]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blob - test/grsecurity-2.2.2-2.6.32.46-201110250925.patch
projects / thirdparty / grsecurity-scrape.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-2.2.2-2.6.32.46-201110250925.patch
1 diff -urNp linux-2.6.32.46/arch/alpha/include/asm/elf.h linux-2.6.32.46/arch/alpha/include/asm/elf.h
2 --- linux-2.6.32.46/arch/alpha/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
3 +++ linux-2.6.32.46/arch/alpha/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
4 @@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
5
6 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
7
8 +#ifdef CONFIG_PAX_ASLR
9 +#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
10 +
11 +#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
12 +#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
13 +#endif
14 +
15 /* $0 is set by ld.so to a pointer to a function which might be
16 registered using atexit. This provides a mean for the dynamic
17 linker to call DT_FINI functions for shared libraries that have
18 diff -urNp linux-2.6.32.46/arch/alpha/include/asm/pgtable.h linux-2.6.32.46/arch/alpha/include/asm/pgtable.h
19 --- linux-2.6.32.46/arch/alpha/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
20 +++ linux-2.6.32.46/arch/alpha/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
21 @@ -101,6 +101,17 @@ struct vm_area_struct;
22 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
23 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
24 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
25 +
26 +#ifdef CONFIG_PAX_PAGEEXEC
27 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
28 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
29 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
30 +#else
31 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
32 +# define PAGE_COPY_NOEXEC PAGE_COPY
33 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
34 +#endif
35 +
36 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
37
38 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
39 diff -urNp linux-2.6.32.46/arch/alpha/kernel/module.c linux-2.6.32.46/arch/alpha/kernel/module.c
40 --- linux-2.6.32.46/arch/alpha/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
41 +++ linux-2.6.32.46/arch/alpha/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
42 @@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs,
43
44 /* The small sections were sorted to the end of the segment.
45 The following should definitely cover them. */
46 - gp = (u64)me->module_core + me->core_size - 0x8000;
47 + gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
48 got = sechdrs[me->arch.gotsecindex].sh_addr;
49
50 for (i = 0; i < n; i++) {
51 diff -urNp linux-2.6.32.46/arch/alpha/kernel/osf_sys.c linux-2.6.32.46/arch/alpha/kernel/osf_sys.c
52 --- linux-2.6.32.46/arch/alpha/kernel/osf_sys.c 2011-08-09 18:35:28.000000000 -0400
53 +++ linux-2.6.32.46/arch/alpha/kernel/osf_sys.c 2011-06-13 17:19:47.000000000 -0400
54 @@ -1172,7 +1172,7 @@ arch_get_unmapped_area_1(unsigned long a
55 /* At this point: (!vma || addr < vma->vm_end). */
56 if (limit - len < addr)
57 return -ENOMEM;
58 - if (!vma || addr + len <= vma->vm_start)
59 + if (check_heap_stack_gap(vma, addr, len))
60 return addr;
61 addr = vma->vm_end;
62 vma = vma->vm_next;
63 @@ -1208,6 +1208,10 @@ arch_get_unmapped_area(struct file *filp
64 merely specific addresses, but regions of memory -- perhaps
65 this feature should be incorporated into all ports? */
66
67 +#ifdef CONFIG_PAX_RANDMMAP
68 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
69 +#endif
70 +
71 if (addr) {
72 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
73 if (addr != (unsigned long) -ENOMEM)
74 @@ -1215,8 +1219,8 @@ arch_get_unmapped_area(struct file *filp
75 }
76
77 /* Next, try allocating at TASK_UNMAPPED_BASE. */
78 - addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
79 - len, limit);
80 + addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
81 +
82 if (addr != (unsigned long) -ENOMEM)
83 return addr;
84
85 diff -urNp linux-2.6.32.46/arch/alpha/mm/fault.c linux-2.6.32.46/arch/alpha/mm/fault.c
86 --- linux-2.6.32.46/arch/alpha/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
87 +++ linux-2.6.32.46/arch/alpha/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
88 @@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
89 __reload_thread(pcb);
90 }
91
92 +#ifdef CONFIG_PAX_PAGEEXEC
93 +/*
94 + * PaX: decide what to do with offenders (regs->pc = fault address)
95 + *
96 + * returns 1 when task should be killed
97 + * 2 when patched PLT trampoline was detected
98 + * 3 when unpatched PLT trampoline was detected
99 + */
100 +static int pax_handle_fetch_fault(struct pt_regs *regs)
101 +{
102 +
103 +#ifdef CONFIG_PAX_EMUPLT
104 + int err;
105 +
106 + do { /* PaX: patched PLT emulation #1 */
107 + unsigned int ldah, ldq, jmp;
108 +
109 + err = get_user(ldah, (unsigned int *)regs->pc);
110 + err |= get_user(ldq, (unsigned int *)(regs->pc+4));
111 + err |= get_user(jmp, (unsigned int *)(regs->pc+8));
112 +
113 + if (err)
114 + break;
115 +
116 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
117 + (ldq & 0xFFFF0000U) == 0xA77B0000U &&
118 + jmp == 0x6BFB0000U)
119 + {
120 + unsigned long r27, addr;
121 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
122 + unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
123 +
124 + addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
125 + err = get_user(r27, (unsigned long *)addr);
126 + if (err)
127 + break;
128 +
129 + regs->r27 = r27;
130 + regs->pc = r27;
131 + return 2;
132 + }
133 + } while (0);
134 +
135 + do { /* PaX: patched PLT emulation #2 */
136 + unsigned int ldah, lda, br;
137 +
138 + err = get_user(ldah, (unsigned int *)regs->pc);
139 + err |= get_user(lda, (unsigned int *)(regs->pc+4));
140 + err |= get_user(br, (unsigned int *)(regs->pc+8));
141 +
142 + if (err)
143 + break;
144 +
145 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
146 + (lda & 0xFFFF0000U) == 0xA77B0000U &&
147 + (br & 0xFFE00000U) == 0xC3E00000U)
148 + {
149 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
150 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
151 + unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
152 +
153 + regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
154 + regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
155 + return 2;
156 + }
157 + } while (0);
158 +
159 + do { /* PaX: unpatched PLT emulation */
160 + unsigned int br;
161 +
162 + err = get_user(br, (unsigned int *)regs->pc);
163 +
164 + if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
165 + unsigned int br2, ldq, nop, jmp;
166 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
167 +
168 + addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
169 + err = get_user(br2, (unsigned int *)addr);
170 + err |= get_user(ldq, (unsigned int *)(addr+4));
171 + err |= get_user(nop, (unsigned int *)(addr+8));
172 + err |= get_user(jmp, (unsigned int *)(addr+12));
173 + err |= get_user(resolver, (unsigned long *)(addr+16));
174 +
175 + if (err)
176 + break;
177 +
178 + if (br2 == 0xC3600000U &&
179 + ldq == 0xA77B000CU &&
180 + nop == 0x47FF041FU &&
181 + jmp == 0x6B7B0000U)
182 + {
183 + regs->r28 = regs->pc+4;
184 + regs->r27 = addr+16;
185 + regs->pc = resolver;
186 + return 3;
187 + }
188 + }
189 + } while (0);
190 +#endif
191 +
192 + return 1;
193 +}
194 +
195 +void pax_report_insns(void *pc, void *sp)
196 +{
197 + unsigned long i;
198 +
199 + printk(KERN_ERR "PAX: bytes at PC: ");
200 + for (i = 0; i < 5; i++) {
201 + unsigned int c;
202 + if (get_user(c, (unsigned int *)pc+i))
203 + printk(KERN_CONT "???????? ");
204 + else
205 + printk(KERN_CONT "%08x ", c);
206 + }
207 + printk("\n");
208 +}
209 +#endif
210
211 /*
212 * This routine handles page faults. It determines the address,
213 @@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
214 good_area:
215 si_code = SEGV_ACCERR;
216 if (cause < 0) {
217 - if (!(vma->vm_flags & VM_EXEC))
218 + if (!(vma->vm_flags & VM_EXEC)) {
219 +
220 +#ifdef CONFIG_PAX_PAGEEXEC
221 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
222 + goto bad_area;
223 +
224 + up_read(&mm->mmap_sem);
225 + switch (pax_handle_fetch_fault(regs)) {
226 +
227 +#ifdef CONFIG_PAX_EMUPLT
228 + case 2:
229 + case 3:
230 + return;
231 +#endif
232 +
233 + }
234 + pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
235 + do_group_exit(SIGKILL);
236 +#else
237 goto bad_area;
238 +#endif
239 +
240 + }
241 } else if (!cause) {
242 /* Allow reads even for write-only mappings */
243 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
244 diff -urNp linux-2.6.32.46/arch/arm/include/asm/elf.h linux-2.6.32.46/arch/arm/include/asm/elf.h
245 --- linux-2.6.32.46/arch/arm/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
246 +++ linux-2.6.32.46/arch/arm/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
247 @@ -109,7 +109,14 @@ int dump_task_regs(struct task_struct *t
248 the loader. We need to make sure that it is out of the way of the program
249 that it will "exec", and that there is sufficient room for the brk. */
250
251 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
252 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
253 +
254 +#ifdef CONFIG_PAX_ASLR
255 +#define PAX_ELF_ET_DYN_BASE 0x00008000UL
256 +
257 +#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
258 +#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
259 +#endif
260
261 /* When the program starts, a1 contains a pointer to a function to be
262 registered with atexit, as per the SVR4 ABI. A value of 0 means we
263 diff -urNp linux-2.6.32.46/arch/arm/include/asm/kmap_types.h linux-2.6.32.46/arch/arm/include/asm/kmap_types.h
264 --- linux-2.6.32.46/arch/arm/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
265 +++ linux-2.6.32.46/arch/arm/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
266 @@ -19,6 +19,7 @@ enum km_type {
267 KM_SOFTIRQ0,
268 KM_SOFTIRQ1,
269 KM_L2_CACHE,
270 + KM_CLEARPAGE,
271 KM_TYPE_NR
272 };
273
274 diff -urNp linux-2.6.32.46/arch/arm/include/asm/uaccess.h linux-2.6.32.46/arch/arm/include/asm/uaccess.h
275 --- linux-2.6.32.46/arch/arm/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
276 +++ linux-2.6.32.46/arch/arm/include/asm/uaccess.h 2011-06-29 21:02:24.000000000 -0400
277 @@ -22,6 +22,8 @@
278 #define VERIFY_READ 0
279 #define VERIFY_WRITE 1
280
281 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
282 +
283 /*
284 * The exception table consists of pairs of addresses: the first is the
285 * address of an instruction that is allowed to fault, and the second is
286 @@ -387,8 +389,23 @@ do { \
287
288
289 #ifdef CONFIG_MMU
290 -extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
291 -extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
292 +extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
293 +extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
294 +
295 +static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
296 +{
297 + if (!__builtin_constant_p(n))
298 + check_object_size(to, n, false);
299 + return ___copy_from_user(to, from, n);
300 +}
301 +
302 +static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
303 +{
304 + if (!__builtin_constant_p(n))
305 + check_object_size(from, n, true);
306 + return ___copy_to_user(to, from, n);
307 +}
308 +
309 extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
310 extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
311 extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
312 @@ -403,6 +420,9 @@ extern unsigned long __must_check __strn
313
314 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
315 {
316 + if ((long)n < 0)
317 + return n;
318 +
319 if (access_ok(VERIFY_READ, from, n))
320 n = __copy_from_user(to, from, n);
321 else /* security hole - plug it */
322 @@ -412,6 +432,9 @@ static inline unsigned long __must_check
323
324 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
325 {
326 + if ((long)n < 0)
327 + return n;
328 +
329 if (access_ok(VERIFY_WRITE, to, n))
330 n = __copy_to_user(to, from, n);
331 return n;
332 diff -urNp linux-2.6.32.46/arch/arm/kernel/armksyms.c linux-2.6.32.46/arch/arm/kernel/armksyms.c
333 --- linux-2.6.32.46/arch/arm/kernel/armksyms.c 2011-03-27 14:31:47.000000000 -0400
334 +++ linux-2.6.32.46/arch/arm/kernel/armksyms.c 2011-07-06 19:51:50.000000000 -0400
335 @@ -118,8 +118,8 @@ EXPORT_SYMBOL(__strncpy_from_user);
336 #ifdef CONFIG_MMU
337 EXPORT_SYMBOL(copy_page);
338
339 -EXPORT_SYMBOL(__copy_from_user);
340 -EXPORT_SYMBOL(__copy_to_user);
341 +EXPORT_SYMBOL(___copy_from_user);
342 +EXPORT_SYMBOL(___copy_to_user);
343 EXPORT_SYMBOL(__clear_user);
344
345 EXPORT_SYMBOL(__get_user_1);
346 diff -urNp linux-2.6.32.46/arch/arm/kernel/kgdb.c linux-2.6.32.46/arch/arm/kernel/kgdb.c
347 --- linux-2.6.32.46/arch/arm/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
348 +++ linux-2.6.32.46/arch/arm/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
349 @@ -190,7 +190,7 @@ void kgdb_arch_exit(void)
350 * and we handle the normal undef case within the do_undefinstr
351 * handler.
352 */
353 -struct kgdb_arch arch_kgdb_ops = {
354 +const struct kgdb_arch arch_kgdb_ops = {
355 #ifndef __ARMEB__
356 .gdb_bpt_instr = {0xfe, 0xde, 0xff, 0xe7}
357 #else /* ! __ARMEB__ */
358 diff -urNp linux-2.6.32.46/arch/arm/kernel/traps.c linux-2.6.32.46/arch/arm/kernel/traps.c
359 --- linux-2.6.32.46/arch/arm/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
360 +++ linux-2.6.32.46/arch/arm/kernel/traps.c 2011-06-13 21:31:18.000000000 -0400
361 @@ -247,6 +247,8 @@ static void __die(const char *str, int e
362
363 DEFINE_SPINLOCK(die_lock);
364
365 +extern void gr_handle_kernel_exploit(void);
366 +
367 /*
368 * This function is protected against re-entrancy.
369 */
370 @@ -271,6 +273,8 @@ NORET_TYPE void die(const char *str, str
371 if (panic_on_oops)
372 panic("Fatal exception");
373
374 + gr_handle_kernel_exploit();
375 +
376 do_exit(SIGSEGV);
377 }
378
379 diff -urNp linux-2.6.32.46/arch/arm/lib/copy_from_user.S linux-2.6.32.46/arch/arm/lib/copy_from_user.S
380 --- linux-2.6.32.46/arch/arm/lib/copy_from_user.S 2011-03-27 14:31:47.000000000 -0400
381 +++ linux-2.6.32.46/arch/arm/lib/copy_from_user.S 2011-06-29 20:48:38.000000000 -0400
382 @@ -16,7 +16,7 @@
383 /*
384 * Prototype:
385 *
386 - * size_t __copy_from_user(void *to, const void *from, size_t n)
387 + * size_t ___copy_from_user(void *to, const void *from, size_t n)
388 *
389 * Purpose:
390 *
391 @@ -84,11 +84,11 @@
392
393 .text
394
395 -ENTRY(__copy_from_user)
396 +ENTRY(___copy_from_user)
397
398 #include "copy_template.S"
399
400 -ENDPROC(__copy_from_user)
401 +ENDPROC(___copy_from_user)
402
403 .section .fixup,"ax"
404 .align 0
405 diff -urNp linux-2.6.32.46/arch/arm/lib/copy_to_user.S linux-2.6.32.46/arch/arm/lib/copy_to_user.S
406 --- linux-2.6.32.46/arch/arm/lib/copy_to_user.S 2011-03-27 14:31:47.000000000 -0400
407 +++ linux-2.6.32.46/arch/arm/lib/copy_to_user.S 2011-06-29 20:46:49.000000000 -0400
408 @@ -16,7 +16,7 @@
409 /*
410 * Prototype:
411 *
412 - * size_t __copy_to_user(void *to, const void *from, size_t n)
413 + * size_t ___copy_to_user(void *to, const void *from, size_t n)
414 *
415 * Purpose:
416 *
417 @@ -88,11 +88,11 @@
418 .text
419
420 ENTRY(__copy_to_user_std)
421 -WEAK(__copy_to_user)
422 +WEAK(___copy_to_user)
423
424 #include "copy_template.S"
425
426 -ENDPROC(__copy_to_user)
427 +ENDPROC(___copy_to_user)
428
429 .section .fixup,"ax"
430 .align 0
431 diff -urNp linux-2.6.32.46/arch/arm/lib/uaccess.S linux-2.6.32.46/arch/arm/lib/uaccess.S
432 --- linux-2.6.32.46/arch/arm/lib/uaccess.S 2011-03-27 14:31:47.000000000 -0400
433 +++ linux-2.6.32.46/arch/arm/lib/uaccess.S 2011-06-29 20:48:53.000000000 -0400
434 @@ -19,7 +19,7 @@
435
436 #define PAGE_SHIFT 12
437
438 -/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
439 +/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n)
440 * Purpose : copy a block to user memory from kernel memory
441 * Params : to - user memory
442 * : from - kernel memory
443 @@ -39,7 +39,7 @@ USER( strgtbt r3, [r0], #1) @ May fau
444 sub r2, r2, ip
445 b .Lc2u_dest_aligned
446
447 -ENTRY(__copy_to_user)
448 +ENTRY(___copy_to_user)
449 stmfd sp!, {r2, r4 - r7, lr}
450 cmp r2, #4
451 blt .Lc2u_not_enough
452 @@ -277,14 +277,14 @@ USER( strgebt r3, [r0], #1) @ May fau
453 ldrgtb r3, [r1], #0
454 USER( strgtbt r3, [r0], #1) @ May fault
455 b .Lc2u_finished
456 -ENDPROC(__copy_to_user)
457 +ENDPROC(___copy_to_user)
458
459 .section .fixup,"ax"
460 .align 0
461 9001: ldmfd sp!, {r0, r4 - r7, pc}
462 .previous
463
464 -/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
465 +/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n);
466 * Purpose : copy a block from user memory to kernel memory
467 * Params : to - kernel memory
468 * : from - user memory
469 @@ -303,7 +303,7 @@ USER( ldrgtbt r3, [r1], #1) @ May fau
470 sub r2, r2, ip
471 b .Lcfu_dest_aligned
472
473 -ENTRY(__copy_from_user)
474 +ENTRY(___copy_from_user)
475 stmfd sp!, {r0, r2, r4 - r7, lr}
476 cmp r2, #4
477 blt .Lcfu_not_enough
478 @@ -543,7 +543,7 @@ USER( ldrgebt r3, [r1], #1) @ May fau
479 USER( ldrgtbt r3, [r1], #1) @ May fault
480 strgtb r3, [r0], #1
481 b .Lcfu_finished
482 -ENDPROC(__copy_from_user)
483 +ENDPROC(___copy_from_user)
484
485 .section .fixup,"ax"
486 .align 0
487 diff -urNp linux-2.6.32.46/arch/arm/lib/uaccess_with_memcpy.c linux-2.6.32.46/arch/arm/lib/uaccess_with_memcpy.c
488 --- linux-2.6.32.46/arch/arm/lib/uaccess_with_memcpy.c 2011-03-27 14:31:47.000000000 -0400
489 +++ linux-2.6.32.46/arch/arm/lib/uaccess_with_memcpy.c 2011-06-29 20:44:35.000000000 -0400
490 @@ -97,7 +97,7 @@ out:
491 }
492
493 unsigned long
494 -__copy_to_user(void __user *to, const void *from, unsigned long n)
495 +___copy_to_user(void __user *to, const void *from, unsigned long n)
496 {
497 /*
498 * This test is stubbed out of the main function above to keep
499 diff -urNp linux-2.6.32.46/arch/arm/mach-at91/pm.c linux-2.6.32.46/arch/arm/mach-at91/pm.c
500 --- linux-2.6.32.46/arch/arm/mach-at91/pm.c 2011-03-27 14:31:47.000000000 -0400
501 +++ linux-2.6.32.46/arch/arm/mach-at91/pm.c 2011-04-17 15:56:45.000000000 -0400
502 @@ -348,7 +348,7 @@ static void at91_pm_end(void)
503 }
504
505
506 -static struct platform_suspend_ops at91_pm_ops ={
507 +static const struct platform_suspend_ops at91_pm_ops ={
508 .valid = at91_pm_valid_state,
509 .begin = at91_pm_begin,
510 .enter = at91_pm_enter,
511 diff -urNp linux-2.6.32.46/arch/arm/mach-omap1/pm.c linux-2.6.32.46/arch/arm/mach-omap1/pm.c
512 --- linux-2.6.32.46/arch/arm/mach-omap1/pm.c 2011-03-27 14:31:47.000000000 -0400
513 +++ linux-2.6.32.46/arch/arm/mach-omap1/pm.c 2011-04-17 15:56:45.000000000 -0400
514 @@ -647,7 +647,7 @@ static struct irqaction omap_wakeup_irq
515
516
517
518 -static struct platform_suspend_ops omap_pm_ops ={
519 +static const struct platform_suspend_ops omap_pm_ops ={
520 .prepare = omap_pm_prepare,
521 .enter = omap_pm_enter,
522 .finish = omap_pm_finish,
523 diff -urNp linux-2.6.32.46/arch/arm/mach-omap2/pm24xx.c linux-2.6.32.46/arch/arm/mach-omap2/pm24xx.c
524 --- linux-2.6.32.46/arch/arm/mach-omap2/pm24xx.c 2011-03-27 14:31:47.000000000 -0400
525 +++ linux-2.6.32.46/arch/arm/mach-omap2/pm24xx.c 2011-04-17 15:56:45.000000000 -0400
526 @@ -326,7 +326,7 @@ static void omap2_pm_finish(void)
527 enable_hlt();
528 }
529
530 -static struct platform_suspend_ops omap_pm_ops = {
531 +static const struct platform_suspend_ops omap_pm_ops = {
532 .prepare = omap2_pm_prepare,
533 .enter = omap2_pm_enter,
534 .finish = omap2_pm_finish,
535 diff -urNp linux-2.6.32.46/arch/arm/mach-omap2/pm34xx.c linux-2.6.32.46/arch/arm/mach-omap2/pm34xx.c
536 --- linux-2.6.32.46/arch/arm/mach-omap2/pm34xx.c 2011-03-27 14:31:47.000000000 -0400
537 +++ linux-2.6.32.46/arch/arm/mach-omap2/pm34xx.c 2011-04-17 15:56:45.000000000 -0400
538 @@ -401,7 +401,7 @@ static void omap3_pm_end(void)
539 return;
540 }
541
542 -static struct platform_suspend_ops omap_pm_ops = {
543 +static const struct platform_suspend_ops omap_pm_ops = {
544 .begin = omap3_pm_begin,
545 .end = omap3_pm_end,
546 .prepare = omap3_pm_prepare,
547 diff -urNp linux-2.6.32.46/arch/arm/mach-pnx4008/pm.c linux-2.6.32.46/arch/arm/mach-pnx4008/pm.c
548 --- linux-2.6.32.46/arch/arm/mach-pnx4008/pm.c 2011-03-27 14:31:47.000000000 -0400
549 +++ linux-2.6.32.46/arch/arm/mach-pnx4008/pm.c 2011-04-17 15:56:45.000000000 -0400
550 @@ -116,7 +116,7 @@ static int pnx4008_pm_valid(suspend_stat
551 (state == PM_SUSPEND_MEM);
552 }
553
554 -static struct platform_suspend_ops pnx4008_pm_ops = {
555 +static const struct platform_suspend_ops pnx4008_pm_ops = {
556 .enter = pnx4008_pm_enter,
557 .valid = pnx4008_pm_valid,
558 };
559 diff -urNp linux-2.6.32.46/arch/arm/mach-pxa/pm.c linux-2.6.32.46/arch/arm/mach-pxa/pm.c
560 --- linux-2.6.32.46/arch/arm/mach-pxa/pm.c 2011-03-27 14:31:47.000000000 -0400
561 +++ linux-2.6.32.46/arch/arm/mach-pxa/pm.c 2011-04-17 15:56:45.000000000 -0400
562 @@ -95,7 +95,7 @@ void pxa_pm_finish(void)
563 pxa_cpu_pm_fns->finish();
564 }
565
566 -static struct platform_suspend_ops pxa_pm_ops = {
567 +static const struct platform_suspend_ops pxa_pm_ops = {
568 .valid = pxa_pm_valid,
569 .enter = pxa_pm_enter,
570 .prepare = pxa_pm_prepare,
571 diff -urNp linux-2.6.32.46/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.32.46/arch/arm/mach-pxa/sharpsl_pm.c
572 --- linux-2.6.32.46/arch/arm/mach-pxa/sharpsl_pm.c 2011-03-27 14:31:47.000000000 -0400
573 +++ linux-2.6.32.46/arch/arm/mach-pxa/sharpsl_pm.c 2011-04-17 15:56:45.000000000 -0400
574 @@ -891,7 +891,7 @@ static void sharpsl_apm_get_power_status
575 }
576
577 #ifdef CONFIG_PM
578 -static struct platform_suspend_ops sharpsl_pm_ops = {
579 +static const struct platform_suspend_ops sharpsl_pm_ops = {
580 .prepare = pxa_pm_prepare,
581 .finish = pxa_pm_finish,
582 .enter = corgi_pxa_pm_enter,
583 diff -urNp linux-2.6.32.46/arch/arm/mach-sa1100/pm.c linux-2.6.32.46/arch/arm/mach-sa1100/pm.c
584 --- linux-2.6.32.46/arch/arm/mach-sa1100/pm.c 2011-03-27 14:31:47.000000000 -0400
585 +++ linux-2.6.32.46/arch/arm/mach-sa1100/pm.c 2011-04-17 15:56:45.000000000 -0400
586 @@ -120,7 +120,7 @@ unsigned long sleep_phys_sp(void *sp)
587 return virt_to_phys(sp);
588 }
589
590 -static struct platform_suspend_ops sa11x0_pm_ops = {
591 +static const struct platform_suspend_ops sa11x0_pm_ops = {
592 .enter = sa11x0_pm_enter,
593 .valid = suspend_valid_only_mem,
594 };
595 diff -urNp linux-2.6.32.46/arch/arm/mm/fault.c linux-2.6.32.46/arch/arm/mm/fault.c
596 --- linux-2.6.32.46/arch/arm/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
597 +++ linux-2.6.32.46/arch/arm/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
598 @@ -166,6 +166,13 @@ __do_user_fault(struct task_struct *tsk,
599 }
600 #endif
601
602 +#ifdef CONFIG_PAX_PAGEEXEC
603 + if (fsr & FSR_LNX_PF) {
604 + pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
605 + do_group_exit(SIGKILL);
606 + }
607 +#endif
608 +
609 tsk->thread.address = addr;
610 tsk->thread.error_code = fsr;
611 tsk->thread.trap_no = 14;
612 @@ -357,6 +364,33 @@ do_page_fault(unsigned long addr, unsign
613 }
614 #endif /* CONFIG_MMU */
615
616 +#ifdef CONFIG_PAX_PAGEEXEC
617 +void pax_report_insns(void *pc, void *sp)
618 +{
619 + long i;
620 +
621 + printk(KERN_ERR "PAX: bytes at PC: ");
622 + for (i = 0; i < 20; i++) {
623 + unsigned char c;
624 + if (get_user(c, (__force unsigned char __user *)pc+i))
625 + printk(KERN_CONT "?? ");
626 + else
627 + printk(KERN_CONT "%02x ", c);
628 + }
629 + printk("\n");
630 +
631 + printk(KERN_ERR "PAX: bytes at SP-4: ");
632 + for (i = -1; i < 20; i++) {
633 + unsigned long c;
634 + if (get_user(c, (__force unsigned long __user *)sp+i))
635 + printk(KERN_CONT "???????? ");
636 + else
637 + printk(KERN_CONT "%08lx ", c);
638 + }
639 + printk("\n");
640 +}
641 +#endif
642 +
643 /*
644 * First Level Translation Fault Handler
645 *
646 diff -urNp linux-2.6.32.46/arch/arm/mm/mmap.c linux-2.6.32.46/arch/arm/mm/mmap.c
647 --- linux-2.6.32.46/arch/arm/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
648 +++ linux-2.6.32.46/arch/arm/mm/mmap.c 2011-04-17 15:56:45.000000000 -0400
649 @@ -63,6 +63,10 @@ arch_get_unmapped_area(struct file *filp
650 if (len > TASK_SIZE)
651 return -ENOMEM;
652
653 +#ifdef CONFIG_PAX_RANDMMAP
654 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
655 +#endif
656 +
657 if (addr) {
658 if (do_align)
659 addr = COLOUR_ALIGN(addr, pgoff);
660 @@ -70,15 +74,14 @@ arch_get_unmapped_area(struct file *filp
661 addr = PAGE_ALIGN(addr);
662
663 vma = find_vma(mm, addr);
664 - if (TASK_SIZE - len >= addr &&
665 - (!vma || addr + len <= vma->vm_start))
666 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
667 return addr;
668 }
669 if (len > mm->cached_hole_size) {
670 - start_addr = addr = mm->free_area_cache;
671 + start_addr = addr = mm->free_area_cache;
672 } else {
673 - start_addr = addr = TASK_UNMAPPED_BASE;
674 - mm->cached_hole_size = 0;
675 + start_addr = addr = mm->mmap_base;
676 + mm->cached_hole_size = 0;
677 }
678
679 full_search:
680 @@ -94,14 +97,14 @@ full_search:
681 * Start a new search - just in case we missed
682 * some holes.
683 */
684 - if (start_addr != TASK_UNMAPPED_BASE) {
685 - start_addr = addr = TASK_UNMAPPED_BASE;
686 + if (start_addr != mm->mmap_base) {
687 + start_addr = addr = mm->mmap_base;
688 mm->cached_hole_size = 0;
689 goto full_search;
690 }
691 return -ENOMEM;
692 }
693 - if (!vma || addr + len <= vma->vm_start) {
694 + if (check_heap_stack_gap(vma, addr, len)) {
695 /*
696 * Remember the place where we stopped the search:
697 */
698 diff -urNp linux-2.6.32.46/arch/arm/plat-s3c/pm.c linux-2.6.32.46/arch/arm/plat-s3c/pm.c
699 --- linux-2.6.32.46/arch/arm/plat-s3c/pm.c 2011-03-27 14:31:47.000000000 -0400
700 +++ linux-2.6.32.46/arch/arm/plat-s3c/pm.c 2011-04-17 15:56:45.000000000 -0400
701 @@ -355,7 +355,7 @@ static void s3c_pm_finish(void)
702 s3c_pm_check_cleanup();
703 }
704
705 -static struct platform_suspend_ops s3c_pm_ops = {
706 +static const struct platform_suspend_ops s3c_pm_ops = {
707 .enter = s3c_pm_enter,
708 .prepare = s3c_pm_prepare,
709 .finish = s3c_pm_finish,
710 diff -urNp linux-2.6.32.46/arch/avr32/include/asm/elf.h linux-2.6.32.46/arch/avr32/include/asm/elf.h
711 --- linux-2.6.32.46/arch/avr32/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
712 +++ linux-2.6.32.46/arch/avr32/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
713 @@ -85,8 +85,14 @@ typedef struct user_fpu_struct elf_fpreg
714 the loader. We need to make sure that it is out of the way of the program
715 that it will "exec", and that there is sufficient room for the brk. */
716
717 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
718 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
719
720 +#ifdef CONFIG_PAX_ASLR
721 +#define PAX_ELF_ET_DYN_BASE 0x00001000UL
722 +
723 +#define PAX_DELTA_MMAP_LEN 15
724 +#define PAX_DELTA_STACK_LEN 15
725 +#endif
726
727 /* This yields a mask that user programs can use to figure out what
728 instruction set this CPU supports. This could be done in user space,
729 diff -urNp linux-2.6.32.46/arch/avr32/include/asm/kmap_types.h linux-2.6.32.46/arch/avr32/include/asm/kmap_types.h
730 --- linux-2.6.32.46/arch/avr32/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
731 +++ linux-2.6.32.46/arch/avr32/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
732 @@ -22,7 +22,8 @@ D(10) KM_IRQ0,
733 D(11) KM_IRQ1,
734 D(12) KM_SOFTIRQ0,
735 D(13) KM_SOFTIRQ1,
736 -D(14) KM_TYPE_NR
737 +D(14) KM_CLEARPAGE,
738 +D(15) KM_TYPE_NR
739 };
740
741 #undef D
742 diff -urNp linux-2.6.32.46/arch/avr32/mach-at32ap/pm.c linux-2.6.32.46/arch/avr32/mach-at32ap/pm.c
743 --- linux-2.6.32.46/arch/avr32/mach-at32ap/pm.c 2011-03-27 14:31:47.000000000 -0400
744 +++ linux-2.6.32.46/arch/avr32/mach-at32ap/pm.c 2011-04-17 15:56:45.000000000 -0400
745 @@ -176,7 +176,7 @@ out:
746 return 0;
747 }
748
749 -static struct platform_suspend_ops avr32_pm_ops = {
750 +static const struct platform_suspend_ops avr32_pm_ops = {
751 .valid = avr32_pm_valid_state,
752 .enter = avr32_pm_enter,
753 };
754 diff -urNp linux-2.6.32.46/arch/avr32/mm/fault.c linux-2.6.32.46/arch/avr32/mm/fault.c
755 --- linux-2.6.32.46/arch/avr32/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
756 +++ linux-2.6.32.46/arch/avr32/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
757 @@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
758
759 int exception_trace = 1;
760
761 +#ifdef CONFIG_PAX_PAGEEXEC
762 +void pax_report_insns(void *pc, void *sp)
763 +{
764 + unsigned long i;
765 +
766 + printk(KERN_ERR "PAX: bytes at PC: ");
767 + for (i = 0; i < 20; i++) {
768 + unsigned char c;
769 + if (get_user(c, (unsigned char *)pc+i))
770 + printk(KERN_CONT "???????? ");
771 + else
772 + printk(KERN_CONT "%02x ", c);
773 + }
774 + printk("\n");
775 +}
776 +#endif
777 +
778 /*
779 * This routine handles page faults. It determines the address and the
780 * problem, and then passes it off to one of the appropriate routines.
781 @@ -157,6 +174,16 @@ bad_area:
782 up_read(&mm->mmap_sem);
783
784 if (user_mode(regs)) {
785 +
786 +#ifdef CONFIG_PAX_PAGEEXEC
787 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
788 + if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
789 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
790 + do_group_exit(SIGKILL);
791 + }
792 + }
793 +#endif
794 +
795 if (exception_trace && printk_ratelimit())
796 printk("%s%s[%d]: segfault at %08lx pc %08lx "
797 "sp %08lx ecr %lu\n",
798 diff -urNp linux-2.6.32.46/arch/blackfin/kernel/kgdb.c linux-2.6.32.46/arch/blackfin/kernel/kgdb.c
799 --- linux-2.6.32.46/arch/blackfin/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
800 +++ linux-2.6.32.46/arch/blackfin/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
801 @@ -428,7 +428,7 @@ int kgdb_arch_handle_exception(int vecto
802 return -1; /* this means that we do not want to exit from the handler */
803 }
804
805 -struct kgdb_arch arch_kgdb_ops = {
806 +const struct kgdb_arch arch_kgdb_ops = {
807 .gdb_bpt_instr = {0xa1},
808 #ifdef CONFIG_SMP
809 .flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
810 diff -urNp linux-2.6.32.46/arch/blackfin/mach-common/pm.c linux-2.6.32.46/arch/blackfin/mach-common/pm.c
811 --- linux-2.6.32.46/arch/blackfin/mach-common/pm.c 2011-03-27 14:31:47.000000000 -0400
812 +++ linux-2.6.32.46/arch/blackfin/mach-common/pm.c 2011-04-17 15:56:45.000000000 -0400
813 @@ -255,7 +255,7 @@ static int bfin_pm_enter(suspend_state_t
814 return 0;
815 }
816
817 -struct platform_suspend_ops bfin_pm_ops = {
818 +const struct platform_suspend_ops bfin_pm_ops = {
819 .enter = bfin_pm_enter,
820 .valid = bfin_pm_valid,
821 };
822 diff -urNp linux-2.6.32.46/arch/frv/include/asm/kmap_types.h linux-2.6.32.46/arch/frv/include/asm/kmap_types.h
823 --- linux-2.6.32.46/arch/frv/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
824 +++ linux-2.6.32.46/arch/frv/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
825 @@ -23,6 +23,7 @@ enum km_type {
826 KM_IRQ1,
827 KM_SOFTIRQ0,
828 KM_SOFTIRQ1,
829 + KM_CLEARPAGE,
830 KM_TYPE_NR
831 };
832
833 diff -urNp linux-2.6.32.46/arch/frv/mm/elf-fdpic.c linux-2.6.32.46/arch/frv/mm/elf-fdpic.c
834 --- linux-2.6.32.46/arch/frv/mm/elf-fdpic.c 2011-03-27 14:31:47.000000000 -0400
835 +++ linux-2.6.32.46/arch/frv/mm/elf-fdpic.c 2011-04-17 15:56:45.000000000 -0400
836 @@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(str
837 if (addr) {
838 addr = PAGE_ALIGN(addr);
839 vma = find_vma(current->mm, addr);
840 - if (TASK_SIZE - len >= addr &&
841 - (!vma || addr + len <= vma->vm_start))
842 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
843 goto success;
844 }
845
846 @@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(str
847 for (; vma; vma = vma->vm_next) {
848 if (addr > limit)
849 break;
850 - if (addr + len <= vma->vm_start)
851 + if (check_heap_stack_gap(vma, addr, len))
852 goto success;
853 addr = vma->vm_end;
854 }
855 @@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(str
856 for (; vma; vma = vma->vm_next) {
857 if (addr > limit)
858 break;
859 - if (addr + len <= vma->vm_start)
860 + if (check_heap_stack_gap(vma, addr, len))
861 goto success;
862 addr = vma->vm_end;
863 }
864 diff -urNp linux-2.6.32.46/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.32.46/arch/ia64/hp/common/hwsw_iommu.c
865 --- linux-2.6.32.46/arch/ia64/hp/common/hwsw_iommu.c 2011-03-27 14:31:47.000000000 -0400
866 +++ linux-2.6.32.46/arch/ia64/hp/common/hwsw_iommu.c 2011-04-17 15:56:45.000000000 -0400
867 @@ -17,7 +17,7 @@
868 #include <linux/swiotlb.h>
869 #include <asm/machvec.h>
870
871 -extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
872 +extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
873
874 /* swiotlb declarations & definitions: */
875 extern int swiotlb_late_init_with_default_size (size_t size);
876 @@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
877 !sba_dma_ops.dma_supported(dev, *dev->dma_mask);
878 }
879
880 -struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
881 +const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
882 {
883 if (use_swiotlb(dev))
884 return &swiotlb_dma_ops;
885 diff -urNp linux-2.6.32.46/arch/ia64/hp/common/sba_iommu.c linux-2.6.32.46/arch/ia64/hp/common/sba_iommu.c
886 --- linux-2.6.32.46/arch/ia64/hp/common/sba_iommu.c 2011-03-27 14:31:47.000000000 -0400
887 +++ linux-2.6.32.46/arch/ia64/hp/common/sba_iommu.c 2011-04-17 15:56:45.000000000 -0400
888 @@ -2097,7 +2097,7 @@ static struct acpi_driver acpi_sba_ioc_d
889 },
890 };
891
892 -extern struct dma_map_ops swiotlb_dma_ops;
893 +extern const struct dma_map_ops swiotlb_dma_ops;
894
895 static int __init
896 sba_init(void)
897 @@ -2211,7 +2211,7 @@ sba_page_override(char *str)
898
899 __setup("sbapagesize=",sba_page_override);
900
901 -struct dma_map_ops sba_dma_ops = {
902 +const struct dma_map_ops sba_dma_ops = {
903 .alloc_coherent = sba_alloc_coherent,
904 .free_coherent = sba_free_coherent,
905 .map_page = sba_map_page,
906 diff -urNp linux-2.6.32.46/arch/ia64/ia32/binfmt_elf32.c linux-2.6.32.46/arch/ia64/ia32/binfmt_elf32.c
907 --- linux-2.6.32.46/arch/ia64/ia32/binfmt_elf32.c 2011-03-27 14:31:47.000000000 -0400
908 +++ linux-2.6.32.46/arch/ia64/ia32/binfmt_elf32.c 2011-04-17 15:56:45.000000000 -0400
909 @@ -45,6 +45,13 @@ randomize_stack_top(unsigned long stack_
910
911 #define elf_read_implies_exec(ex, have_pt_gnu_stack) (!(have_pt_gnu_stack))
912
913 +#ifdef CONFIG_PAX_ASLR
914 +#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
915 +
916 +#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
917 +#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
918 +#endif
919 +
920 /* Ugly but avoids duplication */
921 #include "../../../fs/binfmt_elf.c"
922
923 diff -urNp linux-2.6.32.46/arch/ia64/ia32/ia32priv.h linux-2.6.32.46/arch/ia64/ia32/ia32priv.h
924 --- linux-2.6.32.46/arch/ia64/ia32/ia32priv.h 2011-03-27 14:31:47.000000000 -0400
925 +++ linux-2.6.32.46/arch/ia64/ia32/ia32priv.h 2011-04-17 15:56:45.000000000 -0400
926 @@ -296,7 +296,14 @@ typedef struct compat_siginfo {
927 #define ELF_DATA ELFDATA2LSB
928 #define ELF_ARCH EM_386
929
930 -#define IA32_STACK_TOP IA32_PAGE_OFFSET
931 +#ifdef CONFIG_PAX_RANDUSTACK
932 +#define __IA32_DELTA_STACK (current->mm->delta_stack)
933 +#else
934 +#define __IA32_DELTA_STACK 0UL
935 +#endif
936 +
937 +#define IA32_STACK_TOP (IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
938 +
939 #define IA32_GATE_OFFSET IA32_PAGE_OFFSET
940 #define IA32_GATE_END IA32_PAGE_OFFSET + PAGE_SIZE
941
942 diff -urNp linux-2.6.32.46/arch/ia64/include/asm/dma-mapping.h linux-2.6.32.46/arch/ia64/include/asm/dma-mapping.h
943 --- linux-2.6.32.46/arch/ia64/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
944 +++ linux-2.6.32.46/arch/ia64/include/asm/dma-mapping.h 2011-04-17 15:56:45.000000000 -0400
945 @@ -12,7 +12,7 @@
946
947 #define ARCH_HAS_DMA_GET_REQUIRED_MASK
948
949 -extern struct dma_map_ops *dma_ops;
950 +extern const struct dma_map_ops *dma_ops;
951 extern struct ia64_machine_vector ia64_mv;
952 extern void set_iommu_machvec(void);
953
954 @@ -24,7 +24,7 @@ extern void machvec_dma_sync_sg(struct d
955 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
956 dma_addr_t *daddr, gfp_t gfp)
957 {
958 - struct dma_map_ops *ops = platform_dma_get_ops(dev);
959 + const struct dma_map_ops *ops = platform_dma_get_ops(dev);
960 void *caddr;
961
962 caddr = ops->alloc_coherent(dev, size, daddr, gfp);
963 @@ -35,7 +35,7 @@ static inline void *dma_alloc_coherent(s
964 static inline void dma_free_coherent(struct device *dev, size_t size,
965 void *caddr, dma_addr_t daddr)
966 {
967 - struct dma_map_ops *ops = platform_dma_get_ops(dev);
968 + const struct dma_map_ops *ops = platform_dma_get_ops(dev);
969 debug_dma_free_coherent(dev, size, caddr, daddr);
970 ops->free_coherent(dev, size, caddr, daddr);
971 }
972 @@ -49,13 +49,13 @@ static inline void dma_free_coherent(str
973
974 static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
975 {
976 - struct dma_map_ops *ops = platform_dma_get_ops(dev);
977 + const struct dma_map_ops *ops = platform_dma_get_ops(dev);
978 return ops->mapping_error(dev, daddr);
979 }
980
981 static inline int dma_supported(struct device *dev, u64 mask)
982 {
983 - struct dma_map_ops *ops = platform_dma_get_ops(dev);
984 + const struct dma_map_ops *ops = platform_dma_get_ops(dev);
985 return ops->dma_supported(dev, mask);
986 }
987
988 diff -urNp linux-2.6.32.46/arch/ia64/include/asm/elf.h linux-2.6.32.46/arch/ia64/include/asm/elf.h
989 --- linux-2.6.32.46/arch/ia64/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
990 +++ linux-2.6.32.46/arch/ia64/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
991 @@ -43,6 +43,13 @@
992 */
993 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
994
995 +#ifdef CONFIG_PAX_ASLR
996 +#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
997 +
998 +#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
999 +#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1000 +#endif
1001 +
1002 #define PT_IA_64_UNWIND 0x70000001
1003
1004 /* IA-64 relocations: */
1005 diff -urNp linux-2.6.32.46/arch/ia64/include/asm/machvec.h linux-2.6.32.46/arch/ia64/include/asm/machvec.h
1006 --- linux-2.6.32.46/arch/ia64/include/asm/machvec.h 2011-03-27 14:31:47.000000000 -0400
1007 +++ linux-2.6.32.46/arch/ia64/include/asm/machvec.h 2011-04-17 15:56:45.000000000 -0400
1008 @@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
1009 /* DMA-mapping interface: */
1010 typedef void ia64_mv_dma_init (void);
1011 typedef u64 ia64_mv_dma_get_required_mask (struct device *);
1012 -typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1013 +typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1014
1015 /*
1016 * WARNING: The legacy I/O space is _architected_. Platforms are
1017 @@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
1018 # endif /* CONFIG_IA64_GENERIC */
1019
1020 extern void swiotlb_dma_init(void);
1021 -extern struct dma_map_ops *dma_get_ops(struct device *);
1022 +extern const struct dma_map_ops *dma_get_ops(struct device *);
1023
1024 /*
1025 * Define default versions so we can extend machvec for new platforms without having
1026 diff -urNp linux-2.6.32.46/arch/ia64/include/asm/pgtable.h linux-2.6.32.46/arch/ia64/include/asm/pgtable.h
1027 --- linux-2.6.32.46/arch/ia64/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
1028 +++ linux-2.6.32.46/arch/ia64/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
1029 @@ -12,7 +12,7 @@
1030 * David Mosberger-Tang <davidm@hpl.hp.com>
1031 */
1032
1033 -
1034 +#include <linux/const.h>
1035 #include <asm/mman.h>
1036 #include <asm/page.h>
1037 #include <asm/processor.h>
1038 @@ -143,6 +143,17 @@
1039 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1040 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1041 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
1042 +
1043 +#ifdef CONFIG_PAX_PAGEEXEC
1044 +# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
1045 +# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1046 +# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1047 +#else
1048 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
1049 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
1050 +# define PAGE_COPY_NOEXEC PAGE_COPY
1051 +#endif
1052 +
1053 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
1054 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
1055 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
1056 diff -urNp linux-2.6.32.46/arch/ia64/include/asm/spinlock.h linux-2.6.32.46/arch/ia64/include/asm/spinlock.h
1057 --- linux-2.6.32.46/arch/ia64/include/asm/spinlock.h 2011-03-27 14:31:47.000000000 -0400
1058 +++ linux-2.6.32.46/arch/ia64/include/asm/spinlock.h 2011-04-17 15:56:45.000000000 -0400
1059 @@ -72,7 +72,7 @@ static __always_inline void __ticket_spi
1060 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
1061
1062 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
1063 - ACCESS_ONCE(*p) = (tmp + 2) & ~1;
1064 + ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
1065 }
1066
1067 static __always_inline void __ticket_spin_unlock_wait(raw_spinlock_t *lock)
1068 diff -urNp linux-2.6.32.46/arch/ia64/include/asm/uaccess.h linux-2.6.32.46/arch/ia64/include/asm/uaccess.h
1069 --- linux-2.6.32.46/arch/ia64/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
1070 +++ linux-2.6.32.46/arch/ia64/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
1071 @@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
1072 const void *__cu_from = (from); \
1073 long __cu_len = (n); \
1074 \
1075 - if (__access_ok(__cu_to, __cu_len, get_fs())) \
1076 + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
1077 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
1078 __cu_len; \
1079 })
1080 @@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
1081 long __cu_len = (n); \
1082 \
1083 __chk_user_ptr(__cu_from); \
1084 - if (__access_ok(__cu_from, __cu_len, get_fs())) \
1085 + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
1086 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
1087 __cu_len; \
1088 })
1089 diff -urNp linux-2.6.32.46/arch/ia64/kernel/dma-mapping.c linux-2.6.32.46/arch/ia64/kernel/dma-mapping.c
1090 --- linux-2.6.32.46/arch/ia64/kernel/dma-mapping.c 2011-03-27 14:31:47.000000000 -0400
1091 +++ linux-2.6.32.46/arch/ia64/kernel/dma-mapping.c 2011-04-17 15:56:45.000000000 -0400
1092 @@ -3,7 +3,7 @@
1093 /* Set this to 1 if there is a HW IOMMU in the system */
1094 int iommu_detected __read_mostly;
1095
1096 -struct dma_map_ops *dma_ops;
1097 +const struct dma_map_ops *dma_ops;
1098 EXPORT_SYMBOL(dma_ops);
1099
1100 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
1101 @@ -16,7 +16,7 @@ static int __init dma_init(void)
1102 }
1103 fs_initcall(dma_init);
1104
1105 -struct dma_map_ops *dma_get_ops(struct device *dev)
1106 +const struct dma_map_ops *dma_get_ops(struct device *dev)
1107 {
1108 return dma_ops;
1109 }
1110 diff -urNp linux-2.6.32.46/arch/ia64/kernel/module.c linux-2.6.32.46/arch/ia64/kernel/module.c
1111 --- linux-2.6.32.46/arch/ia64/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
1112 +++ linux-2.6.32.46/arch/ia64/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
1113 @@ -315,8 +315,7 @@ module_alloc (unsigned long size)
1114 void
1115 module_free (struct module *mod, void *module_region)
1116 {
1117 - if (mod && mod->arch.init_unw_table &&
1118 - module_region == mod->module_init) {
1119 + if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
1120 unw_remove_unwind_table(mod->arch.init_unw_table);
1121 mod->arch.init_unw_table = NULL;
1122 }
1123 @@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
1124 }
1125
1126 static inline int
1127 +in_init_rx (const struct module *mod, uint64_t addr)
1128 +{
1129 + return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
1130 +}
1131 +
1132 +static inline int
1133 +in_init_rw (const struct module *mod, uint64_t addr)
1134 +{
1135 + return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
1136 +}
1137 +
1138 +static inline int
1139 in_init (const struct module *mod, uint64_t addr)
1140 {
1141 - return addr - (uint64_t) mod->module_init < mod->init_size;
1142 + return in_init_rx(mod, addr) || in_init_rw(mod, addr);
1143 +}
1144 +
1145 +static inline int
1146 +in_core_rx (const struct module *mod, uint64_t addr)
1147 +{
1148 + return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
1149 +}
1150 +
1151 +static inline int
1152 +in_core_rw (const struct module *mod, uint64_t addr)
1153 +{
1154 + return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
1155 }
1156
1157 static inline int
1158 in_core (const struct module *mod, uint64_t addr)
1159 {
1160 - return addr - (uint64_t) mod->module_core < mod->core_size;
1161 + return in_core_rx(mod, addr) || in_core_rw(mod, addr);
1162 }
1163
1164 static inline int
1165 @@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
1166 break;
1167
1168 case RV_BDREL:
1169 - val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
1170 + if (in_init_rx(mod, val))
1171 + val -= (uint64_t) mod->module_init_rx;
1172 + else if (in_init_rw(mod, val))
1173 + val -= (uint64_t) mod->module_init_rw;
1174 + else if (in_core_rx(mod, val))
1175 + val -= (uint64_t) mod->module_core_rx;
1176 + else if (in_core_rw(mod, val))
1177 + val -= (uint64_t) mod->module_core_rw;
1178 break;
1179
1180 case RV_LTV:
1181 @@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
1182 * addresses have been selected...
1183 */
1184 uint64_t gp;
1185 - if (mod->core_size > MAX_LTOFF)
1186 + if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
1187 /*
1188 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
1189 * at the end of the module.
1190 */
1191 - gp = mod->core_size - MAX_LTOFF / 2;
1192 + gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
1193 else
1194 - gp = mod->core_size / 2;
1195 - gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
1196 + gp = (mod->core_size_rx + mod->core_size_rw) / 2;
1197 + gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
1198 mod->arch.gp = gp;
1199 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
1200 }
1201 diff -urNp linux-2.6.32.46/arch/ia64/kernel/pci-dma.c linux-2.6.32.46/arch/ia64/kernel/pci-dma.c
1202 --- linux-2.6.32.46/arch/ia64/kernel/pci-dma.c 2011-03-27 14:31:47.000000000 -0400
1203 +++ linux-2.6.32.46/arch/ia64/kernel/pci-dma.c 2011-04-17 15:56:45.000000000 -0400
1204 @@ -43,7 +43,7 @@ struct device fallback_dev = {
1205 .dma_mask = &fallback_dev.coherent_dma_mask,
1206 };
1207
1208 -extern struct dma_map_ops intel_dma_ops;
1209 +extern const struct dma_map_ops intel_dma_ops;
1210
1211 static int __init pci_iommu_init(void)
1212 {
1213 @@ -96,15 +96,34 @@ int iommu_dma_supported(struct device *d
1214 }
1215 EXPORT_SYMBOL(iommu_dma_supported);
1216
1217 +extern void *intel_alloc_coherent(struct device *hwdev, size_t size, dma_addr_t *dma_handle, gfp_t flags);
1218 +extern void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr, dma_addr_t dma_handle);
1219 +extern int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems, enum dma_data_direction dir, struct dma_attrs *attrs);
1220 +extern void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist, int nelems, enum dma_data_direction dir, struct dma_attrs *attrs);
1221 +extern dma_addr_t intel_map_page(struct device *dev, struct page *page, unsigned long offset, size_t size, enum dma_data_direction dir, struct dma_attrs *attrs);
1222 +extern void intel_unmap_page(struct device *dev, dma_addr_t dev_addr, size_t size, enum dma_data_direction dir, struct dma_attrs *attrs);
1223 +extern int intel_mapping_error(struct device *dev, dma_addr_t dma_addr);
1224 +
1225 +static const struct dma_map_ops intel_iommu_dma_ops = {
1226 + /* from drivers/pci/intel-iommu.c:intel_dma_ops */
1227 + .alloc_coherent = intel_alloc_coherent,
1228 + .free_coherent = intel_free_coherent,
1229 + .map_sg = intel_map_sg,
1230 + .unmap_sg = intel_unmap_sg,
1231 + .map_page = intel_map_page,
1232 + .unmap_page = intel_unmap_page,
1233 + .mapping_error = intel_mapping_error,
1234 +
1235 + .sync_single_for_cpu = machvec_dma_sync_single,
1236 + .sync_sg_for_cpu = machvec_dma_sync_sg,
1237 + .sync_single_for_device = machvec_dma_sync_single,
1238 + .sync_sg_for_device = machvec_dma_sync_sg,
1239 + .dma_supported = iommu_dma_supported,
1240 +};
1241 +
1242 void __init pci_iommu_alloc(void)
1243 {
1244 - dma_ops = &intel_dma_ops;
1245 -
1246 - dma_ops->sync_single_for_cpu = machvec_dma_sync_single;
1247 - dma_ops->sync_sg_for_cpu = machvec_dma_sync_sg;
1248 - dma_ops->sync_single_for_device = machvec_dma_sync_single;
1249 - dma_ops->sync_sg_for_device = machvec_dma_sync_sg;
1250 - dma_ops->dma_supported = iommu_dma_supported;
1251 + dma_ops = &intel_iommu_dma_ops;
1252
1253 /*
1254 * The order of these functions is important for
1255 diff -urNp linux-2.6.32.46/arch/ia64/kernel/pci-swiotlb.c linux-2.6.32.46/arch/ia64/kernel/pci-swiotlb.c
1256 --- linux-2.6.32.46/arch/ia64/kernel/pci-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
1257 +++ linux-2.6.32.46/arch/ia64/kernel/pci-swiotlb.c 2011-04-17 15:56:45.000000000 -0400
1258 @@ -21,7 +21,7 @@ static void *ia64_swiotlb_alloc_coherent
1259 return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
1260 }
1261
1262 -struct dma_map_ops swiotlb_dma_ops = {
1263 +const struct dma_map_ops swiotlb_dma_ops = {
1264 .alloc_coherent = ia64_swiotlb_alloc_coherent,
1265 .free_coherent = swiotlb_free_coherent,
1266 .map_page = swiotlb_map_page,
1267 diff -urNp linux-2.6.32.46/arch/ia64/kernel/sys_ia64.c linux-2.6.32.46/arch/ia64/kernel/sys_ia64.c
1268 --- linux-2.6.32.46/arch/ia64/kernel/sys_ia64.c 2011-03-27 14:31:47.000000000 -0400
1269 +++ linux-2.6.32.46/arch/ia64/kernel/sys_ia64.c 2011-04-17 15:56:45.000000000 -0400
1270 @@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
1271 if (REGION_NUMBER(addr) == RGN_HPAGE)
1272 addr = 0;
1273 #endif
1274 +
1275 +#ifdef CONFIG_PAX_RANDMMAP
1276 + if (mm->pax_flags & MF_PAX_RANDMMAP)
1277 + addr = mm->free_area_cache;
1278 + else
1279 +#endif
1280 +
1281 if (!addr)
1282 addr = mm->free_area_cache;
1283
1284 @@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *fil
1285 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
1286 /* At this point: (!vma || addr < vma->vm_end). */
1287 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
1288 - if (start_addr != TASK_UNMAPPED_BASE) {
1289 + if (start_addr != mm->mmap_base) {
1290 /* Start a new search --- just in case we missed some holes. */
1291 - addr = TASK_UNMAPPED_BASE;
1292 + addr = mm->mmap_base;
1293 goto full_search;
1294 }
1295 return -ENOMEM;
1296 }
1297 - if (!vma || addr + len <= vma->vm_start) {
1298 + if (check_heap_stack_gap(vma, addr, len)) {
1299 /* Remember the address where we stopped this search: */
1300 mm->free_area_cache = addr + len;
1301 return addr;
1302 diff -urNp linux-2.6.32.46/arch/ia64/kernel/topology.c linux-2.6.32.46/arch/ia64/kernel/topology.c
1303 --- linux-2.6.32.46/arch/ia64/kernel/topology.c 2011-03-27 14:31:47.000000000 -0400
1304 +++ linux-2.6.32.46/arch/ia64/kernel/topology.c 2011-04-17 15:56:45.000000000 -0400
1305 @@ -282,7 +282,7 @@ static ssize_t cache_show(struct kobject
1306 return ret;
1307 }
1308
1309 -static struct sysfs_ops cache_sysfs_ops = {
1310 +static const struct sysfs_ops cache_sysfs_ops = {
1311 .show = cache_show
1312 };
1313
1314 diff -urNp linux-2.6.32.46/arch/ia64/kernel/vmlinux.lds.S linux-2.6.32.46/arch/ia64/kernel/vmlinux.lds.S
1315 --- linux-2.6.32.46/arch/ia64/kernel/vmlinux.lds.S 2011-03-27 14:31:47.000000000 -0400
1316 +++ linux-2.6.32.46/arch/ia64/kernel/vmlinux.lds.S 2011-04-17 15:56:45.000000000 -0400
1317 @@ -190,7 +190,7 @@ SECTIONS
1318 /* Per-cpu data: */
1319 . = ALIGN(PERCPU_PAGE_SIZE);
1320 PERCPU_VADDR(PERCPU_ADDR, :percpu)
1321 - __phys_per_cpu_start = __per_cpu_load;
1322 + __phys_per_cpu_start = per_cpu_load;
1323 . = __phys_per_cpu_start + PERCPU_PAGE_SIZE; /* ensure percpu data fits
1324 * into percpu page size
1325 */
1326 diff -urNp linux-2.6.32.46/arch/ia64/mm/fault.c linux-2.6.32.46/arch/ia64/mm/fault.c
1327 --- linux-2.6.32.46/arch/ia64/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
1328 +++ linux-2.6.32.46/arch/ia64/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
1329 @@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned
1330 return pte_present(pte);
1331 }
1332
1333 +#ifdef CONFIG_PAX_PAGEEXEC
1334 +void pax_report_insns(void *pc, void *sp)
1335 +{
1336 + unsigned long i;
1337 +
1338 + printk(KERN_ERR "PAX: bytes at PC: ");
1339 + for (i = 0; i < 8; i++) {
1340 + unsigned int c;
1341 + if (get_user(c, (unsigned int *)pc+i))
1342 + printk(KERN_CONT "???????? ");
1343 + else
1344 + printk(KERN_CONT "%08x ", c);
1345 + }
1346 + printk("\n");
1347 +}
1348 +#endif
1349 +
1350 void __kprobes
1351 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1352 {
1353 @@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
1354 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1355 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1356
1357 - if ((vma->vm_flags & mask) != mask)
1358 + if ((vma->vm_flags & mask) != mask) {
1359 +
1360 +#ifdef CONFIG_PAX_PAGEEXEC
1361 + if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1362 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1363 + goto bad_area;
1364 +
1365 + up_read(&mm->mmap_sem);
1366 + pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1367 + do_group_exit(SIGKILL);
1368 + }
1369 +#endif
1370 +
1371 goto bad_area;
1372
1373 + }
1374 +
1375 survive:
1376 /*
1377 * If for any reason at all we couldn't handle the fault, make
1378 diff -urNp linux-2.6.32.46/arch/ia64/mm/hugetlbpage.c linux-2.6.32.46/arch/ia64/mm/hugetlbpage.c
1379 --- linux-2.6.32.46/arch/ia64/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
1380 +++ linux-2.6.32.46/arch/ia64/mm/hugetlbpage.c 2011-04-17 15:56:45.000000000 -0400
1381 @@ -172,7 +172,7 @@ unsigned long hugetlb_get_unmapped_area(
1382 /* At this point: (!vmm || addr < vmm->vm_end). */
1383 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
1384 return -ENOMEM;
1385 - if (!vmm || (addr + len) <= vmm->vm_start)
1386 + if (check_heap_stack_gap(vmm, addr, len))
1387 return addr;
1388 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
1389 }
1390 diff -urNp linux-2.6.32.46/arch/ia64/mm/init.c linux-2.6.32.46/arch/ia64/mm/init.c
1391 --- linux-2.6.32.46/arch/ia64/mm/init.c 2011-03-27 14:31:47.000000000 -0400
1392 +++ linux-2.6.32.46/arch/ia64/mm/init.c 2011-04-17 15:56:45.000000000 -0400
1393 @@ -122,6 +122,19 @@ ia64_init_addr_space (void)
1394 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1395 vma->vm_end = vma->vm_start + PAGE_SIZE;
1396 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1397 +
1398 +#ifdef CONFIG_PAX_PAGEEXEC
1399 + if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1400 + vma->vm_flags &= ~VM_EXEC;
1401 +
1402 +#ifdef CONFIG_PAX_MPROTECT
1403 + if (current->mm->pax_flags & MF_PAX_MPROTECT)
1404 + vma->vm_flags &= ~VM_MAYEXEC;
1405 +#endif
1406 +
1407 + }
1408 +#endif
1409 +
1410 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1411 down_write(&current->mm->mmap_sem);
1412 if (insert_vm_struct(current->mm, vma)) {
1413 diff -urNp linux-2.6.32.46/arch/ia64/sn/pci/pci_dma.c linux-2.6.32.46/arch/ia64/sn/pci/pci_dma.c
1414 --- linux-2.6.32.46/arch/ia64/sn/pci/pci_dma.c 2011-03-27 14:31:47.000000000 -0400
1415 +++ linux-2.6.32.46/arch/ia64/sn/pci/pci_dma.c 2011-04-17 15:56:45.000000000 -0400
1416 @@ -464,7 +464,7 @@ int sn_pci_legacy_write(struct pci_bus *
1417 return ret;
1418 }
1419
1420 -static struct dma_map_ops sn_dma_ops = {
1421 +static const struct dma_map_ops sn_dma_ops = {
1422 .alloc_coherent = sn_dma_alloc_coherent,
1423 .free_coherent = sn_dma_free_coherent,
1424 .map_page = sn_dma_map_page,
1425 diff -urNp linux-2.6.32.46/arch/m32r/lib/usercopy.c linux-2.6.32.46/arch/m32r/lib/usercopy.c
1426 --- linux-2.6.32.46/arch/m32r/lib/usercopy.c 2011-03-27 14:31:47.000000000 -0400
1427 +++ linux-2.6.32.46/arch/m32r/lib/usercopy.c 2011-04-17 15:56:45.000000000 -0400
1428 @@ -14,6 +14,9 @@
1429 unsigned long
1430 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1431 {
1432 + if ((long)n < 0)
1433 + return n;
1434 +
1435 prefetch(from);
1436 if (access_ok(VERIFY_WRITE, to, n))
1437 __copy_user(to,from,n);
1438 @@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to,
1439 unsigned long
1440 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1441 {
1442 + if ((long)n < 0)
1443 + return n;
1444 +
1445 prefetchw(to);
1446 if (access_ok(VERIFY_READ, from, n))
1447 __copy_user_zeroing(to,from,n);
1448 diff -urNp linux-2.6.32.46/arch/mips/alchemy/devboards/pm.c linux-2.6.32.46/arch/mips/alchemy/devboards/pm.c
1449 --- linux-2.6.32.46/arch/mips/alchemy/devboards/pm.c 2011-03-27 14:31:47.000000000 -0400
1450 +++ linux-2.6.32.46/arch/mips/alchemy/devboards/pm.c 2011-04-17 15:56:45.000000000 -0400
1451 @@ -78,7 +78,7 @@ static void db1x_pm_end(void)
1452
1453 }
1454
1455 -static struct platform_suspend_ops db1x_pm_ops = {
1456 +static const struct platform_suspend_ops db1x_pm_ops = {
1457 .valid = suspend_valid_only_mem,
1458 .begin = db1x_pm_begin,
1459 .enter = db1x_pm_enter,
1460 diff -urNp linux-2.6.32.46/arch/mips/include/asm/elf.h linux-2.6.32.46/arch/mips/include/asm/elf.h
1461 --- linux-2.6.32.46/arch/mips/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
1462 +++ linux-2.6.32.46/arch/mips/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
1463 @@ -368,4 +368,11 @@ extern int dump_task_fpu(struct task_str
1464 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1465 #endif
1466
1467 +#ifdef CONFIG_PAX_ASLR
1468 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
1469 +
1470 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1471 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1472 +#endif
1473 +
1474 #endif /* _ASM_ELF_H */
1475 diff -urNp linux-2.6.32.46/arch/mips/include/asm/page.h linux-2.6.32.46/arch/mips/include/asm/page.h
1476 --- linux-2.6.32.46/arch/mips/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
1477 +++ linux-2.6.32.46/arch/mips/include/asm/page.h 2011-04-17 15:56:45.000000000 -0400
1478 @@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
1479 #ifdef CONFIG_CPU_MIPS32
1480 typedef struct { unsigned long pte_low, pte_high; } pte_t;
1481 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
1482 - #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
1483 + #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
1484 #else
1485 typedef struct { unsigned long long pte; } pte_t;
1486 #define pte_val(x) ((x).pte)
1487 diff -urNp linux-2.6.32.46/arch/mips/include/asm/reboot.h linux-2.6.32.46/arch/mips/include/asm/reboot.h
1488 --- linux-2.6.32.46/arch/mips/include/asm/reboot.h 2011-03-27 14:31:47.000000000 -0400
1489 +++ linux-2.6.32.46/arch/mips/include/asm/reboot.h 2011-08-21 17:35:02.000000000 -0400
1490 @@ -9,7 +9,7 @@
1491 #ifndef _ASM_REBOOT_H
1492 #define _ASM_REBOOT_H
1493
1494 -extern void (*_machine_restart)(char *command);
1495 -extern void (*_machine_halt)(void);
1496 +extern void (*__noreturn _machine_restart)(char *command);
1497 +extern void (*__noreturn _machine_halt)(void);
1498
1499 #endif /* _ASM_REBOOT_H */
1500 diff -urNp linux-2.6.32.46/arch/mips/include/asm/system.h linux-2.6.32.46/arch/mips/include/asm/system.h
1501 --- linux-2.6.32.46/arch/mips/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
1502 +++ linux-2.6.32.46/arch/mips/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
1503 @@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
1504 */
1505 #define __ARCH_WANT_UNLOCKED_CTXSW
1506
1507 -extern unsigned long arch_align_stack(unsigned long sp);
1508 +#define arch_align_stack(x) ((x) & ~0xfUL)
1509
1510 #endif /* _ASM_SYSTEM_H */
1511 diff -urNp linux-2.6.32.46/arch/mips/kernel/binfmt_elfn32.c linux-2.6.32.46/arch/mips/kernel/binfmt_elfn32.c
1512 --- linux-2.6.32.46/arch/mips/kernel/binfmt_elfn32.c 2011-03-27 14:31:47.000000000 -0400
1513 +++ linux-2.6.32.46/arch/mips/kernel/binfmt_elfn32.c 2011-04-17 15:56:45.000000000 -0400
1514 @@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
1515 #undef ELF_ET_DYN_BASE
1516 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1517
1518 +#ifdef CONFIG_PAX_ASLR
1519 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
1520 +
1521 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1522 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1523 +#endif
1524 +
1525 #include <asm/processor.h>
1526 #include <linux/module.h>
1527 #include <linux/elfcore.h>
1528 diff -urNp linux-2.6.32.46/arch/mips/kernel/binfmt_elfo32.c linux-2.6.32.46/arch/mips/kernel/binfmt_elfo32.c
1529 --- linux-2.6.32.46/arch/mips/kernel/binfmt_elfo32.c 2011-03-27 14:31:47.000000000 -0400
1530 +++ linux-2.6.32.46/arch/mips/kernel/binfmt_elfo32.c 2011-04-17 15:56:45.000000000 -0400
1531 @@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
1532 #undef ELF_ET_DYN_BASE
1533 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1534
1535 +#ifdef CONFIG_PAX_ASLR
1536 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
1537 +
1538 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1539 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1540 +#endif
1541 +
1542 #include <asm/processor.h>
1543
1544 /*
1545 diff -urNp linux-2.6.32.46/arch/mips/kernel/kgdb.c linux-2.6.32.46/arch/mips/kernel/kgdb.c
1546 --- linux-2.6.32.46/arch/mips/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
1547 +++ linux-2.6.32.46/arch/mips/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
1548 @@ -245,6 +245,7 @@ int kgdb_arch_handle_exception(int vecto
1549 return -1;
1550 }
1551
1552 +/* cannot be const */
1553 struct kgdb_arch arch_kgdb_ops;
1554
1555 /*
1556 diff -urNp linux-2.6.32.46/arch/mips/kernel/process.c linux-2.6.32.46/arch/mips/kernel/process.c
1557 --- linux-2.6.32.46/arch/mips/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
1558 +++ linux-2.6.32.46/arch/mips/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
1559 @@ -470,15 +470,3 @@ unsigned long get_wchan(struct task_stru
1560 out:
1561 return pc;
1562 }
1563 -
1564 -/*
1565 - * Don't forget that the stack pointer must be aligned on a 8 bytes
1566 - * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
1567 - */
1568 -unsigned long arch_align_stack(unsigned long sp)
1569 -{
1570 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
1571 - sp -= get_random_int() & ~PAGE_MASK;
1572 -
1573 - return sp & ALMASK;
1574 -}
1575 diff -urNp linux-2.6.32.46/arch/mips/kernel/reset.c linux-2.6.32.46/arch/mips/kernel/reset.c
1576 --- linux-2.6.32.46/arch/mips/kernel/reset.c 2011-03-27 14:31:47.000000000 -0400
1577 +++ linux-2.6.32.46/arch/mips/kernel/reset.c 2011-08-21 17:35:26.000000000 -0400
1578 @@ -19,8 +19,8 @@
1579 * So handle all using function pointers to machine specific
1580 * functions.
1581 */
1582 -void (*_machine_restart)(char *command);
1583 -void (*_machine_halt)(void);
1584 +void (*__noreturn _machine_restart)(char *command);
1585 +void (*__noreturn _machine_halt)(void);
1586 void (*pm_power_off)(void);
1587
1588 EXPORT_SYMBOL(pm_power_off);
1589 @@ -29,16 +29,19 @@ void machine_restart(char *command)
1590 {
1591 if (_machine_restart)
1592 _machine_restart(command);
1593 + BUG();
1594 }
1595
1596 void machine_halt(void)
1597 {
1598 if (_machine_halt)
1599 _machine_halt();
1600 + BUG();
1601 }
1602
1603 void machine_power_off(void)
1604 {
1605 if (pm_power_off)
1606 pm_power_off();
1607 + BUG();
1608 }
1609 diff -urNp linux-2.6.32.46/arch/mips/kernel/syscall.c linux-2.6.32.46/arch/mips/kernel/syscall.c
1610 --- linux-2.6.32.46/arch/mips/kernel/syscall.c 2011-03-27 14:31:47.000000000 -0400
1611 +++ linux-2.6.32.46/arch/mips/kernel/syscall.c 2011-04-17 15:56:45.000000000 -0400
1612 @@ -102,17 +102,21 @@ unsigned long arch_get_unmapped_area(str
1613 do_color_align = 0;
1614 if (filp || (flags & MAP_SHARED))
1615 do_color_align = 1;
1616 +
1617 +#ifdef CONFIG_PAX_RANDMMAP
1618 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
1619 +#endif
1620 +
1621 if (addr) {
1622 if (do_color_align)
1623 addr = COLOUR_ALIGN(addr, pgoff);
1624 else
1625 addr = PAGE_ALIGN(addr);
1626 vmm = find_vma(current->mm, addr);
1627 - if (task_size - len >= addr &&
1628 - (!vmm || addr + len <= vmm->vm_start))
1629 + if (task_size - len >= addr && check_heap_stack_gap(vmm, addr, len))
1630 return addr;
1631 }
1632 - addr = TASK_UNMAPPED_BASE;
1633 + addr = current->mm->mmap_base;
1634 if (do_color_align)
1635 addr = COLOUR_ALIGN(addr, pgoff);
1636 else
1637 @@ -122,7 +126,7 @@ unsigned long arch_get_unmapped_area(str
1638 /* At this point: (!vmm || addr < vmm->vm_end). */
1639 if (task_size - len < addr)
1640 return -ENOMEM;
1641 - if (!vmm || addr + len <= vmm->vm_start)
1642 + if (check_heap_stack_gap(vmm, addr, len))
1643 return addr;
1644 addr = vmm->vm_end;
1645 if (do_color_align)
1646 diff -urNp linux-2.6.32.46/arch/mips/Makefile linux-2.6.32.46/arch/mips/Makefile
1647 --- linux-2.6.32.46/arch/mips/Makefile 2011-03-27 14:31:47.000000000 -0400
1648 +++ linux-2.6.32.46/arch/mips/Makefile 2011-08-21 19:26:52.000000000 -0400
1649 @@ -51,6 +51,8 @@ endif
1650 cflags-y := -ffunction-sections
1651 cflags-y += $(call cc-option, -mno-check-zero-division)
1652
1653 +cflags-y += -Wno-sign-compare -Wno-extra
1654 +
1655 ifdef CONFIG_32BIT
1656 ld-emul = $(32bit-emul)
1657 vmlinux-32 = vmlinux
1658 diff -urNp linux-2.6.32.46/arch/mips/mm/fault.c linux-2.6.32.46/arch/mips/mm/fault.c
1659 --- linux-2.6.32.46/arch/mips/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
1660 +++ linux-2.6.32.46/arch/mips/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
1661 @@ -26,6 +26,23 @@
1662 #include <asm/ptrace.h>
1663 #include <asm/highmem.h> /* For VMALLOC_END */
1664
1665 +#ifdef CONFIG_PAX_PAGEEXEC
1666 +void pax_report_insns(void *pc, void *sp)
1667 +{
1668 + unsigned long i;
1669 +
1670 + printk(KERN_ERR "PAX: bytes at PC: ");
1671 + for (i = 0; i < 5; i++) {
1672 + unsigned int c;
1673 + if (get_user(c, (unsigned int *)pc+i))
1674 + printk(KERN_CONT "???????? ");
1675 + else
1676 + printk(KERN_CONT "%08x ", c);
1677 + }
1678 + printk("\n");
1679 +}
1680 +#endif
1681 +
1682 /*
1683 * This routine handles page faults. It determines the address,
1684 * and the problem, and then passes it off to one of the appropriate
1685 diff -urNp linux-2.6.32.46/arch/parisc/include/asm/elf.h linux-2.6.32.46/arch/parisc/include/asm/elf.h
1686 --- linux-2.6.32.46/arch/parisc/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
1687 +++ linux-2.6.32.46/arch/parisc/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
1688 @@ -343,6 +343,13 @@ struct pt_regs; /* forward declaration..
1689
1690 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
1691
1692 +#ifdef CONFIG_PAX_ASLR
1693 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
1694 +
1695 +#define PAX_DELTA_MMAP_LEN 16
1696 +#define PAX_DELTA_STACK_LEN 16
1697 +#endif
1698 +
1699 /* This yields a mask that user programs can use to figure out what
1700 instruction set this CPU supports. This could be done in user space,
1701 but it's not easy, and we've already done it here. */
1702 diff -urNp linux-2.6.32.46/arch/parisc/include/asm/pgtable.h linux-2.6.32.46/arch/parisc/include/asm/pgtable.h
1703 --- linux-2.6.32.46/arch/parisc/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
1704 +++ linux-2.6.32.46/arch/parisc/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
1705 @@ -207,6 +207,17 @@
1706 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
1707 #define PAGE_COPY PAGE_EXECREAD
1708 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
1709 +
1710 +#ifdef CONFIG_PAX_PAGEEXEC
1711 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
1712 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1713 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1714 +#else
1715 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
1716 +# define PAGE_COPY_NOEXEC PAGE_COPY
1717 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
1718 +#endif
1719 +
1720 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
1721 #define PAGE_KERNEL_RO __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
1722 #define PAGE_KERNEL_UNC __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
1723 diff -urNp linux-2.6.32.46/arch/parisc/kernel/module.c linux-2.6.32.46/arch/parisc/kernel/module.c
1724 --- linux-2.6.32.46/arch/parisc/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
1725 +++ linux-2.6.32.46/arch/parisc/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
1726 @@ -95,16 +95,38 @@
1727
1728 /* three functions to determine where in the module core
1729 * or init pieces the location is */
1730 +static inline int in_init_rx(struct module *me, void *loc)
1731 +{
1732 + return (loc >= me->module_init_rx &&
1733 + loc < (me->module_init_rx + me->init_size_rx));
1734 +}
1735 +
1736 +static inline int in_init_rw(struct module *me, void *loc)
1737 +{
1738 + return (loc >= me->module_init_rw &&
1739 + loc < (me->module_init_rw + me->init_size_rw));
1740 +}
1741 +
1742 static inline int in_init(struct module *me, void *loc)
1743 {
1744 - return (loc >= me->module_init &&
1745 - loc <= (me->module_init + me->init_size));
1746 + return in_init_rx(me, loc) || in_init_rw(me, loc);
1747 +}
1748 +
1749 +static inline int in_core_rx(struct module *me, void *loc)
1750 +{
1751 + return (loc >= me->module_core_rx &&
1752 + loc < (me->module_core_rx + me->core_size_rx));
1753 +}
1754 +
1755 +static inline int in_core_rw(struct module *me, void *loc)
1756 +{
1757 + return (loc >= me->module_core_rw &&
1758 + loc < (me->module_core_rw + me->core_size_rw));
1759 }
1760
1761 static inline int in_core(struct module *me, void *loc)
1762 {
1763 - return (loc >= me->module_core &&
1764 - loc <= (me->module_core + me->core_size));
1765 + return in_core_rx(me, loc) || in_core_rw(me, loc);
1766 }
1767
1768 static inline int in_local(struct module *me, void *loc)
1769 @@ -364,13 +386,13 @@ int module_frob_arch_sections(CONST Elf_
1770 }
1771
1772 /* align things a bit */
1773 - me->core_size = ALIGN(me->core_size, 16);
1774 - me->arch.got_offset = me->core_size;
1775 - me->core_size += gots * sizeof(struct got_entry);
1776 -
1777 - me->core_size = ALIGN(me->core_size, 16);
1778 - me->arch.fdesc_offset = me->core_size;
1779 - me->core_size += fdescs * sizeof(Elf_Fdesc);
1780 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
1781 + me->arch.got_offset = me->core_size_rw;
1782 + me->core_size_rw += gots * sizeof(struct got_entry);
1783 +
1784 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
1785 + me->arch.fdesc_offset = me->core_size_rw;
1786 + me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
1787
1788 me->arch.got_max = gots;
1789 me->arch.fdesc_max = fdescs;
1790 @@ -388,7 +410,7 @@ static Elf64_Word get_got(struct module
1791
1792 BUG_ON(value == 0);
1793
1794 - got = me->module_core + me->arch.got_offset;
1795 + got = me->module_core_rw + me->arch.got_offset;
1796 for (i = 0; got[i].addr; i++)
1797 if (got[i].addr == value)
1798 goto out;
1799 @@ -406,7 +428,7 @@ static Elf64_Word get_got(struct module
1800 #ifdef CONFIG_64BIT
1801 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
1802 {
1803 - Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
1804 + Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
1805
1806 if (!value) {
1807 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
1808 @@ -424,7 +446,7 @@ static Elf_Addr get_fdesc(struct module
1809
1810 /* Create new one */
1811 fdesc->addr = value;
1812 - fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1813 + fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1814 return (Elf_Addr)fdesc;
1815 }
1816 #endif /* CONFIG_64BIT */
1817 @@ -848,7 +870,7 @@ register_unwind_table(struct module *me,
1818
1819 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
1820 end = table + sechdrs[me->arch.unwind_section].sh_size;
1821 - gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1822 + gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1823
1824 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
1825 me->arch.unwind_section, table, end, gp);
1826 diff -urNp linux-2.6.32.46/arch/parisc/kernel/sys_parisc.c linux-2.6.32.46/arch/parisc/kernel/sys_parisc.c
1827 --- linux-2.6.32.46/arch/parisc/kernel/sys_parisc.c 2011-03-27 14:31:47.000000000 -0400
1828 +++ linux-2.6.32.46/arch/parisc/kernel/sys_parisc.c 2011-04-17 15:56:45.000000000 -0400
1829 @@ -43,7 +43,7 @@ static unsigned long get_unshared_area(u
1830 /* At this point: (!vma || addr < vma->vm_end). */
1831 if (TASK_SIZE - len < addr)
1832 return -ENOMEM;
1833 - if (!vma || addr + len <= vma->vm_start)
1834 + if (check_heap_stack_gap(vma, addr, len))
1835 return addr;
1836 addr = vma->vm_end;
1837 }
1838 @@ -79,7 +79,7 @@ static unsigned long get_shared_area(str
1839 /* At this point: (!vma || addr < vma->vm_end). */
1840 if (TASK_SIZE - len < addr)
1841 return -ENOMEM;
1842 - if (!vma || addr + len <= vma->vm_start)
1843 + if (check_heap_stack_gap(vma, addr, len))
1844 return addr;
1845 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
1846 if (addr < vma->vm_end) /* handle wraparound */
1847 @@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
1848 if (flags & MAP_FIXED)
1849 return addr;
1850 if (!addr)
1851 - addr = TASK_UNMAPPED_BASE;
1852 + addr = current->mm->mmap_base;
1853
1854 if (filp) {
1855 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
1856 diff -urNp linux-2.6.32.46/arch/parisc/kernel/traps.c linux-2.6.32.46/arch/parisc/kernel/traps.c
1857 --- linux-2.6.32.46/arch/parisc/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
1858 +++ linux-2.6.32.46/arch/parisc/kernel/traps.c 2011-04-17 15:56:45.000000000 -0400
1859 @@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
1860
1861 down_read(&current->mm->mmap_sem);
1862 vma = find_vma(current->mm,regs->iaoq[0]);
1863 - if (vma && (regs->iaoq[0] >= vma->vm_start)
1864 - && (vma->vm_flags & VM_EXEC)) {
1865 -
1866 + if (vma && (regs->iaoq[0] >= vma->vm_start)) {
1867 fault_address = regs->iaoq[0];
1868 fault_space = regs->iasq[0];
1869
1870 diff -urNp linux-2.6.32.46/arch/parisc/mm/fault.c linux-2.6.32.46/arch/parisc/mm/fault.c
1871 --- linux-2.6.32.46/arch/parisc/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
1872 +++ linux-2.6.32.46/arch/parisc/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
1873 @@ -15,6 +15,7 @@
1874 #include <linux/sched.h>
1875 #include <linux/interrupt.h>
1876 #include <linux/module.h>
1877 +#include <linux/unistd.h>
1878
1879 #include <asm/uaccess.h>
1880 #include <asm/traps.h>
1881 @@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
1882 static unsigned long
1883 parisc_acctyp(unsigned long code, unsigned int inst)
1884 {
1885 - if (code == 6 || code == 16)
1886 + if (code == 6 || code == 7 || code == 16)
1887 return VM_EXEC;
1888
1889 switch (inst & 0xf0000000) {
1890 @@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
1891 }
1892 #endif
1893
1894 +#ifdef CONFIG_PAX_PAGEEXEC
1895 +/*
1896 + * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
1897 + *
1898 + * returns 1 when task should be killed
1899 + * 2 when rt_sigreturn trampoline was detected
1900 + * 3 when unpatched PLT trampoline was detected
1901 + */
1902 +static int pax_handle_fetch_fault(struct pt_regs *regs)
1903 +{
1904 +
1905 +#ifdef CONFIG_PAX_EMUPLT
1906 + int err;
1907 +
1908 + do { /* PaX: unpatched PLT emulation */
1909 + unsigned int bl, depwi;
1910 +
1911 + err = get_user(bl, (unsigned int *)instruction_pointer(regs));
1912 + err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
1913 +
1914 + if (err)
1915 + break;
1916 +
1917 + if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
1918 + unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
1919 +
1920 + err = get_user(ldw, (unsigned int *)addr);
1921 + err |= get_user(bv, (unsigned int *)(addr+4));
1922 + err |= get_user(ldw2, (unsigned int *)(addr+8));
1923 +
1924 + if (err)
1925 + break;
1926 +
1927 + if (ldw == 0x0E801096U &&
1928 + bv == 0xEAC0C000U &&
1929 + ldw2 == 0x0E881095U)
1930 + {
1931 + unsigned int resolver, map;
1932 +
1933 + err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
1934 + err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
1935 + if (err)
1936 + break;
1937 +
1938 + regs->gr[20] = instruction_pointer(regs)+8;
1939 + regs->gr[21] = map;
1940 + regs->gr[22] = resolver;
1941 + regs->iaoq[0] = resolver | 3UL;
1942 + regs->iaoq[1] = regs->iaoq[0] + 4;
1943 + return 3;
1944 + }
1945 + }
1946 + } while (0);
1947 +#endif
1948 +
1949 +#ifdef CONFIG_PAX_EMUTRAMP
1950 +
1951 +#ifndef CONFIG_PAX_EMUSIGRT
1952 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
1953 + return 1;
1954 +#endif
1955 +
1956 + do { /* PaX: rt_sigreturn emulation */
1957 + unsigned int ldi1, ldi2, bel, nop;
1958 +
1959 + err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
1960 + err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
1961 + err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
1962 + err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
1963 +
1964 + if (err)
1965 + break;
1966 +
1967 + if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
1968 + ldi2 == 0x3414015AU &&
1969 + bel == 0xE4008200U &&
1970 + nop == 0x08000240U)
1971 + {
1972 + regs->gr[25] = (ldi1 & 2) >> 1;
1973 + regs->gr[20] = __NR_rt_sigreturn;
1974 + regs->gr[31] = regs->iaoq[1] + 16;
1975 + regs->sr[0] = regs->iasq[1];
1976 + regs->iaoq[0] = 0x100UL;
1977 + regs->iaoq[1] = regs->iaoq[0] + 4;
1978 + regs->iasq[0] = regs->sr[2];
1979 + regs->iasq[1] = regs->sr[2];
1980 + return 2;
1981 + }
1982 + } while (0);
1983 +#endif
1984 +
1985 + return 1;
1986 +}
1987 +
1988 +void pax_report_insns(void *pc, void *sp)
1989 +{
1990 + unsigned long i;
1991 +
1992 + printk(KERN_ERR "PAX: bytes at PC: ");
1993 + for (i = 0; i < 5; i++) {
1994 + unsigned int c;
1995 + if (get_user(c, (unsigned int *)pc+i))
1996 + printk(KERN_CONT "???????? ");
1997 + else
1998 + printk(KERN_CONT "%08x ", c);
1999 + }
2000 + printk("\n");
2001 +}
2002 +#endif
2003 +
2004 int fixup_exception(struct pt_regs *regs)
2005 {
2006 const struct exception_table_entry *fix;
2007 @@ -192,8 +303,33 @@ good_area:
2008
2009 acc_type = parisc_acctyp(code,regs->iir);
2010
2011 - if ((vma->vm_flags & acc_type) != acc_type)
2012 + if ((vma->vm_flags & acc_type) != acc_type) {
2013 +
2014 +#ifdef CONFIG_PAX_PAGEEXEC
2015 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
2016 + (address & ~3UL) == instruction_pointer(regs))
2017 + {
2018 + up_read(&mm->mmap_sem);
2019 + switch (pax_handle_fetch_fault(regs)) {
2020 +
2021 +#ifdef CONFIG_PAX_EMUPLT
2022 + case 3:
2023 + return;
2024 +#endif
2025 +
2026 +#ifdef CONFIG_PAX_EMUTRAMP
2027 + case 2:
2028 + return;
2029 +#endif
2030 +
2031 + }
2032 + pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
2033 + do_group_exit(SIGKILL);
2034 + }
2035 +#endif
2036 +
2037 goto bad_area;
2038 + }
2039
2040 /*
2041 * If for any reason at all we couldn't handle the fault, make
2042 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/device.h linux-2.6.32.46/arch/powerpc/include/asm/device.h
2043 --- linux-2.6.32.46/arch/powerpc/include/asm/device.h 2011-03-27 14:31:47.000000000 -0400
2044 +++ linux-2.6.32.46/arch/powerpc/include/asm/device.h 2011-04-17 15:56:45.000000000 -0400
2045 @@ -14,7 +14,7 @@ struct dev_archdata {
2046 struct device_node *of_node;
2047
2048 /* DMA operations on that device */
2049 - struct dma_map_ops *dma_ops;
2050 + const struct dma_map_ops *dma_ops;
2051
2052 /*
2053 * When an iommu is in use, dma_data is used as a ptr to the base of the
2054 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/dma-mapping.h linux-2.6.32.46/arch/powerpc/include/asm/dma-mapping.h
2055 --- linux-2.6.32.46/arch/powerpc/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
2056 +++ linux-2.6.32.46/arch/powerpc/include/asm/dma-mapping.h 2011-04-17 15:56:45.000000000 -0400
2057 @@ -69,9 +69,9 @@ static inline unsigned long device_to_ma
2058 #ifdef CONFIG_PPC64
2059 extern struct dma_map_ops dma_iommu_ops;
2060 #endif
2061 -extern struct dma_map_ops dma_direct_ops;
2062 +extern const struct dma_map_ops dma_direct_ops;
2063
2064 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
2065 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
2066 {
2067 /* We don't handle the NULL dev case for ISA for now. We could
2068 * do it via an out of line call but it is not needed for now. The
2069 @@ -84,7 +84,7 @@ static inline struct dma_map_ops *get_dm
2070 return dev->archdata.dma_ops;
2071 }
2072
2073 -static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
2074 +static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
2075 {
2076 dev->archdata.dma_ops = ops;
2077 }
2078 @@ -118,7 +118,7 @@ static inline void set_dma_offset(struct
2079
2080 static inline int dma_supported(struct device *dev, u64 mask)
2081 {
2082 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
2083 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2084
2085 if (unlikely(dma_ops == NULL))
2086 return 0;
2087 @@ -132,7 +132,7 @@ static inline int dma_supported(struct d
2088
2089 static inline int dma_set_mask(struct device *dev, u64 dma_mask)
2090 {
2091 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
2092 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2093
2094 if (unlikely(dma_ops == NULL))
2095 return -EIO;
2096 @@ -147,7 +147,7 @@ static inline int dma_set_mask(struct de
2097 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
2098 dma_addr_t *dma_handle, gfp_t flag)
2099 {
2100 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
2101 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2102 void *cpu_addr;
2103
2104 BUG_ON(!dma_ops);
2105 @@ -162,7 +162,7 @@ static inline void *dma_alloc_coherent(s
2106 static inline void dma_free_coherent(struct device *dev, size_t size,
2107 void *cpu_addr, dma_addr_t dma_handle)
2108 {
2109 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
2110 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2111
2112 BUG_ON(!dma_ops);
2113
2114 @@ -173,7 +173,7 @@ static inline void dma_free_coherent(str
2115
2116 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
2117 {
2118 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
2119 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2120
2121 if (dma_ops->mapping_error)
2122 return dma_ops->mapping_error(dev, dma_addr);
2123 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/elf.h linux-2.6.32.46/arch/powerpc/include/asm/elf.h
2124 --- linux-2.6.32.46/arch/powerpc/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
2125 +++ linux-2.6.32.46/arch/powerpc/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
2126 @@ -179,8 +179,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
2127 the loader. We need to make sure that it is out of the way of the program
2128 that it will "exec", and that there is sufficient room for the brk. */
2129
2130 -extern unsigned long randomize_et_dyn(unsigned long base);
2131 -#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
2132 +#define ELF_ET_DYN_BASE (0x20000000)
2133 +
2134 +#ifdef CONFIG_PAX_ASLR
2135 +#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
2136 +
2137 +#ifdef __powerpc64__
2138 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 16 : 28)
2139 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 16 : 28)
2140 +#else
2141 +#define PAX_DELTA_MMAP_LEN 15
2142 +#define PAX_DELTA_STACK_LEN 15
2143 +#endif
2144 +#endif
2145
2146 /*
2147 * Our registers are always unsigned longs, whether we're a 32 bit
2148 @@ -275,9 +286,6 @@ extern int arch_setup_additional_pages(s
2149 (0x7ff >> (PAGE_SHIFT - 12)) : \
2150 (0x3ffff >> (PAGE_SHIFT - 12)))
2151
2152 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2153 -#define arch_randomize_brk arch_randomize_brk
2154 -
2155 #endif /* __KERNEL__ */
2156
2157 /*
2158 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/iommu.h linux-2.6.32.46/arch/powerpc/include/asm/iommu.h
2159 --- linux-2.6.32.46/arch/powerpc/include/asm/iommu.h 2011-03-27 14:31:47.000000000 -0400
2160 +++ linux-2.6.32.46/arch/powerpc/include/asm/iommu.h 2011-04-17 15:56:45.000000000 -0400
2161 @@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
2162 extern void iommu_init_early_dart(void);
2163 extern void iommu_init_early_pasemi(void);
2164
2165 +/* dma-iommu.c */
2166 +extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
2167 +
2168 #ifdef CONFIG_PCI
2169 extern void pci_iommu_init(void);
2170 extern void pci_direct_iommu_init(void);
2171 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/kmap_types.h linux-2.6.32.46/arch/powerpc/include/asm/kmap_types.h
2172 --- linux-2.6.32.46/arch/powerpc/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
2173 +++ linux-2.6.32.46/arch/powerpc/include/asm/kmap_types.h 2011-04-17 15:56:45.000000000 -0400
2174 @@ -26,6 +26,7 @@ enum km_type {
2175 KM_SOFTIRQ1,
2176 KM_PPC_SYNC_PAGE,
2177 KM_PPC_SYNC_ICACHE,
2178 + KM_CLEARPAGE,
2179 KM_TYPE_NR
2180 };
2181
2182 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/page_64.h linux-2.6.32.46/arch/powerpc/include/asm/page_64.h
2183 --- linux-2.6.32.46/arch/powerpc/include/asm/page_64.h 2011-03-27 14:31:47.000000000 -0400
2184 +++ linux-2.6.32.46/arch/powerpc/include/asm/page_64.h 2011-04-17 15:56:45.000000000 -0400
2185 @@ -180,15 +180,18 @@ do { \
2186 * stack by default, so in the absense of a PT_GNU_STACK program header
2187 * we turn execute permission off.
2188 */
2189 -#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
2190 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2191 +#define VM_STACK_DEFAULT_FLAGS32 \
2192 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
2193 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2194
2195 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
2196 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2197
2198 +#ifndef CONFIG_PAX_PAGEEXEC
2199 #define VM_STACK_DEFAULT_FLAGS \
2200 (test_thread_flag(TIF_32BIT) ? \
2201 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
2202 +#endif
2203
2204 #include <asm-generic/getorder.h>
2205
2206 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/page.h linux-2.6.32.46/arch/powerpc/include/asm/page.h
2207 --- linux-2.6.32.46/arch/powerpc/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
2208 +++ linux-2.6.32.46/arch/powerpc/include/asm/page.h 2011-08-21 16:07:39.000000000 -0400
2209 @@ -116,8 +116,9 @@ extern phys_addr_t kernstart_addr;
2210 * and needs to be executable. This means the whole heap ends
2211 * up being executable.
2212 */
2213 -#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
2214 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2215 +#define VM_DATA_DEFAULT_FLAGS32 \
2216 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
2217 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2218
2219 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
2220 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2221 @@ -145,6 +146,9 @@ extern phys_addr_t kernstart_addr;
2222 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
2223 #endif
2224
2225 +#define ktla_ktva(addr) (addr)
2226 +#define ktva_ktla(addr) (addr)
2227 +
2228 #ifndef __ASSEMBLY__
2229
2230 #undef STRICT_MM_TYPECHECKS
2231 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/pci.h linux-2.6.32.46/arch/powerpc/include/asm/pci.h
2232 --- linux-2.6.32.46/arch/powerpc/include/asm/pci.h 2011-03-27 14:31:47.000000000 -0400
2233 +++ linux-2.6.32.46/arch/powerpc/include/asm/pci.h 2011-04-17 15:56:45.000000000 -0400
2234 @@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
2235 }
2236
2237 #ifdef CONFIG_PCI
2238 -extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
2239 -extern struct dma_map_ops *get_pci_dma_ops(void);
2240 +extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
2241 +extern const struct dma_map_ops *get_pci_dma_ops(void);
2242 #else /* CONFIG_PCI */
2243 #define set_pci_dma_ops(d)
2244 #define get_pci_dma_ops() NULL
2245 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/pgtable.h linux-2.6.32.46/arch/powerpc/include/asm/pgtable.h
2246 --- linux-2.6.32.46/arch/powerpc/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
2247 +++ linux-2.6.32.46/arch/powerpc/include/asm/pgtable.h 2011-04-17 15:56:45.000000000 -0400
2248 @@ -2,6 +2,7 @@
2249 #define _ASM_POWERPC_PGTABLE_H
2250 #ifdef __KERNEL__
2251
2252 +#include <linux/const.h>
2253 #ifndef __ASSEMBLY__
2254 #include <asm/processor.h> /* For TASK_SIZE */
2255 #include <asm/mmu.h>
2256 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/pte-hash32.h linux-2.6.32.46/arch/powerpc/include/asm/pte-hash32.h
2257 --- linux-2.6.32.46/arch/powerpc/include/asm/pte-hash32.h 2011-03-27 14:31:47.000000000 -0400
2258 +++ linux-2.6.32.46/arch/powerpc/include/asm/pte-hash32.h 2011-04-17 15:56:45.000000000 -0400
2259 @@ -21,6 +21,7 @@
2260 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
2261 #define _PAGE_USER 0x004 /* usermode access allowed */
2262 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
2263 +#define _PAGE_EXEC _PAGE_GUARDED
2264 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
2265 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
2266 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
2267 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/ptrace.h linux-2.6.32.46/arch/powerpc/include/asm/ptrace.h
2268 --- linux-2.6.32.46/arch/powerpc/include/asm/ptrace.h 2011-03-27 14:31:47.000000000 -0400
2269 +++ linux-2.6.32.46/arch/powerpc/include/asm/ptrace.h 2011-08-21 15:53:58.000000000 -0400
2270 @@ -103,7 +103,7 @@ extern unsigned long profile_pc(struct p
2271 } while(0)
2272
2273 struct task_struct;
2274 -extern unsigned long ptrace_get_reg(struct task_struct *task, int regno);
2275 +extern unsigned long ptrace_get_reg(struct task_struct *task, unsigned int regno);
2276 extern int ptrace_put_reg(struct task_struct *task, int regno,
2277 unsigned long data);
2278
2279 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/reg.h linux-2.6.32.46/arch/powerpc/include/asm/reg.h
2280 --- linux-2.6.32.46/arch/powerpc/include/asm/reg.h 2011-03-27 14:31:47.000000000 -0400
2281 +++ linux-2.6.32.46/arch/powerpc/include/asm/reg.h 2011-04-17 15:56:45.000000000 -0400
2282 @@ -191,6 +191,7 @@
2283 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
2284 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
2285 #define DSISR_NOHPTE 0x40000000 /* no translation found */
2286 +#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
2287 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
2288 #define DSISR_ISSTORE 0x02000000 /* access was a store */
2289 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
2290 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/swiotlb.h linux-2.6.32.46/arch/powerpc/include/asm/swiotlb.h
2291 --- linux-2.6.32.46/arch/powerpc/include/asm/swiotlb.h 2011-03-27 14:31:47.000000000 -0400
2292 +++ linux-2.6.32.46/arch/powerpc/include/asm/swiotlb.h 2011-04-17 15:56:45.000000000 -0400
2293 @@ -13,7 +13,7 @@
2294
2295 #include <linux/swiotlb.h>
2296
2297 -extern struct dma_map_ops swiotlb_dma_ops;
2298 +extern const struct dma_map_ops swiotlb_dma_ops;
2299
2300 static inline void dma_mark_clean(void *addr, size_t size) {}
2301
2302 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/system.h linux-2.6.32.46/arch/powerpc/include/asm/system.h
2303 --- linux-2.6.32.46/arch/powerpc/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
2304 +++ linux-2.6.32.46/arch/powerpc/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
2305 @@ -531,7 +531,7 @@ __cmpxchg_local(volatile void *ptr, unsi
2306 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
2307 #endif
2308
2309 -extern unsigned long arch_align_stack(unsigned long sp);
2310 +#define arch_align_stack(x) ((x) & ~0xfUL)
2311
2312 /* Used in very early kernel initialization. */
2313 extern unsigned long reloc_offset(void);
2314 diff -urNp linux-2.6.32.46/arch/powerpc/include/asm/uaccess.h linux-2.6.32.46/arch/powerpc/include/asm/uaccess.h
2315 --- linux-2.6.32.46/arch/powerpc/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
2316 +++ linux-2.6.32.46/arch/powerpc/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
2317 @@ -13,6 +13,8 @@
2318 #define VERIFY_READ 0
2319 #define VERIFY_WRITE 1
2320
2321 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
2322 +
2323 /*
2324 * The fs value determines whether argument validity checking should be
2325 * performed or not. If get_fs() == USER_DS, checking is performed, with
2326 @@ -327,52 +329,6 @@ do { \
2327 extern unsigned long __copy_tofrom_user(void __user *to,
2328 const void __user *from, unsigned long size);
2329
2330 -#ifndef __powerpc64__
2331 -
2332 -static inline unsigned long copy_from_user(void *to,
2333 - const void __user *from, unsigned long n)
2334 -{
2335 - unsigned long over;
2336 -
2337 - if (access_ok(VERIFY_READ, from, n))
2338 - return __copy_tofrom_user((__force void __user *)to, from, n);
2339 - if ((unsigned long)from < TASK_SIZE) {
2340 - over = (unsigned long)from + n - TASK_SIZE;
2341 - return __copy_tofrom_user((__force void __user *)to, from,
2342 - n - over) + over;
2343 - }
2344 - return n;
2345 -}
2346 -
2347 -static inline unsigned long copy_to_user(void __user *to,
2348 - const void *from, unsigned long n)
2349 -{
2350 - unsigned long over;
2351 -
2352 - if (access_ok(VERIFY_WRITE, to, n))
2353 - return __copy_tofrom_user(to, (__force void __user *)from, n);
2354 - if ((unsigned long)to < TASK_SIZE) {
2355 - over = (unsigned long)to + n - TASK_SIZE;
2356 - return __copy_tofrom_user(to, (__force void __user *)from,
2357 - n - over) + over;
2358 - }
2359 - return n;
2360 -}
2361 -
2362 -#else /* __powerpc64__ */
2363 -
2364 -#define __copy_in_user(to, from, size) \
2365 - __copy_tofrom_user((to), (from), (size))
2366 -
2367 -extern unsigned long copy_from_user(void *to, const void __user *from,
2368 - unsigned long n);
2369 -extern unsigned long copy_to_user(void __user *to, const void *from,
2370 - unsigned long n);
2371 -extern unsigned long copy_in_user(void __user *to, const void __user *from,
2372 - unsigned long n);
2373 -
2374 -#endif /* __powerpc64__ */
2375 -
2376 static inline unsigned long __copy_from_user_inatomic(void *to,
2377 const void __user *from, unsigned long n)
2378 {
2379 @@ -396,6 +352,10 @@ static inline unsigned long __copy_from_
2380 if (ret == 0)
2381 return 0;
2382 }
2383 +
2384 + if (!__builtin_constant_p(n))
2385 + check_object_size(to, n, false);
2386 +
2387 return __copy_tofrom_user((__force void __user *)to, from, n);
2388 }
2389
2390 @@ -422,6 +382,10 @@ static inline unsigned long __copy_to_us
2391 if (ret == 0)
2392 return 0;
2393 }
2394 +
2395 + if (!__builtin_constant_p(n))
2396 + check_object_size(from, n, true);
2397 +
2398 return __copy_tofrom_user(to, (__force const void __user *)from, n);
2399 }
2400
2401 @@ -439,6 +403,92 @@ static inline unsigned long __copy_to_us
2402 return __copy_to_user_inatomic(to, from, size);
2403 }
2404
2405 +#ifndef __powerpc64__
2406 +
2407 +static inline unsigned long __must_check copy_from_user(void *to,
2408 + const void __user *from, unsigned long n)
2409 +{
2410 + unsigned long over;
2411 +
2412 + if ((long)n < 0)
2413 + return n;
2414 +
2415 + if (access_ok(VERIFY_READ, from, n)) {
2416 + if (!__builtin_constant_p(n))
2417 + check_object_size(to, n, false);
2418 + return __copy_tofrom_user((__force void __user *)to, from, n);
2419 + }
2420 + if ((unsigned long)from < TASK_SIZE) {
2421 + over = (unsigned long)from + n - TASK_SIZE;
2422 + if (!__builtin_constant_p(n - over))
2423 + check_object_size(to, n - over, false);
2424 + return __copy_tofrom_user((__force void __user *)to, from,
2425 + n - over) + over;
2426 + }
2427 + return n;
2428 +}
2429 +
2430 +static inline unsigned long __must_check copy_to_user(void __user *to,
2431 + const void *from, unsigned long n)
2432 +{
2433 + unsigned long over;
2434 +
2435 + if ((long)n < 0)
2436 + return n;
2437 +
2438 + if (access_ok(VERIFY_WRITE, to, n)) {
2439 + if (!__builtin_constant_p(n))
2440 + check_object_size(from, n, true);
2441 + return __copy_tofrom_user(to, (__force void __user *)from, n);
2442 + }
2443 + if ((unsigned long)to < TASK_SIZE) {
2444 + over = (unsigned long)to + n - TASK_SIZE;
2445 + if (!__builtin_constant_p(n))
2446 + check_object_size(from, n - over, true);
2447 + return __copy_tofrom_user(to, (__force void __user *)from,
2448 + n - over) + over;
2449 + }
2450 + return n;
2451 +}
2452 +
2453 +#else /* __powerpc64__ */
2454 +
2455 +#define __copy_in_user(to, from, size) \
2456 + __copy_tofrom_user((to), (from), (size))
2457 +
2458 +static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
2459 +{
2460 + if ((long)n < 0 || n > INT_MAX)
2461 + return n;
2462 +
2463 + if (!__builtin_constant_p(n))
2464 + check_object_size(to, n, false);
2465 +
2466 + if (likely(access_ok(VERIFY_READ, from, n)))
2467 + n = __copy_from_user(to, from, n);
2468 + else
2469 + memset(to, 0, n);
2470 + return n;
2471 +}
2472 +
2473 +static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
2474 +{
2475 + if ((long)n < 0 || n > INT_MAX)
2476 + return n;
2477 +
2478 + if (likely(access_ok(VERIFY_WRITE, to, n))) {
2479 + if (!__builtin_constant_p(n))
2480 + check_object_size(from, n, true);
2481 + n = __copy_to_user(to, from, n);
2482 + }
2483 + return n;
2484 +}
2485 +
2486 +extern unsigned long copy_in_user(void __user *to, const void __user *from,
2487 + unsigned long n);
2488 +
2489 +#endif /* __powerpc64__ */
2490 +
2491 extern unsigned long __clear_user(void __user *addr, unsigned long size);
2492
2493 static inline unsigned long clear_user(void __user *addr, unsigned long size)
2494 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/cacheinfo.c linux-2.6.32.46/arch/powerpc/kernel/cacheinfo.c
2495 --- linux-2.6.32.46/arch/powerpc/kernel/cacheinfo.c 2011-03-27 14:31:47.000000000 -0400
2496 +++ linux-2.6.32.46/arch/powerpc/kernel/cacheinfo.c 2011-04-17 15:56:45.000000000 -0400
2497 @@ -642,7 +642,7 @@ static struct kobj_attribute *cache_inde
2498 &cache_assoc_attr,
2499 };
2500
2501 -static struct sysfs_ops cache_index_ops = {
2502 +static const struct sysfs_ops cache_index_ops = {
2503 .show = cache_index_show,
2504 };
2505
2506 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/dma.c linux-2.6.32.46/arch/powerpc/kernel/dma.c
2507 --- linux-2.6.32.46/arch/powerpc/kernel/dma.c 2011-03-27 14:31:47.000000000 -0400
2508 +++ linux-2.6.32.46/arch/powerpc/kernel/dma.c 2011-04-17 15:56:45.000000000 -0400
2509 @@ -134,7 +134,7 @@ static inline void dma_direct_sync_singl
2510 }
2511 #endif
2512
2513 -struct dma_map_ops dma_direct_ops = {
2514 +const struct dma_map_ops dma_direct_ops = {
2515 .alloc_coherent = dma_direct_alloc_coherent,
2516 .free_coherent = dma_direct_free_coherent,
2517 .map_sg = dma_direct_map_sg,
2518 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/dma-iommu.c linux-2.6.32.46/arch/powerpc/kernel/dma-iommu.c
2519 --- linux-2.6.32.46/arch/powerpc/kernel/dma-iommu.c 2011-03-27 14:31:47.000000000 -0400
2520 +++ linux-2.6.32.46/arch/powerpc/kernel/dma-iommu.c 2011-04-17 15:56:45.000000000 -0400
2521 @@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
2522 }
2523
2524 /* We support DMA to/from any memory page via the iommu */
2525 -static int dma_iommu_dma_supported(struct device *dev, u64 mask)
2526 +int dma_iommu_dma_supported(struct device *dev, u64 mask)
2527 {
2528 struct iommu_table *tbl = get_iommu_table_base(dev);
2529
2530 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.32.46/arch/powerpc/kernel/dma-swiotlb.c
2531 --- linux-2.6.32.46/arch/powerpc/kernel/dma-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
2532 +++ linux-2.6.32.46/arch/powerpc/kernel/dma-swiotlb.c 2011-04-17 15:56:45.000000000 -0400
2533 @@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
2534 * map_page, and unmap_page on highmem, use normal dma_ops
2535 * for everything else.
2536 */
2537 -struct dma_map_ops swiotlb_dma_ops = {
2538 +const struct dma_map_ops swiotlb_dma_ops = {
2539 .alloc_coherent = dma_direct_alloc_coherent,
2540 .free_coherent = dma_direct_free_coherent,
2541 .map_sg = swiotlb_map_sg_attrs,
2542 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/exceptions-64e.S linux-2.6.32.46/arch/powerpc/kernel/exceptions-64e.S
2543 --- linux-2.6.32.46/arch/powerpc/kernel/exceptions-64e.S 2011-03-27 14:31:47.000000000 -0400
2544 +++ linux-2.6.32.46/arch/powerpc/kernel/exceptions-64e.S 2011-04-17 15:56:45.000000000 -0400
2545 @@ -455,6 +455,7 @@ storage_fault_common:
2546 std r14,_DAR(r1)
2547 std r15,_DSISR(r1)
2548 addi r3,r1,STACK_FRAME_OVERHEAD
2549 + bl .save_nvgprs
2550 mr r4,r14
2551 mr r5,r15
2552 ld r14,PACA_EXGEN+EX_R14(r13)
2553 @@ -464,8 +465,7 @@ storage_fault_common:
2554 cmpdi r3,0
2555 bne- 1f
2556 b .ret_from_except_lite
2557 -1: bl .save_nvgprs
2558 - mr r5,r3
2559 +1: mr r5,r3
2560 addi r3,r1,STACK_FRAME_OVERHEAD
2561 ld r4,_DAR(r1)
2562 bl .bad_page_fault
2563 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/exceptions-64s.S linux-2.6.32.46/arch/powerpc/kernel/exceptions-64s.S
2564 --- linux-2.6.32.46/arch/powerpc/kernel/exceptions-64s.S 2011-03-27 14:31:47.000000000 -0400
2565 +++ linux-2.6.32.46/arch/powerpc/kernel/exceptions-64s.S 2011-04-17 15:56:45.000000000 -0400
2566 @@ -818,10 +818,10 @@ handle_page_fault:
2567 11: ld r4,_DAR(r1)
2568 ld r5,_DSISR(r1)
2569 addi r3,r1,STACK_FRAME_OVERHEAD
2570 + bl .save_nvgprs
2571 bl .do_page_fault
2572 cmpdi r3,0
2573 beq+ 13f
2574 - bl .save_nvgprs
2575 mr r5,r3
2576 addi r3,r1,STACK_FRAME_OVERHEAD
2577 lwz r4,_DAR(r1)
2578 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/ibmebus.c linux-2.6.32.46/arch/powerpc/kernel/ibmebus.c
2579 --- linux-2.6.32.46/arch/powerpc/kernel/ibmebus.c 2011-03-27 14:31:47.000000000 -0400
2580 +++ linux-2.6.32.46/arch/powerpc/kernel/ibmebus.c 2011-04-17 15:56:45.000000000 -0400
2581 @@ -127,7 +127,7 @@ static int ibmebus_dma_supported(struct
2582 return 1;
2583 }
2584
2585 -static struct dma_map_ops ibmebus_dma_ops = {
2586 +static const struct dma_map_ops ibmebus_dma_ops = {
2587 .alloc_coherent = ibmebus_alloc_coherent,
2588 .free_coherent = ibmebus_free_coherent,
2589 .map_sg = ibmebus_map_sg,
2590 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/kgdb.c linux-2.6.32.46/arch/powerpc/kernel/kgdb.c
2591 --- linux-2.6.32.46/arch/powerpc/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
2592 +++ linux-2.6.32.46/arch/powerpc/kernel/kgdb.c 2011-04-17 15:56:45.000000000 -0400
2593 @@ -126,7 +126,7 @@ static int kgdb_handle_breakpoint(struct
2594 if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
2595 return 0;
2596
2597 - if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
2598 + if (*(u32 *) (regs->nip) == *(const u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
2599 regs->nip += 4;
2600
2601 return 1;
2602 @@ -353,7 +353,7 @@ int kgdb_arch_handle_exception(int vecto
2603 /*
2604 * Global data
2605 */
2606 -struct kgdb_arch arch_kgdb_ops = {
2607 +const struct kgdb_arch arch_kgdb_ops = {
2608 .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
2609 };
2610
2611 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/module_32.c linux-2.6.32.46/arch/powerpc/kernel/module_32.c
2612 --- linux-2.6.32.46/arch/powerpc/kernel/module_32.c 2011-03-27 14:31:47.000000000 -0400
2613 +++ linux-2.6.32.46/arch/powerpc/kernel/module_32.c 2011-04-17 15:56:45.000000000 -0400
2614 @@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
2615 me->arch.core_plt_section = i;
2616 }
2617 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
2618 - printk("Module doesn't contain .plt or .init.plt sections.\n");
2619 + printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
2620 return -ENOEXEC;
2621 }
2622
2623 @@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
2624
2625 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
2626 /* Init, or core PLT? */
2627 - if (location >= mod->module_core
2628 - && location < mod->module_core + mod->core_size)
2629 + if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
2630 + (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
2631 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
2632 - else
2633 + else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
2634 + (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
2635 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
2636 + else {
2637 + printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
2638 + return ~0UL;
2639 + }
2640
2641 /* Find this entry, or if that fails, the next avail. entry */
2642 while (entry->jump[0]) {
2643 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/module.c linux-2.6.32.46/arch/powerpc/kernel/module.c
2644 --- linux-2.6.32.46/arch/powerpc/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
2645 +++ linux-2.6.32.46/arch/powerpc/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
2646 @@ -31,11 +31,24 @@
2647
2648 LIST_HEAD(module_bug_list);
2649
2650 +#ifdef CONFIG_PAX_KERNEXEC
2651 void *module_alloc(unsigned long size)
2652 {
2653 if (size == 0)
2654 return NULL;
2655
2656 + return vmalloc(size);
2657 +}
2658 +
2659 +void *module_alloc_exec(unsigned long size)
2660 +#else
2661 +void *module_alloc(unsigned long size)
2662 +#endif
2663 +
2664 +{
2665 + if (size == 0)
2666 + return NULL;
2667 +
2668 return vmalloc_exec(size);
2669 }
2670
2671 @@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
2672 vfree(module_region);
2673 }
2674
2675 +#ifdef CONFIG_PAX_KERNEXEC
2676 +void module_free_exec(struct module *mod, void *module_region)
2677 +{
2678 + module_free(mod, module_region);
2679 +}
2680 +#endif
2681 +
2682 static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
2683 const Elf_Shdr *sechdrs,
2684 const char *name)
2685 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/pci-common.c linux-2.6.32.46/arch/powerpc/kernel/pci-common.c
2686 --- linux-2.6.32.46/arch/powerpc/kernel/pci-common.c 2011-03-27 14:31:47.000000000 -0400
2687 +++ linux-2.6.32.46/arch/powerpc/kernel/pci-common.c 2011-04-17 15:56:45.000000000 -0400
2688 @@ -50,14 +50,14 @@ resource_size_t isa_mem_base;
2689 unsigned int ppc_pci_flags = 0;
2690
2691
2692 -static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
2693 +static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
2694
2695 -void set_pci_dma_ops(struct dma_map_ops *dma_ops)
2696 +void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
2697 {
2698 pci_dma_ops = dma_ops;
2699 }
2700
2701 -struct dma_map_ops *get_pci_dma_ops(void)
2702 +const struct dma_map_ops *get_pci_dma_ops(void)
2703 {
2704 return pci_dma_ops;
2705 }
2706 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/process.c linux-2.6.32.46/arch/powerpc/kernel/process.c
2707 --- linux-2.6.32.46/arch/powerpc/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
2708 +++ linux-2.6.32.46/arch/powerpc/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
2709 @@ -539,8 +539,8 @@ void show_regs(struct pt_regs * regs)
2710 * Lookup NIP late so we have the best change of getting the
2711 * above info out without failing
2712 */
2713 - printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
2714 - printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
2715 + printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
2716 + printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
2717 #endif
2718 show_stack(current, (unsigned long *) regs->gpr[1]);
2719 if (!user_mode(regs))
2720 @@ -1034,10 +1034,10 @@ void show_stack(struct task_struct *tsk,
2721 newsp = stack[0];
2722 ip = stack[STACK_FRAME_LR_SAVE];
2723 if (!firstframe || ip != lr) {
2724 - printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
2725 + printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
2726 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
2727 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
2728 - printk(" (%pS)",
2729 + printk(" (%pA)",
2730 (void *)current->ret_stack[curr_frame].ret);
2731 curr_frame--;
2732 }
2733 @@ -1057,7 +1057,7 @@ void show_stack(struct task_struct *tsk,
2734 struct pt_regs *regs = (struct pt_regs *)
2735 (sp + STACK_FRAME_OVERHEAD);
2736 lr = regs->link;
2737 - printk("--- Exception: %lx at %pS\n LR = %pS\n",
2738 + printk("--- Exception: %lx at %pA\n LR = %pA\n",
2739 regs->trap, (void *)regs->nip, (void *)lr);
2740 firstframe = 1;
2741 }
2742 @@ -1134,58 +1134,3 @@ void thread_info_cache_init(void)
2743 }
2744
2745 #endif /* THREAD_SHIFT < PAGE_SHIFT */
2746 -
2747 -unsigned long arch_align_stack(unsigned long sp)
2748 -{
2749 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2750 - sp -= get_random_int() & ~PAGE_MASK;
2751 - return sp & ~0xf;
2752 -}
2753 -
2754 -static inline unsigned long brk_rnd(void)
2755 -{
2756 - unsigned long rnd = 0;
2757 -
2758 - /* 8MB for 32bit, 1GB for 64bit */
2759 - if (is_32bit_task())
2760 - rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
2761 - else
2762 - rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
2763 -
2764 - return rnd << PAGE_SHIFT;
2765 -}
2766 -
2767 -unsigned long arch_randomize_brk(struct mm_struct *mm)
2768 -{
2769 - unsigned long base = mm->brk;
2770 - unsigned long ret;
2771 -
2772 -#ifdef CONFIG_PPC_STD_MMU_64
2773 - /*
2774 - * If we are using 1TB segments and we are allowed to randomise
2775 - * the heap, we can put it above 1TB so it is backed by a 1TB
2776 - * segment. Otherwise the heap will be in the bottom 1TB
2777 - * which always uses 256MB segments and this may result in a
2778 - * performance penalty.
2779 - */
2780 - if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
2781 - base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
2782 -#endif
2783 -
2784 - ret = PAGE_ALIGN(base + brk_rnd());
2785 -
2786 - if (ret < mm->brk)
2787 - return mm->brk;
2788 -
2789 - return ret;
2790 -}
2791 -
2792 -unsigned long randomize_et_dyn(unsigned long base)
2793 -{
2794 - unsigned long ret = PAGE_ALIGN(base + brk_rnd());
2795 -
2796 - if (ret < base)
2797 - return base;
2798 -
2799 - return ret;
2800 -}
2801 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/ptrace.c linux-2.6.32.46/arch/powerpc/kernel/ptrace.c
2802 --- linux-2.6.32.46/arch/powerpc/kernel/ptrace.c 2011-03-27 14:31:47.000000000 -0400
2803 +++ linux-2.6.32.46/arch/powerpc/kernel/ptrace.c 2011-08-21 15:53:39.000000000 -0400
2804 @@ -86,7 +86,7 @@ static int set_user_trap(struct task_str
2805 /*
2806 * Get contents of register REGNO in task TASK.
2807 */
2808 -unsigned long ptrace_get_reg(struct task_struct *task, int regno)
2809 +unsigned long ptrace_get_reg(struct task_struct *task, unsigned int regno)
2810 {
2811 if (task->thread.regs == NULL)
2812 return -EIO;
2813 @@ -894,7 +894,7 @@ long arch_ptrace(struct task_struct *chi
2814
2815 CHECK_FULL_REGS(child->thread.regs);
2816 if (index < PT_FPR0) {
2817 - tmp = ptrace_get_reg(child, (int) index);
2818 + tmp = ptrace_get_reg(child, index);
2819 } else {
2820 flush_fp_to_thread(child);
2821 tmp = ((unsigned long *)child->thread.fpr)
2822 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/signal_32.c linux-2.6.32.46/arch/powerpc/kernel/signal_32.c
2823 --- linux-2.6.32.46/arch/powerpc/kernel/signal_32.c 2011-03-27 14:31:47.000000000 -0400
2824 +++ linux-2.6.32.46/arch/powerpc/kernel/signal_32.c 2011-04-17 15:56:45.000000000 -0400
2825 @@ -857,7 +857,7 @@ int handle_rt_signal32(unsigned long sig
2826 /* Save user registers on the stack */
2827 frame = &rt_sf->uc.uc_mcontext;
2828 addr = frame;
2829 - if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
2830 + if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2831 if (save_user_regs(regs, frame, 0, 1))
2832 goto badframe;
2833 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
2834 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/signal_64.c linux-2.6.32.46/arch/powerpc/kernel/signal_64.c
2835 --- linux-2.6.32.46/arch/powerpc/kernel/signal_64.c 2011-03-27 14:31:47.000000000 -0400
2836 +++ linux-2.6.32.46/arch/powerpc/kernel/signal_64.c 2011-04-17 15:56:45.000000000 -0400
2837 @@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
2838 current->thread.fpscr.val = 0;
2839
2840 /* Set up to return from userspace. */
2841 - if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
2842 + if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2843 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
2844 } else {
2845 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
2846 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/sys_ppc32.c linux-2.6.32.46/arch/powerpc/kernel/sys_ppc32.c
2847 --- linux-2.6.32.46/arch/powerpc/kernel/sys_ppc32.c 2011-03-27 14:31:47.000000000 -0400
2848 +++ linux-2.6.32.46/arch/powerpc/kernel/sys_ppc32.c 2011-04-17 15:56:45.000000000 -0400
2849 @@ -563,10 +563,10 @@ asmlinkage long compat_sys_sysctl(struct
2850 if (oldlenp) {
2851 if (!error) {
2852 if (get_user(oldlen, oldlenp) ||
2853 - put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)))
2854 + put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)) ||
2855 + copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused)))
2856 error = -EFAULT;
2857 }
2858 - copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
2859 }
2860 return error;
2861 }
2862 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/traps.c linux-2.6.32.46/arch/powerpc/kernel/traps.c
2863 --- linux-2.6.32.46/arch/powerpc/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
2864 +++ linux-2.6.32.46/arch/powerpc/kernel/traps.c 2011-06-13 21:33:37.000000000 -0400
2865 @@ -99,6 +99,8 @@ static void pmac_backlight_unblank(void)
2866 static inline void pmac_backlight_unblank(void) { }
2867 #endif
2868
2869 +extern void gr_handle_kernel_exploit(void);
2870 +
2871 int die(const char *str, struct pt_regs *regs, long err)
2872 {
2873 static struct {
2874 @@ -168,6 +170,8 @@ int die(const char *str, struct pt_regs
2875 if (panic_on_oops)
2876 panic("Fatal exception");
2877
2878 + gr_handle_kernel_exploit();
2879 +
2880 oops_exit();
2881 do_exit(err);
2882
2883 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/vdso.c linux-2.6.32.46/arch/powerpc/kernel/vdso.c
2884 --- linux-2.6.32.46/arch/powerpc/kernel/vdso.c 2011-03-27 14:31:47.000000000 -0400
2885 +++ linux-2.6.32.46/arch/powerpc/kernel/vdso.c 2011-04-17 15:56:45.000000000 -0400
2886 @@ -36,6 +36,7 @@
2887 #include <asm/firmware.h>
2888 #include <asm/vdso.h>
2889 #include <asm/vdso_datapage.h>
2890 +#include <asm/mman.h>
2891
2892 #include "setup.h"
2893
2894 @@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
2895 vdso_base = VDSO32_MBASE;
2896 #endif
2897
2898 - current->mm->context.vdso_base = 0;
2899 + current->mm->context.vdso_base = ~0UL;
2900
2901 /* vDSO has a problem and was disabled, just don't "enable" it for the
2902 * process
2903 @@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
2904 vdso_base = get_unmapped_area(NULL, vdso_base,
2905 (vdso_pages << PAGE_SHIFT) +
2906 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
2907 - 0, 0);
2908 + 0, MAP_PRIVATE | MAP_EXECUTABLE);
2909 if (IS_ERR_VALUE(vdso_base)) {
2910 rc = vdso_base;
2911 goto fail_mmapsem;
2912 diff -urNp linux-2.6.32.46/arch/powerpc/kernel/vio.c linux-2.6.32.46/arch/powerpc/kernel/vio.c
2913 --- linux-2.6.32.46/arch/powerpc/kernel/vio.c 2011-03-27 14:31:47.000000000 -0400
2914 +++ linux-2.6.32.46/arch/powerpc/kernel/vio.c 2011-04-17 15:56:45.000000000 -0400
2915 @@ -601,11 +601,12 @@ static void vio_dma_iommu_unmap_sg(struc
2916 vio_cmo_dealloc(viodev, alloc_size);
2917 }
2918
2919 -struct dma_map_ops vio_dma_mapping_ops = {
2920 +static const struct dma_map_ops vio_dma_mapping_ops = {
2921 .alloc_coherent = vio_dma_iommu_alloc_coherent,
2922 .free_coherent = vio_dma_iommu_free_coherent,
2923 .map_sg = vio_dma_iommu_map_sg,
2924 .unmap_sg = vio_dma_iommu_unmap_sg,
2925 + .dma_supported = dma_iommu_dma_supported,
2926 .map_page = vio_dma_iommu_map_page,
2927 .unmap_page = vio_dma_iommu_unmap_page,
2928
2929 @@ -857,7 +858,6 @@ static void vio_cmo_bus_remove(struct vi
2930
2931 static void vio_cmo_set_dma_ops(struct vio_dev *viodev)
2932 {
2933 - vio_dma_mapping_ops.dma_supported = dma_iommu_ops.dma_supported;
2934 viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
2935 }
2936
2937 diff -urNp linux-2.6.32.46/arch/powerpc/lib/usercopy_64.c linux-2.6.32.46/arch/powerpc/lib/usercopy_64.c
2938 --- linux-2.6.32.46/arch/powerpc/lib/usercopy_64.c 2011-03-27 14:31:47.000000000 -0400
2939 +++ linux-2.6.32.46/arch/powerpc/lib/usercopy_64.c 2011-04-17 15:56:45.000000000 -0400
2940 @@ -9,22 +9,6 @@
2941 #include <linux/module.h>
2942 #include <asm/uaccess.h>
2943
2944 -unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
2945 -{
2946 - if (likely(access_ok(VERIFY_READ, from, n)))
2947 - n = __copy_from_user(to, from, n);
2948 - else
2949 - memset(to, 0, n);
2950 - return n;
2951 -}
2952 -
2953 -unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
2954 -{
2955 - if (likely(access_ok(VERIFY_WRITE, to, n)))
2956 - n = __copy_to_user(to, from, n);
2957 - return n;
2958 -}
2959 -
2960 unsigned long copy_in_user(void __user *to, const void __user *from,
2961 unsigned long n)
2962 {
2963 @@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
2964 return n;
2965 }
2966
2967 -EXPORT_SYMBOL(copy_from_user);
2968 -EXPORT_SYMBOL(copy_to_user);
2969 EXPORT_SYMBOL(copy_in_user);
2970
2971 diff -urNp linux-2.6.32.46/arch/powerpc/Makefile linux-2.6.32.46/arch/powerpc/Makefile
2972 --- linux-2.6.32.46/arch/powerpc/Makefile 2011-03-27 14:31:47.000000000 -0400
2973 +++ linux-2.6.32.46/arch/powerpc/Makefile 2011-08-21 19:27:08.000000000 -0400
2974 @@ -74,6 +74,8 @@ KBUILD_AFLAGS += -Iarch/$(ARCH)
2975 KBUILD_CFLAGS += -msoft-float -pipe -Iarch/$(ARCH) $(CFLAGS-y)
2976 CPP = $(CC) -E $(KBUILD_CFLAGS)
2977
2978 +cflags-y += -Wno-sign-compare -Wno-extra
2979 +
2980 CHECKFLAGS += -m$(CONFIG_WORD_SIZE) -D__powerpc__ -D__powerpc$(CONFIG_WORD_SIZE)__
2981
2982 ifeq ($(CONFIG_PPC64),y)
2983 diff -urNp linux-2.6.32.46/arch/powerpc/mm/fault.c linux-2.6.32.46/arch/powerpc/mm/fault.c
2984 --- linux-2.6.32.46/arch/powerpc/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
2985 +++ linux-2.6.32.46/arch/powerpc/mm/fault.c 2011-04-17 15:56:45.000000000 -0400
2986 @@ -30,6 +30,10 @@
2987 #include <linux/kprobes.h>
2988 #include <linux/kdebug.h>
2989 #include <linux/perf_event.h>
2990 +#include <linux/slab.h>
2991 +#include <linux/pagemap.h>
2992 +#include <linux/compiler.h>
2993 +#include <linux/unistd.h>
2994
2995 #include <asm/firmware.h>
2996 #include <asm/page.h>
2997 @@ -40,6 +44,7 @@
2998 #include <asm/uaccess.h>
2999 #include <asm/tlbflush.h>
3000 #include <asm/siginfo.h>
3001 +#include <asm/ptrace.h>
3002
3003
3004 #ifdef CONFIG_KPROBES
3005 @@ -64,6 +69,33 @@ static inline int notify_page_fault(stru
3006 }
3007 #endif
3008
3009 +#ifdef CONFIG_PAX_PAGEEXEC
3010 +/*
3011 + * PaX: decide what to do with offenders (regs->nip = fault address)
3012 + *
3013 + * returns 1 when task should be killed
3014 + */
3015 +static int pax_handle_fetch_fault(struct pt_regs *regs)
3016 +{
3017 + return 1;
3018 +}
3019 +
3020 +void pax_report_insns(void *pc, void *sp)
3021 +{
3022 + unsigned long i;
3023 +
3024 + printk(KERN_ERR "PAX: bytes at PC: ");
3025 + for (i = 0; i < 5; i++) {
3026 + unsigned int c;
3027 + if (get_user(c, (unsigned int __user *)pc+i))
3028 + printk(KERN_CONT "???????? ");
3029 + else
3030 + printk(KERN_CONT "%08x ", c);
3031 + }
3032 + printk("\n");
3033 +}
3034 +#endif
3035 +
3036 /*
3037 * Check whether the instruction at regs->nip is a store using
3038 * an update addressing form which will update r1.
3039 @@ -134,7 +166,7 @@ int __kprobes do_page_fault(struct pt_re
3040 * indicate errors in DSISR but can validly be set in SRR1.
3041 */
3042 if (trap == 0x400)
3043 - error_code &= 0x48200000;
3044 + error_code &= 0x58200000;
3045 else
3046 is_write = error_code & DSISR_ISSTORE;
3047 #else
3048 @@ -250,7 +282,7 @@ good_area:
3049 * "undefined". Of those that can be set, this is the only
3050 * one which seems bad.
3051 */
3052 - if (error_code & 0x10000000)
3053 + if (error_code & DSISR_GUARDED)
3054 /* Guarded storage error. */
3055 goto bad_area;
3056 #endif /* CONFIG_8xx */
3057 @@ -265,7 +297,7 @@ good_area:
3058 * processors use the same I/D cache coherency mechanism
3059 * as embedded.
3060 */
3061 - if (error_code & DSISR_PROTFAULT)
3062 + if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
3063 goto bad_area;
3064 #endif /* CONFIG_PPC_STD_MMU */
3065
3066 @@ -335,6 +367,23 @@ bad_area:
3067 bad_area_nosemaphore:
3068 /* User mode accesses cause a SIGSEGV */
3069 if (user_mode(regs)) {
3070 +
3071 +#ifdef CONFIG_PAX_PAGEEXEC
3072 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
3073 +#ifdef CONFIG_PPC_STD_MMU
3074 + if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
3075 +#else
3076 + if (is_exec && regs->nip == address) {
3077 +#endif
3078 + switch (pax_handle_fetch_fault(regs)) {
3079 + }
3080 +
3081 + pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
3082 + do_group_exit(SIGKILL);
3083 + }
3084 + }
3085 +#endif
3086 +
3087 _exception(SIGSEGV, regs, code, address);
3088 return 0;
3089 }
3090 diff -urNp linux-2.6.32.46/arch/powerpc/mm/mem.c linux-2.6.32.46/arch/powerpc/mm/mem.c
3091 --- linux-2.6.32.46/arch/powerpc/mm/mem.c 2011-03-27 14:31:47.000000000 -0400
3092 +++ linux-2.6.32.46/arch/powerpc/mm/mem.c 2011-08-21 15:50:39.000000000 -0400
3093 @@ -250,7 +250,7 @@ static int __init mark_nonram_nosave(voi
3094 {
3095 unsigned long lmb_next_region_start_pfn,
3096 lmb_region_max_pfn;
3097 - int i;
3098 + unsigned int i;
3099
3100 for (i = 0; i < lmb.memory.cnt - 1; i++) {
3101 lmb_region_max_pfn =
3102 diff -urNp linux-2.6.32.46/arch/powerpc/mm/mmap_64.c linux-2.6.32.46/arch/powerpc/mm/mmap_64.c
3103 --- linux-2.6.32.46/arch/powerpc/mm/mmap_64.c 2011-03-27 14:31:47.000000000 -0400
3104 +++ linux-2.6.32.46/arch/powerpc/mm/mmap_64.c 2011-04-17 15:56:45.000000000 -0400
3105 @@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
3106 */
3107 if (mmap_is_legacy()) {
3108 mm->mmap_base = TASK_UNMAPPED_BASE;
3109 +
3110 +#ifdef CONFIG_PAX_RANDMMAP
3111 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3112 + mm->mmap_base += mm->delta_mmap;
3113 +#endif
3114 +
3115 mm->get_unmapped_area = arch_get_unmapped_area;
3116 mm->unmap_area = arch_unmap_area;
3117 } else {
3118 mm->mmap_base = mmap_base();
3119 +
3120 +#ifdef CONFIG_PAX_RANDMMAP
3121 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3122 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3123 +#endif
3124 +
3125 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
3126 mm->unmap_area = arch_unmap_area_topdown;
3127 }
3128 diff -urNp linux-2.6.32.46/arch/powerpc/mm/slice.c linux-2.6.32.46/arch/powerpc/mm/slice.c
3129 --- linux-2.6.32.46/arch/powerpc/mm/slice.c 2011-03-27 14:31:47.000000000 -0400
3130 +++ linux-2.6.32.46/arch/powerpc/mm/slice.c 2011-04-17 15:56:45.000000000 -0400
3131 @@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
3132 if ((mm->task_size - len) < addr)
3133 return 0;
3134 vma = find_vma(mm, addr);
3135 - return (!vma || (addr + len) <= vma->vm_start);
3136 + return check_heap_stack_gap(vma, addr, len);
3137 }
3138
3139 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
3140 @@ -256,7 +256,7 @@ full_search:
3141 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
3142 continue;
3143 }
3144 - if (!vma || addr + len <= vma->vm_start) {
3145 + if (check_heap_stack_gap(vma, addr, len)) {
3146 /*
3147 * Remember the place where we stopped the search:
3148 */
3149 @@ -313,10 +313,14 @@ static unsigned long slice_find_area_top
3150 }
3151 }
3152
3153 - addr = mm->mmap_base;
3154 - while (addr > len) {
3155 + if (mm->mmap_base < len)
3156 + addr = -ENOMEM;
3157 + else
3158 + addr = mm->mmap_base - len;
3159 +
3160 + while (!IS_ERR_VALUE(addr)) {
3161 /* Go down by chunk size */
3162 - addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
3163 + addr = _ALIGN_DOWN(addr, 1ul << pshift);
3164
3165 /* Check for hit with different page size */
3166 mask = slice_range_to_mask(addr, len);
3167 @@ -336,7 +340,7 @@ static unsigned long slice_find_area_top
3168 * return with success:
3169 */
3170 vma = find_vma(mm, addr);
3171 - if (!vma || (addr + len) <= vma->vm_start) {
3172 + if (check_heap_stack_gap(vma, addr, len)) {
3173 /* remember the address as a hint for next time */
3174 if (use_cache)
3175 mm->free_area_cache = addr;
3176 @@ -348,7 +352,7 @@ static unsigned long slice_find_area_top
3177 mm->cached_hole_size = vma->vm_start - addr;
3178
3179 /* try just below the current vma->vm_start */
3180 - addr = vma->vm_start;
3181 + addr = skip_heap_stack_gap(vma, len);
3182 }
3183
3184 /*
3185 @@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(un
3186 if (fixed && addr > (mm->task_size - len))
3187 return -EINVAL;
3188
3189 +#ifdef CONFIG_PAX_RANDMMAP
3190 + if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
3191 + addr = 0;
3192 +#endif
3193 +
3194 /* If hint, make sure it matches our alignment restrictions */
3195 if (!fixed && addr) {
3196 addr = _ALIGN_UP(addr, 1ul << pshift);
3197 diff -urNp linux-2.6.32.46/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.32.46/arch/powerpc/platforms/52xx/lite5200_pm.c
3198 --- linux-2.6.32.46/arch/powerpc/platforms/52xx/lite5200_pm.c 2011-03-27 14:31:47.000000000 -0400
3199 +++ linux-2.6.32.46/arch/powerpc/platforms/52xx/lite5200_pm.c 2011-04-17 15:56:45.000000000 -0400
3200 @@ -235,7 +235,7 @@ static void lite5200_pm_end(void)
3201 lite5200_pm_target_state = PM_SUSPEND_ON;
3202 }
3203
3204 -static struct platform_suspend_ops lite5200_pm_ops = {
3205 +static const struct platform_suspend_ops lite5200_pm_ops = {
3206 .valid = lite5200_pm_valid,
3207 .begin = lite5200_pm_begin,
3208 .prepare = lite5200_pm_prepare,
3209 diff -urNp linux-2.6.32.46/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.32.46/arch/powerpc/platforms/52xx/mpc52xx_pm.c
3210 --- linux-2.6.32.46/arch/powerpc/platforms/52xx/mpc52xx_pm.c 2011-03-27 14:31:47.000000000 -0400
3211 +++ linux-2.6.32.46/arch/powerpc/platforms/52xx/mpc52xx_pm.c 2011-04-17 15:56:45.000000000 -0400
3212 @@ -180,7 +180,7 @@ void mpc52xx_pm_finish(void)
3213 iounmap(mbar);
3214 }
3215
3216 -static struct platform_suspend_ops mpc52xx_pm_ops = {
3217 +static const struct platform_suspend_ops mpc52xx_pm_ops = {
3218 .valid = mpc52xx_pm_valid,
3219 .prepare = mpc52xx_pm_prepare,
3220 .enter = mpc52xx_pm_enter,
3221 diff -urNp linux-2.6.32.46/arch/powerpc/platforms/83xx/suspend.c linux-2.6.32.46/arch/powerpc/platforms/83xx/suspend.c
3222 --- linux-2.6.32.46/arch/powerpc/platforms/83xx/suspend.c 2011-03-27 14:31:47.000000000 -0400
3223 +++ linux-2.6.32.46/arch/powerpc/platforms/83xx/suspend.c 2011-04-17 15:56:45.000000000 -0400
3224 @@ -273,7 +273,7 @@ static int mpc83xx_is_pci_agent(void)
3225 return ret;
3226 }
3227
3228 -static struct platform_suspend_ops mpc83xx_suspend_ops = {
3229 +static const struct platform_suspend_ops mpc83xx_suspend_ops = {
3230 .valid = mpc83xx_suspend_valid,
3231 .begin = mpc83xx_suspend_begin,
3232 .enter = mpc83xx_suspend_enter,
3233 diff -urNp linux-2.6.32.46/arch/powerpc/platforms/cell/iommu.c linux-2.6.32.46/arch/powerpc/platforms/cell/iommu.c
3234 --- linux-2.6.32.46/arch/powerpc/platforms/cell/iommu.c 2011-03-27 14:31:47.000000000 -0400
3235 +++ linux-2.6.32.46/arch/powerpc/platforms/cell/iommu.c 2011-04-17 15:56:45.000000000 -0400
3236 @@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
3237
3238 static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
3239
3240 -struct dma_map_ops dma_iommu_fixed_ops = {
3241 +const struct dma_map_ops dma_iommu_fixed_ops = {
3242 .alloc_coherent = dma_fixed_alloc_coherent,
3243 .free_coherent = dma_fixed_free_coherent,
3244 .map_sg = dma_fixed_map_sg,
3245 diff -urNp linux-2.6.32.46/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.32.46/arch/powerpc/platforms/ps3/system-bus.c
3246 --- linux-2.6.32.46/arch/powerpc/platforms/ps3/system-bus.c 2011-03-27 14:31:47.000000000 -0400
3247 +++ linux-2.6.32.46/arch/powerpc/platforms/ps3/system-bus.c 2011-04-17 15:56:45.000000000 -0400
3248 @@ -694,7 +694,7 @@ static int ps3_dma_supported(struct devi
3249 return mask >= DMA_BIT_MASK(32);
3250 }
3251
3252 -static struct dma_map_ops ps3_sb_dma_ops = {
3253 +static const struct dma_map_ops ps3_sb_dma_ops = {
3254 .alloc_coherent = ps3_alloc_coherent,
3255 .free_coherent = ps3_free_coherent,
3256 .map_sg = ps3_sb_map_sg,
3257 @@ -704,7 +704,7 @@ static struct dma_map_ops ps3_sb_dma_ops
3258 .unmap_page = ps3_unmap_page,
3259 };
3260
3261 -static struct dma_map_ops ps3_ioc0_dma_ops = {
3262 +static const struct dma_map_ops ps3_ioc0_dma_ops = {
3263 .alloc_coherent = ps3_alloc_coherent,
3264 .free_coherent = ps3_free_coherent,
3265 .map_sg = ps3_ioc0_map_sg,
3266 diff -urNp linux-2.6.32.46/arch/powerpc/platforms/pseries/Kconfig linux-2.6.32.46/arch/powerpc/platforms/pseries/Kconfig
3267 --- linux-2.6.32.46/arch/powerpc/platforms/pseries/Kconfig 2011-03-27 14:31:47.000000000 -0400
3268 +++ linux-2.6.32.46/arch/powerpc/platforms/pseries/Kconfig 2011-04-17 15:56:45.000000000 -0400
3269 @@ -2,6 +2,8 @@ config PPC_PSERIES
3270 depends on PPC64 && PPC_BOOK3S
3271 bool "IBM pSeries & new (POWER5-based) iSeries"
3272 select MPIC
3273 + select PCI_MSI
3274 + select XICS
3275 select PPC_I8259
3276 select PPC_RTAS
3277 select RTAS_ERROR_LOGGING
3278 diff -urNp linux-2.6.32.46/arch/s390/include/asm/elf.h linux-2.6.32.46/arch/s390/include/asm/elf.h
3279 --- linux-2.6.32.46/arch/s390/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
3280 +++ linux-2.6.32.46/arch/s390/include/asm/elf.h 2011-04-17 15:56:45.000000000 -0400
3281 @@ -164,6 +164,13 @@ extern unsigned int vdso_enabled;
3282 that it will "exec", and that there is sufficient room for the brk. */
3283 #define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
3284
3285 +#ifdef CONFIG_PAX_ASLR
3286 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
3287 +
3288 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
3289 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
3290 +#endif
3291 +
3292 /* This yields a mask that user programs can use to figure out what
3293 instruction set this CPU supports. */
3294
3295 diff -urNp linux-2.6.32.46/arch/s390/include/asm/setup.h linux-2.6.32.46/arch/s390/include/asm/setup.h
3296 --- linux-2.6.32.46/arch/s390/include/asm/setup.h 2011-03-27 14:31:47.000000000 -0400
3297 +++ linux-2.6.32.46/arch/s390/include/asm/setup.h 2011-04-17 15:56:45.000000000 -0400
3298 @@ -50,13 +50,13 @@ extern unsigned long memory_end;
3299 void detect_memory_layout(struct mem_chunk chunk[]);
3300
3301 #ifdef CONFIG_S390_SWITCH_AMODE
3302 -extern unsigned int switch_amode;
3303 +#define switch_amode (1)
3304 #else
3305 #define switch_amode (0)
3306 #endif
3307
3308 #ifdef CONFIG_S390_EXEC_PROTECT
3309 -extern unsigned int s390_noexec;
3310 +#define s390_noexec (1)
3311 #else
3312 #define s390_noexec (0)
3313 #endif
3314 diff -urNp linux-2.6.32.46/arch/s390/include/asm/uaccess.h linux-2.6.32.46/arch/s390/include/asm/uaccess.h
3315 --- linux-2.6.32.46/arch/s390/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
3316 +++ linux-2.6.32.46/arch/s390/include/asm/uaccess.h 2011-04-17 15:56:45.000000000 -0400
3317 @@ -232,6 +232,10 @@ static inline unsigned long __must_check
3318 copy_to_user(void __user *to, const void *from, unsigned long n)
3319 {
3320 might_fault();
3321 +
3322 + if ((long)n < 0)
3323 + return n;
3324 +
3325 if (access_ok(VERIFY_WRITE, to, n))
3326 n = __copy_to_user(to, from, n);
3327 return n;
3328 @@ -257,6 +261,9 @@ copy_to_user(void __user *to, const void
3329 static inline unsigned long __must_check
3330 __copy_from_user(void *to, const void __user *from, unsigned long n)
3331 {
3332 + if ((long)n < 0)
3333 + return n;
3334 +
3335 if (__builtin_constant_p(n) && (n <= 256))
3336 return uaccess.copy_from_user_small(n, from, to);
3337 else
3338 @@ -283,6 +290,10 @@ static inline unsigned long __must_check
3339 copy_from_user(void *to, const void __user *from, unsigned long n)
3340 {
3341 might_fault();
3342 +
3343 + if ((long)n < 0)
3344 + return n;
3345 +
3346 if (access_ok(VERIFY_READ, from, n))
3347 n = __copy_from_user(to, from, n);
3348 else
3349 diff -urNp linux-2.6.32.46/arch/s390/Kconfig linux-2.6.32.46/arch/s390/Kconfig
3350 --- linux-2.6.32.46/arch/s390/Kconfig 2011-03-27 14:31:47.000000000 -0400
3351 +++ linux-2.6.32.46/arch/s390/Kconfig 2011-04-17 15:56:45.000000000 -0400
3352 @@ -194,28 +194,26 @@ config AUDIT_ARCH
3353
3354 config S390_SWITCH_AMODE
3355 bool "Switch kernel/user addressing modes"
3356 + default y
3357 help
3358 This option allows to switch the addressing modes of kernel and user
3359 - space. The kernel parameter switch_amode=on will enable this feature,
3360 - default is disabled. Enabling this (via kernel parameter) on machines
3361 - earlier than IBM System z9-109 EC/BC will reduce system performance.
3362 + space. Enabling this on machines earlier than IBM System z9-109 EC/BC
3363 + will reduce system performance.
3364
3365 Note that this option will also be selected by selecting the execute
3366 - protection option below. Enabling the execute protection via the
3367 - noexec kernel parameter will also switch the addressing modes,
3368 - independent of the switch_amode kernel parameter.
3369 + protection option below. Enabling the execute protection will also
3370 + switch the addressing modes, independent of this option.
3371
3372
3373 config S390_EXEC_PROTECT
3374 bool "Data execute protection"
3375 + default y
3376 select S390_SWITCH_AMODE
3377 help
3378 This option allows to enable a buffer overflow protection for user
3379 space programs and it also selects the addressing mode option above.
3380 - The kernel parameter noexec=on will enable this feature and also
3381 - switch the addressing modes, default is disabled. Enabling this (via
3382 - kernel parameter) on machines earlier than IBM System z9-109 EC/BC
3383 - will reduce system performance.
3384 + Enabling this on machines earlier than IBM System z9-109 EC/BC will
3385 + reduce system performance.
3386
3387 comment "Code generation options"
3388
3389 diff -urNp linux-2.6.32.46/arch/s390/kernel/module.c linux-2.6.32.46/arch/s390/kernel/module.c
3390 --- linux-2.6.32.46/arch/s390/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
3391 +++ linux-2.6.32.46/arch/s390/kernel/module.c 2011-04-17 15:56:45.000000000 -0400
3392 @@ -166,11 +166,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
3393
3394 /* Increase core size by size of got & plt and set start
3395 offsets for got and plt. */
3396 - me->core_size = ALIGN(me->core_size, 4);
3397 - me->arch.got_offset = me->core_size;
3398 - me->core_size += me->arch.got_size;
3399 - me->arch.plt_offset = me->core_size;
3400 - me->core_size += me->arch.plt_size;
3401 + me->core_size_rw = ALIGN(me->core_size_rw, 4);
3402 + me->arch.got_offset = me->core_size_rw;
3403 + me->core_size_rw += me->arch.got_size;
3404 + me->arch.plt_offset = me->core_size_rx;
3405 + me->core_size_rx += me->arch.plt_size;
3406 return 0;
3407 }
3408
3409 @@ -256,7 +256,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3410 if (info->got_initialized == 0) {
3411 Elf_Addr *gotent;
3412
3413 - gotent = me->module_core + me->arch.got_offset +
3414 + gotent = me->module_core_rw + me->arch.got_offset +
3415 info->got_offset;
3416 *gotent = val;
3417 info->got_initialized = 1;
3418 @@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3419 else if (r_type == R_390_GOTENT ||
3420 r_type == R_390_GOTPLTENT)
3421 *(unsigned int *) loc =
3422 - (val + (Elf_Addr) me->module_core - loc) >> 1;
3423 + (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
3424 else if (r_type == R_390_GOT64 ||
3425 r_type == R_390_GOTPLT64)
3426 *(unsigned long *) loc = val;
3427 @@ -294,7 +294,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3428 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
3429 if (info->plt_initialized == 0) {
3430 unsigned int *ip;
3431 - ip = me->module_core + me->arch.plt_offset +
3432 + ip = me->module_core_rx + me->arch.plt_offset +
3433 info->plt_offset;
3434 #ifndef CONFIG_64BIT
3435 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
3436 @@ -319,7 +319,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3437 val - loc + 0xffffUL < 0x1ffffeUL) ||
3438 (r_type == R_390_PLT32DBL &&
3439 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
3440 - val = (Elf_Addr) me->module_core +
3441 + val = (Elf_Addr) me->module_core_rx +
3442 me->arch.plt_offset +
3443 info->plt_offset;
3444 val += rela->r_addend - loc;
3445 @@ -341,7 +341,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3446 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
3447 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
3448 val = val + rela->r_addend -
3449 - ((Elf_Addr) me->module_core + me->arch.got_offset);
3450 + ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
3451 if (r_type == R_390_GOTOFF16)
3452 *(unsigned short *) loc = val;
3453 else if (r_type == R_390_GOTOFF32)
3454 @@ -351,7 +351,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3455 break;
3456 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
3457 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
3458 - val = (Elf_Addr) me->module_core + me->arch.got_offset +
3459 + val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
3460 rela->r_addend - loc;
3461 if (r_type == R_390_GOTPC)
3462 *(unsigned int *) loc = val;
3463 diff -urNp linux-2.6.32.46/arch/s390/kernel/setup.c linux-2.6.32.46/arch/s390/kernel/setup.c
3464 --- linux-2.6.32.46/arch/s390/kernel/setup.c 2011-03-27 14:31:47.000000000 -0400
3465 +++ linux-2.6.32.46/arch/s390/kernel/setup.c 2011-04-17 15:56:45.000000000 -0400
3466 @@ -306,9 +306,6 @@ static int __init early_parse_mem(char *
3467 early_param("mem", early_parse_mem);
3468
3469 #ifdef CONFIG_S390_SWITCH_AMODE
3470 -unsigned int switch_amode = 0;
3471 -EXPORT_SYMBOL_GPL(switch_amode);
3472 -
3473 static int set_amode_and_uaccess(unsigned long user_amode,
3474 unsigned long user32_amode)
3475 {
3476 @@ -334,17 +331,6 @@ static int set_amode_and_uaccess(unsigne
3477 return 0;
3478 }
3479 }
3480 -
3481 -/*
3482 - * Switch kernel/user addressing modes?
3483 - */
3484 -static int __init early_parse_switch_amode(char *p)
3485 -{
3486 - switch_amode = 1;
3487 - return 0;
3488 -}
3489 -early_param("switch_amode", early_parse_switch_amode);
3490 -
3491 #else /* CONFIG_S390_SWITCH_AMODE */
3492 static inline int set_amode_and_uaccess(unsigned long user_amode,
3493 unsigned long user32_amode)
3494 @@ -353,24 +339,6 @@ static inline int set_amode_and_uaccess(
3495 }
3496 #endif /* CONFIG_S390_SWITCH_AMODE */
3497
3498 -#ifdef CONFIG_S390_EXEC_PROTECT
3499 -unsigned int s390_noexec = 0;
3500 -EXPORT_SYMBOL_GPL(s390_noexec);
3501 -
3502 -/*
3503 - * Enable execute protection?
3504 - */
3505 -static int __init early_parse_noexec(char *p)
3506 -{
3507 - if (!strncmp(p, "off", 3))
3508 - return 0;
3509 - switch_amode = 1;
3510 - s390_noexec = 1;
3511 - return 0;
3512 -}
3513 -early_param("noexec", early_parse_noexec);
3514 -#endif /* CONFIG_S390_EXEC_PROTECT */
3515 -
3516 static void setup_addressing_mode(void)
3517 {
3518 if (s390_noexec) {
3519 diff -urNp linux-2.6.32.46/arch/s390/mm/mmap.c linux-2.6.32.46/arch/s390/mm/mmap.c
3520 --- linux-2.6.32.46/arch/s390/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
3521 +++ linux-2.6.32.46/arch/s390/mm/mmap.c 2011-04-17 15:56:45.000000000 -0400
3522 @@ -78,10 +78,22 @@ void arch_pick_mmap_layout(struct mm_str
3523 */
3524 if (mmap_is_legacy()) {
3525 mm->mmap_base = TASK_UNMAPPED_BASE;
3526 +
3527 +#ifdef CONFIG_PAX_RANDMMAP
3528 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3529 + mm->mmap_base += mm->delta_mmap;
3530 +#endif
3531 +
3532 mm->get_unmapped_area = arch_get_unmapped_area;
3533 mm->unmap_area = arch_unmap_area;
3534 } else {
3535 mm->mmap_base = mmap_base();
3536 +
3537 +#ifdef CONFIG_PAX_RANDMMAP
3538 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3539 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3540 +#endif
3541 +
3542 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
3543 mm->unmap_area = arch_unmap_area_topdown;
3544 }
3545 @@ -153,10 +165,22 @@ void arch_pick_mmap_layout(struct mm_str
3546 */
3547 if (mmap_is_legacy()) {
3548 mm->mmap_base = TASK_UNMAPPED_BASE;
3549 +
3550 +#ifdef CONFIG_PAX_RANDMMAP
3551 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3552 + mm->mmap_base += mm->delta_mmap;
3553 +#endif
3554 +
3555 mm->get_unmapped_area = s390_get_unmapped_area;
3556 mm->unmap_area = arch_unmap_area;
3557 } else {
3558 mm->mmap_base = mmap_base();
3559 +
3560 +#ifdef CONFIG_PAX_RANDMMAP
3561 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3562 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3563 +#endif
3564 +
3565 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
3566 mm->unmap_area = arch_unmap_area_topdown;
3567 }
3568 diff -urNp linux-2.6.32.46/arch/score/include/asm/system.h linux-2.6.32.46/arch/score/include/asm/system.h
3569 --- linux-2.6.32.46/arch/score/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
3570 +++ linux-2.6.32.46/arch/score/include/asm/system.h 2011-04-17 15:56:45.000000000 -0400
3571 @@ -17,7 +17,7 @@ do { \
3572 #define finish_arch_switch(prev) do {} while (0)
3573
3574 typedef void (*vi_handler_t)(void);
3575 -extern unsigned long arch_align_stack(unsigned long sp);
3576 +#define arch_align_stack(x) (x)
3577
3578 #define mb() barrier()
3579 #define rmb() barrier()
3580 diff -urNp linux-2.6.32.46/arch/score/kernel/process.c linux-2.6.32.46/arch/score/kernel/process.c
3581 --- linux-2.6.32.46/arch/score/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
3582 +++ linux-2.6.32.46/arch/score/kernel/process.c 2011-04-17 15:56:45.000000000 -0400
3583 @@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_stru
3584
3585 return task_pt_regs(task)->cp0_epc;
3586 }
3587 -
3588 -unsigned long arch_align_stack(unsigned long sp)
3589 -{
3590 - return sp;
3591 -}
3592 diff -urNp linux-2.6.32.46/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.32.46/arch/sh/boards/mach-hp6xx/pm.c
3593 --- linux-2.6.32.46/arch/sh/boards/mach-hp6xx/pm.c 2011-03-27 14:31:47.000000000 -0400
3594 +++ linux-2.6.32.46/arch/sh/boards/mach-hp6xx/pm.c 2011-04-17 15:56:45.000000000 -0400
3595 @@ -143,7 +143,7 @@ static int hp6x0_pm_enter(suspend_state_
3596 return 0;
3597 }
3598
3599 -static struct platform_suspend_ops hp6x0_pm_ops = {
3600 +static const struct platform_suspend_ops hp6x0_pm_ops = {
3601 .enter = hp6x0_pm_enter,
3602 .valid = suspend_valid_only_mem,
3603 };
3604 diff -urNp linux-2.6.32.46/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.32.46/arch/sh/kernel/cpu/sh4/sq.c
3605 --- linux-2.6.32.46/arch/sh/kernel/cpu/sh4/sq.c 2011-03-27 14:31:47.000000000 -0400
3606 +++ linux-2.6.32.46/arch/sh/kernel/cpu/sh4/sq.c 2011-04-17 15:56:46.000000000 -0400
3607 @@ -327,7 +327,7 @@ static struct attribute *sq_sysfs_attrs[
3608 NULL,
3609 };
3610
3611 -static struct sysfs_ops sq_sysfs_ops = {
3612 +static const struct sysfs_ops sq_sysfs_ops = {
3613 .show = sq_sysfs_show,
3614 .store = sq_sysfs_store,
3615 };
3616 diff -urNp linux-2.6.32.46/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.32.46/arch/sh/kernel/cpu/shmobile/pm.c
3617 --- linux-2.6.32.46/arch/sh/kernel/cpu/shmobile/pm.c 2011-03-27 14:31:47.000000000 -0400
3618 +++ linux-2.6.32.46/arch/sh/kernel/cpu/shmobile/pm.c 2011-04-17 15:56:46.000000000 -0400
3619 @@ -58,7 +58,7 @@ static int sh_pm_enter(suspend_state_t s
3620 return 0;
3621 }
3622
3623 -static struct platform_suspend_ops sh_pm_ops = {
3624 +static const struct platform_suspend_ops sh_pm_ops = {
3625 .enter = sh_pm_enter,
3626 .valid = suspend_valid_only_mem,
3627 };
3628 diff -urNp linux-2.6.32.46/arch/sh/kernel/kgdb.c linux-2.6.32.46/arch/sh/kernel/kgdb.c
3629 --- linux-2.6.32.46/arch/sh/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
3630 +++ linux-2.6.32.46/arch/sh/kernel/kgdb.c 2011-04-17 15:56:46.000000000 -0400
3631 @@ -271,7 +271,7 @@ void kgdb_arch_exit(void)
3632 {
3633 }
3634
3635 -struct kgdb_arch arch_kgdb_ops = {
3636 +const struct kgdb_arch arch_kgdb_ops = {
3637 /* Breakpoint instruction: trapa #0x3c */
3638 #ifdef CONFIG_CPU_LITTLE_ENDIAN
3639 .gdb_bpt_instr = { 0x3c, 0xc3 },
3640 diff -urNp linux-2.6.32.46/arch/sh/mm/mmap.c linux-2.6.32.46/arch/sh/mm/mmap.c
3641 --- linux-2.6.32.46/arch/sh/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
3642 +++ linux-2.6.32.46/arch/sh/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
3643 @@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(str
3644 addr = PAGE_ALIGN(addr);
3645
3646 vma = find_vma(mm, addr);
3647 - if (TASK_SIZE - len >= addr &&
3648 - (!vma || addr + len <= vma->vm_start))
3649 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
3650 return addr;
3651 }
3652
3653 @@ -106,7 +105,7 @@ full_search:
3654 }
3655 return -ENOMEM;
3656 }
3657 - if (likely(!vma || addr + len <= vma->vm_start)) {
3658 + if (likely(check_heap_stack_gap(vma, addr, len))) {
3659 /*
3660 * Remember the place where we stopped the search:
3661 */
3662 @@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct fi
3663 addr = PAGE_ALIGN(addr);
3664
3665 vma = find_vma(mm, addr);
3666 - if (TASK_SIZE - len >= addr &&
3667 - (!vma || addr + len <= vma->vm_start))
3668 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
3669 return addr;
3670 }
3671
3672 @@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct fi
3673 /* make sure it can fit in the remaining address space */
3674 if (likely(addr > len)) {
3675 vma = find_vma(mm, addr-len);
3676 - if (!vma || addr <= vma->vm_start) {
3677 + if (check_heap_stack_gap(vma, addr - len, len)) {
3678 /* remember the address as a hint for next time */
3679 return (mm->free_area_cache = addr-len);
3680 }
3681 @@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct fi
3682 if (unlikely(mm->mmap_base < len))
3683 goto bottomup;
3684
3685 - addr = mm->mmap_base-len;
3686 - if (do_colour_align)
3687 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3688 + addr = mm->mmap_base - len;
3689
3690 do {
3691 + if (do_colour_align)
3692 + addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3693 /*
3694 * Lookup failure means no vma is above this address,
3695 * else if new region fits below vma->vm_start,
3696 * return with success:
3697 */
3698 vma = find_vma(mm, addr);
3699 - if (likely(!vma || addr+len <= vma->vm_start)) {
3700 + if (likely(check_heap_stack_gap(vma, addr, len))) {
3701 /* remember the address as a hint for next time */
3702 return (mm->free_area_cache = addr);
3703 }
3704 @@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct fi
3705 mm->cached_hole_size = vma->vm_start - addr;
3706
3707 /* try just below the current vma->vm_start */
3708 - addr = vma->vm_start-len;
3709 - if (do_colour_align)
3710 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3711 - } while (likely(len < vma->vm_start));
3712 + addr = skip_heap_stack_gap(vma, len);
3713 + } while (!IS_ERR_VALUE(addr));
3714
3715 bottomup:
3716 /*
3717 diff -urNp linux-2.6.32.46/arch/sparc/include/asm/atomic_64.h linux-2.6.32.46/arch/sparc/include/asm/atomic_64.h
3718 --- linux-2.6.32.46/arch/sparc/include/asm/atomic_64.h 2011-03-27 14:31:47.000000000 -0400
3719 +++ linux-2.6.32.46/arch/sparc/include/asm/atomic_64.h 2011-08-18 23:11:34.000000000 -0400
3720 @@ -14,18 +14,40 @@
3721 #define ATOMIC64_INIT(i) { (i) }
3722
3723 #define atomic_read(v) ((v)->counter)
3724 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
3725 +{
3726 + return v->counter;
3727 +}
3728 #define atomic64_read(v) ((v)->counter)
3729 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
3730 +{
3731 + return v->counter;
3732 +}
3733
3734 #define atomic_set(v, i) (((v)->counter) = i)
3735 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
3736 +{
3737 + v->counter = i;
3738 +}
3739 #define atomic64_set(v, i) (((v)->counter) = i)
3740 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
3741 +{
3742 + v->counter = i;
3743 +}
3744
3745 extern void atomic_add(int, atomic_t *);
3746 +extern void atomic_add_unchecked(int, atomic_unchecked_t *);
3747 extern void atomic64_add(long, atomic64_t *);
3748 +extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
3749 extern void atomic_sub(int, atomic_t *);
3750 +extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
3751 extern void atomic64_sub(long, atomic64_t *);
3752 +extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
3753
3754 extern int atomic_add_ret(int, atomic_t *);
3755 +extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
3756 extern long atomic64_add_ret(long, atomic64_t *);
3757 +extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
3758 extern int atomic_sub_ret(int, atomic_t *);
3759 extern long atomic64_sub_ret(long, atomic64_t *);
3760
3761 @@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomi
3762 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
3763
3764 #define atomic_inc_return(v) atomic_add_ret(1, v)
3765 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
3766 +{
3767 + return atomic_add_ret_unchecked(1, v);
3768 +}
3769 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
3770 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
3771 +{
3772 + return atomic64_add_ret_unchecked(1, v);
3773 +}
3774
3775 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
3776 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
3777
3778 #define atomic_add_return(i, v) atomic_add_ret(i, v)
3779 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
3780 +{
3781 + return atomic_add_ret_unchecked(i, v);
3782 +}
3783 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
3784 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
3785 +{
3786 + return atomic64_add_ret_unchecked(i, v);
3787 +}
3788
3789 /*
3790 * atomic_inc_and_test - increment and test
3791 @@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomi
3792 * other cases.
3793 */
3794 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
3795 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
3796 +{
3797 + return atomic_inc_return_unchecked(v) == 0;
3798 +}
3799 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
3800
3801 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
3802 @@ -59,30 +101,65 @@ extern long atomic64_sub_ret(long, atomi
3803 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
3804
3805 #define atomic_inc(v) atomic_add(1, v)
3806 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
3807 +{
3808 + atomic_add_unchecked(1, v);
3809 +}
3810 #define atomic64_inc(v) atomic64_add(1, v)
3811 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
3812 +{
3813 + atomic64_add_unchecked(1, v);
3814 +}
3815
3816 #define atomic_dec(v) atomic_sub(1, v)
3817 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
3818 +{
3819 + atomic_sub_unchecked(1, v);
3820 +}
3821 #define atomic64_dec(v) atomic64_sub(1, v)
3822 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
3823 +{
3824 + atomic64_sub_unchecked(1, v);
3825 +}
3826
3827 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
3828 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
3829
3830 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
3831 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
3832 +{
3833 + return cmpxchg(&v->counter, old, new);
3834 +}
3835 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
3836 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
3837 +{
3838 + return xchg(&v->counter, new);
3839 +}
3840
3841 static inline int atomic_add_unless(atomic_t *v, int a, int u)
3842 {
3843 - int c, old;
3844 + int c, old, new;
3845 c = atomic_read(v);
3846 for (;;) {
3847 - if (unlikely(c == (u)))
3848 + if (unlikely(c == u))
3849 break;
3850 - old = atomic_cmpxchg((v), c, c + (a));
3851 +
3852 + asm volatile("addcc %2, %0, %0\n"
3853 +
3854 +#ifdef CONFIG_PAX_REFCOUNT
3855 + "tvs %%icc, 6\n"
3856 +#endif
3857 +
3858 + : "=r" (new)
3859 + : "0" (c), "ir" (a)
3860 + : "cc");
3861 +
3862 + old = atomic_cmpxchg(v, c, new);
3863 if (likely(old == c))
3864 break;
3865 c = old;
3866 }
3867 - return c != (u);
3868 + return c != u;
3869 }
3870
3871 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
3872 @@ -90,20 +167,35 @@ static inline int atomic_add_unless(atom
3873 #define atomic64_cmpxchg(v, o, n) \
3874 ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
3875 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
3876 +static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
3877 +{
3878 + return xchg(&v->counter, new);
3879 +}
3880
3881 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
3882 {
3883 - long c, old;
3884 + long c, old, new;
3885 c = atomic64_read(v);
3886 for (;;) {
3887 - if (unlikely(c == (u)))
3888 + if (unlikely(c == u))
3889 break;
3890 - old = atomic64_cmpxchg((v), c, c + (a));
3891 +
3892 + asm volatile("addcc %2, %0, %0\n"
3893 +
3894 +#ifdef CONFIG_PAX_REFCOUNT
3895 + "tvs %%xcc, 6\n"
3896 +#endif
3897 +
3898 + : "=r" (new)
3899 + : "0" (c), "ir" (a)
3900 + : "cc");
3901 +
3902 + old = atomic64_cmpxchg(v, c, new);
3903 if (likely(old == c))
3904 break;
3905 c = old;
3906 }
3907 - return c != (u);
3908 + return c != u;
3909 }
3910
3911 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
3912 diff -urNp linux-2.6.32.46/arch/sparc/include/asm/cache.h linux-2.6.32.46/arch/sparc/include/asm/cache.h
3913 --- linux-2.6.32.46/arch/sparc/include/asm/cache.h 2011-03-27 14:31:47.000000000 -0400
3914 +++ linux-2.6.32.46/arch/sparc/include/asm/cache.h 2011-07-06 19:53:33.000000000 -0400
3915 @@ -8,7 +8,7 @@
3916 #define _SPARC_CACHE_H
3917
3918 #define L1_CACHE_SHIFT 5
3919 -#define L1_CACHE_BYTES 32
3920 +#define L1_CACHE_BYTES 32UL
3921 #define L1_CACHE_ALIGN(x) ((((x)+(L1_CACHE_BYTES-1))&~(L1_CACHE_BYTES-1)))
3922
3923 #ifdef CONFIG_SPARC32
3924 diff -urNp linux-2.6.32.46/arch/sparc/include/asm/dma-mapping.h linux-2.6.32.46/arch/sparc/include/asm/dma-mapping.h
3925 --- linux-2.6.32.46/arch/sparc/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
3926 +++ linux-2.6.32.46/arch/sparc/include/asm/dma-mapping.h 2011-04-17 15:56:46.000000000 -0400
3927 @@ -14,10 +14,10 @@ extern int dma_set_mask(struct device *d
3928 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
3929 #define dma_is_consistent(d, h) (1)
3930
3931 -extern struct dma_map_ops *dma_ops, pci32_dma_ops;
3932 +extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
3933 extern struct bus_type pci_bus_type;
3934
3935 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
3936 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
3937 {
3938 #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
3939 if (dev->bus == &pci_bus_type)
3940 @@ -31,7 +31,7 @@ static inline struct dma_map_ops *get_dm
3941 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
3942 dma_addr_t *dma_handle, gfp_t flag)
3943 {
3944 - struct dma_map_ops *ops = get_dma_ops(dev);
3945 + const struct dma_map_ops *ops = get_dma_ops(dev);
3946 void *cpu_addr;
3947
3948 cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
3949 @@ -42,7 +42,7 @@ static inline void *dma_alloc_coherent(s
3950 static inline void dma_free_coherent(struct device *dev, size_t size,
3951 void *cpu_addr, dma_addr_t dma_handle)
3952 {
3953 - struct dma_map_ops *ops = get_dma_ops(dev);
3954 + const struct dma_map_ops *ops = get_dma_ops(dev);
3955
3956 debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
3957 ops->free_coherent(dev, size, cpu_addr, dma_handle);
3958 diff -urNp linux-2.6.32.46/arch/sparc/include/asm/elf_32.h linux-2.6.32.46/arch/sparc/include/asm/elf_32.h
3959 --- linux-2.6.32.46/arch/sparc/include/asm/elf_32.h 2011-03-27 14:31:47.000000000 -0400
3960 +++ linux-2.6.32.46/arch/sparc/include/asm/elf_32.h 2011-04-17 15:56:46.000000000 -0400
3961 @@ -116,6 +116,13 @@ typedef struct {
3962
3963 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
3964
3965 +#ifdef CONFIG_PAX_ASLR
3966 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
3967 +
3968 +#define PAX_DELTA_MMAP_LEN 16
3969 +#define PAX_DELTA_STACK_LEN 16
3970 +#endif
3971 +
3972 /* This yields a mask that user programs can use to figure out what
3973 instruction set this cpu supports. This can NOT be done in userspace
3974 on Sparc. */
3975 diff -urNp linux-2.6.32.46/arch/sparc/include/asm/elf_64.h linux-2.6.32.46/arch/sparc/include/asm/elf_64.h
3976 --- linux-2.6.32.46/arch/sparc/include/asm/elf_64.h 2011-03-27 14:31:47.000000000 -0400
3977 +++ linux-2.6.32.46/arch/sparc/include/asm/elf_64.h 2011-04-17 15:56:46.000000000 -0400
3978 @@ -163,6 +163,12 @@ typedef struct {
3979 #define ELF_ET_DYN_BASE 0x0000010000000000UL
3980 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
3981
3982 +#ifdef CONFIG_PAX_ASLR
3983 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
3984 +
3985 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
3986 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
3987 +#endif
3988
3989 /* This yields a mask that user programs can use to figure out what
3990 instruction set this cpu supports. */
3991 diff -urNp linux-2.6.32.46/arch/sparc/include/asm/pgtable_32.h linux-2.6.32.46/arch/sparc/include/asm/pgtable_32.h
3992 --- linux-2.6.32.46/arch/sparc/include/asm/pgtable_32.h 2011-03-27 14:31:47.000000000 -0400
3993 +++ linux-2.6.32.46/arch/sparc/include/asm/pgtable_32.h 2011-04-17 15:56:46.000000000 -0400
3994 @@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
3995 BTFIXUPDEF_INT(page_none)
3996 BTFIXUPDEF_INT(page_copy)
3997 BTFIXUPDEF_INT(page_readonly)
3998 +
3999 +#ifdef CONFIG_PAX_PAGEEXEC
4000 +BTFIXUPDEF_INT(page_shared_noexec)
4001 +BTFIXUPDEF_INT(page_copy_noexec)
4002 +BTFIXUPDEF_INT(page_readonly_noexec)
4003 +#endif
4004 +
4005 BTFIXUPDEF_INT(page_kernel)
4006
4007 #define PMD_SHIFT SUN4C_PMD_SHIFT
4008 @@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
4009 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
4010 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
4011
4012 +#ifdef CONFIG_PAX_PAGEEXEC
4013 +extern pgprot_t PAGE_SHARED_NOEXEC;
4014 +# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
4015 +# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
4016 +#else
4017 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
4018 +# define PAGE_COPY_NOEXEC PAGE_COPY
4019 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
4020 +#endif
4021 +
4022 extern unsigned long page_kernel;
4023
4024 #ifdef MODULE
4025 diff -urNp linux-2.6.32.46/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.32.46/arch/sparc/include/asm/pgtsrmmu.h
4026 --- linux-2.6.32.46/arch/sparc/include/asm/pgtsrmmu.h 2011-03-27 14:31:47.000000000 -0400
4027 +++ linux-2.6.32.46/arch/sparc/include/asm/pgtsrmmu.h 2011-04-17 15:56:46.000000000 -0400
4028 @@ -115,6 +115,13 @@
4029 SRMMU_EXEC | SRMMU_REF)
4030 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
4031 SRMMU_EXEC | SRMMU_REF)
4032 +
4033 +#ifdef CONFIG_PAX_PAGEEXEC
4034 +#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
4035 +#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
4036 +#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
4037 +#endif
4038 +
4039 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
4040 SRMMU_DIRTY | SRMMU_REF)
4041
4042 diff -urNp linux-2.6.32.46/arch/sparc/include/asm/spinlock_64.h linux-2.6.32.46/arch/sparc/include/asm/spinlock_64.h
4043 --- linux-2.6.32.46/arch/sparc/include/asm/spinlock_64.h 2011-03-27 14:31:47.000000000 -0400
4044 +++ linux-2.6.32.46/arch/sparc/include/asm/spinlock_64.h 2011-08-18 23:19:30.000000000 -0400
4045 @@ -92,14 +92,19 @@ static inline void __raw_spin_lock_flags
4046
4047 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
4048
4049 -static void inline arch_read_lock(raw_rwlock_t *lock)
4050 +static inline void arch_read_lock(raw_rwlock_t *lock)
4051 {
4052 unsigned long tmp1, tmp2;
4053
4054 __asm__ __volatile__ (
4055 "1: ldsw [%2], %0\n"
4056 " brlz,pn %0, 2f\n"
4057 -"4: add %0, 1, %1\n"
4058 +"4: addcc %0, 1, %1\n"
4059 +
4060 +#ifdef CONFIG_PAX_REFCOUNT
4061 +" tvs %%icc, 6\n"
4062 +#endif
4063 +
4064 " cas [%2], %0, %1\n"
4065 " cmp %0, %1\n"
4066 " bne,pn %%icc, 1b\n"
4067 @@ -112,10 +117,10 @@ static void inline arch_read_lock(raw_rw
4068 " .previous"
4069 : "=&r" (tmp1), "=&r" (tmp2)
4070 : "r" (lock)
4071 - : "memory");
4072 + : "memory", "cc");
4073 }
4074
4075 -static int inline arch_read_trylock(raw_rwlock_t *lock)
4076 +static inline int arch_read_trylock(raw_rwlock_t *lock)
4077 {
4078 int tmp1, tmp2;
4079
4080 @@ -123,7 +128,12 @@ static int inline arch_read_trylock(raw_
4081 "1: ldsw [%2], %0\n"
4082 " brlz,a,pn %0, 2f\n"
4083 " mov 0, %0\n"
4084 -" add %0, 1, %1\n"
4085 +" addcc %0, 1, %1\n"
4086 +
4087 +#ifdef CONFIG_PAX_REFCOUNT
4088 +" tvs %%icc, 6\n"
4089 +#endif
4090 +
4091 " cas [%2], %0, %1\n"
4092 " cmp %0, %1\n"
4093 " bne,pn %%icc, 1b\n"
4094 @@ -136,13 +146,18 @@ static int inline arch_read_trylock(raw_
4095 return tmp1;
4096 }
4097
4098 -static void inline arch_read_unlock(raw_rwlock_t *lock)
4099 +static inline void arch_read_unlock(raw_rwlock_t *lock)
4100 {
4101 unsigned long tmp1, tmp2;
4102
4103 __asm__ __volatile__(
4104 "1: lduw [%2], %0\n"
4105 -" sub %0, 1, %1\n"
4106 +" subcc %0, 1, %1\n"
4107 +
4108 +#ifdef CONFIG_PAX_REFCOUNT
4109 +" tvs %%icc, 6\n"
4110 +#endif
4111 +
4112 " cas [%2], %0, %1\n"
4113 " cmp %0, %1\n"
4114 " bne,pn %%xcc, 1b\n"
4115 @@ -152,7 +167,7 @@ static void inline arch_read_unlock(raw_
4116 : "memory");
4117 }
4118
4119 -static void inline arch_write_lock(raw_rwlock_t *lock)
4120 +static inline void arch_write_lock(raw_rwlock_t *lock)
4121 {
4122 unsigned long mask, tmp1, tmp2;
4123
4124 @@ -177,7 +192,7 @@ static void inline arch_write_lock(raw_r
4125 : "memory");
4126 }
4127
4128 -static void inline arch_write_unlock(raw_rwlock_t *lock)
4129 +static inline void arch_write_unlock(raw_rwlock_t *lock)
4130 {
4131 __asm__ __volatile__(
4132 " stw %%g0, [%0]"
4133 @@ -186,7 +201,7 @@ static void inline arch_write_unlock(raw
4134 : "memory");
4135 }
4136
4137 -static int inline arch_write_trylock(raw_rwlock_t *lock)
4138 +static inline int arch_write_trylock(raw_rwlock_t *lock)
4139 {
4140 unsigned long mask, tmp1, tmp2, result;
4141
4142 diff -urNp linux-2.6.32.46/arch/sparc/include/asm/thread_info_32.h linux-2.6.32.46/arch/sparc/include/asm/thread_info_32.h
4143 --- linux-2.6.32.46/arch/sparc/include/asm/thread_info_32.h 2011-03-27 14:31:47.000000000 -0400
4144 +++ linux-2.6.32.46/arch/sparc/include/asm/thread_info_32.h 2011-06-04 20:46:01.000000000 -0400
4145 @@ -50,6 +50,8 @@ struct thread_info {
4146 unsigned long w_saved;
4147
4148 struct restart_block restart_block;
4149 +
4150 + unsigned long lowest_stack;
4151 };
4152
4153 /*
4154 diff -urNp linux-2.6.32.46/arch/sparc/include/asm/thread_info_64.h linux-2.6.32.46/arch/sparc/include/asm/thread_info_64.h
4155 --- linux-2.6.32.46/arch/sparc/include/asm/thread_info_64.h 2011-03-27 14:31:47.000000000 -0400
4156 +++ linux-2.6.32.46/arch/sparc/include/asm/thread_info_64.h 2011-06-04 20:46:21.000000000 -0400
4157 @@ -68,6 +68,8 @@ struct thread_info {
4158 struct pt_regs *kern_una_regs;
4159 unsigned int kern_una_insn;
4160
4161 + unsigned long lowest_stack;
4162 +
4163 unsigned long fpregs[0] __attribute__ ((aligned(64)));
4164 };
4165
4166 diff -urNp linux-2.6.32.46/arch/sparc/include/asm/uaccess_32.h linux-2.6.32.46/arch/sparc/include/asm/uaccess_32.h
4167 --- linux-2.6.32.46/arch/sparc/include/asm/uaccess_32.h 2011-03-27 14:31:47.000000000 -0400
4168 +++ linux-2.6.32.46/arch/sparc/include/asm/uaccess_32.h 2011-04-17 15:56:46.000000000 -0400
4169 @@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
4170
4171 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
4172 {
4173 - if (n && __access_ok((unsigned long) to, n))
4174 + if ((long)n < 0)
4175 + return n;
4176 +
4177 + if (n && __access_ok((unsigned long) to, n)) {
4178 + if (!__builtin_constant_p(n))
4179 + check_object_size(from, n, true);
4180 return __copy_user(to, (__force void __user *) from, n);
4181 - else
4182 + } else
4183 return n;
4184 }
4185
4186 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
4187 {
4188 + if ((long)n < 0)
4189 + return n;
4190 +
4191 + if (!__builtin_constant_p(n))
4192 + check_object_size(from, n, true);
4193 +
4194 return __copy_user(to, (__force void __user *) from, n);
4195 }
4196
4197 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
4198 {
4199 - if (n && __access_ok((unsigned long) from, n))
4200 + if ((long)n < 0)
4201 + return n;
4202 +
4203 + if (n && __access_ok((unsigned long) from, n)) {
4204 + if (!__builtin_constant_p(n))
4205 + check_object_size(to, n, false);
4206 return __copy_user((__force void __user *) to, from, n);
4207 - else
4208 + } else
4209 return n;
4210 }
4211
4212 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
4213 {
4214 + if ((long)n < 0)
4215 + return n;
4216 +
4217 return __copy_user((__force void __user *) to, from, n);
4218 }
4219
4220 diff -urNp linux-2.6.32.46/arch/sparc/include/asm/uaccess_64.h linux-2.6.32.46/arch/sparc/include/asm/uaccess_64.h
4221 --- linux-2.6.32.46/arch/sparc/include/asm/uaccess_64.h 2011-03-27 14:31:47.000000000 -0400
4222 +++ linux-2.6.32.46/arch/sparc/include/asm/uaccess_64.h 2011-04-17 15:56:46.000000000 -0400
4223 @@ -9,6 +9,7 @@
4224 #include <linux/compiler.h>
4225 #include <linux/string.h>
4226 #include <linux/thread_info.h>
4227 +#include <linux/kernel.h>
4228 #include <asm/asi.h>
4229 #include <asm/system.h>
4230 #include <asm/spitfire.h>
4231 @@ -212,8 +213,15 @@ extern unsigned long copy_from_user_fixu
4232 static inline unsigned long __must_check
4233 copy_from_user(void *to, const void __user *from, unsigned long size)
4234 {
4235 - unsigned long ret = ___copy_from_user(to, from, size);
4236 + unsigned long ret;
4237
4238 + if ((long)size < 0 || size > INT_MAX)
4239 + return size;
4240 +
4241 + if (!__builtin_constant_p(size))
4242 + check_object_size(to, size, false);
4243 +
4244 + ret = ___copy_from_user(to, from, size);
4245 if (unlikely(ret))
4246 ret = copy_from_user_fixup(to, from, size);
4247 return ret;
4248 @@ -228,8 +236,15 @@ extern unsigned long copy_to_user_fixup(
4249 static inline unsigned long __must_check
4250 copy_to_user(void __user *to, const void *from, unsigned long size)
4251 {
4252 - unsigned long ret = ___copy_to_user(to, from, size);
4253 + unsigned long ret;
4254 +
4255 + if ((long)size < 0 || size > INT_MAX)
4256 + return size;
4257 +
4258 + if (!__builtin_constant_p(size))
4259 + check_object_size(from, size, true);
4260
4261 + ret = ___copy_to_user(to, from, size);
4262 if (unlikely(ret))
4263 ret = copy_to_user_fixup(to, from, size);
4264 return ret;
4265 diff -urNp linux-2.6.32.46/arch/sparc/include/asm/uaccess.h linux-2.6.32.46/arch/sparc/include/asm/uaccess.h
4266 --- linux-2.6.32.46/arch/sparc/include/asm/uaccess.h 2011-03-27 14:31:47.000000000 -0400
4267 +++ linux-2.6.32.46/arch/sparc/include/asm/uaccess.h 2011-04-17 15:56:46.000000000 -0400
4268 @@ -1,5 +1,13 @@
4269 #ifndef ___ASM_SPARC_UACCESS_H
4270 #define ___ASM_SPARC_UACCESS_H
4271 +
4272 +#ifdef __KERNEL__
4273 +#ifndef __ASSEMBLY__
4274 +#include <linux/types.h>
4275 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
4276 +#endif
4277 +#endif
4278 +
4279 #if defined(__sparc__) && defined(__arch64__)
4280 #include <asm/uaccess_64.h>
4281 #else
4282 diff -urNp linux-2.6.32.46/arch/sparc/kernel/iommu.c linux-2.6.32.46/arch/sparc/kernel/iommu.c
4283 --- linux-2.6.32.46/arch/sparc/kernel/iommu.c 2011-03-27 14:31:47.000000000 -0400
4284 +++ linux-2.6.32.46/arch/sparc/kernel/iommu.c 2011-04-17 15:56:46.000000000 -0400
4285 @@ -826,7 +826,7 @@ static void dma_4u_sync_sg_for_cpu(struc
4286 spin_unlock_irqrestore(&iommu->lock, flags);
4287 }
4288
4289 -static struct dma_map_ops sun4u_dma_ops = {
4290 +static const struct dma_map_ops sun4u_dma_ops = {
4291 .alloc_coherent = dma_4u_alloc_coherent,
4292 .free_coherent = dma_4u_free_coherent,
4293 .map_page = dma_4u_map_page,
4294 @@ -837,7 +837,7 @@ static struct dma_map_ops sun4u_dma_ops
4295 .sync_sg_for_cpu = dma_4u_sync_sg_for_cpu,
4296 };
4297
4298 -struct dma_map_ops *dma_ops = &sun4u_dma_ops;
4299 +const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
4300 EXPORT_SYMBOL(dma_ops);
4301
4302 extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
4303 diff -urNp linux-2.6.32.46/arch/sparc/kernel/ioport.c linux-2.6.32.46/arch/sparc/kernel/ioport.c
4304 --- linux-2.6.32.46/arch/sparc/kernel/ioport.c 2011-03-27 14:31:47.000000000 -0400
4305 +++ linux-2.6.32.46/arch/sparc/kernel/ioport.c 2011-04-17 15:56:46.000000000 -0400
4306 @@ -392,7 +392,7 @@ static void sbus_sync_sg_for_device(stru
4307 BUG();
4308 }
4309
4310 -struct dma_map_ops sbus_dma_ops = {
4311 +const struct dma_map_ops sbus_dma_ops = {
4312 .alloc_coherent = sbus_alloc_coherent,
4313 .free_coherent = sbus_free_coherent,
4314 .map_page = sbus_map_page,
4315 @@ -403,7 +403,7 @@ struct dma_map_ops sbus_dma_ops = {
4316 .sync_sg_for_device = sbus_sync_sg_for_device,
4317 };
4318
4319 -struct dma_map_ops *dma_ops = &sbus_dma_ops;
4320 +const struct dma_map_ops *dma_ops = &sbus_dma_ops;
4321 EXPORT_SYMBOL(dma_ops);
4322
4323 static int __init sparc_register_ioport(void)
4324 @@ -640,7 +640,7 @@ static void pci32_sync_sg_for_device(str
4325 }
4326 }
4327
4328 -struct dma_map_ops pci32_dma_ops = {
4329 +const struct dma_map_ops pci32_dma_ops = {
4330 .alloc_coherent = pci32_alloc_coherent,
4331 .free_coherent = pci32_free_coherent,
4332 .map_page = pci32_map_page,
4333 diff -urNp linux-2.6.32.46/arch/sparc/kernel/kgdb_32.c linux-2.6.32.46/arch/sparc/kernel/kgdb_32.c
4334 --- linux-2.6.32.46/arch/sparc/kernel/kgdb_32.c 2011-03-27 14:31:47.000000000 -0400
4335 +++ linux-2.6.32.46/arch/sparc/kernel/kgdb_32.c 2011-04-17 15:56:46.000000000 -0400
4336 @@ -158,7 +158,7 @@ void kgdb_arch_exit(void)
4337 {
4338 }
4339
4340 -struct kgdb_arch arch_kgdb_ops = {
4341 +const struct kgdb_arch arch_kgdb_ops = {
4342 /* Breakpoint instruction: ta 0x7d */
4343 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x7d },
4344 };
4345 diff -urNp linux-2.6.32.46/arch/sparc/kernel/kgdb_64.c linux-2.6.32.46/arch/sparc/kernel/kgdb_64.c
4346 --- linux-2.6.32.46/arch/sparc/kernel/kgdb_64.c 2011-03-27 14:31:47.000000000 -0400
4347 +++ linux-2.6.32.46/arch/sparc/kernel/kgdb_64.c 2011-04-17 15:56:46.000000000 -0400
4348 @@ -180,7 +180,7 @@ void kgdb_arch_exit(void)
4349 {
4350 }
4351
4352 -struct kgdb_arch arch_kgdb_ops = {
4353 +const struct kgdb_arch arch_kgdb_ops = {
4354 /* Breakpoint instruction: ta 0x72 */
4355 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x72 },
4356 };
4357 diff -urNp linux-2.6.32.46/arch/sparc/kernel/Makefile linux-2.6.32.46/arch/sparc/kernel/Makefile
4358 --- linux-2.6.32.46/arch/sparc/kernel/Makefile 2011-03-27 14:31:47.000000000 -0400
4359 +++ linux-2.6.32.46/arch/sparc/kernel/Makefile 2011-04-17 15:56:46.000000000 -0400
4360 @@ -3,7 +3,7 @@
4361 #
4362
4363 asflags-y := -ansi
4364 -ccflags-y := -Werror
4365 +#ccflags-y := -Werror
4366
4367 extra-y := head_$(BITS).o
4368 extra-y += init_task.o
4369 diff -urNp linux-2.6.32.46/arch/sparc/kernel/pci_sun4v.c linux-2.6.32.46/arch/sparc/kernel/pci_sun4v.c
4370 --- linux-2.6.32.46/arch/sparc/kernel/pci_sun4v.c 2011-03-27 14:31:47.000000000 -0400
4371 +++ linux-2.6.32.46/arch/sparc/kernel/pci_sun4v.c 2011-04-17 15:56:46.000000000 -0400
4372 @@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
4373 spin_unlock_irqrestore(&iommu->lock, flags);
4374 }
4375
4376 -static struct dma_map_ops sun4v_dma_ops = {
4377 +static const struct dma_map_ops sun4v_dma_ops = {
4378 .alloc_coherent = dma_4v_alloc_coherent,
4379 .free_coherent = dma_4v_free_coherent,
4380 .map_page = dma_4v_map_page,
4381 diff -urNp linux-2.6.32.46/arch/sparc/kernel/process_32.c linux-2.6.32.46/arch/sparc/kernel/process_32.c
4382 --- linux-2.6.32.46/arch/sparc/kernel/process_32.c 2011-03-27 14:31:47.000000000 -0400
4383 +++ linux-2.6.32.46/arch/sparc/kernel/process_32.c 2011-04-17 15:56:46.000000000 -0400
4384 @@ -196,7 +196,7 @@ void __show_backtrace(unsigned long fp)
4385 rw->ins[4], rw->ins[5],
4386 rw->ins[6],
4387 rw->ins[7]);
4388 - printk("%pS\n", (void *) rw->ins[7]);
4389 + printk("%pA\n", (void *) rw->ins[7]);
4390 rw = (struct reg_window32 *) rw->ins[6];
4391 }
4392 spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
4393 @@ -263,14 +263,14 @@ void show_regs(struct pt_regs *r)
4394
4395 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
4396 r->psr, r->pc, r->npc, r->y, print_tainted());
4397 - printk("PC: <%pS>\n", (void *) r->pc);
4398 + printk("PC: <%pA>\n", (void *) r->pc);
4399 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
4400 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
4401 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
4402 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
4403 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
4404 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
4405 - printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
4406 + printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
4407
4408 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
4409 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
4410 @@ -305,7 +305,7 @@ void show_stack(struct task_struct *tsk,
4411 rw = (struct reg_window32 *) fp;
4412 pc = rw->ins[7];
4413 printk("[%08lx : ", pc);
4414 - printk("%pS ] ", (void *) pc);
4415 + printk("%pA ] ", (void *) pc);
4416 fp = rw->ins[6];
4417 } while (++count < 16);
4418 printk("\n");
4419 diff -urNp linux-2.6.32.46/arch/sparc/kernel/process_64.c linux-2.6.32.46/arch/sparc/kernel/process_64.c
4420 --- linux-2.6.32.46/arch/sparc/kernel/process_64.c 2011-03-27 14:31:47.000000000 -0400
4421 +++ linux-2.6.32.46/arch/sparc/kernel/process_64.c 2011-04-17 15:56:46.000000000 -0400
4422 @@ -180,14 +180,14 @@ static void show_regwindow(struct pt_reg
4423 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
4424 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
4425 if (regs->tstate & TSTATE_PRIV)
4426 - printk("I7: <%pS>\n", (void *) rwk->ins[7]);
4427 + printk("I7: <%pA>\n", (void *) rwk->ins[7]);
4428 }
4429
4430 void show_regs(struct pt_regs *regs)
4431 {
4432 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
4433 regs->tpc, regs->tnpc, regs->y, print_tainted());
4434 - printk("TPC: <%pS>\n", (void *) regs->tpc);
4435 + printk("TPC: <%pA>\n", (void *) regs->tpc);
4436 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
4437 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
4438 regs->u_regs[3]);
4439 @@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
4440 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
4441 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
4442 regs->u_regs[15]);
4443 - printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
4444 + printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
4445 show_regwindow(regs);
4446 }
4447
4448 @@ -284,7 +284,7 @@ void arch_trigger_all_cpu_backtrace(void
4449 ((tp && tp->task) ? tp->task->pid : -1));
4450
4451 if (gp->tstate & TSTATE_PRIV) {
4452 - printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
4453 + printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
4454 (void *) gp->tpc,
4455 (void *) gp->o7,
4456 (void *) gp->i7,
4457 diff -urNp linux-2.6.32.46/arch/sparc/kernel/sys_sparc_32.c linux-2.6.32.46/arch/sparc/kernel/sys_sparc_32.c
4458 --- linux-2.6.32.46/arch/sparc/kernel/sys_sparc_32.c 2011-03-27 14:31:47.000000000 -0400
4459 +++ linux-2.6.32.46/arch/sparc/kernel/sys_sparc_32.c 2011-04-17 15:56:46.000000000 -0400
4460 @@ -57,7 +57,7 @@ unsigned long arch_get_unmapped_area(str
4461 if (ARCH_SUN4C && len > 0x20000000)
4462 return -ENOMEM;
4463 if (!addr)
4464 - addr = TASK_UNMAPPED_BASE;
4465 + addr = current->mm->mmap_base;
4466
4467 if (flags & MAP_SHARED)
4468 addr = COLOUR_ALIGN(addr);
4469 @@ -72,7 +72,7 @@ unsigned long arch_get_unmapped_area(str
4470 }
4471 if (TASK_SIZE - PAGE_SIZE - len < addr)
4472 return -ENOMEM;
4473 - if (!vmm || addr + len <= vmm->vm_start)
4474 + if (check_heap_stack_gap(vmm, addr, len))
4475 return addr;
4476 addr = vmm->vm_end;
4477 if (flags & MAP_SHARED)
4478 diff -urNp linux-2.6.32.46/arch/sparc/kernel/sys_sparc_64.c linux-2.6.32.46/arch/sparc/kernel/sys_sparc_64.c
4479 --- linux-2.6.32.46/arch/sparc/kernel/sys_sparc_64.c 2011-03-27 14:31:47.000000000 -0400
4480 +++ linux-2.6.32.46/arch/sparc/kernel/sys_sparc_64.c 2011-04-17 15:56:46.000000000 -0400
4481 @@ -125,7 +125,7 @@ unsigned long arch_get_unmapped_area(str
4482 /* We do not accept a shared mapping if it would violate
4483 * cache aliasing constraints.
4484 */
4485 - if ((flags & MAP_SHARED) &&
4486 + if ((filp || (flags & MAP_SHARED)) &&
4487 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
4488 return -EINVAL;
4489 return addr;
4490 @@ -140,6 +140,10 @@ unsigned long arch_get_unmapped_area(str
4491 if (filp || (flags & MAP_SHARED))
4492 do_color_align = 1;
4493
4494 +#ifdef CONFIG_PAX_RANDMMAP
4495 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
4496 +#endif
4497 +
4498 if (addr) {
4499 if (do_color_align)
4500 addr = COLOUR_ALIGN(addr, pgoff);
4501 @@ -147,15 +151,14 @@ unsigned long arch_get_unmapped_area(str
4502 addr = PAGE_ALIGN(addr);
4503
4504 vma = find_vma(mm, addr);
4505 - if (task_size - len >= addr &&
4506 - (!vma || addr + len <= vma->vm_start))
4507 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
4508 return addr;
4509 }
4510
4511 if (len > mm->cached_hole_size) {
4512 - start_addr = addr = mm->free_area_cache;
4513 + start_addr = addr = mm->free_area_cache;
4514 } else {
4515 - start_addr = addr = TASK_UNMAPPED_BASE;
4516 + start_addr = addr = mm->mmap_base;
4517 mm->cached_hole_size = 0;
4518 }
4519
4520 @@ -175,14 +178,14 @@ full_search:
4521 vma = find_vma(mm, VA_EXCLUDE_END);
4522 }
4523 if (unlikely(task_size < addr)) {
4524 - if (start_addr != TASK_UNMAPPED_BASE) {
4525 - start_addr = addr = TASK_UNMAPPED_BASE;
4526 + if (start_addr != mm->mmap_base) {
4527 + start_addr = addr = mm->mmap_base;
4528 mm->cached_hole_size = 0;
4529 goto full_search;
4530 }
4531 return -ENOMEM;
4532 }
4533 - if (likely(!vma || addr + len <= vma->vm_start)) {
4534 + if (likely(check_heap_stack_gap(vma, addr, len))) {
4535 /*
4536 * Remember the place where we stopped the search:
4537 */
4538 @@ -216,7 +219,7 @@ arch_get_unmapped_area_topdown(struct fi
4539 /* We do not accept a shared mapping if it would violate
4540 * cache aliasing constraints.
4541 */
4542 - if ((flags & MAP_SHARED) &&
4543 + if ((filp || (flags & MAP_SHARED)) &&
4544 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
4545 return -EINVAL;
4546 return addr;
4547 @@ -237,8 +240,7 @@ arch_get_unmapped_area_topdown(struct fi
4548 addr = PAGE_ALIGN(addr);
4549
4550 vma = find_vma(mm, addr);
4551 - if (task_size - len >= addr &&
4552 - (!vma || addr + len <= vma->vm_start))
4553 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
4554 return addr;
4555 }
4556
4557 @@ -259,7 +261,7 @@ arch_get_unmapped_area_topdown(struct fi
4558 /* make sure it can fit in the remaining address space */
4559 if (likely(addr > len)) {
4560 vma = find_vma(mm, addr-len);
4561 - if (!vma || addr <= vma->vm_start) {
4562 + if (check_heap_stack_gap(vma, addr - len, len)) {
4563 /* remember the address as a hint for next time */
4564 return (mm->free_area_cache = addr-len);
4565 }
4566 @@ -268,18 +270,18 @@ arch_get_unmapped_area_topdown(struct fi
4567 if (unlikely(mm->mmap_base < len))
4568 goto bottomup;
4569
4570 - addr = mm->mmap_base-len;
4571 - if (do_color_align)
4572 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4573 + addr = mm->mmap_base - len;
4574
4575 do {
4576 + if (do_color_align)
4577 + addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4578 /*
4579 * Lookup failure means no vma is above this address,
4580 * else if new region fits below vma->vm_start,
4581 * return with success:
4582 */
4583 vma = find_vma(mm, addr);
4584 - if (likely(!vma || addr+len <= vma->vm_start)) {
4585 + if (likely(check_heap_stack_gap(vma, addr, len))) {
4586 /* remember the address as a hint for next time */
4587 return (mm->free_area_cache = addr);
4588 }
4589 @@ -289,10 +291,8 @@ arch_get_unmapped_area_topdown(struct fi
4590 mm->cached_hole_size = vma->vm_start - addr;
4591
4592 /* try just below the current vma->vm_start */
4593 - addr = vma->vm_start-len;
4594 - if (do_color_align)
4595 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4596 - } while (likely(len < vma->vm_start));
4597 + addr = skip_heap_stack_gap(vma, len);
4598 + } while (!IS_ERR_VALUE(addr));
4599
4600 bottomup:
4601 /*
4602 @@ -384,6 +384,12 @@ void arch_pick_mmap_layout(struct mm_str
4603 current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY ||
4604 sysctl_legacy_va_layout) {
4605 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
4606 +
4607 +#ifdef CONFIG_PAX_RANDMMAP
4608 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4609 + mm->mmap_base += mm->delta_mmap;
4610 +#endif
4611 +
4612 mm->get_unmapped_area = arch_get_unmapped_area;
4613 mm->unmap_area = arch_unmap_area;
4614 } else {
4615 @@ -398,6 +404,12 @@ void arch_pick_mmap_layout(struct mm_str
4616 gap = (task_size / 6 * 5);
4617
4618 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
4619 +
4620 +#ifdef CONFIG_PAX_RANDMMAP
4621 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4622 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4623 +#endif
4624 +
4625 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4626 mm->unmap_area = arch_unmap_area_topdown;
4627 }
4628 diff -urNp linux-2.6.32.46/arch/sparc/kernel/traps_32.c linux-2.6.32.46/arch/sparc/kernel/traps_32.c
4629 --- linux-2.6.32.46/arch/sparc/kernel/traps_32.c 2011-03-27 14:31:47.000000000 -0400
4630 +++ linux-2.6.32.46/arch/sparc/kernel/traps_32.c 2011-06-13 21:25:39.000000000 -0400
4631 @@ -44,6 +44,8 @@ static void instruction_dump(unsigned lo
4632 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
4633 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
4634
4635 +extern void gr_handle_kernel_exploit(void);
4636 +
4637 void die_if_kernel(char *str, struct pt_regs *regs)
4638 {
4639 static int die_counter;
4640 @@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_
4641 count++ < 30 &&
4642 (((unsigned long) rw) >= PAGE_OFFSET) &&
4643 !(((unsigned long) rw) & 0x7)) {
4644 - printk("Caller[%08lx]: %pS\n", rw->ins[7],
4645 + printk("Caller[%08lx]: %pA\n", rw->ins[7],
4646 (void *) rw->ins[7]);
4647 rw = (struct reg_window32 *)rw->ins[6];
4648 }
4649 }
4650 printk("Instruction DUMP:");
4651 instruction_dump ((unsigned long *) regs->pc);
4652 - if(regs->psr & PSR_PS)
4653 + if(regs->psr & PSR_PS) {
4654 + gr_handle_kernel_exploit();
4655 do_exit(SIGKILL);
4656 + }
4657 do_exit(SIGSEGV);
4658 }
4659
4660 diff -urNp linux-2.6.32.46/arch/sparc/kernel/traps_64.c linux-2.6.32.46/arch/sparc/kernel/traps_64.c
4661 --- linux-2.6.32.46/arch/sparc/kernel/traps_64.c 2011-03-27 14:31:47.000000000 -0400
4662 +++ linux-2.6.32.46/arch/sparc/kernel/traps_64.c 2011-06-13 21:24:11.000000000 -0400
4663 @@ -73,7 +73,7 @@ static void dump_tl1_traplog(struct tl1_
4664 i + 1,
4665 p->trapstack[i].tstate, p->trapstack[i].tpc,
4666 p->trapstack[i].tnpc, p->trapstack[i].tt);
4667 - printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
4668 + printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
4669 }
4670 }
4671
4672 @@ -93,6 +93,12 @@ void bad_trap(struct pt_regs *regs, long
4673
4674 lvl -= 0x100;
4675 if (regs->tstate & TSTATE_PRIV) {
4676 +
4677 +#ifdef CONFIG_PAX_REFCOUNT
4678 + if (lvl == 6)
4679 + pax_report_refcount_overflow(regs);
4680 +#endif
4681 +
4682 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
4683 die_if_kernel(buffer, regs);
4684 }
4685 @@ -111,11 +117,16 @@ void bad_trap(struct pt_regs *regs, long
4686 void bad_trap_tl1(struct pt_regs *regs, long lvl)
4687 {
4688 char buffer[32];
4689 -
4690 +
4691 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
4692 0, lvl, SIGTRAP) == NOTIFY_STOP)
4693 return;
4694
4695 +#ifdef CONFIG_PAX_REFCOUNT
4696 + if (lvl == 6)
4697 + pax_report_refcount_overflow(regs);
4698 +#endif
4699 +
4700 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
4701
4702 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
4703 @@ -1139,7 +1150,7 @@ static void cheetah_log_errors(struct pt
4704 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
4705 printk("%s" "ERROR(%d): ",
4706 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
4707 - printk("TPC<%pS>\n", (void *) regs->tpc);
4708 + printk("TPC<%pA>\n", (void *) regs->tpc);
4709 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
4710 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
4711 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
4712 @@ -1746,7 +1757,7 @@ void cheetah_plus_parity_error(int type,
4713 smp_processor_id(),
4714 (type & 0x1) ? 'I' : 'D',
4715 regs->tpc);
4716 - printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
4717 + printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
4718 panic("Irrecoverable Cheetah+ parity error.");
4719 }
4720
4721 @@ -1754,7 +1765,7 @@ void cheetah_plus_parity_error(int type,
4722 smp_processor_id(),
4723 (type & 0x1) ? 'I' : 'D',
4724 regs->tpc);
4725 - printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
4726 + printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
4727 }
4728
4729 struct sun4v_error_entry {
4730 @@ -1961,9 +1972,9 @@ void sun4v_itlb_error_report(struct pt_r
4731
4732 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
4733 regs->tpc, tl);
4734 - printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
4735 + printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
4736 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
4737 - printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
4738 + printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
4739 (void *) regs->u_regs[UREG_I7]);
4740 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
4741 "pte[%lx] error[%lx]\n",
4742 @@ -1985,9 +1996,9 @@ void sun4v_dtlb_error_report(struct pt_r
4743
4744 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
4745 regs->tpc, tl);
4746 - printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
4747 + printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
4748 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
4749 - printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
4750 + printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
4751 (void *) regs->u_regs[UREG_I7]);
4752 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
4753 "pte[%lx] error[%lx]\n",
4754 @@ -2191,7 +2202,7 @@ void show_stack(struct task_struct *tsk,
4755 fp = (unsigned long)sf->fp + STACK_BIAS;
4756 }
4757
4758 - printk(" [%016lx] %pS\n", pc, (void *) pc);
4759 + printk(" [%016lx] %pA\n", pc, (void *) pc);
4760 } while (++count < 16);
4761 }
4762
4763 @@ -2233,6 +2244,8 @@ static inline struct reg_window *kernel_
4764 return (struct reg_window *) (fp + STACK_BIAS);
4765 }
4766
4767 +extern void gr_handle_kernel_exploit(void);
4768 +
4769 void die_if_kernel(char *str, struct pt_regs *regs)
4770 {
4771 static int die_counter;
4772 @@ -2260,7 +2273,7 @@ void die_if_kernel(char *str, struct pt_
4773 while (rw &&
4774 count++ < 30&&
4775 is_kernel_stack(current, rw)) {
4776 - printk("Caller[%016lx]: %pS\n", rw->ins[7],
4777 + printk("Caller[%016lx]: %pA\n", rw->ins[7],
4778 (void *) rw->ins[7]);
4779
4780 rw = kernel_stack_up(rw);
4781 @@ -2273,8 +2286,11 @@ void die_if_kernel(char *str, struct pt_
4782 }
4783 user_instruction_dump ((unsigned int __user *) regs->tpc);
4784 }
4785 - if (regs->tstate & TSTATE_PRIV)
4786 + if (regs->tstate & TSTATE_PRIV) {
4787 + gr_handle_kernel_exploit();
4788 do_exit(SIGKILL);
4789 + }
4790 +
4791 do_exit(SIGSEGV);
4792 }
4793 EXPORT_SYMBOL(die_if_kernel);
4794 diff -urNp linux-2.6.32.46/arch/sparc/kernel/una_asm_64.S linux-2.6.32.46/arch/sparc/kernel/una_asm_64.S
4795 --- linux-2.6.32.46/arch/sparc/kernel/una_asm_64.S 2011-03-27 14:31:47.000000000 -0400
4796 +++ linux-2.6.32.46/arch/sparc/kernel/una_asm_64.S 2011-07-13 22:20:05.000000000 -0400
4797 @@ -127,7 +127,7 @@ do_int_load:
4798 wr %o5, 0x0, %asi
4799 retl
4800 mov 0, %o0
4801 - .size __do_int_load, .-__do_int_load
4802 + .size do_int_load, .-do_int_load
4803
4804 .section __ex_table,"a"
4805 .word 4b, __retl_efault
4806 diff -urNp linux-2.6.32.46/arch/sparc/kernel/unaligned_64.c linux-2.6.32.46/arch/sparc/kernel/unaligned_64.c
4807 --- linux-2.6.32.46/arch/sparc/kernel/unaligned_64.c 2011-03-27 14:31:47.000000000 -0400
4808 +++ linux-2.6.32.46/arch/sparc/kernel/unaligned_64.c 2011-04-17 15:56:46.000000000 -0400
4809 @@ -288,7 +288,7 @@ static void log_unaligned(struct pt_regs
4810 if (count < 5) {
4811 last_time = jiffies;
4812 count++;
4813 - printk("Kernel unaligned access at TPC[%lx] %pS\n",
4814 + printk("Kernel unaligned access at TPC[%lx] %pA\n",
4815 regs->tpc, (void *) regs->tpc);
4816 }
4817 }
4818 diff -urNp linux-2.6.32.46/arch/sparc/lib/atomic_64.S linux-2.6.32.46/arch/sparc/lib/atomic_64.S
4819 --- linux-2.6.32.46/arch/sparc/lib/atomic_64.S 2011-03-27 14:31:47.000000000 -0400
4820 +++ linux-2.6.32.46/arch/sparc/lib/atomic_64.S 2011-04-17 15:56:46.000000000 -0400
4821 @@ -18,7 +18,12 @@
4822 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
4823 BACKOFF_SETUP(%o2)
4824 1: lduw [%o1], %g1
4825 - add %g1, %o0, %g7
4826 + addcc %g1, %o0, %g7
4827 +
4828 +#ifdef CONFIG_PAX_REFCOUNT
4829 + tvs %icc, 6
4830 +#endif
4831 +
4832 cas [%o1], %g1, %g7
4833 cmp %g1, %g7
4834 bne,pn %icc, 2f
4835 @@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
4836 2: BACKOFF_SPIN(%o2, %o3, 1b)
4837 .size atomic_add, .-atomic_add
4838
4839 + .globl atomic_add_unchecked
4840 + .type atomic_add_unchecked,#function
4841 +atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4842 + BACKOFF_SETUP(%o2)
4843 +1: lduw [%o1], %g1
4844 + add %g1, %o0, %g7
4845 + cas [%o1], %g1, %g7
4846 + cmp %g1, %g7
4847 + bne,pn %icc, 2f
4848 + nop
4849 + retl
4850 + nop
4851 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4852 + .size atomic_add_unchecked, .-atomic_add_unchecked
4853 +
4854 .globl atomic_sub
4855 .type atomic_sub,#function
4856 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4857 BACKOFF_SETUP(%o2)
4858 1: lduw [%o1], %g1
4859 - sub %g1, %o0, %g7
4860 + subcc %g1, %o0, %g7
4861 +
4862 +#ifdef CONFIG_PAX_REFCOUNT
4863 + tvs %icc, 6
4864 +#endif
4865 +
4866 cas [%o1], %g1, %g7
4867 cmp %g1, %g7
4868 bne,pn %icc, 2f
4869 @@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
4870 2: BACKOFF_SPIN(%o2, %o3, 1b)
4871 .size atomic_sub, .-atomic_sub
4872
4873 + .globl atomic_sub_unchecked
4874 + .type atomic_sub_unchecked,#function
4875 +atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
4876 + BACKOFF_SETUP(%o2)
4877 +1: lduw [%o1], %g1
4878 + sub %g1, %o0, %g7
4879 + cas [%o1], %g1, %g7
4880 + cmp %g1, %g7
4881 + bne,pn %icc, 2f
4882 + nop
4883 + retl
4884 + nop
4885 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4886 + .size atomic_sub_unchecked, .-atomic_sub_unchecked
4887 +
4888 .globl atomic_add_ret
4889 .type atomic_add_ret,#function
4890 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4891 BACKOFF_SETUP(%o2)
4892 1: lduw [%o1], %g1
4893 - add %g1, %o0, %g7
4894 + addcc %g1, %o0, %g7
4895 +
4896 +#ifdef CONFIG_PAX_REFCOUNT
4897 + tvs %icc, 6
4898 +#endif
4899 +
4900 cas [%o1], %g1, %g7
4901 cmp %g1, %g7
4902 bne,pn %icc, 2f
4903 @@ -59,12 +104,33 @@ atomic_add_ret: /* %o0 = increment, %o1
4904 2: BACKOFF_SPIN(%o2, %o3, 1b)
4905 .size atomic_add_ret, .-atomic_add_ret
4906
4907 + .globl atomic_add_ret_unchecked
4908 + .type atomic_add_ret_unchecked,#function
4909 +atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4910 + BACKOFF_SETUP(%o2)
4911 +1: lduw [%o1], %g1
4912 + addcc %g1, %o0, %g7
4913 + cas [%o1], %g1, %g7
4914 + cmp %g1, %g7
4915 + bne,pn %icc, 2f
4916 + add %g7, %o0, %g7
4917 + sra %g7, 0, %o0
4918 + retl
4919 + nop
4920 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4921 + .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
4922 +
4923 .globl atomic_sub_ret
4924 .type atomic_sub_ret,#function
4925 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4926 BACKOFF_SETUP(%o2)
4927 1: lduw [%o1], %g1
4928 - sub %g1, %o0, %g7
4929 + subcc %g1, %o0, %g7
4930 +
4931 +#ifdef CONFIG_PAX_REFCOUNT
4932 + tvs %icc, 6
4933 +#endif
4934 +
4935 cas [%o1], %g1, %g7
4936 cmp %g1, %g7
4937 bne,pn %icc, 2f
4938 @@ -80,7 +146,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1
4939 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
4940 BACKOFF_SETUP(%o2)
4941 1: ldx [%o1], %g1
4942 - add %g1, %o0, %g7
4943 + addcc %g1, %o0, %g7
4944 +
4945 +#ifdef CONFIG_PAX_REFCOUNT
4946 + tvs %xcc, 6
4947 +#endif
4948 +
4949 casx [%o1], %g1, %g7
4950 cmp %g1, %g7
4951 bne,pn %xcc, 2f
4952 @@ -90,12 +161,32 @@ atomic64_add: /* %o0 = increment, %o1 =
4953 2: BACKOFF_SPIN(%o2, %o3, 1b)
4954 .size atomic64_add, .-atomic64_add
4955
4956 + .globl atomic64_add_unchecked
4957 + .type atomic64_add_unchecked,#function
4958 +atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4959 + BACKOFF_SETUP(%o2)
4960 +1: ldx [%o1], %g1
4961 + addcc %g1, %o0, %g7
4962 + casx [%o1], %g1, %g7
4963 + cmp %g1, %g7
4964 + bne,pn %xcc, 2f
4965 + nop
4966 + retl
4967 + nop
4968 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4969 + .size atomic64_add_unchecked, .-atomic64_add_unchecked
4970 +
4971 .globl atomic64_sub
4972 .type atomic64_sub,#function
4973 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4974 BACKOFF_SETUP(%o2)
4975 1: ldx [%o1], %g1
4976 - sub %g1, %o0, %g7
4977 + subcc %g1, %o0, %g7
4978 +
4979 +#ifdef CONFIG_PAX_REFCOUNT
4980 + tvs %xcc, 6
4981 +#endif
4982 +
4983 casx [%o1], %g1, %g7
4984 cmp %g1, %g7
4985 bne,pn %xcc, 2f
4986 @@ -105,12 +196,32 @@ atomic64_sub: /* %o0 = decrement, %o1 =
4987 2: BACKOFF_SPIN(%o2, %o3, 1b)
4988 .size atomic64_sub, .-atomic64_sub
4989
4990 + .globl atomic64_sub_unchecked
4991 + .type atomic64_sub_unchecked,#function
4992 +atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
4993 + BACKOFF_SETUP(%o2)
4994 +1: ldx [%o1], %g1
4995 + subcc %g1, %o0, %g7
4996 + casx [%o1], %g1, %g7
4997 + cmp %g1, %g7
4998 + bne,pn %xcc, 2f
4999 + nop
5000 + retl
5001 + nop
5002 +2: BACKOFF_SPIN(%o2, %o3, 1b)
5003 + .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
5004 +
5005 .globl atomic64_add_ret
5006 .type atomic64_add_ret,#function
5007 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
5008 BACKOFF_SETUP(%o2)
5009 1: ldx [%o1], %g1
5010 - add %g1, %o0, %g7
5011 + addcc %g1, %o0, %g7
5012 +
5013 +#ifdef CONFIG_PAX_REFCOUNT
5014 + tvs %xcc, 6
5015 +#endif
5016 +
5017 casx [%o1], %g1, %g7
5018 cmp %g1, %g7
5019 bne,pn %xcc, 2f
5020 @@ -121,12 +232,33 @@ atomic64_add_ret: /* %o0 = increment, %o
5021 2: BACKOFF_SPIN(%o2, %o3, 1b)
5022 .size atomic64_add_ret, .-atomic64_add_ret
5023
5024 + .globl atomic64_add_ret_unchecked
5025 + .type atomic64_add_ret_unchecked,#function
5026 +atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
5027 + BACKOFF_SETUP(%o2)
5028 +1: ldx [%o1], %g1
5029 + addcc %g1, %o0, %g7
5030 + casx [%o1], %g1, %g7
5031 + cmp %g1, %g7
5032 + bne,pn %xcc, 2f
5033 + add %g7, %o0, %g7
5034 + mov %g7, %o0
5035 + retl
5036 + nop
5037 +2: BACKOFF_SPIN(%o2, %o3, 1b)
5038 + .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
5039 +
5040 .globl atomic64_sub_ret
5041 .type atomic64_sub_ret,#function
5042 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
5043 BACKOFF_SETUP(%o2)
5044 1: ldx [%o1], %g1
5045 - sub %g1, %o0, %g7
5046 + subcc %g1, %o0, %g7
5047 +
5048 +#ifdef CONFIG_PAX_REFCOUNT
5049 + tvs %xcc, 6
5050 +#endif
5051 +
5052 casx [%o1], %g1, %g7
5053 cmp %g1, %g7
5054 bne,pn %xcc, 2f
5055 diff -urNp linux-2.6.32.46/arch/sparc/lib/ksyms.c linux-2.6.32.46/arch/sparc/lib/ksyms.c
5056 --- linux-2.6.32.46/arch/sparc/lib/ksyms.c 2011-03-27 14:31:47.000000000 -0400
5057 +++ linux-2.6.32.46/arch/sparc/lib/ksyms.c 2011-08-19 23:05:14.000000000 -0400
5058 @@ -144,12 +144,18 @@ EXPORT_SYMBOL(__downgrade_write);
5059
5060 /* Atomic counter implementation. */
5061 EXPORT_SYMBOL(atomic_add);
5062 +EXPORT_SYMBOL(atomic_add_unchecked);
5063 EXPORT_SYMBOL(atomic_add_ret);
5064 +EXPORT_SYMBOL(atomic_add_ret_unchecked);
5065 EXPORT_SYMBOL(atomic_sub);
5066 +EXPORT_SYMBOL(atomic_sub_unchecked);
5067 EXPORT_SYMBOL(atomic_sub_ret);
5068 EXPORT_SYMBOL(atomic64_add);
5069 +EXPORT_SYMBOL(atomic64_add_unchecked);
5070 EXPORT_SYMBOL(atomic64_add_ret);
5071 +EXPORT_SYMBOL(atomic64_add_ret_unchecked);
5072 EXPORT_SYMBOL(atomic64_sub);
5073 +EXPORT_SYMBOL(atomic64_sub_unchecked);
5074 EXPORT_SYMBOL(atomic64_sub_ret);
5075
5076 /* Atomic bit operations. */
5077 diff -urNp linux-2.6.32.46/arch/sparc/lib/Makefile linux-2.6.32.46/arch/sparc/lib/Makefile
5078 --- linux-2.6.32.46/arch/sparc/lib/Makefile 2011-03-27 14:31:47.000000000 -0400
5079 +++ linux-2.6.32.46/arch/sparc/lib/Makefile 2011-05-17 19:26:34.000000000 -0400
5080 @@ -2,7 +2,7 @@
5081 #
5082
5083 asflags-y := -ansi -DST_DIV0=0x02
5084 -ccflags-y := -Werror
5085 +#ccflags-y := -Werror
5086
5087 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
5088 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
5089 diff -urNp linux-2.6.32.46/arch/sparc/lib/rwsem_64.S linux-2.6.32.46/arch/sparc/lib/rwsem_64.S
5090 --- linux-2.6.32.46/arch/sparc/lib/rwsem_64.S 2011-03-27 14:31:47.000000000 -0400
5091 +++ linux-2.6.32.46/arch/sparc/lib/rwsem_64.S 2011-04-17 15:56:46.000000000 -0400
5092 @@ -11,7 +11,12 @@
5093 .globl __down_read
5094 __down_read:
5095 1: lduw [%o0], %g1
5096 - add %g1, 1, %g7
5097 + addcc %g1, 1, %g7
5098 +
5099 +#ifdef CONFIG_PAX_REFCOUNT
5100 + tvs %icc, 6
5101 +#endif
5102 +
5103 cas [%o0], %g1, %g7
5104 cmp %g1, %g7
5105 bne,pn %icc, 1b
5106 @@ -33,7 +38,12 @@ __down_read:
5107 .globl __down_read_trylock
5108 __down_read_trylock:
5109 1: lduw [%o0], %g1
5110 - add %g1, 1, %g7
5111 + addcc %g1, 1, %g7
5112 +
5113 +#ifdef CONFIG_PAX_REFCOUNT
5114 + tvs %icc, 6
5115 +#endif
5116 +
5117 cmp %g7, 0
5118 bl,pn %icc, 2f
5119 mov 0, %o1
5120 @@ -51,7 +61,12 @@ __down_write:
5121 or %g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
5122 1:
5123 lduw [%o0], %g3
5124 - add %g3, %g1, %g7
5125 + addcc %g3, %g1, %g7
5126 +
5127 +#ifdef CONFIG_PAX_REFCOUNT
5128 + tvs %icc, 6
5129 +#endif
5130 +
5131 cas [%o0], %g3, %g7
5132 cmp %g3, %g7
5133 bne,pn %icc, 1b
5134 @@ -77,7 +92,12 @@ __down_write_trylock:
5135 cmp %g3, 0
5136 bne,pn %icc, 2f
5137 mov 0, %o1
5138 - add %g3, %g1, %g7
5139 + addcc %g3, %g1, %g7
5140 +
5141 +#ifdef CONFIG_PAX_REFCOUNT
5142 + tvs %icc, 6
5143 +#endif
5144 +
5145 cas [%o0], %g3, %g7
5146 cmp %g3, %g7
5147 bne,pn %icc, 1b
5148 @@ -90,7 +110,12 @@ __down_write_trylock:
5149 __up_read:
5150 1:
5151 lduw [%o0], %g1
5152 - sub %g1, 1, %g7
5153 + subcc %g1, 1, %g7
5154 +
5155 +#ifdef CONFIG_PAX_REFCOUNT
5156 + tvs %icc, 6
5157 +#endif
5158 +
5159 cas [%o0], %g1, %g7
5160 cmp %g1, %g7
5161 bne,pn %icc, 1b
5162 @@ -118,7 +143,12 @@ __up_write:
5163 or %g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
5164 1:
5165 lduw [%o0], %g3
5166 - sub %g3, %g1, %g7
5167 + subcc %g3, %g1, %g7
5168 +
5169 +#ifdef CONFIG_PAX_REFCOUNT
5170 + tvs %icc, 6
5171 +#endif
5172 +
5173 cas [%o0], %g3, %g7
5174 cmp %g3, %g7
5175 bne,pn %icc, 1b
5176 @@ -143,7 +173,12 @@ __downgrade_write:
5177 or %g1, %lo(RWSEM_WAITING_BIAS), %g1
5178 1:
5179 lduw [%o0], %g3
5180 - sub %g3, %g1, %g7
5181 + subcc %g3, %g1, %g7
5182 +
5183 +#ifdef CONFIG_PAX_REFCOUNT
5184 + tvs %icc, 6
5185 +#endif
5186 +
5187 cas [%o0], %g3, %g7
5188 cmp %g3, %g7
5189 bne,pn %icc, 1b
5190 diff -urNp linux-2.6.32.46/arch/sparc/Makefile linux-2.6.32.46/arch/sparc/Makefile
5191 --- linux-2.6.32.46/arch/sparc/Makefile 2011-03-27 14:31:47.000000000 -0400
5192 +++ linux-2.6.32.46/arch/sparc/Makefile 2011-04-17 15:56:46.000000000 -0400
5193 @@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc
5194 # Export what is needed by arch/sparc/boot/Makefile
5195 export VMLINUX_INIT VMLINUX_MAIN
5196 VMLINUX_INIT := $(head-y) $(init-y)
5197 -VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
5198 +VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
5199 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
5200 VMLINUX_MAIN += $(drivers-y) $(net-y)
5201
5202 diff -urNp linux-2.6.32.46/arch/sparc/mm/fault_32.c linux-2.6.32.46/arch/sparc/mm/fault_32.c
5203 --- linux-2.6.32.46/arch/sparc/mm/fault_32.c 2011-03-27 14:31:47.000000000 -0400
5204 +++ linux-2.6.32.46/arch/sparc/mm/fault_32.c 2011-04-17 15:56:46.000000000 -0400
5205 @@ -21,6 +21,9 @@
5206 #include <linux/interrupt.h>
5207 #include <linux/module.h>
5208 #include <linux/kdebug.h>
5209 +#include <linux/slab.h>
5210 +#include <linux/pagemap.h>
5211 +#include <linux/compiler.h>
5212
5213 #include <asm/system.h>
5214 #include <asm/page.h>
5215 @@ -167,6 +170,267 @@ static unsigned long compute_si_addr(str
5216 return safe_compute_effective_address(regs, insn);
5217 }
5218
5219 +#ifdef CONFIG_PAX_PAGEEXEC
5220 +#ifdef CONFIG_PAX_DLRESOLVE
5221 +static void pax_emuplt_close(struct vm_area_struct *vma)
5222 +{
5223 + vma->vm_mm->call_dl_resolve = 0UL;
5224 +}
5225 +
5226 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
5227 +{
5228 + unsigned int *kaddr;
5229 +
5230 + vmf->page = alloc_page(GFP_HIGHUSER);
5231 + if (!vmf->page)
5232 + return VM_FAULT_OOM;
5233 +
5234 + kaddr = kmap(vmf->page);
5235 + memset(kaddr, 0, PAGE_SIZE);
5236 + kaddr[0] = 0x9DE3BFA8U; /* save */
5237 + flush_dcache_page(vmf->page);
5238 + kunmap(vmf->page);
5239 + return VM_FAULT_MAJOR;
5240 +}
5241 +
5242 +static const struct vm_operations_struct pax_vm_ops = {
5243 + .close = pax_emuplt_close,
5244 + .fault = pax_emuplt_fault
5245 +};
5246 +
5247 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
5248 +{
5249 + int ret;
5250 +
5251 + vma->vm_mm = current->mm;
5252 + vma->vm_start = addr;
5253 + vma->vm_end = addr + PAGE_SIZE;
5254 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
5255 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
5256 + vma->vm_ops = &pax_vm_ops;
5257 +
5258 + ret = insert_vm_struct(current->mm, vma);
5259 + if (ret)
5260 + return ret;
5261 +
5262 + ++current->mm->total_vm;
5263 + return 0;
5264 +}
5265 +#endif
5266 +
5267 +/*
5268 + * PaX: decide what to do with offenders (regs->pc = fault address)
5269 + *
5270 + * returns 1 when task should be killed
5271 + * 2 when patched PLT trampoline was detected
5272 + * 3 when unpatched PLT trampoline was detected
5273 + */
5274 +static int pax_handle_fetch_fault(struct pt_regs *regs)
5275 +{
5276 +
5277 +#ifdef CONFIG_PAX_EMUPLT
5278 + int err;
5279 +
5280 + do { /* PaX: patched PLT emulation #1 */
5281 + unsigned int sethi1, sethi2, jmpl;
5282 +
5283 + err = get_user(sethi1, (unsigned int *)regs->pc);
5284 + err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
5285 + err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
5286 +
5287 + if (err)
5288 + break;
5289 +
5290 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
5291 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
5292 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
5293 + {
5294 + unsigned int addr;
5295 +
5296 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
5297 + addr = regs->u_regs[UREG_G1];
5298 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
5299 + regs->pc = addr;
5300 + regs->npc = addr+4;
5301 + return 2;
5302 + }
5303 + } while (0);
5304 +
5305 + { /* PaX: patched PLT emulation #2 */
5306 + unsigned int ba;
5307 +
5308 + err = get_user(ba, (unsigned int *)regs->pc);
5309 +
5310 + if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
5311 + unsigned int addr;
5312 +
5313 + addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
5314 + regs->pc = addr;
5315 + regs->npc = addr+4;
5316 + return 2;
5317 + }
5318 + }
5319 +
5320 + do { /* PaX: patched PLT emulation #3 */
5321 + unsigned int sethi, jmpl, nop;
5322 +
5323 + err = get_user(sethi, (unsigned int *)regs->pc);
5324 + err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
5325 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
5326 +
5327 + if (err)
5328 + break;
5329 +
5330 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5331 + (jmpl & 0xFFFFE000U) == 0x81C06000U &&
5332 + nop == 0x01000000U)
5333 + {
5334 + unsigned int addr;
5335 +
5336 + addr = (sethi & 0x003FFFFFU) << 10;
5337 + regs->u_regs[UREG_G1] = addr;
5338 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
5339 + regs->pc = addr;
5340 + regs->npc = addr+4;
5341 + return 2;
5342 + }
5343 + } while (0);
5344 +
5345 + do { /* PaX: unpatched PLT emulation step 1 */
5346 + unsigned int sethi, ba, nop;
5347 +
5348 + err = get_user(sethi, (unsigned int *)regs->pc);
5349 + err |= get_user(ba, (unsigned int *)(regs->pc+4));
5350 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
5351 +
5352 + if (err)
5353 + break;
5354 +
5355 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5356 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
5357 + nop == 0x01000000U)
5358 + {
5359 + unsigned int addr, save, call;
5360 +
5361 + if ((ba & 0xFFC00000U) == 0x30800000U)
5362 + addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
5363 + else
5364 + addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
5365 +
5366 + err = get_user(save, (unsigned int *)addr);
5367 + err |= get_user(call, (unsigned int *)(addr+4));
5368 + err |= get_user(nop, (unsigned int *)(addr+8));
5369 + if (err)
5370 + break;
5371 +
5372 +#ifdef CONFIG_PAX_DLRESOLVE
5373 + if (save == 0x9DE3BFA8U &&
5374 + (call & 0xC0000000U) == 0x40000000U &&
5375 + nop == 0x01000000U)
5376 + {
5377 + struct vm_area_struct *vma;
5378 + unsigned long call_dl_resolve;
5379 +
5380 + down_read(&current->mm->mmap_sem);
5381 + call_dl_resolve = current->mm->call_dl_resolve;
5382 + up_read(&current->mm->mmap_sem);
5383 + if (likely(call_dl_resolve))
5384 + goto emulate;
5385 +
5386 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
5387 +
5388 + down_write(&current->mm->mmap_sem);
5389 + if (current->mm->call_dl_resolve) {
5390 + call_dl_resolve = current->mm->call_dl_resolve;
5391 + up_write(&current->mm->mmap_sem);
5392 + if (vma)
5393 + kmem_cache_free(vm_area_cachep, vma);
5394 + goto emulate;
5395 + }
5396 +
5397 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
5398 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
5399 + up_write(&current->mm->mmap_sem);
5400 + if (vma)
5401 + kmem_cache_free(vm_area_cachep, vma);
5402 + return 1;
5403 + }
5404 +
5405 + if (pax_insert_vma(vma, call_dl_resolve)) {
5406 + up_write(&current->mm->mmap_sem);
5407 + kmem_cache_free(vm_area_cachep, vma);
5408 + return 1;
5409 + }
5410 +
5411 + current->mm->call_dl_resolve = call_dl_resolve;
5412 + up_write(&current->mm->mmap_sem);
5413 +
5414 +emulate:
5415 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5416 + regs->pc = call_dl_resolve;
5417 + regs->npc = addr+4;
5418 + return 3;
5419 + }
5420 +#endif
5421 +
5422 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
5423 + if ((save & 0xFFC00000U) == 0x05000000U &&
5424 + (call & 0xFFFFE000U) == 0x85C0A000U &&
5425 + nop == 0x01000000U)
5426 + {
5427 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5428 + regs->u_regs[UREG_G2] = addr + 4;
5429 + addr = (save & 0x003FFFFFU) << 10;
5430 + addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
5431 + regs->pc = addr;
5432 + regs->npc = addr+4;
5433 + return 3;
5434 + }
5435 + }
5436 + } while (0);
5437 +
5438 + do { /* PaX: unpatched PLT emulation step 2 */
5439 + unsigned int save, call, nop;
5440 +
5441 + err = get_user(save, (unsigned int *)(regs->pc-4));
5442 + err |= get_user(call, (unsigned int *)regs->pc);
5443 + err |= get_user(nop, (unsigned int *)(regs->pc+4));
5444 + if (err)
5445 + break;
5446 +
5447 + if (save == 0x9DE3BFA8U &&
5448 + (call & 0xC0000000U) == 0x40000000U &&
5449 + nop == 0x01000000U)
5450 + {
5451 + unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
5452 +
5453 + regs->u_regs[UREG_RETPC] = regs->pc;
5454 + regs->pc = dl_resolve;
5455 + regs->npc = dl_resolve+4;
5456 + return 3;
5457 + }
5458 + } while (0);
5459 +#endif
5460 +
5461 + return 1;
5462 +}
5463 +
5464 +void pax_report_insns(void *pc, void *sp)
5465 +{
5466 + unsigned long i;
5467 +
5468 + printk(KERN_ERR "PAX: bytes at PC: ");
5469 + for (i = 0; i < 8; i++) {
5470 + unsigned int c;
5471 + if (get_user(c, (unsigned int *)pc+i))
5472 + printk(KERN_CONT "???????? ");
5473 + else
5474 + printk(KERN_CONT "%08x ", c);
5475 + }
5476 + printk("\n");
5477 +}
5478 +#endif
5479 +
5480 asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
5481 unsigned long address)
5482 {
5483 @@ -231,6 +495,24 @@ good_area:
5484 if(!(vma->vm_flags & VM_WRITE))
5485 goto bad_area;
5486 } else {
5487 +
5488 +#ifdef CONFIG_PAX_PAGEEXEC
5489 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
5490 + up_read(&mm->mmap_sem);
5491 + switch (pax_handle_fetch_fault(regs)) {
5492 +
5493 +#ifdef CONFIG_PAX_EMUPLT
5494 + case 2:
5495 + case 3:
5496 + return;
5497 +#endif
5498 +
5499 + }
5500 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
5501 + do_group_exit(SIGKILL);
5502 + }
5503 +#endif
5504 +
5505 /* Allow reads even for write-only mappings */
5506 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
5507 goto bad_area;
5508 diff -urNp linux-2.6.32.46/arch/sparc/mm/fault_64.c linux-2.6.32.46/arch/sparc/mm/fault_64.c
5509 --- linux-2.6.32.46/arch/sparc/mm/fault_64.c 2011-03-27 14:31:47.000000000 -0400
5510 +++ linux-2.6.32.46/arch/sparc/mm/fault_64.c 2011-04-17 15:56:46.000000000 -0400
5511 @@ -20,6 +20,9 @@
5512 #include <linux/kprobes.h>
5513 #include <linux/kdebug.h>
5514 #include <linux/percpu.h>
5515 +#include <linux/slab.h>
5516 +#include <linux/pagemap.h>
5517 +#include <linux/compiler.h>
5518
5519 #include <asm/page.h>
5520 #include <asm/pgtable.h>
5521 @@ -78,7 +81,7 @@ static void bad_kernel_pc(struct pt_regs
5522 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
5523 regs->tpc);
5524 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
5525 - printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
5526 + printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
5527 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
5528 dump_stack();
5529 unhandled_fault(regs->tpc, current, regs);
5530 @@ -249,6 +252,456 @@ static void noinline bogus_32bit_fault_a
5531 show_regs(regs);
5532 }
5533
5534 +#ifdef CONFIG_PAX_PAGEEXEC
5535 +#ifdef CONFIG_PAX_DLRESOLVE
5536 +static void pax_emuplt_close(struct vm_area_struct *vma)
5537 +{
5538 + vma->vm_mm->call_dl_resolve = 0UL;
5539 +}
5540 +
5541 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
5542 +{
5543 + unsigned int *kaddr;
5544 +
5545 + vmf->page = alloc_page(GFP_HIGHUSER);
5546 + if (!vmf->page)
5547 + return VM_FAULT_OOM;
5548 +
5549 + kaddr = kmap(vmf->page);
5550 + memset(kaddr, 0, PAGE_SIZE);
5551 + kaddr[0] = 0x9DE3BFA8U; /* save */
5552 + flush_dcache_page(vmf->page);
5553 + kunmap(vmf->page);
5554 + return VM_FAULT_MAJOR;
5555 +}
5556 +
5557 +static const struct vm_operations_struct pax_vm_ops = {
5558 + .close = pax_emuplt_close,
5559 + .fault = pax_emuplt_fault
5560 +};
5561 +
5562 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
5563 +{
5564 + int ret;
5565 +
5566 + vma->vm_mm = current->mm;
5567 + vma->vm_start = addr;
5568 + vma->vm_end = addr + PAGE_SIZE;
5569 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
5570 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
5571 + vma->vm_ops = &pax_vm_ops;
5572 +
5573 + ret = insert_vm_struct(current->mm, vma);
5574 + if (ret)
5575 + return ret;
5576 +
5577 + ++current->mm->total_vm;
5578 + return 0;
5579 +}
5580 +#endif
5581 +
5582 +/*
5583 + * PaX: decide what to do with offenders (regs->tpc = fault address)
5584 + *
5585 + * returns 1 when task should be killed
5586 + * 2 when patched PLT trampoline was detected
5587 + * 3 when unpatched PLT trampoline was detected
5588 + */
5589 +static int pax_handle_fetch_fault(struct pt_regs *regs)
5590 +{
5591 +
5592 +#ifdef CONFIG_PAX_EMUPLT
5593 + int err;
5594 +
5595 + do { /* PaX: patched PLT emulation #1 */
5596 + unsigned int sethi1, sethi2, jmpl;
5597 +
5598 + err = get_user(sethi1, (unsigned int *)regs->tpc);
5599 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
5600 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
5601 +
5602 + if (err)
5603 + break;
5604 +
5605 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
5606 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
5607 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
5608 + {
5609 + unsigned long addr;
5610 +
5611 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
5612 + addr = regs->u_regs[UREG_G1];
5613 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5614 +
5615 + if (test_thread_flag(TIF_32BIT))
5616 + addr &= 0xFFFFFFFFUL;
5617 +
5618 + regs->tpc = addr;
5619 + regs->tnpc = addr+4;
5620 + return 2;
5621 + }
5622 + } while (0);
5623 +
5624 + { /* PaX: patched PLT emulation #2 */
5625 + unsigned int ba;
5626 +
5627 + err = get_user(ba, (unsigned int *)regs->tpc);
5628 +
5629 + if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
5630 + unsigned long addr;
5631 +
5632 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
5633 +
5634 + if (test_thread_flag(TIF_32BIT))
5635 + addr &= 0xFFFFFFFFUL;
5636 +
5637 + regs->tpc = addr;
5638 + regs->tnpc = addr+4;
5639 + return 2;
5640 + }
5641 + }
5642 +
5643 + do { /* PaX: patched PLT emulation #3 */
5644 + unsigned int sethi, jmpl, nop;
5645 +
5646 + err = get_user(sethi, (unsigned int *)regs->tpc);
5647 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
5648 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5649 +
5650 + if (err)
5651 + break;
5652 +
5653 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5654 + (jmpl & 0xFFFFE000U) == 0x81C06000U &&
5655 + nop == 0x01000000U)
5656 + {
5657 + unsigned long addr;
5658 +
5659 + addr = (sethi & 0x003FFFFFU) << 10;
5660 + regs->u_regs[UREG_G1] = addr;
5661 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5662 +
5663 + if (test_thread_flag(TIF_32BIT))
5664 + addr &= 0xFFFFFFFFUL;
5665 +
5666 + regs->tpc = addr;
5667 + regs->tnpc = addr+4;
5668 + return 2;
5669 + }
5670 + } while (0);
5671 +
5672 + do { /* PaX: patched PLT emulation #4 */
5673 + unsigned int sethi, mov1, call, mov2;
5674 +
5675 + err = get_user(sethi, (unsigned int *)regs->tpc);
5676 + err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
5677 + err |= get_user(call, (unsigned int *)(regs->tpc+8));
5678 + err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
5679 +
5680 + if (err)
5681 + break;
5682 +
5683 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5684 + mov1 == 0x8210000FU &&
5685 + (call & 0xC0000000U) == 0x40000000U &&
5686 + mov2 == 0x9E100001U)
5687 + {
5688 + unsigned long addr;
5689 +
5690 + regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
5691 + addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
5692 +
5693 + if (test_thread_flag(TIF_32BIT))
5694 + addr &= 0xFFFFFFFFUL;
5695 +
5696 + regs->tpc = addr;
5697 + regs->tnpc = addr+4;
5698 + return 2;
5699 + }
5700 + } while (0);
5701 +
5702 + do { /* PaX: patched PLT emulation #5 */
5703 + unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
5704 +
5705 + err = get_user(sethi, (unsigned int *)regs->tpc);
5706 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
5707 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
5708 + err |= get_user(or1, (unsigned int *)(regs->tpc+12));
5709 + err |= get_user(or2, (unsigned int *)(regs->tpc+16));
5710 + err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
5711 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
5712 + err |= get_user(nop, (unsigned int *)(regs->tpc+28));
5713 +
5714 + if (err)
5715 + break;
5716 +
5717 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5718 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
5719 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5720 + (or1 & 0xFFFFE000U) == 0x82106000U &&
5721 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
5722 + sllx == 0x83287020U &&
5723 + jmpl == 0x81C04005U &&
5724 + nop == 0x01000000U)
5725 + {
5726 + unsigned long addr;
5727 +
5728 + regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
5729 + regs->u_regs[UREG_G1] <<= 32;
5730 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
5731 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
5732 + regs->tpc = addr;
5733 + regs->tnpc = addr+4;
5734 + return 2;
5735 + }
5736 + } while (0);
5737 +
5738 + do { /* PaX: patched PLT emulation #6 */
5739 + unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
5740 +
5741 + err = get_user(sethi, (unsigned int *)regs->tpc);
5742 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
5743 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
5744 + err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
5745 + err |= get_user(or, (unsigned int *)(regs->tpc+16));
5746 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
5747 + err |= get_user(nop, (unsigned int *)(regs->tpc+24));
5748 +
5749 + if (err)
5750 + break;
5751 +
5752 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5753 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
5754 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5755 + sllx == 0x83287020U &&
5756 + (or & 0xFFFFE000U) == 0x8A116000U &&
5757 + jmpl == 0x81C04005U &&
5758 + nop == 0x01000000U)
5759 + {
5760 + unsigned long addr;
5761 +
5762 + regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
5763 + regs->u_regs[UREG_G1] <<= 32;
5764 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
5765 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
5766 + regs->tpc = addr;
5767 + regs->tnpc = addr+4;
5768 + return 2;
5769 + }
5770 + } while (0);
5771 +
5772 + do { /* PaX: unpatched PLT emulation step 1 */
5773 + unsigned int sethi, ba, nop;
5774 +
5775 + err = get_user(sethi, (unsigned int *)regs->tpc);
5776 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
5777 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5778 +
5779 + if (err)
5780 + break;
5781 +
5782 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5783 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
5784 + nop == 0x01000000U)
5785 + {
5786 + unsigned long addr;
5787 + unsigned int save, call;
5788 + unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
5789 +
5790 + if ((ba & 0xFFC00000U) == 0x30800000U)
5791 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
5792 + else
5793 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
5794 +
5795 + if (test_thread_flag(TIF_32BIT))
5796 + addr &= 0xFFFFFFFFUL;
5797 +
5798 + err = get_user(save, (unsigned int *)addr);
5799 + err |= get_user(call, (unsigned int *)(addr+4));
5800 + err |= get_user(nop, (unsigned int *)(addr+8));
5801 + if (err)
5802 + break;
5803 +
5804 +#ifdef CONFIG_PAX_DLRESOLVE
5805 + if (save == 0x9DE3BFA8U &&
5806 + (call & 0xC0000000U) == 0x40000000U &&
5807 + nop == 0x01000000U)
5808 + {
5809 + struct vm_area_struct *vma;
5810 + unsigned long call_dl_resolve;
5811 +
5812 + down_read(&current->mm->mmap_sem);
5813 + call_dl_resolve = current->mm->call_dl_resolve;
5814 + up_read(&current->mm->mmap_sem);
5815 + if (likely(call_dl_resolve))
5816 + goto emulate;
5817 +
5818 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
5819 +
5820 + down_write(&current->mm->mmap_sem);
5821 + if (current->mm->call_dl_resolve) {
5822 + call_dl_resolve = current->mm->call_dl_resolve;
5823 + up_write(&current->mm->mmap_sem);
5824 + if (vma)
5825 + kmem_cache_free(vm_area_cachep, vma);
5826 + goto emulate;
5827 + }
5828 +
5829 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
5830 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
5831 + up_write(&current->mm->mmap_sem);
5832 + if (vma)
5833 + kmem_cache_free(vm_area_cachep, vma);
5834 + return 1;
5835 + }
5836 +
5837 + if (pax_insert_vma(vma, call_dl_resolve)) {
5838 + up_write(&current->mm->mmap_sem);
5839 + kmem_cache_free(vm_area_cachep, vma);
5840 + return 1;
5841 + }
5842 +
5843 + current->mm->call_dl_resolve = call_dl_resolve;
5844 + up_write(&current->mm->mmap_sem);
5845 +
5846 +emulate:
5847 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5848 + regs->tpc = call_dl_resolve;
5849 + regs->tnpc = addr+4;
5850 + return 3;
5851 + }
5852 +#endif
5853 +
5854 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
5855 + if ((save & 0xFFC00000U) == 0x05000000U &&
5856 + (call & 0xFFFFE000U) == 0x85C0A000U &&
5857 + nop == 0x01000000U)
5858 + {
5859 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5860 + regs->u_regs[UREG_G2] = addr + 4;
5861 + addr = (save & 0x003FFFFFU) << 10;
5862 + addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5863 +
5864 + if (test_thread_flag(TIF_32BIT))
5865 + addr &= 0xFFFFFFFFUL;
5866 +
5867 + regs->tpc = addr;
5868 + regs->tnpc = addr+4;
5869 + return 3;
5870 + }
5871 +
5872 + /* PaX: 64-bit PLT stub */
5873 + err = get_user(sethi1, (unsigned int *)addr);
5874 + err |= get_user(sethi2, (unsigned int *)(addr+4));
5875 + err |= get_user(or1, (unsigned int *)(addr+8));
5876 + err |= get_user(or2, (unsigned int *)(addr+12));
5877 + err |= get_user(sllx, (unsigned int *)(addr+16));
5878 + err |= get_user(add, (unsigned int *)(addr+20));
5879 + err |= get_user(jmpl, (unsigned int *)(addr+24));
5880 + err |= get_user(nop, (unsigned int *)(addr+28));
5881 + if (err)
5882 + break;
5883 +
5884 + if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
5885 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5886 + (or1 & 0xFFFFE000U) == 0x88112000U &&
5887 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
5888 + sllx == 0x89293020U &&
5889 + add == 0x8A010005U &&
5890 + jmpl == 0x89C14000U &&
5891 + nop == 0x01000000U)
5892 + {
5893 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5894 + regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
5895 + regs->u_regs[UREG_G4] <<= 32;
5896 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
5897 + regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
5898 + regs->u_regs[UREG_G4] = addr + 24;
5899 + addr = regs->u_regs[UREG_G5];
5900 + regs->tpc = addr;
5901 + regs->tnpc = addr+4;
5902 + return 3;
5903 + }
5904 + }
5905 + } while (0);
5906 +
5907 +#ifdef CONFIG_PAX_DLRESOLVE
5908 + do { /* PaX: unpatched PLT emulation step 2 */
5909 + unsigned int save, call, nop;
5910 +
5911 + err = get_user(save, (unsigned int *)(regs->tpc-4));
5912 + err |= get_user(call, (unsigned int *)regs->tpc);
5913 + err |= get_user(nop, (unsigned int *)(regs->tpc+4));
5914 + if (err)
5915 + break;
5916 +
5917 + if (save == 0x9DE3BFA8U &&
5918 + (call & 0xC0000000U) == 0x40000000U &&
5919 + nop == 0x01000000U)
5920 + {
5921 + unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
5922 +
5923 + if (test_thread_flag(TIF_32BIT))
5924 + dl_resolve &= 0xFFFFFFFFUL;
5925 +
5926 + regs->u_regs[UREG_RETPC] = regs->tpc;
5927 + regs->tpc = dl_resolve;
5928 + regs->tnpc = dl_resolve+4;
5929 + return 3;
5930 + }
5931 + } while (0);
5932 +#endif
5933 +
5934 + do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
5935 + unsigned int sethi, ba, nop;
5936 +
5937 + err = get_user(sethi, (unsigned int *)regs->tpc);
5938 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
5939 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5940 +
5941 + if (err)
5942 + break;
5943 +
5944 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5945 + (ba & 0xFFF00000U) == 0x30600000U &&
5946 + nop == 0x01000000U)
5947 + {
5948 + unsigned long addr;
5949 +
5950 + addr = (sethi & 0x003FFFFFU) << 10;
5951 + regs->u_regs[UREG_G1] = addr;
5952 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
5953 +
5954 + if (test_thread_flag(TIF_32BIT))
5955 + addr &= 0xFFFFFFFFUL;
5956 +
5957 + regs->tpc = addr;
5958 + regs->tnpc = addr+4;
5959 + return 2;
5960 + }
5961 + } while (0);
5962 +
5963 +#endif
5964 +
5965 + return 1;
5966 +}
5967 +
5968 +void pax_report_insns(void *pc, void *sp)
5969 +{
5970 + unsigned long i;
5971 +
5972 + printk(KERN_ERR "PAX: bytes at PC: ");
5973 + for (i = 0; i < 8; i++) {
5974 + unsigned int c;
5975 + if (get_user(c, (unsigned int *)pc+i))
5976 + printk(KERN_CONT "???????? ");
5977 + else
5978 + printk(KERN_CONT "%08x ", c);
5979 + }
5980 + printk("\n");
5981 +}
5982 +#endif
5983 +
5984 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
5985 {
5986 struct mm_struct *mm = current->mm;
5987 @@ -315,6 +768,29 @@ asmlinkage void __kprobes do_sparc64_fau
5988 if (!vma)
5989 goto bad_area;
5990
5991 +#ifdef CONFIG_PAX_PAGEEXEC
5992 + /* PaX: detect ITLB misses on non-exec pages */
5993 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
5994 + !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
5995 + {
5996 + if (address != regs->tpc)
5997 + goto good_area;
5998 +
5999 + up_read(&mm->mmap_sem);
6000 + switch (pax_handle_fetch_fault(regs)) {
6001 +
6002 +#ifdef CONFIG_PAX_EMUPLT
6003 + case 2:
6004 + case 3:
6005 + return;
6006 +#endif
6007 +
6008 + }
6009 + pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
6010 + do_group_exit(SIGKILL);
6011 + }
6012 +#endif
6013 +
6014 /* Pure DTLB misses do not tell us whether the fault causing
6015 * load/store/atomic was a write or not, it only says that there
6016 * was no match. So in such a case we (carefully) read the
6017 diff -urNp linux-2.6.32.46/arch/sparc/mm/hugetlbpage.c linux-2.6.32.46/arch/sparc/mm/hugetlbpage.c
6018 --- linux-2.6.32.46/arch/sparc/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
6019 +++ linux-2.6.32.46/arch/sparc/mm/hugetlbpage.c 2011-04-17 15:56:46.000000000 -0400
6020 @@ -69,7 +69,7 @@ full_search:
6021 }
6022 return -ENOMEM;
6023 }
6024 - if (likely(!vma || addr + len <= vma->vm_start)) {
6025 + if (likely(check_heap_stack_gap(vma, addr, len))) {
6026 /*
6027 * Remember the place where we stopped the search:
6028 */
6029 @@ -108,7 +108,7 @@ hugetlb_get_unmapped_area_topdown(struct
6030 /* make sure it can fit in the remaining address space */
6031 if (likely(addr > len)) {
6032 vma = find_vma(mm, addr-len);
6033 - if (!vma || addr <= vma->vm_start) {
6034 + if (check_heap_stack_gap(vma, addr - len, len)) {
6035 /* remember the address as a hint for next time */
6036 return (mm->free_area_cache = addr-len);
6037 }
6038 @@ -117,16 +117,17 @@ hugetlb_get_unmapped_area_topdown(struct
6039 if (unlikely(mm->mmap_base < len))
6040 goto bottomup;
6041
6042 - addr = (mm->mmap_base-len) & HPAGE_MASK;
6043 + addr = mm->mmap_base - len;
6044
6045 do {
6046 + addr &= HPAGE_MASK;
6047 /*
6048 * Lookup failure means no vma is above this address,
6049 * else if new region fits below vma->vm_start,
6050 * return with success:
6051 */
6052 vma = find_vma(mm, addr);
6053 - if (likely(!vma || addr+len <= vma->vm_start)) {
6054 + if (likely(check_heap_stack_gap(vma, addr, len))) {
6055 /* remember the address as a hint for next time */
6056 return (mm->free_area_cache = addr);
6057 }
6058 @@ -136,8 +137,8 @@ hugetlb_get_unmapped_area_topdown(struct
6059 mm->cached_hole_size = vma->vm_start - addr;
6060
6061 /* try just below the current vma->vm_start */
6062 - addr = (vma->vm_start-len) & HPAGE_MASK;
6063 - } while (likely(len < vma->vm_start));
6064 + addr = skip_heap_stack_gap(vma, len);
6065 + } while (!IS_ERR_VALUE(addr));
6066
6067 bottomup:
6068 /*
6069 @@ -183,8 +184,7 @@ hugetlb_get_unmapped_area(struct file *f
6070 if (addr) {
6071 addr = ALIGN(addr, HPAGE_SIZE);
6072 vma = find_vma(mm, addr);
6073 - if (task_size - len >= addr &&
6074 - (!vma || addr + len <= vma->vm_start))
6075 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
6076 return addr;
6077 }
6078 if (mm->get_unmapped_area == arch_get_unmapped_area)
6079 diff -urNp linux-2.6.32.46/arch/sparc/mm/init_32.c linux-2.6.32.46/arch/sparc/mm/init_32.c
6080 --- linux-2.6.32.46/arch/sparc/mm/init_32.c 2011-03-27 14:31:47.000000000 -0400
6081 +++ linux-2.6.32.46/arch/sparc/mm/init_32.c 2011-04-17 15:56:46.000000000 -0400
6082 @@ -317,6 +317,9 @@ extern void device_scan(void);
6083 pgprot_t PAGE_SHARED __read_mostly;
6084 EXPORT_SYMBOL(PAGE_SHARED);
6085
6086 +pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
6087 +EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
6088 +
6089 void __init paging_init(void)
6090 {
6091 switch(sparc_cpu_model) {
6092 @@ -345,17 +348,17 @@ void __init paging_init(void)
6093
6094 /* Initialize the protection map with non-constant, MMU dependent values. */
6095 protection_map[0] = PAGE_NONE;
6096 - protection_map[1] = PAGE_READONLY;
6097 - protection_map[2] = PAGE_COPY;
6098 - protection_map[3] = PAGE_COPY;
6099 + protection_map[1] = PAGE_READONLY_NOEXEC;
6100 + protection_map[2] = PAGE_COPY_NOEXEC;
6101 + protection_map[3] = PAGE_COPY_NOEXEC;
6102 protection_map[4] = PAGE_READONLY;
6103 protection_map[5] = PAGE_READONLY;
6104 protection_map[6] = PAGE_COPY;
6105 protection_map[7] = PAGE_COPY;
6106 protection_map[8] = PAGE_NONE;
6107 - protection_map[9] = PAGE_READONLY;
6108 - protection_map[10] = PAGE_SHARED;
6109 - protection_map[11] = PAGE_SHARED;
6110 + protection_map[9] = PAGE_READONLY_NOEXEC;
6111 + protection_map[10] = PAGE_SHARED_NOEXEC;
6112 + protection_map[11] = PAGE_SHARED_NOEXEC;
6113 protection_map[12] = PAGE_READONLY;
6114 protection_map[13] = PAGE_READONLY;
6115 protection_map[14] = PAGE_SHARED;
6116 diff -urNp linux-2.6.32.46/arch/sparc/mm/Makefile linux-2.6.32.46/arch/sparc/mm/Makefile
6117 --- linux-2.6.32.46/arch/sparc/mm/Makefile 2011-03-27 14:31:47.000000000 -0400
6118 +++ linux-2.6.32.46/arch/sparc/mm/Makefile 2011-04-17 15:56:46.000000000 -0400
6119 @@ -2,7 +2,7 @@
6120 #
6121
6122 asflags-y := -ansi
6123 -ccflags-y := -Werror
6124 +#ccflags-y := -Werror
6125
6126 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
6127 obj-y += fault_$(BITS).o
6128 diff -urNp linux-2.6.32.46/arch/sparc/mm/srmmu.c linux-2.6.32.46/arch/sparc/mm/srmmu.c
6129 --- linux-2.6.32.46/arch/sparc/mm/srmmu.c 2011-03-27 14:31:47.000000000 -0400
6130 +++ linux-2.6.32.46/arch/sparc/mm/srmmu.c 2011-04-17 15:56:46.000000000 -0400
6131 @@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
6132 PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
6133 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
6134 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
6135 +
6136 +#ifdef CONFIG_PAX_PAGEEXEC
6137 + PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
6138 + BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
6139 + BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
6140 +#endif
6141 +
6142 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
6143 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
6144
6145 diff -urNp linux-2.6.32.46/arch/um/include/asm/kmap_types.h linux-2.6.32.46/arch/um/include/asm/kmap_types.h
6146 --- linux-2.6.32.46/arch/um/include/asm/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
6147 +++ linux-2.6.32.46/arch/um/include/asm/kmap_types.h 2011-04-17 15:56:46.000000000 -0400
6148 @@ -23,6 +23,7 @@ enum km_type {
6149 KM_IRQ1,
6150 KM_SOFTIRQ0,
6151 KM_SOFTIRQ1,
6152 + KM_CLEARPAGE,
6153 KM_TYPE_NR
6154 };
6155
6156 diff -urNp linux-2.6.32.46/arch/um/include/asm/page.h linux-2.6.32.46/arch/um/include/asm/page.h
6157 --- linux-2.6.32.46/arch/um/include/asm/page.h 2011-03-27 14:31:47.000000000 -0400
6158 +++ linux-2.6.32.46/arch/um/include/asm/page.h 2011-04-17 15:56:46.000000000 -0400
6159 @@ -14,6 +14,9 @@
6160 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
6161 #define PAGE_MASK (~(PAGE_SIZE-1))
6162
6163 +#define ktla_ktva(addr) (addr)
6164 +#define ktva_ktla(addr) (addr)
6165 +
6166 #ifndef __ASSEMBLY__
6167
6168 struct page;
6169 diff -urNp linux-2.6.32.46/arch/um/kernel/process.c linux-2.6.32.46/arch/um/kernel/process.c
6170 --- linux-2.6.32.46/arch/um/kernel/process.c 2011-03-27 14:31:47.000000000 -0400
6171 +++ linux-2.6.32.46/arch/um/kernel/process.c 2011-04-17 15:56:46.000000000 -0400
6172 @@ -393,22 +393,6 @@ int singlestepping(void * t)
6173 return 2;
6174 }
6175
6176 -/*
6177 - * Only x86 and x86_64 have an arch_align_stack().
6178 - * All other arches have "#define arch_align_stack(x) (x)"
6179 - * in their asm/system.h
6180 - * As this is included in UML from asm-um/system-generic.h,
6181 - * we can use it to behave as the subarch does.
6182 - */
6183 -#ifndef arch_align_stack
6184 -unsigned long arch_align_stack(unsigned long sp)
6185 -{
6186 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
6187 - sp -= get_random_int() % 8192;
6188 - return sp & ~0xf;
6189 -}
6190 -#endif
6191 -
6192 unsigned long get_wchan(struct task_struct *p)
6193 {
6194 unsigned long stack_page, sp, ip;
6195 diff -urNp linux-2.6.32.46/arch/um/sys-i386/syscalls.c linux-2.6.32.46/arch/um/sys-i386/syscalls.c
6196 --- linux-2.6.32.46/arch/um/sys-i386/syscalls.c 2011-03-27 14:31:47.000000000 -0400
6197 +++ linux-2.6.32.46/arch/um/sys-i386/syscalls.c 2011-04-17 15:56:46.000000000 -0400
6198 @@ -11,6 +11,21 @@
6199 #include "asm/uaccess.h"
6200 #include "asm/unistd.h"
6201
6202 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
6203 +{
6204 + unsigned long pax_task_size = TASK_SIZE;
6205 +
6206 +#ifdef CONFIG_PAX_SEGMEXEC
6207 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
6208 + pax_task_size = SEGMEXEC_TASK_SIZE;
6209 +#endif
6210 +
6211 + if (len > pax_task_size || addr > pax_task_size - len)
6212 + return -EINVAL;
6213 +
6214 + return 0;
6215 +}
6216 +
6217 /*
6218 * Perform the select(nd, in, out, ex, tv) and mmap() system
6219 * calls. Linux/i386 didn't use to be able to handle more than
6220 diff -urNp linux-2.6.32.46/arch/x86/boot/bitops.h linux-2.6.32.46/arch/x86/boot/bitops.h
6221 --- linux-2.6.32.46/arch/x86/boot/bitops.h 2011-03-27 14:31:47.000000000 -0400
6222 +++ linux-2.6.32.46/arch/x86/boot/bitops.h 2011-04-17 15:56:46.000000000 -0400
6223 @@ -26,7 +26,7 @@ static inline int variable_test_bit(int
6224 u8 v;
6225 const u32 *p = (const u32 *)addr;
6226
6227 - asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
6228 + asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
6229 return v;
6230 }
6231
6232 @@ -37,7 +37,7 @@ static inline int variable_test_bit(int
6233
6234 static inline void set_bit(int nr, void *addr)
6235 {
6236 - asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
6237 + asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
6238 }
6239
6240 #endif /* BOOT_BITOPS_H */
6241 diff -urNp linux-2.6.32.46/arch/x86/boot/boot.h linux-2.6.32.46/arch/x86/boot/boot.h
6242 --- linux-2.6.32.46/arch/x86/boot/boot.h 2011-03-27 14:31:47.000000000 -0400
6243 +++ linux-2.6.32.46/arch/x86/boot/boot.h 2011-04-17 15:56:46.000000000 -0400
6244 @@ -82,7 +82,7 @@ static inline void io_delay(void)
6245 static inline u16 ds(void)
6246 {
6247 u16 seg;
6248 - asm("movw %%ds,%0" : "=rm" (seg));
6249 + asm volatile("movw %%ds,%0" : "=rm" (seg));
6250 return seg;
6251 }
6252
6253 @@ -178,7 +178,7 @@ static inline void wrgs32(u32 v, addr_t
6254 static inline int memcmp(const void *s1, const void *s2, size_t len)
6255 {
6256 u8 diff;
6257 - asm("repe; cmpsb; setnz %0"
6258 + asm volatile("repe; cmpsb; setnz %0"
6259 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
6260 return diff;
6261 }
6262 diff -urNp linux-2.6.32.46/arch/x86/boot/compressed/head_32.S linux-2.6.32.46/arch/x86/boot/compressed/head_32.S
6263 --- linux-2.6.32.46/arch/x86/boot/compressed/head_32.S 2011-03-27 14:31:47.000000000 -0400
6264 +++ linux-2.6.32.46/arch/x86/boot/compressed/head_32.S 2011-04-17 15:56:46.000000000 -0400
6265 @@ -76,7 +76,7 @@ ENTRY(startup_32)
6266 notl %eax
6267 andl %eax, %ebx
6268 #else
6269 - movl $LOAD_PHYSICAL_ADDR, %ebx
6270 + movl $____LOAD_PHYSICAL_ADDR, %ebx
6271 #endif
6272
6273 /* Target address to relocate to for decompression */
6274 @@ -149,7 +149,7 @@ relocated:
6275 * and where it was actually loaded.
6276 */
6277 movl %ebp, %ebx
6278 - subl $LOAD_PHYSICAL_ADDR, %ebx
6279 + subl $____LOAD_PHYSICAL_ADDR, %ebx
6280 jz 2f /* Nothing to be done if loaded at compiled addr. */
6281 /*
6282 * Process relocations.
6283 @@ -157,8 +157,7 @@ relocated:
6284
6285 1: subl $4, %edi
6286 movl (%edi), %ecx
6287 - testl %ecx, %ecx
6288 - jz 2f
6289 + jecxz 2f
6290 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
6291 jmp 1b
6292 2:
6293 diff -urNp linux-2.6.32.46/arch/x86/boot/compressed/head_64.S linux-2.6.32.46/arch/x86/boot/compressed/head_64.S
6294 --- linux-2.6.32.46/arch/x86/boot/compressed/head_64.S 2011-03-27 14:31:47.000000000 -0400
6295 +++ linux-2.6.32.46/arch/x86/boot/compressed/head_64.S 2011-07-01 18:53:00.000000000 -0400
6296 @@ -91,7 +91,7 @@ ENTRY(startup_32)
6297 notl %eax
6298 andl %eax, %ebx
6299 #else
6300 - movl $LOAD_PHYSICAL_ADDR, %ebx
6301 + movl $____LOAD_PHYSICAL_ADDR, %ebx
6302 #endif
6303
6304 /* Target address to relocate to for decompression */
6305 @@ -183,7 +183,7 @@ no_longmode:
6306 hlt
6307 jmp 1b
6308
6309 -#include "../../kernel/verify_cpu_64.S"
6310 +#include "../../kernel/verify_cpu.S"
6311
6312 /*
6313 * Be careful here startup_64 needs to be at a predictable
6314 @@ -234,7 +234,7 @@ ENTRY(startup_64)
6315 notq %rax
6316 andq %rax, %rbp
6317 #else
6318 - movq $LOAD_PHYSICAL_ADDR, %rbp
6319 + movq $____LOAD_PHYSICAL_ADDR, %rbp
6320 #endif
6321
6322 /* Target address to relocate to for decompression */
6323 diff -urNp linux-2.6.32.46/arch/x86/boot/compressed/Makefile linux-2.6.32.46/arch/x86/boot/compressed/Makefile
6324 --- linux-2.6.32.46/arch/x86/boot/compressed/Makefile 2011-03-27 14:31:47.000000000 -0400
6325 +++ linux-2.6.32.46/arch/x86/boot/compressed/Makefile 2011-08-07 14:38:34.000000000 -0400
6326 @@ -13,6 +13,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=smal
6327 KBUILD_CFLAGS += $(cflags-y)
6328 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
6329 KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
6330 +ifdef CONSTIFY_PLUGIN
6331 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
6332 +endif
6333
6334 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
6335 GCOV_PROFILE := n
6336 diff -urNp linux-2.6.32.46/arch/x86/boot/compressed/misc.c linux-2.6.32.46/arch/x86/boot/compressed/misc.c
6337 --- linux-2.6.32.46/arch/x86/boot/compressed/misc.c 2011-03-27 14:31:47.000000000 -0400
6338 +++ linux-2.6.32.46/arch/x86/boot/compressed/misc.c 2011-04-17 15:56:46.000000000 -0400
6339 @@ -288,7 +288,7 @@ static void parse_elf(void *output)
6340 case PT_LOAD:
6341 #ifdef CONFIG_RELOCATABLE
6342 dest = output;
6343 - dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
6344 + dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
6345 #else
6346 dest = (void *)(phdr->p_paddr);
6347 #endif
6348 @@ -335,7 +335,7 @@ asmlinkage void decompress_kernel(void *
6349 error("Destination address too large");
6350 #endif
6351 #ifndef CONFIG_RELOCATABLE
6352 - if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
6353 + if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
6354 error("Wrong destination address");
6355 #endif
6356
6357 diff -urNp linux-2.6.32.46/arch/x86/boot/compressed/mkpiggy.c linux-2.6.32.46/arch/x86/boot/compressed/mkpiggy.c
6358 --- linux-2.6.32.46/arch/x86/boot/compressed/mkpiggy.c 2011-03-27 14:31:47.000000000 -0400
6359 +++ linux-2.6.32.46/arch/x86/boot/compressed/mkpiggy.c 2011-04-17 15:56:46.000000000 -0400
6360 @@ -74,7 +74,7 @@ int main(int argc, char *argv[])
6361
6362 offs = (olen > ilen) ? olen - ilen : 0;
6363 offs += olen >> 12; /* Add 8 bytes for each 32K block */
6364 - offs += 32*1024 + 18; /* Add 32K + 18 bytes slack */
6365 + offs += 64*1024; /* Add 64K bytes slack */
6366 offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
6367
6368 printf(".section \".rodata.compressed\",\"a\",@progbits\n");
6369 diff -urNp linux-2.6.32.46/arch/x86/boot/compressed/relocs.c linux-2.6.32.46/arch/x86/boot/compressed/relocs.c
6370 --- linux-2.6.32.46/arch/x86/boot/compressed/relocs.c 2011-03-27 14:31:47.000000000 -0400
6371 +++ linux-2.6.32.46/arch/x86/boot/compressed/relocs.c 2011-04-17 15:56:46.000000000 -0400
6372 @@ -10,8 +10,11 @@
6373 #define USE_BSD
6374 #include <endian.h>
6375
6376 +#include "../../../../include/linux/autoconf.h"
6377 +
6378 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
6379 static Elf32_Ehdr ehdr;
6380 +static Elf32_Phdr *phdr;
6381 static unsigned long reloc_count, reloc_idx;
6382 static unsigned long *relocs;
6383
6384 @@ -37,7 +40,7 @@ static const char* safe_abs_relocs[] = {
6385
6386 static int is_safe_abs_reloc(const char* sym_name)
6387 {
6388 - int i;
6389 + unsigned int i;
6390
6391 for (i = 0; i < ARRAY_SIZE(safe_abs_relocs); i++) {
6392 if (!strcmp(sym_name, safe_abs_relocs[i]))
6393 @@ -245,9 +248,39 @@ static void read_ehdr(FILE *fp)
6394 }
6395 }
6396
6397 +static void read_phdrs(FILE *fp)
6398 +{
6399 + unsigned int i;
6400 +
6401 + phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
6402 + if (!phdr) {
6403 + die("Unable to allocate %d program headers\n",
6404 + ehdr.e_phnum);
6405 + }
6406 + if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
6407 + die("Seek to %d failed: %s\n",
6408 + ehdr.e_phoff, strerror(errno));
6409 + }
6410 + if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
6411 + die("Cannot read ELF program headers: %s\n",
6412 + strerror(errno));
6413 + }
6414 + for(i = 0; i < ehdr.e_phnum; i++) {
6415 + phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
6416 + phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
6417 + phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
6418 + phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
6419 + phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
6420 + phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
6421 + phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
6422 + phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
6423 + }
6424 +
6425 +}
6426 +
6427 static void read_shdrs(FILE *fp)
6428 {
6429 - int i;
6430 + unsigned int i;
6431 Elf32_Shdr shdr;
6432
6433 secs = calloc(ehdr.e_shnum, sizeof(struct section));
6434 @@ -282,7 +315,7 @@ static void read_shdrs(FILE *fp)
6435
6436 static void read_strtabs(FILE *fp)
6437 {
6438 - int i;
6439 + unsigned int i;
6440 for (i = 0; i < ehdr.e_shnum; i++) {
6441 struct section *sec = &secs[i];
6442 if (sec->shdr.sh_type != SHT_STRTAB) {
6443 @@ -307,7 +340,7 @@ static void read_strtabs(FILE *fp)
6444
6445 static void read_symtabs(FILE *fp)
6446 {
6447 - int i,j;
6448 + unsigned int i,j;
6449 for (i = 0; i < ehdr.e_shnum; i++) {
6450 struct section *sec = &secs[i];
6451 if (sec->shdr.sh_type != SHT_SYMTAB) {
6452 @@ -340,7 +373,9 @@ static void read_symtabs(FILE *fp)
6453
6454 static void read_relocs(FILE *fp)
6455 {
6456 - int i,j;
6457 + unsigned int i,j;
6458 + uint32_t base;
6459 +
6460 for (i = 0; i < ehdr.e_shnum; i++) {
6461 struct section *sec = &secs[i];
6462 if (sec->shdr.sh_type != SHT_REL) {
6463 @@ -360,9 +395,18 @@ static void read_relocs(FILE *fp)
6464 die("Cannot read symbol table: %s\n",
6465 strerror(errno));
6466 }
6467 + base = 0;
6468 + for (j = 0; j < ehdr.e_phnum; j++) {
6469 + if (phdr[j].p_type != PT_LOAD )
6470 + continue;
6471 + if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
6472 + continue;
6473 + base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
6474 + break;
6475 + }
6476 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
6477 Elf32_Rel *rel = &sec->reltab[j];
6478 - rel->r_offset = elf32_to_cpu(rel->r_offset);
6479 + rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
6480 rel->r_info = elf32_to_cpu(rel->r_info);
6481 }
6482 }
6483 @@ -371,14 +415,14 @@ static void read_relocs(FILE *fp)
6484
6485 static void print_absolute_symbols(void)
6486 {
6487 - int i;
6488 + unsigned int i;
6489 printf("Absolute symbols\n");
6490 printf(" Num: Value Size Type Bind Visibility Name\n");
6491 for (i = 0; i < ehdr.e_shnum; i++) {
6492 struct section *sec = &secs[i];
6493 char *sym_strtab;
6494 Elf32_Sym *sh_symtab;
6495 - int j;
6496 + unsigned int j;
6497
6498 if (sec->shdr.sh_type != SHT_SYMTAB) {
6499 continue;
6500 @@ -406,14 +450,14 @@ static void print_absolute_symbols(void)
6501
6502 static void print_absolute_relocs(void)
6503 {
6504 - int i, printed = 0;
6505 + unsigned int i, printed = 0;
6506
6507 for (i = 0; i < ehdr.e_shnum; i++) {
6508 struct section *sec = &secs[i];
6509 struct section *sec_applies, *sec_symtab;
6510 char *sym_strtab;
6511 Elf32_Sym *sh_symtab;
6512 - int j;
6513 + unsigned int j;
6514 if (sec->shdr.sh_type != SHT_REL) {
6515 continue;
6516 }
6517 @@ -474,13 +518,13 @@ static void print_absolute_relocs(void)
6518
6519 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
6520 {
6521 - int i;
6522 + unsigned int i;
6523 /* Walk through the relocations */
6524 for (i = 0; i < ehdr.e_shnum; i++) {
6525 char *sym_strtab;
6526 Elf32_Sym *sh_symtab;
6527 struct section *sec_applies, *sec_symtab;
6528 - int j;
6529 + unsigned int j;
6530 struct section *sec = &secs[i];
6531
6532 if (sec->shdr.sh_type != SHT_REL) {
6533 @@ -504,6 +548,21 @@ static void walk_relocs(void (*visit)(El
6534 if (sym->st_shndx == SHN_ABS) {
6535 continue;
6536 }
6537 + /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
6538 + if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
6539 + continue;
6540 +
6541 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
6542 + /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
6543 + if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
6544 + continue;
6545 + if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
6546 + continue;
6547 + if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
6548 + continue;
6549 + if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
6550 + continue;
6551 +#endif
6552 if (r_type == R_386_NONE || r_type == R_386_PC32) {
6553 /*
6554 * NONE can be ignored and and PC relative
6555 @@ -541,7 +600,7 @@ static int cmp_relocs(const void *va, co
6556
6557 static void emit_relocs(int as_text)
6558 {
6559 - int i;
6560 + unsigned int i;
6561 /* Count how many relocations I have and allocate space for them. */
6562 reloc_count = 0;
6563 walk_relocs(count_reloc);
6564 @@ -634,6 +693,7 @@ int main(int argc, char **argv)
6565 fname, strerror(errno));
6566 }
6567 read_ehdr(fp);
6568 + read_phdrs(fp);
6569 read_shdrs(fp);
6570 read_strtabs(fp);
6571 read_symtabs(fp);
6572 diff -urNp linux-2.6.32.46/arch/x86/boot/cpucheck.c linux-2.6.32.46/arch/x86/boot/cpucheck.c
6573 --- linux-2.6.32.46/arch/x86/boot/cpucheck.c 2011-03-27 14:31:47.000000000 -0400
6574 +++ linux-2.6.32.46/arch/x86/boot/cpucheck.c 2011-04-17 15:56:46.000000000 -0400
6575 @@ -74,7 +74,7 @@ static int has_fpu(void)
6576 u16 fcw = -1, fsw = -1;
6577 u32 cr0;
6578
6579 - asm("movl %%cr0,%0" : "=r" (cr0));
6580 + asm volatile("movl %%cr0,%0" : "=r" (cr0));
6581 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
6582 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
6583 asm volatile("movl %0,%%cr0" : : "r" (cr0));
6584 @@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
6585 {
6586 u32 f0, f1;
6587
6588 - asm("pushfl ; "
6589 + asm volatile("pushfl ; "
6590 "pushfl ; "
6591 "popl %0 ; "
6592 "movl %0,%1 ; "
6593 @@ -115,7 +115,7 @@ static void get_flags(void)
6594 set_bit(X86_FEATURE_FPU, cpu.flags);
6595
6596 if (has_eflag(X86_EFLAGS_ID)) {
6597 - asm("cpuid"
6598 + asm volatile("cpuid"
6599 : "=a" (max_intel_level),
6600 "=b" (cpu_vendor[0]),
6601 "=d" (cpu_vendor[1]),
6602 @@ -124,7 +124,7 @@ static void get_flags(void)
6603
6604 if (max_intel_level >= 0x00000001 &&
6605 max_intel_level <= 0x0000ffff) {
6606 - asm("cpuid"
6607 + asm volatile("cpuid"
6608 : "=a" (tfms),
6609 "=c" (cpu.flags[4]),
6610 "=d" (cpu.flags[0])
6611 @@ -136,7 +136,7 @@ static void get_flags(void)
6612 cpu.model += ((tfms >> 16) & 0xf) << 4;
6613 }
6614
6615 - asm("cpuid"
6616 + asm volatile("cpuid"
6617 : "=a" (max_amd_level)
6618 : "a" (0x80000000)
6619 : "ebx", "ecx", "edx");
6620 @@ -144,7 +144,7 @@ static void get_flags(void)
6621 if (max_amd_level >= 0x80000001 &&
6622 max_amd_level <= 0x8000ffff) {
6623 u32 eax = 0x80000001;
6624 - asm("cpuid"
6625 + asm volatile("cpuid"
6626 : "+a" (eax),
6627 "=c" (cpu.flags[6]),
6628 "=d" (cpu.flags[1])
6629 @@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
6630 u32 ecx = MSR_K7_HWCR;
6631 u32 eax, edx;
6632
6633 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6634 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6635 eax &= ~(1 << 15);
6636 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6637 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6638
6639 get_flags(); /* Make sure it really did something */
6640 err = check_flags();
6641 @@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
6642 u32 ecx = MSR_VIA_FCR;
6643 u32 eax, edx;
6644
6645 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6646 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6647 eax |= (1<<1)|(1<<7);
6648 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6649 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6650
6651 set_bit(X86_FEATURE_CX8, cpu.flags);
6652 err = check_flags();
6653 @@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
6654 u32 eax, edx;
6655 u32 level = 1;
6656
6657 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6658 - asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
6659 - asm("cpuid"
6660 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6661 + asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
6662 + asm volatile("cpuid"
6663 : "+a" (level), "=d" (cpu.flags[0])
6664 : : "ecx", "ebx");
6665 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6666 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6667
6668 err = check_flags();
6669 }
6670 diff -urNp linux-2.6.32.46/arch/x86/boot/header.S linux-2.6.32.46/arch/x86/boot/header.S
6671 --- linux-2.6.32.46/arch/x86/boot/header.S 2011-03-27 14:31:47.000000000 -0400
6672 +++ linux-2.6.32.46/arch/x86/boot/header.S 2011-04-17 15:56:46.000000000 -0400
6673 @@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical
6674 # single linked list of
6675 # struct setup_data
6676
6677 -pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
6678 +pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
6679
6680 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
6681 #define VO_INIT_SIZE (VO__end - VO__text)
6682 diff -urNp linux-2.6.32.46/arch/x86/boot/Makefile linux-2.6.32.46/arch/x86/boot/Makefile
6683 --- linux-2.6.32.46/arch/x86/boot/Makefile 2011-03-27 14:31:47.000000000 -0400
6684 +++ linux-2.6.32.46/arch/x86/boot/Makefile 2011-08-07 14:38:13.000000000 -0400
6685 @@ -69,6 +69,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os
6686 $(call cc-option, -fno-stack-protector) \
6687 $(call cc-option, -mpreferred-stack-boundary=2)
6688 KBUILD_CFLAGS += $(call cc-option, -m32)
6689 +ifdef CONSTIFY_PLUGIN
6690 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
6691 +endif
6692 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
6693 GCOV_PROFILE := n
6694
6695 diff -urNp linux-2.6.32.46/arch/x86/boot/memory.c linux-2.6.32.46/arch/x86/boot/memory.c
6696 --- linux-2.6.32.46/arch/x86/boot/memory.c 2011-03-27 14:31:47.000000000 -0400
6697 +++ linux-2.6.32.46/arch/x86/boot/memory.c 2011-04-17 15:56:46.000000000 -0400
6698 @@ -19,7 +19,7 @@
6699
6700 static int detect_memory_e820(void)
6701 {
6702 - int count = 0;
6703 + unsigned int count = 0;
6704 struct biosregs ireg, oreg;
6705 struct e820entry *desc = boot_params.e820_map;
6706 static struct e820entry buf; /* static so it is zeroed */
6707 diff -urNp linux-2.6.32.46/arch/x86/boot/video.c linux-2.6.32.46/arch/x86/boot/video.c
6708 --- linux-2.6.32.46/arch/x86/boot/video.c 2011-03-27 14:31:47.000000000 -0400
6709 +++ linux-2.6.32.46/arch/x86/boot/video.c 2011-04-17 15:56:46.000000000 -0400
6710 @@ -90,7 +90,7 @@ static void store_mode_params(void)
6711 static unsigned int get_entry(void)
6712 {
6713 char entry_buf[4];
6714 - int i, len = 0;
6715 + unsigned int i, len = 0;
6716 int key;
6717 unsigned int v;
6718
6719 diff -urNp linux-2.6.32.46/arch/x86/boot/video-vesa.c linux-2.6.32.46/arch/x86/boot/video-vesa.c
6720 --- linux-2.6.32.46/arch/x86/boot/video-vesa.c 2011-03-27 14:31:47.000000000 -0400
6721 +++ linux-2.6.32.46/arch/x86/boot/video-vesa.c 2011-04-17 15:56:46.000000000 -0400
6722 @@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
6723
6724 boot_params.screen_info.vesapm_seg = oreg.es;
6725 boot_params.screen_info.vesapm_off = oreg.di;
6726 + boot_params.screen_info.vesapm_size = oreg.cx;
6727 }
6728
6729 /*
6730 diff -urNp linux-2.6.32.46/arch/x86/crypto/aes-x86_64-asm_64.S linux-2.6.32.46/arch/x86/crypto/aes-x86_64-asm_64.S
6731 --- linux-2.6.32.46/arch/x86/crypto/aes-x86_64-asm_64.S 2011-03-27 14:31:47.000000000 -0400
6732 +++ linux-2.6.32.46/arch/x86/crypto/aes-x86_64-asm_64.S 2011-10-06 09:37:14.000000000 -0400
6733 @@ -8,6 +8,8 @@
6734 * including this sentence is retained in full.
6735 */
6736
6737 +#include <asm/alternative-asm.h>
6738 +
6739 .extern crypto_ft_tab
6740 .extern crypto_it_tab
6741 .extern crypto_fl_tab
6742 @@ -71,6 +73,8 @@ FUNC: movq r1,r2; \
6743 je B192; \
6744 leaq 32(r9),r9;
6745
6746 +#define ret pax_force_retaddr; ret
6747 +
6748 #define epilogue(r1,r2,r3,r4,r5,r6,r7,r8,r9) \
6749 movq r1,r2; \
6750 movq r3,r4; \
6751 diff -urNp linux-2.6.32.46/arch/x86/crypto/salsa20-x86_64-asm_64.S linux-2.6.32.46/arch/x86/crypto/salsa20-x86_64-asm_64.S
6752 --- linux-2.6.32.46/arch/x86/crypto/salsa20-x86_64-asm_64.S 2011-03-27 14:31:47.000000000 -0400
6753 +++ linux-2.6.32.46/arch/x86/crypto/salsa20-x86_64-asm_64.S 2011-10-06 09:37:14.000000000 -0400
6754 @@ -1,3 +1,5 @@
6755 +#include <asm/alternative-asm.h>
6756 +
6757 # enter ECRYPT_encrypt_bytes
6758 .text
6759 .p2align 5
6760 @@ -790,6 +792,7 @@ ECRYPT_encrypt_bytes:
6761 add %r11,%rsp
6762 mov %rdi,%rax
6763 mov %rsi,%rdx
6764 + pax_force_retaddr
6765 ret
6766 # bytesatleast65:
6767 ._bytesatleast65:
6768 @@ -891,6 +894,7 @@ ECRYPT_keysetup:
6769 add %r11,%rsp
6770 mov %rdi,%rax
6771 mov %rsi,%rdx
6772 + pax_force_retaddr
6773 ret
6774 # enter ECRYPT_ivsetup
6775 .text
6776 @@ -917,4 +921,5 @@ ECRYPT_ivsetup:
6777 add %r11,%rsp
6778 mov %rdi,%rax
6779 mov %rsi,%rdx
6780 + pax_force_retaddr
6781 ret
6782 diff -urNp linux-2.6.32.46/arch/x86/crypto/twofish-x86_64-asm_64.S linux-2.6.32.46/arch/x86/crypto/twofish-x86_64-asm_64.S
6783 --- linux-2.6.32.46/arch/x86/crypto/twofish-x86_64-asm_64.S 2011-03-27 14:31:47.000000000 -0400
6784 +++ linux-2.6.32.46/arch/x86/crypto/twofish-x86_64-asm_64.S 2011-10-06 09:37:14.000000000 -0400
6785 @@ -21,6 +21,7 @@
6786 .text
6787
6788 #include <asm/asm-offsets.h>
6789 +#include <asm/alternative-asm.h>
6790
6791 #define a_offset 0
6792 #define b_offset 4
6793 @@ -269,6 +270,7 @@ twofish_enc_blk:
6794
6795 popq R1
6796 movq $1,%rax
6797 + pax_force_retaddr
6798 ret
6799
6800 twofish_dec_blk:
6801 @@ -321,4 +323,5 @@ twofish_dec_blk:
6802
6803 popq R1
6804 movq $1,%rax
6805 + pax_force_retaddr
6806 ret
6807 diff -urNp linux-2.6.32.46/arch/x86/ia32/ia32_aout.c linux-2.6.32.46/arch/x86/ia32/ia32_aout.c
6808 --- linux-2.6.32.46/arch/x86/ia32/ia32_aout.c 2011-03-27 14:31:47.000000000 -0400
6809 +++ linux-2.6.32.46/arch/x86/ia32/ia32_aout.c 2011-04-17 15:56:46.000000000 -0400
6810 @@ -169,6 +169,8 @@ static int aout_core_dump(long signr, st
6811 unsigned long dump_start, dump_size;
6812 struct user32 dump;
6813
6814 + memset(&dump, 0, sizeof(dump));
6815 +
6816 fs = get_fs();
6817 set_fs(KERNEL_DS);
6818 has_dumped = 1;
6819 @@ -218,12 +220,6 @@ static int aout_core_dump(long signr, st
6820 dump_size = dump.u_ssize << PAGE_SHIFT;
6821 DUMP_WRITE(dump_start, dump_size);
6822 }
6823 - /*
6824 - * Finally dump the task struct. Not be used by gdb, but
6825 - * could be useful
6826 - */
6827 - set_fs(KERNEL_DS);
6828 - DUMP_WRITE(current, sizeof(*current));
6829 end_coredump:
6830 set_fs(fs);
6831 return has_dumped;
6832 diff -urNp linux-2.6.32.46/arch/x86/ia32/ia32entry.S linux-2.6.32.46/arch/x86/ia32/ia32entry.S
6833 --- linux-2.6.32.46/arch/x86/ia32/ia32entry.S 2011-03-27 14:31:47.000000000 -0400
6834 +++ linux-2.6.32.46/arch/x86/ia32/ia32entry.S 2011-08-25 17:42:18.000000000 -0400
6835 @@ -13,6 +13,7 @@
6836 #include <asm/thread_info.h>
6837 #include <asm/segment.h>
6838 #include <asm/irqflags.h>
6839 +#include <asm/pgtable.h>
6840 #include <linux/linkage.h>
6841
6842 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
6843 @@ -93,6 +94,29 @@ ENTRY(native_irq_enable_sysexit)
6844 ENDPROC(native_irq_enable_sysexit)
6845 #endif
6846
6847 + .macro pax_enter_kernel_user
6848 +#ifdef CONFIG_PAX_MEMORY_UDEREF
6849 + call pax_enter_kernel_user
6850 +#endif
6851 + .endm
6852 +
6853 + .macro pax_exit_kernel_user
6854 +#ifdef CONFIG_PAX_MEMORY_UDEREF
6855 + call pax_exit_kernel_user
6856 +#endif
6857 +#ifdef CONFIG_PAX_RANDKSTACK
6858 + pushq %rax
6859 + call pax_randomize_kstack
6860 + popq %rax
6861 +#endif
6862 + .endm
6863 +
6864 +.macro pax_erase_kstack
6865 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
6866 + call pax_erase_kstack
6867 +#endif
6868 +.endm
6869 +
6870 /*
6871 * 32bit SYSENTER instruction entry.
6872 *
6873 @@ -119,7 +143,7 @@ ENTRY(ia32_sysenter_target)
6874 CFI_REGISTER rsp,rbp
6875 SWAPGS_UNSAFE_STACK
6876 movq PER_CPU_VAR(kernel_stack), %rsp
6877 - addq $(KERNEL_STACK_OFFSET),%rsp
6878 + pax_enter_kernel_user
6879 /*
6880 * No need to follow this irqs on/off section: the syscall
6881 * disabled irqs, here we enable it straight after entry:
6882 @@ -135,7 +159,8 @@ ENTRY(ia32_sysenter_target)
6883 pushfq
6884 CFI_ADJUST_CFA_OFFSET 8
6885 /*CFI_REL_OFFSET rflags,0*/
6886 - movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
6887 + GET_THREAD_INFO(%r10)
6888 + movl TI_sysenter_return(%r10), %r10d
6889 CFI_REGISTER rip,r10
6890 pushq $__USER32_CS
6891 CFI_ADJUST_CFA_OFFSET 8
6892 @@ -150,6 +175,12 @@ ENTRY(ia32_sysenter_target)
6893 SAVE_ARGS 0,0,1
6894 /* no need to do an access_ok check here because rbp has been
6895 32bit zero extended */
6896 +
6897 +#ifdef CONFIG_PAX_MEMORY_UDEREF
6898 + mov $PAX_USER_SHADOW_BASE,%r10
6899 + add %r10,%rbp
6900 +#endif
6901 +
6902 1: movl (%rbp),%ebp
6903 .section __ex_table,"a"
6904 .quad 1b,ia32_badarg
6905 @@ -172,6 +203,8 @@ sysenter_dispatch:
6906 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
6907 jnz sysexit_audit
6908 sysexit_from_sys_call:
6909 + pax_exit_kernel_user
6910 + pax_erase_kstack
6911 andl $~TS_COMPAT,TI_status(%r10)
6912 /* clear IF, that popfq doesn't enable interrupts early */
6913 andl $~0x200,EFLAGS-R11(%rsp)
6914 @@ -200,6 +233,9 @@ sysexit_from_sys_call:
6915 movl %eax,%esi /* 2nd arg: syscall number */
6916 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
6917 call audit_syscall_entry
6918 +
6919 + pax_erase_kstack
6920 +
6921 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
6922 cmpq $(IA32_NR_syscalls-1),%rax
6923 ja ia32_badsys
6924 @@ -252,6 +288,9 @@ sysenter_tracesys:
6925 movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
6926 movq %rsp,%rdi /* &pt_regs -> arg1 */
6927 call syscall_trace_enter
6928 +
6929 + pax_erase_kstack
6930 +
6931 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
6932 RESTORE_REST
6933 cmpq $(IA32_NR_syscalls-1),%rax
6934 @@ -283,19 +322,24 @@ ENDPROC(ia32_sysenter_target)
6935 ENTRY(ia32_cstar_target)
6936 CFI_STARTPROC32 simple
6937 CFI_SIGNAL_FRAME
6938 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
6939 + CFI_DEF_CFA rsp,0
6940 CFI_REGISTER rip,rcx
6941 /*CFI_REGISTER rflags,r11*/
6942 SWAPGS_UNSAFE_STACK
6943 movl %esp,%r8d
6944 CFI_REGISTER rsp,r8
6945 movq PER_CPU_VAR(kernel_stack),%rsp
6946 +
6947 +#ifdef CONFIG_PAX_MEMORY_UDEREF
6948 + pax_enter_kernel_user
6949 +#endif
6950 +
6951 /*
6952 * No need to follow this irqs on/off section: the syscall
6953 * disabled irqs and here we enable it straight after entry:
6954 */
6955 ENABLE_INTERRUPTS(CLBR_NONE)
6956 - SAVE_ARGS 8,1,1
6957 + SAVE_ARGS 8*6,1,1
6958 movl %eax,%eax /* zero extension */
6959 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
6960 movq %rcx,RIP-ARGOFFSET(%rsp)
6961 @@ -311,6 +355,12 @@ ENTRY(ia32_cstar_target)
6962 /* no need to do an access_ok check here because r8 has been
6963 32bit zero extended */
6964 /* hardware stack frame is complete now */
6965 +
6966 +#ifdef CONFIG_PAX_MEMORY_UDEREF
6967 + mov $PAX_USER_SHADOW_BASE,%r10
6968 + add %r10,%r8
6969 +#endif
6970 +
6971 1: movl (%r8),%r9d
6972 .section __ex_table,"a"
6973 .quad 1b,ia32_badarg
6974 @@ -333,6 +383,8 @@ cstar_dispatch:
6975 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
6976 jnz sysretl_audit
6977 sysretl_from_sys_call:
6978 + pax_exit_kernel_user
6979 + pax_erase_kstack
6980 andl $~TS_COMPAT,TI_status(%r10)
6981 RESTORE_ARGS 1,-ARG_SKIP,1,1,1
6982 movl RIP-ARGOFFSET(%rsp),%ecx
6983 @@ -370,6 +422,9 @@ cstar_tracesys:
6984 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
6985 movq %rsp,%rdi /* &pt_regs -> arg1 */
6986 call syscall_trace_enter
6987 +
6988 + pax_erase_kstack
6989 +
6990 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
6991 RESTORE_REST
6992 xchgl %ebp,%r9d
6993 @@ -415,6 +470,7 @@ ENTRY(ia32_syscall)
6994 CFI_REL_OFFSET rip,RIP-RIP
6995 PARAVIRT_ADJUST_EXCEPTION_FRAME
6996 SWAPGS
6997 + pax_enter_kernel_user
6998 /*
6999 * No need to follow this irqs on/off section: the syscall
7000 * disabled irqs and here we enable it straight after entry:
7001 @@ -448,6 +504,9 @@ ia32_tracesys:
7002 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
7003 movq %rsp,%rdi /* &pt_regs -> arg1 */
7004 call syscall_trace_enter
7005 +
7006 + pax_erase_kstack
7007 +
7008 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
7009 RESTORE_REST
7010 cmpq $(IA32_NR_syscalls-1),%rax
7011 diff -urNp linux-2.6.32.46/arch/x86/ia32/ia32_signal.c linux-2.6.32.46/arch/x86/ia32/ia32_signal.c
7012 --- linux-2.6.32.46/arch/x86/ia32/ia32_signal.c 2011-03-27 14:31:47.000000000 -0400
7013 +++ linux-2.6.32.46/arch/x86/ia32/ia32_signal.c 2011-10-06 09:37:08.000000000 -0400
7014 @@ -167,7 +167,7 @@ asmlinkage long sys32_sigaltstack(const
7015 }
7016 seg = get_fs();
7017 set_fs(KERNEL_DS);
7018 - ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp);
7019 + ret = do_sigaltstack(uss_ptr ? (const stack_t __force_user *)&uss : NULL, (stack_t __force_user *)&uoss, regs->sp);
7020 set_fs(seg);
7021 if (ret >= 0 && uoss_ptr) {
7022 if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)))
7023 @@ -374,7 +374,7 @@ static int ia32_setup_sigcontext(struct
7024 */
7025 static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
7026 size_t frame_size,
7027 - void **fpstate)
7028 + void __user **fpstate)
7029 {
7030 unsigned long sp;
7031
7032 @@ -395,7 +395,7 @@ static void __user *get_sigframe(struct
7033
7034 if (used_math()) {
7035 sp = sp - sig_xstate_ia32_size;
7036 - *fpstate = (struct _fpstate_ia32 *) sp;
7037 + *fpstate = (struct _fpstate_ia32 __user *) sp;
7038 if (save_i387_xstate_ia32(*fpstate) < 0)
7039 return (void __user *) -1L;
7040 }
7041 @@ -403,7 +403,7 @@ static void __user *get_sigframe(struct
7042 sp -= frame_size;
7043 /* Align the stack pointer according to the i386 ABI,
7044 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
7045 - sp = ((sp + 4) & -16ul) - 4;
7046 + sp = ((sp - 12) & -16ul) - 4;
7047 return (void __user *) sp;
7048 }
7049
7050 @@ -461,7 +461,7 @@ int ia32_setup_frame(int sig, struct k_s
7051 * These are actually not used anymore, but left because some
7052 * gdb versions depend on them as a marker.
7053 */
7054 - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
7055 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
7056 } put_user_catch(err);
7057
7058 if (err)
7059 @@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct
7060 0xb8,
7061 __NR_ia32_rt_sigreturn,
7062 0x80cd,
7063 - 0,
7064 + 0
7065 };
7066
7067 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
7068 @@ -533,16 +533,18 @@ int ia32_setup_rt_frame(int sig, struct
7069
7070 if (ka->sa.sa_flags & SA_RESTORER)
7071 restorer = ka->sa.sa_restorer;
7072 + else if (current->mm->context.vdso)
7073 + /* Return stub is in 32bit vsyscall page */
7074 + restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
7075 else
7076 - restorer = VDSO32_SYMBOL(current->mm->context.vdso,
7077 - rt_sigreturn);
7078 + restorer = &frame->retcode;
7079 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
7080
7081 /*
7082 * Not actually used anymore, but left because some gdb
7083 * versions need it.
7084 */
7085 - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
7086 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
7087 } put_user_catch(err);
7088
7089 if (err)
7090 diff -urNp linux-2.6.32.46/arch/x86/ia32/sys_ia32.c linux-2.6.32.46/arch/x86/ia32/sys_ia32.c
7091 --- linux-2.6.32.46/arch/x86/ia32/sys_ia32.c 2011-03-27 14:31:47.000000000 -0400
7092 +++ linux-2.6.32.46/arch/x86/ia32/sys_ia32.c 2011-10-06 09:37:14.000000000 -0400
7093 @@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsign
7094 */
7095 static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
7096 {
7097 - typeof(ubuf->st_uid) uid = 0;
7098 - typeof(ubuf->st_gid) gid = 0;
7099 + typeof(((struct stat64 *)0)->st_uid) uid = 0;
7100 + typeof(((struct stat64 *)0)->st_gid) gid = 0;
7101 SET_UID(uid, stat->uid);
7102 SET_GID(gid, stat->gid);
7103 if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) ||
7104 @@ -308,8 +308,8 @@ asmlinkage long sys32_rt_sigprocmask(int
7105 }
7106 set_fs(KERNEL_DS);
7107 ret = sys_rt_sigprocmask(how,
7108 - set ? (sigset_t __user *)&s : NULL,
7109 - oset ? (sigset_t __user *)&s : NULL,
7110 + set ? (sigset_t __force_user *)&s : NULL,
7111 + oset ? (sigset_t __force_user *)&s : NULL,
7112 sigsetsize);
7113 set_fs(old_fs);
7114 if (ret)
7115 @@ -371,7 +371,7 @@ asmlinkage long sys32_sched_rr_get_inter
7116 mm_segment_t old_fs = get_fs();
7117
7118 set_fs(KERNEL_DS);
7119 - ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t);
7120 + ret = sys_sched_rr_get_interval(pid, (struct timespec __force_user *)&t);
7121 set_fs(old_fs);
7122 if (put_compat_timespec(&t, interval))
7123 return -EFAULT;
7124 @@ -387,7 +387,7 @@ asmlinkage long sys32_rt_sigpending(comp
7125 mm_segment_t old_fs = get_fs();
7126
7127 set_fs(KERNEL_DS);
7128 - ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize);
7129 + ret = sys_rt_sigpending((sigset_t __force_user *)&s, sigsetsize);
7130 set_fs(old_fs);
7131 if (!ret) {
7132 switch (_NSIG_WORDS) {
7133 @@ -412,7 +412,7 @@ asmlinkage long sys32_rt_sigqueueinfo(in
7134 if (copy_siginfo_from_user32(&info, uinfo))
7135 return -EFAULT;
7136 set_fs(KERNEL_DS);
7137 - ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __user *)&info);
7138 + ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __force_user *)&info);
7139 set_fs(old_fs);
7140 return ret;
7141 }
7142 @@ -513,7 +513,7 @@ asmlinkage long sys32_sendfile(int out_f
7143 return -EFAULT;
7144
7145 set_fs(KERNEL_DS);
7146 - ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __user *)&of : NULL,
7147 + ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __force_user *)&of : NULL,
7148 count);
7149 set_fs(old_fs);
7150
7151 diff -urNp linux-2.6.32.46/arch/x86/include/asm/alternative-asm.h linux-2.6.32.46/arch/x86/include/asm/alternative-asm.h
7152 --- linux-2.6.32.46/arch/x86/include/asm/alternative-asm.h 2011-03-27 14:31:47.000000000 -0400
7153 +++ linux-2.6.32.46/arch/x86/include/asm/alternative-asm.h 2011-10-08 08:14:37.000000000 -0400
7154 @@ -19,4 +19,18 @@
7155 .endm
7156 #endif
7157
7158 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
7159 + .macro pax_force_retaddr rip=0
7160 + btsq $63,\rip(%rsp)
7161 + .endm
7162 + .macro pax_force_fptr ptr
7163 + btsq $63,\ptr
7164 + .endm
7165 +#else
7166 + .macro pax_force_retaddr rip=0
7167 + .endm
7168 + .macro pax_force_fptr ptr
7169 + .endm
7170 +#endif
7171 +
7172 #endif /* __ASSEMBLY__ */
7173 diff -urNp linux-2.6.32.46/arch/x86/include/asm/alternative.h linux-2.6.32.46/arch/x86/include/asm/alternative.h
7174 --- linux-2.6.32.46/arch/x86/include/asm/alternative.h 2011-03-27 14:31:47.000000000 -0400
7175 +++ linux-2.6.32.46/arch/x86/include/asm/alternative.h 2011-04-17 15:56:46.000000000 -0400
7176 @@ -85,7 +85,7 @@ static inline void alternatives_smp_swit
7177 " .byte 662b-661b\n" /* sourcelen */ \
7178 " .byte 664f-663f\n" /* replacementlen */ \
7179 ".previous\n" \
7180 - ".section .altinstr_replacement, \"ax\"\n" \
7181 + ".section .altinstr_replacement, \"a\"\n" \
7182 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
7183 ".previous"
7184
7185 diff -urNp linux-2.6.32.46/arch/x86/include/asm/apic.h linux-2.6.32.46/arch/x86/include/asm/apic.h
7186 --- linux-2.6.32.46/arch/x86/include/asm/apic.h 2011-03-27 14:31:47.000000000 -0400
7187 +++ linux-2.6.32.46/arch/x86/include/asm/apic.h 2011-08-17 20:01:15.000000000 -0400
7188 @@ -46,7 +46,7 @@ static inline void generic_apic_probe(vo
7189
7190 #ifdef CONFIG_X86_LOCAL_APIC
7191
7192 -extern unsigned int apic_verbosity;
7193 +extern int apic_verbosity;
7194 extern int local_apic_timer_c2_ok;
7195
7196 extern int disable_apic;
7197 diff -urNp linux-2.6.32.46/arch/x86/include/asm/apm.h linux-2.6.32.46/arch/x86/include/asm/apm.h
7198 --- linux-2.6.32.46/arch/x86/include/asm/apm.h 2011-03-27 14:31:47.000000000 -0400
7199 +++ linux-2.6.32.46/arch/x86/include/asm/apm.h 2011-04-17 15:56:46.000000000 -0400
7200 @@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
7201 __asm__ __volatile__(APM_DO_ZERO_SEGS
7202 "pushl %%edi\n\t"
7203 "pushl %%ebp\n\t"
7204 - "lcall *%%cs:apm_bios_entry\n\t"
7205 + "lcall *%%ss:apm_bios_entry\n\t"
7206 "setc %%al\n\t"
7207 "popl %%ebp\n\t"
7208 "popl %%edi\n\t"
7209 @@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
7210 __asm__ __volatile__(APM_DO_ZERO_SEGS
7211 "pushl %%edi\n\t"
7212 "pushl %%ebp\n\t"
7213 - "lcall *%%cs:apm_bios_entry\n\t"
7214 + "lcall *%%ss:apm_bios_entry\n\t"
7215 "setc %%bl\n\t"
7216 "popl %%ebp\n\t"
7217 "popl %%edi\n\t"
7218 diff -urNp linux-2.6.32.46/arch/x86/include/asm/atomic_32.h linux-2.6.32.46/arch/x86/include/asm/atomic_32.h
7219 --- linux-2.6.32.46/arch/x86/include/asm/atomic_32.h 2011-03-27 14:31:47.000000000 -0400
7220 +++ linux-2.6.32.46/arch/x86/include/asm/atomic_32.h 2011-05-04 17:56:20.000000000 -0400
7221 @@ -25,6 +25,17 @@ static inline int atomic_read(const atom
7222 }
7223
7224 /**
7225 + * atomic_read_unchecked - read atomic variable
7226 + * @v: pointer of type atomic_unchecked_t
7227 + *
7228 + * Atomically reads the value of @v.
7229 + */
7230 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
7231 +{
7232 + return v->counter;
7233 +}
7234 +
7235 +/**
7236 * atomic_set - set atomic variable
7237 * @v: pointer of type atomic_t
7238 * @i: required value
7239 @@ -37,6 +48,18 @@ static inline void atomic_set(atomic_t *
7240 }
7241
7242 /**
7243 + * atomic_set_unchecked - set atomic variable
7244 + * @v: pointer of type atomic_unchecked_t
7245 + * @i: required value
7246 + *
7247 + * Atomically sets the value of @v to @i.
7248 + */
7249 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
7250 +{
7251 + v->counter = i;
7252 +}
7253 +
7254 +/**
7255 * atomic_add - add integer to atomic variable
7256 * @i: integer value to add
7257 * @v: pointer of type atomic_t
7258 @@ -45,7 +68,29 @@ static inline void atomic_set(atomic_t *
7259 */
7260 static inline void atomic_add(int i, atomic_t *v)
7261 {
7262 - asm volatile(LOCK_PREFIX "addl %1,%0"
7263 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
7264 +
7265 +#ifdef CONFIG_PAX_REFCOUNT
7266 + "jno 0f\n"
7267 + LOCK_PREFIX "subl %1,%0\n"
7268 + "int $4\n0:\n"
7269 + _ASM_EXTABLE(0b, 0b)
7270 +#endif
7271 +
7272 + : "+m" (v->counter)
7273 + : "ir" (i));
7274 +}
7275 +
7276 +/**
7277 + * atomic_add_unchecked - add integer to atomic variable
7278 + * @i: integer value to add
7279 + * @v: pointer of type atomic_unchecked_t
7280 + *
7281 + * Atomically adds @i to @v.
7282 + */
7283 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
7284 +{
7285 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
7286 : "+m" (v->counter)
7287 : "ir" (i));
7288 }
7289 @@ -59,7 +104,29 @@ static inline void atomic_add(int i, ato
7290 */
7291 static inline void atomic_sub(int i, atomic_t *v)
7292 {
7293 - asm volatile(LOCK_PREFIX "subl %1,%0"
7294 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
7295 +
7296 +#ifdef CONFIG_PAX_REFCOUNT
7297 + "jno 0f\n"
7298 + LOCK_PREFIX "addl %1,%0\n"
7299 + "int $4\n0:\n"
7300 + _ASM_EXTABLE(0b, 0b)
7301 +#endif
7302 +
7303 + : "+m" (v->counter)
7304 + : "ir" (i));
7305 +}
7306 +
7307 +/**
7308 + * atomic_sub_unchecked - subtract integer from atomic variable
7309 + * @i: integer value to subtract
7310 + * @v: pointer of type atomic_unchecked_t
7311 + *
7312 + * Atomically subtracts @i from @v.
7313 + */
7314 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
7315 +{
7316 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
7317 : "+m" (v->counter)
7318 : "ir" (i));
7319 }
7320 @@ -77,7 +144,16 @@ static inline int atomic_sub_and_test(in
7321 {
7322 unsigned char c;
7323
7324 - asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
7325 + asm volatile(LOCK_PREFIX "subl %2,%0\n"
7326 +
7327 +#ifdef CONFIG_PAX_REFCOUNT
7328 + "jno 0f\n"
7329 + LOCK_PREFIX "addl %2,%0\n"
7330 + "int $4\n0:\n"
7331 + _ASM_EXTABLE(0b, 0b)
7332 +#endif
7333 +
7334 + "sete %1\n"
7335 : "+m" (v->counter), "=qm" (c)
7336 : "ir" (i) : "memory");
7337 return c;
7338 @@ -91,7 +167,27 @@ static inline int atomic_sub_and_test(in
7339 */
7340 static inline void atomic_inc(atomic_t *v)
7341 {
7342 - asm volatile(LOCK_PREFIX "incl %0"
7343 + asm volatile(LOCK_PREFIX "incl %0\n"
7344 +
7345 +#ifdef CONFIG_PAX_REFCOUNT
7346 + "jno 0f\n"
7347 + LOCK_PREFIX "decl %0\n"
7348 + "int $4\n0:\n"
7349 + _ASM_EXTABLE(0b, 0b)
7350 +#endif
7351 +
7352 + : "+m" (v->counter));
7353 +}
7354 +
7355 +/**
7356 + * atomic_inc_unchecked - increment atomic variable
7357 + * @v: pointer of type atomic_unchecked_t
7358 + *
7359 + * Atomically increments @v by 1.
7360 + */
7361 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
7362 +{
7363 + asm volatile(LOCK_PREFIX "incl %0\n"
7364 : "+m" (v->counter));
7365 }
7366
7367 @@ -103,7 +199,27 @@ static inline void atomic_inc(atomic_t *
7368 */
7369 static inline void atomic_dec(atomic_t *v)
7370 {
7371 - asm volatile(LOCK_PREFIX "decl %0"
7372 + asm volatile(LOCK_PREFIX "decl %0\n"
7373 +
7374 +#ifdef CONFIG_PAX_REFCOUNT
7375 + "jno 0f\n"
7376 + LOCK_PREFIX "incl %0\n"
7377 + "int $4\n0:\n"
7378 + _ASM_EXTABLE(0b, 0b)
7379 +#endif
7380 +
7381 + : "+m" (v->counter));
7382 +}
7383 +
7384 +/**
7385 + * atomic_dec_unchecked - decrement atomic variable
7386 + * @v: pointer of type atomic_unchecked_t
7387 + *
7388 + * Atomically decrements @v by 1.
7389 + */
7390 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
7391 +{
7392 + asm volatile(LOCK_PREFIX "decl %0\n"
7393 : "+m" (v->counter));
7394 }
7395
7396 @@ -119,7 +235,16 @@ static inline int atomic_dec_and_test(at
7397 {
7398 unsigned char c;
7399
7400 - asm volatile(LOCK_PREFIX "decl %0; sete %1"
7401 + asm volatile(LOCK_PREFIX "decl %0\n"
7402 +
7403 +#ifdef CONFIG_PAX_REFCOUNT
7404 + "jno 0f\n"
7405 + LOCK_PREFIX "incl %0\n"
7406 + "int $4\n0:\n"
7407 + _ASM_EXTABLE(0b, 0b)
7408 +#endif
7409 +
7410 + "sete %1\n"
7411 : "+m" (v->counter), "=qm" (c)
7412 : : "memory");
7413 return c != 0;
7414 @@ -137,7 +262,35 @@ static inline int atomic_inc_and_test(at
7415 {
7416 unsigned char c;
7417
7418 - asm volatile(LOCK_PREFIX "incl %0; sete %1"
7419 + asm volatile(LOCK_PREFIX "incl %0\n"
7420 +
7421 +#ifdef CONFIG_PAX_REFCOUNT
7422 + "jno 0f\n"
7423 + LOCK_PREFIX "decl %0\n"
7424 + "into\n0:\n"
7425 + _ASM_EXTABLE(0b, 0b)
7426 +#endif
7427 +
7428 + "sete %1\n"
7429 + : "+m" (v->counter), "=qm" (c)
7430 + : : "memory");
7431 + return c != 0;
7432 +}
7433 +
7434 +/**
7435 + * atomic_inc_and_test_unchecked - increment and test
7436 + * @v: pointer of type atomic_unchecked_t
7437 + *
7438 + * Atomically increments @v by 1
7439 + * and returns true if the result is zero, or false for all
7440 + * other cases.
7441 + */
7442 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
7443 +{
7444 + unsigned char c;
7445 +
7446 + asm volatile(LOCK_PREFIX "incl %0\n"
7447 + "sete %1\n"
7448 : "+m" (v->counter), "=qm" (c)
7449 : : "memory");
7450 return c != 0;
7451 @@ -156,7 +309,16 @@ static inline int atomic_add_negative(in
7452 {
7453 unsigned char c;
7454
7455 - asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
7456 + asm volatile(LOCK_PREFIX "addl %2,%0\n"
7457 +
7458 +#ifdef CONFIG_PAX_REFCOUNT
7459 + "jno 0f\n"
7460 + LOCK_PREFIX "subl %2,%0\n"
7461 + "int $4\n0:\n"
7462 + _ASM_EXTABLE(0b, 0b)
7463 +#endif
7464 +
7465 + "sets %1\n"
7466 : "+m" (v->counter), "=qm" (c)
7467 : "ir" (i) : "memory");
7468 return c;
7469 @@ -179,6 +341,46 @@ static inline int atomic_add_return(int
7470 #endif
7471 /* Modern 486+ processor */
7472 __i = i;
7473 + asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
7474 +
7475 +#ifdef CONFIG_PAX_REFCOUNT
7476 + "jno 0f\n"
7477 + "movl %0, %1\n"
7478 + "int $4\n0:\n"
7479 + _ASM_EXTABLE(0b, 0b)
7480 +#endif
7481 +
7482 + : "+r" (i), "+m" (v->counter)
7483 + : : "memory");
7484 + return i + __i;
7485 +
7486 +#ifdef CONFIG_M386
7487 +no_xadd: /* Legacy 386 processor */
7488 + local_irq_save(flags);
7489 + __i = atomic_read(v);
7490 + atomic_set(v, i + __i);
7491 + local_irq_restore(flags);
7492 + return i + __i;
7493 +#endif
7494 +}
7495 +
7496 +/**
7497 + * atomic_add_return_unchecked - add integer and return
7498 + * @v: pointer of type atomic_unchecked_t
7499 + * @i: integer value to add
7500 + *
7501 + * Atomically adds @i to @v and returns @i + @v
7502 + */
7503 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
7504 +{
7505 + int __i;
7506 +#ifdef CONFIG_M386
7507 + unsigned long flags;
7508 + if (unlikely(boot_cpu_data.x86 <= 3))
7509 + goto no_xadd;
7510 +#endif
7511 + /* Modern 486+ processor */
7512 + __i = i;
7513 asm volatile(LOCK_PREFIX "xaddl %0, %1"
7514 : "+r" (i), "+m" (v->counter)
7515 : : "memory");
7516 @@ -211,11 +413,21 @@ static inline int atomic_cmpxchg(atomic_
7517 return cmpxchg(&v->counter, old, new);
7518 }
7519
7520 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
7521 +{
7522 + return cmpxchg(&v->counter, old, new);
7523 +}
7524 +
7525 static inline int atomic_xchg(atomic_t *v, int new)
7526 {
7527 return xchg(&v->counter, new);
7528 }
7529
7530 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
7531 +{
7532 + return xchg(&v->counter, new);
7533 +}
7534 +
7535 /**
7536 * atomic_add_unless - add unless the number is already a given value
7537 * @v: pointer of type atomic_t
7538 @@ -227,22 +439,39 @@ static inline int atomic_xchg(atomic_t *
7539 */
7540 static inline int atomic_add_unless(atomic_t *v, int a, int u)
7541 {
7542 - int c, old;
7543 + int c, old, new;
7544 c = atomic_read(v);
7545 for (;;) {
7546 - if (unlikely(c == (u)))
7547 + if (unlikely(c == u))
7548 break;
7549 - old = atomic_cmpxchg((v), c, c + (a));
7550 +
7551 + asm volatile("addl %2,%0\n"
7552 +
7553 +#ifdef CONFIG_PAX_REFCOUNT
7554 + "jno 0f\n"
7555 + "subl %2,%0\n"
7556 + "int $4\n0:\n"
7557 + _ASM_EXTABLE(0b, 0b)
7558 +#endif
7559 +
7560 + : "=r" (new)
7561 + : "0" (c), "ir" (a));
7562 +
7563 + old = atomic_cmpxchg(v, c, new);
7564 if (likely(old == c))
7565 break;
7566 c = old;
7567 }
7568 - return c != (u);
7569 + return c != u;
7570 }
7571
7572 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
7573
7574 #define atomic_inc_return(v) (atomic_add_return(1, v))
7575 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
7576 +{
7577 + return atomic_add_return_unchecked(1, v);
7578 +}
7579 #define atomic_dec_return(v) (atomic_sub_return(1, v))
7580
7581 /* These are x86-specific, used by some header files */
7582 @@ -266,9 +495,18 @@ typedef struct {
7583 u64 __aligned(8) counter;
7584 } atomic64_t;
7585
7586 +#ifdef CONFIG_PAX_REFCOUNT
7587 +typedef struct {
7588 + u64 __aligned(8) counter;
7589 +} atomic64_unchecked_t;
7590 +#else
7591 +typedef atomic64_t atomic64_unchecked_t;
7592 +#endif
7593 +
7594 #define ATOMIC64_INIT(val) { (val) }
7595
7596 extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
7597 +extern u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old_val, u64 new_val);
7598
7599 /**
7600 * atomic64_xchg - xchg atomic64 variable
7601 @@ -279,6 +517,7 @@ extern u64 atomic64_cmpxchg(atomic64_t *
7602 * the old value.
7603 */
7604 extern u64 atomic64_xchg(atomic64_t *ptr, u64 new_val);
7605 +extern u64 atomic64_xchg_unchecked(atomic64_unchecked_t *ptr, u64 new_val);
7606
7607 /**
7608 * atomic64_set - set atomic64 variable
7609 @@ -290,6 +529,15 @@ extern u64 atomic64_xchg(atomic64_t *ptr
7610 extern void atomic64_set(atomic64_t *ptr, u64 new_val);
7611
7612 /**
7613 + * atomic64_unchecked_set - set atomic64 variable
7614 + * @ptr: pointer to type atomic64_unchecked_t
7615 + * @new_val: value to assign
7616 + *
7617 + * Atomically sets the value of @ptr to @new_val.
7618 + */
7619 +extern void atomic64_set_unchecked(atomic64_unchecked_t *ptr, u64 new_val);
7620 +
7621 +/**
7622 * atomic64_read - read atomic64 variable
7623 * @ptr: pointer to type atomic64_t
7624 *
7625 @@ -317,7 +565,33 @@ static inline u64 atomic64_read(atomic64
7626 return res;
7627 }
7628
7629 -extern u64 atomic64_read(atomic64_t *ptr);
7630 +/**
7631 + * atomic64_read_unchecked - read atomic64 variable
7632 + * @ptr: pointer to type atomic64_unchecked_t
7633 + *
7634 + * Atomically reads the value of @ptr and returns it.
7635 + */
7636 +static inline u64 atomic64_read_unchecked(atomic64_unchecked_t *ptr)
7637 +{
7638 + u64 res;
7639 +
7640 + /*
7641 + * Note, we inline this atomic64_unchecked_t primitive because
7642 + * it only clobbers EAX/EDX and leaves the others
7643 + * untouched. We also (somewhat subtly) rely on the
7644 + * fact that cmpxchg8b returns the current 64-bit value
7645 + * of the memory location we are touching:
7646 + */
7647 + asm volatile(
7648 + "mov %%ebx, %%eax\n\t"
7649 + "mov %%ecx, %%edx\n\t"
7650 + LOCK_PREFIX "cmpxchg8b %1\n"
7651 + : "=&A" (res)
7652 + : "m" (*ptr)
7653 + );
7654 +
7655 + return res;
7656 +}
7657
7658 /**
7659 * atomic64_add_return - add and return
7660 @@ -332,8 +606,11 @@ extern u64 atomic64_add_return(u64 delta
7661 * Other variants with different arithmetic operators:
7662 */
7663 extern u64 atomic64_sub_return(u64 delta, atomic64_t *ptr);
7664 +extern u64 atomic64_sub_return_unchecked(u64 delta, atomic64_unchecked_t *ptr);
7665 extern u64 atomic64_inc_return(atomic64_t *ptr);
7666 +extern u64 atomic64_inc_return_unchecked(atomic64_unchecked_t *ptr);
7667 extern u64 atomic64_dec_return(atomic64_t *ptr);
7668 +extern u64 atomic64_dec_return_unchecked(atomic64_unchecked_t *ptr);
7669
7670 /**
7671 * atomic64_add - add integer to atomic64 variable
7672 @@ -345,6 +622,15 @@ extern u64 atomic64_dec_return(atomic64_
7673 extern void atomic64_add(u64 delta, atomic64_t *ptr);
7674
7675 /**
7676 + * atomic64_add_unchecked - add integer to atomic64 variable
7677 + * @delta: integer value to add
7678 + * @ptr: pointer to type atomic64_unchecked_t
7679 + *
7680 + * Atomically adds @delta to @ptr.
7681 + */
7682 +extern void atomic64_add_unchecked(u64 delta, atomic64_unchecked_t *ptr);
7683 +
7684 +/**
7685 * atomic64_sub - subtract the atomic64 variable
7686 * @delta: integer value to subtract
7687 * @ptr: pointer to type atomic64_t
7688 @@ -354,6 +640,15 @@ extern void atomic64_add(u64 delta, atom
7689 extern void atomic64_sub(u64 delta, atomic64_t *ptr);
7690
7691 /**
7692 + * atomic64_sub_unchecked - subtract the atomic64 variable
7693 + * @delta: integer value to subtract
7694 + * @ptr: pointer to type atomic64_unchecked_t
7695 + *
7696 + * Atomically subtracts @delta from @ptr.
7697 + */
7698 +extern void atomic64_sub_unchecked(u64 delta, atomic64_unchecked_t *ptr);
7699 +
7700 +/**
7701 * atomic64_sub_and_test - subtract value from variable and test result
7702 * @delta: integer value to subtract
7703 * @ptr: pointer to type atomic64_t
7704 @@ -373,6 +668,14 @@ extern int atomic64_sub_and_test(u64 del
7705 extern void atomic64_inc(atomic64_t *ptr);
7706
7707 /**
7708 + * atomic64_inc_unchecked - increment atomic64 variable
7709 + * @ptr: pointer to type atomic64_unchecked_t
7710 + *
7711 + * Atomically increments @ptr by 1.
7712 + */
7713 +extern void atomic64_inc_unchecked(atomic64_unchecked_t *ptr);
7714 +
7715 +/**
7716 * atomic64_dec - decrement atomic64 variable
7717 * @ptr: pointer to type atomic64_t
7718 *
7719 @@ -381,6 +684,14 @@ extern void atomic64_inc(atomic64_t *ptr
7720 extern void atomic64_dec(atomic64_t *ptr);
7721
7722 /**
7723 + * atomic64_dec_unchecked - decrement atomic64 variable
7724 + * @ptr: pointer to type atomic64_unchecked_t
7725 + *
7726 + * Atomically decrements @ptr by 1.
7727 + */
7728 +extern void atomic64_dec_unchecked(atomic64_unchecked_t *ptr);
7729 +
7730 +/**
7731 * atomic64_dec_and_test - decrement and test
7732 * @ptr: pointer to type atomic64_t
7733 *
7734 diff -urNp linux-2.6.32.46/arch/x86/include/asm/atomic_64.h linux-2.6.32.46/arch/x86/include/asm/atomic_64.h
7735 --- linux-2.6.32.46/arch/x86/include/asm/atomic_64.h 2011-03-27 14:31:47.000000000 -0400
7736 +++ linux-2.6.32.46/arch/x86/include/asm/atomic_64.h 2011-05-04 18:35:31.000000000 -0400
7737 @@ -24,6 +24,17 @@ static inline int atomic_read(const atom
7738 }
7739
7740 /**
7741 + * atomic_read_unchecked - read atomic variable
7742 + * @v: pointer of type atomic_unchecked_t
7743 + *
7744 + * Atomically reads the value of @v.
7745 + */
7746 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
7747 +{
7748 + return v->counter;
7749 +}
7750 +
7751 +/**
7752 * atomic_set - set atomic variable
7753 * @v: pointer of type atomic_t
7754 * @i: required value
7755 @@ -36,6 +47,18 @@ static inline void atomic_set(atomic_t *
7756 }
7757
7758 /**
7759 + * atomic_set_unchecked - set atomic variable
7760 + * @v: pointer of type atomic_unchecked_t
7761 + * @i: required value
7762 + *
7763 + * Atomically sets the value of @v to @i.
7764 + */
7765 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
7766 +{
7767 + v->counter = i;
7768 +}
7769 +
7770 +/**
7771 * atomic_add - add integer to atomic variable
7772 * @i: integer value to add
7773 * @v: pointer of type atomic_t
7774 @@ -44,7 +67,29 @@ static inline void atomic_set(atomic_t *
7775 */
7776 static inline void atomic_add(int i, atomic_t *v)
7777 {
7778 - asm volatile(LOCK_PREFIX "addl %1,%0"
7779 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
7780 +
7781 +#ifdef CONFIG_PAX_REFCOUNT
7782 + "jno 0f\n"
7783 + LOCK_PREFIX "subl %1,%0\n"
7784 + "int $4\n0:\n"
7785 + _ASM_EXTABLE(0b, 0b)
7786 +#endif
7787 +
7788 + : "=m" (v->counter)
7789 + : "ir" (i), "m" (v->counter));
7790 +}
7791 +
7792 +/**
7793 + * atomic_add_unchecked - add integer to atomic variable
7794 + * @i: integer value to add
7795 + * @v: pointer of type atomic_unchecked_t
7796 + *
7797 + * Atomically adds @i to @v.
7798 + */
7799 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
7800 +{
7801 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
7802 : "=m" (v->counter)
7803 : "ir" (i), "m" (v->counter));
7804 }
7805 @@ -58,7 +103,29 @@ static inline void atomic_add(int i, ato
7806 */
7807 static inline void atomic_sub(int i, atomic_t *v)
7808 {
7809 - asm volatile(LOCK_PREFIX "subl %1,%0"
7810 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
7811 +
7812 +#ifdef CONFIG_PAX_REFCOUNT
7813 + "jno 0f\n"
7814 + LOCK_PREFIX "addl %1,%0\n"
7815 + "int $4\n0:\n"
7816 + _ASM_EXTABLE(0b, 0b)
7817 +#endif
7818 +
7819 + : "=m" (v->counter)
7820 + : "ir" (i), "m" (v->counter));
7821 +}
7822 +
7823 +/**
7824 + * atomic_sub_unchecked - subtract the atomic variable
7825 + * @i: integer value to subtract
7826 + * @v: pointer of type atomic_unchecked_t
7827 + *
7828 + * Atomically subtracts @i from @v.
7829 + */
7830 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
7831 +{
7832 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
7833 : "=m" (v->counter)
7834 : "ir" (i), "m" (v->counter));
7835 }
7836 @@ -76,7 +143,16 @@ static inline int atomic_sub_and_test(in
7837 {
7838 unsigned char c;
7839
7840 - asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
7841 + asm volatile(LOCK_PREFIX "subl %2,%0\n"
7842 +
7843 +#ifdef CONFIG_PAX_REFCOUNT
7844 + "jno 0f\n"
7845 + LOCK_PREFIX "addl %2,%0\n"
7846 + "int $4\n0:\n"
7847 + _ASM_EXTABLE(0b, 0b)
7848 +#endif
7849 +
7850 + "sete %1\n"
7851 : "=m" (v->counter), "=qm" (c)
7852 : "ir" (i), "m" (v->counter) : "memory");
7853 return c;
7854 @@ -90,7 +166,28 @@ static inline int atomic_sub_and_test(in
7855 */
7856 static inline void atomic_inc(atomic_t *v)
7857 {
7858 - asm volatile(LOCK_PREFIX "incl %0"
7859 + asm volatile(LOCK_PREFIX "incl %0\n"
7860 +
7861 +#ifdef CONFIG_PAX_REFCOUNT
7862 + "jno 0f\n"
7863 + LOCK_PREFIX "decl %0\n"
7864 + "int $4\n0:\n"
7865 + _ASM_EXTABLE(0b, 0b)
7866 +#endif
7867 +
7868 + : "=m" (v->counter)
7869 + : "m" (v->counter));
7870 +}
7871 +
7872 +/**
7873 + * atomic_inc_unchecked - increment atomic variable
7874 + * @v: pointer of type atomic_unchecked_t
7875 + *
7876 + * Atomically increments @v by 1.
7877 + */
7878 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
7879 +{
7880 + asm volatile(LOCK_PREFIX "incl %0\n"
7881 : "=m" (v->counter)
7882 : "m" (v->counter));
7883 }
7884 @@ -103,7 +200,28 @@ static inline void atomic_inc(atomic_t *
7885 */
7886 static inline void atomic_dec(atomic_t *v)
7887 {
7888 - asm volatile(LOCK_PREFIX "decl %0"
7889 + asm volatile(LOCK_PREFIX "decl %0\n"
7890 +
7891 +#ifdef CONFIG_PAX_REFCOUNT
7892 + "jno 0f\n"
7893 + LOCK_PREFIX "incl %0\n"
7894 + "int $4\n0:\n"
7895 + _ASM_EXTABLE(0b, 0b)
7896 +#endif
7897 +
7898 + : "=m" (v->counter)
7899 + : "m" (v->counter));
7900 +}
7901 +
7902 +/**
7903 + * atomic_dec_unchecked - decrement atomic variable
7904 + * @v: pointer of type atomic_unchecked_t
7905 + *
7906 + * Atomically decrements @v by 1.
7907 + */
7908 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
7909 +{
7910 + asm volatile(LOCK_PREFIX "decl %0\n"
7911 : "=m" (v->counter)
7912 : "m" (v->counter));
7913 }
7914 @@ -120,7 +238,16 @@ static inline int atomic_dec_and_test(at
7915 {
7916 unsigned char c;
7917
7918 - asm volatile(LOCK_PREFIX "decl %0; sete %1"
7919 + asm volatile(LOCK_PREFIX "decl %0\n"
7920 +
7921 +#ifdef CONFIG_PAX_REFCOUNT
7922 + "jno 0f\n"
7923 + LOCK_PREFIX "incl %0\n"
7924 + "int $4\n0:\n"
7925 + _ASM_EXTABLE(0b, 0b)
7926 +#endif
7927 +
7928 + "sete %1\n"
7929 : "=m" (v->counter), "=qm" (c)
7930 : "m" (v->counter) : "memory");
7931 return c != 0;
7932 @@ -138,7 +265,35 @@ static inline int atomic_inc_and_test(at
7933 {
7934 unsigned char c;
7935
7936 - asm volatile(LOCK_PREFIX "incl %0; sete %1"
7937 + asm volatile(LOCK_PREFIX "incl %0\n"
7938 +
7939 +#ifdef CONFIG_PAX_REFCOUNT
7940 + "jno 0f\n"
7941 + LOCK_PREFIX "decl %0\n"
7942 + "int $4\n0:\n"
7943 + _ASM_EXTABLE(0b, 0b)
7944 +#endif
7945 +
7946 + "sete %1\n"
7947 + : "=m" (v->counter), "=qm" (c)
7948 + : "m" (v->counter) : "memory");
7949 + return c != 0;
7950 +}
7951 +
7952 +/**
7953 + * atomic_inc_and_test_unchecked - increment and test
7954 + * @v: pointer of type atomic_unchecked_t
7955 + *
7956 + * Atomically increments @v by 1
7957 + * and returns true if the result is zero, or false for all
7958 + * other cases.
7959 + */
7960 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
7961 +{
7962 + unsigned char c;
7963 +
7964 + asm volatile(LOCK_PREFIX "incl %0\n"
7965 + "sete %1\n"
7966 : "=m" (v->counter), "=qm" (c)
7967 : "m" (v->counter) : "memory");
7968 return c != 0;
7969 @@ -157,7 +312,16 @@ static inline int atomic_add_negative(in
7970 {
7971 unsigned char c;
7972
7973 - asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
7974 + asm volatile(LOCK_PREFIX "addl %2,%0\n"
7975 +
7976 +#ifdef CONFIG_PAX_REFCOUNT
7977 + "jno 0f\n"
7978 + LOCK_PREFIX "subl %2,%0\n"
7979 + "int $4\n0:\n"
7980 + _ASM_EXTABLE(0b, 0b)
7981 +#endif
7982 +
7983 + "sets %1\n"
7984 : "=m" (v->counter), "=qm" (c)
7985 : "ir" (i), "m" (v->counter) : "memory");
7986 return c;
7987 @@ -173,7 +337,31 @@ static inline int atomic_add_negative(in
7988 static inline int atomic_add_return(int i, atomic_t *v)
7989 {
7990 int __i = i;
7991 - asm volatile(LOCK_PREFIX "xaddl %0, %1"
7992 + asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
7993 +
7994 +#ifdef CONFIG_PAX_REFCOUNT
7995 + "jno 0f\n"
7996 + "movl %0, %1\n"
7997 + "int $4\n0:\n"
7998 + _ASM_EXTABLE(0b, 0b)
7999 +#endif
8000 +
8001 + : "+r" (i), "+m" (v->counter)
8002 + : : "memory");
8003 + return i + __i;
8004 +}
8005 +
8006 +/**
8007 + * atomic_add_return_unchecked - add and return
8008 + * @i: integer value to add
8009 + * @v: pointer of type atomic_unchecked_t
8010 + *
8011 + * Atomically adds @i to @v and returns @i + @v
8012 + */
8013 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
8014 +{
8015 + int __i = i;
8016 + asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
8017 : "+r" (i), "+m" (v->counter)
8018 : : "memory");
8019 return i + __i;
8020 @@ -185,6 +373,10 @@ static inline int atomic_sub_return(int
8021 }
8022
8023 #define atomic_inc_return(v) (atomic_add_return(1, v))
8024 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
8025 +{
8026 + return atomic_add_return_unchecked(1, v);
8027 +}
8028 #define atomic_dec_return(v) (atomic_sub_return(1, v))
8029
8030 /* The 64-bit atomic type */
8031 @@ -204,6 +396,18 @@ static inline long atomic64_read(const a
8032 }
8033
8034 /**
8035 + * atomic64_read_unchecked - read atomic64 variable
8036 + * @v: pointer of type atomic64_unchecked_t
8037 + *
8038 + * Atomically reads the value of @v.
8039 + * Doesn't imply a read memory barrier.
8040 + */
8041 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
8042 +{
8043 + return v->counter;
8044 +}
8045 +
8046 +/**
8047 * atomic64_set - set atomic64 variable
8048 * @v: pointer to type atomic64_t
8049 * @i: required value
8050 @@ -216,6 +420,18 @@ static inline void atomic64_set(atomic64
8051 }
8052
8053 /**
8054 + * atomic64_set_unchecked - set atomic64 variable
8055 + * @v: pointer to type atomic64_unchecked_t
8056 + * @i: required value
8057 + *
8058 + * Atomically sets the value of @v to @i.
8059 + */
8060 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
8061 +{
8062 + v->counter = i;
8063 +}
8064 +
8065 +/**
8066 * atomic64_add - add integer to atomic64 variable
8067 * @i: integer value to add
8068 * @v: pointer to type atomic64_t
8069 @@ -224,6 +440,28 @@ static inline void atomic64_set(atomic64
8070 */
8071 static inline void atomic64_add(long i, atomic64_t *v)
8072 {
8073 + asm volatile(LOCK_PREFIX "addq %1,%0\n"
8074 +
8075 +#ifdef CONFIG_PAX_REFCOUNT
8076 + "jno 0f\n"
8077 + LOCK_PREFIX "subq %1,%0\n"
8078 + "int $4\n0:\n"
8079 + _ASM_EXTABLE(0b, 0b)
8080 +#endif
8081 +
8082 + : "=m" (v->counter)
8083 + : "er" (i), "m" (v->counter));
8084 +}
8085 +
8086 +/**
8087 + * atomic64_add_unchecked - add integer to atomic64 variable
8088 + * @i: integer value to add
8089 + * @v: pointer to type atomic64_unchecked_t
8090 + *
8091 + * Atomically adds @i to @v.
8092 + */
8093 +static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
8094 +{
8095 asm volatile(LOCK_PREFIX "addq %1,%0"
8096 : "=m" (v->counter)
8097 : "er" (i), "m" (v->counter));
8098 @@ -238,7 +476,15 @@ static inline void atomic64_add(long i,
8099 */
8100 static inline void atomic64_sub(long i, atomic64_t *v)
8101 {
8102 - asm volatile(LOCK_PREFIX "subq %1,%0"
8103 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
8104 +
8105 +#ifdef CONFIG_PAX_REFCOUNT
8106 + "jno 0f\n"
8107 + LOCK_PREFIX "addq %1,%0\n"
8108 + "int $4\n0:\n"
8109 + _ASM_EXTABLE(0b, 0b)
8110 +#endif
8111 +
8112 : "=m" (v->counter)
8113 : "er" (i), "m" (v->counter));
8114 }
8115 @@ -256,7 +502,16 @@ static inline int atomic64_sub_and_test(
8116 {
8117 unsigned char c;
8118
8119 - asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
8120 + asm volatile(LOCK_PREFIX "subq %2,%0\n"
8121 +
8122 +#ifdef CONFIG_PAX_REFCOUNT
8123 + "jno 0f\n"
8124 + LOCK_PREFIX "addq %2,%0\n"
8125 + "int $4\n0:\n"
8126 + _ASM_EXTABLE(0b, 0b)
8127 +#endif
8128 +
8129 + "sete %1\n"
8130 : "=m" (v->counter), "=qm" (c)
8131 : "er" (i), "m" (v->counter) : "memory");
8132 return c;
8133 @@ -270,6 +525,27 @@ static inline int atomic64_sub_and_test(
8134 */
8135 static inline void atomic64_inc(atomic64_t *v)
8136 {
8137 + asm volatile(LOCK_PREFIX "incq %0\n"
8138 +
8139 +#ifdef CONFIG_PAX_REFCOUNT
8140 + "jno 0f\n"
8141 + LOCK_PREFIX "decq %0\n"
8142 + "int $4\n0:\n"
8143 + _ASM_EXTABLE(0b, 0b)
8144 +#endif
8145 +
8146 + : "=m" (v->counter)
8147 + : "m" (v->counter));
8148 +}
8149 +
8150 +/**
8151 + * atomic64_inc_unchecked - increment atomic64 variable
8152 + * @v: pointer to type atomic64_unchecked_t
8153 + *
8154 + * Atomically increments @v by 1.
8155 + */
8156 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
8157 +{
8158 asm volatile(LOCK_PREFIX "incq %0"
8159 : "=m" (v->counter)
8160 : "m" (v->counter));
8161 @@ -283,7 +559,28 @@ static inline void atomic64_inc(atomic64
8162 */
8163 static inline void atomic64_dec(atomic64_t *v)
8164 {
8165 - asm volatile(LOCK_PREFIX "decq %0"
8166 + asm volatile(LOCK_PREFIX "decq %0\n"
8167 +
8168 +#ifdef CONFIG_PAX_REFCOUNT
8169 + "jno 0f\n"
8170 + LOCK_PREFIX "incq %0\n"
8171 + "int $4\n0:\n"
8172 + _ASM_EXTABLE(0b, 0b)
8173 +#endif
8174 +
8175 + : "=m" (v->counter)
8176 + : "m" (v->counter));
8177 +}
8178 +
8179 +/**
8180 + * atomic64_dec_unchecked - decrement atomic64 variable
8181 + * @v: pointer to type atomic64_t
8182 + *
8183 + * Atomically decrements @v by 1.
8184 + */
8185 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
8186 +{
8187 + asm volatile(LOCK_PREFIX "decq %0\n"
8188 : "=m" (v->counter)
8189 : "m" (v->counter));
8190 }
8191 @@ -300,7 +597,16 @@ static inline int atomic64_dec_and_test(
8192 {
8193 unsigned char c;
8194
8195 - asm volatile(LOCK_PREFIX "decq %0; sete %1"
8196 + asm volatile(LOCK_PREFIX "decq %0\n"
8197 +
8198 +#ifdef CONFIG_PAX_REFCOUNT
8199 + "jno 0f\n"
8200 + LOCK_PREFIX "incq %0\n"
8201 + "int $4\n0:\n"
8202 + _ASM_EXTABLE(0b, 0b)
8203 +#endif
8204 +
8205 + "sete %1\n"
8206 : "=m" (v->counter), "=qm" (c)
8207 : "m" (v->counter) : "memory");
8208 return c != 0;
8209 @@ -318,7 +624,16 @@ static inline int atomic64_inc_and_test(
8210 {
8211 unsigned char c;
8212
8213 - asm volatile(LOCK_PREFIX "incq %0; sete %1"
8214 + asm volatile(LOCK_PREFIX "incq %0\n"
8215 +
8216 +#ifdef CONFIG_PAX_REFCOUNT
8217 + "jno 0f\n"
8218 + LOCK_PREFIX "decq %0\n"
8219 + "int $4\n0:\n"
8220 + _ASM_EXTABLE(0b, 0b)
8221 +#endif
8222 +
8223 + "sete %1\n"
8224 : "=m" (v->counter), "=qm" (c)
8225 : "m" (v->counter) : "memory");
8226 return c != 0;
8227 @@ -337,7 +652,16 @@ static inline int atomic64_add_negative(
8228 {
8229 unsigned char c;
8230
8231 - asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
8232 + asm volatile(LOCK_PREFIX "addq %2,%0\n"
8233 +
8234 +#ifdef CONFIG_PAX_REFCOUNT
8235 + "jno 0f\n"
8236 + LOCK_PREFIX "subq %2,%0\n"
8237 + "int $4\n0:\n"
8238 + _ASM_EXTABLE(0b, 0b)
8239 +#endif
8240 +
8241 + "sets %1\n"
8242 : "=m" (v->counter), "=qm" (c)
8243 : "er" (i), "m" (v->counter) : "memory");
8244 return c;
8245 @@ -353,7 +677,31 @@ static inline int atomic64_add_negative(
8246 static inline long atomic64_add_return(long i, atomic64_t *v)
8247 {
8248 long __i = i;
8249 - asm volatile(LOCK_PREFIX "xaddq %0, %1;"
8250 + asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
8251 +
8252 +#ifdef CONFIG_PAX_REFCOUNT
8253 + "jno 0f\n"
8254 + "movq %0, %1\n"
8255 + "int $4\n0:\n"
8256 + _ASM_EXTABLE(0b, 0b)
8257 +#endif
8258 +
8259 + : "+r" (i), "+m" (v->counter)
8260 + : : "memory");
8261 + return i + __i;
8262 +}
8263 +
8264 +/**
8265 + * atomic64_add_return_unchecked - add and return
8266 + * @i: integer value to add
8267 + * @v: pointer to type atomic64_unchecked_t
8268 + *
8269 + * Atomically adds @i to @v and returns @i + @v
8270 + */
8271 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
8272 +{
8273 + long __i = i;
8274 + asm volatile(LOCK_PREFIX "xaddq %0, %1"
8275 : "+r" (i), "+m" (v->counter)
8276 : : "memory");
8277 return i + __i;
8278 @@ -365,6 +713,10 @@ static inline long atomic64_sub_return(l
8279 }
8280
8281 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
8282 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
8283 +{
8284 + return atomic64_add_return_unchecked(1, v);
8285 +}
8286 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
8287
8288 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
8289 @@ -372,21 +724,41 @@ static inline long atomic64_cmpxchg(atom
8290 return cmpxchg(&v->counter, old, new);
8291 }
8292
8293 +static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
8294 +{
8295 + return cmpxchg(&v->counter, old, new);
8296 +}
8297 +
8298 static inline long atomic64_xchg(atomic64_t *v, long new)
8299 {
8300 return xchg(&v->counter, new);
8301 }
8302
8303 +static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
8304 +{
8305 + return xchg(&v->counter, new);
8306 +}
8307 +
8308 static inline long atomic_cmpxchg(atomic_t *v, int old, int new)
8309 {
8310 return cmpxchg(&v->counter, old, new);
8311 }
8312
8313 +static inline long atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
8314 +{
8315 + return cmpxchg(&v->counter, old, new);
8316 +}
8317 +
8318 static inline long atomic_xchg(atomic_t *v, int new)
8319 {
8320 return xchg(&v->counter, new);
8321 }
8322
8323 +static inline long atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
8324 +{
8325 + return xchg(&v->counter, new);
8326 +}
8327 +
8328 /**
8329 * atomic_add_unless - add unless the number is a given value
8330 * @v: pointer of type atomic_t
8331 @@ -398,17 +770,30 @@ static inline long atomic_xchg(atomic_t
8332 */
8333 static inline int atomic_add_unless(atomic_t *v, int a, int u)
8334 {
8335 - int c, old;
8336 + int c, old, new;
8337 c = atomic_read(v);
8338 for (;;) {
8339 - if (unlikely(c == (u)))
8340 + if (unlikely(c == u))
8341 break;
8342 - old = atomic_cmpxchg((v), c, c + (a));
8343 +
8344 + asm volatile("addl %2,%0\n"
8345 +
8346 +#ifdef CONFIG_PAX_REFCOUNT
8347 + "jno 0f\n"
8348 + "subl %2,%0\n"
8349 + "int $4\n0:\n"
8350 + _ASM_EXTABLE(0b, 0b)
8351 +#endif
8352 +
8353 + : "=r" (new)
8354 + : "0" (c), "ir" (a));
8355 +
8356 + old = atomic_cmpxchg(v, c, new);
8357 if (likely(old == c))
8358 break;
8359 c = old;
8360 }
8361 - return c != (u);
8362 + return c != u;
8363 }
8364
8365 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
8366 @@ -424,17 +809,30 @@ static inline int atomic_add_unless(atom
8367 */
8368 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
8369 {
8370 - long c, old;
8371 + long c, old, new;
8372 c = atomic64_read(v);
8373 for (;;) {
8374 - if (unlikely(c == (u)))
8375 + if (unlikely(c == u))
8376 break;
8377 - old = atomic64_cmpxchg((v), c, c + (a));
8378 +
8379 + asm volatile("addq %2,%0\n"
8380 +
8381 +#ifdef CONFIG_PAX_REFCOUNT
8382 + "jno 0f\n"
8383 + "subq %2,%0\n"
8384 + "int $4\n0:\n"
8385 + _ASM_EXTABLE(0b, 0b)
8386 +#endif
8387 +
8388 + : "=r" (new)
8389 + : "0" (c), "er" (a));
8390 +
8391 + old = atomic64_cmpxchg(v, c, new);
8392 if (likely(old == c))
8393 break;
8394 c = old;
8395 }
8396 - return c != (u);
8397 + return c != u;
8398 }
8399
8400 /**
8401 diff -urNp linux-2.6.32.46/arch/x86/include/asm/bitops.h linux-2.6.32.46/arch/x86/include/asm/bitops.h
8402 --- linux-2.6.32.46/arch/x86/include/asm/bitops.h 2011-03-27 14:31:47.000000000 -0400
8403 +++ linux-2.6.32.46/arch/x86/include/asm/bitops.h 2011-04-17 15:56:46.000000000 -0400
8404 @@ -38,7 +38,7 @@
8405 * a mask operation on a byte.
8406 */
8407 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
8408 -#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
8409 +#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
8410 #define CONST_MASK(nr) (1 << ((nr) & 7))
8411
8412 /**
8413 diff -urNp linux-2.6.32.46/arch/x86/include/asm/boot.h linux-2.6.32.46/arch/x86/include/asm/boot.h
8414 --- linux-2.6.32.46/arch/x86/include/asm/boot.h 2011-03-27 14:31:47.000000000 -0400
8415 +++ linux-2.6.32.46/arch/x86/include/asm/boot.h 2011-04-17 15:56:46.000000000 -0400
8416 @@ -11,10 +11,15 @@
8417 #include <asm/pgtable_types.h>
8418
8419 /* Physical address where kernel should be loaded. */
8420 -#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
8421 +#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
8422 + (CONFIG_PHYSICAL_ALIGN - 1)) \
8423 & ~(CONFIG_PHYSICAL_ALIGN - 1))
8424
8425 +#ifndef __ASSEMBLY__
8426 +extern unsigned char __LOAD_PHYSICAL_ADDR[];
8427 +#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
8428 +#endif
8429 +
8430 /* Minimum kernel alignment, as a power of two */
8431 #ifdef CONFIG_X86_64
8432 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
8433 diff -urNp linux-2.6.32.46/arch/x86/include/asm/cacheflush.h linux-2.6.32.46/arch/x86/include/asm/cacheflush.h
8434 --- linux-2.6.32.46/arch/x86/include/asm/cacheflush.h 2011-03-27 14:31:47.000000000 -0400
8435 +++ linux-2.6.32.46/arch/x86/include/asm/cacheflush.h 2011-04-17 15:56:46.000000000 -0400
8436 @@ -60,7 +60,7 @@ PAGEFLAG(WC, WC)
8437 static inline unsigned long get_page_memtype(struct page *pg)
8438 {
8439 if (!PageUncached(pg) && !PageWC(pg))
8440 - return -1;
8441 + return ~0UL;
8442 else if (!PageUncached(pg) && PageWC(pg))
8443 return _PAGE_CACHE_WC;
8444 else if (PageUncached(pg) && !PageWC(pg))
8445 @@ -85,7 +85,7 @@ static inline void set_page_memtype(stru
8446 SetPageWC(pg);
8447 break;
8448 default:
8449 - case -1:
8450 + case ~0UL:
8451 ClearPageUncached(pg);
8452 ClearPageWC(pg);
8453 break;
8454 diff -urNp linux-2.6.32.46/arch/x86/include/asm/cache.h linux-2.6.32.46/arch/x86/include/asm/cache.h
8455 --- linux-2.6.32.46/arch/x86/include/asm/cache.h 2011-03-27 14:31:47.000000000 -0400
8456 +++ linux-2.6.32.46/arch/x86/include/asm/cache.h 2011-07-06 19:53:33.000000000 -0400
8457 @@ -5,9 +5,10 @@
8458
8459 /* L1 cache line size */
8460 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
8461 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
8462 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
8463
8464 #define __read_mostly __attribute__((__section__(".data.read_mostly")))
8465 +#define __read_only __attribute__((__section__(".data.read_only")))
8466
8467 #ifdef CONFIG_X86_VSMP
8468 /* vSMP Internode cacheline shift */
8469 diff -urNp linux-2.6.32.46/arch/x86/include/asm/calling.h linux-2.6.32.46/arch/x86/include/asm/calling.h
8470 --- linux-2.6.32.46/arch/x86/include/asm/calling.h 2011-03-27 14:31:47.000000000 -0400
8471 +++ linux-2.6.32.46/arch/x86/include/asm/calling.h 2011-10-06 10:08:42.000000000 -0400
8472 @@ -52,32 +52,32 @@ For 32-bit we have the following convent
8473 * for assembly code:
8474 */
8475
8476 -#define R15 0
8477 -#define R14 8
8478 -#define R13 16
8479 -#define R12 24
8480 -#define RBP 32
8481 -#define RBX 40
8482 +#define R15 (0)
8483 +#define R14 (8)
8484 +#define R13 (16)
8485 +#define R12 (24)
8486 +#define RBP (32)
8487 +#define RBX (40)
8488
8489 /* arguments: interrupts/non tracing syscalls only save up to here: */
8490 -#define R11 48
8491 -#define R10 56
8492 -#define R9 64
8493 -#define R8 72
8494 -#define RAX 80
8495 -#define RCX 88
8496 -#define RDX 96
8497 -#define RSI 104
8498 -#define RDI 112
8499 -#define ORIG_RAX 120 /* + error_code */
8500 +#define R11 (48)
8501 +#define R10 (56)
8502 +#define R9 (64)
8503 +#define R8 (72)
8504 +#define RAX (80)
8505 +#define RCX (88)
8506 +#define RDX (96)
8507 +#define RSI (104)
8508 +#define RDI (112)
8509 +#define ORIG_RAX (120) /* + error_code */
8510 /* end of arguments */
8511
8512 /* cpu exception frame or undefined in case of fast syscall: */
8513 -#define RIP 128
8514 -#define CS 136
8515 -#define EFLAGS 144
8516 -#define RSP 152
8517 -#define SS 160
8518 +#define RIP (128)
8519 +#define CS (136)
8520 +#define EFLAGS (144)
8521 +#define RSP (152)
8522 +#define SS (160)
8523
8524 #define ARGOFFSET R11
8525 #define SWFRAME ORIG_RAX
8526 diff -urNp linux-2.6.32.46/arch/x86/include/asm/checksum_32.h linux-2.6.32.46/arch/x86/include/asm/checksum_32.h
8527 --- linux-2.6.32.46/arch/x86/include/asm/checksum_32.h 2011-03-27 14:31:47.000000000 -0400
8528 +++ linux-2.6.32.46/arch/x86/include/asm/checksum_32.h 2011-04-17 15:56:46.000000000 -0400
8529 @@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
8530 int len, __wsum sum,
8531 int *src_err_ptr, int *dst_err_ptr);
8532
8533 +asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
8534 + int len, __wsum sum,
8535 + int *src_err_ptr, int *dst_err_ptr);
8536 +
8537 +asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
8538 + int len, __wsum sum,
8539 + int *src_err_ptr, int *dst_err_ptr);
8540 +
8541 /*
8542 * Note: when you get a NULL pointer exception here this means someone
8543 * passed in an incorrect kernel address to one of these functions.
8544 @@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
8545 int *err_ptr)
8546 {
8547 might_sleep();
8548 - return csum_partial_copy_generic((__force void *)src, dst,
8549 + return csum_partial_copy_generic_from_user((__force void *)src, dst,
8550 len, sum, err_ptr, NULL);
8551 }
8552
8553 @@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
8554 {
8555 might_sleep();
8556 if (access_ok(VERIFY_WRITE, dst, len))
8557 - return csum_partial_copy_generic(src, (__force void *)dst,
8558 + return csum_partial_copy_generic_to_user(src, (__force void *)dst,
8559 len, sum, NULL, err_ptr);
8560
8561 if (len)
8562 diff -urNp linux-2.6.32.46/arch/x86/include/asm/desc_defs.h linux-2.6.32.46/arch/x86/include/asm/desc_defs.h
8563 --- linux-2.6.32.46/arch/x86/include/asm/desc_defs.h 2011-03-27 14:31:47.000000000 -0400
8564 +++ linux-2.6.32.46/arch/x86/include/asm/desc_defs.h 2011-04-17 15:56:46.000000000 -0400
8565 @@ -31,6 +31,12 @@ struct desc_struct {
8566 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
8567 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
8568 };
8569 + struct {
8570 + u16 offset_low;
8571 + u16 seg;
8572 + unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
8573 + unsigned offset_high: 16;
8574 + } gate;
8575 };
8576 } __attribute__((packed));
8577
8578 diff -urNp linux-2.6.32.46/arch/x86/include/asm/desc.h linux-2.6.32.46/arch/x86/include/asm/desc.h
8579 --- linux-2.6.32.46/arch/x86/include/asm/desc.h 2011-03-27 14:31:47.000000000 -0400
8580 +++ linux-2.6.32.46/arch/x86/include/asm/desc.h 2011-04-23 12:56:10.000000000 -0400
8581 @@ -4,6 +4,7 @@
8582 #include <asm/desc_defs.h>
8583 #include <asm/ldt.h>
8584 #include <asm/mmu.h>
8585 +#include <asm/pgtable.h>
8586 #include <linux/smp.h>
8587
8588 static inline void fill_ldt(struct desc_struct *desc,
8589 @@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
8590 desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
8591 desc->type = (info->read_exec_only ^ 1) << 1;
8592 desc->type |= info->contents << 2;
8593 + desc->type |= info->seg_not_present ^ 1;
8594 desc->s = 1;
8595 desc->dpl = 0x3;
8596 desc->p = info->seg_not_present ^ 1;
8597 @@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
8598 }
8599
8600 extern struct desc_ptr idt_descr;
8601 -extern gate_desc idt_table[];
8602 -
8603 -struct gdt_page {
8604 - struct desc_struct gdt[GDT_ENTRIES];
8605 -} __attribute__((aligned(PAGE_SIZE)));
8606 -DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
8607 +extern gate_desc idt_table[256];
8608
8609 +extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
8610 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
8611 {
8612 - return per_cpu(gdt_page, cpu).gdt;
8613 + return cpu_gdt_table[cpu];
8614 }
8615
8616 #ifdef CONFIG_X86_64
8617 @@ -65,9 +63,14 @@ static inline void pack_gate(gate_desc *
8618 unsigned long base, unsigned dpl, unsigned flags,
8619 unsigned short seg)
8620 {
8621 - gate->a = (seg << 16) | (base & 0xffff);
8622 - gate->b = (base & 0xffff0000) |
8623 - (((0x80 | type | (dpl << 5)) & 0xff) << 8);
8624 + gate->gate.offset_low = base;
8625 + gate->gate.seg = seg;
8626 + gate->gate.reserved = 0;
8627 + gate->gate.type = type;
8628 + gate->gate.s = 0;
8629 + gate->gate.dpl = dpl;
8630 + gate->gate.p = 1;
8631 + gate->gate.offset_high = base >> 16;
8632 }
8633
8634 #endif
8635 @@ -115,13 +118,17 @@ static inline void paravirt_free_ldt(str
8636 static inline void native_write_idt_entry(gate_desc *idt, int entry,
8637 const gate_desc *gate)
8638 {
8639 + pax_open_kernel();
8640 memcpy(&idt[entry], gate, sizeof(*gate));
8641 + pax_close_kernel();
8642 }
8643
8644 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
8645 const void *desc)
8646 {
8647 + pax_open_kernel();
8648 memcpy(&ldt[entry], desc, 8);
8649 + pax_close_kernel();
8650 }
8651
8652 static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
8653 @@ -139,7 +146,10 @@ static inline void native_write_gdt_entr
8654 size = sizeof(struct desc_struct);
8655 break;
8656 }
8657 +
8658 + pax_open_kernel();
8659 memcpy(&gdt[entry], desc, size);
8660 + pax_close_kernel();
8661 }
8662
8663 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
8664 @@ -211,7 +221,9 @@ static inline void native_set_ldt(const
8665
8666 static inline void native_load_tr_desc(void)
8667 {
8668 + pax_open_kernel();
8669 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
8670 + pax_close_kernel();
8671 }
8672
8673 static inline void native_load_gdt(const struct desc_ptr *dtr)
8674 @@ -246,8 +258,10 @@ static inline void native_load_tls(struc
8675 unsigned int i;
8676 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
8677
8678 + pax_open_kernel();
8679 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
8680 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
8681 + pax_close_kernel();
8682 }
8683
8684 #define _LDT_empty(info) \
8685 @@ -309,7 +323,7 @@ static inline void set_desc_limit(struct
8686 desc->limit = (limit >> 16) & 0xf;
8687 }
8688
8689 -static inline void _set_gate(int gate, unsigned type, void *addr,
8690 +static inline void _set_gate(int gate, unsigned type, const void *addr,
8691 unsigned dpl, unsigned ist, unsigned seg)
8692 {
8693 gate_desc s;
8694 @@ -327,7 +341,7 @@ static inline void _set_gate(int gate, u
8695 * Pentium F0 0F bugfix can have resulted in the mapped
8696 * IDT being write-protected.
8697 */
8698 -static inline void set_intr_gate(unsigned int n, void *addr)
8699 +static inline void set_intr_gate(unsigned int n, const void *addr)
8700 {
8701 BUG_ON((unsigned)n > 0xFF);
8702 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
8703 @@ -356,19 +370,19 @@ static inline void alloc_intr_gate(unsig
8704 /*
8705 * This routine sets up an interrupt gate at directory privilege level 3.
8706 */
8707 -static inline void set_system_intr_gate(unsigned int n, void *addr)
8708 +static inline void set_system_intr_gate(unsigned int n, const void *addr)
8709 {
8710 BUG_ON((unsigned)n > 0xFF);
8711 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
8712 }
8713
8714 -static inline void set_system_trap_gate(unsigned int n, void *addr)
8715 +static inline void set_system_trap_gate(unsigned int n, const void *addr)
8716 {
8717 BUG_ON((unsigned)n > 0xFF);
8718 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
8719 }
8720
8721 -static inline void set_trap_gate(unsigned int n, void *addr)
8722 +static inline void set_trap_gate(unsigned int n, const void *addr)
8723 {
8724 BUG_ON((unsigned)n > 0xFF);
8725 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
8726 @@ -377,19 +391,31 @@ static inline void set_trap_gate(unsigne
8727 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
8728 {
8729 BUG_ON((unsigned)n > 0xFF);
8730 - _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
8731 + _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
8732 }
8733
8734 -static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
8735 +static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
8736 {
8737 BUG_ON((unsigned)n > 0xFF);
8738 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
8739 }
8740
8741 -static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
8742 +static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
8743 {
8744 BUG_ON((unsigned)n > 0xFF);
8745 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
8746 }
8747
8748 +#ifdef CONFIG_X86_32
8749 +static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
8750 +{
8751 + struct desc_struct d;
8752 +
8753 + if (likely(limit))
8754 + limit = (limit - 1UL) >> PAGE_SHIFT;
8755 + pack_descriptor(&d, base, limit, 0xFB, 0xC);
8756 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
8757 +}
8758 +#endif
8759 +
8760 #endif /* _ASM_X86_DESC_H */
8761 diff -urNp linux-2.6.32.46/arch/x86/include/asm/device.h linux-2.6.32.46/arch/x86/include/asm/device.h
8762 --- linux-2.6.32.46/arch/x86/include/asm/device.h 2011-03-27 14:31:47.000000000 -0400
8763 +++ linux-2.6.32.46/arch/x86/include/asm/device.h 2011-04-17 15:56:46.000000000 -0400
8764 @@ -6,7 +6,7 @@ struct dev_archdata {
8765 void *acpi_handle;
8766 #endif
8767 #ifdef CONFIG_X86_64
8768 -struct dma_map_ops *dma_ops;
8769 + const struct dma_map_ops *dma_ops;
8770 #endif
8771 #ifdef CONFIG_DMAR
8772 void *iommu; /* hook for IOMMU specific extension */
8773 diff -urNp linux-2.6.32.46/arch/x86/include/asm/dma-mapping.h linux-2.6.32.46/arch/x86/include/asm/dma-mapping.h
8774 --- linux-2.6.32.46/arch/x86/include/asm/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
8775 +++ linux-2.6.32.46/arch/x86/include/asm/dma-mapping.h 2011-04-17 15:56:46.000000000 -0400
8776 @@ -25,9 +25,9 @@ extern int iommu_merge;
8777 extern struct device x86_dma_fallback_dev;
8778 extern int panic_on_overflow;
8779
8780 -extern struct dma_map_ops *dma_ops;
8781 +extern const struct dma_map_ops *dma_ops;
8782
8783 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
8784 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
8785 {
8786 #ifdef CONFIG_X86_32
8787 return dma_ops;
8788 @@ -44,7 +44,7 @@ static inline struct dma_map_ops *get_dm
8789 /* Make sure we keep the same behaviour */
8790 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
8791 {
8792 - struct dma_map_ops *ops = get_dma_ops(dev);
8793 + const struct dma_map_ops *ops = get_dma_ops(dev);
8794 if (ops->mapping_error)
8795 return ops->mapping_error(dev, dma_addr);
8796
8797 @@ -122,7 +122,7 @@ static inline void *
8798 dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
8799 gfp_t gfp)
8800 {
8801 - struct dma_map_ops *ops = get_dma_ops(dev);
8802 + const struct dma_map_ops *ops = get_dma_ops(dev);
8803 void *memory;
8804
8805 gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
8806 @@ -149,7 +149,7 @@ dma_alloc_coherent(struct device *dev, s
8807 static inline void dma_free_coherent(struct device *dev, size_t size,
8808 void *vaddr, dma_addr_t bus)
8809 {
8810 - struct dma_map_ops *ops = get_dma_ops(dev);
8811 + const struct dma_map_ops *ops = get_dma_ops(dev);
8812
8813 WARN_ON(irqs_disabled()); /* for portability */
8814
8815 diff -urNp linux-2.6.32.46/arch/x86/include/asm/e820.h linux-2.6.32.46/arch/x86/include/asm/e820.h
8816 --- linux-2.6.32.46/arch/x86/include/asm/e820.h 2011-03-27 14:31:47.000000000 -0400
8817 +++ linux-2.6.32.46/arch/x86/include/asm/e820.h 2011-04-17 15:56:46.000000000 -0400
8818 @@ -133,7 +133,7 @@ extern char *default_machine_specific_me
8819 #define ISA_END_ADDRESS 0x100000
8820 #define is_ISA_range(s, e) ((s) >= ISA_START_ADDRESS && (e) < ISA_END_ADDRESS)
8821
8822 -#define BIOS_BEGIN 0x000a0000
8823 +#define BIOS_BEGIN 0x000c0000
8824 #define BIOS_END 0x00100000
8825
8826 #ifdef __KERNEL__
8827 diff -urNp linux-2.6.32.46/arch/x86/include/asm/elf.h linux-2.6.32.46/arch/x86/include/asm/elf.h
8828 --- linux-2.6.32.46/arch/x86/include/asm/elf.h 2011-03-27 14:31:47.000000000 -0400
8829 +++ linux-2.6.32.46/arch/x86/include/asm/elf.h 2011-08-23 20:24:19.000000000 -0400
8830 @@ -257,7 +257,25 @@ extern int force_personality32;
8831 the loader. We need to make sure that it is out of the way of the program
8832 that it will "exec", and that there is sufficient room for the brk. */
8833
8834 +#ifdef CONFIG_PAX_SEGMEXEC
8835 +#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
8836 +#else
8837 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
8838 +#endif
8839 +
8840 +#ifdef CONFIG_PAX_ASLR
8841 +#ifdef CONFIG_X86_32
8842 +#define PAX_ELF_ET_DYN_BASE 0x10000000UL
8843 +
8844 +#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
8845 +#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
8846 +#else
8847 +#define PAX_ELF_ET_DYN_BASE 0x400000UL
8848 +
8849 +#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
8850 +#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
8851 +#endif
8852 +#endif
8853
8854 /* This yields a mask that user programs can use to figure out what
8855 instruction set this CPU supports. This could be done in user space,
8856 @@ -310,9 +328,7 @@ do { \
8857
8858 #define ARCH_DLINFO \
8859 do { \
8860 - if (vdso_enabled) \
8861 - NEW_AUX_ENT(AT_SYSINFO_EHDR, \
8862 - (unsigned long)current->mm->context.vdso); \
8863 + NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
8864 } while (0)
8865
8866 #define AT_SYSINFO 32
8867 @@ -323,7 +339,7 @@ do { \
8868
8869 #endif /* !CONFIG_X86_32 */
8870
8871 -#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
8872 +#define VDSO_CURRENT_BASE (current->mm->context.vdso)
8873
8874 #define VDSO_ENTRY \
8875 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
8876 @@ -337,7 +353,4 @@ extern int arch_setup_additional_pages(s
8877 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
8878 #define compat_arch_setup_additional_pages syscall32_setup_pages
8879
8880 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
8881 -#define arch_randomize_brk arch_randomize_brk
8882 -
8883 #endif /* _ASM_X86_ELF_H */
8884 diff -urNp linux-2.6.32.46/arch/x86/include/asm/emergency-restart.h linux-2.6.32.46/arch/x86/include/asm/emergency-restart.h
8885 --- linux-2.6.32.46/arch/x86/include/asm/emergency-restart.h 2011-03-27 14:31:47.000000000 -0400
8886 +++ linux-2.6.32.46/arch/x86/include/asm/emergency-restart.h 2011-05-22 23:02:06.000000000 -0400
8887 @@ -15,6 +15,6 @@ enum reboot_type {
8888
8889 extern enum reboot_type reboot_type;
8890
8891 -extern void machine_emergency_restart(void);
8892 +extern void machine_emergency_restart(void) __noreturn;
8893
8894 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
8895 diff -urNp linux-2.6.32.46/arch/x86/include/asm/futex.h linux-2.6.32.46/arch/x86/include/asm/futex.h
8896 --- linux-2.6.32.46/arch/x86/include/asm/futex.h 2011-03-27 14:31:47.000000000 -0400
8897 +++ linux-2.6.32.46/arch/x86/include/asm/futex.h 2011-10-06 09:37:08.000000000 -0400
8898 @@ -12,16 +12,18 @@
8899 #include <asm/system.h>
8900
8901 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
8902 + typecheck(u32 __user *, uaddr); \
8903 asm volatile("1:\t" insn "\n" \
8904 "2:\t.section .fixup,\"ax\"\n" \
8905 "3:\tmov\t%3, %1\n" \
8906 "\tjmp\t2b\n" \
8907 "\t.previous\n" \
8908 _ASM_EXTABLE(1b, 3b) \
8909 - : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
8910 + : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr))\
8911 : "i" (-EFAULT), "0" (oparg), "1" (0))
8912
8913 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
8914 + typecheck(u32 __user *, uaddr); \
8915 asm volatile("1:\tmovl %2, %0\n" \
8916 "\tmovl\t%0, %3\n" \
8917 "\t" insn "\n" \
8918 @@ -34,10 +36,10 @@
8919 _ASM_EXTABLE(1b, 4b) \
8920 _ASM_EXTABLE(2b, 4b) \
8921 : "=&a" (oldval), "=&r" (ret), \
8922 - "+m" (*uaddr), "=&r" (tem) \
8923 + "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \
8924 : "r" (oparg), "i" (-EFAULT), "1" (0))
8925
8926 -static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
8927 +static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
8928 {
8929 int op = (encoded_op >> 28) & 7;
8930 int cmp = (encoded_op >> 24) & 15;
8931 @@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser
8932
8933 switch (op) {
8934 case FUTEX_OP_SET:
8935 - __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
8936 + __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
8937 break;
8938 case FUTEX_OP_ADD:
8939 - __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
8940 + __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
8941 uaddr, oparg);
8942 break;
8943 case FUTEX_OP_OR:
8944 @@ -109,7 +111,7 @@ static inline int futex_atomic_op_inuser
8945 return ret;
8946 }
8947
8948 -static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
8949 +static inline int futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval,
8950 int newval)
8951 {
8952
8953 @@ -119,16 +121,16 @@ static inline int futex_atomic_cmpxchg_i
8954 return -ENOSYS;
8955 #endif
8956
8957 - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
8958 + if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
8959 return -EFAULT;
8960
8961 - asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
8962 + asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %3, %1\n"
8963 "2:\t.section .fixup, \"ax\"\n"
8964 "3:\tmov %2, %0\n"
8965 "\tjmp 2b\n"
8966 "\t.previous\n"
8967 _ASM_EXTABLE(1b, 3b)
8968 - : "=a" (oldval), "+m" (*uaddr)
8969 + : "=a" (oldval), "+m" (*(u32 *)____m(uaddr))
8970 : "i" (-EFAULT), "r" (newval), "0" (oldval)
8971 : "memory"
8972 );
8973 diff -urNp linux-2.6.32.46/arch/x86/include/asm/hw_irq.h linux-2.6.32.46/arch/x86/include/asm/hw_irq.h
8974 --- linux-2.6.32.46/arch/x86/include/asm/hw_irq.h 2011-03-27 14:31:47.000000000 -0400
8975 +++ linux-2.6.32.46/arch/x86/include/asm/hw_irq.h 2011-05-04 17:56:28.000000000 -0400
8976 @@ -92,8 +92,8 @@ extern void setup_ioapic_dest(void);
8977 extern void enable_IO_APIC(void);
8978
8979 /* Statistics */
8980 -extern atomic_t irq_err_count;
8981 -extern atomic_t irq_mis_count;
8982 +extern atomic_unchecked_t irq_err_count;
8983 +extern atomic_unchecked_t irq_mis_count;
8984
8985 /* EISA */
8986 extern void eisa_set_level_irq(unsigned int irq);
8987 diff -urNp linux-2.6.32.46/arch/x86/include/asm/i387.h linux-2.6.32.46/arch/x86/include/asm/i387.h
8988 --- linux-2.6.32.46/arch/x86/include/asm/i387.h 2011-03-27 14:31:47.000000000 -0400
8989 +++ linux-2.6.32.46/arch/x86/include/asm/i387.h 2011-04-17 15:56:46.000000000 -0400
8990 @@ -60,6 +60,11 @@ static inline int fxrstor_checking(struc
8991 {
8992 int err;
8993
8994 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8995 + if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
8996 + fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
8997 +#endif
8998 +
8999 asm volatile("1: rex64/fxrstor (%[fx])\n\t"
9000 "2:\n"
9001 ".section .fixup,\"ax\"\n"
9002 @@ -105,6 +110,11 @@ static inline int fxsave_user(struct i38
9003 {
9004 int err;
9005
9006 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9007 + if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
9008 + fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
9009 +#endif
9010 +
9011 asm volatile("1: rex64/fxsave (%[fx])\n\t"
9012 "2:\n"
9013 ".section .fixup,\"ax\"\n"
9014 @@ -195,13 +205,8 @@ static inline int fxrstor_checking(struc
9015 }
9016
9017 /* We need a safe address that is cheap to find and that is already
9018 - in L1 during context switch. The best choices are unfortunately
9019 - different for UP and SMP */
9020 -#ifdef CONFIG_SMP
9021 -#define safe_address (__per_cpu_offset[0])
9022 -#else
9023 -#define safe_address (kstat_cpu(0).cpustat.user)
9024 -#endif
9025 + in L1 during context switch. */
9026 +#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
9027
9028 /*
9029 * These must be called with preempt disabled
9030 @@ -291,7 +296,7 @@ static inline void kernel_fpu_begin(void
9031 struct thread_info *me = current_thread_info();
9032 preempt_disable();
9033 if (me->status & TS_USEDFPU)
9034 - __save_init_fpu(me->task);
9035 + __save_init_fpu(current);
9036 else
9037 clts();
9038 }
9039 diff -urNp linux-2.6.32.46/arch/x86/include/asm/io_32.h linux-2.6.32.46/arch/x86/include/asm/io_32.h
9040 --- linux-2.6.32.46/arch/x86/include/asm/io_32.h 2011-03-27 14:31:47.000000000 -0400
9041 +++ linux-2.6.32.46/arch/x86/include/asm/io_32.h 2011-04-17 15:56:46.000000000 -0400
9042 @@ -3,6 +3,7 @@
9043
9044 #include <linux/string.h>
9045 #include <linux/compiler.h>
9046 +#include <asm/processor.h>
9047
9048 /*
9049 * This file contains the definitions for the x86 IO instructions
9050 @@ -42,6 +43,17 @@
9051
9052 #ifdef __KERNEL__
9053
9054 +#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
9055 +static inline int valid_phys_addr_range(unsigned long addr, size_t count)
9056 +{
9057 + return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9058 +}
9059 +
9060 +static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
9061 +{
9062 + return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9063 +}
9064 +
9065 #include <asm-generic/iomap.h>
9066
9067 #include <linux/vmalloc.h>
9068 diff -urNp linux-2.6.32.46/arch/x86/include/asm/io_64.h linux-2.6.32.46/arch/x86/include/asm/io_64.h
9069 --- linux-2.6.32.46/arch/x86/include/asm/io_64.h 2011-03-27 14:31:47.000000000 -0400
9070 +++ linux-2.6.32.46/arch/x86/include/asm/io_64.h 2011-04-17 15:56:46.000000000 -0400
9071 @@ -140,6 +140,17 @@ __OUTS(l)
9072
9073 #include <linux/vmalloc.h>
9074
9075 +#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
9076 +static inline int valid_phys_addr_range(unsigned long addr, size_t count)
9077 +{
9078 + return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9079 +}
9080 +
9081 +static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
9082 +{
9083 + return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9084 +}
9085 +
9086 #include <asm-generic/iomap.h>
9087
9088 void __memcpy_fromio(void *, unsigned long, unsigned);
9089 diff -urNp linux-2.6.32.46/arch/x86/include/asm/iommu.h linux-2.6.32.46/arch/x86/include/asm/iommu.h
9090 --- linux-2.6.32.46/arch/x86/include/asm/iommu.h 2011-03-27 14:31:47.000000000 -0400
9091 +++ linux-2.6.32.46/arch/x86/include/asm/iommu.h 2011-04-17 15:56:46.000000000 -0400
9092 @@ -3,7 +3,7 @@
9093
9094 extern void pci_iommu_shutdown(void);
9095 extern void no_iommu_init(void);
9096 -extern struct dma_map_ops nommu_dma_ops;
9097 +extern const struct dma_map_ops nommu_dma_ops;
9098 extern int force_iommu, no_iommu;
9099 extern int iommu_detected;
9100 extern int iommu_pass_through;
9101 diff -urNp linux-2.6.32.46/arch/x86/include/asm/irqflags.h linux-2.6.32.46/arch/x86/include/asm/irqflags.h
9102 --- linux-2.6.32.46/arch/x86/include/asm/irqflags.h 2011-03-27 14:31:47.000000000 -0400
9103 +++ linux-2.6.32.46/arch/x86/include/asm/irqflags.h 2011-04-17 15:56:46.000000000 -0400
9104 @@ -142,6 +142,11 @@ static inline unsigned long __raw_local_
9105 sti; \
9106 sysexit
9107
9108 +#define GET_CR0_INTO_RDI mov %cr0, %rdi
9109 +#define SET_RDI_INTO_CR0 mov %rdi, %cr0
9110 +#define GET_CR3_INTO_RDI mov %cr3, %rdi
9111 +#define SET_RDI_INTO_CR3 mov %rdi, %cr3
9112 +
9113 #else
9114 #define INTERRUPT_RETURN iret
9115 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
9116 diff -urNp linux-2.6.32.46/arch/x86/include/asm/kprobes.h linux-2.6.32.46/arch/x86/include/asm/kprobes.h
9117 --- linux-2.6.32.46/arch/x86/include/asm/kprobes.h 2011-03-27 14:31:47.000000000 -0400
9118 +++ linux-2.6.32.46/arch/x86/include/asm/kprobes.h 2011-04-23 12:56:12.000000000 -0400
9119 @@ -34,13 +34,8 @@ typedef u8 kprobe_opcode_t;
9120 #define BREAKPOINT_INSTRUCTION 0xcc
9121 #define RELATIVEJUMP_INSTRUCTION 0xe9
9122 #define MAX_INSN_SIZE 16
9123 -#define MAX_STACK_SIZE 64
9124 -#define MIN_STACK_SIZE(ADDR) \
9125 - (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
9126 - THREAD_SIZE - (unsigned long)(ADDR))) \
9127 - ? (MAX_STACK_SIZE) \
9128 - : (((unsigned long)current_thread_info()) + \
9129 - THREAD_SIZE - (unsigned long)(ADDR)))
9130 +#define MAX_STACK_SIZE 64UL
9131 +#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
9132
9133 #define flush_insn_slot(p) do { } while (0)
9134
9135 diff -urNp linux-2.6.32.46/arch/x86/include/asm/kvm_host.h linux-2.6.32.46/arch/x86/include/asm/kvm_host.h
9136 --- linux-2.6.32.46/arch/x86/include/asm/kvm_host.h 2011-05-10 22:12:01.000000000 -0400
9137 +++ linux-2.6.32.46/arch/x86/include/asm/kvm_host.h 2011-08-26 20:19:09.000000000 -0400
9138 @@ -534,9 +534,9 @@ struct kvm_x86_ops {
9139 bool (*gb_page_enable)(void);
9140
9141 const struct trace_print_flags *exit_reasons_str;
9142 -};
9143 +} __do_const;
9144
9145 -extern struct kvm_x86_ops *kvm_x86_ops;
9146 +extern const struct kvm_x86_ops *kvm_x86_ops;
9147
9148 int kvm_mmu_module_init(void);
9149 void kvm_mmu_module_exit(void);
9150 diff -urNp linux-2.6.32.46/arch/x86/include/asm/local.h linux-2.6.32.46/arch/x86/include/asm/local.h
9151 --- linux-2.6.32.46/arch/x86/include/asm/local.h 2011-03-27 14:31:47.000000000 -0400
9152 +++ linux-2.6.32.46/arch/x86/include/asm/local.h 2011-04-17 15:56:46.000000000 -0400
9153 @@ -18,26 +18,58 @@ typedef struct {
9154
9155 static inline void local_inc(local_t *l)
9156 {
9157 - asm volatile(_ASM_INC "%0"
9158 + asm volatile(_ASM_INC "%0\n"
9159 +
9160 +#ifdef CONFIG_PAX_REFCOUNT
9161 + "jno 0f\n"
9162 + _ASM_DEC "%0\n"
9163 + "int $4\n0:\n"
9164 + _ASM_EXTABLE(0b, 0b)
9165 +#endif
9166 +
9167 : "+m" (l->a.counter));
9168 }
9169
9170 static inline void local_dec(local_t *l)
9171 {
9172 - asm volatile(_ASM_DEC "%0"
9173 + asm volatile(_ASM_DEC "%0\n"
9174 +
9175 +#ifdef CONFIG_PAX_REFCOUNT
9176 + "jno 0f\n"
9177 + _ASM_INC "%0\n"
9178 + "int $4\n0:\n"
9179 + _ASM_EXTABLE(0b, 0b)
9180 +#endif
9181 +
9182 : "+m" (l->a.counter));
9183 }
9184
9185 static inline void local_add(long i, local_t *l)
9186 {
9187 - asm volatile(_ASM_ADD "%1,%0"
9188 + asm volatile(_ASM_ADD "%1,%0\n"
9189 +
9190 +#ifdef CONFIG_PAX_REFCOUNT
9191 + "jno 0f\n"
9192 + _ASM_SUB "%1,%0\n"
9193 + "int $4\n0:\n"
9194 + _ASM_EXTABLE(0b, 0b)
9195 +#endif
9196 +
9197 : "+m" (l->a.counter)
9198 : "ir" (i));
9199 }
9200
9201 static inline void local_sub(long i, local_t *l)
9202 {
9203 - asm volatile(_ASM_SUB "%1,%0"
9204 + asm volatile(_ASM_SUB "%1,%0\n"
9205 +
9206 +#ifdef CONFIG_PAX_REFCOUNT
9207 + "jno 0f\n"
9208 + _ASM_ADD "%1,%0\n"
9209 + "int $4\n0:\n"
9210 + _ASM_EXTABLE(0b, 0b)
9211 +#endif
9212 +
9213 : "+m" (l->a.counter)
9214 : "ir" (i));
9215 }
9216 @@ -55,7 +87,16 @@ static inline int local_sub_and_test(lon
9217 {
9218 unsigned char c;
9219
9220 - asm volatile(_ASM_SUB "%2,%0; sete %1"
9221 + asm volatile(_ASM_SUB "%2,%0\n"
9222 +
9223 +#ifdef CONFIG_PAX_REFCOUNT
9224 + "jno 0f\n"
9225 + _ASM_ADD "%2,%0\n"
9226 + "int $4\n0:\n"
9227 + _ASM_EXTABLE(0b, 0b)
9228 +#endif
9229 +
9230 + "sete %1\n"
9231 : "+m" (l->a.counter), "=qm" (c)
9232 : "ir" (i) : "memory");
9233 return c;
9234 @@ -73,7 +114,16 @@ static inline int local_dec_and_test(loc
9235 {
9236 unsigned char c;
9237
9238 - asm volatile(_ASM_DEC "%0; sete %1"
9239 + asm volatile(_ASM_DEC "%0\n"
9240 +
9241 +#ifdef CONFIG_PAX_REFCOUNT
9242 + "jno 0f\n"
9243 + _ASM_INC "%0\n"
9244 + "int $4\n0:\n"
9245 + _ASM_EXTABLE(0b, 0b)
9246 +#endif
9247 +
9248 + "sete %1\n"
9249 : "+m" (l->a.counter), "=qm" (c)
9250 : : "memory");
9251 return c != 0;
9252 @@ -91,7 +141,16 @@ static inline int local_inc_and_test(loc
9253 {
9254 unsigned char c;
9255
9256 - asm volatile(_ASM_INC "%0; sete %1"
9257 + asm volatile(_ASM_INC "%0\n"
9258 +
9259 +#ifdef CONFIG_PAX_REFCOUNT
9260 + "jno 0f\n"
9261 + _ASM_DEC "%0\n"
9262 + "int $4\n0:\n"
9263 + _ASM_EXTABLE(0b, 0b)
9264 +#endif
9265 +
9266 + "sete %1\n"
9267 : "+m" (l->a.counter), "=qm" (c)
9268 : : "memory");
9269 return c != 0;
9270 @@ -110,7 +169,16 @@ static inline int local_add_negative(lon
9271 {
9272 unsigned char c;
9273
9274 - asm volatile(_ASM_ADD "%2,%0; sets %1"
9275 + asm volatile(_ASM_ADD "%2,%0\n"
9276 +
9277 +#ifdef CONFIG_PAX_REFCOUNT
9278 + "jno 0f\n"
9279 + _ASM_SUB "%2,%0\n"
9280 + "int $4\n0:\n"
9281 + _ASM_EXTABLE(0b, 0b)
9282 +#endif
9283 +
9284 + "sets %1\n"
9285 : "+m" (l->a.counter), "=qm" (c)
9286 : "ir" (i) : "memory");
9287 return c;
9288 @@ -133,7 +201,15 @@ static inline long local_add_return(long
9289 #endif
9290 /* Modern 486+ processor */
9291 __i = i;
9292 - asm volatile(_ASM_XADD "%0, %1;"
9293 + asm volatile(_ASM_XADD "%0, %1\n"
9294 +
9295 +#ifdef CONFIG_PAX_REFCOUNT
9296 + "jno 0f\n"
9297 + _ASM_MOV "%0,%1\n"
9298 + "int $4\n0:\n"
9299 + _ASM_EXTABLE(0b, 0b)
9300 +#endif
9301 +
9302 : "+r" (i), "+m" (l->a.counter)
9303 : : "memory");
9304 return i + __i;
9305 diff -urNp linux-2.6.32.46/arch/x86/include/asm/microcode.h linux-2.6.32.46/arch/x86/include/asm/microcode.h
9306 --- linux-2.6.32.46/arch/x86/include/asm/microcode.h 2011-03-27 14:31:47.000000000 -0400
9307 +++ linux-2.6.32.46/arch/x86/include/asm/microcode.h 2011-04-17 15:56:46.000000000 -0400
9308 @@ -12,13 +12,13 @@ struct device;
9309 enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
9310
9311 struct microcode_ops {
9312 - enum ucode_state (*request_microcode_user) (int cpu,
9313 + enum ucode_state (* const request_microcode_user) (int cpu,
9314 const void __user *buf, size_t size);
9315
9316 - enum ucode_state (*request_microcode_fw) (int cpu,
9317 + enum ucode_state (* const request_microcode_fw) (int cpu,
9318 struct device *device);
9319
9320 - void (*microcode_fini_cpu) (int cpu);
9321 + void (* const microcode_fini_cpu) (int cpu);
9322
9323 /*
9324 * The generic 'microcode_core' part guarantees that
9325 @@ -38,18 +38,18 @@ struct ucode_cpu_info {
9326 extern struct ucode_cpu_info ucode_cpu_info[];
9327
9328 #ifdef CONFIG_MICROCODE_INTEL
9329 -extern struct microcode_ops * __init init_intel_microcode(void);
9330 +extern const struct microcode_ops * __init init_intel_microcode(void);
9331 #else
9332 -static inline struct microcode_ops * __init init_intel_microcode(void)
9333 +static inline const struct microcode_ops * __init init_intel_microcode(void)
9334 {
9335 return NULL;
9336 }
9337 #endif /* CONFIG_MICROCODE_INTEL */
9338
9339 #ifdef CONFIG_MICROCODE_AMD
9340 -extern struct microcode_ops * __init init_amd_microcode(void);
9341 +extern const struct microcode_ops * __init init_amd_microcode(void);
9342 #else
9343 -static inline struct microcode_ops * __init init_amd_microcode(void)
9344 +static inline const struct microcode_ops * __init init_amd_microcode(void)
9345 {
9346 return NULL;
9347 }
9348 diff -urNp linux-2.6.32.46/arch/x86/include/asm/mman.h linux-2.6.32.46/arch/x86/include/asm/mman.h
9349 --- linux-2.6.32.46/arch/x86/include/asm/mman.h 2011-03-27 14:31:47.000000000 -0400
9350 +++ linux-2.6.32.46/arch/x86/include/asm/mman.h 2011-04-17 15:56:46.000000000 -0400
9351 @@ -5,4 +5,14 @@
9352
9353 #include <asm-generic/mman.h>
9354
9355 +#ifdef __KERNEL__
9356 +#ifndef __ASSEMBLY__
9357 +#ifdef CONFIG_X86_32
9358 +#define arch_mmap_check i386_mmap_check
9359 +int i386_mmap_check(unsigned long addr, unsigned long len,
9360 + unsigned long flags);
9361 +#endif
9362 +#endif
9363 +#endif
9364 +
9365 #endif /* _ASM_X86_MMAN_H */
9366 diff -urNp linux-2.6.32.46/arch/x86/include/asm/mmu_context.h linux-2.6.32.46/arch/x86/include/asm/mmu_context.h
9367 --- linux-2.6.32.46/arch/x86/include/asm/mmu_context.h 2011-03-27 14:31:47.000000000 -0400
9368 +++ linux-2.6.32.46/arch/x86/include/asm/mmu_context.h 2011-08-23 20:24:19.000000000 -0400
9369 @@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *m
9370
9371 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
9372 {
9373 +
9374 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9375 + unsigned int i;
9376 + pgd_t *pgd;
9377 +
9378 + pax_open_kernel();
9379 + pgd = get_cpu_pgd(smp_processor_id());
9380 + for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
9381 + set_pgd_batched(pgd+i, native_make_pgd(0));
9382 + pax_close_kernel();
9383 +#endif
9384 +
9385 #ifdef CONFIG_SMP
9386 if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
9387 percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
9388 @@ -34,16 +46,30 @@ static inline void switch_mm(struct mm_s
9389 struct task_struct *tsk)
9390 {
9391 unsigned cpu = smp_processor_id();
9392 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)) && defined(CONFIG_SMP)
9393 + int tlbstate = TLBSTATE_OK;
9394 +#endif
9395
9396 if (likely(prev != next)) {
9397 #ifdef CONFIG_SMP
9398 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
9399 + tlbstate = percpu_read(cpu_tlbstate.state);
9400 +#endif
9401 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
9402 percpu_write(cpu_tlbstate.active_mm, next);
9403 #endif
9404 cpumask_set_cpu(cpu, mm_cpumask(next));
9405
9406 /* Re-load page tables */
9407 +#ifdef CONFIG_PAX_PER_CPU_PGD
9408 + pax_open_kernel();
9409 + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
9410 + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
9411 + pax_close_kernel();
9412 + load_cr3(get_cpu_pgd(cpu));
9413 +#else
9414 load_cr3(next->pgd);
9415 +#endif
9416
9417 /* stop flush ipis for the previous mm */
9418 cpumask_clear_cpu(cpu, mm_cpumask(prev));
9419 @@ -53,9 +79,38 @@ static inline void switch_mm(struct mm_s
9420 */
9421 if (unlikely(prev->context.ldt != next->context.ldt))
9422 load_LDT_nolock(&next->context);
9423 - }
9424 +
9425 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
9426 + if (!nx_enabled) {
9427 + smp_mb__before_clear_bit();
9428 + cpu_clear(cpu, prev->context.cpu_user_cs_mask);
9429 + smp_mb__after_clear_bit();
9430 + cpu_set(cpu, next->context.cpu_user_cs_mask);
9431 + }
9432 +#endif
9433 +
9434 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
9435 + if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
9436 + prev->context.user_cs_limit != next->context.user_cs_limit))
9437 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
9438 #ifdef CONFIG_SMP
9439 + else if (unlikely(tlbstate != TLBSTATE_OK))
9440 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
9441 +#endif
9442 +#endif
9443 +
9444 + }
9445 else {
9446 +
9447 +#ifdef CONFIG_PAX_PER_CPU_PGD
9448 + pax_open_kernel();
9449 + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
9450 + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
9451 + pax_close_kernel();
9452 + load_cr3(get_cpu_pgd(cpu));
9453 +#endif
9454 +
9455 +#ifdef CONFIG_SMP
9456 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
9457 BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
9458
9459 @@ -64,11 +119,28 @@ static inline void switch_mm(struct mm_s
9460 * tlb flush IPI delivery. We must reload CR3
9461 * to make sure to use no freed page tables.
9462 */
9463 +
9464 +#ifndef CONFIG_PAX_PER_CPU_PGD
9465 load_cr3(next->pgd);
9466 +#endif
9467 +
9468 load_LDT_nolock(&next->context);
9469 +
9470 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
9471 + if (!nx_enabled)
9472 + cpu_set(cpu, next->context.cpu_user_cs_mask);
9473 +#endif
9474 +
9475 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
9476 +#ifdef CONFIG_PAX_PAGEEXEC
9477 + if (!((next->pax_flags & MF_PAX_PAGEEXEC) && nx_enabled))
9478 +#endif
9479 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
9480 +#endif
9481 +
9482 }
9483 - }
9484 #endif
9485 + }
9486 }
9487
9488 #define activate_mm(prev, next) \
9489 diff -urNp linux-2.6.32.46/arch/x86/include/asm/mmu.h linux-2.6.32.46/arch/x86/include/asm/mmu.h
9490 --- linux-2.6.32.46/arch/x86/include/asm/mmu.h 2011-03-27 14:31:47.000000000 -0400
9491 +++ linux-2.6.32.46/arch/x86/include/asm/mmu.h 2011-04-17 15:56:46.000000000 -0400
9492 @@ -9,10 +9,23 @@
9493 * we put the segment information here.
9494 */
9495 typedef struct {
9496 - void *ldt;
9497 + struct desc_struct *ldt;
9498 int size;
9499 struct mutex lock;
9500 - void *vdso;
9501 + unsigned long vdso;
9502 +
9503 +#ifdef CONFIG_X86_32
9504 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
9505 + unsigned long user_cs_base;
9506 + unsigned long user_cs_limit;
9507 +
9508 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
9509 + cpumask_t cpu_user_cs_mask;
9510 +#endif
9511 +
9512 +#endif
9513 +#endif
9514 +
9515 } mm_context_t;
9516
9517 #ifdef CONFIG_SMP
9518 diff -urNp linux-2.6.32.46/arch/x86/include/asm/module.h linux-2.6.32.46/arch/x86/include/asm/module.h
9519 --- linux-2.6.32.46/arch/x86/include/asm/module.h 2011-03-27 14:31:47.000000000 -0400
9520 +++ linux-2.6.32.46/arch/x86/include/asm/module.h 2011-10-08 08:16:59.000000000 -0400
9521 @@ -5,6 +5,7 @@
9522
9523 #ifdef CONFIG_X86_64
9524 /* X86_64 does not define MODULE_PROC_FAMILY */
9525 +#define MODULE_PROC_FAMILY ""
9526 #elif defined CONFIG_M386
9527 #define MODULE_PROC_FAMILY "386 "
9528 #elif defined CONFIG_M486
9529 @@ -59,13 +60,24 @@
9530 #error unknown processor family
9531 #endif
9532
9533 -#ifdef CONFIG_X86_32
9534 -# ifdef CONFIG_4KSTACKS
9535 -# define MODULE_STACKSIZE "4KSTACKS "
9536 -# else
9537 -# define MODULE_STACKSIZE ""
9538 -# endif
9539 -# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE
9540 +#if defined(CONFIG_X86_32) && defined(CONFIG_4KSTACKS)
9541 +#define MODULE_STACKSIZE "4KSTACKS "
9542 +#else
9543 +#define MODULE_STACKSIZE ""
9544 +#endif
9545 +
9546 +#ifdef CONFIG_PAX_KERNEXEC
9547 +#define MODULE_PAX_KERNEXEC "KERNEXEC "
9548 +#else
9549 +#define MODULE_PAX_KERNEXEC ""
9550 #endif
9551
9552 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9553 +#define MODULE_PAX_UDEREF "UDEREF "
9554 +#else
9555 +#define MODULE_PAX_UDEREF ""
9556 +#endif
9557 +
9558 +#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
9559 +
9560 #endif /* _ASM_X86_MODULE_H */
9561 diff -urNp linux-2.6.32.46/arch/x86/include/asm/page_64_types.h linux-2.6.32.46/arch/x86/include/asm/page_64_types.h
9562 --- linux-2.6.32.46/arch/x86/include/asm/page_64_types.h 2011-03-27 14:31:47.000000000 -0400
9563 +++ linux-2.6.32.46/arch/x86/include/asm/page_64_types.h 2011-04-17 15:56:46.000000000 -0400
9564 @@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
9565
9566 /* duplicated to the one in bootmem.h */
9567 extern unsigned long max_pfn;
9568 -extern unsigned long phys_base;
9569 +extern const unsigned long phys_base;
9570
9571 extern unsigned long __phys_addr(unsigned long);
9572 #define __phys_reloc_hide(x) (x)
9573 diff -urNp linux-2.6.32.46/arch/x86/include/asm/paravirt.h linux-2.6.32.46/arch/x86/include/asm/paravirt.h
9574 --- linux-2.6.32.46/arch/x86/include/asm/paravirt.h 2011-03-27 14:31:47.000000000 -0400
9575 +++ linux-2.6.32.46/arch/x86/include/asm/paravirt.h 2011-08-23 21:36:48.000000000 -0400
9576 @@ -648,6 +648,18 @@ static inline void set_pgd(pgd_t *pgdp,
9577 val);
9578 }
9579
9580 +static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
9581 +{
9582 + pgdval_t val = native_pgd_val(pgd);
9583 +
9584 + if (sizeof(pgdval_t) > sizeof(long))
9585 + PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp,
9586 + val, (u64)val >> 32);
9587 + else
9588 + PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp,
9589 + val);
9590 +}
9591 +
9592 static inline void pgd_clear(pgd_t *pgdp)
9593 {
9594 set_pgd(pgdp, __pgd(0));
9595 @@ -729,6 +741,21 @@ static inline void __set_fixmap(unsigned
9596 pv_mmu_ops.set_fixmap(idx, phys, flags);
9597 }
9598
9599 +#ifdef CONFIG_PAX_KERNEXEC
9600 +static inline unsigned long pax_open_kernel(void)
9601 +{
9602 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
9603 +}
9604 +
9605 +static inline unsigned long pax_close_kernel(void)
9606 +{
9607 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
9608 +}
9609 +#else
9610 +static inline unsigned long pax_open_kernel(void) { return 0; }
9611 +static inline unsigned long pax_close_kernel(void) { return 0; }
9612 +#endif
9613 +
9614 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
9615
9616 static inline int __raw_spin_is_locked(struct raw_spinlock *lock)
9617 @@ -945,7 +972,7 @@ extern void default_banner(void);
9618
9619 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
9620 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
9621 -#define PARA_INDIRECT(addr) *%cs:addr
9622 +#define PARA_INDIRECT(addr) *%ss:addr
9623 #endif
9624
9625 #define INTERRUPT_RETURN \
9626 @@ -1022,6 +1049,21 @@ extern void default_banner(void);
9627 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
9628 CLBR_NONE, \
9629 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
9630 +
9631 +#define GET_CR0_INTO_RDI \
9632 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
9633 + mov %rax,%rdi
9634 +
9635 +#define SET_RDI_INTO_CR0 \
9636 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
9637 +
9638 +#define GET_CR3_INTO_RDI \
9639 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
9640 + mov %rax,%rdi
9641 +
9642 +#define SET_RDI_INTO_CR3 \
9643 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
9644 +
9645 #endif /* CONFIG_X86_32 */
9646
9647 #endif /* __ASSEMBLY__ */
9648 diff -urNp linux-2.6.32.46/arch/x86/include/asm/paravirt_types.h linux-2.6.32.46/arch/x86/include/asm/paravirt_types.h
9649 --- linux-2.6.32.46/arch/x86/include/asm/paravirt_types.h 2011-03-27 14:31:47.000000000 -0400
9650 +++ linux-2.6.32.46/arch/x86/include/asm/paravirt_types.h 2011-08-23 20:24:19.000000000 -0400
9651 @@ -78,19 +78,19 @@ struct pv_init_ops {
9652 */
9653 unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
9654 unsigned long addr, unsigned len);
9655 -};
9656 +} __no_const;
9657
9658
9659 struct pv_lazy_ops {
9660 /* Set deferred update mode, used for batching operations. */
9661 void (*enter)(void);
9662 void (*leave)(void);
9663 -};
9664 +} __no_const;
9665
9666 struct pv_time_ops {
9667 unsigned long long (*sched_clock)(void);
9668 unsigned long (*get_tsc_khz)(void);
9669 -};
9670 +} __no_const;
9671
9672 struct pv_cpu_ops {
9673 /* hooks for various privileged instructions */
9674 @@ -186,7 +186,7 @@ struct pv_cpu_ops {
9675
9676 void (*start_context_switch)(struct task_struct *prev);
9677 void (*end_context_switch)(struct task_struct *next);
9678 -};
9679 +} __no_const;
9680
9681 struct pv_irq_ops {
9682 /*
9683 @@ -217,7 +217,7 @@ struct pv_apic_ops {
9684 unsigned long start_eip,
9685 unsigned long start_esp);
9686 #endif
9687 -};
9688 +} __no_const;
9689
9690 struct pv_mmu_ops {
9691 unsigned long (*read_cr2)(void);
9692 @@ -301,6 +301,7 @@ struct pv_mmu_ops {
9693 struct paravirt_callee_save make_pud;
9694
9695 void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
9696 + void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval);
9697 #endif /* PAGETABLE_LEVELS == 4 */
9698 #endif /* PAGETABLE_LEVELS >= 3 */
9699
9700 @@ -316,6 +317,12 @@ struct pv_mmu_ops {
9701 an mfn. We can tell which is which from the index. */
9702 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
9703 phys_addr_t phys, pgprot_t flags);
9704 +
9705 +#ifdef CONFIG_PAX_KERNEXEC
9706 + unsigned long (*pax_open_kernel)(void);
9707 + unsigned long (*pax_close_kernel)(void);
9708 +#endif
9709 +
9710 };
9711
9712 struct raw_spinlock;
9713 @@ -326,7 +333,7 @@ struct pv_lock_ops {
9714 void (*spin_lock_flags)(struct raw_spinlock *lock, unsigned long flags);
9715 int (*spin_trylock)(struct raw_spinlock *lock);
9716 void (*spin_unlock)(struct raw_spinlock *lock);
9717 -};
9718 +} __no_const;
9719
9720 /* This contains all the paravirt structures: we get a convenient
9721 * number for each function using the offset which we use to indicate
9722 diff -urNp linux-2.6.32.46/arch/x86/include/asm/pci_x86.h linux-2.6.32.46/arch/x86/include/asm/pci_x86.h
9723 --- linux-2.6.32.46/arch/x86/include/asm/pci_x86.h 2011-03-27 14:31:47.000000000 -0400
9724 +++ linux-2.6.32.46/arch/x86/include/asm/pci_x86.h 2011-04-17 15:56:46.000000000 -0400
9725 @@ -89,16 +89,16 @@ extern int (*pcibios_enable_irq)(struct
9726 extern void (*pcibios_disable_irq)(struct pci_dev *dev);
9727
9728 struct pci_raw_ops {
9729 - int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
9730 + int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
9731 int reg, int len, u32 *val);
9732 - int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
9733 + int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
9734 int reg, int len, u32 val);
9735 };
9736
9737 -extern struct pci_raw_ops *raw_pci_ops;
9738 -extern struct pci_raw_ops *raw_pci_ext_ops;
9739 +extern const struct pci_raw_ops *raw_pci_ops;
9740 +extern const struct pci_raw_ops *raw_pci_ext_ops;
9741
9742 -extern struct pci_raw_ops pci_direct_conf1;
9743 +extern const struct pci_raw_ops pci_direct_conf1;
9744 extern bool port_cf9_safe;
9745
9746 /* arch_initcall level */
9747 diff -urNp linux-2.6.32.46/arch/x86/include/asm/percpu.h linux-2.6.32.46/arch/x86/include/asm/percpu.h
9748 --- linux-2.6.32.46/arch/x86/include/asm/percpu.h 2011-03-27 14:31:47.000000000 -0400
9749 +++ linux-2.6.32.46/arch/x86/include/asm/percpu.h 2011-08-17 19:33:59.000000000 -0400
9750 @@ -78,6 +78,7 @@ do { \
9751 if (0) { \
9752 T__ tmp__; \
9753 tmp__ = (val); \
9754 + (void)tmp__; \
9755 } \
9756 switch (sizeof(var)) { \
9757 case 1: \
9758 diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgalloc.h linux-2.6.32.46/arch/x86/include/asm/pgalloc.h
9759 --- linux-2.6.32.46/arch/x86/include/asm/pgalloc.h 2011-03-27 14:31:47.000000000 -0400
9760 +++ linux-2.6.32.46/arch/x86/include/asm/pgalloc.h 2011-04-17 15:56:46.000000000 -0400
9761 @@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
9762 pmd_t *pmd, pte_t *pte)
9763 {
9764 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
9765 + set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
9766 +}
9767 +
9768 +static inline void pmd_populate_user(struct mm_struct *mm,
9769 + pmd_t *pmd, pte_t *pte)
9770 +{
9771 + paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
9772 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
9773 }
9774
9775 diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable-2level.h linux-2.6.32.46/arch/x86/include/asm/pgtable-2level.h
9776 --- linux-2.6.32.46/arch/x86/include/asm/pgtable-2level.h 2011-03-27 14:31:47.000000000 -0400
9777 +++ linux-2.6.32.46/arch/x86/include/asm/pgtable-2level.h 2011-04-17 15:56:46.000000000 -0400
9778 @@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t
9779
9780 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9781 {
9782 + pax_open_kernel();
9783 *pmdp = pmd;
9784 + pax_close_kernel();
9785 }
9786
9787 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9788 diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable_32.h linux-2.6.32.46/arch/x86/include/asm/pgtable_32.h
9789 --- linux-2.6.32.46/arch/x86/include/asm/pgtable_32.h 2011-03-27 14:31:47.000000000 -0400
9790 +++ linux-2.6.32.46/arch/x86/include/asm/pgtable_32.h 2011-04-17 15:56:46.000000000 -0400
9791 @@ -26,9 +26,6 @@
9792 struct mm_struct;
9793 struct vm_area_struct;
9794
9795 -extern pgd_t swapper_pg_dir[1024];
9796 -extern pgd_t trampoline_pg_dir[1024];
9797 -
9798 static inline void pgtable_cache_init(void) { }
9799 static inline void check_pgt_cache(void) { }
9800 void paging_init(void);
9801 @@ -49,6 +46,12 @@ extern void set_pmd_pfn(unsigned long, u
9802 # include <asm/pgtable-2level.h>
9803 #endif
9804
9805 +extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
9806 +extern pgd_t trampoline_pg_dir[PTRS_PER_PGD];
9807 +#ifdef CONFIG_X86_PAE
9808 +extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
9809 +#endif
9810 +
9811 #if defined(CONFIG_HIGHPTE)
9812 #define __KM_PTE \
9813 (in_nmi() ? KM_NMI_PTE : \
9814 @@ -73,7 +76,9 @@ extern void set_pmd_pfn(unsigned long, u
9815 /* Clear a kernel PTE and flush it from the TLB */
9816 #define kpte_clear_flush(ptep, vaddr) \
9817 do { \
9818 + pax_open_kernel(); \
9819 pte_clear(&init_mm, (vaddr), (ptep)); \
9820 + pax_close_kernel(); \
9821 __flush_tlb_one((vaddr)); \
9822 } while (0)
9823
9824 @@ -85,6 +90,9 @@ do { \
9825
9826 #endif /* !__ASSEMBLY__ */
9827
9828 +#define HAVE_ARCH_UNMAPPED_AREA
9829 +#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
9830 +
9831 /*
9832 * kern_addr_valid() is (1) for FLATMEM and (0) for
9833 * SPARSEMEM and DISCONTIGMEM
9834 diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable_32_types.h linux-2.6.32.46/arch/x86/include/asm/pgtable_32_types.h
9835 --- linux-2.6.32.46/arch/x86/include/asm/pgtable_32_types.h 2011-03-27 14:31:47.000000000 -0400
9836 +++ linux-2.6.32.46/arch/x86/include/asm/pgtable_32_types.h 2011-04-17 15:56:46.000000000 -0400
9837 @@ -8,7 +8,7 @@
9838 */
9839 #ifdef CONFIG_X86_PAE
9840 # include <asm/pgtable-3level_types.h>
9841 -# define PMD_SIZE (1UL << PMD_SHIFT)
9842 +# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
9843 # define PMD_MASK (~(PMD_SIZE - 1))
9844 #else
9845 # include <asm/pgtable-2level_types.h>
9846 @@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set
9847 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
9848 #endif
9849
9850 +#ifdef CONFIG_PAX_KERNEXEC
9851 +#ifndef __ASSEMBLY__
9852 +extern unsigned char MODULES_EXEC_VADDR[];
9853 +extern unsigned char MODULES_EXEC_END[];
9854 +#endif
9855 +#include <asm/boot.h>
9856 +#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
9857 +#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
9858 +#else
9859 +#define ktla_ktva(addr) (addr)
9860 +#define ktva_ktla(addr) (addr)
9861 +#endif
9862 +
9863 #define MODULES_VADDR VMALLOC_START
9864 #define MODULES_END VMALLOC_END
9865 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
9866 diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable-3level.h linux-2.6.32.46/arch/x86/include/asm/pgtable-3level.h
9867 --- linux-2.6.32.46/arch/x86/include/asm/pgtable-3level.h 2011-03-27 14:31:47.000000000 -0400
9868 +++ linux-2.6.32.46/arch/x86/include/asm/pgtable-3level.h 2011-04-17 15:56:46.000000000 -0400
9869 @@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
9870
9871 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9872 {
9873 + pax_open_kernel();
9874 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
9875 + pax_close_kernel();
9876 }
9877
9878 static inline void native_set_pud(pud_t *pudp, pud_t pud)
9879 {
9880 + pax_open_kernel();
9881 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
9882 + pax_close_kernel();
9883 }
9884
9885 /*
9886 diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable_64.h linux-2.6.32.46/arch/x86/include/asm/pgtable_64.h
9887 --- linux-2.6.32.46/arch/x86/include/asm/pgtable_64.h 2011-03-27 14:31:47.000000000 -0400
9888 +++ linux-2.6.32.46/arch/x86/include/asm/pgtable_64.h 2011-08-23 20:24:19.000000000 -0400
9889 @@ -16,10 +16,13 @@
9890
9891 extern pud_t level3_kernel_pgt[512];
9892 extern pud_t level3_ident_pgt[512];
9893 +extern pud_t level3_vmalloc_pgt[512];
9894 +extern pud_t level3_vmemmap_pgt[512];
9895 +extern pud_t level2_vmemmap_pgt[512];
9896 extern pmd_t level2_kernel_pgt[512];
9897 extern pmd_t level2_fixmap_pgt[512];
9898 -extern pmd_t level2_ident_pgt[512];
9899 -extern pgd_t init_level4_pgt[];
9900 +extern pmd_t level2_ident_pgt[512*2];
9901 +extern pgd_t init_level4_pgt[512];
9902
9903 #define swapper_pg_dir init_level4_pgt
9904
9905 @@ -74,7 +77,9 @@ static inline pte_t native_ptep_get_and_
9906
9907 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9908 {
9909 + pax_open_kernel();
9910 *pmdp = pmd;
9911 + pax_close_kernel();
9912 }
9913
9914 static inline void native_pmd_clear(pmd_t *pmd)
9915 @@ -94,6 +99,13 @@ static inline void native_pud_clear(pud_
9916
9917 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
9918 {
9919 + pax_open_kernel();
9920 + *pgdp = pgd;
9921 + pax_close_kernel();
9922 +}
9923 +
9924 +static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
9925 +{
9926 *pgdp = pgd;
9927 }
9928
9929 diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable_64_types.h linux-2.6.32.46/arch/x86/include/asm/pgtable_64_types.h
9930 --- linux-2.6.32.46/arch/x86/include/asm/pgtable_64_types.h 2011-03-27 14:31:47.000000000 -0400
9931 +++ linux-2.6.32.46/arch/x86/include/asm/pgtable_64_types.h 2011-04-17 15:56:46.000000000 -0400
9932 @@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
9933 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
9934 #define MODULES_END _AC(0xffffffffff000000, UL)
9935 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
9936 +#define MODULES_EXEC_VADDR MODULES_VADDR
9937 +#define MODULES_EXEC_END MODULES_END
9938 +
9939 +#define ktla_ktva(addr) (addr)
9940 +#define ktva_ktla(addr) (addr)
9941
9942 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
9943 diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable.h linux-2.6.32.46/arch/x86/include/asm/pgtable.h
9944 --- linux-2.6.32.46/arch/x86/include/asm/pgtable.h 2011-03-27 14:31:47.000000000 -0400
9945 +++ linux-2.6.32.46/arch/x86/include/asm/pgtable.h 2011-08-23 20:24:19.000000000 -0400
9946 @@ -39,6 +39,7 @@ extern struct list_head pgd_list;
9947
9948 #ifndef __PAGETABLE_PUD_FOLDED
9949 #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
9950 +#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd)
9951 #define pgd_clear(pgd) native_pgd_clear(pgd)
9952 #endif
9953
9954 @@ -74,12 +75,51 @@ extern struct list_head pgd_list;
9955
9956 #define arch_end_context_switch(prev) do {} while(0)
9957
9958 +#define pax_open_kernel() native_pax_open_kernel()
9959 +#define pax_close_kernel() native_pax_close_kernel()
9960 #endif /* CONFIG_PARAVIRT */
9961
9962 +#define __HAVE_ARCH_PAX_OPEN_KERNEL
9963 +#define __HAVE_ARCH_PAX_CLOSE_KERNEL
9964 +
9965 +#ifdef CONFIG_PAX_KERNEXEC
9966 +static inline unsigned long native_pax_open_kernel(void)
9967 +{
9968 + unsigned long cr0;
9969 +
9970 + preempt_disable();
9971 + barrier();
9972 + cr0 = read_cr0() ^ X86_CR0_WP;
9973 + BUG_ON(unlikely(cr0 & X86_CR0_WP));
9974 + write_cr0(cr0);
9975 + return cr0 ^ X86_CR0_WP;
9976 +}
9977 +
9978 +static inline unsigned long native_pax_close_kernel(void)
9979 +{
9980 + unsigned long cr0;
9981 +
9982 + cr0 = read_cr0() ^ X86_CR0_WP;
9983 + BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
9984 + write_cr0(cr0);
9985 + barrier();
9986 + preempt_enable_no_resched();
9987 + return cr0 ^ X86_CR0_WP;
9988 +}
9989 +#else
9990 +static inline unsigned long native_pax_open_kernel(void) { return 0; }
9991 +static inline unsigned long native_pax_close_kernel(void) { return 0; }
9992 +#endif
9993 +
9994 /*
9995 * The following only work if pte_present() is true.
9996 * Undefined behaviour if not..
9997 */
9998 +static inline int pte_user(pte_t pte)
9999 +{
10000 + return pte_val(pte) & _PAGE_USER;
10001 +}
10002 +
10003 static inline int pte_dirty(pte_t pte)
10004 {
10005 return pte_flags(pte) & _PAGE_DIRTY;
10006 @@ -167,9 +207,29 @@ static inline pte_t pte_wrprotect(pte_t
10007 return pte_clear_flags(pte, _PAGE_RW);
10008 }
10009
10010 +static inline pte_t pte_mkread(pte_t pte)
10011 +{
10012 + return __pte(pte_val(pte) | _PAGE_USER);
10013 +}
10014 +
10015 static inline pte_t pte_mkexec(pte_t pte)
10016 {
10017 - return pte_clear_flags(pte, _PAGE_NX);
10018 +#ifdef CONFIG_X86_PAE
10019 + if (__supported_pte_mask & _PAGE_NX)
10020 + return pte_clear_flags(pte, _PAGE_NX);
10021 + else
10022 +#endif
10023 + return pte_set_flags(pte, _PAGE_USER);
10024 +}
10025 +
10026 +static inline pte_t pte_exprotect(pte_t pte)
10027 +{
10028 +#ifdef CONFIG_X86_PAE
10029 + if (__supported_pte_mask & _PAGE_NX)
10030 + return pte_set_flags(pte, _PAGE_NX);
10031 + else
10032 +#endif
10033 + return pte_clear_flags(pte, _PAGE_USER);
10034 }
10035
10036 static inline pte_t pte_mkdirty(pte_t pte)
10037 @@ -302,6 +362,15 @@ pte_t *populate_extra_pte(unsigned long
10038 #endif
10039
10040 #ifndef __ASSEMBLY__
10041 +
10042 +#ifdef CONFIG_PAX_PER_CPU_PGD
10043 +extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
10044 +static inline pgd_t *get_cpu_pgd(unsigned int cpu)
10045 +{
10046 + return cpu_pgd[cpu];
10047 +}
10048 +#endif
10049 +
10050 #include <linux/mm_types.h>
10051
10052 static inline int pte_none(pte_t pte)
10053 @@ -472,7 +541,7 @@ static inline pud_t *pud_offset(pgd_t *p
10054
10055 static inline int pgd_bad(pgd_t pgd)
10056 {
10057 - return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
10058 + return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
10059 }
10060
10061 static inline int pgd_none(pgd_t pgd)
10062 @@ -495,7 +564,12 @@ static inline int pgd_none(pgd_t pgd)
10063 * pgd_offset() returns a (pgd_t *)
10064 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
10065 */
10066 -#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
10067 +#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
10068 +
10069 +#ifdef CONFIG_PAX_PER_CPU_PGD
10070 +#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
10071 +#endif
10072 +
10073 /*
10074 * a shortcut which implies the use of the kernel's pgd, instead
10075 * of a process's
10076 @@ -506,6 +580,20 @@ static inline int pgd_none(pgd_t pgd)
10077 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
10078 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
10079
10080 +#ifdef CONFIG_X86_32
10081 +#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
10082 +#else
10083 +#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
10084 +#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
10085 +
10086 +#ifdef CONFIG_PAX_MEMORY_UDEREF
10087 +#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
10088 +#else
10089 +#define PAX_USER_SHADOW_BASE (_AC(0,UL))
10090 +#endif
10091 +
10092 +#endif
10093 +
10094 #ifndef __ASSEMBLY__
10095
10096 extern int direct_gbpages;
10097 @@ -611,11 +699,23 @@ static inline void ptep_set_wrprotect(st
10098 * dst and src can be on the same page, but the range must not overlap,
10099 * and must not cross a page boundary.
10100 */
10101 -static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
10102 +static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
10103 {
10104 - memcpy(dst, src, count * sizeof(pgd_t));
10105 + pax_open_kernel();
10106 + while (count--)
10107 + *dst++ = *src++;
10108 + pax_close_kernel();
10109 }
10110
10111 +#ifdef CONFIG_PAX_PER_CPU_PGD
10112 +extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
10113 +#endif
10114 +
10115 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10116 +extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
10117 +#else
10118 +static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
10119 +#endif
10120
10121 #include <asm-generic/pgtable.h>
10122 #endif /* __ASSEMBLY__ */
10123 diff -urNp linux-2.6.32.46/arch/x86/include/asm/pgtable_types.h linux-2.6.32.46/arch/x86/include/asm/pgtable_types.h
10124 --- linux-2.6.32.46/arch/x86/include/asm/pgtable_types.h 2011-03-27 14:31:47.000000000 -0400
10125 +++ linux-2.6.32.46/arch/x86/include/asm/pgtable_types.h 2011-04-17 15:56:46.000000000 -0400
10126 @@ -16,12 +16,11 @@
10127 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
10128 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
10129 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
10130 -#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
10131 +#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
10132 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
10133 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
10134 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
10135 -#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
10136 -#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
10137 +#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
10138 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
10139
10140 /* If _PAGE_BIT_PRESENT is clear, we use these: */
10141 @@ -39,7 +38,6 @@
10142 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
10143 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
10144 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
10145 -#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
10146 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
10147 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
10148 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
10149 @@ -55,8 +53,10 @@
10150
10151 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
10152 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
10153 -#else
10154 +#elif defined(CONFIG_KMEMCHECK)
10155 #define _PAGE_NX (_AT(pteval_t, 0))
10156 +#else
10157 +#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
10158 #endif
10159
10160 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
10161 @@ -93,6 +93,9 @@
10162 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
10163 _PAGE_ACCESSED)
10164
10165 +#define PAGE_READONLY_NOEXEC PAGE_READONLY
10166 +#define PAGE_SHARED_NOEXEC PAGE_SHARED
10167 +
10168 #define __PAGE_KERNEL_EXEC \
10169 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
10170 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
10171 @@ -103,8 +106,8 @@
10172 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
10173 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
10174 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
10175 -#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
10176 -#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
10177 +#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
10178 +#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
10179 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
10180 #define __PAGE_KERNEL_LARGE_NOCACHE (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
10181 #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE)
10182 @@ -163,8 +166,8 @@
10183 * bits are combined, this will alow user to access the high address mapped
10184 * VDSO in the presence of CONFIG_COMPAT_VDSO
10185 */
10186 -#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
10187 -#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
10188 +#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
10189 +#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
10190 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
10191 #endif
10192
10193 @@ -202,7 +205,17 @@ static inline pgdval_t pgd_flags(pgd_t p
10194 {
10195 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
10196 }
10197 +#endif
10198
10199 +#if PAGETABLE_LEVELS == 3
10200 +#include <asm-generic/pgtable-nopud.h>
10201 +#endif
10202 +
10203 +#if PAGETABLE_LEVELS == 2
10204 +#include <asm-generic/pgtable-nopmd.h>
10205 +#endif
10206 +
10207 +#ifndef __ASSEMBLY__
10208 #if PAGETABLE_LEVELS > 3
10209 typedef struct { pudval_t pud; } pud_t;
10210
10211 @@ -216,8 +229,6 @@ static inline pudval_t native_pud_val(pu
10212 return pud.pud;
10213 }
10214 #else
10215 -#include <asm-generic/pgtable-nopud.h>
10216 -
10217 static inline pudval_t native_pud_val(pud_t pud)
10218 {
10219 return native_pgd_val(pud.pgd);
10220 @@ -237,8 +248,6 @@ static inline pmdval_t native_pmd_val(pm
10221 return pmd.pmd;
10222 }
10223 #else
10224 -#include <asm-generic/pgtable-nopmd.h>
10225 -
10226 static inline pmdval_t native_pmd_val(pmd_t pmd)
10227 {
10228 return native_pgd_val(pmd.pud.pgd);
10229 @@ -278,7 +287,16 @@ typedef struct page *pgtable_t;
10230
10231 extern pteval_t __supported_pte_mask;
10232 extern void set_nx(void);
10233 +
10234 +#ifdef CONFIG_X86_32
10235 +#ifdef CONFIG_X86_PAE
10236 extern int nx_enabled;
10237 +#else
10238 +#define nx_enabled (0)
10239 +#endif
10240 +#else
10241 +#define nx_enabled (1)
10242 +#endif
10243
10244 #define pgprot_writecombine pgprot_writecombine
10245 extern pgprot_t pgprot_writecombine(pgprot_t prot);
10246 diff -urNp linux-2.6.32.46/arch/x86/include/asm/processor.h linux-2.6.32.46/arch/x86/include/asm/processor.h
10247 --- linux-2.6.32.46/arch/x86/include/asm/processor.h 2011-04-22 19:16:29.000000000 -0400
10248 +++ linux-2.6.32.46/arch/x86/include/asm/processor.h 2011-05-11 18:25:15.000000000 -0400
10249 @@ -272,7 +272,7 @@ struct tss_struct {
10250
10251 } ____cacheline_aligned;
10252
10253 -DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
10254 +extern struct tss_struct init_tss[NR_CPUS];
10255
10256 /*
10257 * Save the original ist values for checking stack pointers during debugging
10258 @@ -888,11 +888,18 @@ static inline void spin_lock_prefetch(co
10259 */
10260 #define TASK_SIZE PAGE_OFFSET
10261 #define TASK_SIZE_MAX TASK_SIZE
10262 +
10263 +#ifdef CONFIG_PAX_SEGMEXEC
10264 +#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
10265 +#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
10266 +#else
10267 #define STACK_TOP TASK_SIZE
10268 -#define STACK_TOP_MAX STACK_TOP
10269 +#endif
10270 +
10271 +#define STACK_TOP_MAX TASK_SIZE
10272
10273 #define INIT_THREAD { \
10274 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
10275 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
10276 .vm86_info = NULL, \
10277 .sysenter_cs = __KERNEL_CS, \
10278 .io_bitmap_ptr = NULL, \
10279 @@ -906,7 +913,7 @@ static inline void spin_lock_prefetch(co
10280 */
10281 #define INIT_TSS { \
10282 .x86_tss = { \
10283 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
10284 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
10285 .ss0 = __KERNEL_DS, \
10286 .ss1 = __KERNEL_CS, \
10287 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
10288 @@ -917,11 +924,7 @@ static inline void spin_lock_prefetch(co
10289 extern unsigned long thread_saved_pc(struct task_struct *tsk);
10290
10291 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
10292 -#define KSTK_TOP(info) \
10293 -({ \
10294 - unsigned long *__ptr = (unsigned long *)(info); \
10295 - (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
10296 -})
10297 +#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
10298
10299 /*
10300 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
10301 @@ -936,7 +939,7 @@ extern unsigned long thread_saved_pc(str
10302 #define task_pt_regs(task) \
10303 ({ \
10304 struct pt_regs *__regs__; \
10305 - __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
10306 + __regs__ = (struct pt_regs *)((task)->thread.sp0); \
10307 __regs__ - 1; \
10308 })
10309
10310 @@ -946,13 +949,13 @@ extern unsigned long thread_saved_pc(str
10311 /*
10312 * User space process size. 47bits minus one guard page.
10313 */
10314 -#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
10315 +#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
10316
10317 /* This decides where the kernel will search for a free chunk of vm
10318 * space during mmap's.
10319 */
10320 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
10321 - 0xc0000000 : 0xFFFFe000)
10322 + 0xc0000000 : 0xFFFFf000)
10323
10324 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
10325 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
10326 @@ -963,11 +966,11 @@ extern unsigned long thread_saved_pc(str
10327 #define STACK_TOP_MAX TASK_SIZE_MAX
10328
10329 #define INIT_THREAD { \
10330 - .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
10331 + .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
10332 }
10333
10334 #define INIT_TSS { \
10335 - .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
10336 + .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
10337 }
10338
10339 /*
10340 @@ -989,6 +992,10 @@ extern void start_thread(struct pt_regs
10341 */
10342 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
10343
10344 +#ifdef CONFIG_PAX_SEGMEXEC
10345 +#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
10346 +#endif
10347 +
10348 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
10349
10350 /* Get/set a process' ability to use the timestamp counter instruction */
10351 diff -urNp linux-2.6.32.46/arch/x86/include/asm/ptrace.h linux-2.6.32.46/arch/x86/include/asm/ptrace.h
10352 --- linux-2.6.32.46/arch/x86/include/asm/ptrace.h 2011-03-27 14:31:47.000000000 -0400
10353 +++ linux-2.6.32.46/arch/x86/include/asm/ptrace.h 2011-04-17 15:56:46.000000000 -0400
10354 @@ -151,28 +151,29 @@ static inline unsigned long regs_return_
10355 }
10356
10357 /*
10358 - * user_mode_vm(regs) determines whether a register set came from user mode.
10359 + * user_mode(regs) determines whether a register set came from user mode.
10360 * This is true if V8086 mode was enabled OR if the register set was from
10361 * protected mode with RPL-3 CS value. This tricky test checks that with
10362 * one comparison. Many places in the kernel can bypass this full check
10363 - * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
10364 + * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
10365 + * be used.
10366 */
10367 -static inline int user_mode(struct pt_regs *regs)
10368 +static inline int user_mode_novm(struct pt_regs *regs)
10369 {
10370 #ifdef CONFIG_X86_32
10371 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
10372 #else
10373 - return !!(regs->cs & 3);
10374 + return !!(regs->cs & SEGMENT_RPL_MASK);
10375 #endif
10376 }
10377
10378 -static inline int user_mode_vm(struct pt_regs *regs)
10379 +static inline int user_mode(struct pt_regs *regs)
10380 {
10381 #ifdef CONFIG_X86_32
10382 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
10383 USER_RPL;
10384 #else
10385 - return user_mode(regs);
10386 + return user_mode_novm(regs);
10387 #endif
10388 }
10389
10390 diff -urNp linux-2.6.32.46/arch/x86/include/asm/reboot.h linux-2.6.32.46/arch/x86/include/asm/reboot.h
10391 --- linux-2.6.32.46/arch/x86/include/asm/reboot.h 2011-03-27 14:31:47.000000000 -0400
10392 +++ linux-2.6.32.46/arch/x86/include/asm/reboot.h 2011-08-05 20:33:55.000000000 -0400
10393 @@ -6,19 +6,19 @@
10394 struct pt_regs;
10395
10396 struct machine_ops {
10397 - void (*restart)(char *cmd);
10398 - void (*halt)(void);
10399 - void (*power_off)(void);
10400 + void (* __noreturn restart)(char *cmd);
10401 + void (* __noreturn halt)(void);
10402 + void (* __noreturn power_off)(void);
10403 void (*shutdown)(void);
10404 void (*crash_shutdown)(struct pt_regs *);
10405 - void (*emergency_restart)(void);
10406 -};
10407 + void (* __noreturn emergency_restart)(void);
10408 +} __no_const;
10409
10410 extern struct machine_ops machine_ops;
10411
10412 void native_machine_crash_shutdown(struct pt_regs *regs);
10413 void native_machine_shutdown(void);
10414 -void machine_real_restart(const unsigned char *code, int length);
10415 +void machine_real_restart(const unsigned char *code, unsigned int length) __noreturn;
10416
10417 typedef void (*nmi_shootdown_cb)(int, struct die_args*);
10418 void nmi_shootdown_cpus(nmi_shootdown_cb callback);
10419 diff -urNp linux-2.6.32.46/arch/x86/include/asm/rwsem.h linux-2.6.32.46/arch/x86/include/asm/rwsem.h
10420 --- linux-2.6.32.46/arch/x86/include/asm/rwsem.h 2011-03-27 14:31:47.000000000 -0400
10421 +++ linux-2.6.32.46/arch/x86/include/asm/rwsem.h 2011-04-17 15:56:46.000000000 -0400
10422 @@ -118,6 +118,14 @@ static inline void __down_read(struct rw
10423 {
10424 asm volatile("# beginning down_read\n\t"
10425 LOCK_PREFIX _ASM_INC "(%1)\n\t"
10426 +
10427 +#ifdef CONFIG_PAX_REFCOUNT
10428 + "jno 0f\n"
10429 + LOCK_PREFIX _ASM_DEC "(%1)\n\t"
10430 + "int $4\n0:\n"
10431 + _ASM_EXTABLE(0b, 0b)
10432 +#endif
10433 +
10434 /* adds 0x00000001, returns the old value */
10435 " jns 1f\n"
10436 " call call_rwsem_down_read_failed\n"
10437 @@ -139,6 +147,14 @@ static inline int __down_read_trylock(st
10438 "1:\n\t"
10439 " mov %1,%2\n\t"
10440 " add %3,%2\n\t"
10441 +
10442 +#ifdef CONFIG_PAX_REFCOUNT
10443 + "jno 0f\n"
10444 + "sub %3,%2\n"
10445 + "int $4\n0:\n"
10446 + _ASM_EXTABLE(0b, 0b)
10447 +#endif
10448 +
10449 " jle 2f\n\t"
10450 LOCK_PREFIX " cmpxchg %2,%0\n\t"
10451 " jnz 1b\n\t"
10452 @@ -160,6 +176,14 @@ static inline void __down_write_nested(s
10453 tmp = RWSEM_ACTIVE_WRITE_BIAS;
10454 asm volatile("# beginning down_write\n\t"
10455 LOCK_PREFIX " xadd %1,(%2)\n\t"
10456 +
10457 +#ifdef CONFIG_PAX_REFCOUNT
10458 + "jno 0f\n"
10459 + "mov %1,(%2)\n"
10460 + "int $4\n0:\n"
10461 + _ASM_EXTABLE(0b, 0b)
10462 +#endif
10463 +
10464 /* subtract 0x0000ffff, returns the old value */
10465 " test %1,%1\n\t"
10466 /* was the count 0 before? */
10467 @@ -198,6 +222,14 @@ static inline void __up_read(struct rw_s
10468 rwsem_count_t tmp = -RWSEM_ACTIVE_READ_BIAS;
10469 asm volatile("# beginning __up_read\n\t"
10470 LOCK_PREFIX " xadd %1,(%2)\n\t"
10471 +
10472 +#ifdef CONFIG_PAX_REFCOUNT
10473 + "jno 0f\n"
10474 + "mov %1,(%2)\n"
10475 + "int $4\n0:\n"
10476 + _ASM_EXTABLE(0b, 0b)
10477 +#endif
10478 +
10479 /* subtracts 1, returns the old value */
10480 " jns 1f\n\t"
10481 " call call_rwsem_wake\n"
10482 @@ -216,6 +248,14 @@ static inline void __up_write(struct rw_
10483 rwsem_count_t tmp;
10484 asm volatile("# beginning __up_write\n\t"
10485 LOCK_PREFIX " xadd %1,(%2)\n\t"
10486 +
10487 +#ifdef CONFIG_PAX_REFCOUNT
10488 + "jno 0f\n"
10489 + "mov %1,(%2)\n"
10490 + "int $4\n0:\n"
10491 + _ASM_EXTABLE(0b, 0b)
10492 +#endif
10493 +
10494 /* tries to transition
10495 0xffff0001 -> 0x00000000 */
10496 " jz 1f\n"
10497 @@ -234,6 +274,14 @@ static inline void __downgrade_write(str
10498 {
10499 asm volatile("# beginning __downgrade_write\n\t"
10500 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
10501 +
10502 +#ifdef CONFIG_PAX_REFCOUNT
10503 + "jno 0f\n"
10504 + LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
10505 + "int $4\n0:\n"
10506 + _ASM_EXTABLE(0b, 0b)
10507 +#endif
10508 +
10509 /*
10510 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
10511 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
10512 @@ -253,7 +301,15 @@ static inline void __downgrade_write(str
10513 static inline void rwsem_atomic_add(rwsem_count_t delta,
10514 struct rw_semaphore *sem)
10515 {
10516 - asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
10517 + asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
10518 +
10519 +#ifdef CONFIG_PAX_REFCOUNT
10520 + "jno 0f\n"
10521 + LOCK_PREFIX _ASM_SUB "%1,%0\n"
10522 + "int $4\n0:\n"
10523 + _ASM_EXTABLE(0b, 0b)
10524 +#endif
10525 +
10526 : "+m" (sem->count)
10527 : "er" (delta));
10528 }
10529 @@ -266,7 +322,15 @@ static inline rwsem_count_t rwsem_atomic
10530 {
10531 rwsem_count_t tmp = delta;
10532
10533 - asm volatile(LOCK_PREFIX "xadd %0,%1"
10534 + asm volatile(LOCK_PREFIX "xadd %0,%1\n"
10535 +
10536 +#ifdef CONFIG_PAX_REFCOUNT
10537 + "jno 0f\n"
10538 + "mov %0,%1\n"
10539 + "int $4\n0:\n"
10540 + _ASM_EXTABLE(0b, 0b)
10541 +#endif
10542 +
10543 : "+r" (tmp), "+m" (sem->count)
10544 : : "memory");
10545
10546 diff -urNp linux-2.6.32.46/arch/x86/include/asm/segment.h linux-2.6.32.46/arch/x86/include/asm/segment.h
10547 --- linux-2.6.32.46/arch/x86/include/asm/segment.h 2011-03-27 14:31:47.000000000 -0400
10548 +++ linux-2.6.32.46/arch/x86/include/asm/segment.h 2011-10-06 09:37:08.000000000 -0400
10549 @@ -62,10 +62,15 @@
10550 * 26 - ESPFIX small SS
10551 * 27 - per-cpu [ offset to per-cpu data area ]
10552 * 28 - stack_canary-20 [ for stack protector ]
10553 - * 29 - unused
10554 - * 30 - unused
10555 + * 29 - PCI BIOS CS
10556 + * 30 - PCI BIOS DS
10557 * 31 - TSS for double fault handler
10558 */
10559 +#define GDT_ENTRY_KERNEXEC_EFI_CS (1)
10560 +#define GDT_ENTRY_KERNEXEC_EFI_DS (2)
10561 +#define __KERNEXEC_EFI_CS (GDT_ENTRY_KERNEXEC_EFI_CS*8)
10562 +#define __KERNEXEC_EFI_DS (GDT_ENTRY_KERNEXEC_EFI_DS*8)
10563 +
10564 #define GDT_ENTRY_TLS_MIN 6
10565 #define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)
10566
10567 @@ -77,6 +82,8 @@
10568
10569 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE + 0)
10570
10571 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
10572 +
10573 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE + 1)
10574
10575 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE + 4)
10576 @@ -88,7 +95,7 @@
10577 #define GDT_ENTRY_ESPFIX_SS (GDT_ENTRY_KERNEL_BASE + 14)
10578 #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)
10579
10580 -#define GDT_ENTRY_PERCPU (GDT_ENTRY_KERNEL_BASE + 15)
10581 +#define GDT_ENTRY_PERCPU (GDT_ENTRY_KERNEL_BASE + 15)
10582 #ifdef CONFIG_SMP
10583 #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8)
10584 #else
10585 @@ -102,6 +109,12 @@
10586 #define __KERNEL_STACK_CANARY 0
10587 #endif
10588
10589 +#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE + 17)
10590 +#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
10591 +
10592 +#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE + 18)
10593 +#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
10594 +
10595 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
10596
10597 /*
10598 @@ -139,7 +152,7 @@
10599 */
10600
10601 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
10602 -#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
10603 +#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
10604
10605
10606 #else
10607 @@ -163,6 +176,8 @@
10608 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
10609 #define __USER32_DS __USER_DS
10610
10611 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
10612 +
10613 #define GDT_ENTRY_TSS 8 /* needs two entries */
10614 #define GDT_ENTRY_LDT 10 /* needs two entries */
10615 #define GDT_ENTRY_TLS_MIN 12
10616 @@ -183,6 +198,7 @@
10617 #endif
10618
10619 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS * 8)
10620 +#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS * 8)
10621 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS * 8)
10622 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
10623 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
10624 diff -urNp linux-2.6.32.46/arch/x86/include/asm/smp.h linux-2.6.32.46/arch/x86/include/asm/smp.h
10625 --- linux-2.6.32.46/arch/x86/include/asm/smp.h 2011-03-27 14:31:47.000000000 -0400
10626 +++ linux-2.6.32.46/arch/x86/include/asm/smp.h 2011-08-05 20:33:55.000000000 -0400
10627 @@ -24,7 +24,7 @@ extern unsigned int num_processors;
10628 DECLARE_PER_CPU(cpumask_var_t, cpu_sibling_map);
10629 DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
10630 DECLARE_PER_CPU(u16, cpu_llc_id);
10631 -DECLARE_PER_CPU(int, cpu_number);
10632 +DECLARE_PER_CPU(unsigned int, cpu_number);
10633
10634 static inline struct cpumask *cpu_sibling_mask(int cpu)
10635 {
10636 @@ -40,10 +40,7 @@ DECLARE_EARLY_PER_CPU(u16, x86_cpu_to_ap
10637 DECLARE_EARLY_PER_CPU(u16, x86_bios_cpu_apicid);
10638
10639 /* Static state in head.S used to set up a CPU */
10640 -extern struct {
10641 - void *sp;
10642 - unsigned short ss;
10643 -} stack_start;
10644 +extern unsigned long stack_start; /* Initial stack pointer address */
10645
10646 struct smp_ops {
10647 void (*smp_prepare_boot_cpu)(void);
10648 @@ -60,7 +57,7 @@ struct smp_ops {
10649
10650 void (*send_call_func_ipi)(const struct cpumask *mask);
10651 void (*send_call_func_single_ipi)(int cpu);
10652 -};
10653 +} __no_const;
10654
10655 /* Globals due to paravirt */
10656 extern void set_cpu_sibling_map(int cpu);
10657 @@ -175,14 +172,8 @@ extern unsigned disabled_cpus __cpuinitd
10658 extern int safe_smp_processor_id(void);
10659
10660 #elif defined(CONFIG_X86_64_SMP)
10661 -#define raw_smp_processor_id() (percpu_read(cpu_number))
10662 -
10663 -#define stack_smp_processor_id() \
10664 -({ \
10665 - struct thread_info *ti; \
10666 - __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
10667 - ti->cpu; \
10668 -})
10669 +#define raw_smp_processor_id() (percpu_read(cpu_number))
10670 +#define stack_smp_processor_id() raw_smp_processor_id()
10671 #define safe_smp_processor_id() smp_processor_id()
10672
10673 #endif
10674 diff -urNp linux-2.6.32.46/arch/x86/include/asm/spinlock.h linux-2.6.32.46/arch/x86/include/asm/spinlock.h
10675 --- linux-2.6.32.46/arch/x86/include/asm/spinlock.h 2011-03-27 14:31:47.000000000 -0400
10676 +++ linux-2.6.32.46/arch/x86/include/asm/spinlock.h 2011-04-17 15:56:46.000000000 -0400
10677 @@ -249,6 +249,14 @@ static inline int __raw_write_can_lock(r
10678 static inline void __raw_read_lock(raw_rwlock_t *rw)
10679 {
10680 asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
10681 +
10682 +#ifdef CONFIG_PAX_REFCOUNT
10683 + "jno 0f\n"
10684 + LOCK_PREFIX " addl $1,(%0)\n"
10685 + "int $4\n0:\n"
10686 + _ASM_EXTABLE(0b, 0b)
10687 +#endif
10688 +
10689 "jns 1f\n"
10690 "call __read_lock_failed\n\t"
10691 "1:\n"
10692 @@ -258,6 +266,14 @@ static inline void __raw_read_lock(raw_r
10693 static inline void __raw_write_lock(raw_rwlock_t *rw)
10694 {
10695 asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
10696 +
10697 +#ifdef CONFIG_PAX_REFCOUNT
10698 + "jno 0f\n"
10699 + LOCK_PREFIX " addl %1,(%0)\n"
10700 + "int $4\n0:\n"
10701 + _ASM_EXTABLE(0b, 0b)
10702 +#endif
10703 +
10704 "jz 1f\n"
10705 "call __write_lock_failed\n\t"
10706 "1:\n"
10707 @@ -286,12 +302,29 @@ static inline int __raw_write_trylock(ra
10708
10709 static inline void __raw_read_unlock(raw_rwlock_t *rw)
10710 {
10711 - asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
10712 + asm volatile(LOCK_PREFIX "incl %0\n"
10713 +
10714 +#ifdef CONFIG_PAX_REFCOUNT
10715 + "jno 0f\n"
10716 + LOCK_PREFIX "decl %0\n"
10717 + "int $4\n0:\n"
10718 + _ASM_EXTABLE(0b, 0b)
10719 +#endif
10720 +
10721 + :"+m" (rw->lock) : : "memory");
10722 }
10723
10724 static inline void __raw_write_unlock(raw_rwlock_t *rw)
10725 {
10726 - asm volatile(LOCK_PREFIX "addl %1, %0"
10727 + asm volatile(LOCK_PREFIX "addl %1, %0\n"
10728 +
10729 +#ifdef CONFIG_PAX_REFCOUNT
10730 + "jno 0f\n"
10731 + LOCK_PREFIX "subl %1, %0\n"
10732 + "int $4\n0:\n"
10733 + _ASM_EXTABLE(0b, 0b)
10734 +#endif
10735 +
10736 : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
10737 }
10738
10739 diff -urNp linux-2.6.32.46/arch/x86/include/asm/stackprotector.h linux-2.6.32.46/arch/x86/include/asm/stackprotector.h
10740 --- linux-2.6.32.46/arch/x86/include/asm/stackprotector.h 2011-03-27 14:31:47.000000000 -0400
10741 +++ linux-2.6.32.46/arch/x86/include/asm/stackprotector.h 2011-07-06 19:53:33.000000000 -0400
10742 @@ -48,7 +48,7 @@
10743 * head_32 for boot CPU and setup_per_cpu_areas() for others.
10744 */
10745 #define GDT_STACK_CANARY_INIT \
10746 - [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
10747 + [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
10748
10749 /*
10750 * Initialize the stackprotector canary value.
10751 @@ -113,7 +113,7 @@ static inline void setup_stack_canary_se
10752
10753 static inline void load_stack_canary_segment(void)
10754 {
10755 -#ifdef CONFIG_X86_32
10756 +#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
10757 asm volatile ("mov %0, %%gs" : : "r" (0));
10758 #endif
10759 }
10760 diff -urNp linux-2.6.32.46/arch/x86/include/asm/system.h linux-2.6.32.46/arch/x86/include/asm/system.h
10761 --- linux-2.6.32.46/arch/x86/include/asm/system.h 2011-03-27 14:31:47.000000000 -0400
10762 +++ linux-2.6.32.46/arch/x86/include/asm/system.h 2011-05-22 23:02:03.000000000 -0400
10763 @@ -132,7 +132,7 @@ do { \
10764 "thread_return:\n\t" \
10765 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
10766 __switch_canary \
10767 - "movq %P[thread_info](%%rsi),%%r8\n\t" \
10768 + "movq "__percpu_arg([thread_info])",%%r8\n\t" \
10769 "movq %%rax,%%rdi\n\t" \
10770 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
10771 "jnz ret_from_fork\n\t" \
10772 @@ -143,7 +143,7 @@ do { \
10773 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
10774 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
10775 [_tif_fork] "i" (_TIF_FORK), \
10776 - [thread_info] "i" (offsetof(struct task_struct, stack)), \
10777 + [thread_info] "m" (per_cpu_var(current_tinfo)), \
10778 [current_task] "m" (per_cpu_var(current_task)) \
10779 __switch_canary_iparam \
10780 : "memory", "cc" __EXTRA_CLOBBER)
10781 @@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
10782 {
10783 unsigned long __limit;
10784 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
10785 - return __limit + 1;
10786 + return __limit;
10787 }
10788
10789 static inline void native_clts(void)
10790 @@ -340,12 +340,12 @@ void enable_hlt(void);
10791
10792 void cpu_idle_wait(void);
10793
10794 -extern unsigned long arch_align_stack(unsigned long sp);
10795 +#define arch_align_stack(x) ((x) & ~0xfUL)
10796 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
10797
10798 void default_idle(void);
10799
10800 -void stop_this_cpu(void *dummy);
10801 +void stop_this_cpu(void *dummy) __noreturn;
10802
10803 /*
10804 * Force strict CPU ordering.
10805 diff -urNp linux-2.6.32.46/arch/x86/include/asm/thread_info.h linux-2.6.32.46/arch/x86/include/asm/thread_info.h
10806 --- linux-2.6.32.46/arch/x86/include/asm/thread_info.h 2011-03-27 14:31:47.000000000 -0400
10807 +++ linux-2.6.32.46/arch/x86/include/asm/thread_info.h 2011-05-17 19:26:34.000000000 -0400
10808 @@ -10,6 +10,7 @@
10809 #include <linux/compiler.h>
10810 #include <asm/page.h>
10811 #include <asm/types.h>
10812 +#include <asm/percpu.h>
10813
10814 /*
10815 * low level task data that entry.S needs immediate access to
10816 @@ -24,7 +25,6 @@ struct exec_domain;
10817 #include <asm/atomic.h>
10818
10819 struct thread_info {
10820 - struct task_struct *task; /* main task structure */
10821 struct exec_domain *exec_domain; /* execution domain */
10822 __u32 flags; /* low level flags */
10823 __u32 status; /* thread synchronous flags */
10824 @@ -34,18 +34,12 @@ struct thread_info {
10825 mm_segment_t addr_limit;
10826 struct restart_block restart_block;
10827 void __user *sysenter_return;
10828 -#ifdef CONFIG_X86_32
10829 - unsigned long previous_esp; /* ESP of the previous stack in
10830 - case of nested (IRQ) stacks
10831 - */
10832 - __u8 supervisor_stack[0];
10833 -#endif
10834 + unsigned long lowest_stack;
10835 int uaccess_err;
10836 };
10837
10838 -#define INIT_THREAD_INFO(tsk) \
10839 +#define INIT_THREAD_INFO \
10840 { \
10841 - .task = &tsk, \
10842 .exec_domain = &default_exec_domain, \
10843 .flags = 0, \
10844 .cpu = 0, \
10845 @@ -56,7 +50,7 @@ struct thread_info {
10846 }, \
10847 }
10848
10849 -#define init_thread_info (init_thread_union.thread_info)
10850 +#define init_thread_info (init_thread_union.stack)
10851 #define init_stack (init_thread_union.stack)
10852
10853 #else /* !__ASSEMBLY__ */
10854 @@ -163,6 +157,23 @@ struct thread_info {
10855 #define alloc_thread_info(tsk) \
10856 ((struct thread_info *)__get_free_pages(THREAD_FLAGS, THREAD_ORDER))
10857
10858 +#ifdef __ASSEMBLY__
10859 +/* how to get the thread information struct from ASM */
10860 +#define GET_THREAD_INFO(reg) \
10861 + mov PER_CPU_VAR(current_tinfo), reg
10862 +
10863 +/* use this one if reg already contains %esp */
10864 +#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
10865 +#else
10866 +/* how to get the thread information struct from C */
10867 +DECLARE_PER_CPU(struct thread_info *, current_tinfo);
10868 +
10869 +static __always_inline struct thread_info *current_thread_info(void)
10870 +{
10871 + return percpu_read_stable(current_tinfo);
10872 +}
10873 +#endif
10874 +
10875 #ifdef CONFIG_X86_32
10876
10877 #define STACK_WARN (THREAD_SIZE/8)
10878 @@ -173,35 +184,13 @@ struct thread_info {
10879 */
10880 #ifndef __ASSEMBLY__
10881
10882 -
10883 /* how to get the current stack pointer from C */
10884 register unsigned long current_stack_pointer asm("esp") __used;
10885
10886 -/* how to get the thread information struct from C */
10887 -static inline struct thread_info *current_thread_info(void)
10888 -{
10889 - return (struct thread_info *)
10890 - (current_stack_pointer & ~(THREAD_SIZE - 1));
10891 -}
10892 -
10893 -#else /* !__ASSEMBLY__ */
10894 -
10895 -/* how to get the thread information struct from ASM */
10896 -#define GET_THREAD_INFO(reg) \
10897 - movl $-THREAD_SIZE, reg; \
10898 - andl %esp, reg
10899 -
10900 -/* use this one if reg already contains %esp */
10901 -#define GET_THREAD_INFO_WITH_ESP(reg) \
10902 - andl $-THREAD_SIZE, reg
10903 -
10904 #endif
10905
10906 #else /* X86_32 */
10907
10908 -#include <asm/percpu.h>
10909 -#define KERNEL_STACK_OFFSET (5*8)
10910 -
10911 /*
10912 * macros/functions for gaining access to the thread information structure
10913 * preempt_count needs to be 1 initially, until the scheduler is functional.
10914 @@ -209,21 +198,8 @@ static inline struct thread_info *curren
10915 #ifndef __ASSEMBLY__
10916 DECLARE_PER_CPU(unsigned long, kernel_stack);
10917
10918 -static inline struct thread_info *current_thread_info(void)
10919 -{
10920 - struct thread_info *ti;
10921 - ti = (void *)(percpu_read_stable(kernel_stack) +
10922 - KERNEL_STACK_OFFSET - THREAD_SIZE);
10923 - return ti;
10924 -}
10925 -
10926 -#else /* !__ASSEMBLY__ */
10927 -
10928 -/* how to get the thread information struct from ASM */
10929 -#define GET_THREAD_INFO(reg) \
10930 - movq PER_CPU_VAR(kernel_stack),reg ; \
10931 - subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
10932 -
10933 +/* how to get the current stack pointer from C */
10934 +register unsigned long current_stack_pointer asm("rsp") __used;
10935 #endif
10936
10937 #endif /* !X86_32 */
10938 @@ -260,5 +236,16 @@ extern void arch_task_cache_init(void);
10939 extern void free_thread_info(struct thread_info *ti);
10940 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
10941 #define arch_task_cache_init arch_task_cache_init
10942 +
10943 +#define __HAVE_THREAD_FUNCTIONS
10944 +#define task_thread_info(task) (&(task)->tinfo)
10945 +#define task_stack_page(task) ((task)->stack)
10946 +#define setup_thread_stack(p, org) do {} while (0)
10947 +#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
10948 +
10949 +#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
10950 +extern struct task_struct *alloc_task_struct(void);
10951 +extern void free_task_struct(struct task_struct *);
10952 +
10953 #endif
10954 #endif /* _ASM_X86_THREAD_INFO_H */
10955 diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_32.h linux-2.6.32.46/arch/x86/include/asm/uaccess_32.h
10956 --- linux-2.6.32.46/arch/x86/include/asm/uaccess_32.h 2011-03-27 14:31:47.000000000 -0400
10957 +++ linux-2.6.32.46/arch/x86/include/asm/uaccess_32.h 2011-05-16 21:46:57.000000000 -0400
10958 @@ -44,6 +44,11 @@ unsigned long __must_check __copy_from_u
10959 static __always_inline unsigned long __must_check
10960 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
10961 {
10962 + pax_track_stack();
10963 +
10964 + if ((long)n < 0)
10965 + return n;
10966 +
10967 if (__builtin_constant_p(n)) {
10968 unsigned long ret;
10969
10970 @@ -62,6 +67,8 @@ __copy_to_user_inatomic(void __user *to,
10971 return ret;
10972 }
10973 }
10974 + if (!__builtin_constant_p(n))
10975 + check_object_size(from, n, true);
10976 return __copy_to_user_ll(to, from, n);
10977 }
10978
10979 @@ -83,12 +90,16 @@ static __always_inline unsigned long __m
10980 __copy_to_user(void __user *to, const void *from, unsigned long n)
10981 {
10982 might_fault();
10983 +
10984 return __copy_to_user_inatomic(to, from, n);
10985 }
10986
10987 static __always_inline unsigned long
10988 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
10989 {
10990 + if ((long)n < 0)
10991 + return n;
10992 +
10993 /* Avoid zeroing the tail if the copy fails..
10994 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
10995 * but as the zeroing behaviour is only significant when n is not
10996 @@ -138,6 +149,12 @@ static __always_inline unsigned long
10997 __copy_from_user(void *to, const void __user *from, unsigned long n)
10998 {
10999 might_fault();
11000 +
11001 + pax_track_stack();
11002 +
11003 + if ((long)n < 0)
11004 + return n;
11005 +
11006 if (__builtin_constant_p(n)) {
11007 unsigned long ret;
11008
11009 @@ -153,6 +170,8 @@ __copy_from_user(void *to, const void __
11010 return ret;
11011 }
11012 }
11013 + if (!__builtin_constant_p(n))
11014 + check_object_size(to, n, false);
11015 return __copy_from_user_ll(to, from, n);
11016 }
11017
11018 @@ -160,6 +179,10 @@ static __always_inline unsigned long __c
11019 const void __user *from, unsigned long n)
11020 {
11021 might_fault();
11022 +
11023 + if ((long)n < 0)
11024 + return n;
11025 +
11026 if (__builtin_constant_p(n)) {
11027 unsigned long ret;
11028
11029 @@ -182,14 +205,62 @@ static __always_inline unsigned long
11030 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
11031 unsigned long n)
11032 {
11033 - return __copy_from_user_ll_nocache_nozero(to, from, n);
11034 + if ((long)n < 0)
11035 + return n;
11036 +
11037 + return __copy_from_user_ll_nocache_nozero(to, from, n);
11038 +}
11039 +
11040 +/**
11041 + * copy_to_user: - Copy a block of data into user space.
11042 + * @to: Destination address, in user space.
11043 + * @from: Source address, in kernel space.
11044 + * @n: Number of bytes to copy.
11045 + *
11046 + * Context: User context only. This function may sleep.
11047 + *
11048 + * Copy data from kernel space to user space.
11049 + *
11050 + * Returns number of bytes that could not be copied.
11051 + * On success, this will be zero.
11052 + */
11053 +static __always_inline unsigned long __must_check
11054 +copy_to_user(void __user *to, const void *from, unsigned long n)
11055 +{
11056 + if (access_ok(VERIFY_WRITE, to, n))
11057 + n = __copy_to_user(to, from, n);
11058 + return n;
11059 +}
11060 +
11061 +/**
11062 + * copy_from_user: - Copy a block of data from user space.
11063 + * @to: Destination address, in kernel space.
11064 + * @from: Source address, in user space.
11065 + * @n: Number of bytes to copy.
11066 + *
11067 + * Context: User context only. This function may sleep.
11068 + *
11069 + * Copy data from user space to kernel space.
11070 + *
11071 + * Returns number of bytes that could not be copied.
11072 + * On success, this will be zero.
11073 + *
11074 + * If some data could not be copied, this function will pad the copied
11075 + * data to the requested size using zero bytes.
11076 + */
11077 +static __always_inline unsigned long __must_check
11078 +copy_from_user(void *to, const void __user *from, unsigned long n)
11079 +{
11080 + if (access_ok(VERIFY_READ, from, n))
11081 + n = __copy_from_user(to, from, n);
11082 + else if ((long)n > 0) {
11083 + if (!__builtin_constant_p(n))
11084 + check_object_size(to, n, false);
11085 + memset(to, 0, n);
11086 + }
11087 + return n;
11088 }
11089
11090 -unsigned long __must_check copy_to_user(void __user *to,
11091 - const void *from, unsigned long n);
11092 -unsigned long __must_check copy_from_user(void *to,
11093 - const void __user *from,
11094 - unsigned long n);
11095 long __must_check strncpy_from_user(char *dst, const char __user *src,
11096 long count);
11097 long __must_check __strncpy_from_user(char *dst,
11098 diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h
11099 --- linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h 2011-03-27 14:31:47.000000000 -0400
11100 +++ linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h 2011-10-06 09:37:08.000000000 -0400
11101 @@ -9,6 +9,9 @@
11102 #include <linux/prefetch.h>
11103 #include <linux/lockdep.h>
11104 #include <asm/page.h>
11105 +#include <asm/pgtable.h>
11106 +
11107 +#define set_fs(x) (current_thread_info()->addr_limit = (x))
11108
11109 /*
11110 * Copy To/From Userspace
11111 @@ -19,113 +22,203 @@ __must_check unsigned long
11112 copy_user_generic(void *to, const void *from, unsigned len);
11113
11114 __must_check unsigned long
11115 -copy_to_user(void __user *to, const void *from, unsigned len);
11116 -__must_check unsigned long
11117 -copy_from_user(void *to, const void __user *from, unsigned len);
11118 -__must_check unsigned long
11119 copy_in_user(void __user *to, const void __user *from, unsigned len);
11120
11121 static __always_inline __must_check
11122 -int __copy_from_user(void *dst, const void __user *src, unsigned size)
11123 +unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
11124 {
11125 - int ret = 0;
11126 + unsigned ret = 0;
11127
11128 might_fault();
11129 - if (!__builtin_constant_p(size))
11130 - return copy_user_generic(dst, (__force void *)src, size);
11131 +
11132 + if ((int)size < 0)
11133 + return size;
11134 +
11135 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11136 + if (!__access_ok(VERIFY_READ, src, size))
11137 + return size;
11138 +#endif
11139 +
11140 + if (!__builtin_constant_p(size)) {
11141 + check_object_size(dst, size, false);
11142 +
11143 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11144 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11145 + src += PAX_USER_SHADOW_BASE;
11146 +#endif
11147 +
11148 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
11149 + }
11150 switch (size) {
11151 - case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
11152 + case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
11153 ret, "b", "b", "=q", 1);
11154 return ret;
11155 - case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
11156 + case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
11157 ret, "w", "w", "=r", 2);
11158 return ret;
11159 - case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
11160 + case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
11161 ret, "l", "k", "=r", 4);
11162 return ret;
11163 - case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
11164 + case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11165 ret, "q", "", "=r", 8);
11166 return ret;
11167 case 10:
11168 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
11169 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11170 ret, "q", "", "=r", 10);
11171 if (unlikely(ret))
11172 return ret;
11173 __get_user_asm(*(u16 *)(8 + (char *)dst),
11174 - (u16 __user *)(8 + (char __user *)src),
11175 + (const u16 __user *)(8 + (const char __user *)src),
11176 ret, "w", "w", "=r", 2);
11177 return ret;
11178 case 16:
11179 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
11180 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11181 ret, "q", "", "=r", 16);
11182 if (unlikely(ret))
11183 return ret;
11184 __get_user_asm(*(u64 *)(8 + (char *)dst),
11185 - (u64 __user *)(8 + (char __user *)src),
11186 + (const u64 __user *)(8 + (const char __user *)src),
11187 ret, "q", "", "=r", 8);
11188 return ret;
11189 default:
11190 - return copy_user_generic(dst, (__force void *)src, size);
11191 +
11192 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11193 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11194 + src += PAX_USER_SHADOW_BASE;
11195 +#endif
11196 +
11197 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
11198 }
11199 }
11200
11201 static __always_inline __must_check
11202 -int __copy_to_user(void __user *dst, const void *src, unsigned size)
11203 +unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
11204 {
11205 - int ret = 0;
11206 + unsigned ret = 0;
11207
11208 might_fault();
11209 - if (!__builtin_constant_p(size))
11210 - return copy_user_generic((__force void *)dst, src, size);
11211 +
11212 + pax_track_stack();
11213 +
11214 + if ((int)size < 0)
11215 + return size;
11216 +
11217 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11218 + if (!__access_ok(VERIFY_WRITE, dst, size))
11219 + return size;
11220 +#endif
11221 +
11222 + if (!__builtin_constant_p(size)) {
11223 + check_object_size(src, size, true);
11224 +
11225 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11226 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11227 + dst += PAX_USER_SHADOW_BASE;
11228 +#endif
11229 +
11230 + return copy_user_generic((__force_kernel void *)dst, src, size);
11231 + }
11232 switch (size) {
11233 - case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
11234 + case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
11235 ret, "b", "b", "iq", 1);
11236 return ret;
11237 - case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
11238 + case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
11239 ret, "w", "w", "ir", 2);
11240 return ret;
11241 - case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
11242 + case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
11243 ret, "l", "k", "ir", 4);
11244 return ret;
11245 - case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
11246 + case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11247 ret, "q", "", "er", 8);
11248 return ret;
11249 case 10:
11250 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11251 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11252 ret, "q", "", "er", 10);
11253 if (unlikely(ret))
11254 return ret;
11255 asm("":::"memory");
11256 - __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
11257 + __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
11258 ret, "w", "w", "ir", 2);
11259 return ret;
11260 case 16:
11261 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11262 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11263 ret, "q", "", "er", 16);
11264 if (unlikely(ret))
11265 return ret;
11266 asm("":::"memory");
11267 - __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
11268 + __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
11269 ret, "q", "", "er", 8);
11270 return ret;
11271 default:
11272 - return copy_user_generic((__force void *)dst, src, size);
11273 +
11274 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11275 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11276 + dst += PAX_USER_SHADOW_BASE;
11277 +#endif
11278 +
11279 + return copy_user_generic((__force_kernel void *)dst, src, size);
11280 + }
11281 +}
11282 +
11283 +static __always_inline __must_check
11284 +unsigned long copy_to_user(void __user *to, const void *from, unsigned len)
11285 +{
11286 + if (access_ok(VERIFY_WRITE, to, len))
11287 + len = __copy_to_user(to, from, len);
11288 + return len;
11289 +}
11290 +
11291 +static __always_inline __must_check
11292 +unsigned long copy_from_user(void *to, const void __user *from, unsigned len)
11293 +{
11294 + if ((int)len < 0)
11295 + return len;
11296 +
11297 + if (access_ok(VERIFY_READ, from, len))
11298 + len = __copy_from_user(to, from, len);
11299 + else if ((int)len > 0) {
11300 + if (!__builtin_constant_p(len))
11301 + check_object_size(to, len, false);
11302 + memset(to, 0, len);
11303 }
11304 + return len;
11305 }
11306
11307 static __always_inline __must_check
11308 -int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11309 +unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11310 {
11311 - int ret = 0;
11312 + unsigned ret = 0;
11313
11314 might_fault();
11315 - if (!__builtin_constant_p(size))
11316 - return copy_user_generic((__force void *)dst,
11317 - (__force void *)src, size);
11318 +
11319 + pax_track_stack();
11320 +
11321 + if ((int)size < 0)
11322 + return size;
11323 +
11324 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11325 + if (!__access_ok(VERIFY_READ, src, size))
11326 + return size;
11327 + if (!__access_ok(VERIFY_WRITE, dst, size))
11328 + return size;
11329 +#endif
11330 +
11331 + if (!__builtin_constant_p(size)) {
11332 +
11333 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11334 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11335 + src += PAX_USER_SHADOW_BASE;
11336 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11337 + dst += PAX_USER_SHADOW_BASE;
11338 +#endif
11339 +
11340 + return copy_user_generic((__force_kernel void *)dst,
11341 + (__force_kernel const void *)src, size);
11342 + }
11343 switch (size) {
11344 case 1: {
11345 u8 tmp;
11346 - __get_user_asm(tmp, (u8 __user *)src,
11347 + __get_user_asm(tmp, (const u8 __user *)src,
11348 ret, "b", "b", "=q", 1);
11349 if (likely(!ret))
11350 __put_user_asm(tmp, (u8 __user *)dst,
11351 @@ -134,7 +227,7 @@ int __copy_in_user(void __user *dst, con
11352 }
11353 case 2: {
11354 u16 tmp;
11355 - __get_user_asm(tmp, (u16 __user *)src,
11356 + __get_user_asm(tmp, (const u16 __user *)src,
11357 ret, "w", "w", "=r", 2);
11358 if (likely(!ret))
11359 __put_user_asm(tmp, (u16 __user *)dst,
11360 @@ -144,7 +237,7 @@ int __copy_in_user(void __user *dst, con
11361
11362 case 4: {
11363 u32 tmp;
11364 - __get_user_asm(tmp, (u32 __user *)src,
11365 + __get_user_asm(tmp, (const u32 __user *)src,
11366 ret, "l", "k", "=r", 4);
11367 if (likely(!ret))
11368 __put_user_asm(tmp, (u32 __user *)dst,
11369 @@ -153,7 +246,7 @@ int __copy_in_user(void __user *dst, con
11370 }
11371 case 8: {
11372 u64 tmp;
11373 - __get_user_asm(tmp, (u64 __user *)src,
11374 + __get_user_asm(tmp, (const u64 __user *)src,
11375 ret, "q", "", "=r", 8);
11376 if (likely(!ret))
11377 __put_user_asm(tmp, (u64 __user *)dst,
11378 @@ -161,8 +254,16 @@ int __copy_in_user(void __user *dst, con
11379 return ret;
11380 }
11381 default:
11382 - return copy_user_generic((__force void *)dst,
11383 - (__force void *)src, size);
11384 +
11385 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11386 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11387 + src += PAX_USER_SHADOW_BASE;
11388 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11389 + dst += PAX_USER_SHADOW_BASE;
11390 +#endif
11391 +
11392 + return copy_user_generic((__force_kernel void *)dst,
11393 + (__force_kernel const void *)src, size);
11394 }
11395 }
11396
11397 @@ -176,33 +277,75 @@ __must_check long strlen_user(const char
11398 __must_check unsigned long clear_user(void __user *mem, unsigned long len);
11399 __must_check unsigned long __clear_user(void __user *mem, unsigned long len);
11400
11401 -__must_check long __copy_from_user_inatomic(void *dst, const void __user *src,
11402 - unsigned size);
11403 +static __must_check __always_inline unsigned long
11404 +__copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
11405 +{
11406 + pax_track_stack();
11407 +
11408 + if ((int)size < 0)
11409 + return size;
11410 +
11411 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11412 + if (!__access_ok(VERIFY_READ, src, size))
11413 + return size;
11414 +
11415 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11416 + src += PAX_USER_SHADOW_BASE;
11417 +#endif
11418
11419 -static __must_check __always_inline int
11420 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
11421 +}
11422 +
11423 +static __must_check __always_inline unsigned long
11424 __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
11425 {
11426 - return copy_user_generic((__force void *)dst, src, size);
11427 + if ((int)size < 0)
11428 + return size;
11429 +
11430 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11431 + if (!__access_ok(VERIFY_WRITE, dst, size))
11432 + return size;
11433 +
11434 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11435 + dst += PAX_USER_SHADOW_BASE;
11436 +#endif
11437 +
11438 + return copy_user_generic((__force_kernel void *)dst, src, size);
11439 }
11440
11441 -extern long __copy_user_nocache(void *dst, const void __user *src,
11442 +extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
11443 unsigned size, int zerorest);
11444
11445 -static inline int
11446 -__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
11447 +static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
11448 {
11449 might_sleep();
11450 +
11451 + if ((int)size < 0)
11452 + return size;
11453 +
11454 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11455 + if (!__access_ok(VERIFY_READ, src, size))
11456 + return size;
11457 +#endif
11458 +
11459 return __copy_user_nocache(dst, src, size, 1);
11460 }
11461
11462 -static inline int
11463 -__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
11464 +static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
11465 unsigned size)
11466 {
11467 + if ((int)size < 0)
11468 + return size;
11469 +
11470 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11471 + if (!__access_ok(VERIFY_READ, src, size))
11472 + return size;
11473 +#endif
11474 +
11475 return __copy_user_nocache(dst, src, size, 0);
11476 }
11477
11478 -unsigned long
11479 -copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
11480 +extern unsigned long
11481 +copy_user_handle_tail(char __user *to, char __user *from, unsigned len, unsigned zerorest);
11482
11483 #endif /* _ASM_X86_UACCESS_64_H */
11484 diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess.h linux-2.6.32.46/arch/x86/include/asm/uaccess.h
11485 --- linux-2.6.32.46/arch/x86/include/asm/uaccess.h 2011-06-25 12:55:34.000000000 -0400
11486 +++ linux-2.6.32.46/arch/x86/include/asm/uaccess.h 2011-10-06 09:37:08.000000000 -0400
11487 @@ -8,12 +8,15 @@
11488 #include <linux/thread_info.h>
11489 #include <linux/prefetch.h>
11490 #include <linux/string.h>
11491 +#include <linux/sched.h>
11492 #include <asm/asm.h>
11493 #include <asm/page.h>
11494
11495 #define VERIFY_READ 0
11496 #define VERIFY_WRITE 1
11497
11498 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
11499 +
11500 /*
11501 * The fs value determines whether argument validity checking should be
11502 * performed or not. If get_fs() == USER_DS, checking is performed, with
11503 @@ -29,7 +32,12 @@
11504
11505 #define get_ds() (KERNEL_DS)
11506 #define get_fs() (current_thread_info()->addr_limit)
11507 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
11508 +void __set_fs(mm_segment_t x);
11509 +void set_fs(mm_segment_t x);
11510 +#else
11511 #define set_fs(x) (current_thread_info()->addr_limit = (x))
11512 +#endif
11513
11514 #define segment_eq(a, b) ((a).seg == (b).seg)
11515
11516 @@ -77,7 +85,33 @@
11517 * checks that the pointer is in the user space range - after calling
11518 * this function, memory access functions may still return -EFAULT.
11519 */
11520 -#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
11521 +#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
11522 +#define access_ok(type, addr, size) \
11523 +({ \
11524 + long __size = size; \
11525 + unsigned long __addr = (unsigned long)addr; \
11526 + unsigned long __addr_ao = __addr & PAGE_MASK; \
11527 + unsigned long __end_ao = __addr + __size - 1; \
11528 + bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
11529 + if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
11530 + while(__addr_ao <= __end_ao) { \
11531 + char __c_ao; \
11532 + __addr_ao += PAGE_SIZE; \
11533 + if (__size > PAGE_SIZE) \
11534 + cond_resched(); \
11535 + if (__get_user(__c_ao, (char __user *)__addr)) \
11536 + break; \
11537 + if (type != VERIFY_WRITE) { \
11538 + __addr = __addr_ao; \
11539 + continue; \
11540 + } \
11541 + if (__put_user(__c_ao, (char __user *)__addr)) \
11542 + break; \
11543 + __addr = __addr_ao; \
11544 + } \
11545 + } \
11546 + __ret_ao; \
11547 +})
11548
11549 /*
11550 * The exception table consists of pairs of addresses: the first is the
11551 @@ -183,12 +217,20 @@ extern int __get_user_bad(void);
11552 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
11553 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
11554
11555 -
11556 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
11557 +#define __copyuser_seg "gs;"
11558 +#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
11559 +#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
11560 +#else
11561 +#define __copyuser_seg
11562 +#define __COPYUSER_SET_ES
11563 +#define __COPYUSER_RESTORE_ES
11564 +#endif
11565
11566 #ifdef CONFIG_X86_32
11567 #define __put_user_asm_u64(x, addr, err, errret) \
11568 - asm volatile("1: movl %%eax,0(%2)\n" \
11569 - "2: movl %%edx,4(%2)\n" \
11570 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
11571 + "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
11572 "3:\n" \
11573 ".section .fixup,\"ax\"\n" \
11574 "4: movl %3,%0\n" \
11575 @@ -200,8 +242,8 @@ extern int __get_user_bad(void);
11576 : "A" (x), "r" (addr), "i" (errret), "0" (err))
11577
11578 #define __put_user_asm_ex_u64(x, addr) \
11579 - asm volatile("1: movl %%eax,0(%1)\n" \
11580 - "2: movl %%edx,4(%1)\n" \
11581 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
11582 + "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
11583 "3:\n" \
11584 _ASM_EXTABLE(1b, 2b - 1b) \
11585 _ASM_EXTABLE(2b, 3b - 2b) \
11586 @@ -253,7 +295,7 @@ extern void __put_user_8(void);
11587 __typeof__(*(ptr)) __pu_val; \
11588 __chk_user_ptr(ptr); \
11589 might_fault(); \
11590 - __pu_val = x; \
11591 + __pu_val = (x); \
11592 switch (sizeof(*(ptr))) { \
11593 case 1: \
11594 __put_user_x(1, __pu_val, ptr, __ret_pu); \
11595 @@ -374,7 +416,7 @@ do { \
11596 } while (0)
11597
11598 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
11599 - asm volatile("1: mov"itype" %2,%"rtype"1\n" \
11600 + asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
11601 "2:\n" \
11602 ".section .fixup,\"ax\"\n" \
11603 "3: mov %3,%0\n" \
11604 @@ -382,7 +424,7 @@ do { \
11605 " jmp 2b\n" \
11606 ".previous\n" \
11607 _ASM_EXTABLE(1b, 3b) \
11608 - : "=r" (err), ltype(x) \
11609 + : "=r" (err), ltype (x) \
11610 : "m" (__m(addr)), "i" (errret), "0" (err))
11611
11612 #define __get_user_size_ex(x, ptr, size) \
11613 @@ -407,7 +449,7 @@ do { \
11614 } while (0)
11615
11616 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
11617 - asm volatile("1: mov"itype" %1,%"rtype"0\n" \
11618 + asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
11619 "2:\n" \
11620 _ASM_EXTABLE(1b, 2b - 1b) \
11621 : ltype(x) : "m" (__m(addr)))
11622 @@ -424,13 +466,24 @@ do { \
11623 int __gu_err; \
11624 unsigned long __gu_val; \
11625 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
11626 - (x) = (__force __typeof__(*(ptr)))__gu_val; \
11627 + (x) = (__typeof__(*(ptr)))__gu_val; \
11628 __gu_err; \
11629 })
11630
11631 /* FIXME: this hack is definitely wrong -AK */
11632 struct __large_struct { unsigned long buf[100]; };
11633 -#define __m(x) (*(struct __large_struct __user *)(x))
11634 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11635 +#define ____m(x) \
11636 +({ \
11637 + unsigned long ____x = (unsigned long)(x); \
11638 + if (____x < PAX_USER_SHADOW_BASE) \
11639 + ____x += PAX_USER_SHADOW_BASE; \
11640 + (void __user *)____x; \
11641 +})
11642 +#else
11643 +#define ____m(x) (x)
11644 +#endif
11645 +#define __m(x) (*(struct __large_struct __user *)____m(x))
11646
11647 /*
11648 * Tell gcc we read from memory instead of writing: this is because
11649 @@ -438,7 +491,7 @@ struct __large_struct { unsigned long bu
11650 * aliasing issues.
11651 */
11652 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
11653 - asm volatile("1: mov"itype" %"rtype"1,%2\n" \
11654 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
11655 "2:\n" \
11656 ".section .fixup,\"ax\"\n" \
11657 "3: mov %3,%0\n" \
11658 @@ -446,10 +499,10 @@ struct __large_struct { unsigned long bu
11659 ".previous\n" \
11660 _ASM_EXTABLE(1b, 3b) \
11661 : "=r"(err) \
11662 - : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
11663 + : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
11664
11665 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
11666 - asm volatile("1: mov"itype" %"rtype"0,%1\n" \
11667 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
11668 "2:\n" \
11669 _ASM_EXTABLE(1b, 2b - 1b) \
11670 : : ltype(x), "m" (__m(addr)))
11671 @@ -488,8 +541,12 @@ struct __large_struct { unsigned long bu
11672 * On error, the variable @x is set to zero.
11673 */
11674
11675 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11676 +#define __get_user(x, ptr) get_user((x), (ptr))
11677 +#else
11678 #define __get_user(x, ptr) \
11679 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
11680 +#endif
11681
11682 /**
11683 * __put_user: - Write a simple value into user space, with less checking.
11684 @@ -511,8 +568,12 @@ struct __large_struct { unsigned long bu
11685 * Returns zero on success, or -EFAULT on error.
11686 */
11687
11688 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11689 +#define __put_user(x, ptr) put_user((x), (ptr))
11690 +#else
11691 #define __put_user(x, ptr) \
11692 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
11693 +#endif
11694
11695 #define __get_user_unaligned __get_user
11696 #define __put_user_unaligned __put_user
11697 @@ -530,7 +591,7 @@ struct __large_struct { unsigned long bu
11698 #define get_user_ex(x, ptr) do { \
11699 unsigned long __gue_val; \
11700 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
11701 - (x) = (__force __typeof__(*(ptr)))__gue_val; \
11702 + (x) = (__typeof__(*(ptr)))__gue_val; \
11703 } while (0)
11704
11705 #ifdef CONFIG_X86_WP_WORKS_OK
11706 @@ -567,6 +628,7 @@ extern struct movsl_mask {
11707
11708 #define ARCH_HAS_NOCACHE_UACCESS 1
11709
11710 +#define ARCH_HAS_SORT_EXTABLE
11711 #ifdef CONFIG_X86_32
11712 # include "uaccess_32.h"
11713 #else
11714 diff -urNp linux-2.6.32.46/arch/x86/include/asm/vdso.h linux-2.6.32.46/arch/x86/include/asm/vdso.h
11715 --- linux-2.6.32.46/arch/x86/include/asm/vdso.h 2011-03-27 14:31:47.000000000 -0400
11716 +++ linux-2.6.32.46/arch/x86/include/asm/vdso.h 2011-10-06 09:37:14.000000000 -0400
11717 @@ -25,7 +25,7 @@ extern const char VDSO32_PRELINK[];
11718 #define VDSO32_SYMBOL(base, name) \
11719 ({ \
11720 extern const char VDSO32_##name[]; \
11721 - (void *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
11722 + (void __user *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
11723 })
11724 #endif
11725
11726 diff -urNp linux-2.6.32.46/arch/x86/include/asm/vgtod.h linux-2.6.32.46/arch/x86/include/asm/vgtod.h
11727 --- linux-2.6.32.46/arch/x86/include/asm/vgtod.h 2011-03-27 14:31:47.000000000 -0400
11728 +++ linux-2.6.32.46/arch/x86/include/asm/vgtod.h 2011-04-17 15:56:46.000000000 -0400
11729 @@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
11730 int sysctl_enabled;
11731 struct timezone sys_tz;
11732 struct { /* extract of a clocksource struct */
11733 + char name[8];
11734 cycle_t (*vread)(void);
11735 cycle_t cycle_last;
11736 cycle_t mask;
11737 diff -urNp linux-2.6.32.46/arch/x86/include/asm/vmi.h linux-2.6.32.46/arch/x86/include/asm/vmi.h
11738 --- linux-2.6.32.46/arch/x86/include/asm/vmi.h 2011-03-27 14:31:47.000000000 -0400
11739 +++ linux-2.6.32.46/arch/x86/include/asm/vmi.h 2011-04-17 15:56:46.000000000 -0400
11740 @@ -191,6 +191,7 @@ struct vrom_header {
11741 u8 reserved[96]; /* Reserved for headers */
11742 char vmi_init[8]; /* VMI_Init jump point */
11743 char get_reloc[8]; /* VMI_GetRelocationInfo jump point */
11744 + char rom_data[8048]; /* rest of the option ROM */
11745 } __attribute__((packed));
11746
11747 struct pnp_header {
11748 diff -urNp linux-2.6.32.46/arch/x86/include/asm/vmi_time.h linux-2.6.32.46/arch/x86/include/asm/vmi_time.h
11749 --- linux-2.6.32.46/arch/x86/include/asm/vmi_time.h 2011-03-27 14:31:47.000000000 -0400
11750 +++ linux-2.6.32.46/arch/x86/include/asm/vmi_time.h 2011-08-05 20:33:55.000000000 -0400
11751 @@ -43,7 +43,7 @@ extern struct vmi_timer_ops {
11752 int (*wallclock_updated)(void);
11753 void (*set_alarm)(u32 flags, u64 expiry, u64 period);
11754 void (*cancel_alarm)(u32 flags);
11755 -} vmi_timer_ops;
11756 +} __no_const vmi_timer_ops;
11757
11758 /* Prototypes */
11759 extern void __init vmi_time_init(void);
11760 diff -urNp linux-2.6.32.46/arch/x86/include/asm/vsyscall.h linux-2.6.32.46/arch/x86/include/asm/vsyscall.h
11761 --- linux-2.6.32.46/arch/x86/include/asm/vsyscall.h 2011-03-27 14:31:47.000000000 -0400
11762 +++ linux-2.6.32.46/arch/x86/include/asm/vsyscall.h 2011-04-17 15:56:46.000000000 -0400
11763 @@ -15,9 +15,10 @@ enum vsyscall_num {
11764
11765 #ifdef __KERNEL__
11766 #include <linux/seqlock.h>
11767 +#include <linux/getcpu.h>
11768 +#include <linux/time.h>
11769
11770 #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
11771 -#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
11772
11773 /* Definitions for CONFIG_GENERIC_TIME definitions */
11774 #define __section_vsyscall_gtod_data __attribute__ \
11775 @@ -31,7 +32,6 @@ enum vsyscall_num {
11776 #define VGETCPU_LSL 2
11777
11778 extern int __vgetcpu_mode;
11779 -extern volatile unsigned long __jiffies;
11780
11781 /* kernel space (writeable) */
11782 extern int vgetcpu_mode;
11783 @@ -39,6 +39,9 @@ extern struct timezone sys_tz;
11784
11785 extern void map_vsyscall(void);
11786
11787 +extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
11788 +extern time_t vtime(time_t *t);
11789 +extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
11790 #endif /* __KERNEL__ */
11791
11792 #endif /* _ASM_X86_VSYSCALL_H */
11793 diff -urNp linux-2.6.32.46/arch/x86/include/asm/x86_init.h linux-2.6.32.46/arch/x86/include/asm/x86_init.h
11794 --- linux-2.6.32.46/arch/x86/include/asm/x86_init.h 2011-03-27 14:31:47.000000000 -0400
11795 +++ linux-2.6.32.46/arch/x86/include/asm/x86_init.h 2011-08-05 20:33:55.000000000 -0400
11796 @@ -28,7 +28,7 @@ struct x86_init_mpparse {
11797 void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
11798 void (*find_smp_config)(unsigned int reserve);
11799 void (*get_smp_config)(unsigned int early);
11800 -};
11801 +} __no_const;
11802
11803 /**
11804 * struct x86_init_resources - platform specific resource related ops
11805 @@ -42,7 +42,7 @@ struct x86_init_resources {
11806 void (*probe_roms)(void);
11807 void (*reserve_resources)(void);
11808 char *(*memory_setup)(void);
11809 -};
11810 +} __no_const;
11811
11812 /**
11813 * struct x86_init_irqs - platform specific interrupt setup
11814 @@ -55,7 +55,7 @@ struct x86_init_irqs {
11815 void (*pre_vector_init)(void);
11816 void (*intr_init)(void);
11817 void (*trap_init)(void);
11818 -};
11819 +} __no_const;
11820
11821 /**
11822 * struct x86_init_oem - oem platform specific customizing functions
11823 @@ -65,7 +65,7 @@ struct x86_init_irqs {
11824 struct x86_init_oem {
11825 void (*arch_setup)(void);
11826 void (*banner)(void);
11827 -};
11828 +} __no_const;
11829
11830 /**
11831 * struct x86_init_paging - platform specific paging functions
11832 @@ -75,7 +75,7 @@ struct x86_init_oem {
11833 struct x86_init_paging {
11834 void (*pagetable_setup_start)(pgd_t *base);
11835 void (*pagetable_setup_done)(pgd_t *base);
11836 -};
11837 +} __no_const;
11838
11839 /**
11840 * struct x86_init_timers - platform specific timer setup
11841 @@ -88,7 +88,7 @@ struct x86_init_timers {
11842 void (*setup_percpu_clockev)(void);
11843 void (*tsc_pre_init)(void);
11844 void (*timer_init)(void);
11845 -};
11846 +} __no_const;
11847
11848 /**
11849 * struct x86_init_ops - functions for platform specific setup
11850 @@ -101,7 +101,7 @@ struct x86_init_ops {
11851 struct x86_init_oem oem;
11852 struct x86_init_paging paging;
11853 struct x86_init_timers timers;
11854 -};
11855 +} __no_const;
11856
11857 /**
11858 * struct x86_cpuinit_ops - platform specific cpu hotplug setups
11859 @@ -109,7 +109,7 @@ struct x86_init_ops {
11860 */
11861 struct x86_cpuinit_ops {
11862 void (*setup_percpu_clockev)(void);
11863 -};
11864 +} __no_const;
11865
11866 /**
11867 * struct x86_platform_ops - platform specific runtime functions
11868 @@ -121,7 +121,7 @@ struct x86_platform_ops {
11869 unsigned long (*calibrate_tsc)(void);
11870 unsigned long (*get_wallclock)(void);
11871 int (*set_wallclock)(unsigned long nowtime);
11872 -};
11873 +} __no_const;
11874
11875 extern struct x86_init_ops x86_init;
11876 extern struct x86_cpuinit_ops x86_cpuinit;
11877 diff -urNp linux-2.6.32.46/arch/x86/include/asm/xsave.h linux-2.6.32.46/arch/x86/include/asm/xsave.h
11878 --- linux-2.6.32.46/arch/x86/include/asm/xsave.h 2011-03-27 14:31:47.000000000 -0400
11879 +++ linux-2.6.32.46/arch/x86/include/asm/xsave.h 2011-10-06 09:37:08.000000000 -0400
11880 @@ -56,6 +56,12 @@ static inline int xrstor_checking(struct
11881 static inline int xsave_user(struct xsave_struct __user *buf)
11882 {
11883 int err;
11884 +
11885 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11886 + if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
11887 + buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
11888 +#endif
11889 +
11890 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x27\n"
11891 "2:\n"
11892 ".section .fixup,\"ax\"\n"
11893 @@ -78,10 +84,15 @@ static inline int xsave_user(struct xsav
11894 static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask)
11895 {
11896 int err;
11897 - struct xsave_struct *xstate = ((__force struct xsave_struct *)buf);
11898 + struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)buf);
11899 u32 lmask = mask;
11900 u32 hmask = mask >> 32;
11901
11902 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11903 + if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
11904 + xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
11905 +#endif
11906 +
11907 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
11908 "2:\n"
11909 ".section .fixup,\"ax\"\n"
11910 diff -urNp linux-2.6.32.46/arch/x86/Kconfig linux-2.6.32.46/arch/x86/Kconfig
11911 --- linux-2.6.32.46/arch/x86/Kconfig 2011-03-27 14:31:47.000000000 -0400
11912 +++ linux-2.6.32.46/arch/x86/Kconfig 2011-10-07 08:11:49.000000000 -0400
11913 @@ -223,7 +223,7 @@ config X86_TRAMPOLINE
11914
11915 config X86_32_LAZY_GS
11916 def_bool y
11917 - depends on X86_32 && !CC_STACKPROTECTOR
11918 + depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
11919
11920 config KTIME_SCALAR
11921 def_bool X86_32
11922 @@ -1008,7 +1008,7 @@ choice
11923
11924 config NOHIGHMEM
11925 bool "off"
11926 - depends on !X86_NUMAQ
11927 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
11928 ---help---
11929 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
11930 However, the address space of 32-bit x86 processors is only 4
11931 @@ -1045,7 +1045,7 @@ config NOHIGHMEM
11932
11933 config HIGHMEM4G
11934 bool "4GB"
11935 - depends on !X86_NUMAQ
11936 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
11937 ---help---
11938 Select this if you have a 32-bit processor and between 1 and 4
11939 gigabytes of physical RAM.
11940 @@ -1099,7 +1099,7 @@ config PAGE_OFFSET
11941 hex
11942 default 0xB0000000 if VMSPLIT_3G_OPT
11943 default 0x80000000 if VMSPLIT_2G
11944 - default 0x78000000 if VMSPLIT_2G_OPT
11945 + default 0x70000000 if VMSPLIT_2G_OPT
11946 default 0x40000000 if VMSPLIT_1G
11947 default 0xC0000000
11948 depends on X86_32
11949 @@ -1460,6 +1460,7 @@ config SECCOMP
11950
11951 config CC_STACKPROTECTOR
11952 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
11953 + depends on X86_64 || !PAX_MEMORY_UDEREF
11954 ---help---
11955 This option turns on the -fstack-protector GCC feature. This
11956 feature puts, at the beginning of functions, a canary value on
11957 @@ -1517,6 +1518,7 @@ config KEXEC_JUMP
11958 config PHYSICAL_START
11959 hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
11960 default "0x1000000"
11961 + range 0x400000 0x40000000
11962 ---help---
11963 This gives the physical address where the kernel is loaded.
11964
11965 @@ -1581,6 +1583,7 @@ config PHYSICAL_ALIGN
11966 hex
11967 prompt "Alignment value to which kernel should be aligned" if X86_32
11968 default "0x1000000"
11969 + range 0x400000 0x1000000 if PAX_KERNEXEC
11970 range 0x2000 0x1000000
11971 ---help---
11972 This value puts the alignment restrictions on physical address
11973 @@ -1612,9 +1615,10 @@ config HOTPLUG_CPU
11974 Say N if you want to disable CPU hotplug.
11975
11976 config COMPAT_VDSO
11977 - def_bool y
11978 + def_bool n
11979 prompt "Compat VDSO support"
11980 depends on X86_32 || IA32_EMULATION
11981 + depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
11982 ---help---
11983 Map the 32-bit VDSO to the predictable old-style address too.
11984 ---help---
11985 diff -urNp linux-2.6.32.46/arch/x86/Kconfig.cpu linux-2.6.32.46/arch/x86/Kconfig.cpu
11986 --- linux-2.6.32.46/arch/x86/Kconfig.cpu 2011-03-27 14:31:47.000000000 -0400
11987 +++ linux-2.6.32.46/arch/x86/Kconfig.cpu 2011-04-17 15:56:46.000000000 -0400
11988 @@ -340,7 +340,7 @@ config X86_PPRO_FENCE
11989
11990 config X86_F00F_BUG
11991 def_bool y
11992 - depends on M586MMX || M586TSC || M586 || M486 || M386
11993 + depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
11994
11995 config X86_WP_WORKS_OK
11996 def_bool y
11997 @@ -360,7 +360,7 @@ config X86_POPAD_OK
11998
11999 config X86_ALIGNMENT_16
12000 def_bool y
12001 - depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12002 + depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12003
12004 config X86_INTEL_USERCOPY
12005 def_bool y
12006 @@ -406,7 +406,7 @@ config X86_CMPXCHG64
12007 # generates cmov.
12008 config X86_CMOV
12009 def_bool y
12010 - depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
12011 + depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
12012
12013 config X86_MINIMUM_CPU_FAMILY
12014 int
12015 diff -urNp linux-2.6.32.46/arch/x86/Kconfig.debug linux-2.6.32.46/arch/x86/Kconfig.debug
12016 --- linux-2.6.32.46/arch/x86/Kconfig.debug 2011-03-27 14:31:47.000000000 -0400
12017 +++ linux-2.6.32.46/arch/x86/Kconfig.debug 2011-04-17 15:56:46.000000000 -0400
12018 @@ -99,7 +99,7 @@ config X86_PTDUMP
12019 config DEBUG_RODATA
12020 bool "Write protect kernel read-only data structures"
12021 default y
12022 - depends on DEBUG_KERNEL
12023 + depends on DEBUG_KERNEL && BROKEN
12024 ---help---
12025 Mark the kernel read-only data as write-protected in the pagetables,
12026 in order to catch accidental (and incorrect) writes to such const
12027 diff -urNp linux-2.6.32.46/arch/x86/kernel/acpi/realmode/Makefile linux-2.6.32.46/arch/x86/kernel/acpi/realmode/Makefile
12028 --- linux-2.6.32.46/arch/x86/kernel/acpi/realmode/Makefile 2011-03-27 14:31:47.000000000 -0400
12029 +++ linux-2.6.32.46/arch/x86/kernel/acpi/realmode/Makefile 2011-08-07 14:38:58.000000000 -0400
12030 @@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os
12031 $(call cc-option, -fno-stack-protector) \
12032 $(call cc-option, -mpreferred-stack-boundary=2)
12033 KBUILD_CFLAGS += $(call cc-option, -m32)
12034 +ifdef CONSTIFY_PLUGIN
12035 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
12036 +endif
12037 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
12038 GCOV_PROFILE := n
12039
12040 diff -urNp linux-2.6.32.46/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.32.46/arch/x86/kernel/acpi/realmode/wakeup.S
12041 --- linux-2.6.32.46/arch/x86/kernel/acpi/realmode/wakeup.S 2011-03-27 14:31:47.000000000 -0400
12042 +++ linux-2.6.32.46/arch/x86/kernel/acpi/realmode/wakeup.S 2011-07-01 18:53:40.000000000 -0400
12043 @@ -91,6 +91,9 @@ _start:
12044 /* Do any other stuff... */
12045
12046 #ifndef CONFIG_64BIT
12047 + /* Recheck NX bit overrides (64bit path does this in trampoline) */
12048 + call verify_cpu
12049 +
12050 /* This could also be done in C code... */
12051 movl pmode_cr3, %eax
12052 movl %eax, %cr3
12053 @@ -104,7 +107,7 @@ _start:
12054 movl %eax, %ecx
12055 orl %edx, %ecx
12056 jz 1f
12057 - movl $0xc0000080, %ecx
12058 + mov $MSR_EFER, %ecx
12059 wrmsr
12060 1:
12061
12062 @@ -114,6 +117,7 @@ _start:
12063 movl pmode_cr0, %eax
12064 movl %eax, %cr0
12065 jmp pmode_return
12066 +# include "../../verify_cpu.S"
12067 #else
12068 pushw $0
12069 pushw trampoline_segment
12070 diff -urNp linux-2.6.32.46/arch/x86/kernel/acpi/sleep.c linux-2.6.32.46/arch/x86/kernel/acpi/sleep.c
12071 --- linux-2.6.32.46/arch/x86/kernel/acpi/sleep.c 2011-03-27 14:31:47.000000000 -0400
12072 +++ linux-2.6.32.46/arch/x86/kernel/acpi/sleep.c 2011-07-01 19:01:34.000000000 -0400
12073 @@ -11,11 +11,12 @@
12074 #include <linux/cpumask.h>
12075 #include <asm/segment.h>
12076 #include <asm/desc.h>
12077 +#include <asm/e820.h>
12078
12079 #include "realmode/wakeup.h"
12080 #include "sleep.h"
12081
12082 -unsigned long acpi_wakeup_address;
12083 +unsigned long acpi_wakeup_address = 0x2000;
12084 unsigned long acpi_realmode_flags;
12085
12086 /* address in low memory of the wakeup routine. */
12087 @@ -98,9 +99,13 @@ int acpi_save_state_mem(void)
12088 #else /* CONFIG_64BIT */
12089 header->trampoline_segment = setup_trampoline() >> 4;
12090 #ifdef CONFIG_SMP
12091 - stack_start.sp = temp_stack + sizeof(temp_stack);
12092 + stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
12093 +
12094 + pax_open_kernel();
12095 early_gdt_descr.address =
12096 (unsigned long)get_cpu_gdt_table(smp_processor_id());
12097 + pax_close_kernel();
12098 +
12099 initial_gs = per_cpu_offset(smp_processor_id());
12100 #endif
12101 initial_code = (unsigned long)wakeup_long64;
12102 @@ -134,14 +139,8 @@ void __init acpi_reserve_bootmem(void)
12103 return;
12104 }
12105
12106 - acpi_realmode = (unsigned long)alloc_bootmem_low(WAKEUP_SIZE);
12107 -
12108 - if (!acpi_realmode) {
12109 - printk(KERN_ERR "ACPI: Cannot allocate lowmem, S3 disabled.\n");
12110 - return;
12111 - }
12112 -
12113 - acpi_wakeup_address = virt_to_phys((void *)acpi_realmode);
12114 + reserve_early(acpi_wakeup_address, acpi_wakeup_address + WAKEUP_SIZE, "ACPI Wakeup Code");
12115 + acpi_realmode = (unsigned long)__va(acpi_wakeup_address);;
12116 }
12117
12118
12119 diff -urNp linux-2.6.32.46/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.32.46/arch/x86/kernel/acpi/wakeup_32.S
12120 --- linux-2.6.32.46/arch/x86/kernel/acpi/wakeup_32.S 2011-03-27 14:31:47.000000000 -0400
12121 +++ linux-2.6.32.46/arch/x86/kernel/acpi/wakeup_32.S 2011-04-17 15:56:46.000000000 -0400
12122 @@ -30,13 +30,11 @@ wakeup_pmode_return:
12123 # and restore the stack ... but you need gdt for this to work
12124 movl saved_context_esp, %esp
12125
12126 - movl %cs:saved_magic, %eax
12127 - cmpl $0x12345678, %eax
12128 + cmpl $0x12345678, saved_magic
12129 jne bogus_magic
12130
12131 # jump to place where we left off
12132 - movl saved_eip, %eax
12133 - jmp *%eax
12134 + jmp *(saved_eip)
12135
12136 bogus_magic:
12137 jmp bogus_magic
12138 diff -urNp linux-2.6.32.46/arch/x86/kernel/alternative.c linux-2.6.32.46/arch/x86/kernel/alternative.c
12139 --- linux-2.6.32.46/arch/x86/kernel/alternative.c 2011-03-27 14:31:47.000000000 -0400
12140 +++ linux-2.6.32.46/arch/x86/kernel/alternative.c 2011-04-17 15:56:46.000000000 -0400
12141 @@ -407,7 +407,7 @@ void __init_or_module apply_paravirt(str
12142
12143 BUG_ON(p->len > MAX_PATCH_LEN);
12144 /* prep the buffer with the original instructions */
12145 - memcpy(insnbuf, p->instr, p->len);
12146 + memcpy(insnbuf, ktla_ktva(p->instr), p->len);
12147 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
12148 (unsigned long)p->instr, p->len);
12149
12150 @@ -475,7 +475,7 @@ void __init alternative_instructions(voi
12151 if (smp_alt_once)
12152 free_init_pages("SMP alternatives",
12153 (unsigned long)__smp_locks,
12154 - (unsigned long)__smp_locks_end);
12155 + PAGE_ALIGN((unsigned long)__smp_locks_end));
12156
12157 restart_nmi();
12158 }
12159 @@ -492,13 +492,17 @@ void __init alternative_instructions(voi
12160 * instructions. And on the local CPU you need to be protected again NMI or MCE
12161 * handlers seeing an inconsistent instruction while you patch.
12162 */
12163 -static void *__init_or_module text_poke_early(void *addr, const void *opcode,
12164 +static void *__kprobes text_poke_early(void *addr, const void *opcode,
12165 size_t len)
12166 {
12167 unsigned long flags;
12168 local_irq_save(flags);
12169 - memcpy(addr, opcode, len);
12170 +
12171 + pax_open_kernel();
12172 + memcpy(ktla_ktva(addr), opcode, len);
12173 sync_core();
12174 + pax_close_kernel();
12175 +
12176 local_irq_restore(flags);
12177 /* Could also do a CLFLUSH here to speed up CPU recovery; but
12178 that causes hangs on some VIA CPUs. */
12179 @@ -520,35 +524,21 @@ static void *__init_or_module text_poke_
12180 */
12181 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
12182 {
12183 - unsigned long flags;
12184 - char *vaddr;
12185 + unsigned char *vaddr = ktla_ktva(addr);
12186 struct page *pages[2];
12187 - int i;
12188 + size_t i;
12189
12190 if (!core_kernel_text((unsigned long)addr)) {
12191 - pages[0] = vmalloc_to_page(addr);
12192 - pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
12193 + pages[0] = vmalloc_to_page(vaddr);
12194 + pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
12195 } else {
12196 - pages[0] = virt_to_page(addr);
12197 + pages[0] = virt_to_page(vaddr);
12198 WARN_ON(!PageReserved(pages[0]));
12199 - pages[1] = virt_to_page(addr + PAGE_SIZE);
12200 + pages[1] = virt_to_page(vaddr + PAGE_SIZE);
12201 }
12202 BUG_ON(!pages[0]);
12203 - local_irq_save(flags);
12204 - set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
12205 - if (pages[1])
12206 - set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
12207 - vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
12208 - memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
12209 - clear_fixmap(FIX_TEXT_POKE0);
12210 - if (pages[1])
12211 - clear_fixmap(FIX_TEXT_POKE1);
12212 - local_flush_tlb();
12213 - sync_core();
12214 - /* Could also do a CLFLUSH here to speed up CPU recovery; but
12215 - that causes hangs on some VIA CPUs. */
12216 + text_poke_early(addr, opcode, len);
12217 for (i = 0; i < len; i++)
12218 - BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
12219 - local_irq_restore(flags);
12220 + BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
12221 return addr;
12222 }
12223 diff -urNp linux-2.6.32.46/arch/x86/kernel/amd_iommu.c linux-2.6.32.46/arch/x86/kernel/amd_iommu.c
12224 --- linux-2.6.32.46/arch/x86/kernel/amd_iommu.c 2011-03-27 14:31:47.000000000 -0400
12225 +++ linux-2.6.32.46/arch/x86/kernel/amd_iommu.c 2011-04-17 15:56:46.000000000 -0400
12226 @@ -2076,7 +2076,7 @@ static void prealloc_protection_domains(
12227 }
12228 }
12229
12230 -static struct dma_map_ops amd_iommu_dma_ops = {
12231 +static const struct dma_map_ops amd_iommu_dma_ops = {
12232 .alloc_coherent = alloc_coherent,
12233 .free_coherent = free_coherent,
12234 .map_page = map_page,
12235 diff -urNp linux-2.6.32.46/arch/x86/kernel/apic/apic.c linux-2.6.32.46/arch/x86/kernel/apic/apic.c
12236 --- linux-2.6.32.46/arch/x86/kernel/apic/apic.c 2011-03-27 14:31:47.000000000 -0400
12237 +++ linux-2.6.32.46/arch/x86/kernel/apic/apic.c 2011-08-17 20:00:16.000000000 -0400
12238 @@ -170,7 +170,7 @@ int first_system_vector = 0xfe;
12239 /*
12240 * Debug level, exported for io_apic.c
12241 */
12242 -unsigned int apic_verbosity;
12243 +int apic_verbosity;
12244
12245 int pic_mode;
12246
12247 @@ -1794,7 +1794,7 @@ void smp_error_interrupt(struct pt_regs
12248 apic_write(APIC_ESR, 0);
12249 v1 = apic_read(APIC_ESR);
12250 ack_APIC_irq();
12251 - atomic_inc(&irq_err_count);
12252 + atomic_inc_unchecked(&irq_err_count);
12253
12254 /*
12255 * Here is what the APIC error bits mean:
12256 @@ -2184,6 +2184,8 @@ static int __cpuinit apic_cluster_num(vo
12257 u16 *bios_cpu_apicid;
12258 DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
12259
12260 + pax_track_stack();
12261 +
12262 bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
12263 bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
12264
12265 diff -urNp linux-2.6.32.46/arch/x86/kernel/apic/io_apic.c linux-2.6.32.46/arch/x86/kernel/apic/io_apic.c
12266 --- linux-2.6.32.46/arch/x86/kernel/apic/io_apic.c 2011-03-27 14:31:47.000000000 -0400
12267 +++ linux-2.6.32.46/arch/x86/kernel/apic/io_apic.c 2011-05-04 17:56:20.000000000 -0400
12268 @@ -716,7 +716,7 @@ struct IO_APIC_route_entry **alloc_ioapi
12269 ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
12270 GFP_ATOMIC);
12271 if (!ioapic_entries)
12272 - return 0;
12273 + return NULL;
12274
12275 for (apic = 0; apic < nr_ioapics; apic++) {
12276 ioapic_entries[apic] =
12277 @@ -733,7 +733,7 @@ nomem:
12278 kfree(ioapic_entries[apic]);
12279 kfree(ioapic_entries);
12280
12281 - return 0;
12282 + return NULL;
12283 }
12284
12285 /*
12286 @@ -1150,7 +1150,7 @@ int IO_APIC_get_PCI_irq_vector(int bus,
12287 }
12288 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
12289
12290 -void lock_vector_lock(void)
12291 +void lock_vector_lock(void) __acquires(vector_lock)
12292 {
12293 /* Used to the online set of cpus does not change
12294 * during assign_irq_vector.
12295 @@ -1158,7 +1158,7 @@ void lock_vector_lock(void)
12296 spin_lock(&vector_lock);
12297 }
12298
12299 -void unlock_vector_lock(void)
12300 +void unlock_vector_lock(void) __releases(vector_lock)
12301 {
12302 spin_unlock(&vector_lock);
12303 }
12304 @@ -2542,7 +2542,7 @@ static void ack_apic_edge(unsigned int i
12305 ack_APIC_irq();
12306 }
12307
12308 -atomic_t irq_mis_count;
12309 +atomic_unchecked_t irq_mis_count;
12310
12311 static void ack_apic_level(unsigned int irq)
12312 {
12313 @@ -2626,7 +2626,7 @@ static void ack_apic_level(unsigned int
12314
12315 /* Tail end of version 0x11 I/O APIC bug workaround */
12316 if (!(v & (1 << (i & 0x1f)))) {
12317 - atomic_inc(&irq_mis_count);
12318 + atomic_inc_unchecked(&irq_mis_count);
12319 spin_lock(&ioapic_lock);
12320 __mask_and_edge_IO_APIC_irq(cfg);
12321 __unmask_and_level_IO_APIC_irq(cfg);
12322 diff -urNp linux-2.6.32.46/arch/x86/kernel/apm_32.c linux-2.6.32.46/arch/x86/kernel/apm_32.c
12323 --- linux-2.6.32.46/arch/x86/kernel/apm_32.c 2011-03-27 14:31:47.000000000 -0400
12324 +++ linux-2.6.32.46/arch/x86/kernel/apm_32.c 2011-04-23 12:56:10.000000000 -0400
12325 @@ -410,7 +410,7 @@ static DEFINE_SPINLOCK(user_list_lock);
12326 * This is for buggy BIOS's that refer to (real mode) segment 0x40
12327 * even though they are called in protected mode.
12328 */
12329 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
12330 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
12331 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
12332
12333 static const char driver_version[] = "1.16ac"; /* no spaces */
12334 @@ -588,7 +588,10 @@ static long __apm_bios_call(void *_call)
12335 BUG_ON(cpu != 0);
12336 gdt = get_cpu_gdt_table(cpu);
12337 save_desc_40 = gdt[0x40 / 8];
12338 +
12339 + pax_open_kernel();
12340 gdt[0x40 / 8] = bad_bios_desc;
12341 + pax_close_kernel();
12342
12343 apm_irq_save(flags);
12344 APM_DO_SAVE_SEGS;
12345 @@ -597,7 +600,11 @@ static long __apm_bios_call(void *_call)
12346 &call->esi);
12347 APM_DO_RESTORE_SEGS;
12348 apm_irq_restore(flags);
12349 +
12350 + pax_open_kernel();
12351 gdt[0x40 / 8] = save_desc_40;
12352 + pax_close_kernel();
12353 +
12354 put_cpu();
12355
12356 return call->eax & 0xff;
12357 @@ -664,7 +671,10 @@ static long __apm_bios_call_simple(void
12358 BUG_ON(cpu != 0);
12359 gdt = get_cpu_gdt_table(cpu);
12360 save_desc_40 = gdt[0x40 / 8];
12361 +
12362 + pax_open_kernel();
12363 gdt[0x40 / 8] = bad_bios_desc;
12364 + pax_close_kernel();
12365
12366 apm_irq_save(flags);
12367 APM_DO_SAVE_SEGS;
12368 @@ -672,7 +682,11 @@ static long __apm_bios_call_simple(void
12369 &call->eax);
12370 APM_DO_RESTORE_SEGS;
12371 apm_irq_restore(flags);
12372 +
12373 + pax_open_kernel();
12374 gdt[0x40 / 8] = save_desc_40;
12375 + pax_close_kernel();
12376 +
12377 put_cpu();
12378 return error;
12379 }
12380 @@ -975,7 +989,7 @@ recalc:
12381
12382 static void apm_power_off(void)
12383 {
12384 - unsigned char po_bios_call[] = {
12385 + const unsigned char po_bios_call[] = {
12386 0xb8, 0x00, 0x10, /* movw $0x1000,ax */
12387 0x8e, 0xd0, /* movw ax,ss */
12388 0xbc, 0x00, 0xf0, /* movw $0xf000,sp */
12389 @@ -2357,12 +2371,15 @@ static int __init apm_init(void)
12390 * code to that CPU.
12391 */
12392 gdt = get_cpu_gdt_table(0);
12393 +
12394 + pax_open_kernel();
12395 set_desc_base(&gdt[APM_CS >> 3],
12396 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
12397 set_desc_base(&gdt[APM_CS_16 >> 3],
12398 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
12399 set_desc_base(&gdt[APM_DS >> 3],
12400 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
12401 + pax_close_kernel();
12402
12403 proc_create("apm", 0, NULL, &apm_file_ops);
12404
12405 diff -urNp linux-2.6.32.46/arch/x86/kernel/asm-offsets_32.c linux-2.6.32.46/arch/x86/kernel/asm-offsets_32.c
12406 --- linux-2.6.32.46/arch/x86/kernel/asm-offsets_32.c 2011-03-27 14:31:47.000000000 -0400
12407 +++ linux-2.6.32.46/arch/x86/kernel/asm-offsets_32.c 2011-05-16 21:46:57.000000000 -0400
12408 @@ -51,7 +51,6 @@ void foo(void)
12409 OFFSET(CPUINFO_x86_vendor_id, cpuinfo_x86, x86_vendor_id);
12410 BLANK();
12411
12412 - OFFSET(TI_task, thread_info, task);
12413 OFFSET(TI_exec_domain, thread_info, exec_domain);
12414 OFFSET(TI_flags, thread_info, flags);
12415 OFFSET(TI_status, thread_info, status);
12416 @@ -60,6 +59,8 @@ void foo(void)
12417 OFFSET(TI_restart_block, thread_info, restart_block);
12418 OFFSET(TI_sysenter_return, thread_info, sysenter_return);
12419 OFFSET(TI_cpu, thread_info, cpu);
12420 + OFFSET(TI_lowest_stack, thread_info, lowest_stack);
12421 + DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
12422 BLANK();
12423
12424 OFFSET(GDS_size, desc_ptr, size);
12425 @@ -99,6 +100,7 @@ void foo(void)
12426
12427 DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
12428 DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
12429 + DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
12430 DEFINE(PTRS_PER_PTE, PTRS_PER_PTE);
12431 DEFINE(PTRS_PER_PMD, PTRS_PER_PMD);
12432 DEFINE(PTRS_PER_PGD, PTRS_PER_PGD);
12433 @@ -115,6 +117,11 @@ void foo(void)
12434 OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
12435 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
12436 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
12437 +
12438 +#ifdef CONFIG_PAX_KERNEXEC
12439 + OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
12440 +#endif
12441 +
12442 #endif
12443
12444 #ifdef CONFIG_XEN
12445 diff -urNp linux-2.6.32.46/arch/x86/kernel/asm-offsets_64.c linux-2.6.32.46/arch/x86/kernel/asm-offsets_64.c
12446 --- linux-2.6.32.46/arch/x86/kernel/asm-offsets_64.c 2011-03-27 14:31:47.000000000 -0400
12447 +++ linux-2.6.32.46/arch/x86/kernel/asm-offsets_64.c 2011-08-23 20:24:19.000000000 -0400
12448 @@ -44,6 +44,8 @@ int main(void)
12449 ENTRY(addr_limit);
12450 ENTRY(preempt_count);
12451 ENTRY(status);
12452 + ENTRY(lowest_stack);
12453 + DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
12454 #ifdef CONFIG_IA32_EMULATION
12455 ENTRY(sysenter_return);
12456 #endif
12457 @@ -63,6 +65,18 @@ int main(void)
12458 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
12459 OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
12460 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
12461 +
12462 +#ifdef CONFIG_PAX_KERNEXEC
12463 + OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
12464 + OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
12465 +#endif
12466 +
12467 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12468 + OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
12469 + OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
12470 + OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
12471 +#endif
12472 +
12473 #endif
12474
12475
12476 @@ -115,6 +129,7 @@ int main(void)
12477 ENTRY(cr8);
12478 BLANK();
12479 #undef ENTRY
12480 + DEFINE(TSS_size, sizeof(struct tss_struct));
12481 DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
12482 BLANK();
12483 DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
12484 @@ -130,6 +145,7 @@ int main(void)
12485
12486 BLANK();
12487 DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
12488 + DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
12489 #ifdef CONFIG_XEN
12490 BLANK();
12491 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
12492 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/amd.c linux-2.6.32.46/arch/x86/kernel/cpu/amd.c
12493 --- linux-2.6.32.46/arch/x86/kernel/cpu/amd.c 2011-06-25 12:55:34.000000000 -0400
12494 +++ linux-2.6.32.46/arch/x86/kernel/cpu/amd.c 2011-06-25 12:56:37.000000000 -0400
12495 @@ -602,7 +602,7 @@ static unsigned int __cpuinit amd_size_c
12496 unsigned int size)
12497 {
12498 /* AMD errata T13 (order #21922) */
12499 - if ((c->x86 == 6)) {
12500 + if (c->x86 == 6) {
12501 /* Duron Rev A0 */
12502 if (c->x86_model == 3 && c->x86_mask == 0)
12503 size = 64;
12504 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/common.c linux-2.6.32.46/arch/x86/kernel/cpu/common.c
12505 --- linux-2.6.32.46/arch/x86/kernel/cpu/common.c 2011-03-27 14:31:47.000000000 -0400
12506 +++ linux-2.6.32.46/arch/x86/kernel/cpu/common.c 2011-05-11 18:25:15.000000000 -0400
12507 @@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
12508
12509 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
12510
12511 -DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
12512 -#ifdef CONFIG_X86_64
12513 - /*
12514 - * We need valid kernel segments for data and code in long mode too
12515 - * IRET will check the segment types kkeil 2000/10/28
12516 - * Also sysret mandates a special GDT layout
12517 - *
12518 - * TLS descriptors are currently at a different place compared to i386.
12519 - * Hopefully nobody expects them at a fixed place (Wine?)
12520 - */
12521 - [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
12522 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
12523 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
12524 - [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
12525 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
12526 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
12527 -#else
12528 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
12529 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12530 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
12531 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
12532 - /*
12533 - * Segments used for calling PnP BIOS have byte granularity.
12534 - * They code segments and data segments have fixed 64k limits,
12535 - * the transfer segment sizes are set at run time.
12536 - */
12537 - /* 32-bit code */
12538 - [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
12539 - /* 16-bit code */
12540 - [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
12541 - /* 16-bit data */
12542 - [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
12543 - /* 16-bit data */
12544 - [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
12545 - /* 16-bit data */
12546 - [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
12547 - /*
12548 - * The APM segments have byte granularity and their bases
12549 - * are set at run time. All have 64k limits.
12550 - */
12551 - /* 32-bit code */
12552 - [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
12553 - /* 16-bit code */
12554 - [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
12555 - /* data */
12556 - [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
12557 -
12558 - [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12559 - [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12560 - GDT_STACK_CANARY_INIT
12561 -#endif
12562 -} };
12563 -EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
12564 -
12565 static int __init x86_xsave_setup(char *s)
12566 {
12567 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
12568 @@ -344,7 +290,7 @@ void switch_to_new_gdt(int cpu)
12569 {
12570 struct desc_ptr gdt_descr;
12571
12572 - gdt_descr.address = (long)get_cpu_gdt_table(cpu);
12573 + gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
12574 gdt_descr.size = GDT_SIZE - 1;
12575 load_gdt(&gdt_descr);
12576 /* Reload the per-cpu base */
12577 @@ -798,6 +744,10 @@ static void __cpuinit identify_cpu(struc
12578 /* Filter out anything that depends on CPUID levels we don't have */
12579 filter_cpuid_features(c, true);
12580
12581 +#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
12582 + setup_clear_cpu_cap(X86_FEATURE_SEP);
12583 +#endif
12584 +
12585 /* If the model name is still unset, do table lookup. */
12586 if (!c->x86_model_id[0]) {
12587 const char *p;
12588 @@ -980,6 +930,9 @@ static __init int setup_disablecpuid(cha
12589 }
12590 __setup("clearcpuid=", setup_disablecpuid);
12591
12592 +DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
12593 +EXPORT_PER_CPU_SYMBOL(current_tinfo);
12594 +
12595 #ifdef CONFIG_X86_64
12596 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
12597
12598 @@ -995,7 +948,7 @@ DEFINE_PER_CPU(struct task_struct *, cur
12599 EXPORT_PER_CPU_SYMBOL(current_task);
12600
12601 DEFINE_PER_CPU(unsigned long, kernel_stack) =
12602 - (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
12603 + (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
12604 EXPORT_PER_CPU_SYMBOL(kernel_stack);
12605
12606 DEFINE_PER_CPU(char *, irq_stack_ptr) =
12607 @@ -1060,7 +1013,7 @@ struct pt_regs * __cpuinit idle_regs(str
12608 {
12609 memset(regs, 0, sizeof(struct pt_regs));
12610 regs->fs = __KERNEL_PERCPU;
12611 - regs->gs = __KERNEL_STACK_CANARY;
12612 + savesegment(gs, regs->gs);
12613
12614 return regs;
12615 }
12616 @@ -1101,7 +1054,7 @@ void __cpuinit cpu_init(void)
12617 int i;
12618
12619 cpu = stack_smp_processor_id();
12620 - t = &per_cpu(init_tss, cpu);
12621 + t = init_tss + cpu;
12622 orig_ist = &per_cpu(orig_ist, cpu);
12623
12624 #ifdef CONFIG_NUMA
12625 @@ -1127,7 +1080,7 @@ void __cpuinit cpu_init(void)
12626 switch_to_new_gdt(cpu);
12627 loadsegment(fs, 0);
12628
12629 - load_idt((const struct desc_ptr *)&idt_descr);
12630 + load_idt(&idt_descr);
12631
12632 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
12633 syscall_init();
12634 @@ -1136,7 +1089,6 @@ void __cpuinit cpu_init(void)
12635 wrmsrl(MSR_KERNEL_GS_BASE, 0);
12636 barrier();
12637
12638 - check_efer();
12639 if (cpu != 0)
12640 enable_x2apic();
12641
12642 @@ -1199,7 +1151,7 @@ void __cpuinit cpu_init(void)
12643 {
12644 int cpu = smp_processor_id();
12645 struct task_struct *curr = current;
12646 - struct tss_struct *t = &per_cpu(init_tss, cpu);
12647 + struct tss_struct *t = init_tss + cpu;
12648 struct thread_struct *thread = &curr->thread;
12649
12650 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
12651 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/intel.c linux-2.6.32.46/arch/x86/kernel/cpu/intel.c
12652 --- linux-2.6.32.46/arch/x86/kernel/cpu/intel.c 2011-03-27 14:31:47.000000000 -0400
12653 +++ linux-2.6.32.46/arch/x86/kernel/cpu/intel.c 2011-04-17 15:56:46.000000000 -0400
12654 @@ -162,7 +162,7 @@ static void __cpuinit trap_init_f00f_bug
12655 * Update the IDT descriptor and reload the IDT so that
12656 * it uses the read-only mapped virtual address.
12657 */
12658 - idt_descr.address = fix_to_virt(FIX_F00F_IDT);
12659 + idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
12660 load_idt(&idt_descr);
12661 }
12662 #endif
12663 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.32.46/arch/x86/kernel/cpu/intel_cacheinfo.c
12664 --- linux-2.6.32.46/arch/x86/kernel/cpu/intel_cacheinfo.c 2011-03-27 14:31:47.000000000 -0400
12665 +++ linux-2.6.32.46/arch/x86/kernel/cpu/intel_cacheinfo.c 2011-04-17 15:56:46.000000000 -0400
12666 @@ -921,7 +921,7 @@ static ssize_t store(struct kobject *kob
12667 return ret;
12668 }
12669
12670 -static struct sysfs_ops sysfs_ops = {
12671 +static const struct sysfs_ops sysfs_ops = {
12672 .show = show,
12673 .store = store,
12674 };
12675 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/Makefile linux-2.6.32.46/arch/x86/kernel/cpu/Makefile
12676 --- linux-2.6.32.46/arch/x86/kernel/cpu/Makefile 2011-03-27 14:31:47.000000000 -0400
12677 +++ linux-2.6.32.46/arch/x86/kernel/cpu/Makefile 2011-04-17 15:56:46.000000000 -0400
12678 @@ -7,10 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
12679 CFLAGS_REMOVE_common.o = -pg
12680 endif
12681
12682 -# Make sure load_percpu_segment has no stackprotector
12683 -nostackp := $(call cc-option, -fno-stack-protector)
12684 -CFLAGS_common.o := $(nostackp)
12685 -
12686 obj-y := intel_cacheinfo.o addon_cpuid_features.o
12687 obj-y += proc.o capflags.o powerflags.o common.o
12688 obj-y += vmware.o hypervisor.o sched.o
12689 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce_amd.c
12690 --- linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce_amd.c 2011-05-23 16:56:59.000000000 -0400
12691 +++ linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce_amd.c 2011-05-23 16:57:13.000000000 -0400
12692 @@ -385,7 +385,7 @@ static ssize_t store(struct kobject *kob
12693 return ret;
12694 }
12695
12696 -static struct sysfs_ops threshold_ops = {
12697 +static const struct sysfs_ops threshold_ops = {
12698 .show = show,
12699 .store = store,
12700 };
12701 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce.c
12702 --- linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce.c 2011-03-27 14:31:47.000000000 -0400
12703 +++ linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-04 17:56:20.000000000 -0400
12704 @@ -43,6 +43,7 @@
12705 #include <asm/ipi.h>
12706 #include <asm/mce.h>
12707 #include <asm/msr.h>
12708 +#include <asm/local.h>
12709
12710 #include "mce-internal.h"
12711
12712 @@ -187,7 +188,7 @@ static void print_mce(struct mce *m)
12713 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
12714 m->cs, m->ip);
12715
12716 - if (m->cs == __KERNEL_CS)
12717 + if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
12718 print_symbol("{%s}", m->ip);
12719 pr_cont("\n");
12720 }
12721 @@ -221,10 +222,10 @@ static void print_mce_tail(void)
12722
12723 #define PANIC_TIMEOUT 5 /* 5 seconds */
12724
12725 -static atomic_t mce_paniced;
12726 +static atomic_unchecked_t mce_paniced;
12727
12728 static int fake_panic;
12729 -static atomic_t mce_fake_paniced;
12730 +static atomic_unchecked_t mce_fake_paniced;
12731
12732 /* Panic in progress. Enable interrupts and wait for final IPI */
12733 static void wait_for_panic(void)
12734 @@ -248,7 +249,7 @@ static void mce_panic(char *msg, struct
12735 /*
12736 * Make sure only one CPU runs in machine check panic
12737 */
12738 - if (atomic_inc_return(&mce_paniced) > 1)
12739 + if (atomic_inc_return_unchecked(&mce_paniced) > 1)
12740 wait_for_panic();
12741 barrier();
12742
12743 @@ -256,7 +257,7 @@ static void mce_panic(char *msg, struct
12744 console_verbose();
12745 } else {
12746 /* Don't log too much for fake panic */
12747 - if (atomic_inc_return(&mce_fake_paniced) > 1)
12748 + if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
12749 return;
12750 }
12751 print_mce_head();
12752 @@ -616,7 +617,7 @@ static int mce_timed_out(u64 *t)
12753 * might have been modified by someone else.
12754 */
12755 rmb();
12756 - if (atomic_read(&mce_paniced))
12757 + if (atomic_read_unchecked(&mce_paniced))
12758 wait_for_panic();
12759 if (!monarch_timeout)
12760 goto out;
12761 @@ -1429,14 +1430,14 @@ void __cpuinit mcheck_init(struct cpuinf
12762 */
12763
12764 static DEFINE_SPINLOCK(mce_state_lock);
12765 -static int open_count; /* #times opened */
12766 +static local_t open_count; /* #times opened */
12767 static int open_exclu; /* already open exclusive? */
12768
12769 static int mce_open(struct inode *inode, struct file *file)
12770 {
12771 spin_lock(&mce_state_lock);
12772
12773 - if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
12774 + if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
12775 spin_unlock(&mce_state_lock);
12776
12777 return -EBUSY;
12778 @@ -1444,7 +1445,7 @@ static int mce_open(struct inode *inode,
12779
12780 if (file->f_flags & O_EXCL)
12781 open_exclu = 1;
12782 - open_count++;
12783 + local_inc(&open_count);
12784
12785 spin_unlock(&mce_state_lock);
12786
12787 @@ -1455,7 +1456,7 @@ static int mce_release(struct inode *ino
12788 {
12789 spin_lock(&mce_state_lock);
12790
12791 - open_count--;
12792 + local_dec(&open_count);
12793 open_exclu = 0;
12794
12795 spin_unlock(&mce_state_lock);
12796 @@ -2082,7 +2083,7 @@ struct dentry *mce_get_debugfs_dir(void)
12797 static void mce_reset(void)
12798 {
12799 cpu_missing = 0;
12800 - atomic_set(&mce_fake_paniced, 0);
12801 + atomic_set_unchecked(&mce_fake_paniced, 0);
12802 atomic_set(&mce_executing, 0);
12803 atomic_set(&mce_callin, 0);
12804 atomic_set(&global_nwo, 0);
12805 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce-inject.c linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce-inject.c
12806 --- linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-03-27 14:31:47.000000000 -0400
12807 +++ linux-2.6.32.46/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-08-05 20:33:55.000000000 -0400
12808 @@ -211,7 +211,9 @@ static ssize_t mce_write(struct file *fi
12809 static int inject_init(void)
12810 {
12811 printk(KERN_INFO "Machine check injector initialized\n");
12812 - mce_chrdev_ops.write = mce_write;
12813 + pax_open_kernel();
12814 + *(void **)&mce_chrdev_ops.write = mce_write;
12815 + pax_close_kernel();
12816 register_die_notifier(&mce_raise_nb);
12817 return 0;
12818 }
12819 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/amd.c
12820 --- linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/amd.c 2011-03-27 14:31:47.000000000 -0400
12821 +++ linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/amd.c 2011-04-17 15:56:46.000000000 -0400
12822 @@ -108,7 +108,7 @@ amd_validate_add_page(unsigned long base
12823 return 0;
12824 }
12825
12826 -static struct mtrr_ops amd_mtrr_ops = {
12827 +static const struct mtrr_ops amd_mtrr_ops = {
12828 .vendor = X86_VENDOR_AMD,
12829 .set = amd_set_mtrr,
12830 .get = amd_get_mtrr,
12831 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/centaur.c
12832 --- linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/centaur.c 2011-03-27 14:31:47.000000000 -0400
12833 +++ linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/centaur.c 2011-04-17 15:56:46.000000000 -0400
12834 @@ -110,7 +110,7 @@ centaur_validate_add_page(unsigned long
12835 return 0;
12836 }
12837
12838 -static struct mtrr_ops centaur_mtrr_ops = {
12839 +static const struct mtrr_ops centaur_mtrr_ops = {
12840 .vendor = X86_VENDOR_CENTAUR,
12841 .set = centaur_set_mcr,
12842 .get = centaur_get_mcr,
12843 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/cyrix.c
12844 --- linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/cyrix.c 2011-03-27 14:31:47.000000000 -0400
12845 +++ linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/cyrix.c 2011-04-17 15:56:46.000000000 -0400
12846 @@ -265,7 +265,7 @@ static void cyrix_set_all(void)
12847 post_set();
12848 }
12849
12850 -static struct mtrr_ops cyrix_mtrr_ops = {
12851 +static const struct mtrr_ops cyrix_mtrr_ops = {
12852 .vendor = X86_VENDOR_CYRIX,
12853 .set_all = cyrix_set_all,
12854 .set = cyrix_set_arr,
12855 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/generic.c
12856 --- linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/generic.c 2011-03-27 14:31:47.000000000 -0400
12857 +++ linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/generic.c 2011-04-23 12:56:10.000000000 -0400
12858 @@ -752,7 +752,7 @@ int positive_have_wrcomb(void)
12859 /*
12860 * Generic structure...
12861 */
12862 -struct mtrr_ops generic_mtrr_ops = {
12863 +const struct mtrr_ops generic_mtrr_ops = {
12864 .use_intel_if = 1,
12865 .set_all = generic_set_all,
12866 .get = generic_get_mtrr,
12867 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/main.c
12868 --- linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/main.c 2011-04-17 17:00:52.000000000 -0400
12869 +++ linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/main.c 2011-04-17 17:03:05.000000000 -0400
12870 @@ -60,14 +60,14 @@ static DEFINE_MUTEX(mtrr_mutex);
12871 u64 size_or_mask, size_and_mask;
12872 static bool mtrr_aps_delayed_init;
12873
12874 -static struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
12875 +static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
12876
12877 -struct mtrr_ops *mtrr_if;
12878 +const struct mtrr_ops *mtrr_if;
12879
12880 static void set_mtrr(unsigned int reg, unsigned long base,
12881 unsigned long size, mtrr_type type);
12882
12883 -void set_mtrr_ops(struct mtrr_ops *ops)
12884 +void set_mtrr_ops(const struct mtrr_ops *ops)
12885 {
12886 if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
12887 mtrr_ops[ops->vendor] = ops;
12888 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/mtrr.h
12889 --- linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-03-27 14:31:47.000000000 -0400
12890 +++ linux-2.6.32.46/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-08-26 20:23:57.000000000 -0400
12891 @@ -25,14 +25,14 @@ struct mtrr_ops {
12892 int (*validate_add_page)(unsigned long base, unsigned long size,
12893 unsigned int type);
12894 int (*have_wrcomb)(void);
12895 -};
12896 +} __do_const;
12897
12898 extern int generic_get_free_region(unsigned long base, unsigned long size,
12899 int replace_reg);
12900 extern int generic_validate_add_page(unsigned long base, unsigned long size,
12901 unsigned int type);
12902
12903 -extern struct mtrr_ops generic_mtrr_ops;
12904 +extern const struct mtrr_ops generic_mtrr_ops;
12905
12906 extern int positive_have_wrcomb(void);
12907
12908 @@ -53,10 +53,10 @@ void fill_mtrr_var_range(unsigned int in
12909 u32 base_lo, u32 base_hi, u32 mask_lo, u32 mask_hi);
12910 void get_mtrr_state(void);
12911
12912 -extern void set_mtrr_ops(struct mtrr_ops *ops);
12913 +extern void set_mtrr_ops(const struct mtrr_ops *ops);
12914
12915 extern u64 size_or_mask, size_and_mask;
12916 -extern struct mtrr_ops *mtrr_if;
12917 +extern const struct mtrr_ops *mtrr_if;
12918
12919 #define is_cpu(vnd) (mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
12920 #define use_intel() (mtrr_if && mtrr_if->use_intel_if == 1)
12921 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.32.46/arch/x86/kernel/cpu/perfctr-watchdog.c
12922 --- linux-2.6.32.46/arch/x86/kernel/cpu/perfctr-watchdog.c 2011-03-27 14:31:47.000000000 -0400
12923 +++ linux-2.6.32.46/arch/x86/kernel/cpu/perfctr-watchdog.c 2011-04-17 15:56:46.000000000 -0400
12924 @@ -30,11 +30,11 @@ struct nmi_watchdog_ctlblk {
12925
12926 /* Interface defining a CPU specific perfctr watchdog */
12927 struct wd_ops {
12928 - int (*reserve)(void);
12929 - void (*unreserve)(void);
12930 - int (*setup)(unsigned nmi_hz);
12931 - void (*rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
12932 - void (*stop)(void);
12933 + int (* const reserve)(void);
12934 + void (* const unreserve)(void);
12935 + int (* const setup)(unsigned nmi_hz);
12936 + void (* const rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
12937 + void (* const stop)(void);
12938 unsigned perfctr;
12939 unsigned evntsel;
12940 u64 checkbit;
12941 @@ -645,6 +645,7 @@ static const struct wd_ops p4_wd_ops = {
12942 #define ARCH_PERFMON_NMI_EVENT_SEL ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
12943 #define ARCH_PERFMON_NMI_EVENT_UMASK ARCH_PERFMON_UNHALTED_CORE_CYCLES_UMASK
12944
12945 +/* cannot be const */
12946 static struct wd_ops intel_arch_wd_ops;
12947
12948 static int setup_intel_arch_watchdog(unsigned nmi_hz)
12949 @@ -697,6 +698,7 @@ static int setup_intel_arch_watchdog(uns
12950 return 1;
12951 }
12952
12953 +/* cannot be const */
12954 static struct wd_ops intel_arch_wd_ops __read_mostly = {
12955 .reserve = single_msr_reserve,
12956 .unreserve = single_msr_unreserve,
12957 diff -urNp linux-2.6.32.46/arch/x86/kernel/cpu/perf_event.c linux-2.6.32.46/arch/x86/kernel/cpu/perf_event.c
12958 --- linux-2.6.32.46/arch/x86/kernel/cpu/perf_event.c 2011-03-27 14:31:47.000000000 -0400
12959 +++ linux-2.6.32.46/arch/x86/kernel/cpu/perf_event.c 2011-05-04 17:56:20.000000000 -0400
12960 @@ -723,10 +723,10 @@ x86_perf_event_update(struct perf_event
12961 * count to the generic event atomically:
12962 */
12963 again:
12964 - prev_raw_count = atomic64_read(&hwc->prev_count);
12965 + prev_raw_count = atomic64_read_unchecked(&hwc->prev_count);
12966 rdmsrl(hwc->event_base + idx, new_raw_count);
12967
12968 - if (atomic64_cmpxchg(&hwc->prev_count, prev_raw_count,
12969 + if (atomic64_cmpxchg_unchecked(&hwc->prev_count, prev_raw_count,
12970 new_raw_count) != prev_raw_count)
12971 goto again;
12972
12973 @@ -741,7 +741,7 @@ again:
12974 delta = (new_raw_count << shift) - (prev_raw_count << shift);
12975 delta >>= shift;
12976
12977 - atomic64_add(delta, &event->count);
12978 + atomic64_add_unchecked(delta, &event->count);
12979 atomic64_sub(delta, &hwc->period_left);
12980
12981 return new_raw_count;
12982 @@ -1353,7 +1353,7 @@ x86_perf_event_set_period(struct perf_ev
12983 * The hw event starts counting from this event offset,
12984 * mark it to be able to extra future deltas:
12985 */
12986 - atomic64_set(&hwc->prev_count, (u64)-left);
12987 + atomic64_set_unchecked(&hwc->prev_count, (u64)-left);
12988
12989 err = checking_wrmsrl(hwc->event_base + idx,
12990 (u64)(-left) & x86_pmu.event_mask);
12991 @@ -2357,7 +2357,7 @@ perf_callchain_user(struct pt_regs *regs
12992 break;
12993
12994 callchain_store(entry, frame.return_address);
12995 - fp = frame.next_frame;
12996 + fp = (__force const void __user *)frame.next_frame;
12997 }
12998 }
12999
13000 diff -urNp linux-2.6.32.46/arch/x86/kernel/crash.c linux-2.6.32.46/arch/x86/kernel/crash.c
13001 --- linux-2.6.32.46/arch/x86/kernel/crash.c 2011-03-27 14:31:47.000000000 -0400
13002 +++ linux-2.6.32.46/arch/x86/kernel/crash.c 2011-04-17 15:56:46.000000000 -0400
13003 @@ -41,7 +41,7 @@ static void kdump_nmi_callback(int cpu,
13004 regs = args->regs;
13005
13006 #ifdef CONFIG_X86_32
13007 - if (!user_mode_vm(regs)) {
13008 + if (!user_mode(regs)) {
13009 crash_fixup_ss_esp(&fixed_regs, regs);
13010 regs = &fixed_regs;
13011 }
13012 diff -urNp linux-2.6.32.46/arch/x86/kernel/doublefault_32.c linux-2.6.32.46/arch/x86/kernel/doublefault_32.c
13013 --- linux-2.6.32.46/arch/x86/kernel/doublefault_32.c 2011-03-27 14:31:47.000000000 -0400
13014 +++ linux-2.6.32.46/arch/x86/kernel/doublefault_32.c 2011-04-17 15:56:46.000000000 -0400
13015 @@ -11,7 +11,7 @@
13016
13017 #define DOUBLEFAULT_STACKSIZE (1024)
13018 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
13019 -#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
13020 +#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
13021
13022 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
13023
13024 @@ -21,7 +21,7 @@ static void doublefault_fn(void)
13025 unsigned long gdt, tss;
13026
13027 store_gdt(&gdt_desc);
13028 - gdt = gdt_desc.address;
13029 + gdt = (unsigned long)gdt_desc.address;
13030
13031 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
13032
13033 @@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
13034 /* 0x2 bit is always set */
13035 .flags = X86_EFLAGS_SF | 0x2,
13036 .sp = STACK_START,
13037 - .es = __USER_DS,
13038 + .es = __KERNEL_DS,
13039 .cs = __KERNEL_CS,
13040 .ss = __KERNEL_DS,
13041 - .ds = __USER_DS,
13042 + .ds = __KERNEL_DS,
13043 .fs = __KERNEL_PERCPU,
13044
13045 .__cr3 = __pa_nodebug(swapper_pg_dir),
13046 diff -urNp linux-2.6.32.46/arch/x86/kernel/dumpstack_32.c linux-2.6.32.46/arch/x86/kernel/dumpstack_32.c
13047 --- linux-2.6.32.46/arch/x86/kernel/dumpstack_32.c 2011-03-27 14:31:47.000000000 -0400
13048 +++ linux-2.6.32.46/arch/x86/kernel/dumpstack_32.c 2011-04-17 15:56:46.000000000 -0400
13049 @@ -53,16 +53,12 @@ void dump_trace(struct task_struct *task
13050 #endif
13051
13052 for (;;) {
13053 - struct thread_info *context;
13054 + void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
13055 + bp = print_context_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
13056
13057 - context = (struct thread_info *)
13058 - ((unsigned long)stack & (~(THREAD_SIZE - 1)));
13059 - bp = print_context_stack(context, stack, bp, ops,
13060 - data, NULL, &graph);
13061 -
13062 - stack = (unsigned long *)context->previous_esp;
13063 - if (!stack)
13064 + if (stack_start == task_stack_page(task))
13065 break;
13066 + stack = *(unsigned long **)stack_start;
13067 if (ops->stack(data, "IRQ") < 0)
13068 break;
13069 touch_nmi_watchdog();
13070 @@ -112,11 +108,12 @@ void show_registers(struct pt_regs *regs
13071 * When in-kernel, we also print out the stack and code at the
13072 * time of the fault..
13073 */
13074 - if (!user_mode_vm(regs)) {
13075 + if (!user_mode(regs)) {
13076 unsigned int code_prologue = code_bytes * 43 / 64;
13077 unsigned int code_len = code_bytes;
13078 unsigned char c;
13079 u8 *ip;
13080 + unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
13081
13082 printk(KERN_EMERG "Stack:\n");
13083 show_stack_log_lvl(NULL, regs, &regs->sp,
13084 @@ -124,10 +121,10 @@ void show_registers(struct pt_regs *regs
13085
13086 printk(KERN_EMERG "Code: ");
13087
13088 - ip = (u8 *)regs->ip - code_prologue;
13089 + ip = (u8 *)regs->ip - code_prologue + cs_base;
13090 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
13091 /* try starting at IP */
13092 - ip = (u8 *)regs->ip;
13093 + ip = (u8 *)regs->ip + cs_base;
13094 code_len = code_len - code_prologue + 1;
13095 }
13096 for (i = 0; i < code_len; i++, ip++) {
13097 @@ -136,7 +133,7 @@ void show_registers(struct pt_regs *regs
13098 printk(" Bad EIP value.");
13099 break;
13100 }
13101 - if (ip == (u8 *)regs->ip)
13102 + if (ip == (u8 *)regs->ip + cs_base)
13103 printk("<%02x> ", c);
13104 else
13105 printk("%02x ", c);
13106 @@ -149,6 +146,7 @@ int is_valid_bugaddr(unsigned long ip)
13107 {
13108 unsigned short ud2;
13109
13110 + ip = ktla_ktva(ip);
13111 if (ip < PAGE_OFFSET)
13112 return 0;
13113 if (probe_kernel_address((unsigned short *)ip, ud2))
13114 diff -urNp linux-2.6.32.46/arch/x86/kernel/dumpstack_64.c linux-2.6.32.46/arch/x86/kernel/dumpstack_64.c
13115 --- linux-2.6.32.46/arch/x86/kernel/dumpstack_64.c 2011-03-27 14:31:47.000000000 -0400
13116 +++ linux-2.6.32.46/arch/x86/kernel/dumpstack_64.c 2011-04-17 15:56:46.000000000 -0400
13117 @@ -116,8 +116,8 @@ void dump_trace(struct task_struct *task
13118 unsigned long *irq_stack_end =
13119 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
13120 unsigned used = 0;
13121 - struct thread_info *tinfo;
13122 int graph = 0;
13123 + void *stack_start;
13124
13125 if (!task)
13126 task = current;
13127 @@ -146,10 +146,10 @@ void dump_trace(struct task_struct *task
13128 * current stack address. If the stacks consist of nested
13129 * exceptions
13130 */
13131 - tinfo = task_thread_info(task);
13132 for (;;) {
13133 char *id;
13134 unsigned long *estack_end;
13135 +
13136 estack_end = in_exception_stack(cpu, (unsigned long)stack,
13137 &used, &id);
13138
13139 @@ -157,7 +157,7 @@ void dump_trace(struct task_struct *task
13140 if (ops->stack(data, id) < 0)
13141 break;
13142
13143 - bp = print_context_stack(tinfo, stack, bp, ops,
13144 + bp = print_context_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
13145 data, estack_end, &graph);
13146 ops->stack(data, "<EOE>");
13147 /*
13148 @@ -176,7 +176,7 @@ void dump_trace(struct task_struct *task
13149 if (stack >= irq_stack && stack < irq_stack_end) {
13150 if (ops->stack(data, "IRQ") < 0)
13151 break;
13152 - bp = print_context_stack(tinfo, stack, bp,
13153 + bp = print_context_stack(task, irq_stack, stack, bp,
13154 ops, data, irq_stack_end, &graph);
13155 /*
13156 * We link to the next stack (which would be
13157 @@ -195,7 +195,8 @@ void dump_trace(struct task_struct *task
13158 /*
13159 * This handles the process stack:
13160 */
13161 - bp = print_context_stack(tinfo, stack, bp, ops, data, NULL, &graph);
13162 + stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
13163 + bp = print_context_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
13164 put_cpu();
13165 }
13166 EXPORT_SYMBOL(dump_trace);
13167 diff -urNp linux-2.6.32.46/arch/x86/kernel/dumpstack.c linux-2.6.32.46/arch/x86/kernel/dumpstack.c
13168 --- linux-2.6.32.46/arch/x86/kernel/dumpstack.c 2011-03-27 14:31:47.000000000 -0400
13169 +++ linux-2.6.32.46/arch/x86/kernel/dumpstack.c 2011-04-17 15:56:46.000000000 -0400
13170 @@ -2,6 +2,9 @@
13171 * Copyright (C) 1991, 1992 Linus Torvalds
13172 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
13173 */
13174 +#ifdef CONFIG_GRKERNSEC_HIDESYM
13175 +#define __INCLUDED_BY_HIDESYM 1
13176 +#endif
13177 #include <linux/kallsyms.h>
13178 #include <linux/kprobes.h>
13179 #include <linux/uaccess.h>
13180 @@ -28,7 +31,7 @@ static int die_counter;
13181
13182 void printk_address(unsigned long address, int reliable)
13183 {
13184 - printk(" [<%p>] %s%pS\n", (void *) address,
13185 + printk(" [<%p>] %s%pA\n", (void *) address,
13186 reliable ? "" : "? ", (void *) address);
13187 }
13188
13189 @@ -36,9 +39,8 @@ void printk_address(unsigned long addres
13190 static void
13191 print_ftrace_graph_addr(unsigned long addr, void *data,
13192 const struct stacktrace_ops *ops,
13193 - struct thread_info *tinfo, int *graph)
13194 + struct task_struct *task, int *graph)
13195 {
13196 - struct task_struct *task = tinfo->task;
13197 unsigned long ret_addr;
13198 int index = task->curr_ret_stack;
13199
13200 @@ -59,7 +61,7 @@ print_ftrace_graph_addr(unsigned long ad
13201 static inline void
13202 print_ftrace_graph_addr(unsigned long addr, void *data,
13203 const struct stacktrace_ops *ops,
13204 - struct thread_info *tinfo, int *graph)
13205 + struct task_struct *task, int *graph)
13206 { }
13207 #endif
13208
13209 @@ -70,10 +72,8 @@ print_ftrace_graph_addr(unsigned long ad
13210 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
13211 */
13212
13213 -static inline int valid_stack_ptr(struct thread_info *tinfo,
13214 - void *p, unsigned int size, void *end)
13215 +static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
13216 {
13217 - void *t = tinfo;
13218 if (end) {
13219 if (p < end && p >= (end-THREAD_SIZE))
13220 return 1;
13221 @@ -84,14 +84,14 @@ static inline int valid_stack_ptr(struct
13222 }
13223
13224 unsigned long
13225 -print_context_stack(struct thread_info *tinfo,
13226 +print_context_stack(struct task_struct *task, void *stack_start,
13227 unsigned long *stack, unsigned long bp,
13228 const struct stacktrace_ops *ops, void *data,
13229 unsigned long *end, int *graph)
13230 {
13231 struct stack_frame *frame = (struct stack_frame *)bp;
13232
13233 - while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
13234 + while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
13235 unsigned long addr;
13236
13237 addr = *stack;
13238 @@ -103,7 +103,7 @@ print_context_stack(struct thread_info *
13239 } else {
13240 ops->address(data, addr, 0);
13241 }
13242 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
13243 + print_ftrace_graph_addr(addr, data, ops, task, graph);
13244 }
13245 stack++;
13246 }
13247 @@ -180,7 +180,7 @@ void dump_stack(void)
13248 #endif
13249
13250 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
13251 - current->pid, current->comm, print_tainted(),
13252 + task_pid_nr(current), current->comm, print_tainted(),
13253 init_utsname()->release,
13254 (int)strcspn(init_utsname()->version, " "),
13255 init_utsname()->version);
13256 @@ -220,6 +220,8 @@ unsigned __kprobes long oops_begin(void)
13257 return flags;
13258 }
13259
13260 +extern void gr_handle_kernel_exploit(void);
13261 +
13262 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
13263 {
13264 if (regs && kexec_should_crash(current))
13265 @@ -241,7 +243,10 @@ void __kprobes oops_end(unsigned long fl
13266 panic("Fatal exception in interrupt");
13267 if (panic_on_oops)
13268 panic("Fatal exception");
13269 - do_exit(signr);
13270 +
13271 + gr_handle_kernel_exploit();
13272 +
13273 + do_group_exit(signr);
13274 }
13275
13276 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
13277 @@ -295,7 +300,7 @@ void die(const char *str, struct pt_regs
13278 unsigned long flags = oops_begin();
13279 int sig = SIGSEGV;
13280
13281 - if (!user_mode_vm(regs))
13282 + if (!user_mode(regs))
13283 report_bug(regs->ip, regs);
13284
13285 if (__die(str, regs, err))
13286 diff -urNp linux-2.6.32.46/arch/x86/kernel/dumpstack.h linux-2.6.32.46/arch/x86/kernel/dumpstack.h
13287 --- linux-2.6.32.46/arch/x86/kernel/dumpstack.h 2011-03-27 14:31:47.000000000 -0400
13288 +++ linux-2.6.32.46/arch/x86/kernel/dumpstack.h 2011-04-23 13:25:26.000000000 -0400
13289 @@ -15,7 +15,7 @@
13290 #endif
13291
13292 extern unsigned long
13293 -print_context_stack(struct thread_info *tinfo,
13294 +print_context_stack(struct task_struct *task, void *stack_start,
13295 unsigned long *stack, unsigned long bp,
13296 const struct stacktrace_ops *ops, void *data,
13297 unsigned long *end, int *graph);
13298 diff -urNp linux-2.6.32.46/arch/x86/kernel/e820.c linux-2.6.32.46/arch/x86/kernel/e820.c
13299 --- linux-2.6.32.46/arch/x86/kernel/e820.c 2011-03-27 14:31:47.000000000 -0400
13300 +++ linux-2.6.32.46/arch/x86/kernel/e820.c 2011-04-17 15:56:46.000000000 -0400
13301 @@ -733,7 +733,7 @@ struct early_res {
13302 };
13303 static struct early_res early_res[MAX_EARLY_RES] __initdata = {
13304 { 0, PAGE_SIZE, "BIOS data page" }, /* BIOS data page */
13305 - {}
13306 + { 0, 0, {0}, 0 }
13307 };
13308
13309 static int __init find_overlapped_early(u64 start, u64 end)
13310 diff -urNp linux-2.6.32.46/arch/x86/kernel/early_printk.c linux-2.6.32.46/arch/x86/kernel/early_printk.c
13311 --- linux-2.6.32.46/arch/x86/kernel/early_printk.c 2011-03-27 14:31:47.000000000 -0400
13312 +++ linux-2.6.32.46/arch/x86/kernel/early_printk.c 2011-05-16 21:46:57.000000000 -0400
13313 @@ -7,6 +7,7 @@
13314 #include <linux/pci_regs.h>
13315 #include <linux/pci_ids.h>
13316 #include <linux/errno.h>
13317 +#include <linux/sched.h>
13318 #include <asm/io.h>
13319 #include <asm/processor.h>
13320 #include <asm/fcntl.h>
13321 @@ -170,6 +171,8 @@ asmlinkage void early_printk(const char
13322 int n;
13323 va_list ap;
13324
13325 + pax_track_stack();
13326 +
13327 va_start(ap, fmt);
13328 n = vscnprintf(buf, sizeof(buf), fmt, ap);
13329 early_console->write(early_console, buf, n);
13330 diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_32.c linux-2.6.32.46/arch/x86/kernel/efi_32.c
13331 --- linux-2.6.32.46/arch/x86/kernel/efi_32.c 2011-03-27 14:31:47.000000000 -0400
13332 +++ linux-2.6.32.46/arch/x86/kernel/efi_32.c 2011-10-06 09:37:08.000000000 -0400
13333 @@ -38,70 +38,56 @@
13334 */
13335
13336 static unsigned long efi_rt_eflags;
13337 -static pgd_t efi_bak_pg_dir_pointer[2];
13338 +static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
13339
13340 -void efi_call_phys_prelog(void)
13341 +void __init efi_call_phys_prelog(void)
13342 {
13343 - unsigned long cr4;
13344 - unsigned long temp;
13345 struct desc_ptr gdt_descr;
13346
13347 - local_irq_save(efi_rt_eflags);
13348 +#ifdef CONFIG_PAX_KERNEXEC
13349 + struct desc_struct d;
13350 +#endif
13351
13352 - /*
13353 - * If I don't have PAE, I should just duplicate two entries in page
13354 - * directory. If I have PAE, I just need to duplicate one entry in
13355 - * page directory.
13356 - */
13357 - cr4 = read_cr4_safe();
13358 + local_irq_save(efi_rt_eflags);
13359
13360 - if (cr4 & X86_CR4_PAE) {
13361 - efi_bak_pg_dir_pointer[0].pgd =
13362 - swapper_pg_dir[pgd_index(0)].pgd;
13363 - swapper_pg_dir[0].pgd =
13364 - swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
13365 - } else {
13366 - efi_bak_pg_dir_pointer[0].pgd =
13367 - swapper_pg_dir[pgd_index(0)].pgd;
13368 - efi_bak_pg_dir_pointer[1].pgd =
13369 - swapper_pg_dir[pgd_index(0x400000)].pgd;
13370 - swapper_pg_dir[pgd_index(0)].pgd =
13371 - swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
13372 - temp = PAGE_OFFSET + 0x400000;
13373 - swapper_pg_dir[pgd_index(0x400000)].pgd =
13374 - swapper_pg_dir[pgd_index(temp)].pgd;
13375 - }
13376 + clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
13377 + clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
13378 + min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
13379
13380 /*
13381 * After the lock is released, the original page table is restored.
13382 */
13383 __flush_tlb_all();
13384
13385 +#ifdef CONFIG_PAX_KERNEXEC
13386 + pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC);
13387 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
13388 + pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC);
13389 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
13390 +#endif
13391 +
13392 gdt_descr.address = __pa(get_cpu_gdt_table(0));
13393 gdt_descr.size = GDT_SIZE - 1;
13394 load_gdt(&gdt_descr);
13395 }
13396
13397 -void efi_call_phys_epilog(void)
13398 +void __init efi_call_phys_epilog(void)
13399 {
13400 - unsigned long cr4;
13401 struct desc_ptr gdt_descr;
13402
13403 +#ifdef CONFIG_PAX_KERNEXEC
13404 + struct desc_struct d;
13405 +
13406 + memset(&d, 0, sizeof d);
13407 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
13408 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
13409 +#endif
13410 +
13411 gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
13412 gdt_descr.size = GDT_SIZE - 1;
13413 load_gdt(&gdt_descr);
13414
13415 - cr4 = read_cr4_safe();
13416 -
13417 - if (cr4 & X86_CR4_PAE) {
13418 - swapper_pg_dir[pgd_index(0)].pgd =
13419 - efi_bak_pg_dir_pointer[0].pgd;
13420 - } else {
13421 - swapper_pg_dir[pgd_index(0)].pgd =
13422 - efi_bak_pg_dir_pointer[0].pgd;
13423 - swapper_pg_dir[pgd_index(0x400000)].pgd =
13424 - efi_bak_pg_dir_pointer[1].pgd;
13425 - }
13426 + clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
13427
13428 /*
13429 * After the lock is released, the original page table is restored.
13430 diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S
13431 --- linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S 2011-03-27 14:31:47.000000000 -0400
13432 +++ linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S 2011-10-06 09:37:08.000000000 -0400
13433 @@ -6,7 +6,9 @@
13434 */
13435
13436 #include <linux/linkage.h>
13437 +#include <linux/init.h>
13438 #include <asm/page_types.h>
13439 +#include <asm/segment.h>
13440
13441 /*
13442 * efi_call_phys(void *, ...) is a function with variable parameters.
13443 @@ -20,7 +22,7 @@
13444 * service functions will comply with gcc calling convention, too.
13445 */
13446
13447 -.text
13448 +__INIT
13449 ENTRY(efi_call_phys)
13450 /*
13451 * 0. The function can only be called in Linux kernel. So CS has been
13452 @@ -36,9 +38,11 @@ ENTRY(efi_call_phys)
13453 * The mapping of lower virtual memory has been created in prelog and
13454 * epilog.
13455 */
13456 - movl $1f, %edx
13457 - subl $__PAGE_OFFSET, %edx
13458 - jmp *%edx
13459 + movl $(__KERNEXEC_EFI_DS), %edx
13460 + mov %edx, %ds
13461 + mov %edx, %es
13462 + mov %edx, %ss
13463 + ljmp $(__KERNEXEC_EFI_CS),$1f-__PAGE_OFFSET
13464 1:
13465
13466 /*
13467 @@ -47,14 +51,8 @@ ENTRY(efi_call_phys)
13468 * parameter 2, ..., param n. To make things easy, we save the return
13469 * address of efi_call_phys in a global variable.
13470 */
13471 - popl %edx
13472 - movl %edx, saved_return_addr
13473 - /* get the function pointer into ECX*/
13474 - popl %ecx
13475 - movl %ecx, efi_rt_function_ptr
13476 - movl $2f, %edx
13477 - subl $__PAGE_OFFSET, %edx
13478 - pushl %edx
13479 + popl (saved_return_addr)
13480 + popl (efi_rt_function_ptr)
13481
13482 /*
13483 * 3. Clear PG bit in %CR0.
13484 @@ -73,9 +71,8 @@ ENTRY(efi_call_phys)
13485 /*
13486 * 5. Call the physical function.
13487 */
13488 - jmp *%ecx
13489 + call *(efi_rt_function_ptr-__PAGE_OFFSET)
13490
13491 -2:
13492 /*
13493 * 6. After EFI runtime service returns, control will return to
13494 * following instruction. We'd better readjust stack pointer first.
13495 @@ -88,35 +85,32 @@ ENTRY(efi_call_phys)
13496 movl %cr0, %edx
13497 orl $0x80000000, %edx
13498 movl %edx, %cr0
13499 - jmp 1f
13500 -1:
13501 +
13502 /*
13503 * 8. Now restore the virtual mode from flat mode by
13504 * adding EIP with PAGE_OFFSET.
13505 */
13506 - movl $1f, %edx
13507 - jmp *%edx
13508 + ljmp $(__KERNEL_CS),$1f+__PAGE_OFFSET
13509 1:
13510 + movl $(__KERNEL_DS), %edx
13511 + mov %edx, %ds
13512 + mov %edx, %es
13513 + mov %edx, %ss
13514
13515 /*
13516 * 9. Balance the stack. And because EAX contain the return value,
13517 * we'd better not clobber it.
13518 */
13519 - leal efi_rt_function_ptr, %edx
13520 - movl (%edx), %ecx
13521 - pushl %ecx
13522 + pushl (efi_rt_function_ptr)
13523
13524 /*
13525 - * 10. Push the saved return address onto the stack and return.
13526 + * 10. Return to the saved return address.
13527 */
13528 - leal saved_return_addr, %edx
13529 - movl (%edx), %ecx
13530 - pushl %ecx
13531 - ret
13532 + jmpl *(saved_return_addr)
13533 ENDPROC(efi_call_phys)
13534 .previous
13535
13536 -.data
13537 +__INITDATA
13538 saved_return_addr:
13539 .long 0
13540 efi_rt_function_ptr:
13541 diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_stub_64.S linux-2.6.32.46/arch/x86/kernel/efi_stub_64.S
13542 --- linux-2.6.32.46/arch/x86/kernel/efi_stub_64.S 2011-03-27 14:31:47.000000000 -0400
13543 +++ linux-2.6.32.46/arch/x86/kernel/efi_stub_64.S 2011-10-06 09:37:14.000000000 -0400
13544 @@ -7,6 +7,7 @@
13545 */
13546
13547 #include <linux/linkage.h>
13548 +#include <asm/alternative-asm.h>
13549
13550 #define SAVE_XMM \
13551 mov %rsp, %rax; \
13552 @@ -40,6 +41,7 @@ ENTRY(efi_call0)
13553 call *%rdi
13554 addq $32, %rsp
13555 RESTORE_XMM
13556 + pax_force_retaddr
13557 ret
13558 ENDPROC(efi_call0)
13559
13560 @@ -50,6 +52,7 @@ ENTRY(efi_call1)
13561 call *%rdi
13562 addq $32, %rsp
13563 RESTORE_XMM
13564 + pax_force_retaddr
13565 ret
13566 ENDPROC(efi_call1)
13567
13568 @@ -60,6 +63,7 @@ ENTRY(efi_call2)
13569 call *%rdi
13570 addq $32, %rsp
13571 RESTORE_XMM
13572 + pax_force_retaddr
13573 ret
13574 ENDPROC(efi_call2)
13575
13576 @@ -71,6 +75,7 @@ ENTRY(efi_call3)
13577 call *%rdi
13578 addq $32, %rsp
13579 RESTORE_XMM
13580 + pax_force_retaddr
13581 ret
13582 ENDPROC(efi_call3)
13583
13584 @@ -83,6 +88,7 @@ ENTRY(efi_call4)
13585 call *%rdi
13586 addq $32, %rsp
13587 RESTORE_XMM
13588 + pax_force_retaddr
13589 ret
13590 ENDPROC(efi_call4)
13591
13592 @@ -96,6 +102,7 @@ ENTRY(efi_call5)
13593 call *%rdi
13594 addq $48, %rsp
13595 RESTORE_XMM
13596 + pax_force_retaddr
13597 ret
13598 ENDPROC(efi_call5)
13599
13600 @@ -112,5 +119,6 @@ ENTRY(efi_call6)
13601 call *%rdi
13602 addq $48, %rsp
13603 RESTORE_XMM
13604 + pax_force_retaddr
13605 ret
13606 ENDPROC(efi_call6)
13607 diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_32.S linux-2.6.32.46/arch/x86/kernel/entry_32.S
13608 --- linux-2.6.32.46/arch/x86/kernel/entry_32.S 2011-03-27 14:31:47.000000000 -0400
13609 +++ linux-2.6.32.46/arch/x86/kernel/entry_32.S 2011-08-30 18:19:52.000000000 -0400
13610 @@ -185,13 +185,146 @@
13611 /*CFI_REL_OFFSET gs, PT_GS*/
13612 .endm
13613 .macro SET_KERNEL_GS reg
13614 +
13615 +#ifdef CONFIG_CC_STACKPROTECTOR
13616 movl $(__KERNEL_STACK_CANARY), \reg
13617 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
13618 + movl $(__USER_DS), \reg
13619 +#else
13620 + xorl \reg, \reg
13621 +#endif
13622 +
13623 movl \reg, %gs
13624 .endm
13625
13626 #endif /* CONFIG_X86_32_LAZY_GS */
13627
13628 -.macro SAVE_ALL
13629 +.macro pax_enter_kernel
13630 +#ifdef CONFIG_PAX_KERNEXEC
13631 + call pax_enter_kernel
13632 +#endif
13633 +.endm
13634 +
13635 +.macro pax_exit_kernel
13636 +#ifdef CONFIG_PAX_KERNEXEC
13637 + call pax_exit_kernel
13638 +#endif
13639 +.endm
13640 +
13641 +#ifdef CONFIG_PAX_KERNEXEC
13642 +ENTRY(pax_enter_kernel)
13643 +#ifdef CONFIG_PARAVIRT
13644 + pushl %eax
13645 + pushl %ecx
13646 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
13647 + mov %eax, %esi
13648 +#else
13649 + mov %cr0, %esi
13650 +#endif
13651 + bts $16, %esi
13652 + jnc 1f
13653 + mov %cs, %esi
13654 + cmp $__KERNEL_CS, %esi
13655 + jz 3f
13656 + ljmp $__KERNEL_CS, $3f
13657 +1: ljmp $__KERNEXEC_KERNEL_CS, $2f
13658 +2:
13659 +#ifdef CONFIG_PARAVIRT
13660 + mov %esi, %eax
13661 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
13662 +#else
13663 + mov %esi, %cr0
13664 +#endif
13665 +3:
13666 +#ifdef CONFIG_PARAVIRT
13667 + popl %ecx
13668 + popl %eax
13669 +#endif
13670 + ret
13671 +ENDPROC(pax_enter_kernel)
13672 +
13673 +ENTRY(pax_exit_kernel)
13674 +#ifdef CONFIG_PARAVIRT
13675 + pushl %eax
13676 + pushl %ecx
13677 +#endif
13678 + mov %cs, %esi
13679 + cmp $__KERNEXEC_KERNEL_CS, %esi
13680 + jnz 2f
13681 +#ifdef CONFIG_PARAVIRT
13682 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
13683 + mov %eax, %esi
13684 +#else
13685 + mov %cr0, %esi
13686 +#endif
13687 + btr $16, %esi
13688 + ljmp $__KERNEL_CS, $1f
13689 +1:
13690 +#ifdef CONFIG_PARAVIRT
13691 + mov %esi, %eax
13692 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
13693 +#else
13694 + mov %esi, %cr0
13695 +#endif
13696 +2:
13697 +#ifdef CONFIG_PARAVIRT
13698 + popl %ecx
13699 + popl %eax
13700 +#endif
13701 + ret
13702 +ENDPROC(pax_exit_kernel)
13703 +#endif
13704 +
13705 +.macro pax_erase_kstack
13706 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13707 + call pax_erase_kstack
13708 +#endif
13709 +.endm
13710 +
13711 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13712 +/*
13713 + * ebp: thread_info
13714 + * ecx, edx: can be clobbered
13715 + */
13716 +ENTRY(pax_erase_kstack)
13717 + pushl %edi
13718 + pushl %eax
13719 +
13720 + mov TI_lowest_stack(%ebp), %edi
13721 + mov $-0xBEEF, %eax
13722 + std
13723 +
13724 +1: mov %edi, %ecx
13725 + and $THREAD_SIZE_asm - 1, %ecx
13726 + shr $2, %ecx
13727 + repne scasl
13728 + jecxz 2f
13729 +
13730 + cmp $2*16, %ecx
13731 + jc 2f
13732 +
13733 + mov $2*16, %ecx
13734 + repe scasl
13735 + jecxz 2f
13736 + jne 1b
13737 +
13738 +2: cld
13739 + mov %esp, %ecx
13740 + sub %edi, %ecx
13741 + shr $2, %ecx
13742 + rep stosl
13743 +
13744 + mov TI_task_thread_sp0(%ebp), %edi
13745 + sub $128, %edi
13746 + mov %edi, TI_lowest_stack(%ebp)
13747 +
13748 + popl %eax
13749 + popl %edi
13750 + ret
13751 +ENDPROC(pax_erase_kstack)
13752 +#endif
13753 +
13754 +.macro __SAVE_ALL _DS
13755 cld
13756 PUSH_GS
13757 pushl %fs
13758 @@ -224,7 +357,7 @@
13759 pushl %ebx
13760 CFI_ADJUST_CFA_OFFSET 4
13761 CFI_REL_OFFSET ebx, 0
13762 - movl $(__USER_DS), %edx
13763 + movl $\_DS, %edx
13764 movl %edx, %ds
13765 movl %edx, %es
13766 movl $(__KERNEL_PERCPU), %edx
13767 @@ -232,6 +365,15 @@
13768 SET_KERNEL_GS %edx
13769 .endm
13770
13771 +.macro SAVE_ALL
13772 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
13773 + __SAVE_ALL __KERNEL_DS
13774 + pax_enter_kernel
13775 +#else
13776 + __SAVE_ALL __USER_DS
13777 +#endif
13778 +.endm
13779 +
13780 .macro RESTORE_INT_REGS
13781 popl %ebx
13782 CFI_ADJUST_CFA_OFFSET -4
13783 @@ -352,7 +494,15 @@ check_userspace:
13784 movb PT_CS(%esp), %al
13785 andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
13786 cmpl $USER_RPL, %eax
13787 +
13788 +#ifdef CONFIG_PAX_KERNEXEC
13789 + jae resume_userspace
13790 +
13791 + PAX_EXIT_KERNEL
13792 + jmp resume_kernel
13793 +#else
13794 jb resume_kernel # not returning to v8086 or userspace
13795 +#endif
13796
13797 ENTRY(resume_userspace)
13798 LOCKDEP_SYS_EXIT
13799 @@ -364,7 +514,7 @@ ENTRY(resume_userspace)
13800 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
13801 # int/exception return?
13802 jne work_pending
13803 - jmp restore_all
13804 + jmp restore_all_pax
13805 END(ret_from_exception)
13806
13807 #ifdef CONFIG_PREEMPT
13808 @@ -414,25 +564,36 @@ sysenter_past_esp:
13809 /*CFI_REL_OFFSET cs, 0*/
13810 /*
13811 * Push current_thread_info()->sysenter_return to the stack.
13812 - * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
13813 - * pushed above; +8 corresponds to copy_thread's esp0 setting.
13814 */
13815 - pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
13816 + pushl $0
13817 CFI_ADJUST_CFA_OFFSET 4
13818 CFI_REL_OFFSET eip, 0
13819
13820 pushl %eax
13821 CFI_ADJUST_CFA_OFFSET 4
13822 SAVE_ALL
13823 + GET_THREAD_INFO(%ebp)
13824 + movl TI_sysenter_return(%ebp),%ebp
13825 + movl %ebp,PT_EIP(%esp)
13826 ENABLE_INTERRUPTS(CLBR_NONE)
13827
13828 /*
13829 * Load the potential sixth argument from user stack.
13830 * Careful about security.
13831 */
13832 + movl PT_OLDESP(%esp),%ebp
13833 +
13834 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13835 + mov PT_OLDSS(%esp),%ds
13836 +1: movl %ds:(%ebp),%ebp
13837 + push %ss
13838 + pop %ds
13839 +#else
13840 cmpl $__PAGE_OFFSET-3,%ebp
13841 jae syscall_fault
13842 1: movl (%ebp),%ebp
13843 +#endif
13844 +
13845 movl %ebp,PT_EBP(%esp)
13846 .section __ex_table,"a"
13847 .align 4
13848 @@ -455,12 +616,24 @@ sysenter_do_call:
13849 testl $_TIF_ALLWORK_MASK, %ecx
13850 jne sysexit_audit
13851 sysenter_exit:
13852 +
13853 +#ifdef CONFIG_PAX_RANDKSTACK
13854 + pushl_cfi %eax
13855 + movl %esp, %eax
13856 + call pax_randomize_kstack
13857 + popl_cfi %eax
13858 +#endif
13859 +
13860 + pax_erase_kstack
13861 +
13862 /* if something modifies registers it must also disable sysexit */
13863 movl PT_EIP(%esp), %edx
13864 movl PT_OLDESP(%esp), %ecx
13865 xorl %ebp,%ebp
13866 TRACE_IRQS_ON
13867 1: mov PT_FS(%esp), %fs
13868 +2: mov PT_DS(%esp), %ds
13869 +3: mov PT_ES(%esp), %es
13870 PTGS_TO_GS
13871 ENABLE_INTERRUPTS_SYSEXIT
13872
13873 @@ -477,6 +650,9 @@ sysenter_audit:
13874 movl %eax,%edx /* 2nd arg: syscall number */
13875 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
13876 call audit_syscall_entry
13877 +
13878 + pax_erase_kstack
13879 +
13880 pushl %ebx
13881 CFI_ADJUST_CFA_OFFSET 4
13882 movl PT_EAX(%esp),%eax /* reload syscall number */
13883 @@ -504,11 +680,17 @@ sysexit_audit:
13884
13885 CFI_ENDPROC
13886 .pushsection .fixup,"ax"
13887 -2: movl $0,PT_FS(%esp)
13888 +4: movl $0,PT_FS(%esp)
13889 + jmp 1b
13890 +5: movl $0,PT_DS(%esp)
13891 + jmp 1b
13892 +6: movl $0,PT_ES(%esp)
13893 jmp 1b
13894 .section __ex_table,"a"
13895 .align 4
13896 - .long 1b,2b
13897 + .long 1b,4b
13898 + .long 2b,5b
13899 + .long 3b,6b
13900 .popsection
13901 PTGS_TO_GS_EX
13902 ENDPROC(ia32_sysenter_target)
13903 @@ -538,6 +720,15 @@ syscall_exit:
13904 testl $_TIF_ALLWORK_MASK, %ecx # current->work
13905 jne syscall_exit_work
13906
13907 +restore_all_pax:
13908 +
13909 +#ifdef CONFIG_PAX_RANDKSTACK
13910 + movl %esp, %eax
13911 + call pax_randomize_kstack
13912 +#endif
13913 +
13914 + pax_erase_kstack
13915 +
13916 restore_all:
13917 TRACE_IRQS_IRET
13918 restore_all_notrace:
13919 @@ -602,10 +793,29 @@ ldt_ss:
13920 mov PT_OLDESP(%esp), %eax /* load userspace esp */
13921 mov %dx, %ax /* eax: new kernel esp */
13922 sub %eax, %edx /* offset (low word is 0) */
13923 - PER_CPU(gdt_page, %ebx)
13924 +#ifdef CONFIG_SMP
13925 + movl PER_CPU_VAR(cpu_number), %ebx
13926 + shll $PAGE_SHIFT_asm, %ebx
13927 + addl $cpu_gdt_table, %ebx
13928 +#else
13929 + movl $cpu_gdt_table, %ebx
13930 +#endif
13931 shr $16, %edx
13932 +
13933 +#ifdef CONFIG_PAX_KERNEXEC
13934 + mov %cr0, %esi
13935 + btr $16, %esi
13936 + mov %esi, %cr0
13937 +#endif
13938 +
13939 mov %dl, GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx) /* bits 16..23 */
13940 mov %dh, GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx) /* bits 24..31 */
13941 +
13942 +#ifdef CONFIG_PAX_KERNEXEC
13943 + bts $16, %esi
13944 + mov %esi, %cr0
13945 +#endif
13946 +
13947 pushl $__ESPFIX_SS
13948 CFI_ADJUST_CFA_OFFSET 4
13949 push %eax /* new kernel esp */
13950 @@ -636,31 +846,25 @@ work_resched:
13951 movl TI_flags(%ebp), %ecx
13952 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
13953 # than syscall tracing?
13954 - jz restore_all
13955 + jz restore_all_pax
13956 testb $_TIF_NEED_RESCHED, %cl
13957 jnz work_resched
13958
13959 work_notifysig: # deal with pending signals and
13960 # notify-resume requests
13961 + movl %esp, %eax
13962 #ifdef CONFIG_VM86
13963 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
13964 - movl %esp, %eax
13965 - jne work_notifysig_v86 # returning to kernel-space or
13966 + jz 1f # returning to kernel-space or
13967 # vm86-space
13968 - xorl %edx, %edx
13969 - call do_notify_resume
13970 - jmp resume_userspace_sig
13971
13972 - ALIGN
13973 -work_notifysig_v86:
13974 pushl %ecx # save ti_flags for do_notify_resume
13975 CFI_ADJUST_CFA_OFFSET 4
13976 call save_v86_state # %eax contains pt_regs pointer
13977 popl %ecx
13978 CFI_ADJUST_CFA_OFFSET -4
13979 movl %eax, %esp
13980 -#else
13981 - movl %esp, %eax
13982 +1:
13983 #endif
13984 xorl %edx, %edx
13985 call do_notify_resume
13986 @@ -673,6 +877,9 @@ syscall_trace_entry:
13987 movl $-ENOSYS,PT_EAX(%esp)
13988 movl %esp, %eax
13989 call syscall_trace_enter
13990 +
13991 + pax_erase_kstack
13992 +
13993 /* What it returned is what we'll actually use. */
13994 cmpl $(nr_syscalls), %eax
13995 jnae syscall_call
13996 @@ -695,6 +902,10 @@ END(syscall_exit_work)
13997
13998 RING0_INT_FRAME # can't unwind into user space anyway
13999 syscall_fault:
14000 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14001 + push %ss
14002 + pop %ds
14003 +#endif
14004 GET_THREAD_INFO(%ebp)
14005 movl $-EFAULT,PT_EAX(%esp)
14006 jmp resume_userspace
14007 @@ -726,6 +937,33 @@ PTREGSCALL(rt_sigreturn)
14008 PTREGSCALL(vm86)
14009 PTREGSCALL(vm86old)
14010
14011 + ALIGN;
14012 +ENTRY(kernel_execve)
14013 + push %ebp
14014 + sub $PT_OLDSS+4,%esp
14015 + push %edi
14016 + push %ecx
14017 + push %eax
14018 + lea 3*4(%esp),%edi
14019 + mov $PT_OLDSS/4+1,%ecx
14020 + xorl %eax,%eax
14021 + rep stosl
14022 + pop %eax
14023 + pop %ecx
14024 + pop %edi
14025 + movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
14026 + mov %eax,PT_EBX(%esp)
14027 + mov %edx,PT_ECX(%esp)
14028 + mov %ecx,PT_EDX(%esp)
14029 + mov %esp,%eax
14030 + call sys_execve
14031 + GET_THREAD_INFO(%ebp)
14032 + test %eax,%eax
14033 + jz syscall_exit
14034 + add $PT_OLDSS+4,%esp
14035 + pop %ebp
14036 + ret
14037 +
14038 .macro FIXUP_ESPFIX_STACK
14039 /*
14040 * Switch back for ESPFIX stack to the normal zerobased stack
14041 @@ -735,7 +973,13 @@ PTREGSCALL(vm86old)
14042 * normal stack and adjusts ESP with the matching offset.
14043 */
14044 /* fixup the stack */
14045 - PER_CPU(gdt_page, %ebx)
14046 +#ifdef CONFIG_SMP
14047 + movl PER_CPU_VAR(cpu_number), %ebx
14048 + shll $PAGE_SHIFT_asm, %ebx
14049 + addl $cpu_gdt_table, %ebx
14050 +#else
14051 + movl $cpu_gdt_table, %ebx
14052 +#endif
14053 mov GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx), %al /* bits 16..23 */
14054 mov GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx), %ah /* bits 24..31 */
14055 shl $16, %eax
14056 @@ -1198,7 +1442,6 @@ return_to_handler:
14057 ret
14058 #endif
14059
14060 -.section .rodata,"a"
14061 #include "syscall_table_32.S"
14062
14063 syscall_table_size=(.-sys_call_table)
14064 @@ -1255,9 +1498,12 @@ error_code:
14065 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
14066 REG_TO_PTGS %ecx
14067 SET_KERNEL_GS %ecx
14068 - movl $(__USER_DS), %ecx
14069 + movl $(__KERNEL_DS), %ecx
14070 movl %ecx, %ds
14071 movl %ecx, %es
14072 +
14073 + pax_enter_kernel
14074 +
14075 TRACE_IRQS_OFF
14076 movl %esp,%eax # pt_regs pointer
14077 call *%edi
14078 @@ -1351,6 +1597,9 @@ nmi_stack_correct:
14079 xorl %edx,%edx # zero error code
14080 movl %esp,%eax # pt_regs pointer
14081 call do_nmi
14082 +
14083 + pax_exit_kernel
14084 +
14085 jmp restore_all_notrace
14086 CFI_ENDPROC
14087
14088 @@ -1391,6 +1640,9 @@ nmi_espfix_stack:
14089 FIXUP_ESPFIX_STACK # %eax == %esp
14090 xorl %edx,%edx # zero error code
14091 call do_nmi
14092 +
14093 + pax_exit_kernel
14094 +
14095 RESTORE_REGS
14096 lss 12+4(%esp), %esp # back to espfix stack
14097 CFI_ADJUST_CFA_OFFSET -24
14098 diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/kernel/entry_64.S
14099 --- linux-2.6.32.46/arch/x86/kernel/entry_64.S 2011-03-27 14:31:47.000000000 -0400
14100 +++ linux-2.6.32.46/arch/x86/kernel/entry_64.S 2011-10-08 08:14:37.000000000 -0400
14101 @@ -53,6 +53,8 @@
14102 #include <asm/paravirt.h>
14103 #include <asm/ftrace.h>
14104 #include <asm/percpu.h>
14105 +#include <asm/pgtable.h>
14106 +#include <asm/alternative-asm.h>
14107
14108 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
14109 #include <linux/elf-em.h>
14110 @@ -64,6 +66,7 @@
14111 #ifdef CONFIG_FUNCTION_TRACER
14112 #ifdef CONFIG_DYNAMIC_FTRACE
14113 ENTRY(mcount)
14114 + pax_force_retaddr
14115 retq
14116 END(mcount)
14117
14118 @@ -88,6 +91,7 @@ GLOBAL(ftrace_graph_call)
14119 #endif
14120
14121 GLOBAL(ftrace_stub)
14122 + pax_force_retaddr
14123 retq
14124 END(ftrace_caller)
14125
14126 @@ -108,6 +112,7 @@ ENTRY(mcount)
14127 #endif
14128
14129 GLOBAL(ftrace_stub)
14130 + pax_force_retaddr
14131 retq
14132
14133 trace:
14134 @@ -117,6 +122,7 @@ trace:
14135 movq 8(%rbp), %rsi
14136 subq $MCOUNT_INSN_SIZE, %rdi
14137
14138 + pax_force_fptr ftrace_trace_function
14139 call *ftrace_trace_function
14140
14141 MCOUNT_RESTORE_FRAME
14142 @@ -142,6 +148,7 @@ ENTRY(ftrace_graph_caller)
14143
14144 MCOUNT_RESTORE_FRAME
14145
14146 + pax_force_retaddr
14147 retq
14148 END(ftrace_graph_caller)
14149
14150 @@ -159,6 +166,7 @@ GLOBAL(return_to_handler)
14151 movq 8(%rsp), %rdx
14152 movq (%rsp), %rax
14153 addq $16, %rsp
14154 + pax_force_retaddr
14155 retq
14156 #endif
14157
14158 @@ -174,6 +182,269 @@ ENTRY(native_usergs_sysret64)
14159 ENDPROC(native_usergs_sysret64)
14160 #endif /* CONFIG_PARAVIRT */
14161
14162 + .macro ljmpq sel, off
14163 +#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
14164 + .byte 0x48; ljmp *1234f(%rip)
14165 + .pushsection .rodata
14166 + .align 16
14167 + 1234: .quad \off; .word \sel
14168 + .popsection
14169 +#else
14170 + pushq $\sel
14171 + pushq $\off
14172 + lretq
14173 +#endif
14174 + .endm
14175 +
14176 + .macro pax_enter_kernel
14177 +#ifdef CONFIG_PAX_KERNEXEC
14178 + call pax_enter_kernel
14179 +#endif
14180 + .endm
14181 +
14182 + .macro pax_exit_kernel
14183 +#ifdef CONFIG_PAX_KERNEXEC
14184 + call pax_exit_kernel
14185 +#endif
14186 + .endm
14187 +
14188 +#ifdef CONFIG_PAX_KERNEXEC
14189 +ENTRY(pax_enter_kernel)
14190 + pushq %rdi
14191 +
14192 +#ifdef CONFIG_PARAVIRT
14193 + PV_SAVE_REGS(CLBR_RDI)
14194 +#endif
14195 +
14196 + GET_CR0_INTO_RDI
14197 + bts $16,%rdi
14198 + jnc 1f
14199 + mov %cs,%edi
14200 + cmp $__KERNEL_CS,%edi
14201 + jz 3f
14202 + ljmpq __KERNEL_CS,3f
14203 +1: ljmpq __KERNEXEC_KERNEL_CS,2f
14204 +2: SET_RDI_INTO_CR0
14205 +3:
14206 +
14207 +#ifdef CONFIG_PARAVIRT
14208 + PV_RESTORE_REGS(CLBR_RDI)
14209 +#endif
14210 +
14211 + popq %rdi
14212 + pax_force_retaddr
14213 + retq
14214 +ENDPROC(pax_enter_kernel)
14215 +
14216 +ENTRY(pax_exit_kernel)
14217 + pushq %rdi
14218 +
14219 +#ifdef CONFIG_PARAVIRT
14220 + PV_SAVE_REGS(CLBR_RDI)
14221 +#endif
14222 +
14223 + mov %cs,%rdi
14224 + cmp $__KERNEXEC_KERNEL_CS,%edi
14225 + jnz 2f
14226 + GET_CR0_INTO_RDI
14227 + btr $16,%rdi
14228 + ljmpq __KERNEL_CS,1f
14229 +1: SET_RDI_INTO_CR0
14230 +2:
14231 +
14232 +#ifdef CONFIG_PARAVIRT
14233 + PV_RESTORE_REGS(CLBR_RDI);
14234 +#endif
14235 +
14236 + popq %rdi
14237 + pax_force_retaddr
14238 + retq
14239 +ENDPROC(pax_exit_kernel)
14240 +#endif
14241 +
14242 + .macro pax_enter_kernel_user
14243 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14244 + call pax_enter_kernel_user
14245 +#endif
14246 + .endm
14247 +
14248 + .macro pax_exit_kernel_user
14249 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14250 + call pax_exit_kernel_user
14251 +#endif
14252 +#ifdef CONFIG_PAX_RANDKSTACK
14253 + push %rax
14254 + call pax_randomize_kstack
14255 + pop %rax
14256 +#endif
14257 + .endm
14258 +
14259 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14260 +ENTRY(pax_enter_kernel_user)
14261 + pushq %rdi
14262 + pushq %rbx
14263 +
14264 +#ifdef CONFIG_PARAVIRT
14265 + PV_SAVE_REGS(CLBR_RDI)
14266 +#endif
14267 +
14268 + GET_CR3_INTO_RDI
14269 + mov %rdi,%rbx
14270 + add $__START_KERNEL_map,%rbx
14271 + sub phys_base(%rip),%rbx
14272 +
14273 +#ifdef CONFIG_PARAVIRT
14274 + pushq %rdi
14275 + cmpl $0, pv_info+PARAVIRT_enabled
14276 + jz 1f
14277 + i = 0
14278 + .rept USER_PGD_PTRS
14279 + mov i*8(%rbx),%rsi
14280 + mov $0,%sil
14281 + lea i*8(%rbx),%rdi
14282 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
14283 + i = i + 1
14284 + .endr
14285 + jmp 2f
14286 +1:
14287 +#endif
14288 +
14289 + i = 0
14290 + .rept USER_PGD_PTRS
14291 + movb $0,i*8(%rbx)
14292 + i = i + 1
14293 + .endr
14294 +
14295 +#ifdef CONFIG_PARAVIRT
14296 +2: popq %rdi
14297 +#endif
14298 + SET_RDI_INTO_CR3
14299 +
14300 +#ifdef CONFIG_PAX_KERNEXEC
14301 + GET_CR0_INTO_RDI
14302 + bts $16,%rdi
14303 + SET_RDI_INTO_CR0
14304 +#endif
14305 +
14306 +#ifdef CONFIG_PARAVIRT
14307 + PV_RESTORE_REGS(CLBR_RDI)
14308 +#endif
14309 +
14310 + popq %rbx
14311 + popq %rdi
14312 + pax_force_retaddr
14313 + retq
14314 +ENDPROC(pax_enter_kernel_user)
14315 +
14316 +ENTRY(pax_exit_kernel_user)
14317 + push %rdi
14318 +
14319 +#ifdef CONFIG_PARAVIRT
14320 + pushq %rbx
14321 + PV_SAVE_REGS(CLBR_RDI)
14322 +#endif
14323 +
14324 +#ifdef CONFIG_PAX_KERNEXEC
14325 + GET_CR0_INTO_RDI
14326 + btr $16,%rdi
14327 + SET_RDI_INTO_CR0
14328 +#endif
14329 +
14330 + GET_CR3_INTO_RDI
14331 + add $__START_KERNEL_map,%rdi
14332 + sub phys_base(%rip),%rdi
14333 +
14334 +#ifdef CONFIG_PARAVIRT
14335 + cmpl $0, pv_info+PARAVIRT_enabled
14336 + jz 1f
14337 + mov %rdi,%rbx
14338 + i = 0
14339 + .rept USER_PGD_PTRS
14340 + mov i*8(%rbx),%rsi
14341 + mov $0x67,%sil
14342 + lea i*8(%rbx),%rdi
14343 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
14344 + i = i + 1
14345 + .endr
14346 + jmp 2f
14347 +1:
14348 +#endif
14349 +
14350 + i = 0
14351 + .rept USER_PGD_PTRS
14352 + movb $0x67,i*8(%rdi)
14353 + i = i + 1
14354 + .endr
14355 +
14356 +#ifdef CONFIG_PARAVIRT
14357 +2: PV_RESTORE_REGS(CLBR_RDI)
14358 + popq %rbx
14359 +#endif
14360 +
14361 + popq %rdi
14362 + pax_force_retaddr
14363 + retq
14364 +ENDPROC(pax_exit_kernel_user)
14365 +#endif
14366 +
14367 +.macro pax_erase_kstack
14368 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14369 + call pax_erase_kstack
14370 +#endif
14371 +.endm
14372 +
14373 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14374 +/*
14375 + * r10: thread_info
14376 + * rcx, rdx: can be clobbered
14377 + */
14378 +ENTRY(pax_erase_kstack)
14379 + pushq %rdi
14380 + pushq %rax
14381 + pushq %r10
14382 +
14383 + GET_THREAD_INFO(%r10)
14384 + mov TI_lowest_stack(%r10), %rdi
14385 + mov $-0xBEEF, %rax
14386 + std
14387 +
14388 +1: mov %edi, %ecx
14389 + and $THREAD_SIZE_asm - 1, %ecx
14390 + shr $3, %ecx
14391 + repne scasq
14392 + jecxz 2f
14393 +
14394 + cmp $2*8, %ecx
14395 + jc 2f
14396 +
14397 + mov $2*8, %ecx
14398 + repe scasq
14399 + jecxz 2f
14400 + jne 1b
14401 +
14402 +2: cld
14403 + mov %esp, %ecx
14404 + sub %edi, %ecx
14405 +
14406 + cmp $THREAD_SIZE_asm, %rcx
14407 + jb 3f
14408 + ud2
14409 +3:
14410 +
14411 + shr $3, %ecx
14412 + rep stosq
14413 +
14414 + mov TI_task_thread_sp0(%r10), %rdi
14415 + sub $256, %rdi
14416 + mov %rdi, TI_lowest_stack(%r10)
14417 +
14418 + popq %r10
14419 + popq %rax
14420 + popq %rdi
14421 + pax_force_retaddr
14422 + ret
14423 +ENDPROC(pax_erase_kstack)
14424 +#endif
14425
14426 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
14427 #ifdef CONFIG_TRACE_IRQFLAGS
14428 @@ -317,7 +588,7 @@ ENTRY(save_args)
14429 leaq -ARGOFFSET+16(%rsp),%rdi /* arg1 for handler */
14430 movq_cfi rbp, 8 /* push %rbp */
14431 leaq 8(%rsp), %rbp /* mov %rsp, %ebp */
14432 - testl $3, CS(%rdi)
14433 + testb $3, CS(%rdi)
14434 je 1f
14435 SWAPGS
14436 /*
14437 @@ -337,6 +608,7 @@ ENTRY(save_args)
14438 * We entered an interrupt context - irqs are off:
14439 */
14440 2: TRACE_IRQS_OFF
14441 + pax_force_retaddr
14442 ret
14443 CFI_ENDPROC
14444 END(save_args)
14445 @@ -352,6 +624,7 @@ ENTRY(save_rest)
14446 movq_cfi r15, R15+16
14447 movq %r11, 8(%rsp) /* return address */
14448 FIXUP_TOP_OF_STACK %r11, 16
14449 + pax_force_retaddr
14450 ret
14451 CFI_ENDPROC
14452 END(save_rest)
14453 @@ -383,7 +656,8 @@ ENTRY(save_paranoid)
14454 js 1f /* negative -> in kernel */
14455 SWAPGS
14456 xorl %ebx,%ebx
14457 -1: ret
14458 +1: pax_force_retaddr
14459 + ret
14460 CFI_ENDPROC
14461 END(save_paranoid)
14462 .popsection
14463 @@ -409,7 +683,7 @@ ENTRY(ret_from_fork)
14464
14465 RESTORE_REST
14466
14467 - testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14468 + testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14469 je int_ret_from_sys_call
14470
14471 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
14472 @@ -455,7 +729,7 @@ END(ret_from_fork)
14473 ENTRY(system_call)
14474 CFI_STARTPROC simple
14475 CFI_SIGNAL_FRAME
14476 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
14477 + CFI_DEF_CFA rsp,0
14478 CFI_REGISTER rip,rcx
14479 /*CFI_REGISTER rflags,r11*/
14480 SWAPGS_UNSAFE_STACK
14481 @@ -468,12 +742,13 @@ ENTRY(system_call_after_swapgs)
14482
14483 movq %rsp,PER_CPU_VAR(old_rsp)
14484 movq PER_CPU_VAR(kernel_stack),%rsp
14485 + pax_enter_kernel_user
14486 /*
14487 * No need to follow this irqs off/on section - it's straight
14488 * and short:
14489 */
14490 ENABLE_INTERRUPTS(CLBR_NONE)
14491 - SAVE_ARGS 8,1
14492 + SAVE_ARGS 8*6,1
14493 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
14494 movq %rcx,RIP-ARGOFFSET(%rsp)
14495 CFI_REL_OFFSET rip,RIP-ARGOFFSET
14496 @@ -502,6 +777,8 @@ sysret_check:
14497 andl %edi,%edx
14498 jnz sysret_careful
14499 CFI_REMEMBER_STATE
14500 + pax_exit_kernel_user
14501 + pax_erase_kstack
14502 /*
14503 * sysretq will re-enable interrupts:
14504 */
14505 @@ -562,6 +839,9 @@ auditsys:
14506 movq %rax,%rsi /* 2nd arg: syscall number */
14507 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
14508 call audit_syscall_entry
14509 +
14510 + pax_erase_kstack
14511 +
14512 LOAD_ARGS 0 /* reload call-clobbered registers */
14513 jmp system_call_fastpath
14514
14515 @@ -592,6 +872,9 @@ tracesys:
14516 FIXUP_TOP_OF_STACK %rdi
14517 movq %rsp,%rdi
14518 call syscall_trace_enter
14519 +
14520 + pax_erase_kstack
14521 +
14522 /*
14523 * Reload arg registers from stack in case ptrace changed them.
14524 * We don't reload %rax because syscall_trace_enter() returned
14525 @@ -613,7 +896,7 @@ tracesys:
14526 GLOBAL(int_ret_from_sys_call)
14527 DISABLE_INTERRUPTS(CLBR_NONE)
14528 TRACE_IRQS_OFF
14529 - testl $3,CS-ARGOFFSET(%rsp)
14530 + testb $3,CS-ARGOFFSET(%rsp)
14531 je retint_restore_args
14532 movl $_TIF_ALLWORK_MASK,%edi
14533 /* edi: mask to check */
14534 @@ -708,6 +991,7 @@ ENTRY(ptregscall_common)
14535 movq_cfi_restore R12+8, r12
14536 movq_cfi_restore RBP+8, rbp
14537 movq_cfi_restore RBX+8, rbx
14538 + pax_force_retaddr
14539 ret $REST_SKIP /* pop extended registers */
14540 CFI_ENDPROC
14541 END(ptregscall_common)
14542 @@ -800,6 +1084,16 @@ END(interrupt)
14543 CFI_ADJUST_CFA_OFFSET 10*8
14544 call save_args
14545 PARTIAL_FRAME 0
14546 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14547 + testb $3, CS(%rdi)
14548 + jnz 1f
14549 + pax_enter_kernel
14550 + jmp 2f
14551 +1: pax_enter_kernel_user
14552 +2:
14553 +#else
14554 + pax_enter_kernel
14555 +#endif
14556 call \func
14557 .endm
14558
14559 @@ -822,7 +1116,7 @@ ret_from_intr:
14560 CFI_ADJUST_CFA_OFFSET -8
14561 exit_intr:
14562 GET_THREAD_INFO(%rcx)
14563 - testl $3,CS-ARGOFFSET(%rsp)
14564 + testb $3,CS-ARGOFFSET(%rsp)
14565 je retint_kernel
14566
14567 /* Interrupt came from user space */
14568 @@ -844,12 +1138,16 @@ retint_swapgs: /* return to user-space
14569 * The iretq could re-enable interrupts:
14570 */
14571 DISABLE_INTERRUPTS(CLBR_ANY)
14572 + pax_exit_kernel_user
14573 + pax_erase_kstack
14574 TRACE_IRQS_IRETQ
14575 SWAPGS
14576 jmp restore_args
14577
14578 retint_restore_args: /* return to kernel space */
14579 DISABLE_INTERRUPTS(CLBR_ANY)
14580 + pax_exit_kernel
14581 + pax_force_retaddr RIP-ARGOFFSET
14582 /*
14583 * The iretq could re-enable interrupts:
14584 */
14585 @@ -1032,6 +1330,16 @@ ENTRY(\sym)
14586 CFI_ADJUST_CFA_OFFSET 15*8
14587 call error_entry
14588 DEFAULT_FRAME 0
14589 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14590 + testb $3, CS(%rsp)
14591 + jnz 1f
14592 + pax_enter_kernel
14593 + jmp 2f
14594 +1: pax_enter_kernel_user
14595 +2:
14596 +#else
14597 + pax_enter_kernel
14598 +#endif
14599 movq %rsp,%rdi /* pt_regs pointer */
14600 xorl %esi,%esi /* no error code */
14601 call \do_sym
14602 @@ -1049,6 +1357,16 @@ ENTRY(\sym)
14603 subq $15*8, %rsp
14604 call save_paranoid
14605 TRACE_IRQS_OFF
14606 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14607 + testb $3, CS(%rsp)
14608 + jnz 1f
14609 + pax_enter_kernel
14610 + jmp 2f
14611 +1: pax_enter_kernel_user
14612 +2:
14613 +#else
14614 + pax_enter_kernel
14615 +#endif
14616 movq %rsp,%rdi /* pt_regs pointer */
14617 xorl %esi,%esi /* no error code */
14618 call \do_sym
14619 @@ -1066,9 +1384,24 @@ ENTRY(\sym)
14620 subq $15*8, %rsp
14621 call save_paranoid
14622 TRACE_IRQS_OFF
14623 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14624 + testb $3, CS(%rsp)
14625 + jnz 1f
14626 + pax_enter_kernel
14627 + jmp 2f
14628 +1: pax_enter_kernel_user
14629 +2:
14630 +#else
14631 + pax_enter_kernel
14632 +#endif
14633 movq %rsp,%rdi /* pt_regs pointer */
14634 xorl %esi,%esi /* no error code */
14635 - PER_CPU(init_tss, %rbp)
14636 +#ifdef CONFIG_SMP
14637 + imul $TSS_size, PER_CPU_VAR(cpu_number), %ebp
14638 + lea init_tss(%rbp), %rbp
14639 +#else
14640 + lea init_tss(%rip), %rbp
14641 +#endif
14642 subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
14643 call \do_sym
14644 addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
14645 @@ -1085,6 +1418,16 @@ ENTRY(\sym)
14646 CFI_ADJUST_CFA_OFFSET 15*8
14647 call error_entry
14648 DEFAULT_FRAME 0
14649 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14650 + testb $3, CS(%rsp)
14651 + jnz 1f
14652 + pax_enter_kernel
14653 + jmp 2f
14654 +1: pax_enter_kernel_user
14655 +2:
14656 +#else
14657 + pax_enter_kernel
14658 +#endif
14659 movq %rsp,%rdi /* pt_regs pointer */
14660 movq ORIG_RAX(%rsp),%rsi /* get error code */
14661 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14662 @@ -1104,6 +1447,16 @@ ENTRY(\sym)
14663 call save_paranoid
14664 DEFAULT_FRAME 0
14665 TRACE_IRQS_OFF
14666 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14667 + testb $3, CS(%rsp)
14668 + jnz 1f
14669 + pax_enter_kernel
14670 + jmp 2f
14671 +1: pax_enter_kernel_user
14672 +2:
14673 +#else
14674 + pax_enter_kernel
14675 +#endif
14676 movq %rsp,%rdi /* pt_regs pointer */
14677 movq ORIG_RAX(%rsp),%rsi /* get error code */
14678 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14679 @@ -1141,6 +1494,7 @@ gs_change:
14680 SWAPGS
14681 popf
14682 CFI_ADJUST_CFA_OFFSET -8
14683 + pax_force_retaddr
14684 ret
14685 CFI_ENDPROC
14686 END(native_load_gs_index)
14687 @@ -1195,6 +1549,7 @@ ENTRY(kernel_thread)
14688 */
14689 RESTORE_ALL
14690 UNFAKE_STACK_FRAME
14691 + pax_force_retaddr
14692 ret
14693 CFI_ENDPROC
14694 END(kernel_thread)
14695 @@ -1208,6 +1563,7 @@ ENTRY(child_rip)
14696 */
14697 movq %rdi, %rax
14698 movq %rsi, %rdi
14699 + pax_force_fptr %rax
14700 call *%rax
14701 # exit
14702 mov %eax, %edi
14703 @@ -1243,6 +1599,7 @@ ENTRY(kernel_execve)
14704 je int_ret_from_sys_call
14705 RESTORE_ARGS
14706 UNFAKE_STACK_FRAME
14707 + pax_force_retaddr
14708 ret
14709 CFI_ENDPROC
14710 END(kernel_execve)
14711 @@ -1263,6 +1620,7 @@ ENTRY(call_softirq)
14712 CFI_DEF_CFA_REGISTER rsp
14713 CFI_ADJUST_CFA_OFFSET -8
14714 decl PER_CPU_VAR(irq_count)
14715 + pax_force_retaddr
14716 ret
14717 CFI_ENDPROC
14718 END(call_softirq)
14719 @@ -1405,16 +1763,31 @@ ENTRY(paranoid_exit)
14720 TRACE_IRQS_OFF
14721 testl %ebx,%ebx /* swapgs needed? */
14722 jnz paranoid_restore
14723 - testl $3,CS(%rsp)
14724 + testb $3,CS(%rsp)
14725 jnz paranoid_userspace
14726 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14727 + pax_exit_kernel
14728 + TRACE_IRQS_IRETQ 0
14729 + SWAPGS_UNSAFE_STACK
14730 + RESTORE_ALL 8
14731 + pax_force_retaddr
14732 + jmp irq_return
14733 +#endif
14734 paranoid_swapgs:
14735 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14736 + pax_exit_kernel_user
14737 +#else
14738 + pax_exit_kernel
14739 +#endif
14740 TRACE_IRQS_IRETQ 0
14741 SWAPGS_UNSAFE_STACK
14742 RESTORE_ALL 8
14743 jmp irq_return
14744 paranoid_restore:
14745 + pax_exit_kernel
14746 TRACE_IRQS_IRETQ 0
14747 RESTORE_ALL 8
14748 + pax_force_retaddr
14749 jmp irq_return
14750 paranoid_userspace:
14751 GET_THREAD_INFO(%rcx)
14752 @@ -1470,12 +1843,13 @@ ENTRY(error_entry)
14753 movq_cfi r14, R14+8
14754 movq_cfi r15, R15+8
14755 xorl %ebx,%ebx
14756 - testl $3,CS+8(%rsp)
14757 + testb $3,CS+8(%rsp)
14758 je error_kernelspace
14759 error_swapgs:
14760 SWAPGS
14761 error_sti:
14762 TRACE_IRQS_OFF
14763 + pax_force_retaddr
14764 ret
14765 CFI_ENDPROC
14766
14767 @@ -1529,6 +1903,16 @@ ENTRY(nmi)
14768 CFI_ADJUST_CFA_OFFSET 15*8
14769 call save_paranoid
14770 DEFAULT_FRAME 0
14771 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14772 + testb $3, CS(%rsp)
14773 + jnz 1f
14774 + pax_enter_kernel
14775 + jmp 2f
14776 +1: pax_enter_kernel_user
14777 +2:
14778 +#else
14779 + pax_enter_kernel
14780 +#endif
14781 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
14782 movq %rsp,%rdi
14783 movq $-1,%rsi
14784 @@ -1539,12 +1923,28 @@ ENTRY(nmi)
14785 DISABLE_INTERRUPTS(CLBR_NONE)
14786 testl %ebx,%ebx /* swapgs needed? */
14787 jnz nmi_restore
14788 - testl $3,CS(%rsp)
14789 + testb $3,CS(%rsp)
14790 jnz nmi_userspace
14791 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14792 + pax_exit_kernel
14793 + SWAPGS_UNSAFE_STACK
14794 + RESTORE_ALL 8
14795 + pax_force_retaddr
14796 + jmp irq_return
14797 +#endif
14798 nmi_swapgs:
14799 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14800 + pax_exit_kernel_user
14801 +#else
14802 + pax_exit_kernel
14803 +#endif
14804 SWAPGS_UNSAFE_STACK
14805 + RESTORE_ALL 8
14806 + jmp irq_return
14807 nmi_restore:
14808 + pax_exit_kernel
14809 RESTORE_ALL 8
14810 + pax_force_retaddr
14811 jmp irq_return
14812 nmi_userspace:
14813 GET_THREAD_INFO(%rcx)
14814 diff -urNp linux-2.6.32.46/arch/x86/kernel/ftrace.c linux-2.6.32.46/arch/x86/kernel/ftrace.c
14815 --- linux-2.6.32.46/arch/x86/kernel/ftrace.c 2011-03-27 14:31:47.000000000 -0400
14816 +++ linux-2.6.32.46/arch/x86/kernel/ftrace.c 2011-05-04 17:56:20.000000000 -0400
14817 @@ -103,7 +103,7 @@ static void *mod_code_ip; /* holds the
14818 static void *mod_code_newcode; /* holds the text to write to the IP */
14819
14820 static unsigned nmi_wait_count;
14821 -static atomic_t nmi_update_count = ATOMIC_INIT(0);
14822 +static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
14823
14824 int ftrace_arch_read_dyn_info(char *buf, int size)
14825 {
14826 @@ -111,7 +111,7 @@ int ftrace_arch_read_dyn_info(char *buf,
14827
14828 r = snprintf(buf, size, "%u %u",
14829 nmi_wait_count,
14830 - atomic_read(&nmi_update_count));
14831 + atomic_read_unchecked(&nmi_update_count));
14832 return r;
14833 }
14834
14835 @@ -149,8 +149,10 @@ void ftrace_nmi_enter(void)
14836 {
14837 if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
14838 smp_rmb();
14839 + pax_open_kernel();
14840 ftrace_mod_code();
14841 - atomic_inc(&nmi_update_count);
14842 + pax_close_kernel();
14843 + atomic_inc_unchecked(&nmi_update_count);
14844 }
14845 /* Must have previous changes seen before executions */
14846 smp_mb();
14847 @@ -215,7 +217,7 @@ do_ftrace_mod_code(unsigned long ip, voi
14848
14849
14850
14851 -static unsigned char ftrace_nop[MCOUNT_INSN_SIZE];
14852 +static unsigned char ftrace_nop[MCOUNT_INSN_SIZE] __read_only;
14853
14854 static unsigned char *ftrace_nop_replace(void)
14855 {
14856 @@ -228,6 +230,8 @@ ftrace_modify_code(unsigned long ip, uns
14857 {
14858 unsigned char replaced[MCOUNT_INSN_SIZE];
14859
14860 + ip = ktla_ktva(ip);
14861 +
14862 /*
14863 * Note: Due to modules and __init, code can
14864 * disappear and change, we need to protect against faulting
14865 @@ -284,7 +288,7 @@ int ftrace_update_ftrace_func(ftrace_fun
14866 unsigned char old[MCOUNT_INSN_SIZE], *new;
14867 int ret;
14868
14869 - memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
14870 + memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
14871 new = ftrace_call_replace(ip, (unsigned long)func);
14872 ret = ftrace_modify_code(ip, old, new);
14873
14874 @@ -337,15 +341,15 @@ int __init ftrace_dyn_arch_init(void *da
14875 switch (faulted) {
14876 case 0:
14877 pr_info("ftrace: converting mcount calls to 0f 1f 44 00 00\n");
14878 - memcpy(ftrace_nop, ftrace_test_p6nop, MCOUNT_INSN_SIZE);
14879 + memcpy(ftrace_nop, ktla_ktva(ftrace_test_p6nop), MCOUNT_INSN_SIZE);
14880 break;
14881 case 1:
14882 pr_info("ftrace: converting mcount calls to 66 66 66 66 90\n");
14883 - memcpy(ftrace_nop, ftrace_test_nop5, MCOUNT_INSN_SIZE);
14884 + memcpy(ftrace_nop, ktla_ktva(ftrace_test_nop5), MCOUNT_INSN_SIZE);
14885 break;
14886 case 2:
14887 pr_info("ftrace: converting mcount calls to jmp . + 5\n");
14888 - memcpy(ftrace_nop, ftrace_test_jmp, MCOUNT_INSN_SIZE);
14889 + memcpy(ftrace_nop, ktla_ktva(ftrace_test_jmp), MCOUNT_INSN_SIZE);
14890 break;
14891 }
14892
14893 @@ -366,6 +370,8 @@ static int ftrace_mod_jmp(unsigned long
14894 {
14895 unsigned char code[MCOUNT_INSN_SIZE];
14896
14897 + ip = ktla_ktva(ip);
14898 +
14899 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
14900 return -EFAULT;
14901
14902 diff -urNp linux-2.6.32.46/arch/x86/kernel/head32.c linux-2.6.32.46/arch/x86/kernel/head32.c
14903 --- linux-2.6.32.46/arch/x86/kernel/head32.c 2011-03-27 14:31:47.000000000 -0400
14904 +++ linux-2.6.32.46/arch/x86/kernel/head32.c 2011-04-17 15:56:46.000000000 -0400
14905 @@ -16,6 +16,7 @@
14906 #include <asm/apic.h>
14907 #include <asm/io_apic.h>
14908 #include <asm/bios_ebda.h>
14909 +#include <asm/boot.h>
14910
14911 static void __init i386_default_early_setup(void)
14912 {
14913 @@ -31,7 +32,7 @@ void __init i386_start_kernel(void)
14914 {
14915 reserve_trampoline_memory();
14916
14917 - reserve_early(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14918 + reserve_early(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14919
14920 #ifdef CONFIG_BLK_DEV_INITRD
14921 /* Reserve INITRD */
14922 diff -urNp linux-2.6.32.46/arch/x86/kernel/head_32.S linux-2.6.32.46/arch/x86/kernel/head_32.S
14923 --- linux-2.6.32.46/arch/x86/kernel/head_32.S 2011-03-27 14:31:47.000000000 -0400
14924 +++ linux-2.6.32.46/arch/x86/kernel/head_32.S 2011-07-06 19:53:33.000000000 -0400
14925 @@ -19,10 +19,17 @@
14926 #include <asm/setup.h>
14927 #include <asm/processor-flags.h>
14928 #include <asm/percpu.h>
14929 +#include <asm/msr-index.h>
14930
14931 /* Physical address */
14932 #define pa(X) ((X) - __PAGE_OFFSET)
14933
14934 +#ifdef CONFIG_PAX_KERNEXEC
14935 +#define ta(X) (X)
14936 +#else
14937 +#define ta(X) ((X) - __PAGE_OFFSET)
14938 +#endif
14939 +
14940 /*
14941 * References to members of the new_cpu_data structure.
14942 */
14943 @@ -52,11 +59,7 @@
14944 * and small than max_low_pfn, otherwise will waste some page table entries
14945 */
14946
14947 -#if PTRS_PER_PMD > 1
14948 -#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
14949 -#else
14950 -#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
14951 -#endif
14952 +#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
14953
14954 /* Enough space to fit pagetables for the low memory linear map */
14955 MAPPING_BEYOND_END = \
14956 @@ -73,6 +76,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
14957 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14958
14959 /*
14960 + * Real beginning of normal "text" segment
14961 + */
14962 +ENTRY(stext)
14963 +ENTRY(_stext)
14964 +
14965 +/*
14966 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
14967 * %esi points to the real-mode code as a 32-bit pointer.
14968 * CS and DS must be 4 GB flat segments, but we don't depend on
14969 @@ -80,7 +89,16 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14970 * can.
14971 */
14972 __HEAD
14973 +
14974 +#ifdef CONFIG_PAX_KERNEXEC
14975 + jmp startup_32
14976 +/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
14977 +.fill PAGE_SIZE-5,1,0xcc
14978 +#endif
14979 +
14980 ENTRY(startup_32)
14981 + movl pa(stack_start),%ecx
14982 +
14983 /* test KEEP_SEGMENTS flag to see if the bootloader is asking
14984 us to not reload segments */
14985 testb $(1<<6), BP_loadflags(%esi)
14986 @@ -95,7 +113,60 @@ ENTRY(startup_32)
14987 movl %eax,%es
14988 movl %eax,%fs
14989 movl %eax,%gs
14990 + movl %eax,%ss
14991 2:
14992 + leal -__PAGE_OFFSET(%ecx),%esp
14993 +
14994 +#ifdef CONFIG_SMP
14995 + movl $pa(cpu_gdt_table),%edi
14996 + movl $__per_cpu_load,%eax
14997 + movw %ax,__KERNEL_PERCPU + 2(%edi)
14998 + rorl $16,%eax
14999 + movb %al,__KERNEL_PERCPU + 4(%edi)
15000 + movb %ah,__KERNEL_PERCPU + 7(%edi)
15001 + movl $__per_cpu_end - 1,%eax
15002 + subl $__per_cpu_start,%eax
15003 + movw %ax,__KERNEL_PERCPU + 0(%edi)
15004 +#endif
15005 +
15006 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15007 + movl $NR_CPUS,%ecx
15008 + movl $pa(cpu_gdt_table),%edi
15009 +1:
15010 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
15011 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
15012 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
15013 + addl $PAGE_SIZE_asm,%edi
15014 + loop 1b
15015 +#endif
15016 +
15017 +#ifdef CONFIG_PAX_KERNEXEC
15018 + movl $pa(boot_gdt),%edi
15019 + movl $__LOAD_PHYSICAL_ADDR,%eax
15020 + movw %ax,__BOOT_CS + 2(%edi)
15021 + rorl $16,%eax
15022 + movb %al,__BOOT_CS + 4(%edi)
15023 + movb %ah,__BOOT_CS + 7(%edi)
15024 + rorl $16,%eax
15025 +
15026 + ljmp $(__BOOT_CS),$1f
15027 +1:
15028 +
15029 + movl $NR_CPUS,%ecx
15030 + movl $pa(cpu_gdt_table),%edi
15031 + addl $__PAGE_OFFSET,%eax
15032 +1:
15033 + movw %ax,__KERNEL_CS + 2(%edi)
15034 + movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
15035 + rorl $16,%eax
15036 + movb %al,__KERNEL_CS + 4(%edi)
15037 + movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
15038 + movb %ah,__KERNEL_CS + 7(%edi)
15039 + movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
15040 + rorl $16,%eax
15041 + addl $PAGE_SIZE_asm,%edi
15042 + loop 1b
15043 +#endif
15044
15045 /*
15046 * Clear BSS first so that there are no surprises...
15047 @@ -140,9 +211,7 @@ ENTRY(startup_32)
15048 cmpl $num_subarch_entries, %eax
15049 jae bad_subarch
15050
15051 - movl pa(subarch_entries)(,%eax,4), %eax
15052 - subl $__PAGE_OFFSET, %eax
15053 - jmp *%eax
15054 + jmp *pa(subarch_entries)(,%eax,4)
15055
15056 bad_subarch:
15057 WEAK(lguest_entry)
15058 @@ -154,10 +223,10 @@ WEAK(xen_entry)
15059 __INITDATA
15060
15061 subarch_entries:
15062 - .long default_entry /* normal x86/PC */
15063 - .long lguest_entry /* lguest hypervisor */
15064 - .long xen_entry /* Xen hypervisor */
15065 - .long default_entry /* Moorestown MID */
15066 + .long ta(default_entry) /* normal x86/PC */
15067 + .long ta(lguest_entry) /* lguest hypervisor */
15068 + .long ta(xen_entry) /* Xen hypervisor */
15069 + .long ta(default_entry) /* Moorestown MID */
15070 num_subarch_entries = (. - subarch_entries) / 4
15071 .previous
15072 #endif /* CONFIG_PARAVIRT */
15073 @@ -218,8 +287,11 @@ default_entry:
15074 movl %eax, pa(max_pfn_mapped)
15075
15076 /* Do early initialization of the fixmap area */
15077 - movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
15078 - movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
15079 +#ifdef CONFIG_COMPAT_VDSO
15080 + movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_pmd+0x1000*KPMDS-8)
15081 +#else
15082 + movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_pmd+0x1000*KPMDS-8)
15083 +#endif
15084 #else /* Not PAE */
15085
15086 page_pde_offset = (__PAGE_OFFSET >> 20);
15087 @@ -249,8 +321,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
15088 movl %eax, pa(max_pfn_mapped)
15089
15090 /* Do early initialization of the fixmap area */
15091 - movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
15092 - movl %eax,pa(swapper_pg_dir+0xffc)
15093 +#ifdef CONFIG_COMPAT_VDSO
15094 + movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_dir+0xffc)
15095 +#else
15096 + movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_dir+0xffc)
15097 +#endif
15098 #endif
15099 jmp 3f
15100 /*
15101 @@ -272,6 +347,9 @@ ENTRY(startup_32_smp)
15102 movl %eax,%es
15103 movl %eax,%fs
15104 movl %eax,%gs
15105 + movl pa(stack_start),%ecx
15106 + movl %eax,%ss
15107 + leal -__PAGE_OFFSET(%ecx),%esp
15108 #endif /* CONFIG_SMP */
15109 3:
15110
15111 @@ -297,6 +375,7 @@ ENTRY(startup_32_smp)
15112 orl %edx,%eax
15113 movl %eax,%cr4
15114
15115 +#ifdef CONFIG_X86_PAE
15116 btl $5, %eax # check if PAE is enabled
15117 jnc 6f
15118
15119 @@ -305,6 +384,10 @@ ENTRY(startup_32_smp)
15120 cpuid
15121 cmpl $0x80000000, %eax
15122 jbe 6f
15123 +
15124 + /* Clear bogus XD_DISABLE bits */
15125 + call verify_cpu
15126 +
15127 mov $0x80000001, %eax
15128 cpuid
15129 /* Execute Disable bit supported? */
15130 @@ -312,13 +395,17 @@ ENTRY(startup_32_smp)
15131 jnc 6f
15132
15133 /* Setup EFER (Extended Feature Enable Register) */
15134 - movl $0xc0000080, %ecx
15135 + movl $MSR_EFER, %ecx
15136 rdmsr
15137
15138 btsl $11, %eax
15139 /* Make changes effective */
15140 wrmsr
15141
15142 + btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
15143 + movl $1,pa(nx_enabled)
15144 +#endif
15145 +
15146 6:
15147
15148 /*
15149 @@ -331,8 +418,8 @@ ENTRY(startup_32_smp)
15150 movl %eax,%cr0 /* ..and set paging (PG) bit */
15151 ljmp $__BOOT_CS,$1f /* Clear prefetch and normalize %eip */
15152 1:
15153 - /* Set up the stack pointer */
15154 - lss stack_start,%esp
15155 + /* Shift the stack pointer to a virtual address */
15156 + addl $__PAGE_OFFSET, %esp
15157
15158 /*
15159 * Initialize eflags. Some BIOS's leave bits like NT set. This would
15160 @@ -344,9 +431,7 @@ ENTRY(startup_32_smp)
15161
15162 #ifdef CONFIG_SMP
15163 cmpb $0, ready
15164 - jz 1f /* Initial CPU cleans BSS */
15165 - jmp checkCPUtype
15166 -1:
15167 + jnz checkCPUtype
15168 #endif /* CONFIG_SMP */
15169
15170 /*
15171 @@ -424,7 +509,7 @@ is386: movl $2,%ecx # set MP
15172 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
15173 movl %eax,%ss # after changing gdt.
15174
15175 - movl $(__USER_DS),%eax # DS/ES contains default USER segment
15176 +# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
15177 movl %eax,%ds
15178 movl %eax,%es
15179
15180 @@ -438,15 +523,22 @@ is386: movl $2,%ecx # set MP
15181 */
15182 cmpb $0,ready
15183 jne 1f
15184 - movl $per_cpu__gdt_page,%eax
15185 + movl $cpu_gdt_table,%eax
15186 movl $per_cpu__stack_canary,%ecx
15187 +#ifdef CONFIG_SMP
15188 + addl $__per_cpu_load,%ecx
15189 +#endif
15190 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
15191 shrl $16, %ecx
15192 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
15193 movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
15194 1:
15195 -#endif
15196 movl $(__KERNEL_STACK_CANARY),%eax
15197 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
15198 + movl $(__USER_DS),%eax
15199 +#else
15200 + xorl %eax,%eax
15201 +#endif
15202 movl %eax,%gs
15203
15204 xorl %eax,%eax # Clear LDT
15205 @@ -454,14 +546,7 @@ is386: movl $2,%ecx # set MP
15206
15207 cld # gcc2 wants the direction flag cleared at all times
15208 pushl $0 # fake return address for unwinder
15209 -#ifdef CONFIG_SMP
15210 - movb ready, %cl
15211 movb $1, ready
15212 - cmpb $0,%cl # the first CPU calls start_kernel
15213 - je 1f
15214 - movl (stack_start), %esp
15215 -1:
15216 -#endif /* CONFIG_SMP */
15217 jmp *(initial_code)
15218
15219 /*
15220 @@ -546,22 +631,22 @@ early_page_fault:
15221 jmp early_fault
15222
15223 early_fault:
15224 - cld
15225 #ifdef CONFIG_PRINTK
15226 + cmpl $1,%ss:early_recursion_flag
15227 + je hlt_loop
15228 + incl %ss:early_recursion_flag
15229 + cld
15230 pusha
15231 movl $(__KERNEL_DS),%eax
15232 movl %eax,%ds
15233 movl %eax,%es
15234 - cmpl $2,early_recursion_flag
15235 - je hlt_loop
15236 - incl early_recursion_flag
15237 movl %cr2,%eax
15238 pushl %eax
15239 pushl %edx /* trapno */
15240 pushl $fault_msg
15241 call printk
15242 +; call dump_stack
15243 #endif
15244 - call dump_stack
15245 hlt_loop:
15246 hlt
15247 jmp hlt_loop
15248 @@ -569,8 +654,11 @@ hlt_loop:
15249 /* This is the default interrupt "handler" :-) */
15250 ALIGN
15251 ignore_int:
15252 - cld
15253 #ifdef CONFIG_PRINTK
15254 + cmpl $2,%ss:early_recursion_flag
15255 + je hlt_loop
15256 + incl %ss:early_recursion_flag
15257 + cld
15258 pushl %eax
15259 pushl %ecx
15260 pushl %edx
15261 @@ -579,9 +667,6 @@ ignore_int:
15262 movl $(__KERNEL_DS),%eax
15263 movl %eax,%ds
15264 movl %eax,%es
15265 - cmpl $2,early_recursion_flag
15266 - je hlt_loop
15267 - incl early_recursion_flag
15268 pushl 16(%esp)
15269 pushl 24(%esp)
15270 pushl 32(%esp)
15271 @@ -600,6 +685,8 @@ ignore_int:
15272 #endif
15273 iret
15274
15275 +#include "verify_cpu.S"
15276 +
15277 __REFDATA
15278 .align 4
15279 ENTRY(initial_code)
15280 @@ -610,31 +697,47 @@ ENTRY(initial_page_table)
15281 /*
15282 * BSS section
15283 */
15284 -__PAGE_ALIGNED_BSS
15285 - .align PAGE_SIZE_asm
15286 #ifdef CONFIG_X86_PAE
15287 +.section .swapper_pg_pmd,"a",@progbits
15288 swapper_pg_pmd:
15289 .fill 1024*KPMDS,4,0
15290 #else
15291 +.section .swapper_pg_dir,"a",@progbits
15292 ENTRY(swapper_pg_dir)
15293 .fill 1024,4,0
15294 #endif
15295 +.section .swapper_pg_fixmap,"a",@progbits
15296 swapper_pg_fixmap:
15297 .fill 1024,4,0
15298 #ifdef CONFIG_X86_TRAMPOLINE
15299 +.section .trampoline_pg_dir,"a",@progbits
15300 ENTRY(trampoline_pg_dir)
15301 +#ifdef CONFIG_X86_PAE
15302 + .fill 4,8,0
15303 +#else
15304 .fill 1024,4,0
15305 #endif
15306 +#endif
15307 +
15308 +.section .empty_zero_page,"a",@progbits
15309 ENTRY(empty_zero_page)
15310 .fill 4096,1,0
15311
15312 /*
15313 + * The IDT has to be page-aligned to simplify the Pentium
15314 + * F0 0F bug workaround.. We have a special link segment
15315 + * for this.
15316 + */
15317 +.section .idt,"a",@progbits
15318 +ENTRY(idt_table)
15319 + .fill 256,8,0
15320 +
15321 +/*
15322 * This starts the data section.
15323 */
15324 #ifdef CONFIG_X86_PAE
15325 -__PAGE_ALIGNED_DATA
15326 - /* Page-aligned for the benefit of paravirt? */
15327 - .align PAGE_SIZE_asm
15328 +.section .swapper_pg_dir,"a",@progbits
15329 +
15330 ENTRY(swapper_pg_dir)
15331 .long pa(swapper_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
15332 # if KPMDS == 3
15333 @@ -653,15 +756,24 @@ ENTRY(swapper_pg_dir)
15334 # error "Kernel PMDs should be 1, 2 or 3"
15335 # endif
15336 .align PAGE_SIZE_asm /* needs to be page-sized too */
15337 +
15338 +#ifdef CONFIG_PAX_PER_CPU_PGD
15339 +ENTRY(cpu_pgd)
15340 + .rept NR_CPUS
15341 + .fill 4,8,0
15342 + .endr
15343 +#endif
15344 +
15345 #endif
15346
15347 .data
15348 +.balign 4
15349 ENTRY(stack_start)
15350 - .long init_thread_union+THREAD_SIZE
15351 - .long __BOOT_DS
15352 + .long init_thread_union+THREAD_SIZE-8
15353
15354 ready: .byte 0
15355
15356 +.section .rodata,"a",@progbits
15357 early_recursion_flag:
15358 .long 0
15359
15360 @@ -697,7 +809,7 @@ fault_msg:
15361 .word 0 # 32 bit align gdt_desc.address
15362 boot_gdt_descr:
15363 .word __BOOT_DS+7
15364 - .long boot_gdt - __PAGE_OFFSET
15365 + .long pa(boot_gdt)
15366
15367 .word 0 # 32-bit align idt_desc.address
15368 idt_descr:
15369 @@ -708,7 +820,7 @@ idt_descr:
15370 .word 0 # 32 bit align gdt_desc.address
15371 ENTRY(early_gdt_descr)
15372 .word GDT_ENTRIES*8-1
15373 - .long per_cpu__gdt_page /* Overwritten for secondary CPUs */
15374 + .long cpu_gdt_table /* Overwritten for secondary CPUs */
15375
15376 /*
15377 * The boot_gdt must mirror the equivalent in setup.S and is
15378 @@ -717,5 +829,65 @@ ENTRY(early_gdt_descr)
15379 .align L1_CACHE_BYTES
15380 ENTRY(boot_gdt)
15381 .fill GDT_ENTRY_BOOT_CS,8,0
15382 - .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
15383 - .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
15384 + .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
15385 + .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
15386 +
15387 + .align PAGE_SIZE_asm
15388 +ENTRY(cpu_gdt_table)
15389 + .rept NR_CPUS
15390 + .quad 0x0000000000000000 /* NULL descriptor */
15391 + .quad 0x0000000000000000 /* 0x0b reserved */
15392 + .quad 0x0000000000000000 /* 0x13 reserved */
15393 + .quad 0x0000000000000000 /* 0x1b reserved */
15394 +
15395 +#ifdef CONFIG_PAX_KERNEXEC
15396 + .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
15397 +#else
15398 + .quad 0x0000000000000000 /* 0x20 unused */
15399 +#endif
15400 +
15401 + .quad 0x0000000000000000 /* 0x28 unused */
15402 + .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
15403 + .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
15404 + .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
15405 + .quad 0x0000000000000000 /* 0x4b reserved */
15406 + .quad 0x0000000000000000 /* 0x53 reserved */
15407 + .quad 0x0000000000000000 /* 0x5b reserved */
15408 +
15409 + .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
15410 + .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
15411 + .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
15412 + .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
15413 +
15414 + .quad 0x0000000000000000 /* 0x80 TSS descriptor */
15415 + .quad 0x0000000000000000 /* 0x88 LDT descriptor */
15416 +
15417 + /*
15418 + * Segments used for calling PnP BIOS have byte granularity.
15419 + * The code segments and data segments have fixed 64k limits,
15420 + * the transfer segment sizes are set at run time.
15421 + */
15422 + .quad 0x00409b000000ffff /* 0x90 32-bit code */
15423 + .quad 0x00009b000000ffff /* 0x98 16-bit code */
15424 + .quad 0x000093000000ffff /* 0xa0 16-bit data */
15425 + .quad 0x0000930000000000 /* 0xa8 16-bit data */
15426 + .quad 0x0000930000000000 /* 0xb0 16-bit data */
15427 +
15428 + /*
15429 + * The APM segments have byte granularity and their bases
15430 + * are set at run time. All have 64k limits.
15431 + */
15432 + .quad 0x00409b000000ffff /* 0xb8 APM CS code */
15433 + .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
15434 + .quad 0x004093000000ffff /* 0xc8 APM DS data */
15435 +
15436 + .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
15437 + .quad 0x0040930000000000 /* 0xd8 - PERCPU */
15438 + .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
15439 + .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
15440 + .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
15441 + .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
15442 +
15443 + /* Be sure this is zeroed to avoid false validations in Xen */
15444 + .fill PAGE_SIZE_asm - GDT_SIZE,1,0
15445 + .endr
15446 diff -urNp linux-2.6.32.46/arch/x86/kernel/head_64.S linux-2.6.32.46/arch/x86/kernel/head_64.S
15447 --- linux-2.6.32.46/arch/x86/kernel/head_64.S 2011-03-27 14:31:47.000000000 -0400
15448 +++ linux-2.6.32.46/arch/x86/kernel/head_64.S 2011-04-17 15:56:46.000000000 -0400
15449 @@ -19,6 +19,7 @@
15450 #include <asm/cache.h>
15451 #include <asm/processor-flags.h>
15452 #include <asm/percpu.h>
15453 +#include <asm/cpufeature.h>
15454
15455 #ifdef CONFIG_PARAVIRT
15456 #include <asm/asm-offsets.h>
15457 @@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
15458 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
15459 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
15460 L3_START_KERNEL = pud_index(__START_KERNEL_map)
15461 +L4_VMALLOC_START = pgd_index(VMALLOC_START)
15462 +L3_VMALLOC_START = pud_index(VMALLOC_START)
15463 +L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
15464 +L3_VMEMMAP_START = pud_index(VMEMMAP_START)
15465
15466 .text
15467 __HEAD
15468 @@ -85,35 +90,22 @@ startup_64:
15469 */
15470 addq %rbp, init_level4_pgt + 0(%rip)
15471 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
15472 + addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
15473 + addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
15474 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
15475
15476 addq %rbp, level3_ident_pgt + 0(%rip)
15477 +#ifndef CONFIG_XEN
15478 + addq %rbp, level3_ident_pgt + 8(%rip)
15479 +#endif
15480
15481 - addq %rbp, level3_kernel_pgt + (510*8)(%rip)
15482 - addq %rbp, level3_kernel_pgt + (511*8)(%rip)
15483 + addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
15484
15485 - addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
15486 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
15487 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
15488
15489 - /* Add an Identity mapping if I am above 1G */
15490 - leaq _text(%rip), %rdi
15491 - andq $PMD_PAGE_MASK, %rdi
15492 -
15493 - movq %rdi, %rax
15494 - shrq $PUD_SHIFT, %rax
15495 - andq $(PTRS_PER_PUD - 1), %rax
15496 - jz ident_complete
15497 -
15498 - leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
15499 - leaq level3_ident_pgt(%rip), %rbx
15500 - movq %rdx, 0(%rbx, %rax, 8)
15501 -
15502 - movq %rdi, %rax
15503 - shrq $PMD_SHIFT, %rax
15504 - andq $(PTRS_PER_PMD - 1), %rax
15505 - leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
15506 - leaq level2_spare_pgt(%rip), %rbx
15507 - movq %rdx, 0(%rbx, %rax, 8)
15508 -ident_complete:
15509 + addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
15510 + addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
15511
15512 /*
15513 * Fixup the kernel text+data virtual addresses. Note that
15514 @@ -161,8 +153,8 @@ ENTRY(secondary_startup_64)
15515 * after the boot processor executes this code.
15516 */
15517
15518 - /* Enable PAE mode and PGE */
15519 - movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
15520 + /* Enable PAE mode and PSE/PGE */
15521 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
15522 movq %rax, %cr4
15523
15524 /* Setup early boot stage 4 level pagetables. */
15525 @@ -184,9 +176,13 @@ ENTRY(secondary_startup_64)
15526 movl $MSR_EFER, %ecx
15527 rdmsr
15528 btsl $_EFER_SCE, %eax /* Enable System Call */
15529 - btl $20,%edi /* No Execute supported? */
15530 + btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
15531 jnc 1f
15532 btsl $_EFER_NX, %eax
15533 + leaq init_level4_pgt(%rip), %rdi
15534 + btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
15535 + btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
15536 + btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
15537 1: wrmsr /* Make changes effective */
15538
15539 /* Setup cr0 */
15540 @@ -262,16 +258,16 @@ ENTRY(secondary_startup_64)
15541 .quad x86_64_start_kernel
15542 ENTRY(initial_gs)
15543 .quad INIT_PER_CPU_VAR(irq_stack_union)
15544 - __FINITDATA
15545
15546 ENTRY(stack_start)
15547 .quad init_thread_union+THREAD_SIZE-8
15548 .word 0
15549 + __FINITDATA
15550
15551 bad_address:
15552 jmp bad_address
15553
15554 - .section ".init.text","ax"
15555 + __INIT
15556 #ifdef CONFIG_EARLY_PRINTK
15557 .globl early_idt_handlers
15558 early_idt_handlers:
15559 @@ -316,18 +312,23 @@ ENTRY(early_idt_handler)
15560 #endif /* EARLY_PRINTK */
15561 1: hlt
15562 jmp 1b
15563 + .previous
15564
15565 #ifdef CONFIG_EARLY_PRINTK
15566 + __INITDATA
15567 early_recursion_flag:
15568 .long 0
15569 + .previous
15570
15571 + .section .rodata,"a",@progbits
15572 early_idt_msg:
15573 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
15574 early_idt_ripmsg:
15575 .asciz "RIP %s\n"
15576 -#endif /* CONFIG_EARLY_PRINTK */
15577 .previous
15578 +#endif /* CONFIG_EARLY_PRINTK */
15579
15580 + .section .rodata,"a",@progbits
15581 #define NEXT_PAGE(name) \
15582 .balign PAGE_SIZE; \
15583 ENTRY(name)
15584 @@ -350,13 +351,36 @@ NEXT_PAGE(init_level4_pgt)
15585 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15586 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
15587 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15588 + .org init_level4_pgt + L4_VMALLOC_START*8, 0
15589 + .quad level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
15590 + .org init_level4_pgt + L4_VMEMMAP_START*8, 0
15591 + .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15592 .org init_level4_pgt + L4_START_KERNEL*8, 0
15593 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
15594 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
15595
15596 +#ifdef CONFIG_PAX_PER_CPU_PGD
15597 +NEXT_PAGE(cpu_pgd)
15598 + .rept NR_CPUS
15599 + .fill 512,8,0
15600 + .endr
15601 +#endif
15602 +
15603 NEXT_PAGE(level3_ident_pgt)
15604 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15605 +#ifdef CONFIG_XEN
15606 .fill 511,8,0
15607 +#else
15608 + .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
15609 + .fill 510,8,0
15610 +#endif
15611 +
15612 +NEXT_PAGE(level3_vmalloc_pgt)
15613 + .fill 512,8,0
15614 +
15615 +NEXT_PAGE(level3_vmemmap_pgt)
15616 + .fill L3_VMEMMAP_START,8,0
15617 + .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15618
15619 NEXT_PAGE(level3_kernel_pgt)
15620 .fill L3_START_KERNEL,8,0
15621 @@ -364,20 +388,23 @@ NEXT_PAGE(level3_kernel_pgt)
15622 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
15623 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15624
15625 +NEXT_PAGE(level2_vmemmap_pgt)
15626 + .fill 512,8,0
15627 +
15628 NEXT_PAGE(level2_fixmap_pgt)
15629 - .fill 506,8,0
15630 - .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15631 - /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
15632 - .fill 5,8,0
15633 + .fill 507,8,0
15634 + .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
15635 + /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
15636 + .fill 4,8,0
15637
15638 -NEXT_PAGE(level1_fixmap_pgt)
15639 +NEXT_PAGE(level1_vsyscall_pgt)
15640 .fill 512,8,0
15641
15642 -NEXT_PAGE(level2_ident_pgt)
15643 - /* Since I easily can, map the first 1G.
15644 + /* Since I easily can, map the first 2G.
15645 * Don't set NX because code runs from these pages.
15646 */
15647 - PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
15648 +NEXT_PAGE(level2_ident_pgt)
15649 + PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
15650
15651 NEXT_PAGE(level2_kernel_pgt)
15652 /*
15653 @@ -390,33 +417,55 @@ NEXT_PAGE(level2_kernel_pgt)
15654 * If you want to increase this then increase MODULES_VADDR
15655 * too.)
15656 */
15657 - PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
15658 - KERNEL_IMAGE_SIZE/PMD_SIZE)
15659 -
15660 -NEXT_PAGE(level2_spare_pgt)
15661 - .fill 512, 8, 0
15662 + PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
15663
15664 #undef PMDS
15665 #undef NEXT_PAGE
15666
15667 - .data
15668 + .align PAGE_SIZE
15669 +ENTRY(cpu_gdt_table)
15670 + .rept NR_CPUS
15671 + .quad 0x0000000000000000 /* NULL descriptor */
15672 + .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
15673 + .quad 0x00af9b000000ffff /* __KERNEL_CS */
15674 + .quad 0x00cf93000000ffff /* __KERNEL_DS */
15675 + .quad 0x00cffb000000ffff /* __USER32_CS */
15676 + .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
15677 + .quad 0x00affb000000ffff /* __USER_CS */
15678 +
15679 +#ifdef CONFIG_PAX_KERNEXEC
15680 + .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
15681 +#else
15682 + .quad 0x0 /* unused */
15683 +#endif
15684 +
15685 + .quad 0,0 /* TSS */
15686 + .quad 0,0 /* LDT */
15687 + .quad 0,0,0 /* three TLS descriptors */
15688 + .quad 0x0000f40000000000 /* node/CPU stored in limit */
15689 + /* asm/segment.h:GDT_ENTRIES must match this */
15690 +
15691 + /* zero the remaining page */
15692 + .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
15693 + .endr
15694 +
15695 .align 16
15696 .globl early_gdt_descr
15697 early_gdt_descr:
15698 .word GDT_ENTRIES*8-1
15699 early_gdt_descr_base:
15700 - .quad INIT_PER_CPU_VAR(gdt_page)
15701 + .quad cpu_gdt_table
15702
15703 ENTRY(phys_base)
15704 /* This must match the first entry in level2_kernel_pgt */
15705 .quad 0x0000000000000000
15706
15707 #include "../../x86/xen/xen-head.S"
15708 -
15709 - .section .bss, "aw", @nobits
15710 +
15711 + .section .rodata,"a",@progbits
15712 .align L1_CACHE_BYTES
15713 ENTRY(idt_table)
15714 - .skip IDT_ENTRIES * 16
15715 + .fill 512,8,0
15716
15717 __PAGE_ALIGNED_BSS
15718 .align PAGE_SIZE
15719 diff -urNp linux-2.6.32.46/arch/x86/kernel/i386_ksyms_32.c linux-2.6.32.46/arch/x86/kernel/i386_ksyms_32.c
15720 --- linux-2.6.32.46/arch/x86/kernel/i386_ksyms_32.c 2011-03-27 14:31:47.000000000 -0400
15721 +++ linux-2.6.32.46/arch/x86/kernel/i386_ksyms_32.c 2011-04-17 15:56:46.000000000 -0400
15722 @@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
15723 EXPORT_SYMBOL(cmpxchg8b_emu);
15724 #endif
15725
15726 +EXPORT_SYMBOL_GPL(cpu_gdt_table);
15727 +
15728 /* Networking helper routines. */
15729 EXPORT_SYMBOL(csum_partial_copy_generic);
15730 +EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
15731 +EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
15732
15733 EXPORT_SYMBOL(__get_user_1);
15734 EXPORT_SYMBOL(__get_user_2);
15735 @@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
15736
15737 EXPORT_SYMBOL(csum_partial);
15738 EXPORT_SYMBOL(empty_zero_page);
15739 +
15740 +#ifdef CONFIG_PAX_KERNEXEC
15741 +EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
15742 +#endif
15743 diff -urNp linux-2.6.32.46/arch/x86/kernel/i8259.c linux-2.6.32.46/arch/x86/kernel/i8259.c
15744 --- linux-2.6.32.46/arch/x86/kernel/i8259.c 2011-03-27 14:31:47.000000000 -0400
15745 +++ linux-2.6.32.46/arch/x86/kernel/i8259.c 2011-05-04 17:56:28.000000000 -0400
15746 @@ -208,7 +208,7 @@ spurious_8259A_irq:
15747 "spurious 8259A interrupt: IRQ%d.\n", irq);
15748 spurious_irq_mask |= irqmask;
15749 }
15750 - atomic_inc(&irq_err_count);
15751 + atomic_inc_unchecked(&irq_err_count);
15752 /*
15753 * Theoretically we do not have to handle this IRQ,
15754 * but in Linux this does not cause problems and is
15755 diff -urNp linux-2.6.32.46/arch/x86/kernel/init_task.c linux-2.6.32.46/arch/x86/kernel/init_task.c
15756 --- linux-2.6.32.46/arch/x86/kernel/init_task.c 2011-03-27 14:31:47.000000000 -0400
15757 +++ linux-2.6.32.46/arch/x86/kernel/init_task.c 2011-04-17 15:56:46.000000000 -0400
15758 @@ -20,8 +20,7 @@ static struct sighand_struct init_sighan
15759 * way process stacks are handled. This is done by having a special
15760 * "init_task" linker map entry..
15761 */
15762 -union thread_union init_thread_union __init_task_data =
15763 - { INIT_THREAD_INFO(init_task) };
15764 +union thread_union init_thread_union __init_task_data;
15765
15766 /*
15767 * Initial task structure.
15768 @@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
15769 * section. Since TSS's are completely CPU-local, we want them
15770 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
15771 */
15772 -DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
15773 -
15774 +struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
15775 +EXPORT_SYMBOL(init_tss);
15776 diff -urNp linux-2.6.32.46/arch/x86/kernel/ioport.c linux-2.6.32.46/arch/x86/kernel/ioport.c
15777 --- linux-2.6.32.46/arch/x86/kernel/ioport.c 2011-03-27 14:31:47.000000000 -0400
15778 +++ linux-2.6.32.46/arch/x86/kernel/ioport.c 2011-04-17 15:56:46.000000000 -0400
15779 @@ -6,6 +6,7 @@
15780 #include <linux/sched.h>
15781 #include <linux/kernel.h>
15782 #include <linux/capability.h>
15783 +#include <linux/security.h>
15784 #include <linux/errno.h>
15785 #include <linux/types.h>
15786 #include <linux/ioport.h>
15787 @@ -41,6 +42,12 @@ asmlinkage long sys_ioperm(unsigned long
15788
15789 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
15790 return -EINVAL;
15791 +#ifdef CONFIG_GRKERNSEC_IO
15792 + if (turn_on && grsec_disable_privio) {
15793 + gr_handle_ioperm();
15794 + return -EPERM;
15795 + }
15796 +#endif
15797 if (turn_on && !capable(CAP_SYS_RAWIO))
15798 return -EPERM;
15799
15800 @@ -67,7 +74,7 @@ asmlinkage long sys_ioperm(unsigned long
15801 * because the ->io_bitmap_max value must match the bitmap
15802 * contents:
15803 */
15804 - tss = &per_cpu(init_tss, get_cpu());
15805 + tss = init_tss + get_cpu();
15806
15807 set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
15808
15809 @@ -111,6 +118,12 @@ static int do_iopl(unsigned int level, s
15810 return -EINVAL;
15811 /* Trying to gain more privileges? */
15812 if (level > old) {
15813 +#ifdef CONFIG_GRKERNSEC_IO
15814 + if (grsec_disable_privio) {
15815 + gr_handle_iopl();
15816 + return -EPERM;
15817 + }
15818 +#endif
15819 if (!capable(CAP_SYS_RAWIO))
15820 return -EPERM;
15821 }
15822 diff -urNp linux-2.6.32.46/arch/x86/kernel/irq_32.c linux-2.6.32.46/arch/x86/kernel/irq_32.c
15823 --- linux-2.6.32.46/arch/x86/kernel/irq_32.c 2011-03-27 14:31:47.000000000 -0400
15824 +++ linux-2.6.32.46/arch/x86/kernel/irq_32.c 2011-07-06 19:53:33.000000000 -0400
15825 @@ -35,7 +35,7 @@ static int check_stack_overflow(void)
15826 __asm__ __volatile__("andl %%esp,%0" :
15827 "=r" (sp) : "0" (THREAD_SIZE - 1));
15828
15829 - return sp < (sizeof(struct thread_info) + STACK_WARN);
15830 + return sp < STACK_WARN;
15831 }
15832
15833 static void print_stack_overflow(void)
15834 @@ -54,9 +54,9 @@ static inline void print_stack_overflow(
15835 * per-CPU IRQ handling contexts (thread information and stack)
15836 */
15837 union irq_ctx {
15838 - struct thread_info tinfo;
15839 - u32 stack[THREAD_SIZE/sizeof(u32)];
15840 -} __attribute__((aligned(PAGE_SIZE)));
15841 + unsigned long previous_esp;
15842 + u32 stack[THREAD_SIZE/sizeof(u32)];
15843 +} __attribute__((aligned(THREAD_SIZE)));
15844
15845 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
15846 static DEFINE_PER_CPU(union irq_ctx *, softirq_ctx);
15847 @@ -78,10 +78,9 @@ static void call_on_stack(void *func, vo
15848 static inline int
15849 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15850 {
15851 - union irq_ctx *curctx, *irqctx;
15852 + union irq_ctx *irqctx;
15853 u32 *isp, arg1, arg2;
15854
15855 - curctx = (union irq_ctx *) current_thread_info();
15856 irqctx = __get_cpu_var(hardirq_ctx);
15857
15858 /*
15859 @@ -90,21 +89,16 @@ execute_on_irq_stack(int overflow, struc
15860 * handler) we can't do that and just have to keep using the
15861 * current stack (which is the irq stack already after all)
15862 */
15863 - if (unlikely(curctx == irqctx))
15864 + if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
15865 return 0;
15866
15867 /* build the stack frame on the IRQ stack */
15868 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15869 - irqctx->tinfo.task = curctx->tinfo.task;
15870 - irqctx->tinfo.previous_esp = current_stack_pointer;
15871 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15872 + irqctx->previous_esp = current_stack_pointer;
15873
15874 - /*
15875 - * Copy the softirq bits in preempt_count so that the
15876 - * softirq checks work in the hardirq context.
15877 - */
15878 - irqctx->tinfo.preempt_count =
15879 - (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
15880 - (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
15881 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15882 + __set_fs(MAKE_MM_SEG(0));
15883 +#endif
15884
15885 if (unlikely(overflow))
15886 call_on_stack(print_stack_overflow, isp);
15887 @@ -116,6 +110,11 @@ execute_on_irq_stack(int overflow, struc
15888 : "0" (irq), "1" (desc), "2" (isp),
15889 "D" (desc->handle_irq)
15890 : "memory", "cc", "ecx");
15891 +
15892 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15893 + __set_fs(current_thread_info()->addr_limit);
15894 +#endif
15895 +
15896 return 1;
15897 }
15898
15899 @@ -124,28 +123,11 @@ execute_on_irq_stack(int overflow, struc
15900 */
15901 void __cpuinit irq_ctx_init(int cpu)
15902 {
15903 - union irq_ctx *irqctx;
15904 -
15905 if (per_cpu(hardirq_ctx, cpu))
15906 return;
15907
15908 - irqctx = &per_cpu(hardirq_stack, cpu);
15909 - irqctx->tinfo.task = NULL;
15910 - irqctx->tinfo.exec_domain = NULL;
15911 - irqctx->tinfo.cpu = cpu;
15912 - irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
15913 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15914 -
15915 - per_cpu(hardirq_ctx, cpu) = irqctx;
15916 -
15917 - irqctx = &per_cpu(softirq_stack, cpu);
15918 - irqctx->tinfo.task = NULL;
15919 - irqctx->tinfo.exec_domain = NULL;
15920 - irqctx->tinfo.cpu = cpu;
15921 - irqctx->tinfo.preempt_count = 0;
15922 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15923 -
15924 - per_cpu(softirq_ctx, cpu) = irqctx;
15925 + per_cpu(hardirq_ctx, cpu) = &per_cpu(hardirq_stack, cpu);
15926 + per_cpu(softirq_ctx, cpu) = &per_cpu(softirq_stack, cpu);
15927
15928 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
15929 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
15930 @@ -159,7 +141,6 @@ void irq_ctx_exit(int cpu)
15931 asmlinkage void do_softirq(void)
15932 {
15933 unsigned long flags;
15934 - struct thread_info *curctx;
15935 union irq_ctx *irqctx;
15936 u32 *isp;
15937
15938 @@ -169,15 +150,22 @@ asmlinkage void do_softirq(void)
15939 local_irq_save(flags);
15940
15941 if (local_softirq_pending()) {
15942 - curctx = current_thread_info();
15943 irqctx = __get_cpu_var(softirq_ctx);
15944 - irqctx->tinfo.task = curctx->task;
15945 - irqctx->tinfo.previous_esp = current_stack_pointer;
15946 + irqctx->previous_esp = current_stack_pointer;
15947
15948 /* build the stack frame on the softirq stack */
15949 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15950 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15951 +
15952 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15953 + __set_fs(MAKE_MM_SEG(0));
15954 +#endif
15955
15956 call_on_stack(__do_softirq, isp);
15957 +
15958 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15959 + __set_fs(current_thread_info()->addr_limit);
15960 +#endif
15961 +
15962 /*
15963 * Shouldnt happen, we returned above if in_interrupt():
15964 */
15965 diff -urNp linux-2.6.32.46/arch/x86/kernel/irq.c linux-2.6.32.46/arch/x86/kernel/irq.c
15966 --- linux-2.6.32.46/arch/x86/kernel/irq.c 2011-03-27 14:31:47.000000000 -0400
15967 +++ linux-2.6.32.46/arch/x86/kernel/irq.c 2011-05-04 17:56:28.000000000 -0400
15968 @@ -15,7 +15,7 @@
15969 #include <asm/mce.h>
15970 #include <asm/hw_irq.h>
15971
15972 -atomic_t irq_err_count;
15973 +atomic_unchecked_t irq_err_count;
15974
15975 /* Function pointer for generic interrupt vector handling */
15976 void (*generic_interrupt_extension)(void) = NULL;
15977 @@ -114,9 +114,9 @@ static int show_other_interrupts(struct
15978 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
15979 seq_printf(p, " Machine check polls\n");
15980 #endif
15981 - seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
15982 + seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
15983 #if defined(CONFIG_X86_IO_APIC)
15984 - seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
15985 + seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
15986 #endif
15987 return 0;
15988 }
15989 @@ -209,10 +209,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
15990
15991 u64 arch_irq_stat(void)
15992 {
15993 - u64 sum = atomic_read(&irq_err_count);
15994 + u64 sum = atomic_read_unchecked(&irq_err_count);
15995
15996 #ifdef CONFIG_X86_IO_APIC
15997 - sum += atomic_read(&irq_mis_count);
15998 + sum += atomic_read_unchecked(&irq_mis_count);
15999 #endif
16000 return sum;
16001 }
16002 diff -urNp linux-2.6.32.46/arch/x86/kernel/kgdb.c linux-2.6.32.46/arch/x86/kernel/kgdb.c
16003 --- linux-2.6.32.46/arch/x86/kernel/kgdb.c 2011-03-27 14:31:47.000000000 -0400
16004 +++ linux-2.6.32.46/arch/x86/kernel/kgdb.c 2011-05-04 17:56:20.000000000 -0400
16005 @@ -390,13 +390,13 @@ int kgdb_arch_handle_exception(int e_vec
16006
16007 /* clear the trace bit */
16008 linux_regs->flags &= ~X86_EFLAGS_TF;
16009 - atomic_set(&kgdb_cpu_doing_single_step, -1);
16010 + atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
16011
16012 /* set the trace bit if we're stepping */
16013 if (remcomInBuffer[0] == 's') {
16014 linux_regs->flags |= X86_EFLAGS_TF;
16015 kgdb_single_step = 1;
16016 - atomic_set(&kgdb_cpu_doing_single_step,
16017 + atomic_set_unchecked(&kgdb_cpu_doing_single_step,
16018 raw_smp_processor_id());
16019 }
16020
16021 @@ -476,7 +476,7 @@ static int __kgdb_notify(struct die_args
16022 break;
16023
16024 case DIE_DEBUG:
16025 - if (atomic_read(&kgdb_cpu_doing_single_step) ==
16026 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) ==
16027 raw_smp_processor_id()) {
16028 if (user_mode(regs))
16029 return single_step_cont(regs, args);
16030 @@ -573,7 +573,7 @@ unsigned long kgdb_arch_pc(int exception
16031 return instruction_pointer(regs);
16032 }
16033
16034 -struct kgdb_arch arch_kgdb_ops = {
16035 +const struct kgdb_arch arch_kgdb_ops = {
16036 /* Breakpoint instruction: */
16037 .gdb_bpt_instr = { 0xcc },
16038 .flags = KGDB_HW_BREAKPOINT,
16039 diff -urNp linux-2.6.32.46/arch/x86/kernel/kprobes.c linux-2.6.32.46/arch/x86/kernel/kprobes.c
16040 --- linux-2.6.32.46/arch/x86/kernel/kprobes.c 2011-03-27 14:31:47.000000000 -0400
16041 +++ linux-2.6.32.46/arch/x86/kernel/kprobes.c 2011-04-17 15:56:46.000000000 -0400
16042 @@ -166,9 +166,13 @@ static void __kprobes set_jmp_op(void *f
16043 char op;
16044 s32 raddr;
16045 } __attribute__((packed)) * jop;
16046 - jop = (struct __arch_jmp_op *)from;
16047 +
16048 + jop = (struct __arch_jmp_op *)(ktla_ktva(from));
16049 +
16050 + pax_open_kernel();
16051 jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
16052 jop->op = RELATIVEJUMP_INSTRUCTION;
16053 + pax_close_kernel();
16054 }
16055
16056 /*
16057 @@ -193,7 +197,7 @@ static int __kprobes can_boost(kprobe_op
16058 kprobe_opcode_t opcode;
16059 kprobe_opcode_t *orig_opcodes = opcodes;
16060
16061 - if (search_exception_tables((unsigned long)opcodes))
16062 + if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
16063 return 0; /* Page fault may occur on this address. */
16064
16065 retry:
16066 @@ -337,7 +341,9 @@ static void __kprobes fix_riprel(struct
16067 disp = (u8 *) p->addr + *((s32 *) insn) -
16068 (u8 *) p->ainsn.insn;
16069 BUG_ON((s64) (s32) disp != disp); /* Sanity check. */
16070 + pax_open_kernel();
16071 *(s32 *)insn = (s32) disp;
16072 + pax_close_kernel();
16073 }
16074 }
16075 #endif
16076 @@ -345,16 +351,18 @@ static void __kprobes fix_riprel(struct
16077
16078 static void __kprobes arch_copy_kprobe(struct kprobe *p)
16079 {
16080 - memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
16081 + pax_open_kernel();
16082 + memcpy(p->ainsn.insn, ktla_ktva(p->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
16083 + pax_close_kernel();
16084
16085 fix_riprel(p);
16086
16087 - if (can_boost(p->addr))
16088 + if (can_boost(ktla_ktva(p->addr)))
16089 p->ainsn.boostable = 0;
16090 else
16091 p->ainsn.boostable = -1;
16092
16093 - p->opcode = *p->addr;
16094 + p->opcode = *(ktla_ktva(p->addr));
16095 }
16096
16097 int __kprobes arch_prepare_kprobe(struct kprobe *p)
16098 @@ -432,7 +440,7 @@ static void __kprobes prepare_singlestep
16099 if (p->opcode == BREAKPOINT_INSTRUCTION)
16100 regs->ip = (unsigned long)p->addr;
16101 else
16102 - regs->ip = (unsigned long)p->ainsn.insn;
16103 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
16104 }
16105
16106 void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
16107 @@ -453,7 +461,7 @@ static void __kprobes setup_singlestep(s
16108 if (p->ainsn.boostable == 1 && !p->post_handler) {
16109 /* Boost up -- we can execute copied instructions directly */
16110 reset_current_kprobe();
16111 - regs->ip = (unsigned long)p->ainsn.insn;
16112 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
16113 preempt_enable_no_resched();
16114 return;
16115 }
16116 @@ -523,7 +531,7 @@ static int __kprobes kprobe_handler(stru
16117 struct kprobe_ctlblk *kcb;
16118
16119 addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
16120 - if (*addr != BREAKPOINT_INSTRUCTION) {
16121 + if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
16122 /*
16123 * The breakpoint instruction was removed right
16124 * after we hit it. Another cpu has removed
16125 @@ -775,7 +783,7 @@ static void __kprobes resume_execution(s
16126 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
16127 {
16128 unsigned long *tos = stack_addr(regs);
16129 - unsigned long copy_ip = (unsigned long)p->ainsn.insn;
16130 + unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
16131 unsigned long orig_ip = (unsigned long)p->addr;
16132 kprobe_opcode_t *insn = p->ainsn.insn;
16133
16134 @@ -958,7 +966,7 @@ int __kprobes kprobe_exceptions_notify(s
16135 struct die_args *args = data;
16136 int ret = NOTIFY_DONE;
16137
16138 - if (args->regs && user_mode_vm(args->regs))
16139 + if (args->regs && user_mode(args->regs))
16140 return ret;
16141
16142 switch (val) {
16143 diff -urNp linux-2.6.32.46/arch/x86/kernel/kvm.c linux-2.6.32.46/arch/x86/kernel/kvm.c
16144 --- linux-2.6.32.46/arch/x86/kernel/kvm.c 2011-03-27 14:31:47.000000000 -0400
16145 +++ linux-2.6.32.46/arch/x86/kernel/kvm.c 2011-08-24 18:35:52.000000000 -0400
16146 @@ -216,6 +216,7 @@ static void __init paravirt_ops_setup(vo
16147 pv_mmu_ops.set_pud = kvm_set_pud;
16148 #if PAGETABLE_LEVELS == 4
16149 pv_mmu_ops.set_pgd = kvm_set_pgd;
16150 + pv_mmu_ops.set_pgd_batched = kvm_set_pgd;
16151 #endif
16152 #endif
16153 pv_mmu_ops.flush_tlb_user = kvm_flush_tlb;
16154 diff -urNp linux-2.6.32.46/arch/x86/kernel/ldt.c linux-2.6.32.46/arch/x86/kernel/ldt.c
16155 --- linux-2.6.32.46/arch/x86/kernel/ldt.c 2011-03-27 14:31:47.000000000 -0400
16156 +++ linux-2.6.32.46/arch/x86/kernel/ldt.c 2011-04-17 15:56:46.000000000 -0400
16157 @@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, i
16158 if (reload) {
16159 #ifdef CONFIG_SMP
16160 preempt_disable();
16161 - load_LDT(pc);
16162 + load_LDT_nolock(pc);
16163 if (!cpumask_equal(mm_cpumask(current->mm),
16164 cpumask_of(smp_processor_id())))
16165 smp_call_function(flush_ldt, current->mm, 1);
16166 preempt_enable();
16167 #else
16168 - load_LDT(pc);
16169 + load_LDT_nolock(pc);
16170 #endif
16171 }
16172 if (oldsize) {
16173 @@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t
16174 return err;
16175
16176 for (i = 0; i < old->size; i++)
16177 - write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
16178 + write_ldt_entry(new->ldt, i, old->ldt + i);
16179 return 0;
16180 }
16181
16182 @@ -115,6 +115,24 @@ int init_new_context(struct task_struct
16183 retval = copy_ldt(&mm->context, &old_mm->context);
16184 mutex_unlock(&old_mm->context.lock);
16185 }
16186 +
16187 + if (tsk == current) {
16188 + mm->context.vdso = 0;
16189 +
16190 +#ifdef CONFIG_X86_32
16191 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
16192 + mm->context.user_cs_base = 0UL;
16193 + mm->context.user_cs_limit = ~0UL;
16194 +
16195 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
16196 + cpus_clear(mm->context.cpu_user_cs_mask);
16197 +#endif
16198 +
16199 +#endif
16200 +#endif
16201 +
16202 + }
16203 +
16204 return retval;
16205 }
16206
16207 @@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, u
16208 }
16209 }
16210
16211 +#ifdef CONFIG_PAX_SEGMEXEC
16212 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
16213 + error = -EINVAL;
16214 + goto out_unlock;
16215 + }
16216 +#endif
16217 +
16218 fill_ldt(&ldt, &ldt_info);
16219 if (oldmode)
16220 ldt.avl = 0;
16221 diff -urNp linux-2.6.32.46/arch/x86/kernel/machine_kexec_32.c linux-2.6.32.46/arch/x86/kernel/machine_kexec_32.c
16222 --- linux-2.6.32.46/arch/x86/kernel/machine_kexec_32.c 2011-03-27 14:31:47.000000000 -0400
16223 +++ linux-2.6.32.46/arch/x86/kernel/machine_kexec_32.c 2011-04-17 15:56:46.000000000 -0400
16224 @@ -26,7 +26,7 @@
16225 #include <asm/system.h>
16226 #include <asm/cacheflush.h>
16227
16228 -static void set_idt(void *newidt, __u16 limit)
16229 +static void set_idt(struct desc_struct *newidt, __u16 limit)
16230 {
16231 struct desc_ptr curidt;
16232
16233 @@ -38,7 +38,7 @@ static void set_idt(void *newidt, __u16
16234 }
16235
16236
16237 -static void set_gdt(void *newgdt, __u16 limit)
16238 +static void set_gdt(struct desc_struct *newgdt, __u16 limit)
16239 {
16240 struct desc_ptr curgdt;
16241
16242 @@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
16243 }
16244
16245 control_page = page_address(image->control_code_page);
16246 - memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
16247 + memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
16248
16249 relocate_kernel_ptr = control_page;
16250 page_list[PA_CONTROL_PAGE] = __pa(control_page);
16251 diff -urNp linux-2.6.32.46/arch/x86/kernel/microcode_amd.c linux-2.6.32.46/arch/x86/kernel/microcode_amd.c
16252 --- linux-2.6.32.46/arch/x86/kernel/microcode_amd.c 2011-04-17 17:00:52.000000000 -0400
16253 +++ linux-2.6.32.46/arch/x86/kernel/microcode_amd.c 2011-04-17 17:03:05.000000000 -0400
16254 @@ -364,7 +364,7 @@ static void microcode_fini_cpu_amd(int c
16255 uci->mc = NULL;
16256 }
16257
16258 -static struct microcode_ops microcode_amd_ops = {
16259 +static const struct microcode_ops microcode_amd_ops = {
16260 .request_microcode_user = request_microcode_user,
16261 .request_microcode_fw = request_microcode_fw,
16262 .collect_cpu_info = collect_cpu_info_amd,
16263 @@ -372,7 +372,7 @@ static struct microcode_ops microcode_am
16264 .microcode_fini_cpu = microcode_fini_cpu_amd,
16265 };
16266
16267 -struct microcode_ops * __init init_amd_microcode(void)
16268 +const struct microcode_ops * __init init_amd_microcode(void)
16269 {
16270 return &microcode_amd_ops;
16271 }
16272 diff -urNp linux-2.6.32.46/arch/x86/kernel/microcode_core.c linux-2.6.32.46/arch/x86/kernel/microcode_core.c
16273 --- linux-2.6.32.46/arch/x86/kernel/microcode_core.c 2011-03-27 14:31:47.000000000 -0400
16274 +++ linux-2.6.32.46/arch/x86/kernel/microcode_core.c 2011-04-17 15:56:46.000000000 -0400
16275 @@ -90,7 +90,7 @@ MODULE_LICENSE("GPL");
16276
16277 #define MICROCODE_VERSION "2.00"
16278
16279 -static struct microcode_ops *microcode_ops;
16280 +static const struct microcode_ops *microcode_ops;
16281
16282 /*
16283 * Synchronization.
16284 diff -urNp linux-2.6.32.46/arch/x86/kernel/microcode_intel.c linux-2.6.32.46/arch/x86/kernel/microcode_intel.c
16285 --- linux-2.6.32.46/arch/x86/kernel/microcode_intel.c 2011-03-27 14:31:47.000000000 -0400
16286 +++ linux-2.6.32.46/arch/x86/kernel/microcode_intel.c 2011-10-06 09:37:08.000000000 -0400
16287 @@ -443,13 +443,13 @@ static enum ucode_state request_microcod
16288
16289 static int get_ucode_user(void *to, const void *from, size_t n)
16290 {
16291 - return copy_from_user(to, from, n);
16292 + return copy_from_user(to, (const void __force_user *)from, n);
16293 }
16294
16295 static enum ucode_state
16296 request_microcode_user(int cpu, const void __user *buf, size_t size)
16297 {
16298 - return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
16299 + return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user);
16300 }
16301
16302 static void microcode_fini_cpu(int cpu)
16303 @@ -460,7 +460,7 @@ static void microcode_fini_cpu(int cpu)
16304 uci->mc = NULL;
16305 }
16306
16307 -static struct microcode_ops microcode_intel_ops = {
16308 +static const struct microcode_ops microcode_intel_ops = {
16309 .request_microcode_user = request_microcode_user,
16310 .request_microcode_fw = request_microcode_fw,
16311 .collect_cpu_info = collect_cpu_info,
16312 @@ -468,7 +468,7 @@ static struct microcode_ops microcode_in
16313 .microcode_fini_cpu = microcode_fini_cpu,
16314 };
16315
16316 -struct microcode_ops * __init init_intel_microcode(void)
16317 +const struct microcode_ops * __init init_intel_microcode(void)
16318 {
16319 return &microcode_intel_ops;
16320 }
16321 diff -urNp linux-2.6.32.46/arch/x86/kernel/module.c linux-2.6.32.46/arch/x86/kernel/module.c
16322 --- linux-2.6.32.46/arch/x86/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
16323 +++ linux-2.6.32.46/arch/x86/kernel/module.c 2011-04-17 15:56:46.000000000 -0400
16324 @@ -34,7 +34,7 @@
16325 #define DEBUGP(fmt...)
16326 #endif
16327
16328 -void *module_alloc(unsigned long size)
16329 +static void *__module_alloc(unsigned long size, pgprot_t prot)
16330 {
16331 struct vm_struct *area;
16332
16333 @@ -48,8 +48,18 @@ void *module_alloc(unsigned long size)
16334 if (!area)
16335 return NULL;
16336
16337 - return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM,
16338 - PAGE_KERNEL_EXEC);
16339 + return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot);
16340 +}
16341 +
16342 +void *module_alloc(unsigned long size)
16343 +{
16344 +
16345 +#ifdef CONFIG_PAX_KERNEXEC
16346 + return __module_alloc(size, PAGE_KERNEL);
16347 +#else
16348 + return __module_alloc(size, PAGE_KERNEL_EXEC);
16349 +#endif
16350 +
16351 }
16352
16353 /* Free memory returned from module_alloc */
16354 @@ -58,6 +68,40 @@ void module_free(struct module *mod, voi
16355 vfree(module_region);
16356 }
16357
16358 +#ifdef CONFIG_PAX_KERNEXEC
16359 +#ifdef CONFIG_X86_32
16360 +void *module_alloc_exec(unsigned long size)
16361 +{
16362 + struct vm_struct *area;
16363 +
16364 + if (size == 0)
16365 + return NULL;
16366 +
16367 + area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
16368 + return area ? area->addr : NULL;
16369 +}
16370 +EXPORT_SYMBOL(module_alloc_exec);
16371 +
16372 +void module_free_exec(struct module *mod, void *module_region)
16373 +{
16374 + vunmap(module_region);
16375 +}
16376 +EXPORT_SYMBOL(module_free_exec);
16377 +#else
16378 +void module_free_exec(struct module *mod, void *module_region)
16379 +{
16380 + module_free(mod, module_region);
16381 +}
16382 +EXPORT_SYMBOL(module_free_exec);
16383 +
16384 +void *module_alloc_exec(unsigned long size)
16385 +{
16386 + return __module_alloc(size, PAGE_KERNEL_RX);
16387 +}
16388 +EXPORT_SYMBOL(module_alloc_exec);
16389 +#endif
16390 +#endif
16391 +
16392 /* We don't need anything special. */
16393 int module_frob_arch_sections(Elf_Ehdr *hdr,
16394 Elf_Shdr *sechdrs,
16395 @@ -77,14 +121,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
16396 unsigned int i;
16397 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
16398 Elf32_Sym *sym;
16399 - uint32_t *location;
16400 + uint32_t *plocation, location;
16401
16402 DEBUGP("Applying relocate section %u to %u\n", relsec,
16403 sechdrs[relsec].sh_info);
16404 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
16405 /* This is where to make the change */
16406 - location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
16407 - + rel[i].r_offset;
16408 + plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
16409 + location = (uint32_t)plocation;
16410 + if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
16411 + plocation = ktla_ktva((void *)plocation);
16412 /* This is the symbol it is referring to. Note that all
16413 undefined symbols have been resolved. */
16414 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
16415 @@ -93,11 +139,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
16416 switch (ELF32_R_TYPE(rel[i].r_info)) {
16417 case R_386_32:
16418 /* We add the value into the location given */
16419 - *location += sym->st_value;
16420 + pax_open_kernel();
16421 + *plocation += sym->st_value;
16422 + pax_close_kernel();
16423 break;
16424 case R_386_PC32:
16425 /* Add the value, subtract its postition */
16426 - *location += sym->st_value - (uint32_t)location;
16427 + pax_open_kernel();
16428 + *plocation += sym->st_value - location;
16429 + pax_close_kernel();
16430 break;
16431 default:
16432 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
16433 @@ -153,21 +203,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
16434 case R_X86_64_NONE:
16435 break;
16436 case R_X86_64_64:
16437 + pax_open_kernel();
16438 *(u64 *)loc = val;
16439 + pax_close_kernel();
16440 break;
16441 case R_X86_64_32:
16442 + pax_open_kernel();
16443 *(u32 *)loc = val;
16444 + pax_close_kernel();
16445 if (val != *(u32 *)loc)
16446 goto overflow;
16447 break;
16448 case R_X86_64_32S:
16449 + pax_open_kernel();
16450 *(s32 *)loc = val;
16451 + pax_close_kernel();
16452 if ((s64)val != *(s32 *)loc)
16453 goto overflow;
16454 break;
16455 case R_X86_64_PC32:
16456 val -= (u64)loc;
16457 + pax_open_kernel();
16458 *(u32 *)loc = val;
16459 + pax_close_kernel();
16460 +
16461 #if 0
16462 if ((s64)val != *(s32 *)loc)
16463 goto overflow;
16464 diff -urNp linux-2.6.32.46/arch/x86/kernel/paravirt.c linux-2.6.32.46/arch/x86/kernel/paravirt.c
16465 --- linux-2.6.32.46/arch/x86/kernel/paravirt.c 2011-03-27 14:31:47.000000000 -0400
16466 +++ linux-2.6.32.46/arch/x86/kernel/paravirt.c 2011-08-23 20:24:19.000000000 -0400
16467 @@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
16468 {
16469 return x;
16470 }
16471 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
16472 +PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
16473 +#endif
16474
16475 void __init default_banner(void)
16476 {
16477 @@ -122,7 +125,7 @@ unsigned paravirt_patch_jmp(void *insnbu
16478 * corresponding structure. */
16479 static void *get_call_destination(u8 type)
16480 {
16481 - struct paravirt_patch_template tmpl = {
16482 + const struct paravirt_patch_template tmpl = {
16483 .pv_init_ops = pv_init_ops,
16484 .pv_time_ops = pv_time_ops,
16485 .pv_cpu_ops = pv_cpu_ops,
16486 @@ -133,6 +136,8 @@ static void *get_call_destination(u8 typ
16487 .pv_lock_ops = pv_lock_ops,
16488 #endif
16489 };
16490 +
16491 + pax_track_stack();
16492 return *((void **)&tmpl + type);
16493 }
16494
16495 @@ -145,15 +150,19 @@ unsigned paravirt_patch_default(u8 type,
16496 if (opfunc == NULL)
16497 /* If there's no function, patch it with a ud2a (BUG) */
16498 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
16499 - else if (opfunc == _paravirt_nop)
16500 + else if (opfunc == (void *)_paravirt_nop)
16501 /* If the operation is a nop, then nop the callsite */
16502 ret = paravirt_patch_nop();
16503
16504 /* identity functions just return their single argument */
16505 - else if (opfunc == _paravirt_ident_32)
16506 + else if (opfunc == (void *)_paravirt_ident_32)
16507 ret = paravirt_patch_ident_32(insnbuf, len);
16508 - else if (opfunc == _paravirt_ident_64)
16509 + else if (opfunc == (void *)_paravirt_ident_64)
16510 + ret = paravirt_patch_ident_64(insnbuf, len);
16511 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
16512 + else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
16513 ret = paravirt_patch_ident_64(insnbuf, len);
16514 +#endif
16515
16516 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
16517 type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
16518 @@ -178,7 +187,7 @@ unsigned paravirt_patch_insns(void *insn
16519 if (insn_len > len || start == NULL)
16520 insn_len = len;
16521 else
16522 - memcpy(insnbuf, start, insn_len);
16523 + memcpy(insnbuf, ktla_ktva(start), insn_len);
16524
16525 return insn_len;
16526 }
16527 @@ -294,22 +303,22 @@ void arch_flush_lazy_mmu_mode(void)
16528 preempt_enable();
16529 }
16530
16531 -struct pv_info pv_info = {
16532 +struct pv_info pv_info __read_only = {
16533 .name = "bare hardware",
16534 .paravirt_enabled = 0,
16535 .kernel_rpl = 0,
16536 .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
16537 };
16538
16539 -struct pv_init_ops pv_init_ops = {
16540 +struct pv_init_ops pv_init_ops __read_only = {
16541 .patch = native_patch,
16542 };
16543
16544 -struct pv_time_ops pv_time_ops = {
16545 +struct pv_time_ops pv_time_ops __read_only = {
16546 .sched_clock = native_sched_clock,
16547 };
16548
16549 -struct pv_irq_ops pv_irq_ops = {
16550 +struct pv_irq_ops pv_irq_ops __read_only = {
16551 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
16552 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
16553 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
16554 @@ -321,7 +330,7 @@ struct pv_irq_ops pv_irq_ops = {
16555 #endif
16556 };
16557
16558 -struct pv_cpu_ops pv_cpu_ops = {
16559 +struct pv_cpu_ops pv_cpu_ops __read_only = {
16560 .cpuid = native_cpuid,
16561 .get_debugreg = native_get_debugreg,
16562 .set_debugreg = native_set_debugreg,
16563 @@ -382,21 +391,26 @@ struct pv_cpu_ops pv_cpu_ops = {
16564 .end_context_switch = paravirt_nop,
16565 };
16566
16567 -struct pv_apic_ops pv_apic_ops = {
16568 +struct pv_apic_ops pv_apic_ops __read_only = {
16569 #ifdef CONFIG_X86_LOCAL_APIC
16570 .startup_ipi_hook = paravirt_nop,
16571 #endif
16572 };
16573
16574 -#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
16575 +#ifdef CONFIG_X86_32
16576 +#ifdef CONFIG_X86_PAE
16577 +/* 64-bit pagetable entries */
16578 +#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
16579 +#else
16580 /* 32-bit pagetable entries */
16581 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
16582 +#endif
16583 #else
16584 /* 64-bit pagetable entries */
16585 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
16586 #endif
16587
16588 -struct pv_mmu_ops pv_mmu_ops = {
16589 +struct pv_mmu_ops pv_mmu_ops __read_only = {
16590
16591 .read_cr2 = native_read_cr2,
16592 .write_cr2 = native_write_cr2,
16593 @@ -448,6 +462,7 @@ struct pv_mmu_ops pv_mmu_ops = {
16594 .make_pud = PTE_IDENT,
16595
16596 .set_pgd = native_set_pgd,
16597 + .set_pgd_batched = native_set_pgd_batched,
16598 #endif
16599 #endif /* PAGETABLE_LEVELS >= 3 */
16600
16601 @@ -467,6 +482,12 @@ struct pv_mmu_ops pv_mmu_ops = {
16602 },
16603
16604 .set_fixmap = native_set_fixmap,
16605 +
16606 +#ifdef CONFIG_PAX_KERNEXEC
16607 + .pax_open_kernel = native_pax_open_kernel,
16608 + .pax_close_kernel = native_pax_close_kernel,
16609 +#endif
16610 +
16611 };
16612
16613 EXPORT_SYMBOL_GPL(pv_time_ops);
16614 diff -urNp linux-2.6.32.46/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.32.46/arch/x86/kernel/paravirt-spinlocks.c
16615 --- linux-2.6.32.46/arch/x86/kernel/paravirt-spinlocks.c 2011-03-27 14:31:47.000000000 -0400
16616 +++ linux-2.6.32.46/arch/x86/kernel/paravirt-spinlocks.c 2011-04-17 15:56:46.000000000 -0400
16617 @@ -13,7 +13,7 @@ default_spin_lock_flags(raw_spinlock_t *
16618 __raw_spin_lock(lock);
16619 }
16620
16621 -struct pv_lock_ops pv_lock_ops = {
16622 +struct pv_lock_ops pv_lock_ops __read_only = {
16623 #ifdef CONFIG_SMP
16624 .spin_is_locked = __ticket_spin_is_locked,
16625 .spin_is_contended = __ticket_spin_is_contended,
16626 diff -urNp linux-2.6.32.46/arch/x86/kernel/pci-calgary_64.c linux-2.6.32.46/arch/x86/kernel/pci-calgary_64.c
16627 --- linux-2.6.32.46/arch/x86/kernel/pci-calgary_64.c 2011-03-27 14:31:47.000000000 -0400
16628 +++ linux-2.6.32.46/arch/x86/kernel/pci-calgary_64.c 2011-04-17 15:56:46.000000000 -0400
16629 @@ -477,7 +477,7 @@ static void calgary_free_coherent(struct
16630 free_pages((unsigned long)vaddr, get_order(size));
16631 }
16632
16633 -static struct dma_map_ops calgary_dma_ops = {
16634 +static const struct dma_map_ops calgary_dma_ops = {
16635 .alloc_coherent = calgary_alloc_coherent,
16636 .free_coherent = calgary_free_coherent,
16637 .map_sg = calgary_map_sg,
16638 diff -urNp linux-2.6.32.46/arch/x86/kernel/pci-dma.c linux-2.6.32.46/arch/x86/kernel/pci-dma.c
16639 --- linux-2.6.32.46/arch/x86/kernel/pci-dma.c 2011-03-27 14:31:47.000000000 -0400
16640 +++ linux-2.6.32.46/arch/x86/kernel/pci-dma.c 2011-04-17 15:56:46.000000000 -0400
16641 @@ -14,7 +14,7 @@
16642
16643 static int forbid_dac __read_mostly;
16644
16645 -struct dma_map_ops *dma_ops;
16646 +const struct dma_map_ops *dma_ops;
16647 EXPORT_SYMBOL(dma_ops);
16648
16649 static int iommu_sac_force __read_mostly;
16650 @@ -243,7 +243,7 @@ early_param("iommu", iommu_setup);
16651
16652 int dma_supported(struct device *dev, u64 mask)
16653 {
16654 - struct dma_map_ops *ops = get_dma_ops(dev);
16655 + const struct dma_map_ops *ops = get_dma_ops(dev);
16656
16657 #ifdef CONFIG_PCI
16658 if (mask > 0xffffffff && forbid_dac > 0) {
16659 diff -urNp linux-2.6.32.46/arch/x86/kernel/pci-gart_64.c linux-2.6.32.46/arch/x86/kernel/pci-gart_64.c
16660 --- linux-2.6.32.46/arch/x86/kernel/pci-gart_64.c 2011-03-27 14:31:47.000000000 -0400
16661 +++ linux-2.6.32.46/arch/x86/kernel/pci-gart_64.c 2011-04-17 15:56:46.000000000 -0400
16662 @@ -682,7 +682,7 @@ static __init int init_k8_gatt(struct ag
16663 return -1;
16664 }
16665
16666 -static struct dma_map_ops gart_dma_ops = {
16667 +static const struct dma_map_ops gart_dma_ops = {
16668 .map_sg = gart_map_sg,
16669 .unmap_sg = gart_unmap_sg,
16670 .map_page = gart_map_page,
16671 diff -urNp linux-2.6.32.46/arch/x86/kernel/pci-nommu.c linux-2.6.32.46/arch/x86/kernel/pci-nommu.c
16672 --- linux-2.6.32.46/arch/x86/kernel/pci-nommu.c 2011-03-27 14:31:47.000000000 -0400
16673 +++ linux-2.6.32.46/arch/x86/kernel/pci-nommu.c 2011-04-17 15:56:46.000000000 -0400
16674 @@ -94,7 +94,7 @@ static void nommu_sync_sg_for_device(str
16675 flush_write_buffers();
16676 }
16677
16678 -struct dma_map_ops nommu_dma_ops = {
16679 +const struct dma_map_ops nommu_dma_ops = {
16680 .alloc_coherent = dma_generic_alloc_coherent,
16681 .free_coherent = nommu_free_coherent,
16682 .map_sg = nommu_map_sg,
16683 diff -urNp linux-2.6.32.46/arch/x86/kernel/pci-swiotlb.c linux-2.6.32.46/arch/x86/kernel/pci-swiotlb.c
16684 --- linux-2.6.32.46/arch/x86/kernel/pci-swiotlb.c 2011-03-27 14:31:47.000000000 -0400
16685 +++ linux-2.6.32.46/arch/x86/kernel/pci-swiotlb.c 2011-04-17 15:56:46.000000000 -0400
16686 @@ -25,7 +25,7 @@ static void *x86_swiotlb_alloc_coherent(
16687 return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
16688 }
16689
16690 -static struct dma_map_ops swiotlb_dma_ops = {
16691 +static const struct dma_map_ops swiotlb_dma_ops = {
16692 .mapping_error = swiotlb_dma_mapping_error,
16693 .alloc_coherent = x86_swiotlb_alloc_coherent,
16694 .free_coherent = swiotlb_free_coherent,
16695 diff -urNp linux-2.6.32.46/arch/x86/kernel/process_32.c linux-2.6.32.46/arch/x86/kernel/process_32.c
16696 --- linux-2.6.32.46/arch/x86/kernel/process_32.c 2011-06-25 12:55:34.000000000 -0400
16697 +++ linux-2.6.32.46/arch/x86/kernel/process_32.c 2011-06-25 12:56:37.000000000 -0400
16698 @@ -67,6 +67,7 @@ asmlinkage void ret_from_fork(void) __as
16699 unsigned long thread_saved_pc(struct task_struct *tsk)
16700 {
16701 return ((unsigned long *)tsk->thread.sp)[3];
16702 +//XXX return tsk->thread.eip;
16703 }
16704
16705 #ifndef CONFIG_SMP
16706 @@ -129,15 +130,14 @@ void __show_regs(struct pt_regs *regs, i
16707 unsigned short ss, gs;
16708 const char *board;
16709
16710 - if (user_mode_vm(regs)) {
16711 + if (user_mode(regs)) {
16712 sp = regs->sp;
16713 ss = regs->ss & 0xffff;
16714 - gs = get_user_gs(regs);
16715 } else {
16716 sp = (unsigned long) (&regs->sp);
16717 savesegment(ss, ss);
16718 - savesegment(gs, gs);
16719 }
16720 + gs = get_user_gs(regs);
16721
16722 printk("\n");
16723
16724 @@ -210,10 +210,10 @@ int kernel_thread(int (*fn)(void *), voi
16725 regs.bx = (unsigned long) fn;
16726 regs.dx = (unsigned long) arg;
16727
16728 - regs.ds = __USER_DS;
16729 - regs.es = __USER_DS;
16730 + regs.ds = __KERNEL_DS;
16731 + regs.es = __KERNEL_DS;
16732 regs.fs = __KERNEL_PERCPU;
16733 - regs.gs = __KERNEL_STACK_CANARY;
16734 + savesegment(gs, regs.gs);
16735 regs.orig_ax = -1;
16736 regs.ip = (unsigned long) kernel_thread_helper;
16737 regs.cs = __KERNEL_CS | get_kernel_rpl();
16738 @@ -247,13 +247,14 @@ int copy_thread(unsigned long clone_flag
16739 struct task_struct *tsk;
16740 int err;
16741
16742 - childregs = task_pt_regs(p);
16743 + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
16744 *childregs = *regs;
16745 childregs->ax = 0;
16746 childregs->sp = sp;
16747
16748 p->thread.sp = (unsigned long) childregs;
16749 p->thread.sp0 = (unsigned long) (childregs+1);
16750 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16751
16752 p->thread.ip = (unsigned long) ret_from_fork;
16753
16754 @@ -345,7 +346,7 @@ __switch_to(struct task_struct *prev_p,
16755 struct thread_struct *prev = &prev_p->thread,
16756 *next = &next_p->thread;
16757 int cpu = smp_processor_id();
16758 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
16759 + struct tss_struct *tss = init_tss + cpu;
16760 bool preload_fpu;
16761
16762 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
16763 @@ -380,6 +381,10 @@ __switch_to(struct task_struct *prev_p,
16764 */
16765 lazy_save_gs(prev->gs);
16766
16767 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16768 + __set_fs(task_thread_info(next_p)->addr_limit);
16769 +#endif
16770 +
16771 /*
16772 * Load the per-thread Thread-Local Storage descriptor.
16773 */
16774 @@ -415,6 +420,9 @@ __switch_to(struct task_struct *prev_p,
16775 */
16776 arch_end_context_switch(next_p);
16777
16778 + percpu_write(current_task, next_p);
16779 + percpu_write(current_tinfo, &next_p->tinfo);
16780 +
16781 if (preload_fpu)
16782 __math_state_restore();
16783
16784 @@ -424,8 +432,6 @@ __switch_to(struct task_struct *prev_p,
16785 if (prev->gs | next->gs)
16786 lazy_load_gs(next->gs);
16787
16788 - percpu_write(current_task, next_p);
16789 -
16790 return prev_p;
16791 }
16792
16793 @@ -495,4 +501,3 @@ unsigned long get_wchan(struct task_stru
16794 } while (count++ < 16);
16795 return 0;
16796 }
16797 -
16798 diff -urNp linux-2.6.32.46/arch/x86/kernel/process_64.c linux-2.6.32.46/arch/x86/kernel/process_64.c
16799 --- linux-2.6.32.46/arch/x86/kernel/process_64.c 2011-06-25 12:55:34.000000000 -0400
16800 +++ linux-2.6.32.46/arch/x86/kernel/process_64.c 2011-06-25 12:56:37.000000000 -0400
16801 @@ -91,7 +91,7 @@ static void __exit_idle(void)
16802 void exit_idle(void)
16803 {
16804 /* idle loop has pid 0 */
16805 - if (current->pid)
16806 + if (task_pid_nr(current))
16807 return;
16808 __exit_idle();
16809 }
16810 @@ -170,7 +170,7 @@ void __show_regs(struct pt_regs *regs, i
16811 if (!board)
16812 board = "";
16813 printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
16814 - current->pid, current->comm, print_tainted(),
16815 + task_pid_nr(current), current->comm, print_tainted(),
16816 init_utsname()->release,
16817 (int)strcspn(init_utsname()->version, " "),
16818 init_utsname()->version, board);
16819 @@ -280,8 +280,7 @@ int copy_thread(unsigned long clone_flag
16820 struct pt_regs *childregs;
16821 struct task_struct *me = current;
16822
16823 - childregs = ((struct pt_regs *)
16824 - (THREAD_SIZE + task_stack_page(p))) - 1;
16825 + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
16826 *childregs = *regs;
16827
16828 childregs->ax = 0;
16829 @@ -292,6 +291,7 @@ int copy_thread(unsigned long clone_flag
16830 p->thread.sp = (unsigned long) childregs;
16831 p->thread.sp0 = (unsigned long) (childregs+1);
16832 p->thread.usersp = me->thread.usersp;
16833 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16834
16835 set_tsk_thread_flag(p, TIF_FORK);
16836
16837 @@ -379,7 +379,7 @@ __switch_to(struct task_struct *prev_p,
16838 struct thread_struct *prev = &prev_p->thread;
16839 struct thread_struct *next = &next_p->thread;
16840 int cpu = smp_processor_id();
16841 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
16842 + struct tss_struct *tss = init_tss + cpu;
16843 unsigned fsindex, gsindex;
16844 bool preload_fpu;
16845
16846 @@ -475,10 +475,9 @@ __switch_to(struct task_struct *prev_p,
16847 prev->usersp = percpu_read(old_rsp);
16848 percpu_write(old_rsp, next->usersp);
16849 percpu_write(current_task, next_p);
16850 + percpu_write(current_tinfo, &next_p->tinfo);
16851
16852 - percpu_write(kernel_stack,
16853 - (unsigned long)task_stack_page(next_p) +
16854 - THREAD_SIZE - KERNEL_STACK_OFFSET);
16855 + percpu_write(kernel_stack, next->sp0);
16856
16857 /*
16858 * Now maybe reload the debug registers and handle I/O bitmaps
16859 @@ -559,12 +558,11 @@ unsigned long get_wchan(struct task_stru
16860 if (!p || p == current || p->state == TASK_RUNNING)
16861 return 0;
16862 stack = (unsigned long)task_stack_page(p);
16863 - if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
16864 + if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
16865 return 0;
16866 fp = *(u64 *)(p->thread.sp);
16867 do {
16868 - if (fp < (unsigned long)stack ||
16869 - fp >= (unsigned long)stack+THREAD_SIZE)
16870 + if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
16871 return 0;
16872 ip = *(u64 *)(fp+8);
16873 if (!in_sched_functions(ip))
16874 diff -urNp linux-2.6.32.46/arch/x86/kernel/process.c linux-2.6.32.46/arch/x86/kernel/process.c
16875 --- linux-2.6.32.46/arch/x86/kernel/process.c 2011-04-22 19:16:29.000000000 -0400
16876 +++ linux-2.6.32.46/arch/x86/kernel/process.c 2011-08-30 18:19:52.000000000 -0400
16877 @@ -51,16 +51,33 @@ void free_thread_xstate(struct task_stru
16878
16879 void free_thread_info(struct thread_info *ti)
16880 {
16881 - free_thread_xstate(ti->task);
16882 free_pages((unsigned long)ti, get_order(THREAD_SIZE));
16883 }
16884
16885 +static struct kmem_cache *task_struct_cachep;
16886 +
16887 void arch_task_cache_init(void)
16888 {
16889 - task_xstate_cachep =
16890 - kmem_cache_create("task_xstate", xstate_size,
16891 + /* create a slab on which task_structs can be allocated */
16892 + task_struct_cachep =
16893 + kmem_cache_create("task_struct", sizeof(struct task_struct),
16894 + ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
16895 +
16896 + task_xstate_cachep =
16897 + kmem_cache_create("task_xstate", xstate_size,
16898 __alignof__(union thread_xstate),
16899 - SLAB_PANIC | SLAB_NOTRACK, NULL);
16900 + SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
16901 +}
16902 +
16903 +struct task_struct *alloc_task_struct(void)
16904 +{
16905 + return kmem_cache_alloc(task_struct_cachep, GFP_KERNEL);
16906 +}
16907 +
16908 +void free_task_struct(struct task_struct *task)
16909 +{
16910 + free_thread_xstate(task);
16911 + kmem_cache_free(task_struct_cachep, task);
16912 }
16913
16914 /*
16915 @@ -73,7 +90,7 @@ void exit_thread(void)
16916 unsigned long *bp = t->io_bitmap_ptr;
16917
16918 if (bp) {
16919 - struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
16920 + struct tss_struct *tss = init_tss + get_cpu();
16921
16922 t->io_bitmap_ptr = NULL;
16923 clear_thread_flag(TIF_IO_BITMAP);
16924 @@ -93,6 +110,9 @@ void flush_thread(void)
16925
16926 clear_tsk_thread_flag(tsk, TIF_DEBUG);
16927
16928 +#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
16929 + loadsegment(gs, 0);
16930 +#endif
16931 tsk->thread.debugreg0 = 0;
16932 tsk->thread.debugreg1 = 0;
16933 tsk->thread.debugreg2 = 0;
16934 @@ -307,7 +327,7 @@ void default_idle(void)
16935 EXPORT_SYMBOL(default_idle);
16936 #endif
16937
16938 -void stop_this_cpu(void *dummy)
16939 +__noreturn void stop_this_cpu(void *dummy)
16940 {
16941 local_irq_disable();
16942 /*
16943 @@ -568,16 +588,38 @@ static int __init idle_setup(char *str)
16944 }
16945 early_param("idle", idle_setup);
16946
16947 -unsigned long arch_align_stack(unsigned long sp)
16948 +#ifdef CONFIG_PAX_RANDKSTACK
16949 +void pax_randomize_kstack(struct pt_regs *regs)
16950 {
16951 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
16952 - sp -= get_random_int() % 8192;
16953 - return sp & ~0xf;
16954 -}
16955 + struct thread_struct *thread = &current->thread;
16956 + unsigned long time;
16957
16958 -unsigned long arch_randomize_brk(struct mm_struct *mm)
16959 -{
16960 - unsigned long range_end = mm->brk + 0x02000000;
16961 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
16962 + if (!randomize_va_space)
16963 + return;
16964 +
16965 + if (v8086_mode(regs))
16966 + return;
16967 +
16968 + rdtscl(time);
16969 +
16970 + /* P4 seems to return a 0 LSB, ignore it */
16971 +#ifdef CONFIG_MPENTIUM4
16972 + time &= 0x3EUL;
16973 + time <<= 2;
16974 +#elif defined(CONFIG_X86_64)
16975 + time &= 0xFUL;
16976 + time <<= 4;
16977 +#else
16978 + time &= 0x1FUL;
16979 + time <<= 3;
16980 +#endif
16981 +
16982 + thread->sp0 ^= time;
16983 + load_sp0(init_tss + smp_processor_id(), thread);
16984 +
16985 +#ifdef CONFIG_X86_64
16986 + percpu_write(kernel_stack, thread->sp0);
16987 +#endif
16988 }
16989 +#endif
16990
16991 diff -urNp linux-2.6.32.46/arch/x86/kernel/ptrace.c linux-2.6.32.46/arch/x86/kernel/ptrace.c
16992 --- linux-2.6.32.46/arch/x86/kernel/ptrace.c 2011-03-27 14:31:47.000000000 -0400
16993 +++ linux-2.6.32.46/arch/x86/kernel/ptrace.c 2011-04-17 15:56:46.000000000 -0400
16994 @@ -925,7 +925,7 @@ static const struct user_regset_view use
16995 long arch_ptrace(struct task_struct *child, long request, long addr, long data)
16996 {
16997 int ret;
16998 - unsigned long __user *datap = (unsigned long __user *)data;
16999 + unsigned long __user *datap = (__force unsigned long __user *)data;
17000
17001 switch (request) {
17002 /* read the word at location addr in the USER area. */
17003 @@ -1012,14 +1012,14 @@ long arch_ptrace(struct task_struct *chi
17004 if (addr < 0)
17005 return -EIO;
17006 ret = do_get_thread_area(child, addr,
17007 - (struct user_desc __user *) data);
17008 + (__force struct user_desc __user *) data);
17009 break;
17010
17011 case PTRACE_SET_THREAD_AREA:
17012 if (addr < 0)
17013 return -EIO;
17014 ret = do_set_thread_area(child, addr,
17015 - (struct user_desc __user *) data, 0);
17016 + (__force struct user_desc __user *) data, 0);
17017 break;
17018 #endif
17019
17020 @@ -1038,12 +1038,12 @@ long arch_ptrace(struct task_struct *chi
17021 #ifdef CONFIG_X86_PTRACE_BTS
17022 case PTRACE_BTS_CONFIG:
17023 ret = ptrace_bts_config
17024 - (child, data, (struct ptrace_bts_config __user *)addr);
17025 + (child, data, (__force struct ptrace_bts_config __user *)addr);
17026 break;
17027
17028 case PTRACE_BTS_STATUS:
17029 ret = ptrace_bts_status
17030 - (child, data, (struct ptrace_bts_config __user *)addr);
17031 + (child, data, (__force struct ptrace_bts_config __user *)addr);
17032 break;
17033
17034 case PTRACE_BTS_SIZE:
17035 @@ -1052,7 +1052,7 @@ long arch_ptrace(struct task_struct *chi
17036
17037 case PTRACE_BTS_GET:
17038 ret = ptrace_bts_read_record
17039 - (child, data, (struct bts_struct __user *) addr);
17040 + (child, data, (__force struct bts_struct __user *) addr);
17041 break;
17042
17043 case PTRACE_BTS_CLEAR:
17044 @@ -1061,7 +1061,7 @@ long arch_ptrace(struct task_struct *chi
17045
17046 case PTRACE_BTS_DRAIN:
17047 ret = ptrace_bts_drain
17048 - (child, data, (struct bts_struct __user *) addr);
17049 + (child, data, (__force struct bts_struct __user *) addr);
17050 break;
17051 #endif /* CONFIG_X86_PTRACE_BTS */
17052
17053 @@ -1450,7 +1450,7 @@ void send_sigtrap(struct task_struct *ts
17054 info.si_code = si_code;
17055
17056 /* User-mode ip? */
17057 - info.si_addr = user_mode_vm(regs) ? (void __user *) regs->ip : NULL;
17058 + info.si_addr = user_mode(regs) ? (__force void __user *) regs->ip : NULL;
17059
17060 /* Send us the fake SIGTRAP */
17061 force_sig_info(SIGTRAP, &info, tsk);
17062 @@ -1469,7 +1469,7 @@ void send_sigtrap(struct task_struct *ts
17063 * We must return the syscall number to actually look up in the table.
17064 * This can be -1L to skip running any syscall at all.
17065 */
17066 -asmregparm long syscall_trace_enter(struct pt_regs *regs)
17067 +long syscall_trace_enter(struct pt_regs *regs)
17068 {
17069 long ret = 0;
17070
17071 @@ -1514,7 +1514,7 @@ asmregparm long syscall_trace_enter(stru
17072 return ret ?: regs->orig_ax;
17073 }
17074
17075 -asmregparm void syscall_trace_leave(struct pt_regs *regs)
17076 +void syscall_trace_leave(struct pt_regs *regs)
17077 {
17078 if (unlikely(current->audit_context))
17079 audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
17080 diff -urNp linux-2.6.32.46/arch/x86/kernel/reboot.c linux-2.6.32.46/arch/x86/kernel/reboot.c
17081 --- linux-2.6.32.46/arch/x86/kernel/reboot.c 2011-08-09 18:35:28.000000000 -0400
17082 +++ linux-2.6.32.46/arch/x86/kernel/reboot.c 2011-08-09 18:33:59.000000000 -0400
17083 @@ -33,7 +33,7 @@ void (*pm_power_off)(void);
17084 EXPORT_SYMBOL(pm_power_off);
17085
17086 static const struct desc_ptr no_idt = {};
17087 -static int reboot_mode;
17088 +static unsigned short reboot_mode;
17089 enum reboot_type reboot_type = BOOT_KBD;
17090 int reboot_force;
17091
17092 @@ -292,12 +292,12 @@ core_initcall(reboot_init);
17093 controller to pulse the CPU reset line, which is more thorough, but
17094 doesn't work with at least one type of 486 motherboard. It is easy
17095 to stop this code working; hence the copious comments. */
17096 -static const unsigned long long
17097 -real_mode_gdt_entries [3] =
17098 +static struct desc_struct
17099 +real_mode_gdt_entries [3] __read_only =
17100 {
17101 - 0x0000000000000000ULL, /* Null descriptor */
17102 - 0x00009b000000ffffULL, /* 16-bit real-mode 64k code at 0x00000000 */
17103 - 0x000093000100ffffULL /* 16-bit real-mode 64k data at 0x00000100 */
17104 + GDT_ENTRY_INIT(0, 0, 0), /* Null descriptor */
17105 + GDT_ENTRY_INIT(0x9b, 0, 0xffff), /* 16-bit real-mode 64k code at 0x00000000 */
17106 + GDT_ENTRY_INIT(0x93, 0x100, 0xffff) /* 16-bit real-mode 64k data at 0x00000100 */
17107 };
17108
17109 static const struct desc_ptr
17110 @@ -346,7 +346,7 @@ static const unsigned char jump_to_bios
17111 * specified by the code and length parameters.
17112 * We assume that length will aways be less that 100!
17113 */
17114 -void machine_real_restart(const unsigned char *code, int length)
17115 +__noreturn void machine_real_restart(const unsigned char *code, unsigned int length)
17116 {
17117 local_irq_disable();
17118
17119 @@ -366,8 +366,8 @@ void machine_real_restart(const unsigned
17120 /* Remap the kernel at virtual address zero, as well as offset zero
17121 from the kernel segment. This assumes the kernel segment starts at
17122 virtual address PAGE_OFFSET. */
17123 - memcpy(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
17124 - sizeof(swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
17125 + clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
17126 + min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
17127
17128 /*
17129 * Use `swapper_pg_dir' as our page directory.
17130 @@ -379,16 +379,15 @@ void machine_real_restart(const unsigned
17131 boot)". This seems like a fairly standard thing that gets set by
17132 REBOOT.COM programs, and the previous reset routine did this
17133 too. */
17134 - *((unsigned short *)0x472) = reboot_mode;
17135 + *(unsigned short *)(__va(0x472)) = reboot_mode;
17136
17137 /* For the switch to real mode, copy some code to low memory. It has
17138 to be in the first 64k because it is running in 16-bit mode, and it
17139 has to have the same physical and virtual address, because it turns
17140 off paging. Copy it near the end of the first page, out of the way
17141 of BIOS variables. */
17142 - memcpy((void *)(0x1000 - sizeof(real_mode_switch) - 100),
17143 - real_mode_switch, sizeof (real_mode_switch));
17144 - memcpy((void *)(0x1000 - 100), code, length);
17145 + memcpy(__va(0x1000 - sizeof (real_mode_switch) - 100), real_mode_switch, sizeof (real_mode_switch));
17146 + memcpy(__va(0x1000 - 100), code, length);
17147
17148 /* Set up the IDT for real mode. */
17149 load_idt(&real_mode_idt);
17150 @@ -416,6 +415,7 @@ void machine_real_restart(const unsigned
17151 __asm__ __volatile__ ("ljmp $0x0008,%0"
17152 :
17153 : "i" ((void *)(0x1000 - sizeof (real_mode_switch) - 100)));
17154 + do { } while (1);
17155 }
17156 #ifdef CONFIG_APM_MODULE
17157 EXPORT_SYMBOL(machine_real_restart);
17158 @@ -544,7 +544,7 @@ void __attribute__((weak)) mach_reboot_f
17159 {
17160 }
17161
17162 -static void native_machine_emergency_restart(void)
17163 +__noreturn static void native_machine_emergency_restart(void)
17164 {
17165 int i;
17166
17167 @@ -659,13 +659,13 @@ void native_machine_shutdown(void)
17168 #endif
17169 }
17170
17171 -static void __machine_emergency_restart(int emergency)
17172 +static __noreturn void __machine_emergency_restart(int emergency)
17173 {
17174 reboot_emergency = emergency;
17175 machine_ops.emergency_restart();
17176 }
17177
17178 -static void native_machine_restart(char *__unused)
17179 +static __noreturn void native_machine_restart(char *__unused)
17180 {
17181 printk("machine restart\n");
17182
17183 @@ -674,7 +674,7 @@ static void native_machine_restart(char
17184 __machine_emergency_restart(0);
17185 }
17186
17187 -static void native_machine_halt(void)
17188 +static __noreturn void native_machine_halt(void)
17189 {
17190 /* stop other cpus and apics */
17191 machine_shutdown();
17192 @@ -685,7 +685,7 @@ static void native_machine_halt(void)
17193 stop_this_cpu(NULL);
17194 }
17195
17196 -static void native_machine_power_off(void)
17197 +__noreturn static void native_machine_power_off(void)
17198 {
17199 if (pm_power_off) {
17200 if (!reboot_force)
17201 @@ -694,6 +694,7 @@ static void native_machine_power_off(voi
17202 }
17203 /* a fallback in case there is no PM info available */
17204 tboot_shutdown(TB_SHUTDOWN_HALT);
17205 + do { } while (1);
17206 }
17207
17208 struct machine_ops machine_ops = {
17209 diff -urNp linux-2.6.32.46/arch/x86/kernel/setup.c linux-2.6.32.46/arch/x86/kernel/setup.c
17210 --- linux-2.6.32.46/arch/x86/kernel/setup.c 2011-04-17 17:00:52.000000000 -0400
17211 +++ linux-2.6.32.46/arch/x86/kernel/setup.c 2011-04-17 17:03:05.000000000 -0400
17212 @@ -783,14 +783,14 @@ void __init setup_arch(char **cmdline_p)
17213
17214 if (!boot_params.hdr.root_flags)
17215 root_mountflags &= ~MS_RDONLY;
17216 - init_mm.start_code = (unsigned long) _text;
17217 - init_mm.end_code = (unsigned long) _etext;
17218 + init_mm.start_code = ktla_ktva((unsigned long) _text);
17219 + init_mm.end_code = ktla_ktva((unsigned long) _etext);
17220 init_mm.end_data = (unsigned long) _edata;
17221 init_mm.brk = _brk_end;
17222
17223 - code_resource.start = virt_to_phys(_text);
17224 - code_resource.end = virt_to_phys(_etext)-1;
17225 - data_resource.start = virt_to_phys(_etext);
17226 + code_resource.start = virt_to_phys(ktla_ktva(_text));
17227 + code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
17228 + data_resource.start = virt_to_phys(_sdata);
17229 data_resource.end = virt_to_phys(_edata)-1;
17230 bss_resource.start = virt_to_phys(&__bss_start);
17231 bss_resource.end = virt_to_phys(&__bss_stop)-1;
17232 diff -urNp linux-2.6.32.46/arch/x86/kernel/setup_percpu.c linux-2.6.32.46/arch/x86/kernel/setup_percpu.c
17233 --- linux-2.6.32.46/arch/x86/kernel/setup_percpu.c 2011-03-27 14:31:47.000000000 -0400
17234 +++ linux-2.6.32.46/arch/x86/kernel/setup_percpu.c 2011-06-04 20:36:29.000000000 -0400
17235 @@ -25,19 +25,17 @@
17236 # define DBG(x...)
17237 #endif
17238
17239 -DEFINE_PER_CPU(int, cpu_number);
17240 +#ifdef CONFIG_SMP
17241 +DEFINE_PER_CPU(unsigned int, cpu_number);
17242 EXPORT_PER_CPU_SYMBOL(cpu_number);
17243 +#endif
17244
17245 -#ifdef CONFIG_X86_64
17246 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
17247 -#else
17248 -#define BOOT_PERCPU_OFFSET 0
17249 -#endif
17250
17251 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
17252 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
17253
17254 -unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
17255 +unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
17256 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
17257 };
17258 EXPORT_SYMBOL(__per_cpu_offset);
17259 @@ -159,10 +157,10 @@ static inline void setup_percpu_segment(
17260 {
17261 #ifdef CONFIG_X86_32
17262 struct desc_struct gdt;
17263 + unsigned long base = per_cpu_offset(cpu);
17264
17265 - pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
17266 - 0x2 | DESCTYPE_S, 0x8);
17267 - gdt.s = 1;
17268 + pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
17269 + 0x83 | DESCTYPE_S, 0xC);
17270 write_gdt_entry(get_cpu_gdt_table(cpu),
17271 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
17272 #endif
17273 @@ -212,6 +210,11 @@ void __init setup_per_cpu_areas(void)
17274 /* alrighty, percpu areas up and running */
17275 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
17276 for_each_possible_cpu(cpu) {
17277 +#ifdef CONFIG_CC_STACKPROTECTOR
17278 +#ifdef CONFIG_X86_32
17279 + unsigned long canary = per_cpu(stack_canary.canary, cpu);
17280 +#endif
17281 +#endif
17282 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
17283 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
17284 per_cpu(cpu_number, cpu) = cpu;
17285 @@ -239,6 +242,12 @@ void __init setup_per_cpu_areas(void)
17286 early_per_cpu_map(x86_cpu_to_node_map, cpu);
17287 #endif
17288 #endif
17289 +#ifdef CONFIG_CC_STACKPROTECTOR
17290 +#ifdef CONFIG_X86_32
17291 + if (!cpu)
17292 + per_cpu(stack_canary.canary, cpu) = canary;
17293 +#endif
17294 +#endif
17295 /*
17296 * Up to this point, the boot CPU has been using .data.init
17297 * area. Reload any changed state for the boot CPU.
17298 diff -urNp linux-2.6.32.46/arch/x86/kernel/signal.c linux-2.6.32.46/arch/x86/kernel/signal.c
17299 --- linux-2.6.32.46/arch/x86/kernel/signal.c 2011-03-27 14:31:47.000000000 -0400
17300 +++ linux-2.6.32.46/arch/x86/kernel/signal.c 2011-05-22 23:02:03.000000000 -0400
17301 @@ -197,7 +197,7 @@ static unsigned long align_sigframe(unsi
17302 * Align the stack pointer according to the i386 ABI,
17303 * i.e. so that on function entry ((sp + 4) & 15) == 0.
17304 */
17305 - sp = ((sp + 4) & -16ul) - 4;
17306 + sp = ((sp - 12) & -16ul) - 4;
17307 #else /* !CONFIG_X86_32 */
17308 sp = round_down(sp, 16) - 8;
17309 #endif
17310 @@ -248,11 +248,11 @@ get_sigframe(struct k_sigaction *ka, str
17311 * Return an always-bogus address instead so we will die with SIGSEGV.
17312 */
17313 if (onsigstack && !likely(on_sig_stack(sp)))
17314 - return (void __user *)-1L;
17315 + return (__force void __user *)-1L;
17316
17317 /* save i387 state */
17318 if (used_math() && save_i387_xstate(*fpstate) < 0)
17319 - return (void __user *)-1L;
17320 + return (__force void __user *)-1L;
17321
17322 return (void __user *)sp;
17323 }
17324 @@ -307,9 +307,9 @@ __setup_frame(int sig, struct k_sigactio
17325 }
17326
17327 if (current->mm->context.vdso)
17328 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
17329 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
17330 else
17331 - restorer = &frame->retcode;
17332 + restorer = (void __user *)&frame->retcode;
17333 if (ka->sa.sa_flags & SA_RESTORER)
17334 restorer = ka->sa.sa_restorer;
17335
17336 @@ -323,7 +323,7 @@ __setup_frame(int sig, struct k_sigactio
17337 * reasons and because gdb uses it as a signature to notice
17338 * signal handler stack frames.
17339 */
17340 - err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
17341 + err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
17342
17343 if (err)
17344 return -EFAULT;
17345 @@ -377,7 +377,10 @@ static int __setup_rt_frame(int sig, str
17346 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
17347
17348 /* Set up to return from userspace. */
17349 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
17350 + if (current->mm->context.vdso)
17351 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
17352 + else
17353 + restorer = (void __user *)&frame->retcode;
17354 if (ka->sa.sa_flags & SA_RESTORER)
17355 restorer = ka->sa.sa_restorer;
17356 put_user_ex(restorer, &frame->pretcode);
17357 @@ -389,7 +392,7 @@ static int __setup_rt_frame(int sig, str
17358 * reasons and because gdb uses it as a signature to notice
17359 * signal handler stack frames.
17360 */
17361 - put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
17362 + put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
17363 } put_user_catch(err);
17364
17365 if (err)
17366 @@ -782,6 +785,8 @@ static void do_signal(struct pt_regs *re
17367 int signr;
17368 sigset_t *oldset;
17369
17370 + pax_track_stack();
17371 +
17372 /*
17373 * We want the common case to go fast, which is why we may in certain
17374 * cases get here from kernel mode. Just return without doing anything
17375 @@ -789,7 +794,7 @@ static void do_signal(struct pt_regs *re
17376 * X86_32: vm86 regs switched out by assembly code before reaching
17377 * here, so testing against kernel CS suffices.
17378 */
17379 - if (!user_mode(regs))
17380 + if (!user_mode_novm(regs))
17381 return;
17382
17383 if (current_thread_info()->status & TS_RESTORE_SIGMASK)
17384 diff -urNp linux-2.6.32.46/arch/x86/kernel/smpboot.c linux-2.6.32.46/arch/x86/kernel/smpboot.c
17385 --- linux-2.6.32.46/arch/x86/kernel/smpboot.c 2011-03-27 14:31:47.000000000 -0400
17386 +++ linux-2.6.32.46/arch/x86/kernel/smpboot.c 2011-07-01 19:10:03.000000000 -0400
17387 @@ -94,14 +94,14 @@ static DEFINE_PER_CPU(struct task_struct
17388 */
17389 static DEFINE_MUTEX(x86_cpu_hotplug_driver_mutex);
17390
17391 -void cpu_hotplug_driver_lock()
17392 +void cpu_hotplug_driver_lock(void)
17393 {
17394 - mutex_lock(&x86_cpu_hotplug_driver_mutex);
17395 + mutex_lock(&x86_cpu_hotplug_driver_mutex);
17396 }
17397
17398 -void cpu_hotplug_driver_unlock()
17399 +void cpu_hotplug_driver_unlock(void)
17400 {
17401 - mutex_unlock(&x86_cpu_hotplug_driver_mutex);
17402 + mutex_unlock(&x86_cpu_hotplug_driver_mutex);
17403 }
17404
17405 ssize_t arch_cpu_probe(const char *buf, size_t count) { return -1; }
17406 @@ -625,7 +625,7 @@ wakeup_secondary_cpu_via_init(int phys_a
17407 * target processor state.
17408 */
17409 startup_ipi_hook(phys_apicid, (unsigned long) start_secondary,
17410 - (unsigned long)stack_start.sp);
17411 + stack_start);
17412
17413 /*
17414 * Run STARTUP IPI loop.
17415 @@ -743,6 +743,7 @@ static int __cpuinit do_boot_cpu(int api
17416 set_idle_for_cpu(cpu, c_idle.idle);
17417 do_rest:
17418 per_cpu(current_task, cpu) = c_idle.idle;
17419 + per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
17420 #ifdef CONFIG_X86_32
17421 /* Stack for startup_32 can be just as for start_secondary onwards */
17422 irq_ctx_init(cpu);
17423 @@ -750,13 +751,15 @@ do_rest:
17424 #else
17425 clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
17426 initial_gs = per_cpu_offset(cpu);
17427 - per_cpu(kernel_stack, cpu) =
17428 - (unsigned long)task_stack_page(c_idle.idle) -
17429 - KERNEL_STACK_OFFSET + THREAD_SIZE;
17430 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
17431 #endif
17432 +
17433 + pax_open_kernel();
17434 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
17435 + pax_close_kernel();
17436 +
17437 initial_code = (unsigned long)start_secondary;
17438 - stack_start.sp = (void *) c_idle.idle->thread.sp;
17439 + stack_start = c_idle.idle->thread.sp;
17440
17441 /* start_ip had better be page-aligned! */
17442 start_ip = setup_trampoline();
17443 @@ -891,6 +894,12 @@ int __cpuinit native_cpu_up(unsigned int
17444
17445 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
17446
17447 +#ifdef CONFIG_PAX_PER_CPU_PGD
17448 + clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
17449 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
17450 + KERNEL_PGD_PTRS);
17451 +#endif
17452 +
17453 err = do_boot_cpu(apicid, cpu);
17454
17455 if (err) {
17456 diff -urNp linux-2.6.32.46/arch/x86/kernel/step.c linux-2.6.32.46/arch/x86/kernel/step.c
17457 --- linux-2.6.32.46/arch/x86/kernel/step.c 2011-03-27 14:31:47.000000000 -0400
17458 +++ linux-2.6.32.46/arch/x86/kernel/step.c 2011-04-17 15:56:46.000000000 -0400
17459 @@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
17460 struct desc_struct *desc;
17461 unsigned long base;
17462
17463 - seg &= ~7UL;
17464 + seg >>= 3;
17465
17466 mutex_lock(&child->mm->context.lock);
17467 - if (unlikely((seg >> 3) >= child->mm->context.size))
17468 + if (unlikely(seg >= child->mm->context.size))
17469 addr = -1L; /* bogus selector, access would fault */
17470 else {
17471 desc = child->mm->context.ldt + seg;
17472 @@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struc
17473 addr += base;
17474 }
17475 mutex_unlock(&child->mm->context.lock);
17476 - }
17477 + } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
17478 + addr = ktla_ktva(addr);
17479
17480 return addr;
17481 }
17482 @@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct t
17483 unsigned char opcode[15];
17484 unsigned long addr = convert_ip_to_linear(child, regs);
17485
17486 + if (addr == -EINVAL)
17487 + return 0;
17488 +
17489 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
17490 for (i = 0; i < copied; i++) {
17491 switch (opcode[i]) {
17492 @@ -74,7 +78,7 @@ static int is_setting_trap_flag(struct t
17493
17494 #ifdef CONFIG_X86_64
17495 case 0x40 ... 0x4f:
17496 - if (regs->cs != __USER_CS)
17497 + if ((regs->cs & 0xffff) != __USER_CS)
17498 /* 32-bit mode: register increment */
17499 return 0;
17500 /* 64-bit mode: REX prefix */
17501 diff -urNp linux-2.6.32.46/arch/x86/kernel/syscall_table_32.S linux-2.6.32.46/arch/x86/kernel/syscall_table_32.S
17502 --- linux-2.6.32.46/arch/x86/kernel/syscall_table_32.S 2011-03-27 14:31:47.000000000 -0400
17503 +++ linux-2.6.32.46/arch/x86/kernel/syscall_table_32.S 2011-04-17 15:56:46.000000000 -0400
17504 @@ -1,3 +1,4 @@
17505 +.section .rodata,"a",@progbits
17506 ENTRY(sys_call_table)
17507 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
17508 .long sys_exit
17509 diff -urNp linux-2.6.32.46/arch/x86/kernel/sys_i386_32.c linux-2.6.32.46/arch/x86/kernel/sys_i386_32.c
17510 --- linux-2.6.32.46/arch/x86/kernel/sys_i386_32.c 2011-03-27 14:31:47.000000000 -0400
17511 +++ linux-2.6.32.46/arch/x86/kernel/sys_i386_32.c 2011-04-17 15:56:46.000000000 -0400
17512 @@ -24,6 +24,21 @@
17513
17514 #include <asm/syscalls.h>
17515
17516 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
17517 +{
17518 + unsigned long pax_task_size = TASK_SIZE;
17519 +
17520 +#ifdef CONFIG_PAX_SEGMEXEC
17521 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
17522 + pax_task_size = SEGMEXEC_TASK_SIZE;
17523 +#endif
17524 +
17525 + if (len > pax_task_size || addr > pax_task_size - len)
17526 + return -EINVAL;
17527 +
17528 + return 0;
17529 +}
17530 +
17531 /*
17532 * Perform the select(nd, in, out, ex, tv) and mmap() system
17533 * calls. Linux/i386 didn't use to be able to handle more than
17534 @@ -58,6 +73,212 @@ out:
17535 return err;
17536 }
17537
17538 +unsigned long
17539 +arch_get_unmapped_area(struct file *filp, unsigned long addr,
17540 + unsigned long len, unsigned long pgoff, unsigned long flags)
17541 +{
17542 + struct mm_struct *mm = current->mm;
17543 + struct vm_area_struct *vma;
17544 + unsigned long start_addr, pax_task_size = TASK_SIZE;
17545 +
17546 +#ifdef CONFIG_PAX_SEGMEXEC
17547 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
17548 + pax_task_size = SEGMEXEC_TASK_SIZE;
17549 +#endif
17550 +
17551 + pax_task_size -= PAGE_SIZE;
17552 +
17553 + if (len > pax_task_size)
17554 + return -ENOMEM;
17555 +
17556 + if (flags & MAP_FIXED)
17557 + return addr;
17558 +
17559 +#ifdef CONFIG_PAX_RANDMMAP
17560 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17561 +#endif
17562 +
17563 + if (addr) {
17564 + addr = PAGE_ALIGN(addr);
17565 + if (pax_task_size - len >= addr) {
17566 + vma = find_vma(mm, addr);
17567 + if (check_heap_stack_gap(vma, addr, len))
17568 + return addr;
17569 + }
17570 + }
17571 + if (len > mm->cached_hole_size) {
17572 + start_addr = addr = mm->free_area_cache;
17573 + } else {
17574 + start_addr = addr = mm->mmap_base;
17575 + mm->cached_hole_size = 0;
17576 + }
17577 +
17578 +#ifdef CONFIG_PAX_PAGEEXEC
17579 + if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
17580 + start_addr = 0x00110000UL;
17581 +
17582 +#ifdef CONFIG_PAX_RANDMMAP
17583 + if (mm->pax_flags & MF_PAX_RANDMMAP)
17584 + start_addr += mm->delta_mmap & 0x03FFF000UL;
17585 +#endif
17586 +
17587 + if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
17588 + start_addr = addr = mm->mmap_base;
17589 + else
17590 + addr = start_addr;
17591 + }
17592 +#endif
17593 +
17594 +full_search:
17595 + for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
17596 + /* At this point: (!vma || addr < vma->vm_end). */
17597 + if (pax_task_size - len < addr) {
17598 + /*
17599 + * Start a new search - just in case we missed
17600 + * some holes.
17601 + */
17602 + if (start_addr != mm->mmap_base) {
17603 + start_addr = addr = mm->mmap_base;
17604 + mm->cached_hole_size = 0;
17605 + goto full_search;
17606 + }
17607 + return -ENOMEM;
17608 + }
17609 + if (check_heap_stack_gap(vma, addr, len))
17610 + break;
17611 + if (addr + mm->cached_hole_size < vma->vm_start)
17612 + mm->cached_hole_size = vma->vm_start - addr;
17613 + addr = vma->vm_end;
17614 + if (mm->start_brk <= addr && addr < mm->mmap_base) {
17615 + start_addr = addr = mm->mmap_base;
17616 + mm->cached_hole_size = 0;
17617 + goto full_search;
17618 + }
17619 + }
17620 +
17621 + /*
17622 + * Remember the place where we stopped the search:
17623 + */
17624 + mm->free_area_cache = addr + len;
17625 + return addr;
17626 +}
17627 +
17628 +unsigned long
17629 +arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17630 + const unsigned long len, const unsigned long pgoff,
17631 + const unsigned long flags)
17632 +{
17633 + struct vm_area_struct *vma;
17634 + struct mm_struct *mm = current->mm;
17635 + unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
17636 +
17637 +#ifdef CONFIG_PAX_SEGMEXEC
17638 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
17639 + pax_task_size = SEGMEXEC_TASK_SIZE;
17640 +#endif
17641 +
17642 + pax_task_size -= PAGE_SIZE;
17643 +
17644 + /* requested length too big for entire address space */
17645 + if (len > pax_task_size)
17646 + return -ENOMEM;
17647 +
17648 + if (flags & MAP_FIXED)
17649 + return addr;
17650 +
17651 +#ifdef CONFIG_PAX_PAGEEXEC
17652 + if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
17653 + goto bottomup;
17654 +#endif
17655 +
17656 +#ifdef CONFIG_PAX_RANDMMAP
17657 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17658 +#endif
17659 +
17660 + /* requesting a specific address */
17661 + if (addr) {
17662 + addr = PAGE_ALIGN(addr);
17663 + if (pax_task_size - len >= addr) {
17664 + vma = find_vma(mm, addr);
17665 + if (check_heap_stack_gap(vma, addr, len))
17666 + return addr;
17667 + }
17668 + }
17669 +
17670 + /* check if free_area_cache is useful for us */
17671 + if (len <= mm->cached_hole_size) {
17672 + mm->cached_hole_size = 0;
17673 + mm->free_area_cache = mm->mmap_base;
17674 + }
17675 +
17676 + /* either no address requested or can't fit in requested address hole */
17677 + addr = mm->free_area_cache;
17678 +
17679 + /* make sure it can fit in the remaining address space */
17680 + if (addr > len) {
17681 + vma = find_vma(mm, addr-len);
17682 + if (check_heap_stack_gap(vma, addr - len, len))
17683 + /* remember the address as a hint for next time */
17684 + return (mm->free_area_cache = addr-len);
17685 + }
17686 +
17687 + if (mm->mmap_base < len)
17688 + goto bottomup;
17689 +
17690 + addr = mm->mmap_base-len;
17691 +
17692 + do {
17693 + /*
17694 + * Lookup failure means no vma is above this address,
17695 + * else if new region fits below vma->vm_start,
17696 + * return with success:
17697 + */
17698 + vma = find_vma(mm, addr);
17699 + if (check_heap_stack_gap(vma, addr, len))
17700 + /* remember the address as a hint for next time */
17701 + return (mm->free_area_cache = addr);
17702 +
17703 + /* remember the largest hole we saw so far */
17704 + if (addr + mm->cached_hole_size < vma->vm_start)
17705 + mm->cached_hole_size = vma->vm_start - addr;
17706 +
17707 + /* try just below the current vma->vm_start */
17708 + addr = skip_heap_stack_gap(vma, len);
17709 + } while (!IS_ERR_VALUE(addr));
17710 +
17711 +bottomup:
17712 + /*
17713 + * A failed mmap() very likely causes application failure,
17714 + * so fall back to the bottom-up function here. This scenario
17715 + * can happen with large stack limits and large mmap()
17716 + * allocations.
17717 + */
17718 +
17719 +#ifdef CONFIG_PAX_SEGMEXEC
17720 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
17721 + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
17722 + else
17723 +#endif
17724 +
17725 + mm->mmap_base = TASK_UNMAPPED_BASE;
17726 +
17727 +#ifdef CONFIG_PAX_RANDMMAP
17728 + if (mm->pax_flags & MF_PAX_RANDMMAP)
17729 + mm->mmap_base += mm->delta_mmap;
17730 +#endif
17731 +
17732 + mm->free_area_cache = mm->mmap_base;
17733 + mm->cached_hole_size = ~0UL;
17734 + addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17735 + /*
17736 + * Restore the topdown base:
17737 + */
17738 + mm->mmap_base = base;
17739 + mm->free_area_cache = base;
17740 + mm->cached_hole_size = ~0UL;
17741 +
17742 + return addr;
17743 +}
17744
17745 struct sel_arg_struct {
17746 unsigned long n;
17747 @@ -93,7 +314,7 @@ asmlinkage int sys_ipc(uint call, int fi
17748 return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
17749 case SEMTIMEDOP:
17750 return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
17751 - (const struct timespec __user *)fifth);
17752 + (__force const struct timespec __user *)fifth);
17753
17754 case SEMGET:
17755 return sys_semget(first, second, third);
17756 @@ -140,7 +361,7 @@ asmlinkage int sys_ipc(uint call, int fi
17757 ret = do_shmat(first, (char __user *) ptr, second, &raddr);
17758 if (ret)
17759 return ret;
17760 - return put_user(raddr, (ulong __user *) third);
17761 + return put_user(raddr, (__force ulong __user *) third);
17762 }
17763 case 1: /* iBCS2 emulator entry point */
17764 if (!segment_eq(get_fs(), get_ds()))
17765 @@ -207,17 +428,3 @@ asmlinkage int sys_olduname(struct oldol
17766
17767 return error;
17768 }
17769 -
17770 -
17771 -/*
17772 - * Do a system call from kernel instead of calling sys_execve so we
17773 - * end up with proper pt_regs.
17774 - */
17775 -int kernel_execve(const char *filename, char *const argv[], char *const envp[])
17776 -{
17777 - long __res;
17778 - asm volatile ("push %%ebx ; movl %2,%%ebx ; int $0x80 ; pop %%ebx"
17779 - : "=a" (__res)
17780 - : "0" (__NR_execve), "ri" (filename), "c" (argv), "d" (envp) : "memory");
17781 - return __res;
17782 -}
17783 diff -urNp linux-2.6.32.46/arch/x86/kernel/sys_x86_64.c linux-2.6.32.46/arch/x86/kernel/sys_x86_64.c
17784 --- linux-2.6.32.46/arch/x86/kernel/sys_x86_64.c 2011-03-27 14:31:47.000000000 -0400
17785 +++ linux-2.6.32.46/arch/x86/kernel/sys_x86_64.c 2011-04-17 15:56:46.000000000 -0400
17786 @@ -32,8 +32,8 @@ out:
17787 return error;
17788 }
17789
17790 -static void find_start_end(unsigned long flags, unsigned long *begin,
17791 - unsigned long *end)
17792 +static void find_start_end(struct mm_struct *mm, unsigned long flags,
17793 + unsigned long *begin, unsigned long *end)
17794 {
17795 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
17796 unsigned long new_begin;
17797 @@ -52,7 +52,7 @@ static void find_start_end(unsigned long
17798 *begin = new_begin;
17799 }
17800 } else {
17801 - *begin = TASK_UNMAPPED_BASE;
17802 + *begin = mm->mmap_base;
17803 *end = TASK_SIZE;
17804 }
17805 }
17806 @@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp
17807 if (flags & MAP_FIXED)
17808 return addr;
17809
17810 - find_start_end(flags, &begin, &end);
17811 + find_start_end(mm, flags, &begin, &end);
17812
17813 if (len > end)
17814 return -ENOMEM;
17815
17816 +#ifdef CONFIG_PAX_RANDMMAP
17817 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17818 +#endif
17819 +
17820 if (addr) {
17821 addr = PAGE_ALIGN(addr);
17822 vma = find_vma(mm, addr);
17823 - if (end - len >= addr &&
17824 - (!vma || addr + len <= vma->vm_start))
17825 + if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
17826 return addr;
17827 }
17828 if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
17829 @@ -106,7 +109,7 @@ full_search:
17830 }
17831 return -ENOMEM;
17832 }
17833 - if (!vma || addr + len <= vma->vm_start) {
17834 + if (check_heap_stack_gap(vma, addr, len)) {
17835 /*
17836 * Remember the place where we stopped the search:
17837 */
17838 @@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct fi
17839 {
17840 struct vm_area_struct *vma;
17841 struct mm_struct *mm = current->mm;
17842 - unsigned long addr = addr0;
17843 + unsigned long base = mm->mmap_base, addr = addr0;
17844
17845 /* requested length too big for entire address space */
17846 if (len > TASK_SIZE)
17847 @@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct fi
17848 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
17849 goto bottomup;
17850
17851 +#ifdef CONFIG_PAX_RANDMMAP
17852 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17853 +#endif
17854 +
17855 /* requesting a specific address */
17856 if (addr) {
17857 addr = PAGE_ALIGN(addr);
17858 - vma = find_vma(mm, addr);
17859 - if (TASK_SIZE - len >= addr &&
17860 - (!vma || addr + len <= vma->vm_start))
17861 - return addr;
17862 + if (TASK_SIZE - len >= addr) {
17863 + vma = find_vma(mm, addr);
17864 + if (check_heap_stack_gap(vma, addr, len))
17865 + return addr;
17866 + }
17867 }
17868
17869 /* check if free_area_cache is useful for us */
17870 @@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct fi
17871 /* make sure it can fit in the remaining address space */
17872 if (addr > len) {
17873 vma = find_vma(mm, addr-len);
17874 - if (!vma || addr <= vma->vm_start)
17875 + if (check_heap_stack_gap(vma, addr - len, len))
17876 /* remember the address as a hint for next time */
17877 return mm->free_area_cache = addr-len;
17878 }
17879 @@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct fi
17880 * return with success:
17881 */
17882 vma = find_vma(mm, addr);
17883 - if (!vma || addr+len <= vma->vm_start)
17884 + if (check_heap_stack_gap(vma, addr, len))
17885 /* remember the address as a hint for next time */
17886 return mm->free_area_cache = addr;
17887
17888 @@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct fi
17889 mm->cached_hole_size = vma->vm_start - addr;
17890
17891 /* try just below the current vma->vm_start */
17892 - addr = vma->vm_start-len;
17893 - } while (len < vma->vm_start);
17894 + addr = skip_heap_stack_gap(vma, len);
17895 + } while (!IS_ERR_VALUE(addr));
17896
17897 bottomup:
17898 /*
17899 @@ -198,13 +206,21 @@ bottomup:
17900 * can happen with large stack limits and large mmap()
17901 * allocations.
17902 */
17903 + mm->mmap_base = TASK_UNMAPPED_BASE;
17904 +
17905 +#ifdef CONFIG_PAX_RANDMMAP
17906 + if (mm->pax_flags & MF_PAX_RANDMMAP)
17907 + mm->mmap_base += mm->delta_mmap;
17908 +#endif
17909 +
17910 + mm->free_area_cache = mm->mmap_base;
17911 mm->cached_hole_size = ~0UL;
17912 - mm->free_area_cache = TASK_UNMAPPED_BASE;
17913 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17914 /*
17915 * Restore the topdown base:
17916 */
17917 - mm->free_area_cache = mm->mmap_base;
17918 + mm->mmap_base = base;
17919 + mm->free_area_cache = base;
17920 mm->cached_hole_size = ~0UL;
17921
17922 return addr;
17923 diff -urNp linux-2.6.32.46/arch/x86/kernel/tboot.c linux-2.6.32.46/arch/x86/kernel/tboot.c
17924 --- linux-2.6.32.46/arch/x86/kernel/tboot.c 2011-03-27 14:31:47.000000000 -0400
17925 +++ linux-2.6.32.46/arch/x86/kernel/tboot.c 2011-05-22 23:02:03.000000000 -0400
17926 @@ -216,7 +216,7 @@ static int tboot_setup_sleep(void)
17927
17928 void tboot_shutdown(u32 shutdown_type)
17929 {
17930 - void (*shutdown)(void);
17931 + void (* __noreturn shutdown)(void);
17932
17933 if (!tboot_enabled())
17934 return;
17935 @@ -238,7 +238,7 @@ void tboot_shutdown(u32 shutdown_type)
17936
17937 switch_to_tboot_pt();
17938
17939 - shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
17940 + shutdown = (void *)tboot->shutdown_entry;
17941 shutdown();
17942
17943 /* should not reach here */
17944 @@ -295,7 +295,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1
17945 tboot_shutdown(acpi_shutdown_map[sleep_state]);
17946 }
17947
17948 -static atomic_t ap_wfs_count;
17949 +static atomic_unchecked_t ap_wfs_count;
17950
17951 static int tboot_wait_for_aps(int num_aps)
17952 {
17953 @@ -319,9 +319,9 @@ static int __cpuinit tboot_cpu_callback(
17954 {
17955 switch (action) {
17956 case CPU_DYING:
17957 - atomic_inc(&ap_wfs_count);
17958 + atomic_inc_unchecked(&ap_wfs_count);
17959 if (num_online_cpus() == 1)
17960 - if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
17961 + if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
17962 return NOTIFY_BAD;
17963 break;
17964 }
17965 @@ -340,7 +340,7 @@ static __init int tboot_late_init(void)
17966
17967 tboot_create_trampoline();
17968
17969 - atomic_set(&ap_wfs_count, 0);
17970 + atomic_set_unchecked(&ap_wfs_count, 0);
17971 register_hotcpu_notifier(&tboot_cpu_notifier);
17972 return 0;
17973 }
17974 diff -urNp linux-2.6.32.46/arch/x86/kernel/time.c linux-2.6.32.46/arch/x86/kernel/time.c
17975 --- linux-2.6.32.46/arch/x86/kernel/time.c 2011-03-27 14:31:47.000000000 -0400
17976 +++ linux-2.6.32.46/arch/x86/kernel/time.c 2011-04-17 15:56:46.000000000 -0400
17977 @@ -26,17 +26,13 @@
17978 int timer_ack;
17979 #endif
17980
17981 -#ifdef CONFIG_X86_64
17982 -volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
17983 -#endif
17984 -
17985 unsigned long profile_pc(struct pt_regs *regs)
17986 {
17987 unsigned long pc = instruction_pointer(regs);
17988
17989 - if (!user_mode_vm(regs) && in_lock_functions(pc)) {
17990 + if (!user_mode(regs) && in_lock_functions(pc)) {
17991 #ifdef CONFIG_FRAME_POINTER
17992 - return *(unsigned long *)(regs->bp + sizeof(long));
17993 + return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
17994 #else
17995 unsigned long *sp =
17996 (unsigned long *)kernel_stack_pointer(regs);
17997 @@ -45,11 +41,17 @@ unsigned long profile_pc(struct pt_regs
17998 * or above a saved flags. Eflags has bits 22-31 zero,
17999 * kernel addresses don't.
18000 */
18001 +
18002 +#ifdef CONFIG_PAX_KERNEXEC
18003 + return ktla_ktva(sp[0]);
18004 +#else
18005 if (sp[0] >> 22)
18006 return sp[0];
18007 if (sp[1] >> 22)
18008 return sp[1];
18009 #endif
18010 +
18011 +#endif
18012 }
18013 return pc;
18014 }
18015 diff -urNp linux-2.6.32.46/arch/x86/kernel/tls.c linux-2.6.32.46/arch/x86/kernel/tls.c
18016 --- linux-2.6.32.46/arch/x86/kernel/tls.c 2011-03-27 14:31:47.000000000 -0400
18017 +++ linux-2.6.32.46/arch/x86/kernel/tls.c 2011-04-17 15:56:46.000000000 -0400
18018 @@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
18019 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
18020 return -EINVAL;
18021
18022 +#ifdef CONFIG_PAX_SEGMEXEC
18023 + if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
18024 + return -EINVAL;
18025 +#endif
18026 +
18027 set_tls_desc(p, idx, &info, 1);
18028
18029 return 0;
18030 diff -urNp linux-2.6.32.46/arch/x86/kernel/trampoline_32.S linux-2.6.32.46/arch/x86/kernel/trampoline_32.S
18031 --- linux-2.6.32.46/arch/x86/kernel/trampoline_32.S 2011-03-27 14:31:47.000000000 -0400
18032 +++ linux-2.6.32.46/arch/x86/kernel/trampoline_32.S 2011-04-17 15:56:46.000000000 -0400
18033 @@ -32,6 +32,12 @@
18034 #include <asm/segment.h>
18035 #include <asm/page_types.h>
18036
18037 +#ifdef CONFIG_PAX_KERNEXEC
18038 +#define ta(X) (X)
18039 +#else
18040 +#define ta(X) ((X) - __PAGE_OFFSET)
18041 +#endif
18042 +
18043 /* We can free up trampoline after bootup if cpu hotplug is not supported. */
18044 __CPUINITRODATA
18045 .code16
18046 @@ -60,7 +66,7 @@ r_base = .
18047 inc %ax # protected mode (PE) bit
18048 lmsw %ax # into protected mode
18049 # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
18050 - ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
18051 + ljmpl $__BOOT_CS, $ta(startup_32_smp)
18052
18053 # These need to be in the same 64K segment as the above;
18054 # hence we don't use the boot_gdt_descr defined in head.S
18055 diff -urNp linux-2.6.32.46/arch/x86/kernel/trampoline_64.S linux-2.6.32.46/arch/x86/kernel/trampoline_64.S
18056 --- linux-2.6.32.46/arch/x86/kernel/trampoline_64.S 2011-03-27 14:31:47.000000000 -0400
18057 +++ linux-2.6.32.46/arch/x86/kernel/trampoline_64.S 2011-07-01 18:53:26.000000000 -0400
18058 @@ -91,7 +91,7 @@ startup_32:
18059 movl $__KERNEL_DS, %eax # Initialize the %ds segment register
18060 movl %eax, %ds
18061
18062 - movl $X86_CR4_PAE, %eax
18063 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
18064 movl %eax, %cr4 # Enable PAE mode
18065
18066 # Setup trampoline 4 level pagetables
18067 @@ -127,7 +127,7 @@ startup_64:
18068 no_longmode:
18069 hlt
18070 jmp no_longmode
18071 -#include "verify_cpu_64.S"
18072 +#include "verify_cpu.S"
18073
18074 # Careful these need to be in the same 64K segment as the above;
18075 tidt:
18076 @@ -138,7 +138,7 @@ tidt:
18077 # so the kernel can live anywhere
18078 .balign 4
18079 tgdt:
18080 - .short tgdt_end - tgdt # gdt limit
18081 + .short tgdt_end - tgdt - 1 # gdt limit
18082 .long tgdt - r_base
18083 .short 0
18084 .quad 0x00cf9b000000ffff # __KERNEL32_CS
18085 diff -urNp linux-2.6.32.46/arch/x86/kernel/traps.c linux-2.6.32.46/arch/x86/kernel/traps.c
18086 --- linux-2.6.32.46/arch/x86/kernel/traps.c 2011-03-27 14:31:47.000000000 -0400
18087 +++ linux-2.6.32.46/arch/x86/kernel/traps.c 2011-07-06 19:53:33.000000000 -0400
18088 @@ -69,12 +69,6 @@ asmlinkage int system_call(void);
18089
18090 /* Do we ignore FPU interrupts ? */
18091 char ignore_fpu_irq;
18092 -
18093 -/*
18094 - * The IDT has to be page-aligned to simplify the Pentium
18095 - * F0 0F bug workaround.
18096 - */
18097 -gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
18098 #endif
18099
18100 DECLARE_BITMAP(used_vectors, NR_VECTORS);
18101 @@ -112,19 +106,19 @@ static inline void preempt_conditional_c
18102 static inline void
18103 die_if_kernel(const char *str, struct pt_regs *regs, long err)
18104 {
18105 - if (!user_mode_vm(regs))
18106 + if (!user_mode(regs))
18107 die(str, regs, err);
18108 }
18109 #endif
18110
18111 static void __kprobes
18112 -do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
18113 +do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
18114 long error_code, siginfo_t *info)
18115 {
18116 struct task_struct *tsk = current;
18117
18118 #ifdef CONFIG_X86_32
18119 - if (regs->flags & X86_VM_MASK) {
18120 + if (v8086_mode(regs)) {
18121 /*
18122 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
18123 * On nmi (interrupt 2), do_trap should not be called.
18124 @@ -135,7 +129,7 @@ do_trap(int trapnr, int signr, char *str
18125 }
18126 #endif
18127
18128 - if (!user_mode(regs))
18129 + if (!user_mode_novm(regs))
18130 goto kernel_trap;
18131
18132 #ifdef CONFIG_X86_32
18133 @@ -158,7 +152,7 @@ trap_signal:
18134 printk_ratelimit()) {
18135 printk(KERN_INFO
18136 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
18137 - tsk->comm, tsk->pid, str,
18138 + tsk->comm, task_pid_nr(tsk), str,
18139 regs->ip, regs->sp, error_code);
18140 print_vma_addr(" in ", regs->ip);
18141 printk("\n");
18142 @@ -175,8 +169,20 @@ kernel_trap:
18143 if (!fixup_exception(regs)) {
18144 tsk->thread.error_code = error_code;
18145 tsk->thread.trap_no = trapnr;
18146 +
18147 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18148 + if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
18149 + str = "PAX: suspicious stack segment fault";
18150 +#endif
18151 +
18152 die(str, regs, error_code);
18153 }
18154 +
18155 +#ifdef CONFIG_PAX_REFCOUNT
18156 + if (trapnr == 4)
18157 + pax_report_refcount_overflow(regs);
18158 +#endif
18159 +
18160 return;
18161
18162 #ifdef CONFIG_X86_32
18163 @@ -265,14 +271,30 @@ do_general_protection(struct pt_regs *re
18164 conditional_sti(regs);
18165
18166 #ifdef CONFIG_X86_32
18167 - if (regs->flags & X86_VM_MASK)
18168 + if (v8086_mode(regs))
18169 goto gp_in_vm86;
18170 #endif
18171
18172 tsk = current;
18173 - if (!user_mode(regs))
18174 + if (!user_mode_novm(regs))
18175 goto gp_in_kernel;
18176
18177 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
18178 + if (!nx_enabled && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
18179 + struct mm_struct *mm = tsk->mm;
18180 + unsigned long limit;
18181 +
18182 + down_write(&mm->mmap_sem);
18183 + limit = mm->context.user_cs_limit;
18184 + if (limit < TASK_SIZE) {
18185 + track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
18186 + up_write(&mm->mmap_sem);
18187 + return;
18188 + }
18189 + up_write(&mm->mmap_sem);
18190 + }
18191 +#endif
18192 +
18193 tsk->thread.error_code = error_code;
18194 tsk->thread.trap_no = 13;
18195
18196 @@ -305,6 +327,13 @@ gp_in_kernel:
18197 if (notify_die(DIE_GPF, "general protection fault", regs,
18198 error_code, 13, SIGSEGV) == NOTIFY_STOP)
18199 return;
18200 +
18201 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18202 + if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
18203 + die("PAX: suspicious general protection fault", regs, error_code);
18204 + else
18205 +#endif
18206 +
18207 die("general protection fault", regs, error_code);
18208 }
18209
18210 @@ -435,6 +464,17 @@ static notrace __kprobes void default_do
18211 dotraplinkage notrace __kprobes void
18212 do_nmi(struct pt_regs *regs, long error_code)
18213 {
18214 +
18215 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18216 + if (!user_mode(regs)) {
18217 + unsigned long cs = regs->cs & 0xFFFF;
18218 + unsigned long ip = ktva_ktla(regs->ip);
18219 +
18220 + if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
18221 + regs->ip = ip;
18222 + }
18223 +#endif
18224 +
18225 nmi_enter();
18226
18227 inc_irq_stat(__nmi_count);
18228 @@ -558,7 +598,7 @@ dotraplinkage void __kprobes do_debug(st
18229 }
18230
18231 #ifdef CONFIG_X86_32
18232 - if (regs->flags & X86_VM_MASK)
18233 + if (v8086_mode(regs))
18234 goto debug_vm86;
18235 #endif
18236
18237 @@ -570,7 +610,7 @@ dotraplinkage void __kprobes do_debug(st
18238 * kernel space (but re-enable TF when returning to user mode).
18239 */
18240 if (condition & DR_STEP) {
18241 - if (!user_mode(regs))
18242 + if (!user_mode_novm(regs))
18243 goto clear_TF_reenable;
18244 }
18245
18246 @@ -757,7 +797,7 @@ do_simd_coprocessor_error(struct pt_regs
18247 * Handle strange cache flush from user space exception
18248 * in all other cases. This is undocumented behaviour.
18249 */
18250 - if (regs->flags & X86_VM_MASK) {
18251 + if (v8086_mode(regs)) {
18252 handle_vm86_fault((struct kernel_vm86_regs *)regs, error_code);
18253 return;
18254 }
18255 @@ -798,7 +838,7 @@ asmlinkage void __attribute__((weak)) sm
18256 void __math_state_restore(void)
18257 {
18258 struct thread_info *thread = current_thread_info();
18259 - struct task_struct *tsk = thread->task;
18260 + struct task_struct *tsk = current;
18261
18262 /*
18263 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
18264 @@ -825,8 +865,7 @@ void __math_state_restore(void)
18265 */
18266 asmlinkage void math_state_restore(void)
18267 {
18268 - struct thread_info *thread = current_thread_info();
18269 - struct task_struct *tsk = thread->task;
18270 + struct task_struct *tsk = current;
18271
18272 if (!tsk_used_math(tsk)) {
18273 local_irq_enable();
18274 diff -urNp linux-2.6.32.46/arch/x86/kernel/verify_cpu_64.S linux-2.6.32.46/arch/x86/kernel/verify_cpu_64.S
18275 --- linux-2.6.32.46/arch/x86/kernel/verify_cpu_64.S 2011-03-27 14:31:47.000000000 -0400
18276 +++ linux-2.6.32.46/arch/x86/kernel/verify_cpu_64.S 1969-12-31 19:00:00.000000000 -0500
18277 @@ -1,105 +0,0 @@
18278 -/*
18279 - *
18280 - * verify_cpu.S - Code for cpu long mode and SSE verification. This
18281 - * code has been borrowed from boot/setup.S and was introduced by
18282 - * Andi Kleen.
18283 - *
18284 - * Copyright (c) 2007 Andi Kleen (ak@suse.de)
18285 - * Copyright (c) 2007 Eric Biederman (ebiederm@xmission.com)
18286 - * Copyright (c) 2007 Vivek Goyal (vgoyal@in.ibm.com)
18287 - *
18288 - * This source code is licensed under the GNU General Public License,
18289 - * Version 2. See the file COPYING for more details.
18290 - *
18291 - * This is a common code for verification whether CPU supports
18292 - * long mode and SSE or not. It is not called directly instead this
18293 - * file is included at various places and compiled in that context.
18294 - * Following are the current usage.
18295 - *
18296 - * This file is included by both 16bit and 32bit code.
18297 - *
18298 - * arch/x86_64/boot/setup.S : Boot cpu verification (16bit)
18299 - * arch/x86_64/boot/compressed/head.S: Boot cpu verification (32bit)
18300 - * arch/x86_64/kernel/trampoline.S: secondary processor verfication (16bit)
18301 - * arch/x86_64/kernel/acpi/wakeup.S:Verfication at resume (16bit)
18302 - *
18303 - * verify_cpu, returns the status of cpu check in register %eax.
18304 - * 0: Success 1: Failure
18305 - *
18306 - * The caller needs to check for the error code and take the action
18307 - * appropriately. Either display a message or halt.
18308 - */
18309 -
18310 -#include <asm/cpufeature.h>
18311 -
18312 -verify_cpu:
18313 - pushfl # Save caller passed flags
18314 - pushl $0 # Kill any dangerous flags
18315 - popfl
18316 -
18317 - pushfl # standard way to check for cpuid
18318 - popl %eax
18319 - movl %eax,%ebx
18320 - xorl $0x200000,%eax
18321 - pushl %eax
18322 - popfl
18323 - pushfl
18324 - popl %eax
18325 - cmpl %eax,%ebx
18326 - jz verify_cpu_no_longmode # cpu has no cpuid
18327 -
18328 - movl $0x0,%eax # See if cpuid 1 is implemented
18329 - cpuid
18330 - cmpl $0x1,%eax
18331 - jb verify_cpu_no_longmode # no cpuid 1
18332 -
18333 - xor %di,%di
18334 - cmpl $0x68747541,%ebx # AuthenticAMD
18335 - jnz verify_cpu_noamd
18336 - cmpl $0x69746e65,%edx
18337 - jnz verify_cpu_noamd
18338 - cmpl $0x444d4163,%ecx
18339 - jnz verify_cpu_noamd
18340 - mov $1,%di # cpu is from AMD
18341 -
18342 -verify_cpu_noamd:
18343 - movl $0x1,%eax # Does the cpu have what it takes
18344 - cpuid
18345 - andl $REQUIRED_MASK0,%edx
18346 - xorl $REQUIRED_MASK0,%edx
18347 - jnz verify_cpu_no_longmode
18348 -
18349 - movl $0x80000000,%eax # See if extended cpuid is implemented
18350 - cpuid
18351 - cmpl $0x80000001,%eax
18352 - jb verify_cpu_no_longmode # no extended cpuid
18353 -
18354 - movl $0x80000001,%eax # Does the cpu have what it takes
18355 - cpuid
18356 - andl $REQUIRED_MASK1,%edx
18357 - xorl $REQUIRED_MASK1,%edx
18358 - jnz verify_cpu_no_longmode
18359 -
18360 -verify_cpu_sse_test:
18361 - movl $1,%eax
18362 - cpuid
18363 - andl $SSE_MASK,%edx
18364 - cmpl $SSE_MASK,%edx
18365 - je verify_cpu_sse_ok
18366 - test %di,%di
18367 - jz verify_cpu_no_longmode # only try to force SSE on AMD
18368 - movl $0xc0010015,%ecx # HWCR
18369 - rdmsr
18370 - btr $15,%eax # enable SSE
18371 - wrmsr
18372 - xor %di,%di # don't loop
18373 - jmp verify_cpu_sse_test # try again
18374 -
18375 -verify_cpu_no_longmode:
18376 - popfl # Restore caller passed flags
18377 - movl $1,%eax
18378 - ret
18379 -verify_cpu_sse_ok:
18380 - popfl # Restore caller passed flags
18381 - xorl %eax, %eax
18382 - ret
18383 diff -urNp linux-2.6.32.46/arch/x86/kernel/verify_cpu.S linux-2.6.32.46/arch/x86/kernel/verify_cpu.S
18384 --- linux-2.6.32.46/arch/x86/kernel/verify_cpu.S 1969-12-31 19:00:00.000000000 -0500
18385 +++ linux-2.6.32.46/arch/x86/kernel/verify_cpu.S 2011-07-01 18:28:42.000000000 -0400
18386 @@ -0,0 +1,140 @@
18387 +/*
18388 + *
18389 + * verify_cpu.S - Code for cpu long mode and SSE verification. This
18390 + * code has been borrowed from boot/setup.S and was introduced by
18391 + * Andi Kleen.
18392 + *
18393 + * Copyright (c) 2007 Andi Kleen (ak@suse.de)
18394 + * Copyright (c) 2007 Eric Biederman (ebiederm@xmission.com)
18395 + * Copyright (c) 2007 Vivek Goyal (vgoyal@in.ibm.com)
18396 + * Copyright (c) 2010 Kees Cook (kees.cook@canonical.com)
18397 + *
18398 + * This source code is licensed under the GNU General Public License,
18399 + * Version 2. See the file COPYING for more details.
18400 + *
18401 + * This is a common code for verification whether CPU supports
18402 + * long mode and SSE or not. It is not called directly instead this
18403 + * file is included at various places and compiled in that context.
18404 + * This file is expected to run in 32bit code. Currently:
18405 + *
18406 + * arch/x86/boot/compressed/head_64.S: Boot cpu verification
18407 + * arch/x86/kernel/trampoline_64.S: secondary processor verification
18408 + * arch/x86/kernel/head_32.S: processor startup
18409 + * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
18410 + *
18411 + * verify_cpu, returns the status of longmode and SSE in register %eax.
18412 + * 0: Success 1: Failure
18413 + *
18414 + * On Intel, the XD_DISABLE flag will be cleared as a side-effect.
18415 + *
18416 + * The caller needs to check for the error code and take the action
18417 + * appropriately. Either display a message or halt.
18418 + */
18419 +
18420 +#include <asm/cpufeature.h>
18421 +#include <asm/msr-index.h>
18422 +
18423 +verify_cpu:
18424 + pushfl # Save caller passed flags
18425 + pushl $0 # Kill any dangerous flags
18426 + popfl
18427 +
18428 + pushfl # standard way to check for cpuid
18429 + popl %eax
18430 + movl %eax,%ebx
18431 + xorl $0x200000,%eax
18432 + pushl %eax
18433 + popfl
18434 + pushfl
18435 + popl %eax
18436 + cmpl %eax,%ebx
18437 + jz verify_cpu_no_longmode # cpu has no cpuid
18438 +
18439 + movl $0x0,%eax # See if cpuid 1 is implemented
18440 + cpuid
18441 + cmpl $0x1,%eax
18442 + jb verify_cpu_no_longmode # no cpuid 1
18443 +
18444 + xor %di,%di
18445 + cmpl $0x68747541,%ebx # AuthenticAMD
18446 + jnz verify_cpu_noamd
18447 + cmpl $0x69746e65,%edx
18448 + jnz verify_cpu_noamd
18449 + cmpl $0x444d4163,%ecx
18450 + jnz verify_cpu_noamd
18451 + mov $1,%di # cpu is from AMD
18452 + jmp verify_cpu_check
18453 +
18454 +verify_cpu_noamd:
18455 + cmpl $0x756e6547,%ebx # GenuineIntel?
18456 + jnz verify_cpu_check
18457 + cmpl $0x49656e69,%edx
18458 + jnz verify_cpu_check
18459 + cmpl $0x6c65746e,%ecx
18460 + jnz verify_cpu_check
18461 +
18462 + # only call IA32_MISC_ENABLE when:
18463 + # family > 6 || (family == 6 && model >= 0xd)
18464 + movl $0x1, %eax # check CPU family and model
18465 + cpuid
18466 + movl %eax, %ecx
18467 +
18468 + andl $0x0ff00f00, %eax # mask family and extended family
18469 + shrl $8, %eax
18470 + cmpl $6, %eax
18471 + ja verify_cpu_clear_xd # family > 6, ok
18472 + jb verify_cpu_check # family < 6, skip
18473 +
18474 + andl $0x000f00f0, %ecx # mask model and extended model
18475 + shrl $4, %ecx
18476 + cmpl $0xd, %ecx
18477 + jb verify_cpu_check # family == 6, model < 0xd, skip
18478 +
18479 +verify_cpu_clear_xd:
18480 + movl $MSR_IA32_MISC_ENABLE, %ecx
18481 + rdmsr
18482 + btrl $2, %edx # clear MSR_IA32_MISC_ENABLE_XD_DISABLE
18483 + jnc verify_cpu_check # only write MSR if bit was changed
18484 + wrmsr
18485 +
18486 +verify_cpu_check:
18487 + movl $0x1,%eax # Does the cpu have what it takes
18488 + cpuid
18489 + andl $REQUIRED_MASK0,%edx
18490 + xorl $REQUIRED_MASK0,%edx
18491 + jnz verify_cpu_no_longmode
18492 +
18493 + movl $0x80000000,%eax # See if extended cpuid is implemented
18494 + cpuid
18495 + cmpl $0x80000001,%eax
18496 + jb verify_cpu_no_longmode # no extended cpuid
18497 +
18498 + movl $0x80000001,%eax # Does the cpu have what it takes
18499 + cpuid
18500 + andl $REQUIRED_MASK1,%edx
18501 + xorl $REQUIRED_MASK1,%edx
18502 + jnz verify_cpu_no_longmode
18503 +
18504 +verify_cpu_sse_test:
18505 + movl $1,%eax
18506 + cpuid
18507 + andl $SSE_MASK,%edx
18508 + cmpl $SSE_MASK,%edx
18509 + je verify_cpu_sse_ok
18510 + test %di,%di
18511 + jz verify_cpu_no_longmode # only try to force SSE on AMD
18512 + movl $MSR_K7_HWCR,%ecx
18513 + rdmsr
18514 + btr $15,%eax # enable SSE
18515 + wrmsr
18516 + xor %di,%di # don't loop
18517 + jmp verify_cpu_sse_test # try again
18518 +
18519 +verify_cpu_no_longmode:
18520 + popfl # Restore caller passed flags
18521 + movl $1,%eax
18522 + ret
18523 +verify_cpu_sse_ok:
18524 + popfl # Restore caller passed flags
18525 + xorl %eax, %eax
18526 + ret
18527 diff -urNp linux-2.6.32.46/arch/x86/kernel/vm86_32.c linux-2.6.32.46/arch/x86/kernel/vm86_32.c
18528 --- linux-2.6.32.46/arch/x86/kernel/vm86_32.c 2011-03-27 14:31:47.000000000 -0400
18529 +++ linux-2.6.32.46/arch/x86/kernel/vm86_32.c 2011-04-17 15:56:46.000000000 -0400
18530 @@ -41,6 +41,7 @@
18531 #include <linux/ptrace.h>
18532 #include <linux/audit.h>
18533 #include <linux/stddef.h>
18534 +#include <linux/grsecurity.h>
18535
18536 #include <asm/uaccess.h>
18537 #include <asm/io.h>
18538 @@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
18539 do_exit(SIGSEGV);
18540 }
18541
18542 - tss = &per_cpu(init_tss, get_cpu());
18543 + tss = init_tss + get_cpu();
18544 current->thread.sp0 = current->thread.saved_sp0;
18545 current->thread.sysenter_cs = __KERNEL_CS;
18546 load_sp0(tss, &current->thread);
18547 @@ -208,6 +209,13 @@ int sys_vm86old(struct pt_regs *regs)
18548 struct task_struct *tsk;
18549 int tmp, ret = -EPERM;
18550
18551 +#ifdef CONFIG_GRKERNSEC_VM86
18552 + if (!capable(CAP_SYS_RAWIO)) {
18553 + gr_handle_vm86();
18554 + goto out;
18555 + }
18556 +#endif
18557 +
18558 tsk = current;
18559 if (tsk->thread.saved_sp0)
18560 goto out;
18561 @@ -238,6 +246,14 @@ int sys_vm86(struct pt_regs *regs)
18562 int tmp, ret;
18563 struct vm86plus_struct __user *v86;
18564
18565 +#ifdef CONFIG_GRKERNSEC_VM86
18566 + if (!capable(CAP_SYS_RAWIO)) {
18567 + gr_handle_vm86();
18568 + ret = -EPERM;
18569 + goto out;
18570 + }
18571 +#endif
18572 +
18573 tsk = current;
18574 switch (regs->bx) {
18575 case VM86_REQUEST_IRQ:
18576 @@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
18577 tsk->thread.saved_fs = info->regs32->fs;
18578 tsk->thread.saved_gs = get_user_gs(info->regs32);
18579
18580 - tss = &per_cpu(init_tss, get_cpu());
18581 + tss = init_tss + get_cpu();
18582 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
18583 if (cpu_has_sep)
18584 tsk->thread.sysenter_cs = 0;
18585 @@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
18586 goto cannot_handle;
18587 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
18588 goto cannot_handle;
18589 - intr_ptr = (unsigned long __user *) (i << 2);
18590 + intr_ptr = (__force unsigned long __user *) (i << 2);
18591 if (get_user(segoffs, intr_ptr))
18592 goto cannot_handle;
18593 if ((segoffs >> 16) == BIOSSEG)
18594 diff -urNp linux-2.6.32.46/arch/x86/kernel/vmi_32.c linux-2.6.32.46/arch/x86/kernel/vmi_32.c
18595 --- linux-2.6.32.46/arch/x86/kernel/vmi_32.c 2011-03-27 14:31:47.000000000 -0400
18596 +++ linux-2.6.32.46/arch/x86/kernel/vmi_32.c 2011-08-05 20:33:55.000000000 -0400
18597 @@ -44,12 +44,17 @@ typedef u32 __attribute__((regparm(1)))
18598 typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
18599
18600 #define call_vrom_func(rom,func) \
18601 - (((VROMFUNC *)(rom->func))())
18602 + (((VROMFUNC *)(ktva_ktla(rom.func)))())
18603
18604 #define call_vrom_long_func(rom,func,arg) \
18605 - (((VROMLONGFUNC *)(rom->func)) (arg))
18606 +({\
18607 + u64 __reloc = ((VROMLONGFUNC *)(ktva_ktla(rom.func))) (arg);\
18608 + struct vmi_relocation_info *const __rel = (struct vmi_relocation_info *)&__reloc;\
18609 + __rel->eip = (unsigned char *)ktva_ktla((unsigned long)__rel->eip);\
18610 + __reloc;\
18611 +})
18612
18613 -static struct vrom_header *vmi_rom;
18614 +static struct vrom_header vmi_rom __attribute((__section__(".vmi.rom"), __aligned__(PAGE_SIZE)));
18615 static int disable_pge;
18616 static int disable_pse;
18617 static int disable_sep;
18618 @@ -76,10 +81,10 @@ static struct {
18619 void (*set_initial_ap_state)(int, int);
18620 void (*halt)(void);
18621 void (*set_lazy_mode)(int mode);
18622 -} vmi_ops;
18623 +} __no_const vmi_ops __read_only;
18624
18625 /* Cached VMI operations */
18626 -struct vmi_timer_ops vmi_timer_ops;
18627 +struct vmi_timer_ops vmi_timer_ops __read_only;
18628
18629 /*
18630 * VMI patching routines.
18631 @@ -94,7 +99,7 @@ struct vmi_timer_ops vmi_timer_ops;
18632 static inline void patch_offset(void *insnbuf,
18633 unsigned long ip, unsigned long dest)
18634 {
18635 - *(unsigned long *)(insnbuf+1) = dest-ip-5;
18636 + *(unsigned long *)(insnbuf+1) = dest-ip-5;
18637 }
18638
18639 static unsigned patch_internal(int call, unsigned len, void *insnbuf,
18640 @@ -102,6 +107,7 @@ static unsigned patch_internal(int call,
18641 {
18642 u64 reloc;
18643 struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
18644 +
18645 reloc = call_vrom_long_func(vmi_rom, get_reloc, call);
18646 switch(rel->type) {
18647 case VMI_RELOCATION_CALL_REL:
18648 @@ -404,13 +410,13 @@ static void vmi_set_pud(pud_t *pudp, pud
18649
18650 static void vmi_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
18651 {
18652 - const pte_t pte = { .pte = 0 };
18653 + const pte_t pte = __pte(0ULL);
18654 vmi_ops.set_pte(pte, ptep, vmi_flags_addr(mm, addr, VMI_PAGE_PT, 0));
18655 }
18656
18657 static void vmi_pmd_clear(pmd_t *pmd)
18658 {
18659 - const pte_t pte = { .pte = 0 };
18660 + const pte_t pte = __pte(0ULL);
18661 vmi_ops.set_pte(pte, (pte_t *)pmd, VMI_PAGE_PD);
18662 }
18663 #endif
18664 @@ -438,10 +444,10 @@ vmi_startup_ipi_hook(int phys_apicid, un
18665 ap.ss = __KERNEL_DS;
18666 ap.esp = (unsigned long) start_esp;
18667
18668 - ap.ds = __USER_DS;
18669 - ap.es = __USER_DS;
18670 + ap.ds = __KERNEL_DS;
18671 + ap.es = __KERNEL_DS;
18672 ap.fs = __KERNEL_PERCPU;
18673 - ap.gs = __KERNEL_STACK_CANARY;
18674 + savesegment(gs, ap.gs);
18675
18676 ap.eflags = 0;
18677
18678 @@ -486,6 +492,18 @@ static void vmi_leave_lazy_mmu(void)
18679 paravirt_leave_lazy_mmu();
18680 }
18681
18682 +#ifdef CONFIG_PAX_KERNEXEC
18683 +static unsigned long vmi_pax_open_kernel(void)
18684 +{
18685 + return 0;
18686 +}
18687 +
18688 +static unsigned long vmi_pax_close_kernel(void)
18689 +{
18690 + return 0;
18691 +}
18692 +#endif
18693 +
18694 static inline int __init check_vmi_rom(struct vrom_header *rom)
18695 {
18696 struct pci_header *pci;
18697 @@ -498,6 +516,10 @@ static inline int __init check_vmi_rom(s
18698 return 0;
18699 if (rom->vrom_signature != VMI_SIGNATURE)
18700 return 0;
18701 + if (rom->rom_length * 512 > sizeof(*rom)) {
18702 + printk(KERN_WARNING "PAX: VMI: ROM size too big: %x\n", rom->rom_length * 512);
18703 + return 0;
18704 + }
18705 if (rom->api_version_maj != VMI_API_REV_MAJOR ||
18706 rom->api_version_min+1 < VMI_API_REV_MINOR+1) {
18707 printk(KERN_WARNING "VMI: Found mismatched rom version %d.%d\n",
18708 @@ -562,7 +584,7 @@ static inline int __init probe_vmi_rom(v
18709 struct vrom_header *romstart;
18710 romstart = (struct vrom_header *)isa_bus_to_virt(base);
18711 if (check_vmi_rom(romstart)) {
18712 - vmi_rom = romstart;
18713 + vmi_rom = *romstart;
18714 return 1;
18715 }
18716 }
18717 @@ -836,6 +858,11 @@ static inline int __init activate_vmi(vo
18718
18719 para_fill(pv_irq_ops.safe_halt, Halt);
18720
18721 +#ifdef CONFIG_PAX_KERNEXEC
18722 + pv_mmu_ops.pax_open_kernel = vmi_pax_open_kernel;
18723 + pv_mmu_ops.pax_close_kernel = vmi_pax_close_kernel;
18724 +#endif
18725 +
18726 /*
18727 * Alternative instruction rewriting doesn't happen soon enough
18728 * to convert VMI_IRET to a call instead of a jump; so we have
18729 @@ -853,16 +880,16 @@ static inline int __init activate_vmi(vo
18730
18731 void __init vmi_init(void)
18732 {
18733 - if (!vmi_rom)
18734 + if (!vmi_rom.rom_signature)
18735 probe_vmi_rom();
18736 else
18737 - check_vmi_rom(vmi_rom);
18738 + check_vmi_rom(&vmi_rom);
18739
18740 /* In case probing for or validating the ROM failed, basil */
18741 - if (!vmi_rom)
18742 + if (!vmi_rom.rom_signature)
18743 return;
18744
18745 - reserve_top_address(-vmi_rom->virtual_top);
18746 + reserve_top_address(-vmi_rom.virtual_top);
18747
18748 #ifdef CONFIG_X86_IO_APIC
18749 /* This is virtual hardware; timer routing is wired correctly */
18750 @@ -874,7 +901,7 @@ void __init vmi_activate(void)
18751 {
18752 unsigned long flags;
18753
18754 - if (!vmi_rom)
18755 + if (!vmi_rom.rom_signature)
18756 return;
18757
18758 local_irq_save(flags);
18759 diff -urNp linux-2.6.32.46/arch/x86/kernel/vmlinux.lds.S linux-2.6.32.46/arch/x86/kernel/vmlinux.lds.S
18760 --- linux-2.6.32.46/arch/x86/kernel/vmlinux.lds.S 2011-03-27 14:31:47.000000000 -0400
18761 +++ linux-2.6.32.46/arch/x86/kernel/vmlinux.lds.S 2011-04-17 15:56:46.000000000 -0400
18762 @@ -26,6 +26,13 @@
18763 #include <asm/page_types.h>
18764 #include <asm/cache.h>
18765 #include <asm/boot.h>
18766 +#include <asm/segment.h>
18767 +
18768 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18769 +#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
18770 +#else
18771 +#define __KERNEL_TEXT_OFFSET 0
18772 +#endif
18773
18774 #undef i386 /* in case the preprocessor is a 32bit one */
18775
18776 @@ -34,40 +41,53 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
18777 #ifdef CONFIG_X86_32
18778 OUTPUT_ARCH(i386)
18779 ENTRY(phys_startup_32)
18780 -jiffies = jiffies_64;
18781 #else
18782 OUTPUT_ARCH(i386:x86-64)
18783 ENTRY(phys_startup_64)
18784 -jiffies_64 = jiffies;
18785 #endif
18786
18787 PHDRS {
18788 text PT_LOAD FLAGS(5); /* R_E */
18789 - data PT_LOAD FLAGS(7); /* RWE */
18790 +#ifdef CONFIG_X86_32
18791 + module PT_LOAD FLAGS(5); /* R_E */
18792 +#endif
18793 +#ifdef CONFIG_XEN
18794 + rodata PT_LOAD FLAGS(5); /* R_E */
18795 +#else
18796 + rodata PT_LOAD FLAGS(4); /* R__ */
18797 +#endif
18798 + data PT_LOAD FLAGS(6); /* RW_ */
18799 #ifdef CONFIG_X86_64
18800 user PT_LOAD FLAGS(5); /* R_E */
18801 +#endif
18802 + init.begin PT_LOAD FLAGS(6); /* RW_ */
18803 #ifdef CONFIG_SMP
18804 percpu PT_LOAD FLAGS(6); /* RW_ */
18805 #endif
18806 + text.init PT_LOAD FLAGS(5); /* R_E */
18807 + text.exit PT_LOAD FLAGS(5); /* R_E */
18808 init PT_LOAD FLAGS(7); /* RWE */
18809 -#endif
18810 note PT_NOTE FLAGS(0); /* ___ */
18811 }
18812
18813 SECTIONS
18814 {
18815 #ifdef CONFIG_X86_32
18816 - . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
18817 - phys_startup_32 = startup_32 - LOAD_OFFSET;
18818 + . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
18819 #else
18820 - . = __START_KERNEL;
18821 - phys_startup_64 = startup_64 - LOAD_OFFSET;
18822 + . = __START_KERNEL;
18823 #endif
18824
18825 /* Text and read-only data */
18826 - .text : AT(ADDR(.text) - LOAD_OFFSET) {
18827 - _text = .;
18828 + .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
18829 /* bootstrapping code */
18830 +#ifdef CONFIG_X86_32
18831 + phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18832 +#else
18833 + phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18834 +#endif
18835 + __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18836 + _text = .;
18837 HEAD_TEXT
18838 #ifdef CONFIG_X86_32
18839 . = ALIGN(PAGE_SIZE);
18840 @@ -82,28 +102,71 @@ SECTIONS
18841 IRQENTRY_TEXT
18842 *(.fixup)
18843 *(.gnu.warning)
18844 - /* End of text section */
18845 - _etext = .;
18846 } :text = 0x9090
18847
18848 - NOTES :text :note
18849 + . += __KERNEL_TEXT_OFFSET;
18850 +
18851 +#ifdef CONFIG_X86_32
18852 + . = ALIGN(PAGE_SIZE);
18853 + .vmi.rom : AT(ADDR(.vmi.rom) - LOAD_OFFSET) {
18854 + *(.vmi.rom)
18855 + } :module
18856 +
18857 + . = ALIGN(PAGE_SIZE);
18858 + .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
18859 +
18860 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
18861 + MODULES_EXEC_VADDR = .;
18862 + BYTE(0)
18863 + . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
18864 + . = ALIGN(HPAGE_SIZE);
18865 + MODULES_EXEC_END = . - 1;
18866 +#endif
18867 +
18868 + } :module
18869 +#endif
18870
18871 - EXCEPTION_TABLE(16) :text = 0x9090
18872 + .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
18873 + /* End of text section */
18874 + _etext = . - __KERNEL_TEXT_OFFSET;
18875 + }
18876 +
18877 +#ifdef CONFIG_X86_32
18878 + . = ALIGN(PAGE_SIZE);
18879 + .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
18880 + *(.idt)
18881 + . = ALIGN(PAGE_SIZE);
18882 + *(.empty_zero_page)
18883 + *(.swapper_pg_fixmap)
18884 + *(.swapper_pg_pmd)
18885 + *(.swapper_pg_dir)
18886 + *(.trampoline_pg_dir)
18887 + } :rodata
18888 +#endif
18889 +
18890 + . = ALIGN(PAGE_SIZE);
18891 + NOTES :rodata :note
18892 +
18893 + EXCEPTION_TABLE(16) :rodata
18894
18895 RO_DATA(PAGE_SIZE)
18896
18897 /* Data */
18898 .data : AT(ADDR(.data) - LOAD_OFFSET) {
18899 +
18900 +#ifdef CONFIG_PAX_KERNEXEC
18901 + . = ALIGN(HPAGE_SIZE);
18902 +#else
18903 + . = ALIGN(PAGE_SIZE);
18904 +#endif
18905 +
18906 /* Start of data section */
18907 _sdata = .;
18908
18909 /* init_task */
18910 INIT_TASK_DATA(THREAD_SIZE)
18911
18912 -#ifdef CONFIG_X86_32
18913 - /* 32 bit has nosave before _edata */
18914 NOSAVE_DATA
18915 -#endif
18916
18917 PAGE_ALIGNED_DATA(PAGE_SIZE)
18918
18919 @@ -112,6 +175,8 @@ SECTIONS
18920 DATA_DATA
18921 CONSTRUCTORS
18922
18923 + jiffies = jiffies_64;
18924 +
18925 /* rarely changed data like cpu maps */
18926 READ_MOSTLY_DATA(CONFIG_X86_INTERNODE_CACHE_BYTES)
18927
18928 @@ -166,12 +231,6 @@ SECTIONS
18929 }
18930 vgetcpu_mode = VVIRT(.vgetcpu_mode);
18931
18932 - . = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
18933 - .jiffies : AT(VLOAD(.jiffies)) {
18934 - *(.jiffies)
18935 - }
18936 - jiffies = VVIRT(.jiffies);
18937 -
18938 .vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
18939 *(.vsyscall_3)
18940 }
18941 @@ -187,12 +246,19 @@ SECTIONS
18942 #endif /* CONFIG_X86_64 */
18943
18944 /* Init code and data - will be freed after init */
18945 - . = ALIGN(PAGE_SIZE);
18946 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
18947 + BYTE(0)
18948 +
18949 +#ifdef CONFIG_PAX_KERNEXEC
18950 + . = ALIGN(HPAGE_SIZE);
18951 +#else
18952 + . = ALIGN(PAGE_SIZE);
18953 +#endif
18954 +
18955 __init_begin = .; /* paired with __init_end */
18956 - }
18957 + } :init.begin
18958
18959 -#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
18960 +#ifdef CONFIG_SMP
18961 /*
18962 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
18963 * output PHDR, so the next output section - .init.text - should
18964 @@ -201,12 +267,27 @@ SECTIONS
18965 PERCPU_VADDR(0, :percpu)
18966 #endif
18967
18968 - INIT_TEXT_SECTION(PAGE_SIZE)
18969 -#ifdef CONFIG_X86_64
18970 - :init
18971 -#endif
18972 + . = ALIGN(PAGE_SIZE);
18973 + init_begin = .;
18974 + .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
18975 + VMLINUX_SYMBOL(_sinittext) = .;
18976 + INIT_TEXT
18977 + VMLINUX_SYMBOL(_einittext) = .;
18978 + . = ALIGN(PAGE_SIZE);
18979 + } :text.init
18980
18981 - INIT_DATA_SECTION(16)
18982 + /*
18983 + * .exit.text is discard at runtime, not link time, to deal with
18984 + * references from .altinstructions and .eh_frame
18985 + */
18986 + .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
18987 + EXIT_TEXT
18988 + . = ALIGN(16);
18989 + } :text.exit
18990 + . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
18991 +
18992 + . = ALIGN(PAGE_SIZE);
18993 + INIT_DATA_SECTION(16) :init
18994
18995 .x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
18996 __x86_cpu_dev_start = .;
18997 @@ -232,19 +313,11 @@ SECTIONS
18998 *(.altinstr_replacement)
18999 }
19000
19001 - /*
19002 - * .exit.text is discard at runtime, not link time, to deal with
19003 - * references from .altinstructions and .eh_frame
19004 - */
19005 - .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
19006 - EXIT_TEXT
19007 - }
19008 -
19009 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
19010 EXIT_DATA
19011 }
19012
19013 -#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
19014 +#ifndef CONFIG_SMP
19015 PERCPU(PAGE_SIZE)
19016 #endif
19017
19018 @@ -267,12 +340,6 @@ SECTIONS
19019 . = ALIGN(PAGE_SIZE);
19020 }
19021
19022 -#ifdef CONFIG_X86_64
19023 - .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
19024 - NOSAVE_DATA
19025 - }
19026 -#endif
19027 -
19028 /* BSS */
19029 . = ALIGN(PAGE_SIZE);
19030 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
19031 @@ -288,6 +355,7 @@ SECTIONS
19032 __brk_base = .;
19033 . += 64 * 1024; /* 64k alignment slop space */
19034 *(.brk_reservation) /* areas brk users have reserved */
19035 + . = ALIGN(HPAGE_SIZE);
19036 __brk_limit = .;
19037 }
19038
19039 @@ -316,13 +384,12 @@ SECTIONS
19040 * for the boot processor.
19041 */
19042 #define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
19043 -INIT_PER_CPU(gdt_page);
19044 INIT_PER_CPU(irq_stack_union);
19045
19046 /*
19047 * Build-time check on the image size:
19048 */
19049 -. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
19050 +. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
19051 "kernel image bigger than KERNEL_IMAGE_SIZE");
19052
19053 #ifdef CONFIG_SMP
19054 diff -urNp linux-2.6.32.46/arch/x86/kernel/vsyscall_64.c linux-2.6.32.46/arch/x86/kernel/vsyscall_64.c
19055 --- linux-2.6.32.46/arch/x86/kernel/vsyscall_64.c 2011-03-27 14:31:47.000000000 -0400
19056 +++ linux-2.6.32.46/arch/x86/kernel/vsyscall_64.c 2011-04-23 12:56:10.000000000 -0400
19057 @@ -80,6 +80,7 @@ void update_vsyscall(struct timespec *wa
19058
19059 write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
19060 /* copy vsyscall data */
19061 + strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
19062 vsyscall_gtod_data.clock.vread = clock->vread;
19063 vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
19064 vsyscall_gtod_data.clock.mask = clock->mask;
19065 @@ -203,7 +204,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
19066 We do this here because otherwise user space would do it on
19067 its own in a likely inferior way (no access to jiffies).
19068 If you don't like it pass NULL. */
19069 - if (tcache && tcache->blob[0] == (j = __jiffies)) {
19070 + if (tcache && tcache->blob[0] == (j = jiffies)) {
19071 p = tcache->blob[1];
19072 } else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
19073 /* Load per CPU data from RDTSCP */
19074 diff -urNp linux-2.6.32.46/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.46/arch/x86/kernel/x8664_ksyms_64.c
19075 --- linux-2.6.32.46/arch/x86/kernel/x8664_ksyms_64.c 2011-03-27 14:31:47.000000000 -0400
19076 +++ linux-2.6.32.46/arch/x86/kernel/x8664_ksyms_64.c 2011-04-17 15:56:46.000000000 -0400
19077 @@ -30,8 +30,6 @@ EXPORT_SYMBOL(__put_user_8);
19078
19079 EXPORT_SYMBOL(copy_user_generic);
19080 EXPORT_SYMBOL(__copy_user_nocache);
19081 -EXPORT_SYMBOL(copy_from_user);
19082 -EXPORT_SYMBOL(copy_to_user);
19083 EXPORT_SYMBOL(__copy_from_user_inatomic);
19084
19085 EXPORT_SYMBOL(copy_page);
19086 diff -urNp linux-2.6.32.46/arch/x86/kernel/xsave.c linux-2.6.32.46/arch/x86/kernel/xsave.c
19087 --- linux-2.6.32.46/arch/x86/kernel/xsave.c 2011-03-27 14:31:47.000000000 -0400
19088 +++ linux-2.6.32.46/arch/x86/kernel/xsave.c 2011-10-06 09:37:08.000000000 -0400
19089 @@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_
19090 fx_sw_user->xstate_size > fx_sw_user->extended_size)
19091 return -1;
19092
19093 - err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
19094 + err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
19095 fx_sw_user->extended_size -
19096 FP_XSTATE_MAGIC2_SIZE));
19097 /*
19098 @@ -196,7 +196,7 @@ fx_only:
19099 * the other extended state.
19100 */
19101 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
19102 - return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
19103 + return fxrstor_checking((struct i387_fxsave_struct __force_kernel *)buf);
19104 }
19105
19106 /*
19107 @@ -228,7 +228,7 @@ int restore_i387_xstate(void __user *buf
19108 if (task_thread_info(tsk)->status & TS_XSAVE)
19109 err = restore_user_xstate(buf);
19110 else
19111 - err = fxrstor_checking((__force struct i387_fxsave_struct *)
19112 + err = fxrstor_checking((struct i387_fxsave_struct __user *)
19113 buf);
19114 if (unlikely(err)) {
19115 /*
19116 diff -urNp linux-2.6.32.46/arch/x86/kvm/emulate.c linux-2.6.32.46/arch/x86/kvm/emulate.c
19117 --- linux-2.6.32.46/arch/x86/kvm/emulate.c 2011-03-27 14:31:47.000000000 -0400
19118 +++ linux-2.6.32.46/arch/x86/kvm/emulate.c 2011-04-17 15:56:46.000000000 -0400
19119 @@ -81,8 +81,8 @@
19120 #define Src2CL (1<<29)
19121 #define Src2ImmByte (2<<29)
19122 #define Src2One (3<<29)
19123 -#define Src2Imm16 (4<<29)
19124 -#define Src2Mask (7<<29)
19125 +#define Src2Imm16 (4U<<29)
19126 +#define Src2Mask (7U<<29)
19127
19128 enum {
19129 Group1_80, Group1_81, Group1_82, Group1_83,
19130 @@ -411,6 +411,7 @@ static u32 group2_table[] = {
19131
19132 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix) \
19133 do { \
19134 + unsigned long _tmp; \
19135 __asm__ __volatile__ ( \
19136 _PRE_EFLAGS("0", "4", "2") \
19137 _op _suffix " %"_x"3,%1; " \
19138 @@ -424,8 +425,6 @@ static u32 group2_table[] = {
19139 /* Raw emulation: instruction has two explicit operands. */
19140 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
19141 do { \
19142 - unsigned long _tmp; \
19143 - \
19144 switch ((_dst).bytes) { \
19145 case 2: \
19146 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
19147 @@ -441,7 +440,6 @@ static u32 group2_table[] = {
19148
19149 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
19150 do { \
19151 - unsigned long _tmp; \
19152 switch ((_dst).bytes) { \
19153 case 1: \
19154 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b"); \
19155 diff -urNp linux-2.6.32.46/arch/x86/kvm/lapic.c linux-2.6.32.46/arch/x86/kvm/lapic.c
19156 --- linux-2.6.32.46/arch/x86/kvm/lapic.c 2011-03-27 14:31:47.000000000 -0400
19157 +++ linux-2.6.32.46/arch/x86/kvm/lapic.c 2011-04-17 15:56:46.000000000 -0400
19158 @@ -52,7 +52,7 @@
19159 #define APIC_BUS_CYCLE_NS 1
19160
19161 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
19162 -#define apic_debug(fmt, arg...)
19163 +#define apic_debug(fmt, arg...) do {} while (0)
19164
19165 #define APIC_LVT_NUM 6
19166 /* 14 is the version for Xeon and Pentium 8.4.8*/
19167 diff -urNp linux-2.6.32.46/arch/x86/kvm/paging_tmpl.h linux-2.6.32.46/arch/x86/kvm/paging_tmpl.h
19168 --- linux-2.6.32.46/arch/x86/kvm/paging_tmpl.h 2011-03-27 14:31:47.000000000 -0400
19169 +++ linux-2.6.32.46/arch/x86/kvm/paging_tmpl.h 2011-05-16 21:46:57.000000000 -0400
19170 @@ -416,6 +416,8 @@ static int FNAME(page_fault)(struct kvm_
19171 int level = PT_PAGE_TABLE_LEVEL;
19172 unsigned long mmu_seq;
19173
19174 + pax_track_stack();
19175 +
19176 pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
19177 kvm_mmu_audit(vcpu, "pre page fault");
19178
19179 diff -urNp linux-2.6.32.46/arch/x86/kvm/svm.c linux-2.6.32.46/arch/x86/kvm/svm.c
19180 --- linux-2.6.32.46/arch/x86/kvm/svm.c 2011-03-27 14:31:47.000000000 -0400
19181 +++ linux-2.6.32.46/arch/x86/kvm/svm.c 2011-08-05 20:33:55.000000000 -0400
19182 @@ -2485,7 +2485,11 @@ static void reload_tss(struct kvm_vcpu *
19183 int cpu = raw_smp_processor_id();
19184
19185 struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
19186 +
19187 + pax_open_kernel();
19188 svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
19189 + pax_close_kernel();
19190 +
19191 load_TR_desc();
19192 }
19193
19194 @@ -2946,7 +2950,7 @@ static bool svm_gb_page_enable(void)
19195 return true;
19196 }
19197
19198 -static struct kvm_x86_ops svm_x86_ops = {
19199 +static const struct kvm_x86_ops svm_x86_ops = {
19200 .cpu_has_kvm_support = has_svm,
19201 .disabled_by_bios = is_disabled,
19202 .hardware_setup = svm_hardware_setup,
19203 diff -urNp linux-2.6.32.46/arch/x86/kvm/vmx.c linux-2.6.32.46/arch/x86/kvm/vmx.c
19204 --- linux-2.6.32.46/arch/x86/kvm/vmx.c 2011-03-27 14:31:47.000000000 -0400
19205 +++ linux-2.6.32.46/arch/x86/kvm/vmx.c 2011-05-04 17:56:20.000000000 -0400
19206 @@ -570,7 +570,11 @@ static void reload_tss(void)
19207
19208 kvm_get_gdt(&gdt);
19209 descs = (void *)gdt.base;
19210 +
19211 + pax_open_kernel();
19212 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
19213 + pax_close_kernel();
19214 +
19215 load_TR_desc();
19216 }
19217
19218 @@ -1409,8 +1413,11 @@ static __init int hardware_setup(void)
19219 if (!cpu_has_vmx_flexpriority())
19220 flexpriority_enabled = 0;
19221
19222 - if (!cpu_has_vmx_tpr_shadow())
19223 - kvm_x86_ops->update_cr8_intercept = NULL;
19224 + if (!cpu_has_vmx_tpr_shadow()) {
19225 + pax_open_kernel();
19226 + *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
19227 + pax_close_kernel();
19228 + }
19229
19230 if (enable_ept && !cpu_has_vmx_ept_2m_page())
19231 kvm_disable_largepages();
19232 @@ -2361,7 +2368,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
19233 vmcs_writel(HOST_IDTR_BASE, dt.base); /* 22.2.4 */
19234
19235 asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
19236 - vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
19237 + vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
19238 vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
19239 vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
19240 vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
19241 @@ -3717,6 +3724,12 @@ static void vmx_vcpu_run(struct kvm_vcpu
19242 "jmp .Lkvm_vmx_return \n\t"
19243 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
19244 ".Lkvm_vmx_return: "
19245 +
19246 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
19247 + "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
19248 + ".Lkvm_vmx_return2: "
19249 +#endif
19250 +
19251 /* Save guest registers, load host registers, keep flags */
19252 "xchg %0, (%%"R"sp) \n\t"
19253 "mov %%"R"ax, %c[rax](%0) \n\t"
19254 @@ -3763,8 +3776,13 @@ static void vmx_vcpu_run(struct kvm_vcpu
19255 [r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
19256 #endif
19257 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2))
19258 +
19259 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
19260 + ,[cs]"i"(__KERNEL_CS)
19261 +#endif
19262 +
19263 : "cc", "memory"
19264 - , R"bx", R"di", R"si"
19265 + , R"ax", R"bx", R"di", R"si"
19266 #ifdef CONFIG_X86_64
19267 , "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
19268 #endif
19269 @@ -3781,7 +3799,16 @@ static void vmx_vcpu_run(struct kvm_vcpu
19270 if (vmx->rmode.irq.pending)
19271 fixup_rmode_irq(vmx);
19272
19273 - asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
19274 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
19275 +
19276 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
19277 + loadsegment(fs, __KERNEL_PERCPU);
19278 +#endif
19279 +
19280 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19281 + __set_fs(current_thread_info()->addr_limit);
19282 +#endif
19283 +
19284 vmx->launched = 1;
19285
19286 vmx_complete_interrupts(vmx);
19287 @@ -3956,7 +3983,7 @@ static bool vmx_gb_page_enable(void)
19288 return false;
19289 }
19290
19291 -static struct kvm_x86_ops vmx_x86_ops = {
19292 +static const struct kvm_x86_ops vmx_x86_ops = {
19293 .cpu_has_kvm_support = cpu_has_kvm_support,
19294 .disabled_by_bios = vmx_disabled_by_bios,
19295 .hardware_setup = hardware_setup,
19296 diff -urNp linux-2.6.32.46/arch/x86/kvm/x86.c linux-2.6.32.46/arch/x86/kvm/x86.c
19297 --- linux-2.6.32.46/arch/x86/kvm/x86.c 2011-05-10 22:12:01.000000000 -0400
19298 +++ linux-2.6.32.46/arch/x86/kvm/x86.c 2011-05-10 22:12:26.000000000 -0400
19299 @@ -82,7 +82,7 @@ static void update_cr8_intercept(struct
19300 static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
19301 struct kvm_cpuid_entry2 __user *entries);
19302
19303 -struct kvm_x86_ops *kvm_x86_ops;
19304 +const struct kvm_x86_ops *kvm_x86_ops;
19305 EXPORT_SYMBOL_GPL(kvm_x86_ops);
19306
19307 int ignore_msrs = 0;
19308 @@ -1430,15 +1430,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(str
19309 struct kvm_cpuid2 *cpuid,
19310 struct kvm_cpuid_entry2 __user *entries)
19311 {
19312 - int r;
19313 + int r, i;
19314
19315 r = -E2BIG;
19316 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
19317 goto out;
19318 r = -EFAULT;
19319 - if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
19320 - cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
19321 + if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
19322 goto out;
19323 + for (i = 0; i < cpuid->nent; ++i) {
19324 + struct kvm_cpuid_entry2 cpuid_entry;
19325 + if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
19326 + goto out;
19327 + vcpu->arch.cpuid_entries[i] = cpuid_entry;
19328 + }
19329 vcpu->arch.cpuid_nent = cpuid->nent;
19330 kvm_apic_set_version(vcpu);
19331 return 0;
19332 @@ -1451,16 +1456,20 @@ static int kvm_vcpu_ioctl_get_cpuid2(str
19333 struct kvm_cpuid2 *cpuid,
19334 struct kvm_cpuid_entry2 __user *entries)
19335 {
19336 - int r;
19337 + int r, i;
19338
19339 vcpu_load(vcpu);
19340 r = -E2BIG;
19341 if (cpuid->nent < vcpu->arch.cpuid_nent)
19342 goto out;
19343 r = -EFAULT;
19344 - if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
19345 - vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
19346 + if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
19347 goto out;
19348 + for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
19349 + struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
19350 + if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
19351 + goto out;
19352 + }
19353 return 0;
19354
19355 out:
19356 @@ -1678,7 +1687,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
19357 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
19358 struct kvm_interrupt *irq)
19359 {
19360 - if (irq->irq < 0 || irq->irq >= 256)
19361 + if (irq->irq >= 256)
19362 return -EINVAL;
19363 if (irqchip_in_kernel(vcpu->kvm))
19364 return -ENXIO;
19365 @@ -3260,10 +3269,10 @@ static struct notifier_block kvmclock_cp
19366 .notifier_call = kvmclock_cpufreq_notifier
19367 };
19368
19369 -int kvm_arch_init(void *opaque)
19370 +int kvm_arch_init(const void *opaque)
19371 {
19372 int r, cpu;
19373 - struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
19374 + const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
19375
19376 if (kvm_x86_ops) {
19377 printk(KERN_ERR "kvm: already loaded the other module\n");
19378 diff -urNp linux-2.6.32.46/arch/x86/lguest/boot.c linux-2.6.32.46/arch/x86/lguest/boot.c
19379 --- linux-2.6.32.46/arch/x86/lguest/boot.c 2011-03-27 14:31:47.000000000 -0400
19380 +++ linux-2.6.32.46/arch/x86/lguest/boot.c 2011-08-05 20:33:55.000000000 -0400
19381 @@ -1172,9 +1172,10 @@ static __init int early_put_chars(u32 vt
19382 * Rebooting also tells the Host we're finished, but the RESTART flag tells the
19383 * Launcher to reboot us.
19384 */
19385 -static void lguest_restart(char *reason)
19386 +static __noreturn void lguest_restart(char *reason)
19387 {
19388 kvm_hypercall2(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART);
19389 + BUG();
19390 }
19391
19392 /*G:050
19393 diff -urNp linux-2.6.32.46/arch/x86/lib/atomic64_32.c linux-2.6.32.46/arch/x86/lib/atomic64_32.c
19394 --- linux-2.6.32.46/arch/x86/lib/atomic64_32.c 2011-03-27 14:31:47.000000000 -0400
19395 +++ linux-2.6.32.46/arch/x86/lib/atomic64_32.c 2011-05-04 17:56:28.000000000 -0400
19396 @@ -25,6 +25,12 @@ u64 atomic64_cmpxchg(atomic64_t *ptr, u6
19397 }
19398 EXPORT_SYMBOL(atomic64_cmpxchg);
19399
19400 +u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old_val, u64 new_val)
19401 +{
19402 + return cmpxchg8b(&ptr->counter, old_val, new_val);
19403 +}
19404 +EXPORT_SYMBOL(atomic64_cmpxchg_unchecked);
19405 +
19406 /**
19407 * atomic64_xchg - xchg atomic64 variable
19408 * @ptr: pointer to type atomic64_t
19409 @@ -56,6 +62,36 @@ u64 atomic64_xchg(atomic64_t *ptr, u64 n
19410 EXPORT_SYMBOL(atomic64_xchg);
19411
19412 /**
19413 + * atomic64_xchg_unchecked - xchg atomic64 variable
19414 + * @ptr: pointer to type atomic64_unchecked_t
19415 + * @new_val: value to assign
19416 + *
19417 + * Atomically xchgs the value of @ptr to @new_val and returns
19418 + * the old value.
19419 + */
19420 +u64 atomic64_xchg_unchecked(atomic64_unchecked_t *ptr, u64 new_val)
19421 +{
19422 + /*
19423 + * Try first with a (possibly incorrect) assumption about
19424 + * what we have there. We'll do two loops most likely,
19425 + * but we'll get an ownership MESI transaction straight away
19426 + * instead of a read transaction followed by a
19427 + * flush-for-ownership transaction:
19428 + */
19429 + u64 old_val, real_val = 0;
19430 +
19431 + do {
19432 + old_val = real_val;
19433 +
19434 + real_val = atomic64_cmpxchg_unchecked(ptr, old_val, new_val);
19435 +
19436 + } while (real_val != old_val);
19437 +
19438 + return old_val;
19439 +}
19440 +EXPORT_SYMBOL(atomic64_xchg_unchecked);
19441 +
19442 +/**
19443 * atomic64_set - set atomic64 variable
19444 * @ptr: pointer to type atomic64_t
19445 * @new_val: value to assign
19446 @@ -69,7 +105,19 @@ void atomic64_set(atomic64_t *ptr, u64 n
19447 EXPORT_SYMBOL(atomic64_set);
19448
19449 /**
19450 -EXPORT_SYMBOL(atomic64_read);
19451 + * atomic64_unchecked_set - set atomic64 variable
19452 + * @ptr: pointer to type atomic64_unchecked_t
19453 + * @new_val: value to assign
19454 + *
19455 + * Atomically sets the value of @ptr to @new_val.
19456 + */
19457 +void atomic64_set_unchecked(atomic64_unchecked_t *ptr, u64 new_val)
19458 +{
19459 + atomic64_xchg_unchecked(ptr, new_val);
19460 +}
19461 +EXPORT_SYMBOL(atomic64_set_unchecked);
19462 +
19463 +/**
19464 * atomic64_add_return - add and return
19465 * @delta: integer value to add
19466 * @ptr: pointer to type atomic64_t
19467 @@ -99,24 +147,72 @@ noinline u64 atomic64_add_return(u64 del
19468 }
19469 EXPORT_SYMBOL(atomic64_add_return);
19470
19471 +/**
19472 + * atomic64_add_return_unchecked - add and return
19473 + * @delta: integer value to add
19474 + * @ptr: pointer to type atomic64_unchecked_t
19475 + *
19476 + * Atomically adds @delta to @ptr and returns @delta + *@ptr
19477 + */
19478 +noinline u64 atomic64_add_return_unchecked(u64 delta, atomic64_unchecked_t *ptr)
19479 +{
19480 + /*
19481 + * Try first with a (possibly incorrect) assumption about
19482 + * what we have there. We'll do two loops most likely,
19483 + * but we'll get an ownership MESI transaction straight away
19484 + * instead of a read transaction followed by a
19485 + * flush-for-ownership transaction:
19486 + */
19487 + u64 old_val, new_val, real_val = 0;
19488 +
19489 + do {
19490 + old_val = real_val;
19491 + new_val = old_val + delta;
19492 +
19493 + real_val = atomic64_cmpxchg_unchecked(ptr, old_val, new_val);
19494 +
19495 + } while (real_val != old_val);
19496 +
19497 + return new_val;
19498 +}
19499 +EXPORT_SYMBOL(atomic64_add_return_unchecked);
19500 +
19501 u64 atomic64_sub_return(u64 delta, atomic64_t *ptr)
19502 {
19503 return atomic64_add_return(-delta, ptr);
19504 }
19505 EXPORT_SYMBOL(atomic64_sub_return);
19506
19507 +u64 atomic64_sub_return_unchecked(u64 delta, atomic64_unchecked_t *ptr)
19508 +{
19509 + return atomic64_add_return_unchecked(-delta, ptr);
19510 +}
19511 +EXPORT_SYMBOL(atomic64_sub_return_unchecked);
19512 +
19513 u64 atomic64_inc_return(atomic64_t *ptr)
19514 {
19515 return atomic64_add_return(1, ptr);
19516 }
19517 EXPORT_SYMBOL(atomic64_inc_return);
19518
19519 +u64 atomic64_inc_return_unchecked(atomic64_unchecked_t *ptr)
19520 +{
19521 + return atomic64_add_return_unchecked(1, ptr);
19522 +}
19523 +EXPORT_SYMBOL(atomic64_inc_return_unchecked);
19524 +
19525 u64 atomic64_dec_return(atomic64_t *ptr)
19526 {
19527 return atomic64_sub_return(1, ptr);
19528 }
19529 EXPORT_SYMBOL(atomic64_dec_return);
19530
19531 +u64 atomic64_dec_return_unchecked(atomic64_unchecked_t *ptr)
19532 +{
19533 + return atomic64_sub_return_unchecked(1, ptr);
19534 +}
19535 +EXPORT_SYMBOL(atomic64_dec_return_unchecked);
19536 +
19537 /**
19538 * atomic64_add - add integer to atomic64 variable
19539 * @delta: integer value to add
19540 @@ -131,6 +227,19 @@ void atomic64_add(u64 delta, atomic64_t
19541 EXPORT_SYMBOL(atomic64_add);
19542
19543 /**
19544 + * atomic64_add_unchecked - add integer to atomic64 variable
19545 + * @delta: integer value to add
19546 + * @ptr: pointer to type atomic64_unchecked_t
19547 + *
19548 + * Atomically adds @delta to @ptr.
19549 + */
19550 +void atomic64_add_unchecked(u64 delta, atomic64_unchecked_t *ptr)
19551 +{
19552 + atomic64_add_return_unchecked(delta, ptr);
19553 +}
19554 +EXPORT_SYMBOL(atomic64_add_unchecked);
19555 +
19556 +/**
19557 * atomic64_sub - subtract the atomic64 variable
19558 * @delta: integer value to subtract
19559 * @ptr: pointer to type atomic64_t
19560 @@ -144,6 +253,19 @@ void atomic64_sub(u64 delta, atomic64_t
19561 EXPORT_SYMBOL(atomic64_sub);
19562
19563 /**
19564 + * atomic64_sub_unchecked - subtract the atomic64 variable
19565 + * @delta: integer value to subtract
19566 + * @ptr: pointer to type atomic64_unchecked_t
19567 + *
19568 + * Atomically subtracts @delta from @ptr.
19569 + */
19570 +void atomic64_sub_unchecked(u64 delta, atomic64_unchecked_t *ptr)
19571 +{
19572 + atomic64_add_unchecked(-delta, ptr);
19573 +}
19574 +EXPORT_SYMBOL(atomic64_sub_unchecked);
19575 +
19576 +/**
19577 * atomic64_sub_and_test - subtract value from variable and test result
19578 * @delta: integer value to subtract
19579 * @ptr: pointer to type atomic64_t
19580 @@ -173,6 +295,18 @@ void atomic64_inc(atomic64_t *ptr)
19581 EXPORT_SYMBOL(atomic64_inc);
19582
19583 /**
19584 + * atomic64_inc_unchecked - increment atomic64 variable
19585 + * @ptr: pointer to type atomic64_unchecked_t
19586 + *
19587 + * Atomically increments @ptr by 1.
19588 + */
19589 +void atomic64_inc_unchecked(atomic64_unchecked_t *ptr)
19590 +{
19591 + atomic64_add_unchecked(1, ptr);
19592 +}
19593 +EXPORT_SYMBOL(atomic64_inc_unchecked);
19594 +
19595 +/**
19596 * atomic64_dec - decrement atomic64 variable
19597 * @ptr: pointer to type atomic64_t
19598 *
19599 @@ -185,6 +319,18 @@ void atomic64_dec(atomic64_t *ptr)
19600 EXPORT_SYMBOL(atomic64_dec);
19601
19602 /**
19603 + * atomic64_dec_unchecked - decrement atomic64 variable
19604 + * @ptr: pointer to type atomic64_unchecked_t
19605 + *
19606 + * Atomically decrements @ptr by 1.
19607 + */
19608 +void atomic64_dec_unchecked(atomic64_unchecked_t *ptr)
19609 +{
19610 + atomic64_sub_unchecked(1, ptr);
19611 +}
19612 +EXPORT_SYMBOL(atomic64_dec_unchecked);
19613 +
19614 +/**
19615 * atomic64_dec_and_test - decrement and test
19616 * @ptr: pointer to type atomic64_t
19617 *
19618 diff -urNp linux-2.6.32.46/arch/x86/lib/checksum_32.S linux-2.6.32.46/arch/x86/lib/checksum_32.S
19619 --- linux-2.6.32.46/arch/x86/lib/checksum_32.S 2011-03-27 14:31:47.000000000 -0400
19620 +++ linux-2.6.32.46/arch/x86/lib/checksum_32.S 2011-04-17 15:56:46.000000000 -0400
19621 @@ -28,7 +28,8 @@
19622 #include <linux/linkage.h>
19623 #include <asm/dwarf2.h>
19624 #include <asm/errno.h>
19625 -
19626 +#include <asm/segment.h>
19627 +
19628 /*
19629 * computes a partial checksum, e.g. for TCP/UDP fragments
19630 */
19631 @@ -304,9 +305,28 @@ unsigned int csum_partial_copy_generic (
19632
19633 #define ARGBASE 16
19634 #define FP 12
19635 -
19636 -ENTRY(csum_partial_copy_generic)
19637 +
19638 +ENTRY(csum_partial_copy_generic_to_user)
19639 CFI_STARTPROC
19640 +
19641 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19642 + pushl %gs
19643 + CFI_ADJUST_CFA_OFFSET 4
19644 + popl %es
19645 + CFI_ADJUST_CFA_OFFSET -4
19646 + jmp csum_partial_copy_generic
19647 +#endif
19648 +
19649 +ENTRY(csum_partial_copy_generic_from_user)
19650 +
19651 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19652 + pushl %gs
19653 + CFI_ADJUST_CFA_OFFSET 4
19654 + popl %ds
19655 + CFI_ADJUST_CFA_OFFSET -4
19656 +#endif
19657 +
19658 +ENTRY(csum_partial_copy_generic)
19659 subl $4,%esp
19660 CFI_ADJUST_CFA_OFFSET 4
19661 pushl %edi
19662 @@ -331,7 +351,7 @@ ENTRY(csum_partial_copy_generic)
19663 jmp 4f
19664 SRC(1: movw (%esi), %bx )
19665 addl $2, %esi
19666 -DST( movw %bx, (%edi) )
19667 +DST( movw %bx, %es:(%edi) )
19668 addl $2, %edi
19669 addw %bx, %ax
19670 adcl $0, %eax
19671 @@ -343,30 +363,30 @@ DST( movw %bx, (%edi) )
19672 SRC(1: movl (%esi), %ebx )
19673 SRC( movl 4(%esi), %edx )
19674 adcl %ebx, %eax
19675 -DST( movl %ebx, (%edi) )
19676 +DST( movl %ebx, %es:(%edi) )
19677 adcl %edx, %eax
19678 -DST( movl %edx, 4(%edi) )
19679 +DST( movl %edx, %es:4(%edi) )
19680
19681 SRC( movl 8(%esi), %ebx )
19682 SRC( movl 12(%esi), %edx )
19683 adcl %ebx, %eax
19684 -DST( movl %ebx, 8(%edi) )
19685 +DST( movl %ebx, %es:8(%edi) )
19686 adcl %edx, %eax
19687 -DST( movl %edx, 12(%edi) )
19688 +DST( movl %edx, %es:12(%edi) )
19689
19690 SRC( movl 16(%esi), %ebx )
19691 SRC( movl 20(%esi), %edx )
19692 adcl %ebx, %eax
19693 -DST( movl %ebx, 16(%edi) )
19694 +DST( movl %ebx, %es:16(%edi) )
19695 adcl %edx, %eax
19696 -DST( movl %edx, 20(%edi) )
19697 +DST( movl %edx, %es:20(%edi) )
19698
19699 SRC( movl 24(%esi), %ebx )
19700 SRC( movl 28(%esi), %edx )
19701 adcl %ebx, %eax
19702 -DST( movl %ebx, 24(%edi) )
19703 +DST( movl %ebx, %es:24(%edi) )
19704 adcl %edx, %eax
19705 -DST( movl %edx, 28(%edi) )
19706 +DST( movl %edx, %es:28(%edi) )
19707
19708 lea 32(%esi), %esi
19709 lea 32(%edi), %edi
19710 @@ -380,7 +400,7 @@ DST( movl %edx, 28(%edi) )
19711 shrl $2, %edx # This clears CF
19712 SRC(3: movl (%esi), %ebx )
19713 adcl %ebx, %eax
19714 -DST( movl %ebx, (%edi) )
19715 +DST( movl %ebx, %es:(%edi) )
19716 lea 4(%esi), %esi
19717 lea 4(%edi), %edi
19718 dec %edx
19719 @@ -392,12 +412,12 @@ DST( movl %ebx, (%edi) )
19720 jb 5f
19721 SRC( movw (%esi), %cx )
19722 leal 2(%esi), %esi
19723 -DST( movw %cx, (%edi) )
19724 +DST( movw %cx, %es:(%edi) )
19725 leal 2(%edi), %edi
19726 je 6f
19727 shll $16,%ecx
19728 SRC(5: movb (%esi), %cl )
19729 -DST( movb %cl, (%edi) )
19730 +DST( movb %cl, %es:(%edi) )
19731 6: addl %ecx, %eax
19732 adcl $0, %eax
19733 7:
19734 @@ -408,7 +428,7 @@ DST( movb %cl, (%edi) )
19735
19736 6001:
19737 movl ARGBASE+20(%esp), %ebx # src_err_ptr
19738 - movl $-EFAULT, (%ebx)
19739 + movl $-EFAULT, %ss:(%ebx)
19740
19741 # zero the complete destination - computing the rest
19742 # is too much work
19743 @@ -421,11 +441,19 @@ DST( movb %cl, (%edi) )
19744
19745 6002:
19746 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19747 - movl $-EFAULT,(%ebx)
19748 + movl $-EFAULT,%ss:(%ebx)
19749 jmp 5000b
19750
19751 .previous
19752
19753 + pushl %ss
19754 + CFI_ADJUST_CFA_OFFSET 4
19755 + popl %ds
19756 + CFI_ADJUST_CFA_OFFSET -4
19757 + pushl %ss
19758 + CFI_ADJUST_CFA_OFFSET 4
19759 + popl %es
19760 + CFI_ADJUST_CFA_OFFSET -4
19761 popl %ebx
19762 CFI_ADJUST_CFA_OFFSET -4
19763 CFI_RESTORE ebx
19764 @@ -439,26 +467,47 @@ DST( movb %cl, (%edi) )
19765 CFI_ADJUST_CFA_OFFSET -4
19766 ret
19767 CFI_ENDPROC
19768 -ENDPROC(csum_partial_copy_generic)
19769 +ENDPROC(csum_partial_copy_generic_to_user)
19770
19771 #else
19772
19773 /* Version for PentiumII/PPro */
19774
19775 #define ROUND1(x) \
19776 + nop; nop; nop; \
19777 SRC(movl x(%esi), %ebx ) ; \
19778 addl %ebx, %eax ; \
19779 - DST(movl %ebx, x(%edi) ) ;
19780 + DST(movl %ebx, %es:x(%edi)) ;
19781
19782 #define ROUND(x) \
19783 + nop; nop; nop; \
19784 SRC(movl x(%esi), %ebx ) ; \
19785 adcl %ebx, %eax ; \
19786 - DST(movl %ebx, x(%edi) ) ;
19787 + DST(movl %ebx, %es:x(%edi)) ;
19788
19789 #define ARGBASE 12
19790 -
19791 -ENTRY(csum_partial_copy_generic)
19792 +
19793 +ENTRY(csum_partial_copy_generic_to_user)
19794 CFI_STARTPROC
19795 +
19796 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19797 + pushl %gs
19798 + CFI_ADJUST_CFA_OFFSET 4
19799 + popl %es
19800 + CFI_ADJUST_CFA_OFFSET -4
19801 + jmp csum_partial_copy_generic
19802 +#endif
19803 +
19804 +ENTRY(csum_partial_copy_generic_from_user)
19805 +
19806 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19807 + pushl %gs
19808 + CFI_ADJUST_CFA_OFFSET 4
19809 + popl %ds
19810 + CFI_ADJUST_CFA_OFFSET -4
19811 +#endif
19812 +
19813 +ENTRY(csum_partial_copy_generic)
19814 pushl %ebx
19815 CFI_ADJUST_CFA_OFFSET 4
19816 CFI_REL_OFFSET ebx, 0
19817 @@ -482,7 +531,7 @@ ENTRY(csum_partial_copy_generic)
19818 subl %ebx, %edi
19819 lea -1(%esi),%edx
19820 andl $-32,%edx
19821 - lea 3f(%ebx,%ebx), %ebx
19822 + lea 3f(%ebx,%ebx,2), %ebx
19823 testl %esi, %esi
19824 jmp *%ebx
19825 1: addl $64,%esi
19826 @@ -503,19 +552,19 @@ ENTRY(csum_partial_copy_generic)
19827 jb 5f
19828 SRC( movw (%esi), %dx )
19829 leal 2(%esi), %esi
19830 -DST( movw %dx, (%edi) )
19831 +DST( movw %dx, %es:(%edi) )
19832 leal 2(%edi), %edi
19833 je 6f
19834 shll $16,%edx
19835 5:
19836 SRC( movb (%esi), %dl )
19837 -DST( movb %dl, (%edi) )
19838 +DST( movb %dl, %es:(%edi) )
19839 6: addl %edx, %eax
19840 adcl $0, %eax
19841 7:
19842 .section .fixup, "ax"
19843 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
19844 - movl $-EFAULT, (%ebx)
19845 + movl $-EFAULT, %ss:(%ebx)
19846 # zero the complete destination (computing the rest is too much work)
19847 movl ARGBASE+8(%esp),%edi # dst
19848 movl ARGBASE+12(%esp),%ecx # len
19849 @@ -523,10 +572,21 @@ DST( movb %dl, (%edi) )
19850 rep; stosb
19851 jmp 7b
19852 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19853 - movl $-EFAULT, (%ebx)
19854 + movl $-EFAULT, %ss:(%ebx)
19855 jmp 7b
19856 .previous
19857
19858 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19859 + pushl %ss
19860 + CFI_ADJUST_CFA_OFFSET 4
19861 + popl %ds
19862 + CFI_ADJUST_CFA_OFFSET -4
19863 + pushl %ss
19864 + CFI_ADJUST_CFA_OFFSET 4
19865 + popl %es
19866 + CFI_ADJUST_CFA_OFFSET -4
19867 +#endif
19868 +
19869 popl %esi
19870 CFI_ADJUST_CFA_OFFSET -4
19871 CFI_RESTORE esi
19872 @@ -538,7 +598,7 @@ DST( movb %dl, (%edi) )
19873 CFI_RESTORE ebx
19874 ret
19875 CFI_ENDPROC
19876 -ENDPROC(csum_partial_copy_generic)
19877 +ENDPROC(csum_partial_copy_generic_to_user)
19878
19879 #undef ROUND
19880 #undef ROUND1
19881 diff -urNp linux-2.6.32.46/arch/x86/lib/clear_page_64.S linux-2.6.32.46/arch/x86/lib/clear_page_64.S
19882 --- linux-2.6.32.46/arch/x86/lib/clear_page_64.S 2011-03-27 14:31:47.000000000 -0400
19883 +++ linux-2.6.32.46/arch/x86/lib/clear_page_64.S 2011-10-06 09:37:08.000000000 -0400
19884 @@ -1,5 +1,6 @@
19885 #include <linux/linkage.h>
19886 #include <asm/dwarf2.h>
19887 +#include <asm/alternative-asm.h>
19888
19889 /*
19890 * Zero a page.
19891 @@ -10,6 +11,7 @@ ENTRY(clear_page_c)
19892 movl $4096/8,%ecx
19893 xorl %eax,%eax
19894 rep stosq
19895 + pax_force_retaddr
19896 ret
19897 CFI_ENDPROC
19898 ENDPROC(clear_page_c)
19899 @@ -33,6 +35,7 @@ ENTRY(clear_page)
19900 leaq 64(%rdi),%rdi
19901 jnz .Lloop
19902 nop
19903 + pax_force_retaddr
19904 ret
19905 CFI_ENDPROC
19906 .Lclear_page_end:
19907 @@ -43,7 +46,7 @@ ENDPROC(clear_page)
19908
19909 #include <asm/cpufeature.h>
19910
19911 - .section .altinstr_replacement,"ax"
19912 + .section .altinstr_replacement,"a"
19913 1: .byte 0xeb /* jmp <disp8> */
19914 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
19915 2:
19916 diff -urNp linux-2.6.32.46/arch/x86/lib/copy_page_64.S linux-2.6.32.46/arch/x86/lib/copy_page_64.S
19917 --- linux-2.6.32.46/arch/x86/lib/copy_page_64.S 2011-03-27 14:31:47.000000000 -0400
19918 +++ linux-2.6.32.46/arch/x86/lib/copy_page_64.S 2011-10-06 09:37:08.000000000 -0400
19919 @@ -2,12 +2,14 @@
19920
19921 #include <linux/linkage.h>
19922 #include <asm/dwarf2.h>
19923 +#include <asm/alternative-asm.h>
19924
19925 ALIGN
19926 copy_page_c:
19927 CFI_STARTPROC
19928 movl $4096/8,%ecx
19929 rep movsq
19930 + pax_force_retaddr
19931 ret
19932 CFI_ENDPROC
19933 ENDPROC(copy_page_c)
19934 @@ -94,6 +96,7 @@ ENTRY(copy_page)
19935 CFI_RESTORE r13
19936 addq $3*8,%rsp
19937 CFI_ADJUST_CFA_OFFSET -3*8
19938 + pax_force_retaddr
19939 ret
19940 .Lcopy_page_end:
19941 CFI_ENDPROC
19942 @@ -104,7 +107,7 @@ ENDPROC(copy_page)
19943
19944 #include <asm/cpufeature.h>
19945
19946 - .section .altinstr_replacement,"ax"
19947 + .section .altinstr_replacement,"a"
19948 1: .byte 0xeb /* jmp <disp8> */
19949 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
19950 2:
19951 diff -urNp linux-2.6.32.46/arch/x86/lib/copy_user_64.S linux-2.6.32.46/arch/x86/lib/copy_user_64.S
19952 --- linux-2.6.32.46/arch/x86/lib/copy_user_64.S 2011-06-25 12:55:34.000000000 -0400
19953 +++ linux-2.6.32.46/arch/x86/lib/copy_user_64.S 2011-10-06 10:12:52.000000000 -0400
19954 @@ -15,13 +15,15 @@
19955 #include <asm/asm-offsets.h>
19956 #include <asm/thread_info.h>
19957 #include <asm/cpufeature.h>
19958 +#include <asm/pgtable.h>
19959 +#include <asm/alternative-asm.h>
19960
19961 .macro ALTERNATIVE_JUMP feature,orig,alt
19962 0:
19963 .byte 0xe9 /* 32bit jump */
19964 .long \orig-1f /* by default jump to orig */
19965 1:
19966 - .section .altinstr_replacement,"ax"
19967 + .section .altinstr_replacement,"a"
19968 2: .byte 0xe9 /* near jump with 32bit immediate */
19969 .long \alt-1b /* offset */ /* or alternatively to alt */
19970 .previous
19971 @@ -64,55 +66,26 @@
19972 #endif
19973 .endm
19974
19975 -/* Standard copy_to_user with segment limit checking */
19976 -ENTRY(copy_to_user)
19977 - CFI_STARTPROC
19978 - GET_THREAD_INFO(%rax)
19979 - movq %rdi,%rcx
19980 - addq %rdx,%rcx
19981 - jc bad_to_user
19982 - cmpq TI_addr_limit(%rax),%rcx
19983 - ja bad_to_user
19984 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19985 - CFI_ENDPROC
19986 -ENDPROC(copy_to_user)
19987 -
19988 -/* Standard copy_from_user with segment limit checking */
19989 -ENTRY(copy_from_user)
19990 - CFI_STARTPROC
19991 - GET_THREAD_INFO(%rax)
19992 - movq %rsi,%rcx
19993 - addq %rdx,%rcx
19994 - jc bad_from_user
19995 - cmpq TI_addr_limit(%rax),%rcx
19996 - ja bad_from_user
19997 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19998 - CFI_ENDPROC
19999 -ENDPROC(copy_from_user)
20000 -
20001 ENTRY(copy_user_generic)
20002 CFI_STARTPROC
20003 ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
20004 CFI_ENDPROC
20005 ENDPROC(copy_user_generic)
20006
20007 -ENTRY(__copy_from_user_inatomic)
20008 - CFI_STARTPROC
20009 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
20010 - CFI_ENDPROC
20011 -ENDPROC(__copy_from_user_inatomic)
20012 -
20013 .section .fixup,"ax"
20014 /* must zero dest */
20015 ENTRY(bad_from_user)
20016 bad_from_user:
20017 CFI_STARTPROC
20018 + testl %edx,%edx
20019 + js bad_to_user
20020 movl %edx,%ecx
20021 xorl %eax,%eax
20022 rep
20023 stosb
20024 bad_to_user:
20025 movl %edx,%eax
20026 + pax_force_retaddr
20027 ret
20028 CFI_ENDPROC
20029 ENDPROC(bad_from_user)
20030 @@ -180,6 +153,7 @@ ENTRY(copy_user_generic_unrolled)
20031 decl %ecx
20032 jnz 21b
20033 23: xor %eax,%eax
20034 + pax_force_retaddr
20035 ret
20036
20037 .section .fixup,"ax"
20038 @@ -252,6 +226,7 @@ ENTRY(copy_user_generic_string)
20039 3: rep
20040 movsb
20041 4: xorl %eax,%eax
20042 + pax_force_retaddr
20043 ret
20044
20045 .section .fixup,"ax"
20046 diff -urNp linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S
20047 --- linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S 2011-03-27 14:31:47.000000000 -0400
20048 +++ linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S 2011-10-06 09:37:08.000000000 -0400
20049 @@ -8,12 +8,14 @@
20050
20051 #include <linux/linkage.h>
20052 #include <asm/dwarf2.h>
20053 +#include <asm/alternative-asm.h>
20054
20055 #define FIX_ALIGNMENT 1
20056
20057 #include <asm/current.h>
20058 #include <asm/asm-offsets.h>
20059 #include <asm/thread_info.h>
20060 +#include <asm/pgtable.h>
20061
20062 .macro ALIGN_DESTINATION
20063 #ifdef FIX_ALIGNMENT
20064 @@ -50,6 +52,15 @@
20065 */
20066 ENTRY(__copy_user_nocache)
20067 CFI_STARTPROC
20068 +
20069 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20070 + mov $PAX_USER_SHADOW_BASE,%rcx
20071 + cmp %rcx,%rsi
20072 + jae 1f
20073 + add %rcx,%rsi
20074 +1:
20075 +#endif
20076 +
20077 cmpl $8,%edx
20078 jb 20f /* less then 8 bytes, go to byte copy loop */
20079 ALIGN_DESTINATION
20080 @@ -98,6 +109,7 @@ ENTRY(__copy_user_nocache)
20081 jnz 21b
20082 23: xorl %eax,%eax
20083 sfence
20084 + pax_force_retaddr
20085 ret
20086
20087 .section .fixup,"ax"
20088 diff -urNp linux-2.6.32.46/arch/x86/lib/csum-copy_64.S linux-2.6.32.46/arch/x86/lib/csum-copy_64.S
20089 --- linux-2.6.32.46/arch/x86/lib/csum-copy_64.S 2011-03-27 14:31:47.000000000 -0400
20090 +++ linux-2.6.32.46/arch/x86/lib/csum-copy_64.S 2011-10-06 09:37:14.000000000 -0400
20091 @@ -8,6 +8,7 @@
20092 #include <linux/linkage.h>
20093 #include <asm/dwarf2.h>
20094 #include <asm/errno.h>
20095 +#include <asm/alternative-asm.h>
20096
20097 /*
20098 * Checksum copy with exception handling.
20099 @@ -228,6 +229,7 @@ ENTRY(csum_partial_copy_generic)
20100 CFI_RESTORE rbp
20101 addq $7*8,%rsp
20102 CFI_ADJUST_CFA_OFFSET -7*8
20103 + pax_force_retaddr
20104 ret
20105 CFI_RESTORE_STATE
20106
20107 diff -urNp linux-2.6.32.46/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.46/arch/x86/lib/csum-wrappers_64.c
20108 --- linux-2.6.32.46/arch/x86/lib/csum-wrappers_64.c 2011-03-27 14:31:47.000000000 -0400
20109 +++ linux-2.6.32.46/arch/x86/lib/csum-wrappers_64.c 2011-10-06 09:37:08.000000000 -0400
20110 @@ -52,7 +52,13 @@ csum_partial_copy_from_user(const void _
20111 len -= 2;
20112 }
20113 }
20114 - isum = csum_partial_copy_generic((__force const void *)src,
20115 +
20116 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20117 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
20118 + src += PAX_USER_SHADOW_BASE;
20119 +#endif
20120 +
20121 + isum = csum_partial_copy_generic((const void __force_kernel *)src,
20122 dst, len, isum, errp, NULL);
20123 if (unlikely(*errp))
20124 goto out_err;
20125 @@ -105,7 +111,13 @@ csum_partial_copy_to_user(const void *sr
20126 }
20127
20128 *errp = 0;
20129 - return csum_partial_copy_generic(src, (void __force *)dst,
20130 +
20131 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20132 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
20133 + dst += PAX_USER_SHADOW_BASE;
20134 +#endif
20135 +
20136 + return csum_partial_copy_generic(src, (void __force_kernel *)dst,
20137 len, isum, NULL, errp);
20138 }
20139 EXPORT_SYMBOL(csum_partial_copy_to_user);
20140 diff -urNp linux-2.6.32.46/arch/x86/lib/getuser.S linux-2.6.32.46/arch/x86/lib/getuser.S
20141 --- linux-2.6.32.46/arch/x86/lib/getuser.S 2011-03-27 14:31:47.000000000 -0400
20142 +++ linux-2.6.32.46/arch/x86/lib/getuser.S 2011-10-08 08:14:37.000000000 -0400
20143 @@ -33,15 +33,38 @@
20144 #include <asm/asm-offsets.h>
20145 #include <asm/thread_info.h>
20146 #include <asm/asm.h>
20147 +#include <asm/segment.h>
20148 +#include <asm/pgtable.h>
20149 +#include <asm/alternative-asm.h>
20150 +
20151 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
20152 +#define __copyuser_seg gs;
20153 +#else
20154 +#define __copyuser_seg
20155 +#endif
20156
20157 .text
20158 ENTRY(__get_user_1)
20159 CFI_STARTPROC
20160 +
20161 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20162 GET_THREAD_INFO(%_ASM_DX)
20163 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
20164 jae bad_get_user
20165 -1: movzb (%_ASM_AX),%edx
20166 +
20167 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20168 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
20169 + cmp %_ASM_DX,%_ASM_AX
20170 + jae 1234f
20171 + add %_ASM_DX,%_ASM_AX
20172 +1234:
20173 +#endif
20174 +
20175 +#endif
20176 +
20177 +1: __copyuser_seg movzb (%_ASM_AX),%edx
20178 xor %eax,%eax
20179 + pax_force_retaddr
20180 ret
20181 CFI_ENDPROC
20182 ENDPROC(__get_user_1)
20183 @@ -49,12 +72,26 @@ ENDPROC(__get_user_1)
20184 ENTRY(__get_user_2)
20185 CFI_STARTPROC
20186 add $1,%_ASM_AX
20187 +
20188 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20189 jc bad_get_user
20190 GET_THREAD_INFO(%_ASM_DX)
20191 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
20192 jae bad_get_user
20193 -2: movzwl -1(%_ASM_AX),%edx
20194 +
20195 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20196 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
20197 + cmp %_ASM_DX,%_ASM_AX
20198 + jae 1234f
20199 + add %_ASM_DX,%_ASM_AX
20200 +1234:
20201 +#endif
20202 +
20203 +#endif
20204 +
20205 +2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
20206 xor %eax,%eax
20207 + pax_force_retaddr
20208 ret
20209 CFI_ENDPROC
20210 ENDPROC(__get_user_2)
20211 @@ -62,12 +99,26 @@ ENDPROC(__get_user_2)
20212 ENTRY(__get_user_4)
20213 CFI_STARTPROC
20214 add $3,%_ASM_AX
20215 +
20216 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20217 jc bad_get_user
20218 GET_THREAD_INFO(%_ASM_DX)
20219 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
20220 jae bad_get_user
20221 -3: mov -3(%_ASM_AX),%edx
20222 +
20223 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20224 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
20225 + cmp %_ASM_DX,%_ASM_AX
20226 + jae 1234f
20227 + add %_ASM_DX,%_ASM_AX
20228 +1234:
20229 +#endif
20230 +
20231 +#endif
20232 +
20233 +3: __copyuser_seg mov -3(%_ASM_AX),%edx
20234 xor %eax,%eax
20235 + pax_force_retaddr
20236 ret
20237 CFI_ENDPROC
20238 ENDPROC(__get_user_4)
20239 @@ -80,8 +131,18 @@ ENTRY(__get_user_8)
20240 GET_THREAD_INFO(%_ASM_DX)
20241 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
20242 jae bad_get_user
20243 +
20244 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20245 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
20246 + cmp %_ASM_DX,%_ASM_AX
20247 + jae 1234f
20248 + add %_ASM_DX,%_ASM_AX
20249 +1234:
20250 +#endif
20251 +
20252 4: movq -7(%_ASM_AX),%_ASM_DX
20253 xor %eax,%eax
20254 + pax_force_retaddr
20255 ret
20256 CFI_ENDPROC
20257 ENDPROC(__get_user_8)
20258 @@ -91,6 +152,7 @@ bad_get_user:
20259 CFI_STARTPROC
20260 xor %edx,%edx
20261 mov $(-EFAULT),%_ASM_AX
20262 + pax_force_retaddr
20263 ret
20264 CFI_ENDPROC
20265 END(bad_get_user)
20266 diff -urNp linux-2.6.32.46/arch/x86/lib/iomap_copy_64.S linux-2.6.32.46/arch/x86/lib/iomap_copy_64.S
20267 --- linux-2.6.32.46/arch/x86/lib/iomap_copy_64.S 2011-03-27 14:31:47.000000000 -0400
20268 +++ linux-2.6.32.46/arch/x86/lib/iomap_copy_64.S 2011-10-06 09:37:14.000000000 -0400
20269 @@ -17,6 +17,7 @@
20270
20271 #include <linux/linkage.h>
20272 #include <asm/dwarf2.h>
20273 +#include <asm/alternative-asm.h>
20274
20275 /*
20276 * override generic version in lib/iomap_copy.c
20277 @@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy)
20278 CFI_STARTPROC
20279 movl %edx,%ecx
20280 rep movsd
20281 + pax_force_retaddr
20282 ret
20283 CFI_ENDPROC
20284 ENDPROC(__iowrite32_copy)
20285 diff -urNp linux-2.6.32.46/arch/x86/lib/memcpy_64.S linux-2.6.32.46/arch/x86/lib/memcpy_64.S
20286 --- linux-2.6.32.46/arch/x86/lib/memcpy_64.S 2011-03-27 14:31:47.000000000 -0400
20287 +++ linux-2.6.32.46/arch/x86/lib/memcpy_64.S 2011-10-06 10:13:49.000000000 -0400
20288 @@ -4,6 +4,7 @@
20289
20290 #include <asm/cpufeature.h>
20291 #include <asm/dwarf2.h>
20292 +#include <asm/alternative-asm.h>
20293
20294 /*
20295 * memcpy - Copy a memory block.
20296 @@ -34,6 +35,7 @@ memcpy_c:
20297 rep movsq
20298 movl %edx, %ecx
20299 rep movsb
20300 + pax_force_retaddr
20301 ret
20302 CFI_ENDPROC
20303 ENDPROC(memcpy_c)
20304 @@ -118,6 +120,7 @@ ENTRY(memcpy)
20305 jnz .Lloop_1
20306
20307 .Lend:
20308 + pax_force_retaddr
20309 ret
20310 CFI_ENDPROC
20311 ENDPROC(memcpy)
20312 @@ -128,7 +131,7 @@ ENDPROC(__memcpy)
20313 * It is also a lot simpler. Use this when possible:
20314 */
20315
20316 - .section .altinstr_replacement, "ax"
20317 + .section .altinstr_replacement, "a"
20318 1: .byte 0xeb /* jmp <disp8> */
20319 .byte (memcpy_c - memcpy) - (2f - 1b) /* offset */
20320 2:
20321 diff -urNp linux-2.6.32.46/arch/x86/lib/memset_64.S linux-2.6.32.46/arch/x86/lib/memset_64.S
20322 --- linux-2.6.32.46/arch/x86/lib/memset_64.S 2011-03-27 14:31:47.000000000 -0400
20323 +++ linux-2.6.32.46/arch/x86/lib/memset_64.S 2011-10-06 09:37:08.000000000 -0400
20324 @@ -2,6 +2,7 @@
20325
20326 #include <linux/linkage.h>
20327 #include <asm/dwarf2.h>
20328 +#include <asm/alternative-asm.h>
20329
20330 /*
20331 * ISO C memset - set a memory block to a byte value.
20332 @@ -28,6 +29,7 @@ memset_c:
20333 movl %r8d,%ecx
20334 rep stosb
20335 movq %r9,%rax
20336 + pax_force_retaddr
20337 ret
20338 CFI_ENDPROC
20339 ENDPROC(memset_c)
20340 @@ -96,6 +98,7 @@ ENTRY(__memset)
20341
20342 .Lende:
20343 movq %r10,%rax
20344 + pax_force_retaddr
20345 ret
20346
20347 CFI_RESTORE_STATE
20348 @@ -118,7 +121,7 @@ ENDPROC(__memset)
20349
20350 #include <asm/cpufeature.h>
20351
20352 - .section .altinstr_replacement,"ax"
20353 + .section .altinstr_replacement,"a"
20354 1: .byte 0xeb /* jmp <disp8> */
20355 .byte (memset_c - memset) - (2f - 1b) /* offset */
20356 2:
20357 diff -urNp linux-2.6.32.46/arch/x86/lib/mmx_32.c linux-2.6.32.46/arch/x86/lib/mmx_32.c
20358 --- linux-2.6.32.46/arch/x86/lib/mmx_32.c 2011-03-27 14:31:47.000000000 -0400
20359 +++ linux-2.6.32.46/arch/x86/lib/mmx_32.c 2011-04-17 15:56:46.000000000 -0400
20360 @@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
20361 {
20362 void *p;
20363 int i;
20364 + unsigned long cr0;
20365
20366 if (unlikely(in_interrupt()))
20367 return __memcpy(to, from, len);
20368 @@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
20369 kernel_fpu_begin();
20370
20371 __asm__ __volatile__ (
20372 - "1: prefetch (%0)\n" /* This set is 28 bytes */
20373 - " prefetch 64(%0)\n"
20374 - " prefetch 128(%0)\n"
20375 - " prefetch 192(%0)\n"
20376 - " prefetch 256(%0)\n"
20377 + "1: prefetch (%1)\n" /* This set is 28 bytes */
20378 + " prefetch 64(%1)\n"
20379 + " prefetch 128(%1)\n"
20380 + " prefetch 192(%1)\n"
20381 + " prefetch 256(%1)\n"
20382 "2: \n"
20383 ".section .fixup, \"ax\"\n"
20384 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20385 + "3: \n"
20386 +
20387 +#ifdef CONFIG_PAX_KERNEXEC
20388 + " movl %%cr0, %0\n"
20389 + " movl %0, %%eax\n"
20390 + " andl $0xFFFEFFFF, %%eax\n"
20391 + " movl %%eax, %%cr0\n"
20392 +#endif
20393 +
20394 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20395 +
20396 +#ifdef CONFIG_PAX_KERNEXEC
20397 + " movl %0, %%cr0\n"
20398 +#endif
20399 +
20400 " jmp 2b\n"
20401 ".previous\n"
20402 _ASM_EXTABLE(1b, 3b)
20403 - : : "r" (from));
20404 + : "=&r" (cr0) : "r" (from) : "ax");
20405
20406 for ( ; i > 5; i--) {
20407 __asm__ __volatile__ (
20408 - "1: prefetch 320(%0)\n"
20409 - "2: movq (%0), %%mm0\n"
20410 - " movq 8(%0), %%mm1\n"
20411 - " movq 16(%0), %%mm2\n"
20412 - " movq 24(%0), %%mm3\n"
20413 - " movq %%mm0, (%1)\n"
20414 - " movq %%mm1, 8(%1)\n"
20415 - " movq %%mm2, 16(%1)\n"
20416 - " movq %%mm3, 24(%1)\n"
20417 - " movq 32(%0), %%mm0\n"
20418 - " movq 40(%0), %%mm1\n"
20419 - " movq 48(%0), %%mm2\n"
20420 - " movq 56(%0), %%mm3\n"
20421 - " movq %%mm0, 32(%1)\n"
20422 - " movq %%mm1, 40(%1)\n"
20423 - " movq %%mm2, 48(%1)\n"
20424 - " movq %%mm3, 56(%1)\n"
20425 + "1: prefetch 320(%1)\n"
20426 + "2: movq (%1), %%mm0\n"
20427 + " movq 8(%1), %%mm1\n"
20428 + " movq 16(%1), %%mm2\n"
20429 + " movq 24(%1), %%mm3\n"
20430 + " movq %%mm0, (%2)\n"
20431 + " movq %%mm1, 8(%2)\n"
20432 + " movq %%mm2, 16(%2)\n"
20433 + " movq %%mm3, 24(%2)\n"
20434 + " movq 32(%1), %%mm0\n"
20435 + " movq 40(%1), %%mm1\n"
20436 + " movq 48(%1), %%mm2\n"
20437 + " movq 56(%1), %%mm3\n"
20438 + " movq %%mm0, 32(%2)\n"
20439 + " movq %%mm1, 40(%2)\n"
20440 + " movq %%mm2, 48(%2)\n"
20441 + " movq %%mm3, 56(%2)\n"
20442 ".section .fixup, \"ax\"\n"
20443 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20444 + "3:\n"
20445 +
20446 +#ifdef CONFIG_PAX_KERNEXEC
20447 + " movl %%cr0, %0\n"
20448 + " movl %0, %%eax\n"
20449 + " andl $0xFFFEFFFF, %%eax\n"
20450 + " movl %%eax, %%cr0\n"
20451 +#endif
20452 +
20453 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20454 +
20455 +#ifdef CONFIG_PAX_KERNEXEC
20456 + " movl %0, %%cr0\n"
20457 +#endif
20458 +
20459 " jmp 2b\n"
20460 ".previous\n"
20461 _ASM_EXTABLE(1b, 3b)
20462 - : : "r" (from), "r" (to) : "memory");
20463 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20464
20465 from += 64;
20466 to += 64;
20467 @@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
20468 static void fast_copy_page(void *to, void *from)
20469 {
20470 int i;
20471 + unsigned long cr0;
20472
20473 kernel_fpu_begin();
20474
20475 @@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
20476 * but that is for later. -AV
20477 */
20478 __asm__ __volatile__(
20479 - "1: prefetch (%0)\n"
20480 - " prefetch 64(%0)\n"
20481 - " prefetch 128(%0)\n"
20482 - " prefetch 192(%0)\n"
20483 - " prefetch 256(%0)\n"
20484 + "1: prefetch (%1)\n"
20485 + " prefetch 64(%1)\n"
20486 + " prefetch 128(%1)\n"
20487 + " prefetch 192(%1)\n"
20488 + " prefetch 256(%1)\n"
20489 "2: \n"
20490 ".section .fixup, \"ax\"\n"
20491 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20492 + "3: \n"
20493 +
20494 +#ifdef CONFIG_PAX_KERNEXEC
20495 + " movl %%cr0, %0\n"
20496 + " movl %0, %%eax\n"
20497 + " andl $0xFFFEFFFF, %%eax\n"
20498 + " movl %%eax, %%cr0\n"
20499 +#endif
20500 +
20501 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20502 +
20503 +#ifdef CONFIG_PAX_KERNEXEC
20504 + " movl %0, %%cr0\n"
20505 +#endif
20506 +
20507 " jmp 2b\n"
20508 ".previous\n"
20509 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
20510 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
20511
20512 for (i = 0; i < (4096-320)/64; i++) {
20513 __asm__ __volatile__ (
20514 - "1: prefetch 320(%0)\n"
20515 - "2: movq (%0), %%mm0\n"
20516 - " movntq %%mm0, (%1)\n"
20517 - " movq 8(%0), %%mm1\n"
20518 - " movntq %%mm1, 8(%1)\n"
20519 - " movq 16(%0), %%mm2\n"
20520 - " movntq %%mm2, 16(%1)\n"
20521 - " movq 24(%0), %%mm3\n"
20522 - " movntq %%mm3, 24(%1)\n"
20523 - " movq 32(%0), %%mm4\n"
20524 - " movntq %%mm4, 32(%1)\n"
20525 - " movq 40(%0), %%mm5\n"
20526 - " movntq %%mm5, 40(%1)\n"
20527 - " movq 48(%0), %%mm6\n"
20528 - " movntq %%mm6, 48(%1)\n"
20529 - " movq 56(%0), %%mm7\n"
20530 - " movntq %%mm7, 56(%1)\n"
20531 + "1: prefetch 320(%1)\n"
20532 + "2: movq (%1), %%mm0\n"
20533 + " movntq %%mm0, (%2)\n"
20534 + " movq 8(%1), %%mm1\n"
20535 + " movntq %%mm1, 8(%2)\n"
20536 + " movq 16(%1), %%mm2\n"
20537 + " movntq %%mm2, 16(%2)\n"
20538 + " movq 24(%1), %%mm3\n"
20539 + " movntq %%mm3, 24(%2)\n"
20540 + " movq 32(%1), %%mm4\n"
20541 + " movntq %%mm4, 32(%2)\n"
20542 + " movq 40(%1), %%mm5\n"
20543 + " movntq %%mm5, 40(%2)\n"
20544 + " movq 48(%1), %%mm6\n"
20545 + " movntq %%mm6, 48(%2)\n"
20546 + " movq 56(%1), %%mm7\n"
20547 + " movntq %%mm7, 56(%2)\n"
20548 ".section .fixup, \"ax\"\n"
20549 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20550 + "3:\n"
20551 +
20552 +#ifdef CONFIG_PAX_KERNEXEC
20553 + " movl %%cr0, %0\n"
20554 + " movl %0, %%eax\n"
20555 + " andl $0xFFFEFFFF, %%eax\n"
20556 + " movl %%eax, %%cr0\n"
20557 +#endif
20558 +
20559 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20560 +
20561 +#ifdef CONFIG_PAX_KERNEXEC
20562 + " movl %0, %%cr0\n"
20563 +#endif
20564 +
20565 " jmp 2b\n"
20566 ".previous\n"
20567 - _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
20568 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20569
20570 from += 64;
20571 to += 64;
20572 @@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
20573 static void fast_copy_page(void *to, void *from)
20574 {
20575 int i;
20576 + unsigned long cr0;
20577
20578 kernel_fpu_begin();
20579
20580 __asm__ __volatile__ (
20581 - "1: prefetch (%0)\n"
20582 - " prefetch 64(%0)\n"
20583 - " prefetch 128(%0)\n"
20584 - " prefetch 192(%0)\n"
20585 - " prefetch 256(%0)\n"
20586 + "1: prefetch (%1)\n"
20587 + " prefetch 64(%1)\n"
20588 + " prefetch 128(%1)\n"
20589 + " prefetch 192(%1)\n"
20590 + " prefetch 256(%1)\n"
20591 "2: \n"
20592 ".section .fixup, \"ax\"\n"
20593 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20594 + "3: \n"
20595 +
20596 +#ifdef CONFIG_PAX_KERNEXEC
20597 + " movl %%cr0, %0\n"
20598 + " movl %0, %%eax\n"
20599 + " andl $0xFFFEFFFF, %%eax\n"
20600 + " movl %%eax, %%cr0\n"
20601 +#endif
20602 +
20603 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
20604 +
20605 +#ifdef CONFIG_PAX_KERNEXEC
20606 + " movl %0, %%cr0\n"
20607 +#endif
20608 +
20609 " jmp 2b\n"
20610 ".previous\n"
20611 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
20612 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
20613
20614 for (i = 0; i < 4096/64; i++) {
20615 __asm__ __volatile__ (
20616 - "1: prefetch 320(%0)\n"
20617 - "2: movq (%0), %%mm0\n"
20618 - " movq 8(%0), %%mm1\n"
20619 - " movq 16(%0), %%mm2\n"
20620 - " movq 24(%0), %%mm3\n"
20621 - " movq %%mm0, (%1)\n"
20622 - " movq %%mm1, 8(%1)\n"
20623 - " movq %%mm2, 16(%1)\n"
20624 - " movq %%mm3, 24(%1)\n"
20625 - " movq 32(%0), %%mm0\n"
20626 - " movq 40(%0), %%mm1\n"
20627 - " movq 48(%0), %%mm2\n"
20628 - " movq 56(%0), %%mm3\n"
20629 - " movq %%mm0, 32(%1)\n"
20630 - " movq %%mm1, 40(%1)\n"
20631 - " movq %%mm2, 48(%1)\n"
20632 - " movq %%mm3, 56(%1)\n"
20633 + "1: prefetch 320(%1)\n"
20634 + "2: movq (%1), %%mm0\n"
20635 + " movq 8(%1), %%mm1\n"
20636 + " movq 16(%1), %%mm2\n"
20637 + " movq 24(%1), %%mm3\n"
20638 + " movq %%mm0, (%2)\n"
20639 + " movq %%mm1, 8(%2)\n"
20640 + " movq %%mm2, 16(%2)\n"
20641 + " movq %%mm3, 24(%2)\n"
20642 + " movq 32(%1), %%mm0\n"
20643 + " movq 40(%1), %%mm1\n"
20644 + " movq 48(%1), %%mm2\n"
20645 + " movq 56(%1), %%mm3\n"
20646 + " movq %%mm0, 32(%2)\n"
20647 + " movq %%mm1, 40(%2)\n"
20648 + " movq %%mm2, 48(%2)\n"
20649 + " movq %%mm3, 56(%2)\n"
20650 ".section .fixup, \"ax\"\n"
20651 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20652 + "3:\n"
20653 +
20654 +#ifdef CONFIG_PAX_KERNEXEC
20655 + " movl %%cr0, %0\n"
20656 + " movl %0, %%eax\n"
20657 + " andl $0xFFFEFFFF, %%eax\n"
20658 + " movl %%eax, %%cr0\n"
20659 +#endif
20660 +
20661 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
20662 +
20663 +#ifdef CONFIG_PAX_KERNEXEC
20664 + " movl %0, %%cr0\n"
20665 +#endif
20666 +
20667 " jmp 2b\n"
20668 ".previous\n"
20669 _ASM_EXTABLE(1b, 3b)
20670 - : : "r" (from), "r" (to) : "memory");
20671 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
20672
20673 from += 64;
20674 to += 64;
20675 diff -urNp linux-2.6.32.46/arch/x86/lib/msr-reg.S linux-2.6.32.46/arch/x86/lib/msr-reg.S
20676 --- linux-2.6.32.46/arch/x86/lib/msr-reg.S 2011-03-27 14:31:47.000000000 -0400
20677 +++ linux-2.6.32.46/arch/x86/lib/msr-reg.S 2011-10-08 08:14:40.000000000 -0400
20678 @@ -3,6 +3,7 @@
20679 #include <asm/dwarf2.h>
20680 #include <asm/asm.h>
20681 #include <asm/msr.h>
20682 +#include <asm/alternative-asm.h>
20683
20684 #ifdef CONFIG_X86_64
20685 /*
20686 @@ -37,6 +38,7 @@ ENTRY(native_\op\()_safe_regs)
20687 movl %edi, 28(%r10)
20688 popq_cfi %rbp
20689 popq_cfi %rbx
20690 + pax_force_retaddr
20691 ret
20692 3:
20693 CFI_RESTORE_STATE
20694 diff -urNp linux-2.6.32.46/arch/x86/lib/putuser.S linux-2.6.32.46/arch/x86/lib/putuser.S
20695 --- linux-2.6.32.46/arch/x86/lib/putuser.S 2011-03-27 14:31:47.000000000 -0400
20696 +++ linux-2.6.32.46/arch/x86/lib/putuser.S 2011-10-08 08:14:40.000000000 -0400
20697 @@ -15,7 +15,9 @@
20698 #include <asm/thread_info.h>
20699 #include <asm/errno.h>
20700 #include <asm/asm.h>
20701 -
20702 +#include <asm/segment.h>
20703 +#include <asm/pgtable.h>
20704 +#include <asm/alternative-asm.h>
20705
20706 /*
20707 * __put_user_X
20708 @@ -29,52 +31,119 @@
20709 * as they get called from within inline assembly.
20710 */
20711
20712 -#define ENTER CFI_STARTPROC ; \
20713 - GET_THREAD_INFO(%_ASM_BX)
20714 -#define EXIT ret ; \
20715 +#define ENTER CFI_STARTPROC
20716 +#define EXIT pax_force_retaddr; ret ; \
20717 CFI_ENDPROC
20718
20719 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20720 +#define _DEST %_ASM_CX,%_ASM_BX
20721 +#else
20722 +#define _DEST %_ASM_CX
20723 +#endif
20724 +
20725 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
20726 +#define __copyuser_seg gs;
20727 +#else
20728 +#define __copyuser_seg
20729 +#endif
20730 +
20731 .text
20732 ENTRY(__put_user_1)
20733 ENTER
20734 +
20735 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20736 + GET_THREAD_INFO(%_ASM_BX)
20737 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
20738 jae bad_put_user
20739 -1: movb %al,(%_ASM_CX)
20740 +
20741 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20742 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20743 + cmp %_ASM_BX,%_ASM_CX
20744 + jb 1234f
20745 + xor %ebx,%ebx
20746 +1234:
20747 +#endif
20748 +
20749 +#endif
20750 +
20751 +1: __copyuser_seg movb %al,(_DEST)
20752 xor %eax,%eax
20753 EXIT
20754 ENDPROC(__put_user_1)
20755
20756 ENTRY(__put_user_2)
20757 ENTER
20758 +
20759 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20760 + GET_THREAD_INFO(%_ASM_BX)
20761 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20762 sub $1,%_ASM_BX
20763 cmp %_ASM_BX,%_ASM_CX
20764 jae bad_put_user
20765 -2: movw %ax,(%_ASM_CX)
20766 +
20767 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20768 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20769 + cmp %_ASM_BX,%_ASM_CX
20770 + jb 1234f
20771 + xor %ebx,%ebx
20772 +1234:
20773 +#endif
20774 +
20775 +#endif
20776 +
20777 +2: __copyuser_seg movw %ax,(_DEST)
20778 xor %eax,%eax
20779 EXIT
20780 ENDPROC(__put_user_2)
20781
20782 ENTRY(__put_user_4)
20783 ENTER
20784 +
20785 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20786 + GET_THREAD_INFO(%_ASM_BX)
20787 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20788 sub $3,%_ASM_BX
20789 cmp %_ASM_BX,%_ASM_CX
20790 jae bad_put_user
20791 -3: movl %eax,(%_ASM_CX)
20792 +
20793 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20794 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20795 + cmp %_ASM_BX,%_ASM_CX
20796 + jb 1234f
20797 + xor %ebx,%ebx
20798 +1234:
20799 +#endif
20800 +
20801 +#endif
20802 +
20803 +3: __copyuser_seg movl %eax,(_DEST)
20804 xor %eax,%eax
20805 EXIT
20806 ENDPROC(__put_user_4)
20807
20808 ENTRY(__put_user_8)
20809 ENTER
20810 +
20811 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20812 + GET_THREAD_INFO(%_ASM_BX)
20813 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20814 sub $7,%_ASM_BX
20815 cmp %_ASM_BX,%_ASM_CX
20816 jae bad_put_user
20817 -4: mov %_ASM_AX,(%_ASM_CX)
20818 +
20819 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20820 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20821 + cmp %_ASM_BX,%_ASM_CX
20822 + jb 1234f
20823 + xor %ebx,%ebx
20824 +1234:
20825 +#endif
20826 +
20827 +#endif
20828 +
20829 +4: __copyuser_seg mov %_ASM_AX,(_DEST)
20830 #ifdef CONFIG_X86_32
20831 -5: movl %edx,4(%_ASM_CX)
20832 +5: __copyuser_seg movl %edx,4(_DEST)
20833 #endif
20834 xor %eax,%eax
20835 EXIT
20836 diff -urNp linux-2.6.32.46/arch/x86/lib/rwlock_64.S linux-2.6.32.46/arch/x86/lib/rwlock_64.S
20837 --- linux-2.6.32.46/arch/x86/lib/rwlock_64.S 2011-03-27 14:31:47.000000000 -0400
20838 +++ linux-2.6.32.46/arch/x86/lib/rwlock_64.S 2011-10-06 09:37:14.000000000 -0400
20839 @@ -17,6 +17,7 @@ ENTRY(__write_lock_failed)
20840 LOCK_PREFIX
20841 subl $RW_LOCK_BIAS,(%rdi)
20842 jnz __write_lock_failed
20843 + pax_force_retaddr
20844 ret
20845 CFI_ENDPROC
20846 END(__write_lock_failed)
20847 @@ -33,6 +34,7 @@ ENTRY(__read_lock_failed)
20848 LOCK_PREFIX
20849 decl (%rdi)
20850 js __read_lock_failed
20851 + pax_force_retaddr
20852 ret
20853 CFI_ENDPROC
20854 END(__read_lock_failed)
20855 diff -urNp linux-2.6.32.46/arch/x86/lib/rwsem_64.S linux-2.6.32.46/arch/x86/lib/rwsem_64.S
20856 --- linux-2.6.32.46/arch/x86/lib/rwsem_64.S 2011-03-27 14:31:47.000000000 -0400
20857 +++ linux-2.6.32.46/arch/x86/lib/rwsem_64.S 2011-10-06 09:37:14.000000000 -0400
20858 @@ -48,6 +48,7 @@ ENTRY(call_rwsem_down_read_failed)
20859 call rwsem_down_read_failed
20860 popq %rdx
20861 restore_common_regs
20862 + pax_force_retaddr
20863 ret
20864 ENDPROC(call_rwsem_down_read_failed)
20865
20866 @@ -56,6 +57,7 @@ ENTRY(call_rwsem_down_write_failed)
20867 movq %rax,%rdi
20868 call rwsem_down_write_failed
20869 restore_common_regs
20870 + pax_force_retaddr
20871 ret
20872 ENDPROC(call_rwsem_down_write_failed)
20873
20874 @@ -66,7 +68,8 @@ ENTRY(call_rwsem_wake)
20875 movq %rax,%rdi
20876 call rwsem_wake
20877 restore_common_regs
20878 -1: ret
20879 +1: pax_force_retaddr
20880 + ret
20881 ENDPROC(call_rwsem_wake)
20882
20883 /* Fix up special calling conventions */
20884 @@ -77,5 +80,6 @@ ENTRY(call_rwsem_downgrade_wake)
20885 call rwsem_downgrade_wake
20886 popq %rdx
20887 restore_common_regs
20888 + pax_force_retaddr
20889 ret
20890 ENDPROC(call_rwsem_downgrade_wake)
20891 diff -urNp linux-2.6.32.46/arch/x86/lib/thunk_64.S linux-2.6.32.46/arch/x86/lib/thunk_64.S
20892 --- linux-2.6.32.46/arch/x86/lib/thunk_64.S 2011-03-27 14:31:47.000000000 -0400
20893 +++ linux-2.6.32.46/arch/x86/lib/thunk_64.S 2011-10-06 09:37:14.000000000 -0400
20894 @@ -10,7 +10,8 @@
20895 #include <asm/dwarf2.h>
20896 #include <asm/calling.h>
20897 #include <asm/rwlock.h>
20898 -
20899 + #include <asm/alternative-asm.h>
20900 +
20901 /* rdi: arg1 ... normal C conventions. rax is saved/restored. */
20902 .macro thunk name,func
20903 .globl \name
20904 @@ -70,6 +71,7 @@
20905 SAVE_ARGS
20906 restore:
20907 RESTORE_ARGS
20908 + pax_force_retaddr
20909 ret
20910 CFI_ENDPROC
20911
20912 @@ -77,5 +79,6 @@ restore:
20913 SAVE_ARGS
20914 restore_norax:
20915 RESTORE_ARGS 1
20916 + pax_force_retaddr
20917 ret
20918 CFI_ENDPROC
20919 diff -urNp linux-2.6.32.46/arch/x86/lib/usercopy_32.c linux-2.6.32.46/arch/x86/lib/usercopy_32.c
20920 --- linux-2.6.32.46/arch/x86/lib/usercopy_32.c 2011-03-27 14:31:47.000000000 -0400
20921 +++ linux-2.6.32.46/arch/x86/lib/usercopy_32.c 2011-04-23 21:12:28.000000000 -0400
20922 @@ -43,7 +43,7 @@ do { \
20923 __asm__ __volatile__( \
20924 " testl %1,%1\n" \
20925 " jz 2f\n" \
20926 - "0: lodsb\n" \
20927 + "0: "__copyuser_seg"lodsb\n" \
20928 " stosb\n" \
20929 " testb %%al,%%al\n" \
20930 " jz 1f\n" \
20931 @@ -128,10 +128,12 @@ do { \
20932 int __d0; \
20933 might_fault(); \
20934 __asm__ __volatile__( \
20935 + __COPYUSER_SET_ES \
20936 "0: rep; stosl\n" \
20937 " movl %2,%0\n" \
20938 "1: rep; stosb\n" \
20939 "2:\n" \
20940 + __COPYUSER_RESTORE_ES \
20941 ".section .fixup,\"ax\"\n" \
20942 "3: lea 0(%2,%0,4),%0\n" \
20943 " jmp 2b\n" \
20944 @@ -200,6 +202,7 @@ long strnlen_user(const char __user *s,
20945 might_fault();
20946
20947 __asm__ __volatile__(
20948 + __COPYUSER_SET_ES
20949 " testl %0, %0\n"
20950 " jz 3f\n"
20951 " andl %0,%%ecx\n"
20952 @@ -208,6 +211,7 @@ long strnlen_user(const char __user *s,
20953 " subl %%ecx,%0\n"
20954 " addl %0,%%eax\n"
20955 "1:\n"
20956 + __COPYUSER_RESTORE_ES
20957 ".section .fixup,\"ax\"\n"
20958 "2: xorl %%eax,%%eax\n"
20959 " jmp 1b\n"
20960 @@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
20961
20962 #ifdef CONFIG_X86_INTEL_USERCOPY
20963 static unsigned long
20964 -__copy_user_intel(void __user *to, const void *from, unsigned long size)
20965 +__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
20966 {
20967 int d0, d1;
20968 __asm__ __volatile__(
20969 @@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const
20970 " .align 2,0x90\n"
20971 "3: movl 0(%4), %%eax\n"
20972 "4: movl 4(%4), %%edx\n"
20973 - "5: movl %%eax, 0(%3)\n"
20974 - "6: movl %%edx, 4(%3)\n"
20975 + "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
20976 + "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
20977 "7: movl 8(%4), %%eax\n"
20978 "8: movl 12(%4),%%edx\n"
20979 - "9: movl %%eax, 8(%3)\n"
20980 - "10: movl %%edx, 12(%3)\n"
20981 + "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
20982 + "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
20983 "11: movl 16(%4), %%eax\n"
20984 "12: movl 20(%4), %%edx\n"
20985 - "13: movl %%eax, 16(%3)\n"
20986 - "14: movl %%edx, 20(%3)\n"
20987 + "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
20988 + "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
20989 "15: movl 24(%4), %%eax\n"
20990 "16: movl 28(%4), %%edx\n"
20991 - "17: movl %%eax, 24(%3)\n"
20992 - "18: movl %%edx, 28(%3)\n"
20993 + "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
20994 + "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
20995 "19: movl 32(%4), %%eax\n"
20996 "20: movl 36(%4), %%edx\n"
20997 - "21: movl %%eax, 32(%3)\n"
20998 - "22: movl %%edx, 36(%3)\n"
20999 + "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
21000 + "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
21001 "23: movl 40(%4), %%eax\n"
21002 "24: movl 44(%4), %%edx\n"
21003 - "25: movl %%eax, 40(%3)\n"
21004 - "26: movl %%edx, 44(%3)\n"
21005 + "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
21006 + "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
21007 "27: movl 48(%4), %%eax\n"
21008 "28: movl 52(%4), %%edx\n"
21009 - "29: movl %%eax, 48(%3)\n"
21010 - "30: movl %%edx, 52(%3)\n"
21011 + "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
21012 + "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
21013 "31: movl 56(%4), %%eax\n"
21014 "32: movl 60(%4), %%edx\n"
21015 - "33: movl %%eax, 56(%3)\n"
21016 - "34: movl %%edx, 60(%3)\n"
21017 + "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
21018 + "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
21019 " addl $-64, %0\n"
21020 " addl $64, %4\n"
21021 " addl $64, %3\n"
21022 @@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const
21023 " shrl $2, %0\n"
21024 " andl $3, %%eax\n"
21025 " cld\n"
21026 + __COPYUSER_SET_ES
21027 "99: rep; movsl\n"
21028 "36: movl %%eax, %0\n"
21029 "37: rep; movsb\n"
21030 "100:\n"
21031 + __COPYUSER_RESTORE_ES
21032 + ".section .fixup,\"ax\"\n"
21033 + "101: lea 0(%%eax,%0,4),%0\n"
21034 + " jmp 100b\n"
21035 + ".previous\n"
21036 + ".section __ex_table,\"a\"\n"
21037 + " .align 4\n"
21038 + " .long 1b,100b\n"
21039 + " .long 2b,100b\n"
21040 + " .long 3b,100b\n"
21041 + " .long 4b,100b\n"
21042 + " .long 5b,100b\n"
21043 + " .long 6b,100b\n"
21044 + " .long 7b,100b\n"
21045 + " .long 8b,100b\n"
21046 + " .long 9b,100b\n"
21047 + " .long 10b,100b\n"
21048 + " .long 11b,100b\n"
21049 + " .long 12b,100b\n"
21050 + " .long 13b,100b\n"
21051 + " .long 14b,100b\n"
21052 + " .long 15b,100b\n"
21053 + " .long 16b,100b\n"
21054 + " .long 17b,100b\n"
21055 + " .long 18b,100b\n"
21056 + " .long 19b,100b\n"
21057 + " .long 20b,100b\n"
21058 + " .long 21b,100b\n"
21059 + " .long 22b,100b\n"
21060 + " .long 23b,100b\n"
21061 + " .long 24b,100b\n"
21062 + " .long 25b,100b\n"
21063 + " .long 26b,100b\n"
21064 + " .long 27b,100b\n"
21065 + " .long 28b,100b\n"
21066 + " .long 29b,100b\n"
21067 + " .long 30b,100b\n"
21068 + " .long 31b,100b\n"
21069 + " .long 32b,100b\n"
21070 + " .long 33b,100b\n"
21071 + " .long 34b,100b\n"
21072 + " .long 35b,100b\n"
21073 + " .long 36b,100b\n"
21074 + " .long 37b,100b\n"
21075 + " .long 99b,101b\n"
21076 + ".previous"
21077 + : "=&c"(size), "=&D" (d0), "=&S" (d1)
21078 + : "1"(to), "2"(from), "0"(size)
21079 + : "eax", "edx", "memory");
21080 + return size;
21081 +}
21082 +
21083 +static unsigned long
21084 +__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
21085 +{
21086 + int d0, d1;
21087 + __asm__ __volatile__(
21088 + " .align 2,0x90\n"
21089 + "1: "__copyuser_seg" movl 32(%4), %%eax\n"
21090 + " cmpl $67, %0\n"
21091 + " jbe 3f\n"
21092 + "2: "__copyuser_seg" movl 64(%4), %%eax\n"
21093 + " .align 2,0x90\n"
21094 + "3: "__copyuser_seg" movl 0(%4), %%eax\n"
21095 + "4: "__copyuser_seg" movl 4(%4), %%edx\n"
21096 + "5: movl %%eax, 0(%3)\n"
21097 + "6: movl %%edx, 4(%3)\n"
21098 + "7: "__copyuser_seg" movl 8(%4), %%eax\n"
21099 + "8: "__copyuser_seg" movl 12(%4),%%edx\n"
21100 + "9: movl %%eax, 8(%3)\n"
21101 + "10: movl %%edx, 12(%3)\n"
21102 + "11: "__copyuser_seg" movl 16(%4), %%eax\n"
21103 + "12: "__copyuser_seg" movl 20(%4), %%edx\n"
21104 + "13: movl %%eax, 16(%3)\n"
21105 + "14: movl %%edx, 20(%3)\n"
21106 + "15: "__copyuser_seg" movl 24(%4), %%eax\n"
21107 + "16: "__copyuser_seg" movl 28(%4), %%edx\n"
21108 + "17: movl %%eax, 24(%3)\n"
21109 + "18: movl %%edx, 28(%3)\n"
21110 + "19: "__copyuser_seg" movl 32(%4), %%eax\n"
21111 + "20: "__copyuser_seg" movl 36(%4), %%edx\n"
21112 + "21: movl %%eax, 32(%3)\n"
21113 + "22: movl %%edx, 36(%3)\n"
21114 + "23: "__copyuser_seg" movl 40(%4), %%eax\n"
21115 + "24: "__copyuser_seg" movl 44(%4), %%edx\n"
21116 + "25: movl %%eax, 40(%3)\n"
21117 + "26: movl %%edx, 44(%3)\n"
21118 + "27: "__copyuser_seg" movl 48(%4), %%eax\n"
21119 + "28: "__copyuser_seg" movl 52(%4), %%edx\n"
21120 + "29: movl %%eax, 48(%3)\n"
21121 + "30: movl %%edx, 52(%3)\n"
21122 + "31: "__copyuser_seg" movl 56(%4), %%eax\n"
21123 + "32: "__copyuser_seg" movl 60(%4), %%edx\n"
21124 + "33: movl %%eax, 56(%3)\n"
21125 + "34: movl %%edx, 60(%3)\n"
21126 + " addl $-64, %0\n"
21127 + " addl $64, %4\n"
21128 + " addl $64, %3\n"
21129 + " cmpl $63, %0\n"
21130 + " ja 1b\n"
21131 + "35: movl %0, %%eax\n"
21132 + " shrl $2, %0\n"
21133 + " andl $3, %%eax\n"
21134 + " cld\n"
21135 + "99: rep; "__copyuser_seg" movsl\n"
21136 + "36: movl %%eax, %0\n"
21137 + "37: rep; "__copyuser_seg" movsb\n"
21138 + "100:\n"
21139 ".section .fixup,\"ax\"\n"
21140 "101: lea 0(%%eax,%0,4),%0\n"
21141 " jmp 100b\n"
21142 @@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, cons
21143 int d0, d1;
21144 __asm__ __volatile__(
21145 " .align 2,0x90\n"
21146 - "0: movl 32(%4), %%eax\n"
21147 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
21148 " cmpl $67, %0\n"
21149 " jbe 2f\n"
21150 - "1: movl 64(%4), %%eax\n"
21151 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
21152 " .align 2,0x90\n"
21153 - "2: movl 0(%4), %%eax\n"
21154 - "21: movl 4(%4), %%edx\n"
21155 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
21156 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
21157 " movl %%eax, 0(%3)\n"
21158 " movl %%edx, 4(%3)\n"
21159 - "3: movl 8(%4), %%eax\n"
21160 - "31: movl 12(%4),%%edx\n"
21161 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
21162 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
21163 " movl %%eax, 8(%3)\n"
21164 " movl %%edx, 12(%3)\n"
21165 - "4: movl 16(%4), %%eax\n"
21166 - "41: movl 20(%4), %%edx\n"
21167 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
21168 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
21169 " movl %%eax, 16(%3)\n"
21170 " movl %%edx, 20(%3)\n"
21171 - "10: movl 24(%4), %%eax\n"
21172 - "51: movl 28(%4), %%edx\n"
21173 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
21174 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
21175 " movl %%eax, 24(%3)\n"
21176 " movl %%edx, 28(%3)\n"
21177 - "11: movl 32(%4), %%eax\n"
21178 - "61: movl 36(%4), %%edx\n"
21179 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
21180 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
21181 " movl %%eax, 32(%3)\n"
21182 " movl %%edx, 36(%3)\n"
21183 - "12: movl 40(%4), %%eax\n"
21184 - "71: movl 44(%4), %%edx\n"
21185 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
21186 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
21187 " movl %%eax, 40(%3)\n"
21188 " movl %%edx, 44(%3)\n"
21189 - "13: movl 48(%4), %%eax\n"
21190 - "81: movl 52(%4), %%edx\n"
21191 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
21192 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
21193 " movl %%eax, 48(%3)\n"
21194 " movl %%edx, 52(%3)\n"
21195 - "14: movl 56(%4), %%eax\n"
21196 - "91: movl 60(%4), %%edx\n"
21197 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
21198 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
21199 " movl %%eax, 56(%3)\n"
21200 " movl %%edx, 60(%3)\n"
21201 " addl $-64, %0\n"
21202 @@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, cons
21203 " shrl $2, %0\n"
21204 " andl $3, %%eax\n"
21205 " cld\n"
21206 - "6: rep; movsl\n"
21207 + "6: rep; "__copyuser_seg" movsl\n"
21208 " movl %%eax,%0\n"
21209 - "7: rep; movsb\n"
21210 + "7: rep; "__copyuser_seg" movsb\n"
21211 "8:\n"
21212 ".section .fixup,\"ax\"\n"
21213 "9: lea 0(%%eax,%0,4),%0\n"
21214 @@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing
21215
21216 __asm__ __volatile__(
21217 " .align 2,0x90\n"
21218 - "0: movl 32(%4), %%eax\n"
21219 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
21220 " cmpl $67, %0\n"
21221 " jbe 2f\n"
21222 - "1: movl 64(%4), %%eax\n"
21223 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
21224 " .align 2,0x90\n"
21225 - "2: movl 0(%4), %%eax\n"
21226 - "21: movl 4(%4), %%edx\n"
21227 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
21228 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
21229 " movnti %%eax, 0(%3)\n"
21230 " movnti %%edx, 4(%3)\n"
21231 - "3: movl 8(%4), %%eax\n"
21232 - "31: movl 12(%4),%%edx\n"
21233 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
21234 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
21235 " movnti %%eax, 8(%3)\n"
21236 " movnti %%edx, 12(%3)\n"
21237 - "4: movl 16(%4), %%eax\n"
21238 - "41: movl 20(%4), %%edx\n"
21239 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
21240 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
21241 " movnti %%eax, 16(%3)\n"
21242 " movnti %%edx, 20(%3)\n"
21243 - "10: movl 24(%4), %%eax\n"
21244 - "51: movl 28(%4), %%edx\n"
21245 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
21246 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
21247 " movnti %%eax, 24(%3)\n"
21248 " movnti %%edx, 28(%3)\n"
21249 - "11: movl 32(%4), %%eax\n"
21250 - "61: movl 36(%4), %%edx\n"
21251 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
21252 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
21253 " movnti %%eax, 32(%3)\n"
21254 " movnti %%edx, 36(%3)\n"
21255 - "12: movl 40(%4), %%eax\n"
21256 - "71: movl 44(%4), %%edx\n"
21257 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
21258 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
21259 " movnti %%eax, 40(%3)\n"
21260 " movnti %%edx, 44(%3)\n"
21261 - "13: movl 48(%4), %%eax\n"
21262 - "81: movl 52(%4), %%edx\n"
21263 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
21264 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
21265 " movnti %%eax, 48(%3)\n"
21266 " movnti %%edx, 52(%3)\n"
21267 - "14: movl 56(%4), %%eax\n"
21268 - "91: movl 60(%4), %%edx\n"
21269 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
21270 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
21271 " movnti %%eax, 56(%3)\n"
21272 " movnti %%edx, 60(%3)\n"
21273 " addl $-64, %0\n"
21274 @@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing
21275 " shrl $2, %0\n"
21276 " andl $3, %%eax\n"
21277 " cld\n"
21278 - "6: rep; movsl\n"
21279 + "6: rep; "__copyuser_seg" movsl\n"
21280 " movl %%eax,%0\n"
21281 - "7: rep; movsb\n"
21282 + "7: rep; "__copyuser_seg" movsb\n"
21283 "8:\n"
21284 ".section .fixup,\"ax\"\n"
21285 "9: lea 0(%%eax,%0,4),%0\n"
21286 @@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_n
21287
21288 __asm__ __volatile__(
21289 " .align 2,0x90\n"
21290 - "0: movl 32(%4), %%eax\n"
21291 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
21292 " cmpl $67, %0\n"
21293 " jbe 2f\n"
21294 - "1: movl 64(%4), %%eax\n"
21295 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
21296 " .align 2,0x90\n"
21297 - "2: movl 0(%4), %%eax\n"
21298 - "21: movl 4(%4), %%edx\n"
21299 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
21300 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
21301 " movnti %%eax, 0(%3)\n"
21302 " movnti %%edx, 4(%3)\n"
21303 - "3: movl 8(%4), %%eax\n"
21304 - "31: movl 12(%4),%%edx\n"
21305 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
21306 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
21307 " movnti %%eax, 8(%3)\n"
21308 " movnti %%edx, 12(%3)\n"
21309 - "4: movl 16(%4), %%eax\n"
21310 - "41: movl 20(%4), %%edx\n"
21311 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
21312 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
21313 " movnti %%eax, 16(%3)\n"
21314 " movnti %%edx, 20(%3)\n"
21315 - "10: movl 24(%4), %%eax\n"
21316 - "51: movl 28(%4), %%edx\n"
21317 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
21318 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
21319 " movnti %%eax, 24(%3)\n"
21320 " movnti %%edx, 28(%3)\n"
21321 - "11: movl 32(%4), %%eax\n"
21322 - "61: movl 36(%4), %%edx\n"
21323 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
21324 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
21325 " movnti %%eax, 32(%3)\n"
21326 " movnti %%edx, 36(%3)\n"
21327 - "12: movl 40(%4), %%eax\n"
21328 - "71: movl 44(%4), %%edx\n"
21329 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
21330 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
21331 " movnti %%eax, 40(%3)\n"
21332 " movnti %%edx, 44(%3)\n"
21333 - "13: movl 48(%4), %%eax\n"
21334 - "81: movl 52(%4), %%edx\n"
21335 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
21336 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
21337 " movnti %%eax, 48(%3)\n"
21338 " movnti %%edx, 52(%3)\n"
21339 - "14: movl 56(%4), %%eax\n"
21340 - "91: movl 60(%4), %%edx\n"
21341 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
21342 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
21343 " movnti %%eax, 56(%3)\n"
21344 " movnti %%edx, 60(%3)\n"
21345 " addl $-64, %0\n"
21346 @@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_n
21347 " shrl $2, %0\n"
21348 " andl $3, %%eax\n"
21349 " cld\n"
21350 - "6: rep; movsl\n"
21351 + "6: rep; "__copyuser_seg" movsl\n"
21352 " movl %%eax,%0\n"
21353 - "7: rep; movsb\n"
21354 + "7: rep; "__copyuser_seg" movsb\n"
21355 "8:\n"
21356 ".section .fixup,\"ax\"\n"
21357 "9: lea 0(%%eax,%0,4),%0\n"
21358 @@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_n
21359 */
21360 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
21361 unsigned long size);
21362 -unsigned long __copy_user_intel(void __user *to, const void *from,
21363 +unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
21364 + unsigned long size);
21365 +unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
21366 unsigned long size);
21367 unsigned long __copy_user_zeroing_intel_nocache(void *to,
21368 const void __user *from, unsigned long size);
21369 #endif /* CONFIG_X86_INTEL_USERCOPY */
21370
21371 /* Generic arbitrary sized copy. */
21372 -#define __copy_user(to, from, size) \
21373 +#define __copy_user(to, from, size, prefix, set, restore) \
21374 do { \
21375 int __d0, __d1, __d2; \
21376 __asm__ __volatile__( \
21377 + set \
21378 " cmp $7,%0\n" \
21379 " jbe 1f\n" \
21380 " movl %1,%0\n" \
21381 " negl %0\n" \
21382 " andl $7,%0\n" \
21383 " subl %0,%3\n" \
21384 - "4: rep; movsb\n" \
21385 + "4: rep; "prefix"movsb\n" \
21386 " movl %3,%0\n" \
21387 " shrl $2,%0\n" \
21388 " andl $3,%3\n" \
21389 " .align 2,0x90\n" \
21390 - "0: rep; movsl\n" \
21391 + "0: rep; "prefix"movsl\n" \
21392 " movl %3,%0\n" \
21393 - "1: rep; movsb\n" \
21394 + "1: rep; "prefix"movsb\n" \
21395 "2:\n" \
21396 + restore \
21397 ".section .fixup,\"ax\"\n" \
21398 "5: addl %3,%0\n" \
21399 " jmp 2b\n" \
21400 @@ -682,14 +799,14 @@ do { \
21401 " negl %0\n" \
21402 " andl $7,%0\n" \
21403 " subl %0,%3\n" \
21404 - "4: rep; movsb\n" \
21405 + "4: rep; "__copyuser_seg"movsb\n" \
21406 " movl %3,%0\n" \
21407 " shrl $2,%0\n" \
21408 " andl $3,%3\n" \
21409 " .align 2,0x90\n" \
21410 - "0: rep; movsl\n" \
21411 + "0: rep; "__copyuser_seg"movsl\n" \
21412 " movl %3,%0\n" \
21413 - "1: rep; movsb\n" \
21414 + "1: rep; "__copyuser_seg"movsb\n" \
21415 "2:\n" \
21416 ".section .fixup,\"ax\"\n" \
21417 "5: addl %3,%0\n" \
21418 @@ -775,9 +892,9 @@ survive:
21419 }
21420 #endif
21421 if (movsl_is_ok(to, from, n))
21422 - __copy_user(to, from, n);
21423 + __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
21424 else
21425 - n = __copy_user_intel(to, from, n);
21426 + n = __generic_copy_to_user_intel(to, from, n);
21427 return n;
21428 }
21429 EXPORT_SYMBOL(__copy_to_user_ll);
21430 @@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero
21431 unsigned long n)
21432 {
21433 if (movsl_is_ok(to, from, n))
21434 - __copy_user(to, from, n);
21435 + __copy_user(to, from, n, __copyuser_seg, "", "");
21436 else
21437 - n = __copy_user_intel((void __user *)to,
21438 - (const void *)from, n);
21439 + n = __generic_copy_from_user_intel(to, from, n);
21440 return n;
21441 }
21442 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
21443 @@ -827,59 +943,38 @@ unsigned long __copy_from_user_ll_nocach
21444 if (n > 64 && cpu_has_xmm2)
21445 n = __copy_user_intel_nocache(to, from, n);
21446 else
21447 - __copy_user(to, from, n);
21448 + __copy_user(to, from, n, __copyuser_seg, "", "");
21449 #else
21450 - __copy_user(to, from, n);
21451 + __copy_user(to, from, n, __copyuser_seg, "", "");
21452 #endif
21453 return n;
21454 }
21455 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
21456
21457 -/**
21458 - * copy_to_user: - Copy a block of data into user space.
21459 - * @to: Destination address, in user space.
21460 - * @from: Source address, in kernel space.
21461 - * @n: Number of bytes to copy.
21462 - *
21463 - * Context: User context only. This function may sleep.
21464 - *
21465 - * Copy data from kernel space to user space.
21466 - *
21467 - * Returns number of bytes that could not be copied.
21468 - * On success, this will be zero.
21469 - */
21470 -unsigned long
21471 -copy_to_user(void __user *to, const void *from, unsigned long n)
21472 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21473 +void __set_fs(mm_segment_t x)
21474 {
21475 - if (access_ok(VERIFY_WRITE, to, n))
21476 - n = __copy_to_user(to, from, n);
21477 - return n;
21478 + switch (x.seg) {
21479 + case 0:
21480 + loadsegment(gs, 0);
21481 + break;
21482 + case TASK_SIZE_MAX:
21483 + loadsegment(gs, __USER_DS);
21484 + break;
21485 + case -1UL:
21486 + loadsegment(gs, __KERNEL_DS);
21487 + break;
21488 + default:
21489 + BUG();
21490 + }
21491 + return;
21492 }
21493 -EXPORT_SYMBOL(copy_to_user);
21494 +EXPORT_SYMBOL(__set_fs);
21495
21496 -/**
21497 - * copy_from_user: - Copy a block of data from user space.
21498 - * @to: Destination address, in kernel space.
21499 - * @from: Source address, in user space.
21500 - * @n: Number of bytes to copy.
21501 - *
21502 - * Context: User context only. This function may sleep.
21503 - *
21504 - * Copy data from user space to kernel space.
21505 - *
21506 - * Returns number of bytes that could not be copied.
21507 - * On success, this will be zero.
21508 - *
21509 - * If some data could not be copied, this function will pad the copied
21510 - * data to the requested size using zero bytes.
21511 - */
21512 -unsigned long
21513 -copy_from_user(void *to, const void __user *from, unsigned long n)
21514 +void set_fs(mm_segment_t x)
21515 {
21516 - if (access_ok(VERIFY_READ, from, n))
21517 - n = __copy_from_user(to, from, n);
21518 - else
21519 - memset(to, 0, n);
21520 - return n;
21521 + current_thread_info()->addr_limit = x;
21522 + __set_fs(x);
21523 }
21524 -EXPORT_SYMBOL(copy_from_user);
21525 +EXPORT_SYMBOL(set_fs);
21526 +#endif
21527 diff -urNp linux-2.6.32.46/arch/x86/lib/usercopy_64.c linux-2.6.32.46/arch/x86/lib/usercopy_64.c
21528 --- linux-2.6.32.46/arch/x86/lib/usercopy_64.c 2011-03-27 14:31:47.000000000 -0400
21529 +++ linux-2.6.32.46/arch/x86/lib/usercopy_64.c 2011-10-06 09:37:08.000000000 -0400
21530 @@ -42,6 +42,12 @@ long
21531 __strncpy_from_user(char *dst, const char __user *src, long count)
21532 {
21533 long res;
21534 +
21535 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21536 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
21537 + src += PAX_USER_SHADOW_BASE;
21538 +#endif
21539 +
21540 __do_strncpy_from_user(dst, src, count, res);
21541 return res;
21542 }
21543 @@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *
21544 {
21545 long __d0;
21546 might_fault();
21547 +
21548 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21549 + if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
21550 + addr += PAX_USER_SHADOW_BASE;
21551 +#endif
21552 +
21553 /* no memory constraint because it doesn't change any memory gcc knows
21554 about */
21555 asm volatile(
21556 @@ -151,10 +163,18 @@ EXPORT_SYMBOL(strlen_user);
21557
21558 unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
21559 {
21560 - if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
21561 - return copy_user_generic((__force void *)to, (__force void *)from, len);
21562 - }
21563 - return len;
21564 + if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
21565 +
21566 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21567 + if ((unsigned long)to < PAX_USER_SHADOW_BASE)
21568 + to += PAX_USER_SHADOW_BASE;
21569 + if ((unsigned long)from < PAX_USER_SHADOW_BASE)
21570 + from += PAX_USER_SHADOW_BASE;
21571 +#endif
21572 +
21573 + return copy_user_generic((void __force_kernel *)to, (void __force_kernel *)from, len);
21574 + }
21575 + return len;
21576 }
21577 EXPORT_SYMBOL(copy_in_user);
21578
21579 @@ -164,7 +184,7 @@ EXPORT_SYMBOL(copy_in_user);
21580 * it is not necessary to optimize tail handling.
21581 */
21582 unsigned long
21583 -copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
21584 +copy_user_handle_tail(char __user *to, char __user *from, unsigned len, unsigned zerorest)
21585 {
21586 char c;
21587 unsigned zero_len;
21588 diff -urNp linux-2.6.32.46/arch/x86/Makefile linux-2.6.32.46/arch/x86/Makefile
21589 --- linux-2.6.32.46/arch/x86/Makefile 2011-03-27 14:31:47.000000000 -0400
21590 +++ linux-2.6.32.46/arch/x86/Makefile 2011-07-19 18:16:02.000000000 -0400
21591 @@ -44,6 +44,7 @@ ifeq ($(CONFIG_X86_32),y)
21592 else
21593 BITS := 64
21594 UTS_MACHINE := x86_64
21595 + biarch := $(call cc-option,-m64)
21596 CHECKFLAGS += -D__x86_64__ -m64
21597
21598 KBUILD_AFLAGS += -m64
21599 @@ -189,3 +190,12 @@ define archhelp
21600 echo ' FDARGS="..." arguments for the booted kernel'
21601 echo ' FDINITRD=file initrd for the booted kernel'
21602 endef
21603 +
21604 +define OLD_LD
21605 +
21606 +*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
21607 +*** Please upgrade your binutils to 2.18 or newer
21608 +endef
21609 +
21610 +archprepare:
21611 + $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
21612 diff -urNp linux-2.6.32.46/arch/x86/mm/extable.c linux-2.6.32.46/arch/x86/mm/extable.c
21613 --- linux-2.6.32.46/arch/x86/mm/extable.c 2011-03-27 14:31:47.000000000 -0400
21614 +++ linux-2.6.32.46/arch/x86/mm/extable.c 2011-04-17 15:56:46.000000000 -0400
21615 @@ -1,14 +1,71 @@
21616 #include <linux/module.h>
21617 #include <linux/spinlock.h>
21618 +#include <linux/sort.h>
21619 #include <asm/uaccess.h>
21620 +#include <asm/pgtable.h>
21621
21622 +/*
21623 + * The exception table needs to be sorted so that the binary
21624 + * search that we use to find entries in it works properly.
21625 + * This is used both for the kernel exception table and for
21626 + * the exception tables of modules that get loaded.
21627 + */
21628 +static int cmp_ex(const void *a, const void *b)
21629 +{
21630 + const struct exception_table_entry *x = a, *y = b;
21631 +
21632 + /* avoid overflow */
21633 + if (x->insn > y->insn)
21634 + return 1;
21635 + if (x->insn < y->insn)
21636 + return -1;
21637 + return 0;
21638 +}
21639 +
21640 +static void swap_ex(void *a, void *b, int size)
21641 +{
21642 + struct exception_table_entry t, *x = a, *y = b;
21643 +
21644 + t = *x;
21645 +
21646 + pax_open_kernel();
21647 + *x = *y;
21648 + *y = t;
21649 + pax_close_kernel();
21650 +}
21651 +
21652 +void sort_extable(struct exception_table_entry *start,
21653 + struct exception_table_entry *finish)
21654 +{
21655 + sort(start, finish - start, sizeof(struct exception_table_entry),
21656 + cmp_ex, swap_ex);
21657 +}
21658 +
21659 +#ifdef CONFIG_MODULES
21660 +/*
21661 + * If the exception table is sorted, any referring to the module init
21662 + * will be at the beginning or the end.
21663 + */
21664 +void trim_init_extable(struct module *m)
21665 +{
21666 + /*trim the beginning*/
21667 + while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
21668 + m->extable++;
21669 + m->num_exentries--;
21670 + }
21671 + /*trim the end*/
21672 + while (m->num_exentries &&
21673 + within_module_init(m->extable[m->num_exentries-1].insn, m))
21674 + m->num_exentries--;
21675 +}
21676 +#endif /* CONFIG_MODULES */
21677
21678 int fixup_exception(struct pt_regs *regs)
21679 {
21680 const struct exception_table_entry *fixup;
21681
21682 #ifdef CONFIG_PNPBIOS
21683 - if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
21684 + if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
21685 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
21686 extern u32 pnp_bios_is_utter_crap;
21687 pnp_bios_is_utter_crap = 1;
21688 diff -urNp linux-2.6.32.46/arch/x86/mm/fault.c linux-2.6.32.46/arch/x86/mm/fault.c
21689 --- linux-2.6.32.46/arch/x86/mm/fault.c 2011-03-27 14:31:47.000000000 -0400
21690 +++ linux-2.6.32.46/arch/x86/mm/fault.c 2011-10-06 09:37:08.000000000 -0400
21691 @@ -11,10 +11,19 @@
21692 #include <linux/kprobes.h> /* __kprobes, ... */
21693 #include <linux/mmiotrace.h> /* kmmio_handler, ... */
21694 #include <linux/perf_event.h> /* perf_sw_event */
21695 +#include <linux/unistd.h>
21696 +#include <linux/compiler.h>
21697
21698 #include <asm/traps.h> /* dotraplinkage, ... */
21699 #include <asm/pgalloc.h> /* pgd_*(), ... */
21700 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
21701 +#include <asm/vsyscall.h>
21702 +#include <asm/tlbflush.h>
21703 +
21704 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21705 +#include <asm/stacktrace.h>
21706 +#include "../kernel/dumpstack.h"
21707 +#endif
21708
21709 /*
21710 * Page fault error code bits:
21711 @@ -51,7 +60,7 @@ static inline int notify_page_fault(stru
21712 int ret = 0;
21713
21714 /* kprobe_running() needs smp_processor_id() */
21715 - if (kprobes_built_in() && !user_mode_vm(regs)) {
21716 + if (kprobes_built_in() && !user_mode(regs)) {
21717 preempt_disable();
21718 if (kprobe_running() && kprobe_fault_handler(regs, 14))
21719 ret = 1;
21720 @@ -112,7 +121,10 @@ check_prefetch_opcode(struct pt_regs *re
21721 return !instr_lo || (instr_lo>>1) == 1;
21722 case 0x00:
21723 /* Prefetch instruction is 0x0F0D or 0x0F18 */
21724 - if (probe_kernel_address(instr, opcode))
21725 + if (user_mode(regs)) {
21726 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
21727 + return 0;
21728 + } else if (probe_kernel_address(instr, opcode))
21729 return 0;
21730
21731 *prefetch = (instr_lo == 0xF) &&
21732 @@ -146,7 +158,10 @@ is_prefetch(struct pt_regs *regs, unsign
21733 while (instr < max_instr) {
21734 unsigned char opcode;
21735
21736 - if (probe_kernel_address(instr, opcode))
21737 + if (user_mode(regs)) {
21738 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
21739 + break;
21740 + } else if (probe_kernel_address(instr, opcode))
21741 break;
21742
21743 instr++;
21744 @@ -172,6 +187,30 @@ force_sig_info_fault(int si_signo, int s
21745 force_sig_info(si_signo, &info, tsk);
21746 }
21747
21748 +#ifdef CONFIG_PAX_EMUTRAMP
21749 +static int pax_handle_fetch_fault(struct pt_regs *regs);
21750 +#endif
21751 +
21752 +#ifdef CONFIG_PAX_PAGEEXEC
21753 +static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
21754 +{
21755 + pgd_t *pgd;
21756 + pud_t *pud;
21757 + pmd_t *pmd;
21758 +
21759 + pgd = pgd_offset(mm, address);
21760 + if (!pgd_present(*pgd))
21761 + return NULL;
21762 + pud = pud_offset(pgd, address);
21763 + if (!pud_present(*pud))
21764 + return NULL;
21765 + pmd = pmd_offset(pud, address);
21766 + if (!pmd_present(*pmd))
21767 + return NULL;
21768 + return pmd;
21769 +}
21770 +#endif
21771 +
21772 DEFINE_SPINLOCK(pgd_lock);
21773 LIST_HEAD(pgd_list);
21774
21775 @@ -224,11 +263,24 @@ void vmalloc_sync_all(void)
21776 address += PMD_SIZE) {
21777
21778 unsigned long flags;
21779 +
21780 +#ifdef CONFIG_PAX_PER_CPU_PGD
21781 + unsigned long cpu;
21782 +#else
21783 struct page *page;
21784 +#endif
21785
21786 spin_lock_irqsave(&pgd_lock, flags);
21787 +
21788 +#ifdef CONFIG_PAX_PER_CPU_PGD
21789 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
21790 + pgd_t *pgd = get_cpu_pgd(cpu);
21791 +#else
21792 list_for_each_entry(page, &pgd_list, lru) {
21793 - if (!vmalloc_sync_one(page_address(page), address))
21794 + pgd_t *pgd = page_address(page);
21795 +#endif
21796 +
21797 + if (!vmalloc_sync_one(pgd, address))
21798 break;
21799 }
21800 spin_unlock_irqrestore(&pgd_lock, flags);
21801 @@ -258,6 +310,11 @@ static noinline int vmalloc_fault(unsign
21802 * an interrupt in the middle of a task switch..
21803 */
21804 pgd_paddr = read_cr3();
21805 +
21806 +#ifdef CONFIG_PAX_PER_CPU_PGD
21807 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
21808 +#endif
21809 +
21810 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
21811 if (!pmd_k)
21812 return -1;
21813 @@ -332,15 +389,27 @@ void vmalloc_sync_all(void)
21814
21815 const pgd_t *pgd_ref = pgd_offset_k(address);
21816 unsigned long flags;
21817 +
21818 +#ifdef CONFIG_PAX_PER_CPU_PGD
21819 + unsigned long cpu;
21820 +#else
21821 struct page *page;
21822 +#endif
21823
21824 if (pgd_none(*pgd_ref))
21825 continue;
21826
21827 spin_lock_irqsave(&pgd_lock, flags);
21828 +
21829 +#ifdef CONFIG_PAX_PER_CPU_PGD
21830 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
21831 + pgd_t *pgd = pgd_offset_cpu(cpu, address);
21832 +#else
21833 list_for_each_entry(page, &pgd_list, lru) {
21834 pgd_t *pgd;
21835 pgd = (pgd_t *)page_address(page) + pgd_index(address);
21836 +#endif
21837 +
21838 if (pgd_none(*pgd))
21839 set_pgd(pgd, *pgd_ref);
21840 else
21841 @@ -373,7 +442,14 @@ static noinline int vmalloc_fault(unsign
21842 * happen within a race in page table update. In the later
21843 * case just flush:
21844 */
21845 +
21846 +#ifdef CONFIG_PAX_PER_CPU_PGD
21847 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
21848 + pgd = pgd_offset_cpu(smp_processor_id(), address);
21849 +#else
21850 pgd = pgd_offset(current->active_mm, address);
21851 +#endif
21852 +
21853 pgd_ref = pgd_offset_k(address);
21854 if (pgd_none(*pgd_ref))
21855 return -1;
21856 @@ -535,7 +611,7 @@ static int is_errata93(struct pt_regs *r
21857 static int is_errata100(struct pt_regs *regs, unsigned long address)
21858 {
21859 #ifdef CONFIG_X86_64
21860 - if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
21861 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
21862 return 1;
21863 #endif
21864 return 0;
21865 @@ -562,7 +638,7 @@ static int is_f00f_bug(struct pt_regs *r
21866 }
21867
21868 static const char nx_warning[] = KERN_CRIT
21869 -"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
21870 +"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
21871
21872 static void
21873 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
21874 @@ -571,15 +647,26 @@ show_fault_oops(struct pt_regs *regs, un
21875 if (!oops_may_print())
21876 return;
21877
21878 - if (error_code & PF_INSTR) {
21879 + if (nx_enabled && (error_code & PF_INSTR)) {
21880 unsigned int level;
21881
21882 pte_t *pte = lookup_address(address, &level);
21883
21884 if (pte && pte_present(*pte) && !pte_exec(*pte))
21885 - printk(nx_warning, current_uid());
21886 + printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
21887 }
21888
21889 +#ifdef CONFIG_PAX_KERNEXEC
21890 + if (init_mm.start_code <= address && address < init_mm.end_code) {
21891 + if (current->signal->curr_ip)
21892 + printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21893 + &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
21894 + else
21895 + printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21896 + current->comm, task_pid_nr(current), current_uid(), current_euid());
21897 + }
21898 +#endif
21899 +
21900 printk(KERN_ALERT "BUG: unable to handle kernel ");
21901 if (address < PAGE_SIZE)
21902 printk(KERN_CONT "NULL pointer dereference");
21903 @@ -704,6 +791,70 @@ __bad_area_nosemaphore(struct pt_regs *r
21904 unsigned long address, int si_code)
21905 {
21906 struct task_struct *tsk = current;
21907 +#if defined(CONFIG_X86_64) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21908 + struct mm_struct *mm = tsk->mm;
21909 +#endif
21910 +
21911 +#ifdef CONFIG_X86_64
21912 + if (mm && (error_code & PF_INSTR) && mm->context.vdso) {
21913 + if (regs->ip == (unsigned long)vgettimeofday) {
21914 + regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
21915 + return;
21916 + } else if (regs->ip == (unsigned long)vtime) {
21917 + regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
21918 + return;
21919 + } else if (regs->ip == (unsigned long)vgetcpu) {
21920 + regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
21921 + return;
21922 + }
21923 + }
21924 +#endif
21925 +
21926 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21927 + if (mm && (error_code & PF_USER)) {
21928 + unsigned long ip = regs->ip;
21929 +
21930 + if (v8086_mode(regs))
21931 + ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
21932 +
21933 + /*
21934 + * It's possible to have interrupts off here:
21935 + */
21936 + local_irq_enable();
21937 +
21938 +#ifdef CONFIG_PAX_PAGEEXEC
21939 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
21940 + ((nx_enabled && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && ip == address))) {
21941 +
21942 +#ifdef CONFIG_PAX_EMUTRAMP
21943 + switch (pax_handle_fetch_fault(regs)) {
21944 + case 2:
21945 + return;
21946 + }
21947 +#endif
21948 +
21949 + pax_report_fault(regs, (void *)ip, (void *)regs->sp);
21950 + do_group_exit(SIGKILL);
21951 + }
21952 +#endif
21953 +
21954 +#ifdef CONFIG_PAX_SEGMEXEC
21955 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address)) {
21956 +
21957 +#ifdef CONFIG_PAX_EMUTRAMP
21958 + switch (pax_handle_fetch_fault(regs)) {
21959 + case 2:
21960 + return;
21961 + }
21962 +#endif
21963 +
21964 + pax_report_fault(regs, (void *)ip, (void *)regs->sp);
21965 + do_group_exit(SIGKILL);
21966 + }
21967 +#endif
21968 +
21969 + }
21970 +#endif
21971
21972 /* User mode accesses just cause a SIGSEGV */
21973 if (error_code & PF_USER) {
21974 @@ -857,6 +1008,99 @@ static int spurious_fault_check(unsigned
21975 return 1;
21976 }
21977
21978 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21979 +static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
21980 +{
21981 + pte_t *pte;
21982 + pmd_t *pmd;
21983 + spinlock_t *ptl;
21984 + unsigned char pte_mask;
21985 +
21986 + if (nx_enabled || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
21987 + !(mm->pax_flags & MF_PAX_PAGEEXEC))
21988 + return 0;
21989 +
21990 + /* PaX: it's our fault, let's handle it if we can */
21991 +
21992 + /* PaX: take a look at read faults before acquiring any locks */
21993 + if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
21994 + /* instruction fetch attempt from a protected page in user mode */
21995 + up_read(&mm->mmap_sem);
21996 +
21997 +#ifdef CONFIG_PAX_EMUTRAMP
21998 + switch (pax_handle_fetch_fault(regs)) {
21999 + case 2:
22000 + return 1;
22001 + }
22002 +#endif
22003 +
22004 + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
22005 + do_group_exit(SIGKILL);
22006 + }
22007 +
22008 + pmd = pax_get_pmd(mm, address);
22009 + if (unlikely(!pmd))
22010 + return 0;
22011 +
22012 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
22013 + if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
22014 + pte_unmap_unlock(pte, ptl);
22015 + return 0;
22016 + }
22017 +
22018 + if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
22019 + /* write attempt to a protected page in user mode */
22020 + pte_unmap_unlock(pte, ptl);
22021 + return 0;
22022 + }
22023 +
22024 +#ifdef CONFIG_SMP
22025 + if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
22026 +#else
22027 + if (likely(address > get_limit(regs->cs)))
22028 +#endif
22029 + {
22030 + set_pte(pte, pte_mkread(*pte));
22031 + __flush_tlb_one(address);
22032 + pte_unmap_unlock(pte, ptl);
22033 + up_read(&mm->mmap_sem);
22034 + return 1;
22035 + }
22036 +
22037 + pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
22038 +
22039 + /*
22040 + * PaX: fill DTLB with user rights and retry
22041 + */
22042 + __asm__ __volatile__ (
22043 + "orb %2,(%1)\n"
22044 +#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
22045 +/*
22046 + * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
22047 + * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
22048 + * page fault when examined during a TLB load attempt. this is true not only
22049 + * for PTEs holding a non-present entry but also present entries that will
22050 + * raise a page fault (such as those set up by PaX, or the copy-on-write
22051 + * mechanism). in effect it means that we do *not* need to flush the TLBs
22052 + * for our target pages since their PTEs are simply not in the TLBs at all.
22053 +
22054 + * the best thing in omitting it is that we gain around 15-20% speed in the
22055 + * fast path of the page fault handler and can get rid of tracing since we
22056 + * can no longer flush unintended entries.
22057 + */
22058 + "invlpg (%0)\n"
22059 +#endif
22060 + __copyuser_seg"testb $0,(%0)\n"
22061 + "xorb %3,(%1)\n"
22062 + :
22063 + : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
22064 + : "memory", "cc");
22065 + pte_unmap_unlock(pte, ptl);
22066 + up_read(&mm->mmap_sem);
22067 + return 1;
22068 +}
22069 +#endif
22070 +
22071 /*
22072 * Handle a spurious fault caused by a stale TLB entry.
22073 *
22074 @@ -923,6 +1167,9 @@ int show_unhandled_signals = 1;
22075 static inline int
22076 access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
22077 {
22078 + if (nx_enabled && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
22079 + return 1;
22080 +
22081 if (write) {
22082 /* write, present and write, not present: */
22083 if (unlikely(!(vma->vm_flags & VM_WRITE)))
22084 @@ -956,17 +1203,31 @@ do_page_fault(struct pt_regs *regs, unsi
22085 {
22086 struct vm_area_struct *vma;
22087 struct task_struct *tsk;
22088 - unsigned long address;
22089 struct mm_struct *mm;
22090 int write;
22091 int fault;
22092
22093 + /* Get the faulting address: */
22094 + unsigned long address = read_cr2();
22095 +
22096 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22097 + if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
22098 + if (!search_exception_tables(regs->ip)) {
22099 + bad_area_nosemaphore(regs, error_code, address);
22100 + return;
22101 + }
22102 + if (address < PAX_USER_SHADOW_BASE) {
22103 + printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
22104 + printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip);
22105 + show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
22106 + } else
22107 + address -= PAX_USER_SHADOW_BASE;
22108 + }
22109 +#endif
22110 +
22111 tsk = current;
22112 mm = tsk->mm;
22113
22114 - /* Get the faulting address: */
22115 - address = read_cr2();
22116 -
22117 /*
22118 * Detect and handle instructions that would cause a page fault for
22119 * both a tracked kernel page and a userspace page.
22120 @@ -1026,7 +1287,7 @@ do_page_fault(struct pt_regs *regs, unsi
22121 * User-mode registers count as a user access even for any
22122 * potential system fault or CPU buglet:
22123 */
22124 - if (user_mode_vm(regs)) {
22125 + if (user_mode(regs)) {
22126 local_irq_enable();
22127 error_code |= PF_USER;
22128 } else {
22129 @@ -1080,6 +1341,11 @@ do_page_fault(struct pt_regs *regs, unsi
22130 might_sleep();
22131 }
22132
22133 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
22134 + if (pax_handle_pageexec_fault(regs, mm, address, error_code))
22135 + return;
22136 +#endif
22137 +
22138 vma = find_vma(mm, address);
22139 if (unlikely(!vma)) {
22140 bad_area(regs, error_code, address);
22141 @@ -1091,18 +1357,24 @@ do_page_fault(struct pt_regs *regs, unsi
22142 bad_area(regs, error_code, address);
22143 return;
22144 }
22145 - if (error_code & PF_USER) {
22146 - /*
22147 - * Accessing the stack below %sp is always a bug.
22148 - * The large cushion allows instructions like enter
22149 - * and pusha to work. ("enter $65535, $31" pushes
22150 - * 32 pointers and then decrements %sp by 65535.)
22151 - */
22152 - if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
22153 - bad_area(regs, error_code, address);
22154 - return;
22155 - }
22156 + /*
22157 + * Accessing the stack below %sp is always a bug.
22158 + * The large cushion allows instructions like enter
22159 + * and pusha to work. ("enter $65535, $31" pushes
22160 + * 32 pointers and then decrements %sp by 65535.)
22161 + */
22162 + if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
22163 + bad_area(regs, error_code, address);
22164 + return;
22165 }
22166 +
22167 +#ifdef CONFIG_PAX_SEGMEXEC
22168 + if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
22169 + bad_area(regs, error_code, address);
22170 + return;
22171 + }
22172 +#endif
22173 +
22174 if (unlikely(expand_stack(vma, address))) {
22175 bad_area(regs, error_code, address);
22176 return;
22177 @@ -1146,3 +1418,199 @@ good_area:
22178
22179 up_read(&mm->mmap_sem);
22180 }
22181 +
22182 +#ifdef CONFIG_PAX_EMUTRAMP
22183 +static int pax_handle_fetch_fault_32(struct pt_regs *regs)
22184 +{
22185 + int err;
22186 +
22187 + do { /* PaX: gcc trampoline emulation #1 */
22188 + unsigned char mov1, mov2;
22189 + unsigned short jmp;
22190 + unsigned int addr1, addr2;
22191 +
22192 +#ifdef CONFIG_X86_64
22193 + if ((regs->ip + 11) >> 32)
22194 + break;
22195 +#endif
22196 +
22197 + err = get_user(mov1, (unsigned char __user *)regs->ip);
22198 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
22199 + err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
22200 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
22201 + err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
22202 +
22203 + if (err)
22204 + break;
22205 +
22206 + if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
22207 + regs->cx = addr1;
22208 + regs->ax = addr2;
22209 + regs->ip = addr2;
22210 + return 2;
22211 + }
22212 + } while (0);
22213 +
22214 + do { /* PaX: gcc trampoline emulation #2 */
22215 + unsigned char mov, jmp;
22216 + unsigned int addr1, addr2;
22217 +
22218 +#ifdef CONFIG_X86_64
22219 + if ((regs->ip + 9) >> 32)
22220 + break;
22221 +#endif
22222 +
22223 + err = get_user(mov, (unsigned char __user *)regs->ip);
22224 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
22225 + err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
22226 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
22227 +
22228 + if (err)
22229 + break;
22230 +
22231 + if (mov == 0xB9 && jmp == 0xE9) {
22232 + regs->cx = addr1;
22233 + regs->ip = (unsigned int)(regs->ip + addr2 + 10);
22234 + return 2;
22235 + }
22236 + } while (0);
22237 +
22238 + return 1; /* PaX in action */
22239 +}
22240 +
22241 +#ifdef CONFIG_X86_64
22242 +static int pax_handle_fetch_fault_64(struct pt_regs *regs)
22243 +{
22244 + int err;
22245 +
22246 + do { /* PaX: gcc trampoline emulation #1 */
22247 + unsigned short mov1, mov2, jmp1;
22248 + unsigned char jmp2;
22249 + unsigned int addr1;
22250 + unsigned long addr2;
22251 +
22252 + err = get_user(mov1, (unsigned short __user *)regs->ip);
22253 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
22254 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
22255 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
22256 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
22257 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
22258 +
22259 + if (err)
22260 + break;
22261 +
22262 + if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
22263 + regs->r11 = addr1;
22264 + regs->r10 = addr2;
22265 + regs->ip = addr1;
22266 + return 2;
22267 + }
22268 + } while (0);
22269 +
22270 + do { /* PaX: gcc trampoline emulation #2 */
22271 + unsigned short mov1, mov2, jmp1;
22272 + unsigned char jmp2;
22273 + unsigned long addr1, addr2;
22274 +
22275 + err = get_user(mov1, (unsigned short __user *)regs->ip);
22276 + err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
22277 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
22278 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
22279 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
22280 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
22281 +
22282 + if (err)
22283 + break;
22284 +
22285 + if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
22286 + regs->r11 = addr1;
22287 + regs->r10 = addr2;
22288 + regs->ip = addr1;
22289 + return 2;
22290 + }
22291 + } while (0);
22292 +
22293 + return 1; /* PaX in action */
22294 +}
22295 +#endif
22296 +
22297 +/*
22298 + * PaX: decide what to do with offenders (regs->ip = fault address)
22299 + *
22300 + * returns 1 when task should be killed
22301 + * 2 when gcc trampoline was detected
22302 + */
22303 +static int pax_handle_fetch_fault(struct pt_regs *regs)
22304 +{
22305 + if (v8086_mode(regs))
22306 + return 1;
22307 +
22308 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
22309 + return 1;
22310 +
22311 +#ifdef CONFIG_X86_32
22312 + return pax_handle_fetch_fault_32(regs);
22313 +#else
22314 + if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
22315 + return pax_handle_fetch_fault_32(regs);
22316 + else
22317 + return pax_handle_fetch_fault_64(regs);
22318 +#endif
22319 +}
22320 +#endif
22321 +
22322 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22323 +void pax_report_insns(void *pc, void *sp)
22324 +{
22325 + long i;
22326 +
22327 + printk(KERN_ERR "PAX: bytes at PC: ");
22328 + for (i = 0; i < 20; i++) {
22329 + unsigned char c;
22330 + if (get_user(c, (unsigned char __force_user *)pc+i))
22331 + printk(KERN_CONT "?? ");
22332 + else
22333 + printk(KERN_CONT "%02x ", c);
22334 + }
22335 + printk("\n");
22336 +
22337 + printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
22338 + for (i = -1; i < 80 / (long)sizeof(long); i++) {
22339 + unsigned long c;
22340 + if (get_user(c, (unsigned long __force_user *)sp+i))
22341 +#ifdef CONFIG_X86_32
22342 + printk(KERN_CONT "???????? ");
22343 +#else
22344 + printk(KERN_CONT "???????????????? ");
22345 +#endif
22346 + else
22347 + printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
22348 + }
22349 + printk("\n");
22350 +}
22351 +#endif
22352 +
22353 +/**
22354 + * probe_kernel_write(): safely attempt to write to a location
22355 + * @dst: address to write to
22356 + * @src: pointer to the data that shall be written
22357 + * @size: size of the data chunk
22358 + *
22359 + * Safely write to address @dst from the buffer at @src. If a kernel fault
22360 + * happens, handle that and return -EFAULT.
22361 + */
22362 +long notrace probe_kernel_write(void *dst, const void *src, size_t size)
22363 +{
22364 + long ret;
22365 + mm_segment_t old_fs = get_fs();
22366 +
22367 + set_fs(KERNEL_DS);
22368 + pagefault_disable();
22369 + pax_open_kernel();
22370 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
22371 + pax_close_kernel();
22372 + pagefault_enable();
22373 + set_fs(old_fs);
22374 +
22375 + return ret ? -EFAULT : 0;
22376 +}
22377 diff -urNp linux-2.6.32.46/arch/x86/mm/gup.c linux-2.6.32.46/arch/x86/mm/gup.c
22378 --- linux-2.6.32.46/arch/x86/mm/gup.c 2011-03-27 14:31:47.000000000 -0400
22379 +++ linux-2.6.32.46/arch/x86/mm/gup.c 2011-04-17 15:56:46.000000000 -0400
22380 @@ -237,7 +237,7 @@ int __get_user_pages_fast(unsigned long
22381 addr = start;
22382 len = (unsigned long) nr_pages << PAGE_SHIFT;
22383 end = start + len;
22384 - if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
22385 + if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
22386 (void __user *)start, len)))
22387 return 0;
22388
22389 diff -urNp linux-2.6.32.46/arch/x86/mm/highmem_32.c linux-2.6.32.46/arch/x86/mm/highmem_32.c
22390 --- linux-2.6.32.46/arch/x86/mm/highmem_32.c 2011-03-27 14:31:47.000000000 -0400
22391 +++ linux-2.6.32.46/arch/x86/mm/highmem_32.c 2011-04-17 15:56:46.000000000 -0400
22392 @@ -43,7 +43,10 @@ void *kmap_atomic_prot(struct page *page
22393 idx = type + KM_TYPE_NR*smp_processor_id();
22394 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22395 BUG_ON(!pte_none(*(kmap_pte-idx)));
22396 +
22397 + pax_open_kernel();
22398 set_pte(kmap_pte-idx, mk_pte(page, prot));
22399 + pax_close_kernel();
22400
22401 return (void *)vaddr;
22402 }
22403 diff -urNp linux-2.6.32.46/arch/x86/mm/hugetlbpage.c linux-2.6.32.46/arch/x86/mm/hugetlbpage.c
22404 --- linux-2.6.32.46/arch/x86/mm/hugetlbpage.c 2011-03-27 14:31:47.000000000 -0400
22405 +++ linux-2.6.32.46/arch/x86/mm/hugetlbpage.c 2011-04-17 15:56:46.000000000 -0400
22406 @@ -267,13 +267,20 @@ static unsigned long hugetlb_get_unmappe
22407 struct hstate *h = hstate_file(file);
22408 struct mm_struct *mm = current->mm;
22409 struct vm_area_struct *vma;
22410 - unsigned long start_addr;
22411 + unsigned long start_addr, pax_task_size = TASK_SIZE;
22412 +
22413 +#ifdef CONFIG_PAX_SEGMEXEC
22414 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
22415 + pax_task_size = SEGMEXEC_TASK_SIZE;
22416 +#endif
22417 +
22418 + pax_task_size -= PAGE_SIZE;
22419
22420 if (len > mm->cached_hole_size) {
22421 - start_addr = mm->free_area_cache;
22422 + start_addr = mm->free_area_cache;
22423 } else {
22424 - start_addr = TASK_UNMAPPED_BASE;
22425 - mm->cached_hole_size = 0;
22426 + start_addr = mm->mmap_base;
22427 + mm->cached_hole_size = 0;
22428 }
22429
22430 full_search:
22431 @@ -281,26 +288,27 @@ full_search:
22432
22433 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
22434 /* At this point: (!vma || addr < vma->vm_end). */
22435 - if (TASK_SIZE - len < addr) {
22436 + if (pax_task_size - len < addr) {
22437 /*
22438 * Start a new search - just in case we missed
22439 * some holes.
22440 */
22441 - if (start_addr != TASK_UNMAPPED_BASE) {
22442 - start_addr = TASK_UNMAPPED_BASE;
22443 + if (start_addr != mm->mmap_base) {
22444 + start_addr = mm->mmap_base;
22445 mm->cached_hole_size = 0;
22446 goto full_search;
22447 }
22448 return -ENOMEM;
22449 }
22450 - if (!vma || addr + len <= vma->vm_start) {
22451 - mm->free_area_cache = addr + len;
22452 - return addr;
22453 - }
22454 + if (check_heap_stack_gap(vma, addr, len))
22455 + break;
22456 if (addr + mm->cached_hole_size < vma->vm_start)
22457 mm->cached_hole_size = vma->vm_start - addr;
22458 addr = ALIGN(vma->vm_end, huge_page_size(h));
22459 }
22460 +
22461 + mm->free_area_cache = addr + len;
22462 + return addr;
22463 }
22464
22465 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
22466 @@ -309,10 +317,9 @@ static unsigned long hugetlb_get_unmappe
22467 {
22468 struct hstate *h = hstate_file(file);
22469 struct mm_struct *mm = current->mm;
22470 - struct vm_area_struct *vma, *prev_vma;
22471 - unsigned long base = mm->mmap_base, addr = addr0;
22472 + struct vm_area_struct *vma;
22473 + unsigned long base = mm->mmap_base, addr;
22474 unsigned long largest_hole = mm->cached_hole_size;
22475 - int first_time = 1;
22476
22477 /* don't allow allocations above current base */
22478 if (mm->free_area_cache > base)
22479 @@ -322,64 +329,63 @@ static unsigned long hugetlb_get_unmappe
22480 largest_hole = 0;
22481 mm->free_area_cache = base;
22482 }
22483 -try_again:
22484 +
22485 /* make sure it can fit in the remaining address space */
22486 if (mm->free_area_cache < len)
22487 goto fail;
22488
22489 /* either no address requested or cant fit in requested address hole */
22490 - addr = (mm->free_area_cache - len) & huge_page_mask(h);
22491 + addr = (mm->free_area_cache - len);
22492 do {
22493 + addr &= huge_page_mask(h);
22494 + vma = find_vma(mm, addr);
22495 /*
22496 * Lookup failure means no vma is above this address,
22497 * i.e. return with success:
22498 - */
22499 - if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
22500 - return addr;
22501 -
22502 - /*
22503 * new region fits between prev_vma->vm_end and
22504 * vma->vm_start, use it:
22505 */
22506 - if (addr + len <= vma->vm_start &&
22507 - (!prev_vma || (addr >= prev_vma->vm_end))) {
22508 + if (check_heap_stack_gap(vma, addr, len)) {
22509 /* remember the address as a hint for next time */
22510 - mm->cached_hole_size = largest_hole;
22511 - return (mm->free_area_cache = addr);
22512 - } else {
22513 - /* pull free_area_cache down to the first hole */
22514 - if (mm->free_area_cache == vma->vm_end) {
22515 - mm->free_area_cache = vma->vm_start;
22516 - mm->cached_hole_size = largest_hole;
22517 - }
22518 + mm->cached_hole_size = largest_hole;
22519 + return (mm->free_area_cache = addr);
22520 + }
22521 + /* pull free_area_cache down to the first hole */
22522 + if (mm->free_area_cache == vma->vm_end) {
22523 + mm->free_area_cache = vma->vm_start;
22524 + mm->cached_hole_size = largest_hole;
22525 }
22526
22527 /* remember the largest hole we saw so far */
22528 if (addr + largest_hole < vma->vm_start)
22529 - largest_hole = vma->vm_start - addr;
22530 + largest_hole = vma->vm_start - addr;
22531
22532 /* try just below the current vma->vm_start */
22533 - addr = (vma->vm_start - len) & huge_page_mask(h);
22534 - } while (len <= vma->vm_start);
22535 + addr = skip_heap_stack_gap(vma, len);
22536 + } while (!IS_ERR_VALUE(addr));
22537
22538 fail:
22539 /*
22540 - * if hint left us with no space for the requested
22541 - * mapping then try again:
22542 - */
22543 - if (first_time) {
22544 - mm->free_area_cache = base;
22545 - largest_hole = 0;
22546 - first_time = 0;
22547 - goto try_again;
22548 - }
22549 - /*
22550 * A failed mmap() very likely causes application failure,
22551 * so fall back to the bottom-up function here. This scenario
22552 * can happen with large stack limits and large mmap()
22553 * allocations.
22554 */
22555 - mm->free_area_cache = TASK_UNMAPPED_BASE;
22556 +
22557 +#ifdef CONFIG_PAX_SEGMEXEC
22558 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
22559 + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
22560 + else
22561 +#endif
22562 +
22563 + mm->mmap_base = TASK_UNMAPPED_BASE;
22564 +
22565 +#ifdef CONFIG_PAX_RANDMMAP
22566 + if (mm->pax_flags & MF_PAX_RANDMMAP)
22567 + mm->mmap_base += mm->delta_mmap;
22568 +#endif
22569 +
22570 + mm->free_area_cache = mm->mmap_base;
22571 mm->cached_hole_size = ~0UL;
22572 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
22573 len, pgoff, flags);
22574 @@ -387,6 +393,7 @@ fail:
22575 /*
22576 * Restore the topdown base:
22577 */
22578 + mm->mmap_base = base;
22579 mm->free_area_cache = base;
22580 mm->cached_hole_size = ~0UL;
22581
22582 @@ -400,10 +407,19 @@ hugetlb_get_unmapped_area(struct file *f
22583 struct hstate *h = hstate_file(file);
22584 struct mm_struct *mm = current->mm;
22585 struct vm_area_struct *vma;
22586 + unsigned long pax_task_size = TASK_SIZE;
22587
22588 if (len & ~huge_page_mask(h))
22589 return -EINVAL;
22590 - if (len > TASK_SIZE)
22591 +
22592 +#ifdef CONFIG_PAX_SEGMEXEC
22593 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
22594 + pax_task_size = SEGMEXEC_TASK_SIZE;
22595 +#endif
22596 +
22597 + pax_task_size -= PAGE_SIZE;
22598 +
22599 + if (len > pax_task_size)
22600 return -ENOMEM;
22601
22602 if (flags & MAP_FIXED) {
22603 @@ -415,8 +431,7 @@ hugetlb_get_unmapped_area(struct file *f
22604 if (addr) {
22605 addr = ALIGN(addr, huge_page_size(h));
22606 vma = find_vma(mm, addr);
22607 - if (TASK_SIZE - len >= addr &&
22608 - (!vma || addr + len <= vma->vm_start))
22609 + if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
22610 return addr;
22611 }
22612 if (mm->get_unmapped_area == arch_get_unmapped_area)
22613 diff -urNp linux-2.6.32.46/arch/x86/mm/init_32.c linux-2.6.32.46/arch/x86/mm/init_32.c
22614 --- linux-2.6.32.46/arch/x86/mm/init_32.c 2011-03-27 14:31:47.000000000 -0400
22615 +++ linux-2.6.32.46/arch/x86/mm/init_32.c 2011-04-17 15:56:46.000000000 -0400
22616 @@ -72,36 +72,6 @@ static __init void *alloc_low_page(void)
22617 }
22618
22619 /*
22620 - * Creates a middle page table and puts a pointer to it in the
22621 - * given global directory entry. This only returns the gd entry
22622 - * in non-PAE compilation mode, since the middle layer is folded.
22623 - */
22624 -static pmd_t * __init one_md_table_init(pgd_t *pgd)
22625 -{
22626 - pud_t *pud;
22627 - pmd_t *pmd_table;
22628 -
22629 -#ifdef CONFIG_X86_PAE
22630 - if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
22631 - if (after_bootmem)
22632 - pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
22633 - else
22634 - pmd_table = (pmd_t *)alloc_low_page();
22635 - paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
22636 - set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
22637 - pud = pud_offset(pgd, 0);
22638 - BUG_ON(pmd_table != pmd_offset(pud, 0));
22639 -
22640 - return pmd_table;
22641 - }
22642 -#endif
22643 - pud = pud_offset(pgd, 0);
22644 - pmd_table = pmd_offset(pud, 0);
22645 -
22646 - return pmd_table;
22647 -}
22648 -
22649 -/*
22650 * Create a page table and place a pointer to it in a middle page
22651 * directory entry:
22652 */
22653 @@ -121,13 +91,28 @@ static pte_t * __init one_page_table_ini
22654 page_table = (pte_t *)alloc_low_page();
22655
22656 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
22657 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22658 + set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
22659 +#else
22660 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
22661 +#endif
22662 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
22663 }
22664
22665 return pte_offset_kernel(pmd, 0);
22666 }
22667
22668 +static pmd_t * __init one_md_table_init(pgd_t *pgd)
22669 +{
22670 + pud_t *pud;
22671 + pmd_t *pmd_table;
22672 +
22673 + pud = pud_offset(pgd, 0);
22674 + pmd_table = pmd_offset(pud, 0);
22675 +
22676 + return pmd_table;
22677 +}
22678 +
22679 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
22680 {
22681 int pgd_idx = pgd_index(vaddr);
22682 @@ -201,6 +186,7 @@ page_table_range_init(unsigned long star
22683 int pgd_idx, pmd_idx;
22684 unsigned long vaddr;
22685 pgd_t *pgd;
22686 + pud_t *pud;
22687 pmd_t *pmd;
22688 pte_t *pte = NULL;
22689
22690 @@ -210,8 +196,13 @@ page_table_range_init(unsigned long star
22691 pgd = pgd_base + pgd_idx;
22692
22693 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
22694 - pmd = one_md_table_init(pgd);
22695 - pmd = pmd + pmd_index(vaddr);
22696 + pud = pud_offset(pgd, vaddr);
22697 + pmd = pmd_offset(pud, vaddr);
22698 +
22699 +#ifdef CONFIG_X86_PAE
22700 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
22701 +#endif
22702 +
22703 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
22704 pmd++, pmd_idx++) {
22705 pte = page_table_kmap_check(one_page_table_init(pmd),
22706 @@ -223,11 +214,20 @@ page_table_range_init(unsigned long star
22707 }
22708 }
22709
22710 -static inline int is_kernel_text(unsigned long addr)
22711 +static inline int is_kernel_text(unsigned long start, unsigned long end)
22712 {
22713 - if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
22714 - return 1;
22715 - return 0;
22716 + if ((start > ktla_ktva((unsigned long)_etext) ||
22717 + end <= ktla_ktva((unsigned long)_stext)) &&
22718 + (start > ktla_ktva((unsigned long)_einittext) ||
22719 + end <= ktla_ktva((unsigned long)_sinittext)) &&
22720 +
22721 +#ifdef CONFIG_ACPI_SLEEP
22722 + (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
22723 +#endif
22724 +
22725 + (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
22726 + return 0;
22727 + return 1;
22728 }
22729
22730 /*
22731 @@ -243,9 +243,10 @@ kernel_physical_mapping_init(unsigned lo
22732 int use_pse = page_size_mask == (1<<PG_LEVEL_2M);
22733 unsigned long start_pfn, end_pfn;
22734 pgd_t *pgd_base = swapper_pg_dir;
22735 - int pgd_idx, pmd_idx, pte_ofs;
22736 + unsigned int pgd_idx, pmd_idx, pte_ofs;
22737 unsigned long pfn;
22738 pgd_t *pgd;
22739 + pud_t *pud;
22740 pmd_t *pmd;
22741 pte_t *pte;
22742 unsigned pages_2m, pages_4k;
22743 @@ -278,8 +279,13 @@ repeat:
22744 pfn = start_pfn;
22745 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22746 pgd = pgd_base + pgd_idx;
22747 - for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
22748 - pmd = one_md_table_init(pgd);
22749 + for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
22750 + pud = pud_offset(pgd, 0);
22751 + pmd = pmd_offset(pud, 0);
22752 +
22753 +#ifdef CONFIG_X86_PAE
22754 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
22755 +#endif
22756
22757 if (pfn >= end_pfn)
22758 continue;
22759 @@ -291,14 +297,13 @@ repeat:
22760 #endif
22761 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
22762 pmd++, pmd_idx++) {
22763 - unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
22764 + unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
22765
22766 /*
22767 * Map with big pages if possible, otherwise
22768 * create normal page tables:
22769 */
22770 if (use_pse) {
22771 - unsigned int addr2;
22772 pgprot_t prot = PAGE_KERNEL_LARGE;
22773 /*
22774 * first pass will use the same initial
22775 @@ -308,11 +313,7 @@ repeat:
22776 __pgprot(PTE_IDENT_ATTR |
22777 _PAGE_PSE);
22778
22779 - addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
22780 - PAGE_OFFSET + PAGE_SIZE-1;
22781 -
22782 - if (is_kernel_text(addr) ||
22783 - is_kernel_text(addr2))
22784 + if (is_kernel_text(address, address + PMD_SIZE))
22785 prot = PAGE_KERNEL_LARGE_EXEC;
22786
22787 pages_2m++;
22788 @@ -329,7 +330,7 @@ repeat:
22789 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
22790 pte += pte_ofs;
22791 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
22792 - pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
22793 + pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
22794 pgprot_t prot = PAGE_KERNEL;
22795 /*
22796 * first pass will use the same initial
22797 @@ -337,7 +338,7 @@ repeat:
22798 */
22799 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
22800
22801 - if (is_kernel_text(addr))
22802 + if (is_kernel_text(address, address + PAGE_SIZE))
22803 prot = PAGE_KERNEL_EXEC;
22804
22805 pages_4k++;
22806 @@ -489,7 +490,7 @@ void __init native_pagetable_setup_start
22807
22808 pud = pud_offset(pgd, va);
22809 pmd = pmd_offset(pud, va);
22810 - if (!pmd_present(*pmd))
22811 + if (!pmd_present(*pmd) || pmd_huge(*pmd))
22812 break;
22813
22814 pte = pte_offset_kernel(pmd, va);
22815 @@ -541,9 +542,7 @@ void __init early_ioremap_page_table_ran
22816
22817 static void __init pagetable_init(void)
22818 {
22819 - pgd_t *pgd_base = swapper_pg_dir;
22820 -
22821 - permanent_kmaps_init(pgd_base);
22822 + permanent_kmaps_init(swapper_pg_dir);
22823 }
22824
22825 #ifdef CONFIG_ACPI_SLEEP
22826 @@ -551,12 +550,12 @@ static void __init pagetable_init(void)
22827 * ACPI suspend needs this for resume, because things like the intel-agp
22828 * driver might have split up a kernel 4MB mapping.
22829 */
22830 -char swsusp_pg_dir[PAGE_SIZE]
22831 +pgd_t swsusp_pg_dir[PTRS_PER_PGD]
22832 __attribute__ ((aligned(PAGE_SIZE)));
22833
22834 static inline void save_pg_dir(void)
22835 {
22836 - memcpy(swsusp_pg_dir, swapper_pg_dir, PAGE_SIZE);
22837 + clone_pgd_range(swsusp_pg_dir, swapper_pg_dir, PTRS_PER_PGD);
22838 }
22839 #else /* !CONFIG_ACPI_SLEEP */
22840 static inline void save_pg_dir(void)
22841 @@ -588,7 +587,7 @@ void zap_low_mappings(bool early)
22842 flush_tlb_all();
22843 }
22844
22845 -pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22846 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22847 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22848
22849 /* user-defined highmem size */
22850 @@ -777,7 +776,7 @@ void __init setup_bootmem_allocator(void
22851 * Initialize the boot-time allocator (with low memory only):
22852 */
22853 bootmap_size = bootmem_bootmap_pages(max_low_pfn)<<PAGE_SHIFT;
22854 - bootmap = find_e820_area(0, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
22855 + bootmap = find_e820_area(0x100000, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
22856 PAGE_SIZE);
22857 if (bootmap == -1L)
22858 panic("Cannot find bootmem map of size %ld\n", bootmap_size);
22859 @@ -864,6 +863,12 @@ void __init mem_init(void)
22860
22861 pci_iommu_alloc();
22862
22863 +#ifdef CONFIG_PAX_PER_CPU_PGD
22864 + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22865 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22866 + KERNEL_PGD_PTRS);
22867 +#endif
22868 +
22869 #ifdef CONFIG_FLATMEM
22870 BUG_ON(!mem_map);
22871 #endif
22872 @@ -881,7 +886,7 @@ void __init mem_init(void)
22873 set_highmem_pages_init();
22874
22875 codesize = (unsigned long) &_etext - (unsigned long) &_text;
22876 - datasize = (unsigned long) &_edata - (unsigned long) &_etext;
22877 + datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
22878 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
22879
22880 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
22881 @@ -923,10 +928,10 @@ void __init mem_init(void)
22882 ((unsigned long)&__init_end -
22883 (unsigned long)&__init_begin) >> 10,
22884
22885 - (unsigned long)&_etext, (unsigned long)&_edata,
22886 - ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
22887 + (unsigned long)&_sdata, (unsigned long)&_edata,
22888 + ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
22889
22890 - (unsigned long)&_text, (unsigned long)&_etext,
22891 + ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
22892 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
22893
22894 /*
22895 @@ -1007,6 +1012,7 @@ void set_kernel_text_rw(void)
22896 if (!kernel_set_to_readonly)
22897 return;
22898
22899 + start = ktla_ktva(start);
22900 pr_debug("Set kernel text: %lx - %lx for read write\n",
22901 start, start+size);
22902
22903 @@ -1021,6 +1027,7 @@ void set_kernel_text_ro(void)
22904 if (!kernel_set_to_readonly)
22905 return;
22906
22907 + start = ktla_ktva(start);
22908 pr_debug("Set kernel text: %lx - %lx for read only\n",
22909 start, start+size);
22910
22911 @@ -1032,6 +1039,7 @@ void mark_rodata_ro(void)
22912 unsigned long start = PFN_ALIGN(_text);
22913 unsigned long size = PFN_ALIGN(_etext) - start;
22914
22915 + start = ktla_ktva(start);
22916 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
22917 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
22918 size >> 10);
22919 diff -urNp linux-2.6.32.46/arch/x86/mm/init_64.c linux-2.6.32.46/arch/x86/mm/init_64.c
22920 --- linux-2.6.32.46/arch/x86/mm/init_64.c 2011-04-17 17:00:52.000000000 -0400
22921 +++ linux-2.6.32.46/arch/x86/mm/init_64.c 2011-04-17 17:03:05.000000000 -0400
22922 @@ -164,7 +164,9 @@ void set_pte_vaddr_pud(pud_t *pud_page,
22923 pmd = fill_pmd(pud, vaddr);
22924 pte = fill_pte(pmd, vaddr);
22925
22926 + pax_open_kernel();
22927 set_pte(pte, new_pte);
22928 + pax_close_kernel();
22929
22930 /*
22931 * It's enough to flush this one mapping.
22932 @@ -223,14 +225,12 @@ static void __init __init_extra_mapping(
22933 pgd = pgd_offset_k((unsigned long)__va(phys));
22934 if (pgd_none(*pgd)) {
22935 pud = (pud_t *) spp_getpage();
22936 - set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
22937 - _PAGE_USER));
22938 + set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
22939 }
22940 pud = pud_offset(pgd, (unsigned long)__va(phys));
22941 if (pud_none(*pud)) {
22942 pmd = (pmd_t *) spp_getpage();
22943 - set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
22944 - _PAGE_USER));
22945 + set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
22946 }
22947 pmd = pmd_offset(pud, phys);
22948 BUG_ON(!pmd_none(*pmd));
22949 @@ -675,6 +675,12 @@ void __init mem_init(void)
22950
22951 pci_iommu_alloc();
22952
22953 +#ifdef CONFIG_PAX_PER_CPU_PGD
22954 + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22955 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22956 + KERNEL_PGD_PTRS);
22957 +#endif
22958 +
22959 /* clear_bss() already clear the empty_zero_page */
22960
22961 reservedpages = 0;
22962 @@ -861,8 +867,8 @@ int kern_addr_valid(unsigned long addr)
22963 static struct vm_area_struct gate_vma = {
22964 .vm_start = VSYSCALL_START,
22965 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
22966 - .vm_page_prot = PAGE_READONLY_EXEC,
22967 - .vm_flags = VM_READ | VM_EXEC
22968 + .vm_page_prot = PAGE_READONLY,
22969 + .vm_flags = VM_READ
22970 };
22971
22972 struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
22973 @@ -896,7 +902,7 @@ int in_gate_area_no_task(unsigned long a
22974
22975 const char *arch_vma_name(struct vm_area_struct *vma)
22976 {
22977 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
22978 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
22979 return "[vdso]";
22980 if (vma == &gate_vma)
22981 return "[vsyscall]";
22982 diff -urNp linux-2.6.32.46/arch/x86/mm/init.c linux-2.6.32.46/arch/x86/mm/init.c
22983 --- linux-2.6.32.46/arch/x86/mm/init.c 2011-04-17 17:00:52.000000000 -0400
22984 +++ linux-2.6.32.46/arch/x86/mm/init.c 2011-06-07 19:06:09.000000000 -0400
22985 @@ -69,11 +69,7 @@ static void __init find_early_table_spac
22986 * cause a hotspot and fill up ZONE_DMA. The page tables
22987 * need roughly 0.5KB per GB.
22988 */
22989 -#ifdef CONFIG_X86_32
22990 - start = 0x7000;
22991 -#else
22992 - start = 0x8000;
22993 -#endif
22994 + start = 0x100000;
22995 e820_table_start = find_e820_area(start, max_pfn_mapped<<PAGE_SHIFT,
22996 tables, PAGE_SIZE);
22997 if (e820_table_start == -1UL)
22998 @@ -147,7 +143,7 @@ unsigned long __init_refok init_memory_m
22999 #endif
23000
23001 set_nx();
23002 - if (nx_enabled)
23003 + if (nx_enabled && cpu_has_nx)
23004 printk(KERN_INFO "NX (Execute Disable) protection: active\n");
23005
23006 /* Enable PSE if available */
23007 @@ -329,10 +325,27 @@ unsigned long __init_refok init_memory_m
23008 * Access has to be given to non-kernel-ram areas as well, these contain the PCI
23009 * mmio resources as well as potential bios/acpi data regions.
23010 */
23011 +
23012 int devmem_is_allowed(unsigned long pagenr)
23013 {
23014 +#ifdef CONFIG_GRKERNSEC_KMEM
23015 + /* allow BDA */
23016 + if (!pagenr)
23017 + return 1;
23018 + /* allow EBDA */
23019 + if ((0x9f000 >> PAGE_SHIFT) == pagenr)
23020 + return 1;
23021 + /* allow ISA/video mem */
23022 + if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
23023 + return 1;
23024 + /* throw out everything else below 1MB */
23025 + if (pagenr <= 256)
23026 + return 0;
23027 +#else
23028 if (pagenr <= 256)
23029 return 1;
23030 +#endif
23031 +
23032 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
23033 return 0;
23034 if (!page_is_ram(pagenr))
23035 @@ -379,6 +392,86 @@ void free_init_pages(char *what, unsigne
23036
23037 void free_initmem(void)
23038 {
23039 +
23040 +#ifdef CONFIG_PAX_KERNEXEC
23041 +#ifdef CONFIG_X86_32
23042 + /* PaX: limit KERNEL_CS to actual size */
23043 + unsigned long addr, limit;
23044 + struct desc_struct d;
23045 + int cpu;
23046 +
23047 + limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
23048 + limit = (limit - 1UL) >> PAGE_SHIFT;
23049 +
23050 + memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
23051 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
23052 + pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
23053 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
23054 + }
23055 +
23056 + /* PaX: make KERNEL_CS read-only */
23057 + addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
23058 + if (!paravirt_enabled())
23059 + set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
23060 +/*
23061 + for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
23062 + pgd = pgd_offset_k(addr);
23063 + pud = pud_offset(pgd, addr);
23064 + pmd = pmd_offset(pud, addr);
23065 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
23066 + }
23067 +*/
23068 +#ifdef CONFIG_X86_PAE
23069 + set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
23070 +/*
23071 + for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
23072 + pgd = pgd_offset_k(addr);
23073 + pud = pud_offset(pgd, addr);
23074 + pmd = pmd_offset(pud, addr);
23075 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
23076 + }
23077 +*/
23078 +#endif
23079 +
23080 +#ifdef CONFIG_MODULES
23081 + set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
23082 +#endif
23083 +
23084 +#else
23085 + pgd_t *pgd;
23086 + pud_t *pud;
23087 + pmd_t *pmd;
23088 + unsigned long addr, end;
23089 +
23090 + /* PaX: make kernel code/rodata read-only, rest non-executable */
23091 + for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
23092 + pgd = pgd_offset_k(addr);
23093 + pud = pud_offset(pgd, addr);
23094 + pmd = pmd_offset(pud, addr);
23095 + if (!pmd_present(*pmd))
23096 + continue;
23097 + if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
23098 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
23099 + else
23100 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
23101 + }
23102 +
23103 + addr = (unsigned long)__va(__pa(__START_KERNEL_map));
23104 + end = addr + KERNEL_IMAGE_SIZE;
23105 + for (; addr < end; addr += PMD_SIZE) {
23106 + pgd = pgd_offset_k(addr);
23107 + pud = pud_offset(pgd, addr);
23108 + pmd = pmd_offset(pud, addr);
23109 + if (!pmd_present(*pmd))
23110 + continue;
23111 + if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
23112 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
23113 + }
23114 +#endif
23115 +
23116 + flush_tlb_all();
23117 +#endif
23118 +
23119 free_init_pages("unused kernel memory",
23120 (unsigned long)(&__init_begin),
23121 (unsigned long)(&__init_end));
23122 diff -urNp linux-2.6.32.46/arch/x86/mm/iomap_32.c linux-2.6.32.46/arch/x86/mm/iomap_32.c
23123 --- linux-2.6.32.46/arch/x86/mm/iomap_32.c 2011-03-27 14:31:47.000000000 -0400
23124 +++ linux-2.6.32.46/arch/x86/mm/iomap_32.c 2011-04-17 15:56:46.000000000 -0400
23125 @@ -65,7 +65,11 @@ void *kmap_atomic_prot_pfn(unsigned long
23126 debug_kmap_atomic(type);
23127 idx = type + KM_TYPE_NR * smp_processor_id();
23128 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
23129 +
23130 + pax_open_kernel();
23131 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
23132 + pax_close_kernel();
23133 +
23134 arch_flush_lazy_mmu_mode();
23135
23136 return (void *)vaddr;
23137 diff -urNp linux-2.6.32.46/arch/x86/mm/ioremap.c linux-2.6.32.46/arch/x86/mm/ioremap.c
23138 --- linux-2.6.32.46/arch/x86/mm/ioremap.c 2011-03-27 14:31:47.000000000 -0400
23139 +++ linux-2.6.32.46/arch/x86/mm/ioremap.c 2011-04-17 15:56:46.000000000 -0400
23140 @@ -41,8 +41,8 @@ int page_is_ram(unsigned long pagenr)
23141 * Second special case: Some BIOSen report the PC BIOS
23142 * area (640->1Mb) as ram even though it is not.
23143 */
23144 - if (pagenr >= (BIOS_BEGIN >> PAGE_SHIFT) &&
23145 - pagenr < (BIOS_END >> PAGE_SHIFT))
23146 + if (pagenr >= (ISA_START_ADDRESS >> PAGE_SHIFT) &&
23147 + pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
23148 return 0;
23149
23150 for (i = 0; i < e820.nr_map; i++) {
23151 @@ -137,13 +137,10 @@ static void __iomem *__ioremap_caller(re
23152 /*
23153 * Don't allow anybody to remap normal RAM that we're using..
23154 */
23155 - for (pfn = phys_addr >> PAGE_SHIFT;
23156 - (pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
23157 - pfn++) {
23158 -
23159 + for (pfn = phys_addr >> PAGE_SHIFT; ((resource_size_t)pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK); pfn++) {
23160 int is_ram = page_is_ram(pfn);
23161
23162 - if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
23163 + if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
23164 return NULL;
23165 WARN_ON_ONCE(is_ram);
23166 }
23167 @@ -407,7 +404,7 @@ static int __init early_ioremap_debug_se
23168 early_param("early_ioremap_debug", early_ioremap_debug_setup);
23169
23170 static __initdata int after_paging_init;
23171 -static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
23172 +static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
23173
23174 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
23175 {
23176 @@ -439,8 +436,7 @@ void __init early_ioremap_init(void)
23177 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
23178
23179 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
23180 - memset(bm_pte, 0, sizeof(bm_pte));
23181 - pmd_populate_kernel(&init_mm, pmd, bm_pte);
23182 + pmd_populate_user(&init_mm, pmd, bm_pte);
23183
23184 /*
23185 * The boot-ioremap range spans multiple pmds, for which
23186 diff -urNp linux-2.6.32.46/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.32.46/arch/x86/mm/kmemcheck/kmemcheck.c
23187 --- linux-2.6.32.46/arch/x86/mm/kmemcheck/kmemcheck.c 2011-03-27 14:31:47.000000000 -0400
23188 +++ linux-2.6.32.46/arch/x86/mm/kmemcheck/kmemcheck.c 2011-04-17 15:56:46.000000000 -0400
23189 @@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
23190 * memory (e.g. tracked pages)? For now, we need this to avoid
23191 * invoking kmemcheck for PnP BIOS calls.
23192 */
23193 - if (regs->flags & X86_VM_MASK)
23194 + if (v8086_mode(regs))
23195 return false;
23196 - if (regs->cs != __KERNEL_CS)
23197 + if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
23198 return false;
23199
23200 pte = kmemcheck_pte_lookup(address);
23201 diff -urNp linux-2.6.32.46/arch/x86/mm/mmap.c linux-2.6.32.46/arch/x86/mm/mmap.c
23202 --- linux-2.6.32.46/arch/x86/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
23203 +++ linux-2.6.32.46/arch/x86/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
23204 @@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
23205 * Leave an at least ~128 MB hole with possible stack randomization.
23206 */
23207 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
23208 -#define MAX_GAP (TASK_SIZE/6*5)
23209 +#define MAX_GAP (pax_task_size/6*5)
23210
23211 /*
23212 * True on X86_32 or when emulating IA32 on X86_64
23213 @@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
23214 return rnd << PAGE_SHIFT;
23215 }
23216
23217 -static unsigned long mmap_base(void)
23218 +static unsigned long mmap_base(struct mm_struct *mm)
23219 {
23220 unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
23221 + unsigned long pax_task_size = TASK_SIZE;
23222 +
23223 +#ifdef CONFIG_PAX_SEGMEXEC
23224 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
23225 + pax_task_size = SEGMEXEC_TASK_SIZE;
23226 +#endif
23227
23228 if (gap < MIN_GAP)
23229 gap = MIN_GAP;
23230 else if (gap > MAX_GAP)
23231 gap = MAX_GAP;
23232
23233 - return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
23234 + return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
23235 }
23236
23237 /*
23238 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
23239 * does, but not when emulating X86_32
23240 */
23241 -static unsigned long mmap_legacy_base(void)
23242 +static unsigned long mmap_legacy_base(struct mm_struct *mm)
23243 {
23244 - if (mmap_is_ia32())
23245 + if (mmap_is_ia32()) {
23246 +
23247 +#ifdef CONFIG_PAX_SEGMEXEC
23248 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
23249 + return SEGMEXEC_TASK_UNMAPPED_BASE;
23250 + else
23251 +#endif
23252 +
23253 return TASK_UNMAPPED_BASE;
23254 - else
23255 + } else
23256 return TASK_UNMAPPED_BASE + mmap_rnd();
23257 }
23258
23259 @@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
23260 void arch_pick_mmap_layout(struct mm_struct *mm)
23261 {
23262 if (mmap_is_legacy()) {
23263 - mm->mmap_base = mmap_legacy_base();
23264 + mm->mmap_base = mmap_legacy_base(mm);
23265 +
23266 +#ifdef CONFIG_PAX_RANDMMAP
23267 + if (mm->pax_flags & MF_PAX_RANDMMAP)
23268 + mm->mmap_base += mm->delta_mmap;
23269 +#endif
23270 +
23271 mm->get_unmapped_area = arch_get_unmapped_area;
23272 mm->unmap_area = arch_unmap_area;
23273 } else {
23274 - mm->mmap_base = mmap_base();
23275 + mm->mmap_base = mmap_base(mm);
23276 +
23277 +#ifdef CONFIG_PAX_RANDMMAP
23278 + if (mm->pax_flags & MF_PAX_RANDMMAP)
23279 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
23280 +#endif
23281 +
23282 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
23283 mm->unmap_area = arch_unmap_area_topdown;
23284 }
23285 diff -urNp linux-2.6.32.46/arch/x86/mm/mmio-mod.c linux-2.6.32.46/arch/x86/mm/mmio-mod.c
23286 --- linux-2.6.32.46/arch/x86/mm/mmio-mod.c 2011-03-27 14:31:47.000000000 -0400
23287 +++ linux-2.6.32.46/arch/x86/mm/mmio-mod.c 2011-07-06 19:53:33.000000000 -0400
23288 @@ -193,7 +193,7 @@ static void pre(struct kmmio_probe *p, s
23289 break;
23290 default:
23291 {
23292 - unsigned char *ip = (unsigned char *)instptr;
23293 + unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
23294 my_trace->opcode = MMIO_UNKNOWN_OP;
23295 my_trace->width = 0;
23296 my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
23297 @@ -233,7 +233,7 @@ static void post(struct kmmio_probe *p,
23298 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
23299 void __iomem *addr)
23300 {
23301 - static atomic_t next_id;
23302 + static atomic_unchecked_t next_id;
23303 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
23304 /* These are page-unaligned. */
23305 struct mmiotrace_map map = {
23306 @@ -257,7 +257,7 @@ static void ioremap_trace_core(resource_
23307 .private = trace
23308 },
23309 .phys = offset,
23310 - .id = atomic_inc_return(&next_id)
23311 + .id = atomic_inc_return_unchecked(&next_id)
23312 };
23313 map.map_id = trace->id;
23314
23315 diff -urNp linux-2.6.32.46/arch/x86/mm/numa_32.c linux-2.6.32.46/arch/x86/mm/numa_32.c
23316 --- linux-2.6.32.46/arch/x86/mm/numa_32.c 2011-03-27 14:31:47.000000000 -0400
23317 +++ linux-2.6.32.46/arch/x86/mm/numa_32.c 2011-04-17 15:56:46.000000000 -0400
23318 @@ -98,7 +98,6 @@ unsigned long node_memmap_size_bytes(int
23319 }
23320 #endif
23321
23322 -extern unsigned long find_max_low_pfn(void);
23323 extern unsigned long highend_pfn, highstart_pfn;
23324
23325 #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
23326 diff -urNp linux-2.6.32.46/arch/x86/mm/pageattr.c linux-2.6.32.46/arch/x86/mm/pageattr.c
23327 --- linux-2.6.32.46/arch/x86/mm/pageattr.c 2011-03-27 14:31:47.000000000 -0400
23328 +++ linux-2.6.32.46/arch/x86/mm/pageattr.c 2011-04-17 15:56:46.000000000 -0400
23329 @@ -261,16 +261,17 @@ static inline pgprot_t static_protection
23330 * PCI BIOS based config access (CONFIG_PCI_GOBIOS) support.
23331 */
23332 if (within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
23333 - pgprot_val(forbidden) |= _PAGE_NX;
23334 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23335
23336 /*
23337 * The kernel text needs to be executable for obvious reasons
23338 * Does not cover __inittext since that is gone later on. On
23339 * 64bit we do not enforce !NX on the low mapping
23340 */
23341 - if (within(address, (unsigned long)_text, (unsigned long)_etext))
23342 - pgprot_val(forbidden) |= _PAGE_NX;
23343 + if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
23344 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23345
23346 +#ifdef CONFIG_DEBUG_RODATA
23347 /*
23348 * The .rodata section needs to be read-only. Using the pfn
23349 * catches all aliases.
23350 @@ -278,6 +279,14 @@ static inline pgprot_t static_protection
23351 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
23352 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
23353 pgprot_val(forbidden) |= _PAGE_RW;
23354 +#endif
23355 +
23356 +#ifdef CONFIG_PAX_KERNEXEC
23357 + if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
23358 + pgprot_val(forbidden) |= _PAGE_RW;
23359 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23360 + }
23361 +#endif
23362
23363 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
23364
23365 @@ -331,23 +340,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
23366 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
23367 {
23368 /* change init_mm */
23369 + pax_open_kernel();
23370 set_pte_atomic(kpte, pte);
23371 +
23372 #ifdef CONFIG_X86_32
23373 if (!SHARED_KERNEL_PMD) {
23374 +
23375 +#ifdef CONFIG_PAX_PER_CPU_PGD
23376 + unsigned long cpu;
23377 +#else
23378 struct page *page;
23379 +#endif
23380
23381 +#ifdef CONFIG_PAX_PER_CPU_PGD
23382 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
23383 + pgd_t *pgd = get_cpu_pgd(cpu);
23384 +#else
23385 list_for_each_entry(page, &pgd_list, lru) {
23386 - pgd_t *pgd;
23387 + pgd_t *pgd = (pgd_t *)page_address(page);
23388 +#endif
23389 +
23390 pud_t *pud;
23391 pmd_t *pmd;
23392
23393 - pgd = (pgd_t *)page_address(page) + pgd_index(address);
23394 + pgd += pgd_index(address);
23395 pud = pud_offset(pgd, address);
23396 pmd = pmd_offset(pud, address);
23397 set_pte_atomic((pte_t *)pmd, pte);
23398 }
23399 }
23400 #endif
23401 + pax_close_kernel();
23402 }
23403
23404 static int
23405 diff -urNp linux-2.6.32.46/arch/x86/mm/pageattr-test.c linux-2.6.32.46/arch/x86/mm/pageattr-test.c
23406 --- linux-2.6.32.46/arch/x86/mm/pageattr-test.c 2011-03-27 14:31:47.000000000 -0400
23407 +++ linux-2.6.32.46/arch/x86/mm/pageattr-test.c 2011-04-17 15:56:46.000000000 -0400
23408 @@ -36,7 +36,7 @@ enum {
23409
23410 static int pte_testbit(pte_t pte)
23411 {
23412 - return pte_flags(pte) & _PAGE_UNUSED1;
23413 + return pte_flags(pte) & _PAGE_CPA_TEST;
23414 }
23415
23416 struct split_state {
23417 diff -urNp linux-2.6.32.46/arch/x86/mm/pat.c linux-2.6.32.46/arch/x86/mm/pat.c
23418 --- linux-2.6.32.46/arch/x86/mm/pat.c 2011-03-27 14:31:47.000000000 -0400
23419 +++ linux-2.6.32.46/arch/x86/mm/pat.c 2011-04-17 15:56:46.000000000 -0400
23420 @@ -258,7 +258,7 @@ chk_conflict(struct memtype *new, struct
23421
23422 conflict:
23423 printk(KERN_INFO "%s:%d conflicting memory types "
23424 - "%Lx-%Lx %s<->%s\n", current->comm, current->pid, new->start,
23425 + "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), new->start,
23426 new->end, cattr_name(new->type), cattr_name(entry->type));
23427 return -EBUSY;
23428 }
23429 @@ -559,7 +559,7 @@ unlock_ret:
23430
23431 if (err) {
23432 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
23433 - current->comm, current->pid, start, end);
23434 + current->comm, task_pid_nr(current), start, end);
23435 }
23436
23437 dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
23438 @@ -689,8 +689,8 @@ static inline int range_is_allowed(unsig
23439 while (cursor < to) {
23440 if (!devmem_is_allowed(pfn)) {
23441 printk(KERN_INFO
23442 - "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
23443 - current->comm, from, to);
23444 + "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
23445 + current->comm, from, to, cursor);
23446 return 0;
23447 }
23448 cursor += PAGE_SIZE;
23449 @@ -755,7 +755,7 @@ int kernel_map_sync_memtype(u64 base, un
23450 printk(KERN_INFO
23451 "%s:%d ioremap_change_attr failed %s "
23452 "for %Lx-%Lx\n",
23453 - current->comm, current->pid,
23454 + current->comm, task_pid_nr(current),
23455 cattr_name(flags),
23456 base, (unsigned long long)(base + size));
23457 return -EINVAL;
23458 @@ -813,7 +813,7 @@ static int reserve_pfn_range(u64 paddr,
23459 free_memtype(paddr, paddr + size);
23460 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
23461 " for %Lx-%Lx, got %s\n",
23462 - current->comm, current->pid,
23463 + current->comm, task_pid_nr(current),
23464 cattr_name(want_flags),
23465 (unsigned long long)paddr,
23466 (unsigned long long)(paddr + size),
23467 diff -urNp linux-2.6.32.46/arch/x86/mm/pf_in.c linux-2.6.32.46/arch/x86/mm/pf_in.c
23468 --- linux-2.6.32.46/arch/x86/mm/pf_in.c 2011-03-27 14:31:47.000000000 -0400
23469 +++ linux-2.6.32.46/arch/x86/mm/pf_in.c 2011-07-06 19:53:33.000000000 -0400
23470 @@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned l
23471 int i;
23472 enum reason_type rv = OTHERS;
23473
23474 - p = (unsigned char *)ins_addr;
23475 + p = (unsigned char *)ktla_ktva(ins_addr);
23476 p += skip_prefix(p, &prf);
23477 p += get_opcode(p, &opcode);
23478
23479 @@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(un
23480 struct prefix_bits prf;
23481 int i;
23482
23483 - p = (unsigned char *)ins_addr;
23484 + p = (unsigned char *)ktla_ktva(ins_addr);
23485 p += skip_prefix(p, &prf);
23486 p += get_opcode(p, &opcode);
23487
23488 @@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned
23489 struct prefix_bits prf;
23490 int i;
23491
23492 - p = (unsigned char *)ins_addr;
23493 + p = (unsigned char *)ktla_ktva(ins_addr);
23494 p += skip_prefix(p, &prf);
23495 p += get_opcode(p, &opcode);
23496
23497 @@ -417,7 +417,7 @@ unsigned long get_ins_reg_val(unsigned l
23498 int i;
23499 unsigned long rv;
23500
23501 - p = (unsigned char *)ins_addr;
23502 + p = (unsigned char *)ktla_ktva(ins_addr);
23503 p += skip_prefix(p, &prf);
23504 p += get_opcode(p, &opcode);
23505 for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
23506 @@ -472,7 +472,7 @@ unsigned long get_ins_imm_val(unsigned l
23507 int i;
23508 unsigned long rv;
23509
23510 - p = (unsigned char *)ins_addr;
23511 + p = (unsigned char *)ktla_ktva(ins_addr);
23512 p += skip_prefix(p, &prf);
23513 p += get_opcode(p, &opcode);
23514 for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
23515 diff -urNp linux-2.6.32.46/arch/x86/mm/pgtable_32.c linux-2.6.32.46/arch/x86/mm/pgtable_32.c
23516 --- linux-2.6.32.46/arch/x86/mm/pgtable_32.c 2011-03-27 14:31:47.000000000 -0400
23517 +++ linux-2.6.32.46/arch/x86/mm/pgtable_32.c 2011-04-17 15:56:46.000000000 -0400
23518 @@ -49,10 +49,13 @@ void set_pte_vaddr(unsigned long vaddr,
23519 return;
23520 }
23521 pte = pte_offset_kernel(pmd, vaddr);
23522 +
23523 + pax_open_kernel();
23524 if (pte_val(pteval))
23525 set_pte_at(&init_mm, vaddr, pte, pteval);
23526 else
23527 pte_clear(&init_mm, vaddr, pte);
23528 + pax_close_kernel();
23529
23530 /*
23531 * It's enough to flush this one mapping.
23532 diff -urNp linux-2.6.32.46/arch/x86/mm/pgtable.c linux-2.6.32.46/arch/x86/mm/pgtable.c
23533 --- linux-2.6.32.46/arch/x86/mm/pgtable.c 2011-03-27 14:31:47.000000000 -0400
23534 +++ linux-2.6.32.46/arch/x86/mm/pgtable.c 2011-05-11 18:25:15.000000000 -0400
23535 @@ -83,9 +83,52 @@ static inline void pgd_list_del(pgd_t *p
23536 list_del(&page->lru);
23537 }
23538
23539 -#define UNSHARED_PTRS_PER_PGD \
23540 - (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
23541 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
23542 +pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
23543
23544 +void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
23545 +{
23546 + while (count--)
23547 + *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
23548 +}
23549 +#endif
23550 +
23551 +#ifdef CONFIG_PAX_PER_CPU_PGD
23552 +void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
23553 +{
23554 + while (count--)
23555 +
23556 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
23557 + *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
23558 +#else
23559 + *dst++ = *src++;
23560 +#endif
23561 +
23562 +}
23563 +#endif
23564 +
23565 +#ifdef CONFIG_X86_64
23566 +#define pxd_t pud_t
23567 +#define pyd_t pgd_t
23568 +#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
23569 +#define pxd_free(mm, pud) pud_free((mm), (pud))
23570 +#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
23571 +#define pyd_offset(mm ,address) pgd_offset((mm), (address))
23572 +#define PYD_SIZE PGDIR_SIZE
23573 +#else
23574 +#define pxd_t pmd_t
23575 +#define pyd_t pud_t
23576 +#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
23577 +#define pxd_free(mm, pud) pmd_free((mm), (pud))
23578 +#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
23579 +#define pyd_offset(mm ,address) pud_offset((mm), (address))
23580 +#define PYD_SIZE PUD_SIZE
23581 +#endif
23582 +
23583 +#ifdef CONFIG_PAX_PER_CPU_PGD
23584 +static inline void pgd_ctor(pgd_t *pgd) {}
23585 +static inline void pgd_dtor(pgd_t *pgd) {}
23586 +#else
23587 static void pgd_ctor(pgd_t *pgd)
23588 {
23589 /* If the pgd points to a shared pagetable level (either the
23590 @@ -119,6 +162,7 @@ static void pgd_dtor(pgd_t *pgd)
23591 pgd_list_del(pgd);
23592 spin_unlock_irqrestore(&pgd_lock, flags);
23593 }
23594 +#endif
23595
23596 /*
23597 * List of all pgd's needed for non-PAE so it can invalidate entries
23598 @@ -131,7 +175,7 @@ static void pgd_dtor(pgd_t *pgd)
23599 * -- wli
23600 */
23601
23602 -#ifdef CONFIG_X86_PAE
23603 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
23604 /*
23605 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
23606 * updating the top-level pagetable entries to guarantee the
23607 @@ -143,7 +187,7 @@ static void pgd_dtor(pgd_t *pgd)
23608 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
23609 * and initialize the kernel pmds here.
23610 */
23611 -#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
23612 +#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
23613
23614 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
23615 {
23616 @@ -161,36 +205,38 @@ void pud_populate(struct mm_struct *mm,
23617 */
23618 flush_tlb_mm(mm);
23619 }
23620 +#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
23621 +#define PREALLOCATED_PXDS USER_PGD_PTRS
23622 #else /* !CONFIG_X86_PAE */
23623
23624 /* No need to prepopulate any pagetable entries in non-PAE modes. */
23625 -#define PREALLOCATED_PMDS 0
23626 +#define PREALLOCATED_PXDS 0
23627
23628 #endif /* CONFIG_X86_PAE */
23629
23630 -static void free_pmds(pmd_t *pmds[])
23631 +static void free_pxds(pxd_t *pxds[])
23632 {
23633 int i;
23634
23635 - for(i = 0; i < PREALLOCATED_PMDS; i++)
23636 - if (pmds[i])
23637 - free_page((unsigned long)pmds[i]);
23638 + for(i = 0; i < PREALLOCATED_PXDS; i++)
23639 + if (pxds[i])
23640 + free_page((unsigned long)pxds[i]);
23641 }
23642
23643 -static int preallocate_pmds(pmd_t *pmds[])
23644 +static int preallocate_pxds(pxd_t *pxds[])
23645 {
23646 int i;
23647 bool failed = false;
23648
23649 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
23650 - pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
23651 - if (pmd == NULL)
23652 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
23653 + pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
23654 + if (pxd == NULL)
23655 failed = true;
23656 - pmds[i] = pmd;
23657 + pxds[i] = pxd;
23658 }
23659
23660 if (failed) {
23661 - free_pmds(pmds);
23662 + free_pxds(pxds);
23663 return -ENOMEM;
23664 }
23665
23666 @@ -203,51 +249,56 @@ static int preallocate_pmds(pmd_t *pmds[
23667 * preallocate which never got a corresponding vma will need to be
23668 * freed manually.
23669 */
23670 -static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
23671 +static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
23672 {
23673 int i;
23674
23675 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
23676 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
23677 pgd_t pgd = pgdp[i];
23678
23679 if (pgd_val(pgd) != 0) {
23680 - pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
23681 + pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
23682
23683 - pgdp[i] = native_make_pgd(0);
23684 + set_pgd(pgdp + i, native_make_pgd(0));
23685
23686 - paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
23687 - pmd_free(mm, pmd);
23688 + paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
23689 + pxd_free(mm, pxd);
23690 }
23691 }
23692 }
23693
23694 -static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
23695 +static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
23696 {
23697 - pud_t *pud;
23698 + pyd_t *pyd;
23699 unsigned long addr;
23700 int i;
23701
23702 - if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
23703 + if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
23704 return;
23705
23706 - pud = pud_offset(pgd, 0);
23707 +#ifdef CONFIG_X86_64
23708 + pyd = pyd_offset(mm, 0L);
23709 +#else
23710 + pyd = pyd_offset(pgd, 0L);
23711 +#endif
23712
23713 - for (addr = i = 0; i < PREALLOCATED_PMDS;
23714 - i++, pud++, addr += PUD_SIZE) {
23715 - pmd_t *pmd = pmds[i];
23716 + for (addr = i = 0; i < PREALLOCATED_PXDS;
23717 + i++, pyd++, addr += PYD_SIZE) {
23718 + pxd_t *pxd = pxds[i];
23719
23720 if (i >= KERNEL_PGD_BOUNDARY)
23721 - memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
23722 - sizeof(pmd_t) * PTRS_PER_PMD);
23723 + memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
23724 + sizeof(pxd_t) * PTRS_PER_PMD);
23725
23726 - pud_populate(mm, pud, pmd);
23727 + pyd_populate(mm, pyd, pxd);
23728 }
23729 }
23730
23731 pgd_t *pgd_alloc(struct mm_struct *mm)
23732 {
23733 pgd_t *pgd;
23734 - pmd_t *pmds[PREALLOCATED_PMDS];
23735 + pxd_t *pxds[PREALLOCATED_PXDS];
23736 +
23737 unsigned long flags;
23738
23739 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
23740 @@ -257,11 +308,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
23741
23742 mm->pgd = pgd;
23743
23744 - if (preallocate_pmds(pmds) != 0)
23745 + if (preallocate_pxds(pxds) != 0)
23746 goto out_free_pgd;
23747
23748 if (paravirt_pgd_alloc(mm) != 0)
23749 - goto out_free_pmds;
23750 + goto out_free_pxds;
23751
23752 /*
23753 * Make sure that pre-populating the pmds is atomic with
23754 @@ -271,14 +322,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
23755 spin_lock_irqsave(&pgd_lock, flags);
23756
23757 pgd_ctor(pgd);
23758 - pgd_prepopulate_pmd(mm, pgd, pmds);
23759 + pgd_prepopulate_pxd(mm, pgd, pxds);
23760
23761 spin_unlock_irqrestore(&pgd_lock, flags);
23762
23763 return pgd;
23764
23765 -out_free_pmds:
23766 - free_pmds(pmds);
23767 +out_free_pxds:
23768 + free_pxds(pxds);
23769 out_free_pgd:
23770 free_page((unsigned long)pgd);
23771 out:
23772 @@ -287,7 +338,7 @@ out:
23773
23774 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
23775 {
23776 - pgd_mop_up_pmds(mm, pgd);
23777 + pgd_mop_up_pxds(mm, pgd);
23778 pgd_dtor(pgd);
23779 paravirt_pgd_free(mm, pgd);
23780 free_page((unsigned long)pgd);
23781 diff -urNp linux-2.6.32.46/arch/x86/mm/setup_nx.c linux-2.6.32.46/arch/x86/mm/setup_nx.c
23782 --- linux-2.6.32.46/arch/x86/mm/setup_nx.c 2011-03-27 14:31:47.000000000 -0400
23783 +++ linux-2.6.32.46/arch/x86/mm/setup_nx.c 2011-04-17 15:56:46.000000000 -0400
23784 @@ -4,11 +4,10 @@
23785
23786 #include <asm/pgtable.h>
23787
23788 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
23789 int nx_enabled;
23790
23791 -#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23792 -static int disable_nx __cpuinitdata;
23793 -
23794 +#ifndef CONFIG_PAX_PAGEEXEC
23795 /*
23796 * noexec = on|off
23797 *
23798 @@ -22,32 +21,26 @@ static int __init noexec_setup(char *str
23799 if (!str)
23800 return -EINVAL;
23801 if (!strncmp(str, "on", 2)) {
23802 - __supported_pte_mask |= _PAGE_NX;
23803 - disable_nx = 0;
23804 + nx_enabled = 1;
23805 } else if (!strncmp(str, "off", 3)) {
23806 - disable_nx = 1;
23807 - __supported_pte_mask &= ~_PAGE_NX;
23808 + nx_enabled = 0;
23809 }
23810 return 0;
23811 }
23812 early_param("noexec", noexec_setup);
23813 #endif
23814 +#endif
23815
23816 #ifdef CONFIG_X86_PAE
23817 void __init set_nx(void)
23818 {
23819 - unsigned int v[4], l, h;
23820 + if (!nx_enabled && cpu_has_nx) {
23821 + unsigned l, h;
23822
23823 - if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {
23824 - cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);
23825 -
23826 - if ((v[3] & (1 << 20)) && !disable_nx) {
23827 - rdmsr(MSR_EFER, l, h);
23828 - l |= EFER_NX;
23829 - wrmsr(MSR_EFER, l, h);
23830 - nx_enabled = 1;
23831 - __supported_pte_mask |= _PAGE_NX;
23832 - }
23833 + __supported_pte_mask &= ~_PAGE_NX;
23834 + rdmsr(MSR_EFER, l, h);
23835 + l &= ~EFER_NX;
23836 + wrmsr(MSR_EFER, l, h);
23837 }
23838 }
23839 #else
23840 @@ -62,7 +55,7 @@ void __cpuinit check_efer(void)
23841 unsigned long efer;
23842
23843 rdmsrl(MSR_EFER, efer);
23844 - if (!(efer & EFER_NX) || disable_nx)
23845 + if (!(efer & EFER_NX) || !nx_enabled)
23846 __supported_pte_mask &= ~_PAGE_NX;
23847 }
23848 #endif
23849 diff -urNp linux-2.6.32.46/arch/x86/mm/tlb.c linux-2.6.32.46/arch/x86/mm/tlb.c
23850 --- linux-2.6.32.46/arch/x86/mm/tlb.c 2011-03-27 14:31:47.000000000 -0400
23851 +++ linux-2.6.32.46/arch/x86/mm/tlb.c 2011-04-23 12:56:10.000000000 -0400
23852 @@ -61,7 +61,11 @@ void leave_mm(int cpu)
23853 BUG();
23854 cpumask_clear_cpu(cpu,
23855 mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
23856 +
23857 +#ifndef CONFIG_PAX_PER_CPU_PGD
23858 load_cr3(swapper_pg_dir);
23859 +#endif
23860 +
23861 }
23862 EXPORT_SYMBOL_GPL(leave_mm);
23863
23864 diff -urNp linux-2.6.32.46/arch/x86/oprofile/backtrace.c linux-2.6.32.46/arch/x86/oprofile/backtrace.c
23865 --- linux-2.6.32.46/arch/x86/oprofile/backtrace.c 2011-03-27 14:31:47.000000000 -0400
23866 +++ linux-2.6.32.46/arch/x86/oprofile/backtrace.c 2011-04-17 15:56:46.000000000 -0400
23867 @@ -57,7 +57,7 @@ static struct frame_head *dump_user_back
23868 struct frame_head bufhead[2];
23869
23870 /* Also check accessibility of one struct frame_head beyond */
23871 - if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
23872 + if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
23873 return NULL;
23874 if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
23875 return NULL;
23876 @@ -77,7 +77,7 @@ x86_backtrace(struct pt_regs * const reg
23877 {
23878 struct frame_head *head = (struct frame_head *)frame_pointer(regs);
23879
23880 - if (!user_mode_vm(regs)) {
23881 + if (!user_mode(regs)) {
23882 unsigned long stack = kernel_stack_pointer(regs);
23883 if (depth)
23884 dump_trace(NULL, regs, (unsigned long *)stack, 0,
23885 diff -urNp linux-2.6.32.46/arch/x86/oprofile/op_model_p4.c linux-2.6.32.46/arch/x86/oprofile/op_model_p4.c
23886 --- linux-2.6.32.46/arch/x86/oprofile/op_model_p4.c 2011-03-27 14:31:47.000000000 -0400
23887 +++ linux-2.6.32.46/arch/x86/oprofile/op_model_p4.c 2011-04-17 15:56:46.000000000 -0400
23888 @@ -50,7 +50,7 @@ static inline void setup_num_counters(vo
23889 #endif
23890 }
23891
23892 -static int inline addr_increment(void)
23893 +static inline int addr_increment(void)
23894 {
23895 #ifdef CONFIG_SMP
23896 return smp_num_siblings == 2 ? 2 : 1;
23897 diff -urNp linux-2.6.32.46/arch/x86/pci/common.c linux-2.6.32.46/arch/x86/pci/common.c
23898 --- linux-2.6.32.46/arch/x86/pci/common.c 2011-03-27 14:31:47.000000000 -0400
23899 +++ linux-2.6.32.46/arch/x86/pci/common.c 2011-04-23 12:56:10.000000000 -0400
23900 @@ -31,8 +31,8 @@ int noioapicreroute = 1;
23901 int pcibios_last_bus = -1;
23902 unsigned long pirq_table_addr;
23903 struct pci_bus *pci_root_bus;
23904 -struct pci_raw_ops *raw_pci_ops;
23905 -struct pci_raw_ops *raw_pci_ext_ops;
23906 +const struct pci_raw_ops *raw_pci_ops;
23907 +const struct pci_raw_ops *raw_pci_ext_ops;
23908
23909 int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
23910 int reg, int len, u32 *val)
23911 diff -urNp linux-2.6.32.46/arch/x86/pci/direct.c linux-2.6.32.46/arch/x86/pci/direct.c
23912 --- linux-2.6.32.46/arch/x86/pci/direct.c 2011-03-27 14:31:47.000000000 -0400
23913 +++ linux-2.6.32.46/arch/x86/pci/direct.c 2011-04-17 15:56:46.000000000 -0400
23914 @@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int
23915
23916 #undef PCI_CONF1_ADDRESS
23917
23918 -struct pci_raw_ops pci_direct_conf1 = {
23919 +const struct pci_raw_ops pci_direct_conf1 = {
23920 .read = pci_conf1_read,
23921 .write = pci_conf1_write,
23922 };
23923 @@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int
23924
23925 #undef PCI_CONF2_ADDRESS
23926
23927 -struct pci_raw_ops pci_direct_conf2 = {
23928 +const struct pci_raw_ops pci_direct_conf2 = {
23929 .read = pci_conf2_read,
23930 .write = pci_conf2_write,
23931 };
23932 @@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
23933 * This should be close to trivial, but it isn't, because there are buggy
23934 * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
23935 */
23936 -static int __init pci_sanity_check(struct pci_raw_ops *o)
23937 +static int __init pci_sanity_check(const struct pci_raw_ops *o)
23938 {
23939 u32 x = 0;
23940 int year, devfn;
23941 diff -urNp linux-2.6.32.46/arch/x86/pci/mmconfig_32.c linux-2.6.32.46/arch/x86/pci/mmconfig_32.c
23942 --- linux-2.6.32.46/arch/x86/pci/mmconfig_32.c 2011-03-27 14:31:47.000000000 -0400
23943 +++ linux-2.6.32.46/arch/x86/pci/mmconfig_32.c 2011-04-17 15:56:46.000000000 -0400
23944 @@ -125,7 +125,7 @@ static int pci_mmcfg_write(unsigned int
23945 return 0;
23946 }
23947
23948 -static struct pci_raw_ops pci_mmcfg = {
23949 +static const struct pci_raw_ops pci_mmcfg = {
23950 .read = pci_mmcfg_read,
23951 .write = pci_mmcfg_write,
23952 };
23953 diff -urNp linux-2.6.32.46/arch/x86/pci/mmconfig_64.c linux-2.6.32.46/arch/x86/pci/mmconfig_64.c
23954 --- linux-2.6.32.46/arch/x86/pci/mmconfig_64.c 2011-03-27 14:31:47.000000000 -0400
23955 +++ linux-2.6.32.46/arch/x86/pci/mmconfig_64.c 2011-04-17 15:56:46.000000000 -0400
23956 @@ -104,7 +104,7 @@ static int pci_mmcfg_write(unsigned int
23957 return 0;
23958 }
23959
23960 -static struct pci_raw_ops pci_mmcfg = {
23961 +static const struct pci_raw_ops pci_mmcfg = {
23962 .read = pci_mmcfg_read,
23963 .write = pci_mmcfg_write,
23964 };
23965 diff -urNp linux-2.6.32.46/arch/x86/pci/numaq_32.c linux-2.6.32.46/arch/x86/pci/numaq_32.c
23966 --- linux-2.6.32.46/arch/x86/pci/numaq_32.c 2011-03-27 14:31:47.000000000 -0400
23967 +++ linux-2.6.32.46/arch/x86/pci/numaq_32.c 2011-04-17 15:56:46.000000000 -0400
23968 @@ -112,7 +112,7 @@ static int pci_conf1_mq_write(unsigned i
23969
23970 #undef PCI_CONF1_MQ_ADDRESS
23971
23972 -static struct pci_raw_ops pci_direct_conf1_mq = {
23973 +static const struct pci_raw_ops pci_direct_conf1_mq = {
23974 .read = pci_conf1_mq_read,
23975 .write = pci_conf1_mq_write
23976 };
23977 diff -urNp linux-2.6.32.46/arch/x86/pci/olpc.c linux-2.6.32.46/arch/x86/pci/olpc.c
23978 --- linux-2.6.32.46/arch/x86/pci/olpc.c 2011-03-27 14:31:47.000000000 -0400
23979 +++ linux-2.6.32.46/arch/x86/pci/olpc.c 2011-04-17 15:56:46.000000000 -0400
23980 @@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
23981 return 0;
23982 }
23983
23984 -static struct pci_raw_ops pci_olpc_conf = {
23985 +static const struct pci_raw_ops pci_olpc_conf = {
23986 .read = pci_olpc_read,
23987 .write = pci_olpc_write,
23988 };
23989 diff -urNp linux-2.6.32.46/arch/x86/pci/pcbios.c linux-2.6.32.46/arch/x86/pci/pcbios.c
23990 --- linux-2.6.32.46/arch/x86/pci/pcbios.c 2011-03-27 14:31:47.000000000 -0400
23991 +++ linux-2.6.32.46/arch/x86/pci/pcbios.c 2011-04-17 15:56:46.000000000 -0400
23992 @@ -56,50 +56,93 @@ union bios32 {
23993 static struct {
23994 unsigned long address;
23995 unsigned short segment;
23996 -} bios32_indirect = { 0, __KERNEL_CS };
23997 +} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
23998
23999 /*
24000 * Returns the entry point for the given service, NULL on error
24001 */
24002
24003 -static unsigned long bios32_service(unsigned long service)
24004 +static unsigned long __devinit bios32_service(unsigned long service)
24005 {
24006 unsigned char return_code; /* %al */
24007 unsigned long address; /* %ebx */
24008 unsigned long length; /* %ecx */
24009 unsigned long entry; /* %edx */
24010 unsigned long flags;
24011 + struct desc_struct d, *gdt;
24012
24013 local_irq_save(flags);
24014 - __asm__("lcall *(%%edi); cld"
24015 +
24016 + gdt = get_cpu_gdt_table(smp_processor_id());
24017 +
24018 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
24019 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
24020 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
24021 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
24022 +
24023 + __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
24024 : "=a" (return_code),
24025 "=b" (address),
24026 "=c" (length),
24027 "=d" (entry)
24028 : "0" (service),
24029 "1" (0),
24030 - "D" (&bios32_indirect));
24031 + "D" (&bios32_indirect),
24032 + "r"(__PCIBIOS_DS)
24033 + : "memory");
24034 +
24035 + pax_open_kernel();
24036 + gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
24037 + gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
24038 + gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
24039 + gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
24040 + pax_close_kernel();
24041 +
24042 local_irq_restore(flags);
24043
24044 switch (return_code) {
24045 - case 0:
24046 - return address + entry;
24047 - case 0x80: /* Not present */
24048 - printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
24049 - return 0;
24050 - default: /* Shouldn't happen */
24051 - printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
24052 - service, return_code);
24053 + case 0: {
24054 + int cpu;
24055 + unsigned char flags;
24056 +
24057 + printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
24058 + if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
24059 + printk(KERN_WARNING "bios32_service: not valid\n");
24060 return 0;
24061 + }
24062 + address = address + PAGE_OFFSET;
24063 + length += 16UL; /* some BIOSs underreport this... */
24064 + flags = 4;
24065 + if (length >= 64*1024*1024) {
24066 + length >>= PAGE_SHIFT;
24067 + flags |= 8;
24068 + }
24069 +
24070 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
24071 + gdt = get_cpu_gdt_table(cpu);
24072 + pack_descriptor(&d, address, length, 0x9b, flags);
24073 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
24074 + pack_descriptor(&d, address, length, 0x93, flags);
24075 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
24076 + }
24077 + return entry;
24078 + }
24079 + case 0x80: /* Not present */
24080 + printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
24081 + return 0;
24082 + default: /* Shouldn't happen */
24083 + printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
24084 + service, return_code);
24085 + return 0;
24086 }
24087 }
24088
24089 static struct {
24090 unsigned long address;
24091 unsigned short segment;
24092 -} pci_indirect = { 0, __KERNEL_CS };
24093 +} pci_indirect __read_only = { 0, __PCIBIOS_CS };
24094
24095 -static int pci_bios_present;
24096 +static int pci_bios_present __read_only;
24097
24098 static int __devinit check_pcibios(void)
24099 {
24100 @@ -108,11 +151,13 @@ static int __devinit check_pcibios(void)
24101 unsigned long flags, pcibios_entry;
24102
24103 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
24104 - pci_indirect.address = pcibios_entry + PAGE_OFFSET;
24105 + pci_indirect.address = pcibios_entry;
24106
24107 local_irq_save(flags);
24108 - __asm__(
24109 - "lcall *(%%edi); cld\n\t"
24110 + __asm__("movw %w6, %%ds\n\t"
24111 + "lcall *%%ss:(%%edi); cld\n\t"
24112 + "push %%ss\n\t"
24113 + "pop %%ds\n\t"
24114 "jc 1f\n\t"
24115 "xor %%ah, %%ah\n"
24116 "1:"
24117 @@ -121,7 +166,8 @@ static int __devinit check_pcibios(void)
24118 "=b" (ebx),
24119 "=c" (ecx)
24120 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
24121 - "D" (&pci_indirect)
24122 + "D" (&pci_indirect),
24123 + "r" (__PCIBIOS_DS)
24124 : "memory");
24125 local_irq_restore(flags);
24126
24127 @@ -165,7 +211,10 @@ static int pci_bios_read(unsigned int se
24128
24129 switch (len) {
24130 case 1:
24131 - __asm__("lcall *(%%esi); cld\n\t"
24132 + __asm__("movw %w6, %%ds\n\t"
24133 + "lcall *%%ss:(%%esi); cld\n\t"
24134 + "push %%ss\n\t"
24135 + "pop %%ds\n\t"
24136 "jc 1f\n\t"
24137 "xor %%ah, %%ah\n"
24138 "1:"
24139 @@ -174,7 +223,8 @@ static int pci_bios_read(unsigned int se
24140 : "1" (PCIBIOS_READ_CONFIG_BYTE),
24141 "b" (bx),
24142 "D" ((long)reg),
24143 - "S" (&pci_indirect));
24144 + "S" (&pci_indirect),
24145 + "r" (__PCIBIOS_DS));
24146 /*
24147 * Zero-extend the result beyond 8 bits, do not trust the
24148 * BIOS having done it:
24149 @@ -182,7 +232,10 @@ static int pci_bios_read(unsigned int se
24150 *value &= 0xff;
24151 break;
24152 case 2:
24153 - __asm__("lcall *(%%esi); cld\n\t"
24154 + __asm__("movw %w6, %%ds\n\t"
24155 + "lcall *%%ss:(%%esi); cld\n\t"
24156 + "push %%ss\n\t"
24157 + "pop %%ds\n\t"
24158 "jc 1f\n\t"
24159 "xor %%ah, %%ah\n"
24160 "1:"
24161 @@ -191,7 +244,8 @@ static int pci_bios_read(unsigned int se
24162 : "1" (PCIBIOS_READ_CONFIG_WORD),
24163 "b" (bx),
24164 "D" ((long)reg),
24165 - "S" (&pci_indirect));
24166 + "S" (&pci_indirect),
24167 + "r" (__PCIBIOS_DS));
24168 /*
24169 * Zero-extend the result beyond 16 bits, do not trust the
24170 * BIOS having done it:
24171 @@ -199,7 +253,10 @@ static int pci_bios_read(unsigned int se
24172 *value &= 0xffff;
24173 break;
24174 case 4:
24175 - __asm__("lcall *(%%esi); cld\n\t"
24176 + __asm__("movw %w6, %%ds\n\t"
24177 + "lcall *%%ss:(%%esi); cld\n\t"
24178 + "push %%ss\n\t"
24179 + "pop %%ds\n\t"
24180 "jc 1f\n\t"
24181 "xor %%ah, %%ah\n"
24182 "1:"
24183 @@ -208,7 +265,8 @@ static int pci_bios_read(unsigned int se
24184 : "1" (PCIBIOS_READ_CONFIG_DWORD),
24185 "b" (bx),
24186 "D" ((long)reg),
24187 - "S" (&pci_indirect));
24188 + "S" (&pci_indirect),
24189 + "r" (__PCIBIOS_DS));
24190 break;
24191 }
24192
24193 @@ -231,7 +289,10 @@ static int pci_bios_write(unsigned int s
24194
24195 switch (len) {
24196 case 1:
24197 - __asm__("lcall *(%%esi); cld\n\t"
24198 + __asm__("movw %w6, %%ds\n\t"
24199 + "lcall *%%ss:(%%esi); cld\n\t"
24200 + "push %%ss\n\t"
24201 + "pop %%ds\n\t"
24202 "jc 1f\n\t"
24203 "xor %%ah, %%ah\n"
24204 "1:"
24205 @@ -240,10 +301,14 @@ static int pci_bios_write(unsigned int s
24206 "c" (value),
24207 "b" (bx),
24208 "D" ((long)reg),
24209 - "S" (&pci_indirect));
24210 + "S" (&pci_indirect),
24211 + "r" (__PCIBIOS_DS));
24212 break;
24213 case 2:
24214 - __asm__("lcall *(%%esi); cld\n\t"
24215 + __asm__("movw %w6, %%ds\n\t"
24216 + "lcall *%%ss:(%%esi); cld\n\t"
24217 + "push %%ss\n\t"
24218 + "pop %%ds\n\t"
24219 "jc 1f\n\t"
24220 "xor %%ah, %%ah\n"
24221 "1:"
24222 @@ -252,10 +317,14 @@ static int pci_bios_write(unsigned int s
24223 "c" (value),
24224 "b" (bx),
24225 "D" ((long)reg),
24226 - "S" (&pci_indirect));
24227 + "S" (&pci_indirect),
24228 + "r" (__PCIBIOS_DS));
24229 break;
24230 case 4:
24231 - __asm__("lcall *(%%esi); cld\n\t"
24232 + __asm__("movw %w6, %%ds\n\t"
24233 + "lcall *%%ss:(%%esi); cld\n\t"
24234 + "push %%ss\n\t"
24235 + "pop %%ds\n\t"
24236 "jc 1f\n\t"
24237 "xor %%ah, %%ah\n"
24238 "1:"
24239 @@ -264,7 +333,8 @@ static int pci_bios_write(unsigned int s
24240 "c" (value),
24241 "b" (bx),
24242 "D" ((long)reg),
24243 - "S" (&pci_indirect));
24244 + "S" (&pci_indirect),
24245 + "r" (__PCIBIOS_DS));
24246 break;
24247 }
24248
24249 @@ -278,7 +348,7 @@ static int pci_bios_write(unsigned int s
24250 * Function table for BIOS32 access
24251 */
24252
24253 -static struct pci_raw_ops pci_bios_access = {
24254 +static const struct pci_raw_ops pci_bios_access = {
24255 .read = pci_bios_read,
24256 .write = pci_bios_write
24257 };
24258 @@ -287,7 +357,7 @@ static struct pci_raw_ops pci_bios_acces
24259 * Try to find PCI BIOS.
24260 */
24261
24262 -static struct pci_raw_ops * __devinit pci_find_bios(void)
24263 +static const struct pci_raw_ops * __devinit pci_find_bios(void)
24264 {
24265 union bios32 *check;
24266 unsigned char sum;
24267 @@ -368,10 +438,13 @@ struct irq_routing_table * pcibios_get_i
24268
24269 DBG("PCI: Fetching IRQ routing table... ");
24270 __asm__("push %%es\n\t"
24271 + "movw %w8, %%ds\n\t"
24272 "push %%ds\n\t"
24273 "pop %%es\n\t"
24274 - "lcall *(%%esi); cld\n\t"
24275 + "lcall *%%ss:(%%esi); cld\n\t"
24276 "pop %%es\n\t"
24277 + "push %%ss\n\t"
24278 + "pop %%ds\n"
24279 "jc 1f\n\t"
24280 "xor %%ah, %%ah\n"
24281 "1:"
24282 @@ -382,7 +455,8 @@ struct irq_routing_table * pcibios_get_i
24283 "1" (0),
24284 "D" ((long) &opt),
24285 "S" (&pci_indirect),
24286 - "m" (opt)
24287 + "m" (opt),
24288 + "r" (__PCIBIOS_DS)
24289 : "memory");
24290 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
24291 if (ret & 0xff00)
24292 @@ -406,7 +480,10 @@ int pcibios_set_irq_routing(struct pci_d
24293 {
24294 int ret;
24295
24296 - __asm__("lcall *(%%esi); cld\n\t"
24297 + __asm__("movw %w5, %%ds\n\t"
24298 + "lcall *%%ss:(%%esi); cld\n\t"
24299 + "push %%ss\n\t"
24300 + "pop %%ds\n"
24301 "jc 1f\n\t"
24302 "xor %%ah, %%ah\n"
24303 "1:"
24304 @@ -414,7 +491,8 @@ int pcibios_set_irq_routing(struct pci_d
24305 : "0" (PCIBIOS_SET_PCI_HW_INT),
24306 "b" ((dev->bus->number << 8) | dev->devfn),
24307 "c" ((irq << 8) | (pin + 10)),
24308 - "S" (&pci_indirect));
24309 + "S" (&pci_indirect),
24310 + "r" (__PCIBIOS_DS));
24311 return !(ret & 0xff00);
24312 }
24313 EXPORT_SYMBOL(pcibios_set_irq_routing);
24314 diff -urNp linux-2.6.32.46/arch/x86/power/cpu.c linux-2.6.32.46/arch/x86/power/cpu.c
24315 --- linux-2.6.32.46/arch/x86/power/cpu.c 2011-03-27 14:31:47.000000000 -0400
24316 +++ linux-2.6.32.46/arch/x86/power/cpu.c 2011-04-17 15:56:46.000000000 -0400
24317 @@ -129,7 +129,7 @@ static void do_fpu_end(void)
24318 static void fix_processor_context(void)
24319 {
24320 int cpu = smp_processor_id();
24321 - struct tss_struct *t = &per_cpu(init_tss, cpu);
24322 + struct tss_struct *t = init_tss + cpu;
24323
24324 set_tss_desc(cpu, t); /*
24325 * This just modifies memory; should not be
24326 @@ -139,7 +139,9 @@ static void fix_processor_context(void)
24327 */
24328
24329 #ifdef CONFIG_X86_64
24330 + pax_open_kernel();
24331 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
24332 + pax_close_kernel();
24333
24334 syscall_init(); /* This sets MSR_*STAR and related */
24335 #endif
24336 diff -urNp linux-2.6.32.46/arch/x86/vdso/Makefile linux-2.6.32.46/arch/x86/vdso/Makefile
24337 --- linux-2.6.32.46/arch/x86/vdso/Makefile 2011-03-27 14:31:47.000000000 -0400
24338 +++ linux-2.6.32.46/arch/x86/vdso/Makefile 2011-04-17 15:56:46.000000000 -0400
24339 @@ -122,7 +122,7 @@ quiet_cmd_vdso = VDSO $@
24340 $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
24341 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
24342
24343 -VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
24344 +VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
24345 GCOV_PROFILE := n
24346
24347 #
24348 diff -urNp linux-2.6.32.46/arch/x86/vdso/vclock_gettime.c linux-2.6.32.46/arch/x86/vdso/vclock_gettime.c
24349 --- linux-2.6.32.46/arch/x86/vdso/vclock_gettime.c 2011-03-27 14:31:47.000000000 -0400
24350 +++ linux-2.6.32.46/arch/x86/vdso/vclock_gettime.c 2011-04-17 15:56:46.000000000 -0400
24351 @@ -22,24 +22,48 @@
24352 #include <asm/hpet.h>
24353 #include <asm/unistd.h>
24354 #include <asm/io.h>
24355 +#include <asm/fixmap.h>
24356 #include "vextern.h"
24357
24358 #define gtod vdso_vsyscall_gtod_data
24359
24360 +notrace noinline long __vdso_fallback_time(long *t)
24361 +{
24362 + long secs;
24363 + asm volatile("syscall"
24364 + : "=a" (secs)
24365 + : "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
24366 + return secs;
24367 +}
24368 +
24369 notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
24370 {
24371 long ret;
24372 asm("syscall" : "=a" (ret) :
24373 - "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
24374 + "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
24375 return ret;
24376 }
24377
24378 +notrace static inline cycle_t __vdso_vread_hpet(void)
24379 +{
24380 + return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
24381 +}
24382 +
24383 +notrace static inline cycle_t __vdso_vread_tsc(void)
24384 +{
24385 + cycle_t ret = (cycle_t)vget_cycles();
24386 +
24387 + return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
24388 +}
24389 +
24390 notrace static inline long vgetns(void)
24391 {
24392 long v;
24393 - cycles_t (*vread)(void);
24394 - vread = gtod->clock.vread;
24395 - v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
24396 + if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
24397 + v = __vdso_vread_tsc();
24398 + else
24399 + v = __vdso_vread_hpet();
24400 + v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
24401 return (v * gtod->clock.mult) >> gtod->clock.shift;
24402 }
24403
24404 @@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
24405
24406 notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
24407 {
24408 - if (likely(gtod->sysctl_enabled))
24409 + if (likely(gtod->sysctl_enabled &&
24410 + ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
24411 + (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
24412 switch (clock) {
24413 case CLOCK_REALTIME:
24414 if (likely(gtod->clock.vread))
24415 @@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
24416 int clock_gettime(clockid_t, struct timespec *)
24417 __attribute__((weak, alias("__vdso_clock_gettime")));
24418
24419 -notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
24420 +notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
24421 {
24422 long ret;
24423 - if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
24424 + asm("syscall" : "=a" (ret) :
24425 + "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
24426 + return ret;
24427 +}
24428 +
24429 +notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
24430 +{
24431 + if (likely(gtod->sysctl_enabled &&
24432 + ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
24433 + (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
24434 + {
24435 if (likely(tv != NULL)) {
24436 BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
24437 offsetof(struct timespec, tv_nsec) ||
24438 @@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
24439 }
24440 return 0;
24441 }
24442 - asm("syscall" : "=a" (ret) :
24443 - "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
24444 - return ret;
24445 + return __vdso_fallback_gettimeofday(tv, tz);
24446 }
24447 int gettimeofday(struct timeval *, struct timezone *)
24448 __attribute__((weak, alias("__vdso_gettimeofday")));
24449 diff -urNp linux-2.6.32.46/arch/x86/vdso/vdso32-setup.c linux-2.6.32.46/arch/x86/vdso/vdso32-setup.c
24450 --- linux-2.6.32.46/arch/x86/vdso/vdso32-setup.c 2011-03-27 14:31:47.000000000 -0400
24451 +++ linux-2.6.32.46/arch/x86/vdso/vdso32-setup.c 2011-04-23 12:56:10.000000000 -0400
24452 @@ -25,6 +25,7 @@
24453 #include <asm/tlbflush.h>
24454 #include <asm/vdso.h>
24455 #include <asm/proto.h>
24456 +#include <asm/mman.h>
24457
24458 enum {
24459 VDSO_DISABLED = 0,
24460 @@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
24461 void enable_sep_cpu(void)
24462 {
24463 int cpu = get_cpu();
24464 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
24465 + struct tss_struct *tss = init_tss + cpu;
24466
24467 if (!boot_cpu_has(X86_FEATURE_SEP)) {
24468 put_cpu();
24469 @@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
24470 gate_vma.vm_start = FIXADDR_USER_START;
24471 gate_vma.vm_end = FIXADDR_USER_END;
24472 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
24473 - gate_vma.vm_page_prot = __P101;
24474 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
24475 /*
24476 * Make sure the vDSO gets into every core dump.
24477 * Dumping its contents makes post-mortem fully interpretable later
24478 @@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
24479 if (compat)
24480 addr = VDSO_HIGH_BASE;
24481 else {
24482 - addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
24483 + addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
24484 if (IS_ERR_VALUE(addr)) {
24485 ret = addr;
24486 goto up_fail;
24487 }
24488 }
24489
24490 - current->mm->context.vdso = (void *)addr;
24491 + current->mm->context.vdso = addr;
24492
24493 if (compat_uses_vma || !compat) {
24494 /*
24495 @@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
24496 }
24497
24498 current_thread_info()->sysenter_return =
24499 - VDSO32_SYMBOL(addr, SYSENTER_RETURN);
24500 + (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
24501
24502 up_fail:
24503 if (ret)
24504 - current->mm->context.vdso = NULL;
24505 + current->mm->context.vdso = 0;
24506
24507 up_write(&mm->mmap_sem);
24508
24509 @@ -413,8 +414,14 @@ __initcall(ia32_binfmt_init);
24510
24511 const char *arch_vma_name(struct vm_area_struct *vma)
24512 {
24513 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
24514 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
24515 return "[vdso]";
24516 +
24517 +#ifdef CONFIG_PAX_SEGMEXEC
24518 + if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
24519 + return "[vdso]";
24520 +#endif
24521 +
24522 return NULL;
24523 }
24524
24525 @@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
24526 struct mm_struct *mm = tsk->mm;
24527
24528 /* Check to see if this task was created in compat vdso mode */
24529 - if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
24530 + if (mm && mm->context.vdso == VDSO_HIGH_BASE)
24531 return &gate_vma;
24532 return NULL;
24533 }
24534 diff -urNp linux-2.6.32.46/arch/x86/vdso/vdso.lds.S linux-2.6.32.46/arch/x86/vdso/vdso.lds.S
24535 --- linux-2.6.32.46/arch/x86/vdso/vdso.lds.S 2011-03-27 14:31:47.000000000 -0400
24536 +++ linux-2.6.32.46/arch/x86/vdso/vdso.lds.S 2011-06-06 17:35:35.000000000 -0400
24537 @@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
24538 #define VEXTERN(x) VDSO64_ ## x = vdso_ ## x;
24539 #include "vextern.h"
24540 #undef VEXTERN
24541 +
24542 +#define VEXTERN(x) VDSO64_ ## x = __vdso_ ## x;
24543 +VEXTERN(fallback_gettimeofday)
24544 +VEXTERN(fallback_time)
24545 +VEXTERN(getcpu)
24546 +#undef VEXTERN
24547 diff -urNp linux-2.6.32.46/arch/x86/vdso/vextern.h linux-2.6.32.46/arch/x86/vdso/vextern.h
24548 --- linux-2.6.32.46/arch/x86/vdso/vextern.h 2011-03-27 14:31:47.000000000 -0400
24549 +++ linux-2.6.32.46/arch/x86/vdso/vextern.h 2011-04-17 15:56:46.000000000 -0400
24550 @@ -11,6 +11,5 @@
24551 put into vextern.h and be referenced as a pointer with vdso prefix.
24552 The main kernel later fills in the values. */
24553
24554 -VEXTERN(jiffies)
24555 VEXTERN(vgetcpu_mode)
24556 VEXTERN(vsyscall_gtod_data)
24557 diff -urNp linux-2.6.32.46/arch/x86/vdso/vma.c linux-2.6.32.46/arch/x86/vdso/vma.c
24558 --- linux-2.6.32.46/arch/x86/vdso/vma.c 2011-03-27 14:31:47.000000000 -0400
24559 +++ linux-2.6.32.46/arch/x86/vdso/vma.c 2011-08-23 20:24:19.000000000 -0400
24560 @@ -17,8 +17,6 @@
24561 #include "vextern.h" /* Just for VMAGIC. */
24562 #undef VEXTERN
24563
24564 -unsigned int __read_mostly vdso_enabled = 1;
24565 -
24566 extern char vdso_start[], vdso_end[];
24567 extern unsigned short vdso_sync_cpuid;
24568
24569 @@ -27,10 +25,8 @@ static unsigned vdso_size;
24570
24571 static inline void *var_ref(void *p, char *name)
24572 {
24573 - if (*(void **)p != (void *)VMAGIC) {
24574 - printk("VDSO: variable %s broken\n", name);
24575 - vdso_enabled = 0;
24576 - }
24577 + if (*(void **)p != (void *)VMAGIC)
24578 + panic("VDSO: variable %s broken\n", name);
24579 return p;
24580 }
24581
24582 @@ -57,21 +53,18 @@ static int __init init_vdso_vars(void)
24583 if (!vbase)
24584 goto oom;
24585
24586 - if (memcmp(vbase, "\177ELF", 4)) {
24587 - printk("VDSO: I'm broken; not ELF\n");
24588 - vdso_enabled = 0;
24589 - }
24590 + if (memcmp(vbase, ELFMAG, SELFMAG))
24591 + panic("VDSO: I'm broken; not ELF\n");
24592
24593 #define VEXTERN(x) \
24594 *(typeof(__ ## x) **) var_ref(VDSO64_SYMBOL(vbase, x), #x) = &__ ## x;
24595 #include "vextern.h"
24596 #undef VEXTERN
24597 + vunmap(vbase);
24598 return 0;
24599
24600 oom:
24601 - printk("Cannot allocate vdso\n");
24602 - vdso_enabled = 0;
24603 - return -ENOMEM;
24604 + panic("Cannot allocate vdso\n");
24605 }
24606 __initcall(init_vdso_vars);
24607
24608 @@ -105,9 +98,6 @@ int arch_setup_additional_pages(struct l
24609 unsigned long addr;
24610 int ret;
24611
24612 - if (!vdso_enabled)
24613 - return 0;
24614 -
24615 down_write(&mm->mmap_sem);
24616 addr = vdso_addr(mm->start_stack, vdso_size);
24617 addr = get_unmapped_area(NULL, addr, vdso_size, 0, 0);
24618 @@ -116,7 +106,7 @@ int arch_setup_additional_pages(struct l
24619 goto up_fail;
24620 }
24621
24622 - current->mm->context.vdso = (void *)addr;
24623 + current->mm->context.vdso = addr;
24624
24625 ret = install_special_mapping(mm, addr, vdso_size,
24626 VM_READ|VM_EXEC|
24627 @@ -124,7 +114,7 @@ int arch_setup_additional_pages(struct l
24628 VM_ALWAYSDUMP,
24629 vdso_pages);
24630 if (ret) {
24631 - current->mm->context.vdso = NULL;
24632 + current->mm->context.vdso = 0;
24633 goto up_fail;
24634 }
24635
24636 @@ -132,10 +122,3 @@ up_fail:
24637 up_write(&mm->mmap_sem);
24638 return ret;
24639 }
24640 -
24641 -static __init int vdso_setup(char *s)
24642 -{
24643 - vdso_enabled = simple_strtoul(s, NULL, 0);
24644 - return 0;
24645 -}
24646 -__setup("vdso=", vdso_setup);
24647 diff -urNp linux-2.6.32.46/arch/x86/xen/enlighten.c linux-2.6.32.46/arch/x86/xen/enlighten.c
24648 --- linux-2.6.32.46/arch/x86/xen/enlighten.c 2011-03-27 14:31:47.000000000 -0400
24649 +++ linux-2.6.32.46/arch/x86/xen/enlighten.c 2011-05-22 23:02:03.000000000 -0400
24650 @@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
24651
24652 struct shared_info xen_dummy_shared_info;
24653
24654 -void *xen_initial_gdt;
24655 -
24656 /*
24657 * Point at some empty memory to start with. We map the real shared_info
24658 * page as soon as fixmap is up and running.
24659 @@ -548,7 +546,7 @@ static void xen_write_idt_entry(gate_des
24660
24661 preempt_disable();
24662
24663 - start = __get_cpu_var(idt_desc).address;
24664 + start = (unsigned long)__get_cpu_var(idt_desc).address;
24665 end = start + __get_cpu_var(idt_desc).size + 1;
24666
24667 xen_mc_flush();
24668 @@ -993,7 +991,7 @@ static const struct pv_apic_ops xen_apic
24669 #endif
24670 };
24671
24672 -static void xen_reboot(int reason)
24673 +static __noreturn void xen_reboot(int reason)
24674 {
24675 struct sched_shutdown r = { .reason = reason };
24676
24677 @@ -1001,17 +999,17 @@ static void xen_reboot(int reason)
24678 BUG();
24679 }
24680
24681 -static void xen_restart(char *msg)
24682 +static __noreturn void xen_restart(char *msg)
24683 {
24684 xen_reboot(SHUTDOWN_reboot);
24685 }
24686
24687 -static void xen_emergency_restart(void)
24688 +static __noreturn void xen_emergency_restart(void)
24689 {
24690 xen_reboot(SHUTDOWN_reboot);
24691 }
24692
24693 -static void xen_machine_halt(void)
24694 +static __noreturn void xen_machine_halt(void)
24695 {
24696 xen_reboot(SHUTDOWN_poweroff);
24697 }
24698 @@ -1095,9 +1093,20 @@ asmlinkage void __init xen_start_kernel(
24699 */
24700 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
24701
24702 -#ifdef CONFIG_X86_64
24703 /* Work out if we support NX */
24704 - check_efer();
24705 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
24706 + if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
24707 + (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
24708 + unsigned l, h;
24709 +
24710 +#ifdef CONFIG_X86_PAE
24711 + nx_enabled = 1;
24712 +#endif
24713 + __supported_pte_mask |= _PAGE_NX;
24714 + rdmsr(MSR_EFER, l, h);
24715 + l |= EFER_NX;
24716 + wrmsr(MSR_EFER, l, h);
24717 + }
24718 #endif
24719
24720 xen_setup_features();
24721 @@ -1129,13 +1138,6 @@ asmlinkage void __init xen_start_kernel(
24722
24723 machine_ops = xen_machine_ops;
24724
24725 - /*
24726 - * The only reliable way to retain the initial address of the
24727 - * percpu gdt_page is to remember it here, so we can go and
24728 - * mark it RW later, when the initial percpu area is freed.
24729 - */
24730 - xen_initial_gdt = &per_cpu(gdt_page, 0);
24731 -
24732 xen_smp_init();
24733
24734 pgd = (pgd_t *)xen_start_info->pt_base;
24735 diff -urNp linux-2.6.32.46/arch/x86/xen/mmu.c linux-2.6.32.46/arch/x86/xen/mmu.c
24736 --- linux-2.6.32.46/arch/x86/xen/mmu.c 2011-07-13 17:23:04.000000000 -0400
24737 +++ linux-2.6.32.46/arch/x86/xen/mmu.c 2011-08-24 18:35:52.000000000 -0400
24738 @@ -1719,6 +1719,8 @@ __init pgd_t *xen_setup_kernel_pagetable
24739 convert_pfn_mfn(init_level4_pgt);
24740 convert_pfn_mfn(level3_ident_pgt);
24741 convert_pfn_mfn(level3_kernel_pgt);
24742 + convert_pfn_mfn(level3_vmalloc_pgt);
24743 + convert_pfn_mfn(level3_vmemmap_pgt);
24744
24745 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
24746 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
24747 @@ -1737,7 +1739,10 @@ __init pgd_t *xen_setup_kernel_pagetable
24748 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
24749 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
24750 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
24751 + set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
24752 + set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
24753 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
24754 + set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
24755 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
24756 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
24757
24758 @@ -1860,6 +1865,7 @@ static __init void xen_post_allocator_in
24759 pv_mmu_ops.set_pud = xen_set_pud;
24760 #if PAGETABLE_LEVELS == 4
24761 pv_mmu_ops.set_pgd = xen_set_pgd;
24762 + pv_mmu_ops.set_pgd_batched = xen_set_pgd;
24763 #endif
24764
24765 /* This will work as long as patching hasn't happened yet
24766 @@ -1946,6 +1952,7 @@ static const struct pv_mmu_ops xen_mmu_o
24767 .pud_val = PV_CALLEE_SAVE(xen_pud_val),
24768 .make_pud = PV_CALLEE_SAVE(xen_make_pud),
24769 .set_pgd = xen_set_pgd_hyper,
24770 + .set_pgd_batched = xen_set_pgd_hyper,
24771
24772 .alloc_pud = xen_alloc_pmd_init,
24773 .release_pud = xen_release_pmd_init,
24774 diff -urNp linux-2.6.32.46/arch/x86/xen/smp.c linux-2.6.32.46/arch/x86/xen/smp.c
24775 --- linux-2.6.32.46/arch/x86/xen/smp.c 2011-03-27 14:31:47.000000000 -0400
24776 +++ linux-2.6.32.46/arch/x86/xen/smp.c 2011-05-11 18:25:15.000000000 -0400
24777 @@ -167,11 +167,6 @@ static void __init xen_smp_prepare_boot_
24778 {
24779 BUG_ON(smp_processor_id() != 0);
24780 native_smp_prepare_boot_cpu();
24781 -
24782 - /* We've switched to the "real" per-cpu gdt, so make sure the
24783 - old memory can be recycled */
24784 - make_lowmem_page_readwrite(xen_initial_gdt);
24785 -
24786 xen_setup_vcpu_info_placement();
24787 }
24788
24789 @@ -231,12 +226,12 @@ cpu_initialize_context(unsigned int cpu,
24790 gdt = get_cpu_gdt_table(cpu);
24791
24792 ctxt->flags = VGCF_IN_KERNEL;
24793 - ctxt->user_regs.ds = __USER_DS;
24794 - ctxt->user_regs.es = __USER_DS;
24795 + ctxt->user_regs.ds = __KERNEL_DS;
24796 + ctxt->user_regs.es = __KERNEL_DS;
24797 ctxt->user_regs.ss = __KERNEL_DS;
24798 #ifdef CONFIG_X86_32
24799 ctxt->user_regs.fs = __KERNEL_PERCPU;
24800 - ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
24801 + savesegment(gs, ctxt->user_regs.gs);
24802 #else
24803 ctxt->gs_base_kernel = per_cpu_offset(cpu);
24804 #endif
24805 @@ -287,13 +282,12 @@ static int __cpuinit xen_cpu_up(unsigned
24806 int rc;
24807
24808 per_cpu(current_task, cpu) = idle;
24809 + per_cpu(current_tinfo, cpu) = &idle->tinfo;
24810 #ifdef CONFIG_X86_32
24811 irq_ctx_init(cpu);
24812 #else
24813 clear_tsk_thread_flag(idle, TIF_FORK);
24814 - per_cpu(kernel_stack, cpu) =
24815 - (unsigned long)task_stack_page(idle) -
24816 - KERNEL_STACK_OFFSET + THREAD_SIZE;
24817 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
24818 #endif
24819 xen_setup_runstate_info(cpu);
24820 xen_setup_timer(cpu);
24821 diff -urNp linux-2.6.32.46/arch/x86/xen/xen-asm_32.S linux-2.6.32.46/arch/x86/xen/xen-asm_32.S
24822 --- linux-2.6.32.46/arch/x86/xen/xen-asm_32.S 2011-03-27 14:31:47.000000000 -0400
24823 +++ linux-2.6.32.46/arch/x86/xen/xen-asm_32.S 2011-04-22 19:13:13.000000000 -0400
24824 @@ -83,14 +83,14 @@ ENTRY(xen_iret)
24825 ESP_OFFSET=4 # bytes pushed onto stack
24826
24827 /*
24828 - * Store vcpu_info pointer for easy access. Do it this way to
24829 - * avoid having to reload %fs
24830 + * Store vcpu_info pointer for easy access.
24831 */
24832 #ifdef CONFIG_SMP
24833 - GET_THREAD_INFO(%eax)
24834 - movl TI_cpu(%eax), %eax
24835 - movl __per_cpu_offset(,%eax,4), %eax
24836 - mov per_cpu__xen_vcpu(%eax), %eax
24837 + push %fs
24838 + mov $(__KERNEL_PERCPU), %eax
24839 + mov %eax, %fs
24840 + mov PER_CPU_VAR(xen_vcpu), %eax
24841 + pop %fs
24842 #else
24843 movl per_cpu__xen_vcpu, %eax
24844 #endif
24845 diff -urNp linux-2.6.32.46/arch/x86/xen/xen-head.S linux-2.6.32.46/arch/x86/xen/xen-head.S
24846 --- linux-2.6.32.46/arch/x86/xen/xen-head.S 2011-03-27 14:31:47.000000000 -0400
24847 +++ linux-2.6.32.46/arch/x86/xen/xen-head.S 2011-04-17 15:56:46.000000000 -0400
24848 @@ -19,6 +19,17 @@ ENTRY(startup_xen)
24849 #ifdef CONFIG_X86_32
24850 mov %esi,xen_start_info
24851 mov $init_thread_union+THREAD_SIZE,%esp
24852 +#ifdef CONFIG_SMP
24853 + movl $cpu_gdt_table,%edi
24854 + movl $__per_cpu_load,%eax
24855 + movw %ax,__KERNEL_PERCPU + 2(%edi)
24856 + rorl $16,%eax
24857 + movb %al,__KERNEL_PERCPU + 4(%edi)
24858 + movb %ah,__KERNEL_PERCPU + 7(%edi)
24859 + movl $__per_cpu_end - 1,%eax
24860 + subl $__per_cpu_start,%eax
24861 + movw %ax,__KERNEL_PERCPU + 0(%edi)
24862 +#endif
24863 #else
24864 mov %rsi,xen_start_info
24865 mov $init_thread_union+THREAD_SIZE,%rsp
24866 diff -urNp linux-2.6.32.46/arch/x86/xen/xen-ops.h linux-2.6.32.46/arch/x86/xen/xen-ops.h
24867 --- linux-2.6.32.46/arch/x86/xen/xen-ops.h 2011-03-27 14:31:47.000000000 -0400
24868 +++ linux-2.6.32.46/arch/x86/xen/xen-ops.h 2011-04-17 15:56:46.000000000 -0400
24869 @@ -10,8 +10,6 @@
24870 extern const char xen_hypervisor_callback[];
24871 extern const char xen_failsafe_callback[];
24872
24873 -extern void *xen_initial_gdt;
24874 -
24875 struct trap_info;
24876 void xen_copy_trap_info(struct trap_info *traps);
24877
24878 diff -urNp linux-2.6.32.46/block/blk-integrity.c linux-2.6.32.46/block/blk-integrity.c
24879 --- linux-2.6.32.46/block/blk-integrity.c 2011-03-27 14:31:47.000000000 -0400
24880 +++ linux-2.6.32.46/block/blk-integrity.c 2011-04-17 15:56:46.000000000 -0400
24881 @@ -278,7 +278,7 @@ static struct attribute *integrity_attrs
24882 NULL,
24883 };
24884
24885 -static struct sysfs_ops integrity_ops = {
24886 +static const struct sysfs_ops integrity_ops = {
24887 .show = &integrity_attr_show,
24888 .store = &integrity_attr_store,
24889 };
24890 diff -urNp linux-2.6.32.46/block/blk-iopoll.c linux-2.6.32.46/block/blk-iopoll.c
24891 --- linux-2.6.32.46/block/blk-iopoll.c 2011-03-27 14:31:47.000000000 -0400
24892 +++ linux-2.6.32.46/block/blk-iopoll.c 2011-04-17 15:56:46.000000000 -0400
24893 @@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
24894 }
24895 EXPORT_SYMBOL(blk_iopoll_complete);
24896
24897 -static void blk_iopoll_softirq(struct softirq_action *h)
24898 +static void blk_iopoll_softirq(void)
24899 {
24900 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
24901 int rearm = 0, budget = blk_iopoll_budget;
24902 diff -urNp linux-2.6.32.46/block/blk-map.c linux-2.6.32.46/block/blk-map.c
24903 --- linux-2.6.32.46/block/blk-map.c 2011-03-27 14:31:47.000000000 -0400
24904 +++ linux-2.6.32.46/block/blk-map.c 2011-04-18 16:57:33.000000000 -0400
24905 @@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct requ
24906 * direct dma. else, set up kernel bounce buffers
24907 */
24908 uaddr = (unsigned long) ubuf;
24909 - if (blk_rq_aligned(q, ubuf, len) && !map_data)
24910 + if (blk_rq_aligned(q, (__force void *)ubuf, len) && !map_data)
24911 bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
24912 else
24913 bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
24914 @@ -201,12 +201,13 @@ int blk_rq_map_user_iov(struct request_q
24915 for (i = 0; i < iov_count; i++) {
24916 unsigned long uaddr = (unsigned long)iov[i].iov_base;
24917
24918 + if (!iov[i].iov_len)
24919 + return -EINVAL;
24920 +
24921 if (uaddr & queue_dma_alignment(q)) {
24922 unaligned = 1;
24923 break;
24924 }
24925 - if (!iov[i].iov_len)
24926 - return -EINVAL;
24927 }
24928
24929 if (unaligned || (q->dma_pad_mask & len) || map_data)
24930 @@ -299,7 +300,7 @@ int blk_rq_map_kern(struct request_queue
24931 if (!len || !kbuf)
24932 return -EINVAL;
24933
24934 - do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
24935 + do_copy = !blk_rq_aligned(q, kbuf, len) || object_starts_on_stack(kbuf);
24936 if (do_copy)
24937 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
24938 else
24939 diff -urNp linux-2.6.32.46/block/blk-softirq.c linux-2.6.32.46/block/blk-softirq.c
24940 --- linux-2.6.32.46/block/blk-softirq.c 2011-03-27 14:31:47.000000000 -0400
24941 +++ linux-2.6.32.46/block/blk-softirq.c 2011-04-17 15:56:46.000000000 -0400
24942 @@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head,
24943 * Softirq action handler - move entries to local list and loop over them
24944 * while passing them to the queue registered handler.
24945 */
24946 -static void blk_done_softirq(struct softirq_action *h)
24947 +static void blk_done_softirq(void)
24948 {
24949 struct list_head *cpu_list, local_list;
24950
24951 diff -urNp linux-2.6.32.46/block/blk-sysfs.c linux-2.6.32.46/block/blk-sysfs.c
24952 --- linux-2.6.32.46/block/blk-sysfs.c 2011-05-10 22:12:01.000000000 -0400
24953 +++ linux-2.6.32.46/block/blk-sysfs.c 2011-05-10 22:12:26.000000000 -0400
24954 @@ -414,7 +414,7 @@ static void blk_release_queue(struct kob
24955 kmem_cache_free(blk_requestq_cachep, q);
24956 }
24957
24958 -static struct sysfs_ops queue_sysfs_ops = {
24959 +static const struct sysfs_ops queue_sysfs_ops = {
24960 .show = queue_attr_show,
24961 .store = queue_attr_store,
24962 };
24963 diff -urNp linux-2.6.32.46/block/bsg.c linux-2.6.32.46/block/bsg.c
24964 --- linux-2.6.32.46/block/bsg.c 2011-03-27 14:31:47.000000000 -0400
24965 +++ linux-2.6.32.46/block/bsg.c 2011-10-06 09:37:08.000000000 -0400
24966 @@ -175,16 +175,24 @@ static int blk_fill_sgv4_hdr_rq(struct r
24967 struct sg_io_v4 *hdr, struct bsg_device *bd,
24968 fmode_t has_write_perm)
24969 {
24970 + unsigned char tmpcmd[sizeof(rq->__cmd)];
24971 + unsigned char *cmdptr;
24972 +
24973 if (hdr->request_len > BLK_MAX_CDB) {
24974 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
24975 if (!rq->cmd)
24976 return -ENOMEM;
24977 - }
24978 + cmdptr = rq->cmd;
24979 + } else
24980 + cmdptr = tmpcmd;
24981
24982 - if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
24983 + if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request,
24984 hdr->request_len))
24985 return -EFAULT;
24986
24987 + if (cmdptr != rq->cmd)
24988 + memcpy(rq->cmd, cmdptr, hdr->request_len);
24989 +
24990 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
24991 if (blk_verify_command(rq->cmd, has_write_perm))
24992 return -EPERM;
24993 @@ -282,7 +290,7 @@ bsg_map_hdr(struct bsg_device *bd, struc
24994 rq->next_rq = next_rq;
24995 next_rq->cmd_type = rq->cmd_type;
24996
24997 - dxferp = (void*)(unsigned long)hdr->din_xferp;
24998 + dxferp = (void __user *)(unsigned long)hdr->din_xferp;
24999 ret = blk_rq_map_user(q, next_rq, NULL, dxferp,
25000 hdr->din_xfer_len, GFP_KERNEL);
25001 if (ret)
25002 @@ -291,10 +299,10 @@ bsg_map_hdr(struct bsg_device *bd, struc
25003
25004 if (hdr->dout_xfer_len) {
25005 dxfer_len = hdr->dout_xfer_len;
25006 - dxferp = (void*)(unsigned long)hdr->dout_xferp;
25007 + dxferp = (void __user *)(unsigned long)hdr->dout_xferp;
25008 } else if (hdr->din_xfer_len) {
25009 dxfer_len = hdr->din_xfer_len;
25010 - dxferp = (void*)(unsigned long)hdr->din_xferp;
25011 + dxferp = (void __user *)(unsigned long)hdr->din_xferp;
25012 } else
25013 dxfer_len = 0;
25014
25015 @@ -436,7 +444,7 @@ static int blk_complete_sgv4_hdr_rq(stru
25016 int len = min_t(unsigned int, hdr->max_response_len,
25017 rq->sense_len);
25018
25019 - ret = copy_to_user((void*)(unsigned long)hdr->response,
25020 + ret = copy_to_user((void __user *)(unsigned long)hdr->response,
25021 rq->sense, len);
25022 if (!ret)
25023 hdr->response_len = len;
25024 diff -urNp linux-2.6.32.46/block/compat_ioctl.c linux-2.6.32.46/block/compat_ioctl.c
25025 --- linux-2.6.32.46/block/compat_ioctl.c 2011-03-27 14:31:47.000000000 -0400
25026 +++ linux-2.6.32.46/block/compat_ioctl.c 2011-10-06 09:37:14.000000000 -0400
25027 @@ -354,7 +354,7 @@ static int compat_fd_ioctl(struct block_
25028 err |= __get_user(f->spec1, &uf->spec1);
25029 err |= __get_user(f->fmt_gap, &uf->fmt_gap);
25030 err |= __get_user(name, &uf->name);
25031 - f->name = compat_ptr(name);
25032 + f->name = (void __force_kernel *)compat_ptr(name);
25033 if (err) {
25034 err = -EFAULT;
25035 goto out;
25036 diff -urNp linux-2.6.32.46/block/elevator.c linux-2.6.32.46/block/elevator.c
25037 --- linux-2.6.32.46/block/elevator.c 2011-03-27 14:31:47.000000000 -0400
25038 +++ linux-2.6.32.46/block/elevator.c 2011-04-17 15:56:46.000000000 -0400
25039 @@ -889,7 +889,7 @@ elv_attr_store(struct kobject *kobj, str
25040 return error;
25041 }
25042
25043 -static struct sysfs_ops elv_sysfs_ops = {
25044 +static const struct sysfs_ops elv_sysfs_ops = {
25045 .show = elv_attr_show,
25046 .store = elv_attr_store,
25047 };
25048 diff -urNp linux-2.6.32.46/block/scsi_ioctl.c linux-2.6.32.46/block/scsi_ioctl.c
25049 --- linux-2.6.32.46/block/scsi_ioctl.c 2011-03-27 14:31:47.000000000 -0400
25050 +++ linux-2.6.32.46/block/scsi_ioctl.c 2011-04-23 13:28:22.000000000 -0400
25051 @@ -220,8 +220,20 @@ EXPORT_SYMBOL(blk_verify_command);
25052 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
25053 struct sg_io_hdr *hdr, fmode_t mode)
25054 {
25055 - if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
25056 + unsigned char tmpcmd[sizeof(rq->__cmd)];
25057 + unsigned char *cmdptr;
25058 +
25059 + if (rq->cmd != rq->__cmd)
25060 + cmdptr = rq->cmd;
25061 + else
25062 + cmdptr = tmpcmd;
25063 +
25064 + if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
25065 return -EFAULT;
25066 +
25067 + if (cmdptr != rq->cmd)
25068 + memcpy(rq->cmd, cmdptr, hdr->cmd_len);
25069 +
25070 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
25071 return -EPERM;
25072
25073 @@ -430,6 +442,8 @@ int sg_scsi_ioctl(struct request_queue *
25074 int err;
25075 unsigned int in_len, out_len, bytes, opcode, cmdlen;
25076 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
25077 + unsigned char tmpcmd[sizeof(rq->__cmd)];
25078 + unsigned char *cmdptr;
25079
25080 if (!sic)
25081 return -EINVAL;
25082 @@ -463,9 +477,18 @@ int sg_scsi_ioctl(struct request_queue *
25083 */
25084 err = -EFAULT;
25085 rq->cmd_len = cmdlen;
25086 - if (copy_from_user(rq->cmd, sic->data, cmdlen))
25087 +
25088 + if (rq->cmd != rq->__cmd)
25089 + cmdptr = rq->cmd;
25090 + else
25091 + cmdptr = tmpcmd;
25092 +
25093 + if (copy_from_user(cmdptr, sic->data, cmdlen))
25094 goto error;
25095
25096 + if (rq->cmd != cmdptr)
25097 + memcpy(rq->cmd, cmdptr, cmdlen);
25098 +
25099 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
25100 goto error;
25101
25102 diff -urNp linux-2.6.32.46/crypto/cryptd.c linux-2.6.32.46/crypto/cryptd.c
25103 --- linux-2.6.32.46/crypto/cryptd.c 2011-03-27 14:31:47.000000000 -0400
25104 +++ linux-2.6.32.46/crypto/cryptd.c 2011-08-23 21:22:32.000000000 -0400
25105 @@ -50,7 +50,7 @@ struct cryptd_blkcipher_ctx {
25106
25107 struct cryptd_blkcipher_request_ctx {
25108 crypto_completion_t complete;
25109 -};
25110 +} __no_const;
25111
25112 struct cryptd_hash_ctx {
25113 struct crypto_shash *child;
25114 diff -urNp linux-2.6.32.46/crypto/gf128mul.c linux-2.6.32.46/crypto/gf128mul.c
25115 --- linux-2.6.32.46/crypto/gf128mul.c 2011-03-27 14:31:47.000000000 -0400
25116 +++ linux-2.6.32.46/crypto/gf128mul.c 2011-07-06 19:53:33.000000000 -0400
25117 @@ -182,7 +182,7 @@ void gf128mul_lle(be128 *r, const be128
25118 for (i = 0; i < 7; ++i)
25119 gf128mul_x_lle(&p[i + 1], &p[i]);
25120
25121 - memset(r, 0, sizeof(r));
25122 + memset(r, 0, sizeof(*r));
25123 for (i = 0;;) {
25124 u8 ch = ((u8 *)b)[15 - i];
25125
25126 @@ -220,7 +220,7 @@ void gf128mul_bbe(be128 *r, const be128
25127 for (i = 0; i < 7; ++i)
25128 gf128mul_x_bbe(&p[i + 1], &p[i]);
25129
25130 - memset(r, 0, sizeof(r));
25131 + memset(r, 0, sizeof(*r));
25132 for (i = 0;;) {
25133 u8 ch = ((u8 *)b)[i];
25134
25135 diff -urNp linux-2.6.32.46/crypto/serpent.c linux-2.6.32.46/crypto/serpent.c
25136 --- linux-2.6.32.46/crypto/serpent.c 2011-03-27 14:31:47.000000000 -0400
25137 +++ linux-2.6.32.46/crypto/serpent.c 2011-08-18 23:59:56.000000000 -0400
25138 @@ -21,6 +21,7 @@
25139 #include <asm/byteorder.h>
25140 #include <linux/crypto.h>
25141 #include <linux/types.h>
25142 +#include <linux/sched.h>
25143
25144 /* Key is padded to the maximum of 256 bits before round key generation.
25145 * Any key length <= 256 bits (32 bytes) is allowed by the algorithm.
25146 @@ -224,6 +225,8 @@ static int serpent_setkey(struct crypto_
25147 u32 r0,r1,r2,r3,r4;
25148 int i;
25149
25150 + pax_track_stack();
25151 +
25152 /* Copy key, add padding */
25153
25154 for (i = 0; i < keylen; ++i)
25155 diff -urNp linux-2.6.32.46/Documentation/dontdiff linux-2.6.32.46/Documentation/dontdiff
25156 --- linux-2.6.32.46/Documentation/dontdiff 2011-03-27 14:31:47.000000000 -0400
25157 +++ linux-2.6.32.46/Documentation/dontdiff 2011-08-21 18:59:02.000000000 -0400
25158 @@ -1,13 +1,16 @@
25159 *.a
25160 *.aux
25161 *.bin
25162 +*.cis
25163 *.cpio
25164 *.csp
25165 +*.dbg
25166 *.dsp
25167 *.dvi
25168 *.elf
25169 *.eps
25170 *.fw
25171 +*.gcno
25172 *.gen.S
25173 *.gif
25174 *.grep
25175 @@ -38,8 +41,10 @@
25176 *.tab.h
25177 *.tex
25178 *.ver
25179 +*.vim
25180 *.xml
25181 *_MODULES
25182 +*_reg_safe.h
25183 *_vga16.c
25184 *~
25185 *.9
25186 @@ -49,11 +54,16 @@
25187 53c700_d.h
25188 CVS
25189 ChangeSet
25190 +GPATH
25191 +GRTAGS
25192 +GSYMS
25193 +GTAGS
25194 Image
25195 Kerntypes
25196 Module.markers
25197 Module.symvers
25198 PENDING
25199 +PERF*
25200 SCCS
25201 System.map*
25202 TAGS
25203 @@ -76,7 +86,11 @@ btfixupprep
25204 build
25205 bvmlinux
25206 bzImage*
25207 +capability_names.h
25208 +capflags.c
25209 classlist.h*
25210 +clut_vga16.c
25211 +common-cmds.h
25212 comp*.log
25213 compile.h*
25214 conf
25215 @@ -97,19 +111,21 @@ elfconfig.h*
25216 fixdep
25217 fore200e_mkfirm
25218 fore200e_pca_fw.c*
25219 +gate.lds
25220 gconf
25221 gen-devlist
25222 gen_crc32table
25223 gen_init_cpio
25224 genksyms
25225 *_gray256.c
25226 +hash
25227 ihex2fw
25228 ikconfig.h*
25229 initramfs_data.cpio
25230 +initramfs_data.cpio.bz2
25231 initramfs_data.cpio.gz
25232 initramfs_list
25233 kallsyms
25234 -kconfig
25235 keywords.c
25236 ksym.c*
25237 ksym.h*
25238 @@ -133,7 +149,9 @@ mkboot
25239 mkbugboot
25240 mkcpustr
25241 mkdep
25242 +mkpiggy
25243 mkprep
25244 +mkregtable
25245 mktables
25246 mktree
25247 modpost
25248 @@ -149,6 +167,7 @@ patches*
25249 pca200e.bin
25250 pca200e_ecd.bin2
25251 piggy.gz
25252 +piggy.S
25253 piggyback
25254 pnmtologo
25255 ppc_defs.h*
25256 @@ -157,12 +176,15 @@ qconf
25257 raid6altivec*.c
25258 raid6int*.c
25259 raid6tables.c
25260 +regdb.c
25261 relocs
25262 +rlim_names.h
25263 series
25264 setup
25265 setup.bin
25266 setup.elf
25267 sImage
25268 +slabinfo
25269 sm_tbl*
25270 split-include
25271 syscalltab.h
25272 @@ -186,14 +208,20 @@ version.h*
25273 vmlinux
25274 vmlinux-*
25275 vmlinux.aout
25276 +vmlinux.bin.all
25277 +vmlinux.bin.bz2
25278 vmlinux.lds
25279 +vmlinux.relocs
25280 +voffset.h
25281 vsyscall.lds
25282 vsyscall_32.lds
25283 wanxlfw.inc
25284 uImage
25285 unifdef
25286 +utsrelease.h
25287 wakeup.bin
25288 wakeup.elf
25289 wakeup.lds
25290 zImage*
25291 zconf.hash.c
25292 +zoffset.h
25293 diff -urNp linux-2.6.32.46/Documentation/kernel-parameters.txt linux-2.6.32.46/Documentation/kernel-parameters.txt
25294 --- linux-2.6.32.46/Documentation/kernel-parameters.txt 2011-03-27 14:31:47.000000000 -0400
25295 +++ linux-2.6.32.46/Documentation/kernel-parameters.txt 2011-04-17 15:56:45.000000000 -0400
25296 @@ -1837,6 +1837,13 @@ and is between 256 and 4096 characters.
25297 the specified number of seconds. This is to be used if
25298 your oopses keep scrolling off the screen.
25299
25300 + pax_nouderef [X86] disables UDEREF. Most likely needed under certain
25301 + virtualization environments that don't cope well with the
25302 + expand down segment used by UDEREF on X86-32 or the frequent
25303 + page table updates on X86-64.
25304 +
25305 + pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
25306 +
25307 pcbit= [HW,ISDN]
25308
25309 pcd. [PARIDE]
25310 diff -urNp linux-2.6.32.46/drivers/acpi/acpi_pad.c linux-2.6.32.46/drivers/acpi/acpi_pad.c
25311 --- linux-2.6.32.46/drivers/acpi/acpi_pad.c 2011-03-27 14:31:47.000000000 -0400
25312 +++ linux-2.6.32.46/drivers/acpi/acpi_pad.c 2011-04-17 15:56:46.000000000 -0400
25313 @@ -30,7 +30,7 @@
25314 #include <acpi/acpi_bus.h>
25315 #include <acpi/acpi_drivers.h>
25316
25317 -#define ACPI_PROCESSOR_AGGREGATOR_CLASS "processor_aggregator"
25318 +#define ACPI_PROCESSOR_AGGREGATOR_CLASS "acpi_pad"
25319 #define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"
25320 #define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80
25321 static DEFINE_MUTEX(isolated_cpus_lock);
25322 diff -urNp linux-2.6.32.46/drivers/acpi/battery.c linux-2.6.32.46/drivers/acpi/battery.c
25323 --- linux-2.6.32.46/drivers/acpi/battery.c 2011-03-27 14:31:47.000000000 -0400
25324 +++ linux-2.6.32.46/drivers/acpi/battery.c 2011-04-17 15:56:46.000000000 -0400
25325 @@ -763,7 +763,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
25326 }
25327
25328 static struct battery_file {
25329 - struct file_operations ops;
25330 + const struct file_operations ops;
25331 mode_t mode;
25332 const char *name;
25333 } acpi_battery_file[] = {
25334 diff -urNp linux-2.6.32.46/drivers/acpi/dock.c linux-2.6.32.46/drivers/acpi/dock.c
25335 --- linux-2.6.32.46/drivers/acpi/dock.c 2011-03-27 14:31:47.000000000 -0400
25336 +++ linux-2.6.32.46/drivers/acpi/dock.c 2011-04-17 15:56:46.000000000 -0400
25337 @@ -77,7 +77,7 @@ struct dock_dependent_device {
25338 struct list_head list;
25339 struct list_head hotplug_list;
25340 acpi_handle handle;
25341 - struct acpi_dock_ops *ops;
25342 + const struct acpi_dock_ops *ops;
25343 void *context;
25344 };
25345
25346 @@ -605,7 +605,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
25347 * the dock driver after _DCK is executed.
25348 */
25349 int
25350 -register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
25351 +register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
25352 void *context)
25353 {
25354 struct dock_dependent_device *dd;
25355 diff -urNp linux-2.6.32.46/drivers/acpi/osl.c linux-2.6.32.46/drivers/acpi/osl.c
25356 --- linux-2.6.32.46/drivers/acpi/osl.c 2011-03-27 14:31:47.000000000 -0400
25357 +++ linux-2.6.32.46/drivers/acpi/osl.c 2011-04-17 15:56:46.000000000 -0400
25358 @@ -523,6 +523,8 @@ acpi_os_read_memory(acpi_physical_addres
25359 void __iomem *virt_addr;
25360
25361 virt_addr = ioremap(phys_addr, width);
25362 + if (!virt_addr)
25363 + return AE_NO_MEMORY;
25364 if (!value)
25365 value = &dummy;
25366
25367 @@ -551,6 +553,8 @@ acpi_os_write_memory(acpi_physical_addre
25368 void __iomem *virt_addr;
25369
25370 virt_addr = ioremap(phys_addr, width);
25371 + if (!virt_addr)
25372 + return AE_NO_MEMORY;
25373
25374 switch (width) {
25375 case 8:
25376 diff -urNp linux-2.6.32.46/drivers/acpi/power_meter.c linux-2.6.32.46/drivers/acpi/power_meter.c
25377 --- linux-2.6.32.46/drivers/acpi/power_meter.c 2011-03-27 14:31:47.000000000 -0400
25378 +++ linux-2.6.32.46/drivers/acpi/power_meter.c 2011-04-17 15:56:46.000000000 -0400
25379 @@ -315,8 +315,6 @@ static ssize_t set_trip(struct device *d
25380 return res;
25381
25382 temp /= 1000;
25383 - if (temp < 0)
25384 - return -EINVAL;
25385
25386 mutex_lock(&resource->lock);
25387 resource->trip[attr->index - 7] = temp;
25388 diff -urNp linux-2.6.32.46/drivers/acpi/proc.c linux-2.6.32.46/drivers/acpi/proc.c
25389 --- linux-2.6.32.46/drivers/acpi/proc.c 2011-03-27 14:31:47.000000000 -0400
25390 +++ linux-2.6.32.46/drivers/acpi/proc.c 2011-04-17 15:56:46.000000000 -0400
25391 @@ -391,20 +391,15 @@ acpi_system_write_wakeup_device(struct f
25392 size_t count, loff_t * ppos)
25393 {
25394 struct list_head *node, *next;
25395 - char strbuf[5];
25396 - char str[5] = "";
25397 - unsigned int len = count;
25398 + char strbuf[5] = {0};
25399 struct acpi_device *found_dev = NULL;
25400
25401 - if (len > 4)
25402 - len = 4;
25403 - if (len < 0)
25404 - return -EFAULT;
25405 + if (count > 4)
25406 + count = 4;
25407
25408 - if (copy_from_user(strbuf, buffer, len))
25409 + if (copy_from_user(strbuf, buffer, count))
25410 return -EFAULT;
25411 - strbuf[len] = '\0';
25412 - sscanf(strbuf, "%s", str);
25413 + strbuf[count] = '\0';
25414
25415 mutex_lock(&acpi_device_lock);
25416 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
25417 @@ -413,7 +408,7 @@ acpi_system_write_wakeup_device(struct f
25418 if (!dev->wakeup.flags.valid)
25419 continue;
25420
25421 - if (!strncmp(dev->pnp.bus_id, str, 4)) {
25422 + if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
25423 dev->wakeup.state.enabled =
25424 dev->wakeup.state.enabled ? 0 : 1;
25425 found_dev = dev;
25426 diff -urNp linux-2.6.32.46/drivers/acpi/processor_core.c linux-2.6.32.46/drivers/acpi/processor_core.c
25427 --- linux-2.6.32.46/drivers/acpi/processor_core.c 2011-03-27 14:31:47.000000000 -0400
25428 +++ linux-2.6.32.46/drivers/acpi/processor_core.c 2011-04-17 15:56:46.000000000 -0400
25429 @@ -790,7 +790,7 @@ static int __cpuinit acpi_processor_add(
25430 return 0;
25431 }
25432
25433 - BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
25434 + BUG_ON(pr->id >= nr_cpu_ids);
25435
25436 /*
25437 * Buggy BIOS check
25438 diff -urNp linux-2.6.32.46/drivers/acpi/sbshc.c linux-2.6.32.46/drivers/acpi/sbshc.c
25439 --- linux-2.6.32.46/drivers/acpi/sbshc.c 2011-03-27 14:31:47.000000000 -0400
25440 +++ linux-2.6.32.46/drivers/acpi/sbshc.c 2011-04-17 15:56:46.000000000 -0400
25441 @@ -17,7 +17,7 @@
25442
25443 #define PREFIX "ACPI: "
25444
25445 -#define ACPI_SMB_HC_CLASS "smbus_host_controller"
25446 +#define ACPI_SMB_HC_CLASS "smbus_host_ctl"
25447 #define ACPI_SMB_HC_DEVICE_NAME "ACPI SMBus HC"
25448
25449 struct acpi_smb_hc {
25450 diff -urNp linux-2.6.32.46/drivers/acpi/sleep.c linux-2.6.32.46/drivers/acpi/sleep.c
25451 --- linux-2.6.32.46/drivers/acpi/sleep.c 2011-03-27 14:31:47.000000000 -0400
25452 +++ linux-2.6.32.46/drivers/acpi/sleep.c 2011-04-17 15:56:46.000000000 -0400
25453 @@ -283,7 +283,7 @@ static int acpi_suspend_state_valid(susp
25454 }
25455 }
25456
25457 -static struct platform_suspend_ops acpi_suspend_ops = {
25458 +static const struct platform_suspend_ops acpi_suspend_ops = {
25459 .valid = acpi_suspend_state_valid,
25460 .begin = acpi_suspend_begin,
25461 .prepare_late = acpi_pm_prepare,
25462 @@ -311,7 +311,7 @@ static int acpi_suspend_begin_old(suspen
25463 * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
25464 * been requested.
25465 */
25466 -static struct platform_suspend_ops acpi_suspend_ops_old = {
25467 +static const struct platform_suspend_ops acpi_suspend_ops_old = {
25468 .valid = acpi_suspend_state_valid,
25469 .begin = acpi_suspend_begin_old,
25470 .prepare_late = acpi_pm_disable_gpes,
25471 @@ -460,7 +460,7 @@ static void acpi_pm_enable_gpes(void)
25472 acpi_enable_all_runtime_gpes();
25473 }
25474
25475 -static struct platform_hibernation_ops acpi_hibernation_ops = {
25476 +static const struct platform_hibernation_ops acpi_hibernation_ops = {
25477 .begin = acpi_hibernation_begin,
25478 .end = acpi_pm_end,
25479 .pre_snapshot = acpi_hibernation_pre_snapshot,
25480 @@ -513,7 +513,7 @@ static int acpi_hibernation_pre_snapshot
25481 * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
25482 * been requested.
25483 */
25484 -static struct platform_hibernation_ops acpi_hibernation_ops_old = {
25485 +static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
25486 .begin = acpi_hibernation_begin_old,
25487 .end = acpi_pm_end,
25488 .pre_snapshot = acpi_hibernation_pre_snapshot_old,
25489 diff -urNp linux-2.6.32.46/drivers/acpi/video.c linux-2.6.32.46/drivers/acpi/video.c
25490 --- linux-2.6.32.46/drivers/acpi/video.c 2011-03-27 14:31:47.000000000 -0400
25491 +++ linux-2.6.32.46/drivers/acpi/video.c 2011-04-17 15:56:46.000000000 -0400
25492 @@ -359,7 +359,7 @@ static int acpi_video_set_brightness(str
25493 vd->brightness->levels[request_level]);
25494 }
25495
25496 -static struct backlight_ops acpi_backlight_ops = {
25497 +static const struct backlight_ops acpi_backlight_ops = {
25498 .get_brightness = acpi_video_get_brightness,
25499 .update_status = acpi_video_set_brightness,
25500 };
25501 diff -urNp linux-2.6.32.46/drivers/ata/ahci.c linux-2.6.32.46/drivers/ata/ahci.c
25502 --- linux-2.6.32.46/drivers/ata/ahci.c 2011-03-27 14:31:47.000000000 -0400
25503 +++ linux-2.6.32.46/drivers/ata/ahci.c 2011-04-23 12:56:10.000000000 -0400
25504 @@ -387,7 +387,7 @@ static struct scsi_host_template ahci_sh
25505 .sdev_attrs = ahci_sdev_attrs,
25506 };
25507
25508 -static struct ata_port_operations ahci_ops = {
25509 +static const struct ata_port_operations ahci_ops = {
25510 .inherits = &sata_pmp_port_ops,
25511
25512 .qc_defer = sata_pmp_qc_defer_cmd_switch,
25513 @@ -424,17 +424,17 @@ static struct ata_port_operations ahci_o
25514 .port_stop = ahci_port_stop,
25515 };
25516
25517 -static struct ata_port_operations ahci_vt8251_ops = {
25518 +static const struct ata_port_operations ahci_vt8251_ops = {
25519 .inherits = &ahci_ops,
25520 .hardreset = ahci_vt8251_hardreset,
25521 };
25522
25523 -static struct ata_port_operations ahci_p5wdh_ops = {
25524 +static const struct ata_port_operations ahci_p5wdh_ops = {
25525 .inherits = &ahci_ops,
25526 .hardreset = ahci_p5wdh_hardreset,
25527 };
25528
25529 -static struct ata_port_operations ahci_sb600_ops = {
25530 +static const struct ata_port_operations ahci_sb600_ops = {
25531 .inherits = &ahci_ops,
25532 .softreset = ahci_sb600_softreset,
25533 .pmp_softreset = ahci_sb600_softreset,
25534 diff -urNp linux-2.6.32.46/drivers/ata/ata_generic.c linux-2.6.32.46/drivers/ata/ata_generic.c
25535 --- linux-2.6.32.46/drivers/ata/ata_generic.c 2011-03-27 14:31:47.000000000 -0400
25536 +++ linux-2.6.32.46/drivers/ata/ata_generic.c 2011-04-17 15:56:46.000000000 -0400
25537 @@ -104,7 +104,7 @@ static struct scsi_host_template generic
25538 ATA_BMDMA_SHT(DRV_NAME),
25539 };
25540
25541 -static struct ata_port_operations generic_port_ops = {
25542 +static const struct ata_port_operations generic_port_ops = {
25543 .inherits = &ata_bmdma_port_ops,
25544 .cable_detect = ata_cable_unknown,
25545 .set_mode = generic_set_mode,
25546 diff -urNp linux-2.6.32.46/drivers/ata/ata_piix.c linux-2.6.32.46/drivers/ata/ata_piix.c
25547 --- linux-2.6.32.46/drivers/ata/ata_piix.c 2011-03-27 14:31:47.000000000 -0400
25548 +++ linux-2.6.32.46/drivers/ata/ata_piix.c 2011-04-23 12:56:10.000000000 -0400
25549 @@ -318,7 +318,7 @@ static struct scsi_host_template piix_sh
25550 ATA_BMDMA_SHT(DRV_NAME),
25551 };
25552
25553 -static struct ata_port_operations piix_pata_ops = {
25554 +static const struct ata_port_operations piix_pata_ops = {
25555 .inherits = &ata_bmdma32_port_ops,
25556 .cable_detect = ata_cable_40wire,
25557 .set_piomode = piix_set_piomode,
25558 @@ -326,22 +326,22 @@ static struct ata_port_operations piix_p
25559 .prereset = piix_pata_prereset,
25560 };
25561
25562 -static struct ata_port_operations piix_vmw_ops = {
25563 +static const struct ata_port_operations piix_vmw_ops = {
25564 .inherits = &piix_pata_ops,
25565 .bmdma_status = piix_vmw_bmdma_status,
25566 };
25567
25568 -static struct ata_port_operations ich_pata_ops = {
25569 +static const struct ata_port_operations ich_pata_ops = {
25570 .inherits = &piix_pata_ops,
25571 .cable_detect = ich_pata_cable_detect,
25572 .set_dmamode = ich_set_dmamode,
25573 };
25574
25575 -static struct ata_port_operations piix_sata_ops = {
25576 +static const struct ata_port_operations piix_sata_ops = {
25577 .inherits = &ata_bmdma_port_ops,
25578 };
25579
25580 -static struct ata_port_operations piix_sidpr_sata_ops = {
25581 +static const struct ata_port_operations piix_sidpr_sata_ops = {
25582 .inherits = &piix_sata_ops,
25583 .hardreset = sata_std_hardreset,
25584 .scr_read = piix_sidpr_scr_read,
25585 diff -urNp linux-2.6.32.46/drivers/ata/libata-acpi.c linux-2.6.32.46/drivers/ata/libata-acpi.c
25586 --- linux-2.6.32.46/drivers/ata/libata-acpi.c 2011-03-27 14:31:47.000000000 -0400
25587 +++ linux-2.6.32.46/drivers/ata/libata-acpi.c 2011-04-17 15:56:46.000000000 -0400
25588 @@ -223,12 +223,12 @@ static void ata_acpi_dev_uevent(acpi_han
25589 ata_acpi_uevent(dev->link->ap, dev, event);
25590 }
25591
25592 -static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
25593 +static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
25594 .handler = ata_acpi_dev_notify_dock,
25595 .uevent = ata_acpi_dev_uevent,
25596 };
25597
25598 -static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
25599 +static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
25600 .handler = ata_acpi_ap_notify_dock,
25601 .uevent = ata_acpi_ap_uevent,
25602 };
25603 diff -urNp linux-2.6.32.46/drivers/ata/libata-core.c linux-2.6.32.46/drivers/ata/libata-core.c
25604 --- linux-2.6.32.46/drivers/ata/libata-core.c 2011-03-27 14:31:47.000000000 -0400
25605 +++ linux-2.6.32.46/drivers/ata/libata-core.c 2011-08-05 20:33:55.000000000 -0400
25606 @@ -4954,7 +4954,7 @@ void ata_qc_free(struct ata_queued_cmd *
25607 struct ata_port *ap;
25608 unsigned int tag;
25609
25610 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25611 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25612 ap = qc->ap;
25613
25614 qc->flags = 0;
25615 @@ -4970,7 +4970,7 @@ void __ata_qc_complete(struct ata_queued
25616 struct ata_port *ap;
25617 struct ata_link *link;
25618
25619 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25620 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
25621 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
25622 ap = qc->ap;
25623 link = qc->dev->link;
25624 @@ -5987,7 +5987,7 @@ static void ata_host_stop(struct device
25625 * LOCKING:
25626 * None.
25627 */
25628 -static void ata_finalize_port_ops(struct ata_port_operations *ops)
25629 +static void ata_finalize_port_ops(const struct ata_port_operations *ops)
25630 {
25631 static DEFINE_SPINLOCK(lock);
25632 const struct ata_port_operations *cur;
25633 @@ -5999,6 +5999,7 @@ static void ata_finalize_port_ops(struct
25634 return;
25635
25636 spin_lock(&lock);
25637 + pax_open_kernel();
25638
25639 for (cur = ops->inherits; cur; cur = cur->inherits) {
25640 void **inherit = (void **)cur;
25641 @@ -6012,8 +6013,9 @@ static void ata_finalize_port_ops(struct
25642 if (IS_ERR(*pp))
25643 *pp = NULL;
25644
25645 - ops->inherits = NULL;
25646 + *(struct ata_port_operations **)&ops->inherits = NULL;
25647
25648 + pax_close_kernel();
25649 spin_unlock(&lock);
25650 }
25651
25652 @@ -6110,7 +6112,7 @@ int ata_host_start(struct ata_host *host
25653 */
25654 /* KILLME - the only user left is ipr */
25655 void ata_host_init(struct ata_host *host, struct device *dev,
25656 - unsigned long flags, struct ata_port_operations *ops)
25657 + unsigned long flags, const struct ata_port_operations *ops)
25658 {
25659 spin_lock_init(&host->lock);
25660 host->dev = dev;
25661 @@ -6773,7 +6775,7 @@ static void ata_dummy_error_handler(stru
25662 /* truly dummy */
25663 }
25664
25665 -struct ata_port_operations ata_dummy_port_ops = {
25666 +const struct ata_port_operations ata_dummy_port_ops = {
25667 .qc_prep = ata_noop_qc_prep,
25668 .qc_issue = ata_dummy_qc_issue,
25669 .error_handler = ata_dummy_error_handler,
25670 diff -urNp linux-2.6.32.46/drivers/ata/libata-eh.c linux-2.6.32.46/drivers/ata/libata-eh.c
25671 --- linux-2.6.32.46/drivers/ata/libata-eh.c 2011-08-09 18:35:28.000000000 -0400
25672 +++ linux-2.6.32.46/drivers/ata/libata-eh.c 2011-08-09 18:33:59.000000000 -0400
25673 @@ -2423,6 +2423,8 @@ void ata_eh_report(struct ata_port *ap)
25674 {
25675 struct ata_link *link;
25676
25677 + pax_track_stack();
25678 +
25679 ata_for_each_link(link, ap, HOST_FIRST)
25680 ata_eh_link_report(link);
25681 }
25682 @@ -3594,7 +3596,7 @@ void ata_do_eh(struct ata_port *ap, ata_
25683 */
25684 void ata_std_error_handler(struct ata_port *ap)
25685 {
25686 - struct ata_port_operations *ops = ap->ops;
25687 + const struct ata_port_operations *ops = ap->ops;
25688 ata_reset_fn_t hardreset = ops->hardreset;
25689
25690 /* ignore built-in hardreset if SCR access is not available */
25691 diff -urNp linux-2.6.32.46/drivers/ata/libata-pmp.c linux-2.6.32.46/drivers/ata/libata-pmp.c
25692 --- linux-2.6.32.46/drivers/ata/libata-pmp.c 2011-03-27 14:31:47.000000000 -0400
25693 +++ linux-2.6.32.46/drivers/ata/libata-pmp.c 2011-04-17 15:56:46.000000000 -0400
25694 @@ -841,7 +841,7 @@ static int sata_pmp_handle_link_fail(str
25695 */
25696 static int sata_pmp_eh_recover(struct ata_port *ap)
25697 {
25698 - struct ata_port_operations *ops = ap->ops;
25699 + const struct ata_port_operations *ops = ap->ops;
25700 int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
25701 struct ata_link *pmp_link = &ap->link;
25702 struct ata_device *pmp_dev = pmp_link->device;
25703 diff -urNp linux-2.6.32.46/drivers/ata/pata_acpi.c linux-2.6.32.46/drivers/ata/pata_acpi.c
25704 --- linux-2.6.32.46/drivers/ata/pata_acpi.c 2011-03-27 14:31:47.000000000 -0400
25705 +++ linux-2.6.32.46/drivers/ata/pata_acpi.c 2011-04-17 15:56:46.000000000 -0400
25706 @@ -215,7 +215,7 @@ static struct scsi_host_template pacpi_s
25707 ATA_BMDMA_SHT(DRV_NAME),
25708 };
25709
25710 -static struct ata_port_operations pacpi_ops = {
25711 +static const struct ata_port_operations pacpi_ops = {
25712 .inherits = &ata_bmdma_port_ops,
25713 .qc_issue = pacpi_qc_issue,
25714 .cable_detect = pacpi_cable_detect,
25715 diff -urNp linux-2.6.32.46/drivers/ata/pata_ali.c linux-2.6.32.46/drivers/ata/pata_ali.c
25716 --- linux-2.6.32.46/drivers/ata/pata_ali.c 2011-03-27 14:31:47.000000000 -0400
25717 +++ linux-2.6.32.46/drivers/ata/pata_ali.c 2011-04-17 15:56:46.000000000 -0400
25718 @@ -365,7 +365,7 @@ static struct scsi_host_template ali_sht
25719 * Port operations for PIO only ALi
25720 */
25721
25722 -static struct ata_port_operations ali_early_port_ops = {
25723 +static const struct ata_port_operations ali_early_port_ops = {
25724 .inherits = &ata_sff_port_ops,
25725 .cable_detect = ata_cable_40wire,
25726 .set_piomode = ali_set_piomode,
25727 @@ -382,7 +382,7 @@ static const struct ata_port_operations
25728 * Port operations for DMA capable ALi without cable
25729 * detect
25730 */
25731 -static struct ata_port_operations ali_20_port_ops = {
25732 +static const struct ata_port_operations ali_20_port_ops = {
25733 .inherits = &ali_dma_base_ops,
25734 .cable_detect = ata_cable_40wire,
25735 .mode_filter = ali_20_filter,
25736 @@ -393,7 +393,7 @@ static struct ata_port_operations ali_20
25737 /*
25738 * Port operations for DMA capable ALi with cable detect
25739 */
25740 -static struct ata_port_operations ali_c2_port_ops = {
25741 +static const struct ata_port_operations ali_c2_port_ops = {
25742 .inherits = &ali_dma_base_ops,
25743 .check_atapi_dma = ali_check_atapi_dma,
25744 .cable_detect = ali_c2_cable_detect,
25745 @@ -404,7 +404,7 @@ static struct ata_port_operations ali_c2
25746 /*
25747 * Port operations for DMA capable ALi with cable detect
25748 */
25749 -static struct ata_port_operations ali_c4_port_ops = {
25750 +static const struct ata_port_operations ali_c4_port_ops = {
25751 .inherits = &ali_dma_base_ops,
25752 .check_atapi_dma = ali_check_atapi_dma,
25753 .cable_detect = ali_c2_cable_detect,
25754 @@ -414,7 +414,7 @@ static struct ata_port_operations ali_c4
25755 /*
25756 * Port operations for DMA capable ALi with cable detect and LBA48
25757 */
25758 -static struct ata_port_operations ali_c5_port_ops = {
25759 +static const struct ata_port_operations ali_c5_port_ops = {
25760 .inherits = &ali_dma_base_ops,
25761 .check_atapi_dma = ali_check_atapi_dma,
25762 .dev_config = ali_warn_atapi_dma,
25763 diff -urNp linux-2.6.32.46/drivers/ata/pata_amd.c linux-2.6.32.46/drivers/ata/pata_amd.c
25764 --- linux-2.6.32.46/drivers/ata/pata_amd.c 2011-03-27 14:31:47.000000000 -0400
25765 +++ linux-2.6.32.46/drivers/ata/pata_amd.c 2011-04-17 15:56:46.000000000 -0400
25766 @@ -397,28 +397,28 @@ static const struct ata_port_operations
25767 .prereset = amd_pre_reset,
25768 };
25769
25770 -static struct ata_port_operations amd33_port_ops = {
25771 +static const struct ata_port_operations amd33_port_ops = {
25772 .inherits = &amd_base_port_ops,
25773 .cable_detect = ata_cable_40wire,
25774 .set_piomode = amd33_set_piomode,
25775 .set_dmamode = amd33_set_dmamode,
25776 };
25777
25778 -static struct ata_port_operations amd66_port_ops = {
25779 +static const struct ata_port_operations amd66_port_ops = {
25780 .inherits = &amd_base_port_ops,
25781 .cable_detect = ata_cable_unknown,
25782 .set_piomode = amd66_set_piomode,
25783 .set_dmamode = amd66_set_dmamode,
25784 };
25785
25786 -static struct ata_port_operations amd100_port_ops = {
25787 +static const struct ata_port_operations amd100_port_ops = {
25788 .inherits = &amd_base_port_ops,
25789 .cable_detect = ata_cable_unknown,
25790 .set_piomode = amd100_set_piomode,
25791 .set_dmamode = amd100_set_dmamode,
25792 };
25793
25794 -static struct ata_port_operations amd133_port_ops = {
25795 +static const struct ata_port_operations amd133_port_ops = {
25796 .inherits = &amd_base_port_ops,
25797 .cable_detect = amd_cable_detect,
25798 .set_piomode = amd133_set_piomode,
25799 @@ -433,13 +433,13 @@ static const struct ata_port_operations
25800 .host_stop = nv_host_stop,
25801 };
25802
25803 -static struct ata_port_operations nv100_port_ops = {
25804 +static const struct ata_port_operations nv100_port_ops = {
25805 .inherits = &nv_base_port_ops,
25806 .set_piomode = nv100_set_piomode,
25807 .set_dmamode = nv100_set_dmamode,
25808 };
25809
25810 -static struct ata_port_operations nv133_port_ops = {
25811 +static const struct ata_port_operations nv133_port_ops = {
25812 .inherits = &nv_base_port_ops,
25813 .set_piomode = nv133_set_piomode,
25814 .set_dmamode = nv133_set_dmamode,
25815 diff -urNp linux-2.6.32.46/drivers/ata/pata_artop.c linux-2.6.32.46/drivers/ata/pata_artop.c
25816 --- linux-2.6.32.46/drivers/ata/pata_artop.c 2011-03-27 14:31:47.000000000 -0400
25817 +++ linux-2.6.32.46/drivers/ata/pata_artop.c 2011-04-17 15:56:46.000000000 -0400
25818 @@ -311,7 +311,7 @@ static struct scsi_host_template artop_s
25819 ATA_BMDMA_SHT(DRV_NAME),
25820 };
25821
25822 -static struct ata_port_operations artop6210_ops = {
25823 +static const struct ata_port_operations artop6210_ops = {
25824 .inherits = &ata_bmdma_port_ops,
25825 .cable_detect = ata_cable_40wire,
25826 .set_piomode = artop6210_set_piomode,
25827 @@ -320,7 +320,7 @@ static struct ata_port_operations artop6
25828 .qc_defer = artop6210_qc_defer,
25829 };
25830
25831 -static struct ata_port_operations artop6260_ops = {
25832 +static const struct ata_port_operations artop6260_ops = {
25833 .inherits = &ata_bmdma_port_ops,
25834 .cable_detect = artop6260_cable_detect,
25835 .set_piomode = artop6260_set_piomode,
25836 diff -urNp linux-2.6.32.46/drivers/ata/pata_at32.c linux-2.6.32.46/drivers/ata/pata_at32.c
25837 --- linux-2.6.32.46/drivers/ata/pata_at32.c 2011-03-27 14:31:47.000000000 -0400
25838 +++ linux-2.6.32.46/drivers/ata/pata_at32.c 2011-04-17 15:56:46.000000000 -0400
25839 @@ -172,7 +172,7 @@ static struct scsi_host_template at32_sh
25840 ATA_PIO_SHT(DRV_NAME),
25841 };
25842
25843 -static struct ata_port_operations at32_port_ops = {
25844 +static const struct ata_port_operations at32_port_ops = {
25845 .inherits = &ata_sff_port_ops,
25846 .cable_detect = ata_cable_40wire,
25847 .set_piomode = pata_at32_set_piomode,
25848 diff -urNp linux-2.6.32.46/drivers/ata/pata_at91.c linux-2.6.32.46/drivers/ata/pata_at91.c
25849 --- linux-2.6.32.46/drivers/ata/pata_at91.c 2011-03-27 14:31:47.000000000 -0400
25850 +++ linux-2.6.32.46/drivers/ata/pata_at91.c 2011-04-17 15:56:46.000000000 -0400
25851 @@ -195,7 +195,7 @@ static struct scsi_host_template pata_at
25852 ATA_PIO_SHT(DRV_NAME),
25853 };
25854
25855 -static struct ata_port_operations pata_at91_port_ops = {
25856 +static const struct ata_port_operations pata_at91_port_ops = {
25857 .inherits = &ata_sff_port_ops,
25858
25859 .sff_data_xfer = pata_at91_data_xfer_noirq,
25860 diff -urNp linux-2.6.32.46/drivers/ata/pata_atiixp.c linux-2.6.32.46/drivers/ata/pata_atiixp.c
25861 --- linux-2.6.32.46/drivers/ata/pata_atiixp.c 2011-03-27 14:31:47.000000000 -0400
25862 +++ linux-2.6.32.46/drivers/ata/pata_atiixp.c 2011-04-17 15:56:46.000000000 -0400
25863 @@ -205,7 +205,7 @@ static struct scsi_host_template atiixp_
25864 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25865 };
25866
25867 -static struct ata_port_operations atiixp_port_ops = {
25868 +static const struct ata_port_operations atiixp_port_ops = {
25869 .inherits = &ata_bmdma_port_ops,
25870
25871 .qc_prep = ata_sff_dumb_qc_prep,
25872 diff -urNp linux-2.6.32.46/drivers/ata/pata_atp867x.c linux-2.6.32.46/drivers/ata/pata_atp867x.c
25873 --- linux-2.6.32.46/drivers/ata/pata_atp867x.c 2011-03-27 14:31:47.000000000 -0400
25874 +++ linux-2.6.32.46/drivers/ata/pata_atp867x.c 2011-04-17 15:56:46.000000000 -0400
25875 @@ -274,7 +274,7 @@ static struct scsi_host_template atp867x
25876 ATA_BMDMA_SHT(DRV_NAME),
25877 };
25878
25879 -static struct ata_port_operations atp867x_ops = {
25880 +static const struct ata_port_operations atp867x_ops = {
25881 .inherits = &ata_bmdma_port_ops,
25882 .cable_detect = atp867x_cable_detect,
25883 .set_piomode = atp867x_set_piomode,
25884 diff -urNp linux-2.6.32.46/drivers/ata/pata_bf54x.c linux-2.6.32.46/drivers/ata/pata_bf54x.c
25885 --- linux-2.6.32.46/drivers/ata/pata_bf54x.c 2011-03-27 14:31:47.000000000 -0400
25886 +++ linux-2.6.32.46/drivers/ata/pata_bf54x.c 2011-04-17 15:56:46.000000000 -0400
25887 @@ -1464,7 +1464,7 @@ static struct scsi_host_template bfin_sh
25888 .dma_boundary = ATA_DMA_BOUNDARY,
25889 };
25890
25891 -static struct ata_port_operations bfin_pata_ops = {
25892 +static const struct ata_port_operations bfin_pata_ops = {
25893 .inherits = &ata_sff_port_ops,
25894
25895 .set_piomode = bfin_set_piomode,
25896 diff -urNp linux-2.6.32.46/drivers/ata/pata_cmd640.c linux-2.6.32.46/drivers/ata/pata_cmd640.c
25897 --- linux-2.6.32.46/drivers/ata/pata_cmd640.c 2011-03-27 14:31:47.000000000 -0400
25898 +++ linux-2.6.32.46/drivers/ata/pata_cmd640.c 2011-04-17 15:56:46.000000000 -0400
25899 @@ -168,7 +168,7 @@ static struct scsi_host_template cmd640_
25900 ATA_BMDMA_SHT(DRV_NAME),
25901 };
25902
25903 -static struct ata_port_operations cmd640_port_ops = {
25904 +static const struct ata_port_operations cmd640_port_ops = {
25905 .inherits = &ata_bmdma_port_ops,
25906 /* In theory xfer_noirq is not needed once we kill the prefetcher */
25907 .sff_data_xfer = ata_sff_data_xfer_noirq,
25908 diff -urNp linux-2.6.32.46/drivers/ata/pata_cmd64x.c linux-2.6.32.46/drivers/ata/pata_cmd64x.c
25909 --- linux-2.6.32.46/drivers/ata/pata_cmd64x.c 2011-06-25 12:55:34.000000000 -0400
25910 +++ linux-2.6.32.46/drivers/ata/pata_cmd64x.c 2011-06-25 12:56:37.000000000 -0400
25911 @@ -271,18 +271,18 @@ static const struct ata_port_operations
25912 .set_dmamode = cmd64x_set_dmamode,
25913 };
25914
25915 -static struct ata_port_operations cmd64x_port_ops = {
25916 +static const struct ata_port_operations cmd64x_port_ops = {
25917 .inherits = &cmd64x_base_ops,
25918 .cable_detect = ata_cable_40wire,
25919 };
25920
25921 -static struct ata_port_operations cmd646r1_port_ops = {
25922 +static const struct ata_port_operations cmd646r1_port_ops = {
25923 .inherits = &cmd64x_base_ops,
25924 .bmdma_stop = cmd646r1_bmdma_stop,
25925 .cable_detect = ata_cable_40wire,
25926 };
25927
25928 -static struct ata_port_operations cmd648_port_ops = {
25929 +static const struct ata_port_operations cmd648_port_ops = {
25930 .inherits = &cmd64x_base_ops,
25931 .bmdma_stop = cmd648_bmdma_stop,
25932 .cable_detect = cmd648_cable_detect,
25933 diff -urNp linux-2.6.32.46/drivers/ata/pata_cs5520.c linux-2.6.32.46/drivers/ata/pata_cs5520.c
25934 --- linux-2.6.32.46/drivers/ata/pata_cs5520.c 2011-03-27 14:31:47.000000000 -0400
25935 +++ linux-2.6.32.46/drivers/ata/pata_cs5520.c 2011-04-17 15:56:46.000000000 -0400
25936 @@ -144,7 +144,7 @@ static struct scsi_host_template cs5520_
25937 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25938 };
25939
25940 -static struct ata_port_operations cs5520_port_ops = {
25941 +static const struct ata_port_operations cs5520_port_ops = {
25942 .inherits = &ata_bmdma_port_ops,
25943 .qc_prep = ata_sff_dumb_qc_prep,
25944 .cable_detect = ata_cable_40wire,
25945 diff -urNp linux-2.6.32.46/drivers/ata/pata_cs5530.c linux-2.6.32.46/drivers/ata/pata_cs5530.c
25946 --- linux-2.6.32.46/drivers/ata/pata_cs5530.c 2011-03-27 14:31:47.000000000 -0400
25947 +++ linux-2.6.32.46/drivers/ata/pata_cs5530.c 2011-04-17 15:56:46.000000000 -0400
25948 @@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
25949 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25950 };
25951
25952 -static struct ata_port_operations cs5530_port_ops = {
25953 +static const struct ata_port_operations cs5530_port_ops = {
25954 .inherits = &ata_bmdma_port_ops,
25955
25956 .qc_prep = ata_sff_dumb_qc_prep,
25957 diff -urNp linux-2.6.32.46/drivers/ata/pata_cs5535.c linux-2.6.32.46/drivers/ata/pata_cs5535.c
25958 --- linux-2.6.32.46/drivers/ata/pata_cs5535.c 2011-03-27 14:31:47.000000000 -0400
25959 +++ linux-2.6.32.46/drivers/ata/pata_cs5535.c 2011-04-17 15:56:46.000000000 -0400
25960 @@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
25961 ATA_BMDMA_SHT(DRV_NAME),
25962 };
25963
25964 -static struct ata_port_operations cs5535_port_ops = {
25965 +static const struct ata_port_operations cs5535_port_ops = {
25966 .inherits = &ata_bmdma_port_ops,
25967 .cable_detect = cs5535_cable_detect,
25968 .set_piomode = cs5535_set_piomode,
25969 diff -urNp linux-2.6.32.46/drivers/ata/pata_cs5536.c linux-2.6.32.46/drivers/ata/pata_cs5536.c
25970 --- linux-2.6.32.46/drivers/ata/pata_cs5536.c 2011-03-27 14:31:47.000000000 -0400
25971 +++ linux-2.6.32.46/drivers/ata/pata_cs5536.c 2011-04-17 15:56:46.000000000 -0400
25972 @@ -223,7 +223,7 @@ static struct scsi_host_template cs5536_
25973 ATA_BMDMA_SHT(DRV_NAME),
25974 };
25975
25976 -static struct ata_port_operations cs5536_port_ops = {
25977 +static const struct ata_port_operations cs5536_port_ops = {
25978 .inherits = &ata_bmdma_port_ops,
25979 .cable_detect = cs5536_cable_detect,
25980 .set_piomode = cs5536_set_piomode,
25981 diff -urNp linux-2.6.32.46/drivers/ata/pata_cypress.c linux-2.6.32.46/drivers/ata/pata_cypress.c
25982 --- linux-2.6.32.46/drivers/ata/pata_cypress.c 2011-03-27 14:31:47.000000000 -0400
25983 +++ linux-2.6.32.46/drivers/ata/pata_cypress.c 2011-04-17 15:56:46.000000000 -0400
25984 @@ -113,7 +113,7 @@ static struct scsi_host_template cy82c69
25985 ATA_BMDMA_SHT(DRV_NAME),
25986 };
25987
25988 -static struct ata_port_operations cy82c693_port_ops = {
25989 +static const struct ata_port_operations cy82c693_port_ops = {
25990 .inherits = &ata_bmdma_port_ops,
25991 .cable_detect = ata_cable_40wire,
25992 .set_piomode = cy82c693_set_piomode,
25993 diff -urNp linux-2.6.32.46/drivers/ata/pata_efar.c linux-2.6.32.46/drivers/ata/pata_efar.c
25994 --- linux-2.6.32.46/drivers/ata/pata_efar.c 2011-03-27 14:31:47.000000000 -0400
25995 +++ linux-2.6.32.46/drivers/ata/pata_efar.c 2011-04-17 15:56:46.000000000 -0400
25996 @@ -222,7 +222,7 @@ static struct scsi_host_template efar_sh
25997 ATA_BMDMA_SHT(DRV_NAME),
25998 };
25999
26000 -static struct ata_port_operations efar_ops = {
26001 +static const struct ata_port_operations efar_ops = {
26002 .inherits = &ata_bmdma_port_ops,
26003 .cable_detect = efar_cable_detect,
26004 .set_piomode = efar_set_piomode,
26005 diff -urNp linux-2.6.32.46/drivers/ata/pata_hpt366.c linux-2.6.32.46/drivers/ata/pata_hpt366.c
26006 --- linux-2.6.32.46/drivers/ata/pata_hpt366.c 2011-06-25 12:55:34.000000000 -0400
26007 +++ linux-2.6.32.46/drivers/ata/pata_hpt366.c 2011-06-25 12:56:37.000000000 -0400
26008 @@ -282,7 +282,7 @@ static struct scsi_host_template hpt36x_
26009 * Configuration for HPT366/68
26010 */
26011
26012 -static struct ata_port_operations hpt366_port_ops = {
26013 +static const struct ata_port_operations hpt366_port_ops = {
26014 .inherits = &ata_bmdma_port_ops,
26015 .cable_detect = hpt36x_cable_detect,
26016 .mode_filter = hpt366_filter,
26017 diff -urNp linux-2.6.32.46/drivers/ata/pata_hpt37x.c linux-2.6.32.46/drivers/ata/pata_hpt37x.c
26018 --- linux-2.6.32.46/drivers/ata/pata_hpt37x.c 2011-06-25 12:55:34.000000000 -0400
26019 +++ linux-2.6.32.46/drivers/ata/pata_hpt37x.c 2011-06-25 12:56:37.000000000 -0400
26020 @@ -576,7 +576,7 @@ static struct scsi_host_template hpt37x_
26021 * Configuration for HPT370
26022 */
26023
26024 -static struct ata_port_operations hpt370_port_ops = {
26025 +static const struct ata_port_operations hpt370_port_ops = {
26026 .inherits = &ata_bmdma_port_ops,
26027
26028 .bmdma_stop = hpt370_bmdma_stop,
26029 @@ -591,7 +591,7 @@ static struct ata_port_operations hpt370
26030 * Configuration for HPT370A. Close to 370 but less filters
26031 */
26032
26033 -static struct ata_port_operations hpt370a_port_ops = {
26034 +static const struct ata_port_operations hpt370a_port_ops = {
26035 .inherits = &hpt370_port_ops,
26036 .mode_filter = hpt370a_filter,
26037 };
26038 @@ -601,7 +601,7 @@ static struct ata_port_operations hpt370
26039 * and DMA mode setting functionality.
26040 */
26041
26042 -static struct ata_port_operations hpt372_port_ops = {
26043 +static const struct ata_port_operations hpt372_port_ops = {
26044 .inherits = &ata_bmdma_port_ops,
26045
26046 .bmdma_stop = hpt37x_bmdma_stop,
26047 @@ -616,7 +616,7 @@ static struct ata_port_operations hpt372
26048 * but we have a different cable detection procedure for function 1.
26049 */
26050
26051 -static struct ata_port_operations hpt374_fn1_port_ops = {
26052 +static const struct ata_port_operations hpt374_fn1_port_ops = {
26053 .inherits = &hpt372_port_ops,
26054 .prereset = hpt374_fn1_pre_reset,
26055 };
26056 diff -urNp linux-2.6.32.46/drivers/ata/pata_hpt3x2n.c linux-2.6.32.46/drivers/ata/pata_hpt3x2n.c
26057 --- linux-2.6.32.46/drivers/ata/pata_hpt3x2n.c 2011-06-25 12:55:34.000000000 -0400
26058 +++ linux-2.6.32.46/drivers/ata/pata_hpt3x2n.c 2011-06-25 12:56:37.000000000 -0400
26059 @@ -337,7 +337,7 @@ static struct scsi_host_template hpt3x2n
26060 * Configuration for HPT3x2n.
26061 */
26062
26063 -static struct ata_port_operations hpt3x2n_port_ops = {
26064 +static const struct ata_port_operations hpt3x2n_port_ops = {
26065 .inherits = &ata_bmdma_port_ops,
26066
26067 .bmdma_stop = hpt3x2n_bmdma_stop,
26068 diff -urNp linux-2.6.32.46/drivers/ata/pata_hpt3x3.c linux-2.6.32.46/drivers/ata/pata_hpt3x3.c
26069 --- linux-2.6.32.46/drivers/ata/pata_hpt3x3.c 2011-03-27 14:31:47.000000000 -0400
26070 +++ linux-2.6.32.46/drivers/ata/pata_hpt3x3.c 2011-04-17 15:56:46.000000000 -0400
26071 @@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
26072 ATA_BMDMA_SHT(DRV_NAME),
26073 };
26074
26075 -static struct ata_port_operations hpt3x3_port_ops = {
26076 +static const struct ata_port_operations hpt3x3_port_ops = {
26077 .inherits = &ata_bmdma_port_ops,
26078 .cable_detect = ata_cable_40wire,
26079 .set_piomode = hpt3x3_set_piomode,
26080 diff -urNp linux-2.6.32.46/drivers/ata/pata_icside.c linux-2.6.32.46/drivers/ata/pata_icside.c
26081 --- linux-2.6.32.46/drivers/ata/pata_icside.c 2011-03-27 14:31:47.000000000 -0400
26082 +++ linux-2.6.32.46/drivers/ata/pata_icside.c 2011-04-17 15:56:46.000000000 -0400
26083 @@ -319,7 +319,7 @@ static void pata_icside_postreset(struct
26084 }
26085 }
26086
26087 -static struct ata_port_operations pata_icside_port_ops = {
26088 +static const struct ata_port_operations pata_icside_port_ops = {
26089 .inherits = &ata_sff_port_ops,
26090 /* no need to build any PRD tables for DMA */
26091 .qc_prep = ata_noop_qc_prep,
26092 diff -urNp linux-2.6.32.46/drivers/ata/pata_isapnp.c linux-2.6.32.46/drivers/ata/pata_isapnp.c
26093 --- linux-2.6.32.46/drivers/ata/pata_isapnp.c 2011-03-27 14:31:47.000000000 -0400
26094 +++ linux-2.6.32.46/drivers/ata/pata_isapnp.c 2011-04-17 15:56:46.000000000 -0400
26095 @@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
26096 ATA_PIO_SHT(DRV_NAME),
26097 };
26098
26099 -static struct ata_port_operations isapnp_port_ops = {
26100 +static const struct ata_port_operations isapnp_port_ops = {
26101 .inherits = &ata_sff_port_ops,
26102 .cable_detect = ata_cable_40wire,
26103 };
26104
26105 -static struct ata_port_operations isapnp_noalt_port_ops = {
26106 +static const struct ata_port_operations isapnp_noalt_port_ops = {
26107 .inherits = &ata_sff_port_ops,
26108 .cable_detect = ata_cable_40wire,
26109 /* No altstatus so we don't want to use the lost interrupt poll */
26110 diff -urNp linux-2.6.32.46/drivers/ata/pata_it8213.c linux-2.6.32.46/drivers/ata/pata_it8213.c
26111 --- linux-2.6.32.46/drivers/ata/pata_it8213.c 2011-03-27 14:31:47.000000000 -0400
26112 +++ linux-2.6.32.46/drivers/ata/pata_it8213.c 2011-04-17 15:56:46.000000000 -0400
26113 @@ -234,7 +234,7 @@ static struct scsi_host_template it8213_
26114 };
26115
26116
26117 -static struct ata_port_operations it8213_ops = {
26118 +static const struct ata_port_operations it8213_ops = {
26119 .inherits = &ata_bmdma_port_ops,
26120 .cable_detect = it8213_cable_detect,
26121 .set_piomode = it8213_set_piomode,
26122 diff -urNp linux-2.6.32.46/drivers/ata/pata_it821x.c linux-2.6.32.46/drivers/ata/pata_it821x.c
26123 --- linux-2.6.32.46/drivers/ata/pata_it821x.c 2011-03-27 14:31:47.000000000 -0400
26124 +++ linux-2.6.32.46/drivers/ata/pata_it821x.c 2011-04-17 15:56:46.000000000 -0400
26125 @@ -800,7 +800,7 @@ static struct scsi_host_template it821x_
26126 ATA_BMDMA_SHT(DRV_NAME),
26127 };
26128
26129 -static struct ata_port_operations it821x_smart_port_ops = {
26130 +static const struct ata_port_operations it821x_smart_port_ops = {
26131 .inherits = &ata_bmdma_port_ops,
26132
26133 .check_atapi_dma= it821x_check_atapi_dma,
26134 @@ -814,7 +814,7 @@ static struct ata_port_operations it821x
26135 .port_start = it821x_port_start,
26136 };
26137
26138 -static struct ata_port_operations it821x_passthru_port_ops = {
26139 +static const struct ata_port_operations it821x_passthru_port_ops = {
26140 .inherits = &ata_bmdma_port_ops,
26141
26142 .check_atapi_dma= it821x_check_atapi_dma,
26143 @@ -830,7 +830,7 @@ static struct ata_port_operations it821x
26144 .port_start = it821x_port_start,
26145 };
26146
26147 -static struct ata_port_operations it821x_rdc_port_ops = {
26148 +static const struct ata_port_operations it821x_rdc_port_ops = {
26149 .inherits = &ata_bmdma_port_ops,
26150
26151 .check_atapi_dma= it821x_check_atapi_dma,
26152 diff -urNp linux-2.6.32.46/drivers/ata/pata_ixp4xx_cf.c linux-2.6.32.46/drivers/ata/pata_ixp4xx_cf.c
26153 --- linux-2.6.32.46/drivers/ata/pata_ixp4xx_cf.c 2011-03-27 14:31:47.000000000 -0400
26154 +++ linux-2.6.32.46/drivers/ata/pata_ixp4xx_cf.c 2011-04-17 15:56:46.000000000 -0400
26155 @@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
26156 ATA_PIO_SHT(DRV_NAME),
26157 };
26158
26159 -static struct ata_port_operations ixp4xx_port_ops = {
26160 +static const struct ata_port_operations ixp4xx_port_ops = {
26161 .inherits = &ata_sff_port_ops,
26162 .sff_data_xfer = ixp4xx_mmio_data_xfer,
26163 .cable_detect = ata_cable_40wire,
26164 diff -urNp linux-2.6.32.46/drivers/ata/pata_jmicron.c linux-2.6.32.46/drivers/ata/pata_jmicron.c
26165 --- linux-2.6.32.46/drivers/ata/pata_jmicron.c 2011-03-27 14:31:47.000000000 -0400
26166 +++ linux-2.6.32.46/drivers/ata/pata_jmicron.c 2011-04-17 15:56:46.000000000 -0400
26167 @@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
26168 ATA_BMDMA_SHT(DRV_NAME),
26169 };
26170
26171 -static struct ata_port_operations jmicron_ops = {
26172 +static const struct ata_port_operations jmicron_ops = {
26173 .inherits = &ata_bmdma_port_ops,
26174 .prereset = jmicron_pre_reset,
26175 };
26176 diff -urNp linux-2.6.32.46/drivers/ata/pata_legacy.c linux-2.6.32.46/drivers/ata/pata_legacy.c
26177 --- linux-2.6.32.46/drivers/ata/pata_legacy.c 2011-03-27 14:31:47.000000000 -0400
26178 +++ linux-2.6.32.46/drivers/ata/pata_legacy.c 2011-04-17 15:56:46.000000000 -0400
26179 @@ -106,7 +106,7 @@ struct legacy_probe {
26180
26181 struct legacy_controller {
26182 const char *name;
26183 - struct ata_port_operations *ops;
26184 + const struct ata_port_operations *ops;
26185 unsigned int pio_mask;
26186 unsigned int flags;
26187 unsigned int pflags;
26188 @@ -223,12 +223,12 @@ static const struct ata_port_operations
26189 * pio_mask as well.
26190 */
26191
26192 -static struct ata_port_operations simple_port_ops = {
26193 +static const struct ata_port_operations simple_port_ops = {
26194 .inherits = &legacy_base_port_ops,
26195 .sff_data_xfer = ata_sff_data_xfer_noirq,
26196 };
26197
26198 -static struct ata_port_operations legacy_port_ops = {
26199 +static const struct ata_port_operations legacy_port_ops = {
26200 .inherits = &legacy_base_port_ops,
26201 .sff_data_xfer = ata_sff_data_xfer_noirq,
26202 .set_mode = legacy_set_mode,
26203 @@ -324,7 +324,7 @@ static unsigned int pdc_data_xfer_vlb(st
26204 return buflen;
26205 }
26206
26207 -static struct ata_port_operations pdc20230_port_ops = {
26208 +static const struct ata_port_operations pdc20230_port_ops = {
26209 .inherits = &legacy_base_port_ops,
26210 .set_piomode = pdc20230_set_piomode,
26211 .sff_data_xfer = pdc_data_xfer_vlb,
26212 @@ -357,7 +357,7 @@ static void ht6560a_set_piomode(struct a
26213 ioread8(ap->ioaddr.status_addr);
26214 }
26215
26216 -static struct ata_port_operations ht6560a_port_ops = {
26217 +static const struct ata_port_operations ht6560a_port_ops = {
26218 .inherits = &legacy_base_port_ops,
26219 .set_piomode = ht6560a_set_piomode,
26220 };
26221 @@ -400,7 +400,7 @@ static void ht6560b_set_piomode(struct a
26222 ioread8(ap->ioaddr.status_addr);
26223 }
26224
26225 -static struct ata_port_operations ht6560b_port_ops = {
26226 +static const struct ata_port_operations ht6560b_port_ops = {
26227 .inherits = &legacy_base_port_ops,
26228 .set_piomode = ht6560b_set_piomode,
26229 };
26230 @@ -499,7 +499,7 @@ static void opti82c611a_set_piomode(stru
26231 }
26232
26233
26234 -static struct ata_port_operations opti82c611a_port_ops = {
26235 +static const struct ata_port_operations opti82c611a_port_ops = {
26236 .inherits = &legacy_base_port_ops,
26237 .set_piomode = opti82c611a_set_piomode,
26238 };
26239 @@ -609,7 +609,7 @@ static unsigned int opti82c46x_qc_issue(
26240 return ata_sff_qc_issue(qc);
26241 }
26242
26243 -static struct ata_port_operations opti82c46x_port_ops = {
26244 +static const struct ata_port_operations opti82c46x_port_ops = {
26245 .inherits = &legacy_base_port_ops,
26246 .set_piomode = opti82c46x_set_piomode,
26247 .qc_issue = opti82c46x_qc_issue,
26248 @@ -771,20 +771,20 @@ static int qdi_port(struct platform_devi
26249 return 0;
26250 }
26251
26252 -static struct ata_port_operations qdi6500_port_ops = {
26253 +static const struct ata_port_operations qdi6500_port_ops = {
26254 .inherits = &legacy_base_port_ops,
26255 .set_piomode = qdi6500_set_piomode,
26256 .qc_issue = qdi_qc_issue,
26257 .sff_data_xfer = vlb32_data_xfer,
26258 };
26259
26260 -static struct ata_port_operations qdi6580_port_ops = {
26261 +static const struct ata_port_operations qdi6580_port_ops = {
26262 .inherits = &legacy_base_port_ops,
26263 .set_piomode = qdi6580_set_piomode,
26264 .sff_data_xfer = vlb32_data_xfer,
26265 };
26266
26267 -static struct ata_port_operations qdi6580dp_port_ops = {
26268 +static const struct ata_port_operations qdi6580dp_port_ops = {
26269 .inherits = &legacy_base_port_ops,
26270 .set_piomode = qdi6580dp_set_piomode,
26271 .sff_data_xfer = vlb32_data_xfer,
26272 @@ -855,7 +855,7 @@ static int winbond_port(struct platform_
26273 return 0;
26274 }
26275
26276 -static struct ata_port_operations winbond_port_ops = {
26277 +static const struct ata_port_operations winbond_port_ops = {
26278 .inherits = &legacy_base_port_ops,
26279 .set_piomode = winbond_set_piomode,
26280 .sff_data_xfer = vlb32_data_xfer,
26281 @@ -978,7 +978,7 @@ static __init int legacy_init_one(struct
26282 int pio_modes = controller->pio_mask;
26283 unsigned long io = probe->port;
26284 u32 mask = (1 << probe->slot);
26285 - struct ata_port_operations *ops = controller->ops;
26286 + const struct ata_port_operations *ops = controller->ops;
26287 struct legacy_data *ld = &legacy_data[probe->slot];
26288 struct ata_host *host = NULL;
26289 struct ata_port *ap;
26290 diff -urNp linux-2.6.32.46/drivers/ata/pata_marvell.c linux-2.6.32.46/drivers/ata/pata_marvell.c
26291 --- linux-2.6.32.46/drivers/ata/pata_marvell.c 2011-03-27 14:31:47.000000000 -0400
26292 +++ linux-2.6.32.46/drivers/ata/pata_marvell.c 2011-04-17 15:56:46.000000000 -0400
26293 @@ -100,7 +100,7 @@ static struct scsi_host_template marvell
26294 ATA_BMDMA_SHT(DRV_NAME),
26295 };
26296
26297 -static struct ata_port_operations marvell_ops = {
26298 +static const struct ata_port_operations marvell_ops = {
26299 .inherits = &ata_bmdma_port_ops,
26300 .cable_detect = marvell_cable_detect,
26301 .prereset = marvell_pre_reset,
26302 diff -urNp linux-2.6.32.46/drivers/ata/pata_mpc52xx.c linux-2.6.32.46/drivers/ata/pata_mpc52xx.c
26303 --- linux-2.6.32.46/drivers/ata/pata_mpc52xx.c 2011-03-27 14:31:47.000000000 -0400
26304 +++ linux-2.6.32.46/drivers/ata/pata_mpc52xx.c 2011-04-17 15:56:46.000000000 -0400
26305 @@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
26306 ATA_PIO_SHT(DRV_NAME),
26307 };
26308
26309 -static struct ata_port_operations mpc52xx_ata_port_ops = {
26310 +static const struct ata_port_operations mpc52xx_ata_port_ops = {
26311 .inherits = &ata_bmdma_port_ops,
26312 .sff_dev_select = mpc52xx_ata_dev_select,
26313 .set_piomode = mpc52xx_ata_set_piomode,
26314 diff -urNp linux-2.6.32.46/drivers/ata/pata_mpiix.c linux-2.6.32.46/drivers/ata/pata_mpiix.c
26315 --- linux-2.6.32.46/drivers/ata/pata_mpiix.c 2011-03-27 14:31:47.000000000 -0400
26316 +++ linux-2.6.32.46/drivers/ata/pata_mpiix.c 2011-04-17 15:56:46.000000000 -0400
26317 @@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
26318 ATA_PIO_SHT(DRV_NAME),
26319 };
26320
26321 -static struct ata_port_operations mpiix_port_ops = {
26322 +static const struct ata_port_operations mpiix_port_ops = {
26323 .inherits = &ata_sff_port_ops,
26324 .qc_issue = mpiix_qc_issue,
26325 .cable_detect = ata_cable_40wire,
26326 diff -urNp linux-2.6.32.46/drivers/ata/pata_netcell.c linux-2.6.32.46/drivers/ata/pata_netcell.c
26327 --- linux-2.6.32.46/drivers/ata/pata_netcell.c 2011-03-27 14:31:47.000000000 -0400
26328 +++ linux-2.6.32.46/drivers/ata/pata_netcell.c 2011-04-17 15:56:46.000000000 -0400
26329 @@ -34,7 +34,7 @@ static struct scsi_host_template netcell
26330 ATA_BMDMA_SHT(DRV_NAME),
26331 };
26332
26333 -static struct ata_port_operations netcell_ops = {
26334 +static const struct ata_port_operations netcell_ops = {
26335 .inherits = &ata_bmdma_port_ops,
26336 .cable_detect = ata_cable_80wire,
26337 .read_id = netcell_read_id,
26338 diff -urNp linux-2.6.32.46/drivers/ata/pata_ninja32.c linux-2.6.32.46/drivers/ata/pata_ninja32.c
26339 --- linux-2.6.32.46/drivers/ata/pata_ninja32.c 2011-03-27 14:31:47.000000000 -0400
26340 +++ linux-2.6.32.46/drivers/ata/pata_ninja32.c 2011-04-17 15:56:46.000000000 -0400
26341 @@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
26342 ATA_BMDMA_SHT(DRV_NAME),
26343 };
26344
26345 -static struct ata_port_operations ninja32_port_ops = {
26346 +static const struct ata_port_operations ninja32_port_ops = {
26347 .inherits = &ata_bmdma_port_ops,
26348 .sff_dev_select = ninja32_dev_select,
26349 .cable_detect = ata_cable_40wire,
26350 diff -urNp linux-2.6.32.46/drivers/ata/pata_ns87410.c linux-2.6.32.46/drivers/ata/pata_ns87410.c
26351 --- linux-2.6.32.46/drivers/ata/pata_ns87410.c 2011-03-27 14:31:47.000000000 -0400
26352 +++ linux-2.6.32.46/drivers/ata/pata_ns87410.c 2011-04-17 15:56:46.000000000 -0400
26353 @@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
26354 ATA_PIO_SHT(DRV_NAME),
26355 };
26356
26357 -static struct ata_port_operations ns87410_port_ops = {
26358 +static const struct ata_port_operations ns87410_port_ops = {
26359 .inherits = &ata_sff_port_ops,
26360 .qc_issue = ns87410_qc_issue,
26361 .cable_detect = ata_cable_40wire,
26362 diff -urNp linux-2.6.32.46/drivers/ata/pata_ns87415.c linux-2.6.32.46/drivers/ata/pata_ns87415.c
26363 --- linux-2.6.32.46/drivers/ata/pata_ns87415.c 2011-03-27 14:31:47.000000000 -0400
26364 +++ linux-2.6.32.46/drivers/ata/pata_ns87415.c 2011-04-17 15:56:46.000000000 -0400
26365 @@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
26366 }
26367 #endif /* 87560 SuperIO Support */
26368
26369 -static struct ata_port_operations ns87415_pata_ops = {
26370 +static const struct ata_port_operations ns87415_pata_ops = {
26371 .inherits = &ata_bmdma_port_ops,
26372
26373 .check_atapi_dma = ns87415_check_atapi_dma,
26374 @@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
26375 };
26376
26377 #if defined(CONFIG_SUPERIO)
26378 -static struct ata_port_operations ns87560_pata_ops = {
26379 +static const struct ata_port_operations ns87560_pata_ops = {
26380 .inherits = &ns87415_pata_ops,
26381 .sff_tf_read = ns87560_tf_read,
26382 .sff_check_status = ns87560_check_status,
26383 diff -urNp linux-2.6.32.46/drivers/ata/pata_octeon_cf.c linux-2.6.32.46/drivers/ata/pata_octeon_cf.c
26384 --- linux-2.6.32.46/drivers/ata/pata_octeon_cf.c 2011-03-27 14:31:47.000000000 -0400
26385 +++ linux-2.6.32.46/drivers/ata/pata_octeon_cf.c 2011-04-17 15:56:46.000000000 -0400
26386 @@ -801,6 +801,7 @@ static unsigned int octeon_cf_qc_issue(s
26387 return 0;
26388 }
26389
26390 +/* cannot be const */
26391 static struct ata_port_operations octeon_cf_ops = {
26392 .inherits = &ata_sff_port_ops,
26393 .check_atapi_dma = octeon_cf_check_atapi_dma,
26394 diff -urNp linux-2.6.32.46/drivers/ata/pata_oldpiix.c linux-2.6.32.46/drivers/ata/pata_oldpiix.c
26395 --- linux-2.6.32.46/drivers/ata/pata_oldpiix.c 2011-03-27 14:31:47.000000000 -0400
26396 +++ linux-2.6.32.46/drivers/ata/pata_oldpiix.c 2011-04-17 15:56:46.000000000 -0400
26397 @@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
26398 ATA_BMDMA_SHT(DRV_NAME),
26399 };
26400
26401 -static struct ata_port_operations oldpiix_pata_ops = {
26402 +static const struct ata_port_operations oldpiix_pata_ops = {
26403 .inherits = &ata_bmdma_port_ops,
26404 .qc_issue = oldpiix_qc_issue,
26405 .cable_detect = ata_cable_40wire,
26406 diff -urNp linux-2.6.32.46/drivers/ata/pata_opti.c linux-2.6.32.46/drivers/ata/pata_opti.c
26407 --- linux-2.6.32.46/drivers/ata/pata_opti.c 2011-03-27 14:31:47.000000000 -0400
26408 +++ linux-2.6.32.46/drivers/ata/pata_opti.c 2011-04-17 15:56:46.000000000 -0400
26409 @@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
26410 ATA_PIO_SHT(DRV_NAME),
26411 };
26412
26413 -static struct ata_port_operations opti_port_ops = {
26414 +static const struct ata_port_operations opti_port_ops = {
26415 .inherits = &ata_sff_port_ops,
26416 .cable_detect = ata_cable_40wire,
26417 .set_piomode = opti_set_piomode,
26418 diff -urNp linux-2.6.32.46/drivers/ata/pata_optidma.c linux-2.6.32.46/drivers/ata/pata_optidma.c
26419 --- linux-2.6.32.46/drivers/ata/pata_optidma.c 2011-03-27 14:31:47.000000000 -0400
26420 +++ linux-2.6.32.46/drivers/ata/pata_optidma.c 2011-04-17 15:56:46.000000000 -0400
26421 @@ -337,7 +337,7 @@ static struct scsi_host_template optidma
26422 ATA_BMDMA_SHT(DRV_NAME),
26423 };
26424
26425 -static struct ata_port_operations optidma_port_ops = {
26426 +static const struct ata_port_operations optidma_port_ops = {
26427 .inherits = &ata_bmdma_port_ops,
26428 .cable_detect = ata_cable_40wire,
26429 .set_piomode = optidma_set_pio_mode,
26430 @@ -346,7 +346,7 @@ static struct ata_port_operations optidm
26431 .prereset = optidma_pre_reset,
26432 };
26433
26434 -static struct ata_port_operations optiplus_port_ops = {
26435 +static const struct ata_port_operations optiplus_port_ops = {
26436 .inherits = &optidma_port_ops,
26437 .set_piomode = optiplus_set_pio_mode,
26438 .set_dmamode = optiplus_set_dma_mode,
26439 diff -urNp linux-2.6.32.46/drivers/ata/pata_palmld.c linux-2.6.32.46/drivers/ata/pata_palmld.c
26440 --- linux-2.6.32.46/drivers/ata/pata_palmld.c 2011-03-27 14:31:47.000000000 -0400
26441 +++ linux-2.6.32.46/drivers/ata/pata_palmld.c 2011-04-17 15:56:46.000000000 -0400
26442 @@ -37,7 +37,7 @@ static struct scsi_host_template palmld_
26443 ATA_PIO_SHT(DRV_NAME),
26444 };
26445
26446 -static struct ata_port_operations palmld_port_ops = {
26447 +static const struct ata_port_operations palmld_port_ops = {
26448 .inherits = &ata_sff_port_ops,
26449 .sff_data_xfer = ata_sff_data_xfer_noirq,
26450 .cable_detect = ata_cable_40wire,
26451 diff -urNp linux-2.6.32.46/drivers/ata/pata_pcmcia.c linux-2.6.32.46/drivers/ata/pata_pcmcia.c
26452 --- linux-2.6.32.46/drivers/ata/pata_pcmcia.c 2011-03-27 14:31:47.000000000 -0400
26453 +++ linux-2.6.32.46/drivers/ata/pata_pcmcia.c 2011-04-17 15:56:46.000000000 -0400
26454 @@ -162,14 +162,14 @@ static struct scsi_host_template pcmcia_
26455 ATA_PIO_SHT(DRV_NAME),
26456 };
26457
26458 -static struct ata_port_operations pcmcia_port_ops = {
26459 +static const struct ata_port_operations pcmcia_port_ops = {
26460 .inherits = &ata_sff_port_ops,
26461 .sff_data_xfer = ata_sff_data_xfer_noirq,
26462 .cable_detect = ata_cable_40wire,
26463 .set_mode = pcmcia_set_mode,
26464 };
26465
26466 -static struct ata_port_operations pcmcia_8bit_port_ops = {
26467 +static const struct ata_port_operations pcmcia_8bit_port_ops = {
26468 .inherits = &ata_sff_port_ops,
26469 .sff_data_xfer = ata_data_xfer_8bit,
26470 .cable_detect = ata_cable_40wire,
26471 @@ -256,7 +256,7 @@ static int pcmcia_init_one(struct pcmcia
26472 unsigned long io_base, ctl_base;
26473 void __iomem *io_addr, *ctl_addr;
26474 int n_ports = 1;
26475 - struct ata_port_operations *ops = &pcmcia_port_ops;
26476 + const struct ata_port_operations *ops = &pcmcia_port_ops;
26477
26478 info = kzalloc(sizeof(*info), GFP_KERNEL);
26479 if (info == NULL)
26480 diff -urNp linux-2.6.32.46/drivers/ata/pata_pdc2027x.c linux-2.6.32.46/drivers/ata/pata_pdc2027x.c
26481 --- linux-2.6.32.46/drivers/ata/pata_pdc2027x.c 2011-03-27 14:31:47.000000000 -0400
26482 +++ linux-2.6.32.46/drivers/ata/pata_pdc2027x.c 2011-04-17 15:56:46.000000000 -0400
26483 @@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
26484 ATA_BMDMA_SHT(DRV_NAME),
26485 };
26486
26487 -static struct ata_port_operations pdc2027x_pata100_ops = {
26488 +static const struct ata_port_operations pdc2027x_pata100_ops = {
26489 .inherits = &ata_bmdma_port_ops,
26490 .check_atapi_dma = pdc2027x_check_atapi_dma,
26491 .cable_detect = pdc2027x_cable_detect,
26492 .prereset = pdc2027x_prereset,
26493 };
26494
26495 -static struct ata_port_operations pdc2027x_pata133_ops = {
26496 +static const struct ata_port_operations pdc2027x_pata133_ops = {
26497 .inherits = &pdc2027x_pata100_ops,
26498 .mode_filter = pdc2027x_mode_filter,
26499 .set_piomode = pdc2027x_set_piomode,
26500 diff -urNp linux-2.6.32.46/drivers/ata/pata_pdc202xx_old.c linux-2.6.32.46/drivers/ata/pata_pdc202xx_old.c
26501 --- linux-2.6.32.46/drivers/ata/pata_pdc202xx_old.c 2011-03-27 14:31:47.000000000 -0400
26502 +++ linux-2.6.32.46/drivers/ata/pata_pdc202xx_old.c 2011-04-17 15:56:46.000000000 -0400
26503 @@ -274,7 +274,7 @@ static struct scsi_host_template pdc202x
26504 ATA_BMDMA_SHT(DRV_NAME),
26505 };
26506
26507 -static struct ata_port_operations pdc2024x_port_ops = {
26508 +static const struct ata_port_operations pdc2024x_port_ops = {
26509 .inherits = &ata_bmdma_port_ops,
26510
26511 .cable_detect = ata_cable_40wire,
26512 @@ -284,7 +284,7 @@ static struct ata_port_operations pdc202
26513 .sff_exec_command = pdc202xx_exec_command,
26514 };
26515
26516 -static struct ata_port_operations pdc2026x_port_ops = {
26517 +static const struct ata_port_operations pdc2026x_port_ops = {
26518 .inherits = &pdc2024x_port_ops,
26519
26520 .check_atapi_dma = pdc2026x_check_atapi_dma,
26521 diff -urNp linux-2.6.32.46/drivers/ata/pata_platform.c linux-2.6.32.46/drivers/ata/pata_platform.c
26522 --- linux-2.6.32.46/drivers/ata/pata_platform.c 2011-03-27 14:31:47.000000000 -0400
26523 +++ linux-2.6.32.46/drivers/ata/pata_platform.c 2011-04-17 15:56:46.000000000 -0400
26524 @@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
26525 ATA_PIO_SHT(DRV_NAME),
26526 };
26527
26528 -static struct ata_port_operations pata_platform_port_ops = {
26529 +static const struct ata_port_operations pata_platform_port_ops = {
26530 .inherits = &ata_sff_port_ops,
26531 .sff_data_xfer = ata_sff_data_xfer_noirq,
26532 .cable_detect = ata_cable_unknown,
26533 diff -urNp linux-2.6.32.46/drivers/ata/pata_qdi.c linux-2.6.32.46/drivers/ata/pata_qdi.c
26534 --- linux-2.6.32.46/drivers/ata/pata_qdi.c 2011-03-27 14:31:47.000000000 -0400
26535 +++ linux-2.6.32.46/drivers/ata/pata_qdi.c 2011-04-17 15:56:46.000000000 -0400
26536 @@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
26537 ATA_PIO_SHT(DRV_NAME),
26538 };
26539
26540 -static struct ata_port_operations qdi6500_port_ops = {
26541 +static const struct ata_port_operations qdi6500_port_ops = {
26542 .inherits = &ata_sff_port_ops,
26543 .qc_issue = qdi_qc_issue,
26544 .sff_data_xfer = qdi_data_xfer,
26545 @@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
26546 .set_piomode = qdi6500_set_piomode,
26547 };
26548
26549 -static struct ata_port_operations qdi6580_port_ops = {
26550 +static const struct ata_port_operations qdi6580_port_ops = {
26551 .inherits = &qdi6500_port_ops,
26552 .set_piomode = qdi6580_set_piomode,
26553 };
26554 diff -urNp linux-2.6.32.46/drivers/ata/pata_radisys.c linux-2.6.32.46/drivers/ata/pata_radisys.c
26555 --- linux-2.6.32.46/drivers/ata/pata_radisys.c 2011-03-27 14:31:47.000000000 -0400
26556 +++ linux-2.6.32.46/drivers/ata/pata_radisys.c 2011-04-17 15:56:46.000000000 -0400
26557 @@ -187,7 +187,7 @@ static struct scsi_host_template radisys
26558 ATA_BMDMA_SHT(DRV_NAME),
26559 };
26560
26561 -static struct ata_port_operations radisys_pata_ops = {
26562 +static const struct ata_port_operations radisys_pata_ops = {
26563 .inherits = &ata_bmdma_port_ops,
26564 .qc_issue = radisys_qc_issue,
26565 .cable_detect = ata_cable_unknown,
26566 diff -urNp linux-2.6.32.46/drivers/ata/pata_rb532_cf.c linux-2.6.32.46/drivers/ata/pata_rb532_cf.c
26567 --- linux-2.6.32.46/drivers/ata/pata_rb532_cf.c 2011-03-27 14:31:47.000000000 -0400
26568 +++ linux-2.6.32.46/drivers/ata/pata_rb532_cf.c 2011-04-17 15:56:46.000000000 -0400
26569 @@ -68,7 +68,7 @@ static irqreturn_t rb532_pata_irq_handle
26570 return IRQ_HANDLED;
26571 }
26572
26573 -static struct ata_port_operations rb532_pata_port_ops = {
26574 +static const struct ata_port_operations rb532_pata_port_ops = {
26575 .inherits = &ata_sff_port_ops,
26576 .sff_data_xfer = ata_sff_data_xfer32,
26577 };
26578 diff -urNp linux-2.6.32.46/drivers/ata/pata_rdc.c linux-2.6.32.46/drivers/ata/pata_rdc.c
26579 --- linux-2.6.32.46/drivers/ata/pata_rdc.c 2011-03-27 14:31:47.000000000 -0400
26580 +++ linux-2.6.32.46/drivers/ata/pata_rdc.c 2011-04-17 15:56:46.000000000 -0400
26581 @@ -272,7 +272,7 @@ static void rdc_set_dmamode(struct ata_p
26582 pci_write_config_byte(dev, 0x48, udma_enable);
26583 }
26584
26585 -static struct ata_port_operations rdc_pata_ops = {
26586 +static const struct ata_port_operations rdc_pata_ops = {
26587 .inherits = &ata_bmdma32_port_ops,
26588 .cable_detect = rdc_pata_cable_detect,
26589 .set_piomode = rdc_set_piomode,
26590 diff -urNp linux-2.6.32.46/drivers/ata/pata_rz1000.c linux-2.6.32.46/drivers/ata/pata_rz1000.c
26591 --- linux-2.6.32.46/drivers/ata/pata_rz1000.c 2011-03-27 14:31:47.000000000 -0400
26592 +++ linux-2.6.32.46/drivers/ata/pata_rz1000.c 2011-04-17 15:56:46.000000000 -0400
26593 @@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
26594 ATA_PIO_SHT(DRV_NAME),
26595 };
26596
26597 -static struct ata_port_operations rz1000_port_ops = {
26598 +static const struct ata_port_operations rz1000_port_ops = {
26599 .inherits = &ata_sff_port_ops,
26600 .cable_detect = ata_cable_40wire,
26601 .set_mode = rz1000_set_mode,
26602 diff -urNp linux-2.6.32.46/drivers/ata/pata_sc1200.c linux-2.6.32.46/drivers/ata/pata_sc1200.c
26603 --- linux-2.6.32.46/drivers/ata/pata_sc1200.c 2011-03-27 14:31:47.000000000 -0400
26604 +++ linux-2.6.32.46/drivers/ata/pata_sc1200.c 2011-04-17 15:56:46.000000000 -0400
26605 @@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
26606 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
26607 };
26608
26609 -static struct ata_port_operations sc1200_port_ops = {
26610 +static const struct ata_port_operations sc1200_port_ops = {
26611 .inherits = &ata_bmdma_port_ops,
26612 .qc_prep = ata_sff_dumb_qc_prep,
26613 .qc_issue = sc1200_qc_issue,
26614 diff -urNp linux-2.6.32.46/drivers/ata/pata_scc.c linux-2.6.32.46/drivers/ata/pata_scc.c
26615 --- linux-2.6.32.46/drivers/ata/pata_scc.c 2011-03-27 14:31:47.000000000 -0400
26616 +++ linux-2.6.32.46/drivers/ata/pata_scc.c 2011-04-17 15:56:46.000000000 -0400
26617 @@ -965,7 +965,7 @@ static struct scsi_host_template scc_sht
26618 ATA_BMDMA_SHT(DRV_NAME),
26619 };
26620
26621 -static struct ata_port_operations scc_pata_ops = {
26622 +static const struct ata_port_operations scc_pata_ops = {
26623 .inherits = &ata_bmdma_port_ops,
26624
26625 .set_piomode = scc_set_piomode,
26626 diff -urNp linux-2.6.32.46/drivers/ata/pata_sch.c linux-2.6.32.46/drivers/ata/pata_sch.c
26627 --- linux-2.6.32.46/drivers/ata/pata_sch.c 2011-03-27 14:31:47.000000000 -0400
26628 +++ linux-2.6.32.46/drivers/ata/pata_sch.c 2011-04-17 15:56:46.000000000 -0400
26629 @@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
26630 ATA_BMDMA_SHT(DRV_NAME),
26631 };
26632
26633 -static struct ata_port_operations sch_pata_ops = {
26634 +static const struct ata_port_operations sch_pata_ops = {
26635 .inherits = &ata_bmdma_port_ops,
26636 .cable_detect = ata_cable_unknown,
26637 .set_piomode = sch_set_piomode,
26638 diff -urNp linux-2.6.32.46/drivers/ata/pata_serverworks.c linux-2.6.32.46/drivers/ata/pata_serverworks.c
26639 --- linux-2.6.32.46/drivers/ata/pata_serverworks.c 2011-03-27 14:31:47.000000000 -0400
26640 +++ linux-2.6.32.46/drivers/ata/pata_serverworks.c 2011-04-17 15:56:46.000000000 -0400
26641 @@ -299,7 +299,7 @@ static struct scsi_host_template serverw
26642 ATA_BMDMA_SHT(DRV_NAME),
26643 };
26644
26645 -static struct ata_port_operations serverworks_osb4_port_ops = {
26646 +static const struct ata_port_operations serverworks_osb4_port_ops = {
26647 .inherits = &ata_bmdma_port_ops,
26648 .cable_detect = serverworks_cable_detect,
26649 .mode_filter = serverworks_osb4_filter,
26650 @@ -307,7 +307,7 @@ static struct ata_port_operations server
26651 .set_dmamode = serverworks_set_dmamode,
26652 };
26653
26654 -static struct ata_port_operations serverworks_csb_port_ops = {
26655 +static const struct ata_port_operations serverworks_csb_port_ops = {
26656 .inherits = &serverworks_osb4_port_ops,
26657 .mode_filter = serverworks_csb_filter,
26658 };
26659 diff -urNp linux-2.6.32.46/drivers/ata/pata_sil680.c linux-2.6.32.46/drivers/ata/pata_sil680.c
26660 --- linux-2.6.32.46/drivers/ata/pata_sil680.c 2011-06-25 12:55:34.000000000 -0400
26661 +++ linux-2.6.32.46/drivers/ata/pata_sil680.c 2011-06-25 12:56:37.000000000 -0400
26662 @@ -194,7 +194,7 @@ static struct scsi_host_template sil680_
26663 ATA_BMDMA_SHT(DRV_NAME),
26664 };
26665
26666 -static struct ata_port_operations sil680_port_ops = {
26667 +static const struct ata_port_operations sil680_port_ops = {
26668 .inherits = &ata_bmdma32_port_ops,
26669 .cable_detect = sil680_cable_detect,
26670 .set_piomode = sil680_set_piomode,
26671 diff -urNp linux-2.6.32.46/drivers/ata/pata_sis.c linux-2.6.32.46/drivers/ata/pata_sis.c
26672 --- linux-2.6.32.46/drivers/ata/pata_sis.c 2011-03-27 14:31:47.000000000 -0400
26673 +++ linux-2.6.32.46/drivers/ata/pata_sis.c 2011-04-17 15:56:46.000000000 -0400
26674 @@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
26675 ATA_BMDMA_SHT(DRV_NAME),
26676 };
26677
26678 -static struct ata_port_operations sis_133_for_sata_ops = {
26679 +static const struct ata_port_operations sis_133_for_sata_ops = {
26680 .inherits = &ata_bmdma_port_ops,
26681 .set_piomode = sis_133_set_piomode,
26682 .set_dmamode = sis_133_set_dmamode,
26683 .cable_detect = sis_133_cable_detect,
26684 };
26685
26686 -static struct ata_port_operations sis_base_ops = {
26687 +static const struct ata_port_operations sis_base_ops = {
26688 .inherits = &ata_bmdma_port_ops,
26689 .prereset = sis_pre_reset,
26690 };
26691
26692 -static struct ata_port_operations sis_133_ops = {
26693 +static const struct ata_port_operations sis_133_ops = {
26694 .inherits = &sis_base_ops,
26695 .set_piomode = sis_133_set_piomode,
26696 .set_dmamode = sis_133_set_dmamode,
26697 .cable_detect = sis_133_cable_detect,
26698 };
26699
26700 -static struct ata_port_operations sis_133_early_ops = {
26701 +static const struct ata_port_operations sis_133_early_ops = {
26702 .inherits = &sis_base_ops,
26703 .set_piomode = sis_100_set_piomode,
26704 .set_dmamode = sis_133_early_set_dmamode,
26705 .cable_detect = sis_66_cable_detect,
26706 };
26707
26708 -static struct ata_port_operations sis_100_ops = {
26709 +static const struct ata_port_operations sis_100_ops = {
26710 .inherits = &sis_base_ops,
26711 .set_piomode = sis_100_set_piomode,
26712 .set_dmamode = sis_100_set_dmamode,
26713 .cable_detect = sis_66_cable_detect,
26714 };
26715
26716 -static struct ata_port_operations sis_66_ops = {
26717 +static const struct ata_port_operations sis_66_ops = {
26718 .inherits = &sis_base_ops,
26719 .set_piomode = sis_old_set_piomode,
26720 .set_dmamode = sis_66_set_dmamode,
26721 .cable_detect = sis_66_cable_detect,
26722 };
26723
26724 -static struct ata_port_operations sis_old_ops = {
26725 +static const struct ata_port_operations sis_old_ops = {
26726 .inherits = &sis_base_ops,
26727 .set_piomode = sis_old_set_piomode,
26728 .set_dmamode = sis_old_set_dmamode,
26729 diff -urNp linux-2.6.32.46/drivers/ata/pata_sl82c105.c linux-2.6.32.46/drivers/ata/pata_sl82c105.c
26730 --- linux-2.6.32.46/drivers/ata/pata_sl82c105.c 2011-03-27 14:31:47.000000000 -0400
26731 +++ linux-2.6.32.46/drivers/ata/pata_sl82c105.c 2011-04-17 15:56:46.000000000 -0400
26732 @@ -231,7 +231,7 @@ static struct scsi_host_template sl82c10
26733 ATA_BMDMA_SHT(DRV_NAME),
26734 };
26735
26736 -static struct ata_port_operations sl82c105_port_ops = {
26737 +static const struct ata_port_operations sl82c105_port_ops = {
26738 .inherits = &ata_bmdma_port_ops,
26739 .qc_defer = sl82c105_qc_defer,
26740 .bmdma_start = sl82c105_bmdma_start,
26741 diff -urNp linux-2.6.32.46/drivers/ata/pata_triflex.c linux-2.6.32.46/drivers/ata/pata_triflex.c
26742 --- linux-2.6.32.46/drivers/ata/pata_triflex.c 2011-03-27 14:31:47.000000000 -0400
26743 +++ linux-2.6.32.46/drivers/ata/pata_triflex.c 2011-04-17 15:56:46.000000000 -0400
26744 @@ -178,7 +178,7 @@ static struct scsi_host_template triflex
26745 ATA_BMDMA_SHT(DRV_NAME),
26746 };
26747
26748 -static struct ata_port_operations triflex_port_ops = {
26749 +static const struct ata_port_operations triflex_port_ops = {
26750 .inherits = &ata_bmdma_port_ops,
26751 .bmdma_start = triflex_bmdma_start,
26752 .bmdma_stop = triflex_bmdma_stop,
26753 diff -urNp linux-2.6.32.46/drivers/ata/pata_via.c linux-2.6.32.46/drivers/ata/pata_via.c
26754 --- linux-2.6.32.46/drivers/ata/pata_via.c 2011-03-27 14:31:47.000000000 -0400
26755 +++ linux-2.6.32.46/drivers/ata/pata_via.c 2011-04-17 15:56:46.000000000 -0400
26756 @@ -419,7 +419,7 @@ static struct scsi_host_template via_sht
26757 ATA_BMDMA_SHT(DRV_NAME),
26758 };
26759
26760 -static struct ata_port_operations via_port_ops = {
26761 +static const struct ata_port_operations via_port_ops = {
26762 .inherits = &ata_bmdma_port_ops,
26763 .cable_detect = via_cable_detect,
26764 .set_piomode = via_set_piomode,
26765 @@ -429,7 +429,7 @@ static struct ata_port_operations via_po
26766 .port_start = via_port_start,
26767 };
26768
26769 -static struct ata_port_operations via_port_ops_noirq = {
26770 +static const struct ata_port_operations via_port_ops_noirq = {
26771 .inherits = &via_port_ops,
26772 .sff_data_xfer = ata_sff_data_xfer_noirq,
26773 };
26774 diff -urNp linux-2.6.32.46/drivers/ata/pata_winbond.c linux-2.6.32.46/drivers/ata/pata_winbond.c
26775 --- linux-2.6.32.46/drivers/ata/pata_winbond.c 2011-03-27 14:31:47.000000000 -0400
26776 +++ linux-2.6.32.46/drivers/ata/pata_winbond.c 2011-04-17 15:56:46.000000000 -0400
26777 @@ -125,7 +125,7 @@ static struct scsi_host_template winbond
26778 ATA_PIO_SHT(DRV_NAME),
26779 };
26780
26781 -static struct ata_port_operations winbond_port_ops = {
26782 +static const struct ata_port_operations winbond_port_ops = {
26783 .inherits = &ata_sff_port_ops,
26784 .sff_data_xfer = winbond_data_xfer,
26785 .cable_detect = ata_cable_40wire,
26786 diff -urNp linux-2.6.32.46/drivers/ata/pdc_adma.c linux-2.6.32.46/drivers/ata/pdc_adma.c
26787 --- linux-2.6.32.46/drivers/ata/pdc_adma.c 2011-03-27 14:31:47.000000000 -0400
26788 +++ linux-2.6.32.46/drivers/ata/pdc_adma.c 2011-04-17 15:56:46.000000000 -0400
26789 @@ -145,7 +145,7 @@ static struct scsi_host_template adma_at
26790 .dma_boundary = ADMA_DMA_BOUNDARY,
26791 };
26792
26793 -static struct ata_port_operations adma_ata_ops = {
26794 +static const struct ata_port_operations adma_ata_ops = {
26795 .inherits = &ata_sff_port_ops,
26796
26797 .lost_interrupt = ATA_OP_NULL,
26798 diff -urNp linux-2.6.32.46/drivers/ata/sata_fsl.c linux-2.6.32.46/drivers/ata/sata_fsl.c
26799 --- linux-2.6.32.46/drivers/ata/sata_fsl.c 2011-03-27 14:31:47.000000000 -0400
26800 +++ linux-2.6.32.46/drivers/ata/sata_fsl.c 2011-04-17 15:56:46.000000000 -0400
26801 @@ -1258,7 +1258,7 @@ static struct scsi_host_template sata_fs
26802 .dma_boundary = ATA_DMA_BOUNDARY,
26803 };
26804
26805 -static struct ata_port_operations sata_fsl_ops = {
26806 +static const struct ata_port_operations sata_fsl_ops = {
26807 .inherits = &sata_pmp_port_ops,
26808
26809 .qc_defer = ata_std_qc_defer,
26810 diff -urNp linux-2.6.32.46/drivers/ata/sata_inic162x.c linux-2.6.32.46/drivers/ata/sata_inic162x.c
26811 --- linux-2.6.32.46/drivers/ata/sata_inic162x.c 2011-03-27 14:31:47.000000000 -0400
26812 +++ linux-2.6.32.46/drivers/ata/sata_inic162x.c 2011-04-17 15:56:46.000000000 -0400
26813 @@ -721,7 +721,7 @@ static int inic_port_start(struct ata_po
26814 return 0;
26815 }
26816
26817 -static struct ata_port_operations inic_port_ops = {
26818 +static const struct ata_port_operations inic_port_ops = {
26819 .inherits = &sata_port_ops,
26820
26821 .check_atapi_dma = inic_check_atapi_dma,
26822 diff -urNp linux-2.6.32.46/drivers/ata/sata_mv.c linux-2.6.32.46/drivers/ata/sata_mv.c
26823 --- linux-2.6.32.46/drivers/ata/sata_mv.c 2011-03-27 14:31:47.000000000 -0400
26824 +++ linux-2.6.32.46/drivers/ata/sata_mv.c 2011-04-17 15:56:46.000000000 -0400
26825 @@ -656,7 +656,7 @@ static struct scsi_host_template mv6_sht
26826 .dma_boundary = MV_DMA_BOUNDARY,
26827 };
26828
26829 -static struct ata_port_operations mv5_ops = {
26830 +static const struct ata_port_operations mv5_ops = {
26831 .inherits = &ata_sff_port_ops,
26832
26833 .lost_interrupt = ATA_OP_NULL,
26834 @@ -678,7 +678,7 @@ static struct ata_port_operations mv5_op
26835 .port_stop = mv_port_stop,
26836 };
26837
26838 -static struct ata_port_operations mv6_ops = {
26839 +static const struct ata_port_operations mv6_ops = {
26840 .inherits = &mv5_ops,
26841 .dev_config = mv6_dev_config,
26842 .scr_read = mv_scr_read,
26843 @@ -698,7 +698,7 @@ static struct ata_port_operations mv6_op
26844 .bmdma_status = mv_bmdma_status,
26845 };
26846
26847 -static struct ata_port_operations mv_iie_ops = {
26848 +static const struct ata_port_operations mv_iie_ops = {
26849 .inherits = &mv6_ops,
26850 .dev_config = ATA_OP_NULL,
26851 .qc_prep = mv_qc_prep_iie,
26852 diff -urNp linux-2.6.32.46/drivers/ata/sata_nv.c linux-2.6.32.46/drivers/ata/sata_nv.c
26853 --- linux-2.6.32.46/drivers/ata/sata_nv.c 2011-03-27 14:31:47.000000000 -0400
26854 +++ linux-2.6.32.46/drivers/ata/sata_nv.c 2011-04-17 15:56:46.000000000 -0400
26855 @@ -464,7 +464,7 @@ static struct scsi_host_template nv_swnc
26856 * cases. Define nv_hardreset() which only kicks in for post-boot
26857 * probing and use it for all variants.
26858 */
26859 -static struct ata_port_operations nv_generic_ops = {
26860 +static const struct ata_port_operations nv_generic_ops = {
26861 .inherits = &ata_bmdma_port_ops,
26862 .lost_interrupt = ATA_OP_NULL,
26863 .scr_read = nv_scr_read,
26864 @@ -472,20 +472,20 @@ static struct ata_port_operations nv_gen
26865 .hardreset = nv_hardreset,
26866 };
26867
26868 -static struct ata_port_operations nv_nf2_ops = {
26869 +static const struct ata_port_operations nv_nf2_ops = {
26870 .inherits = &nv_generic_ops,
26871 .freeze = nv_nf2_freeze,
26872 .thaw = nv_nf2_thaw,
26873 };
26874
26875 -static struct ata_port_operations nv_ck804_ops = {
26876 +static const struct ata_port_operations nv_ck804_ops = {
26877 .inherits = &nv_generic_ops,
26878 .freeze = nv_ck804_freeze,
26879 .thaw = nv_ck804_thaw,
26880 .host_stop = nv_ck804_host_stop,
26881 };
26882
26883 -static struct ata_port_operations nv_adma_ops = {
26884 +static const struct ata_port_operations nv_adma_ops = {
26885 .inherits = &nv_ck804_ops,
26886
26887 .check_atapi_dma = nv_adma_check_atapi_dma,
26888 @@ -509,7 +509,7 @@ static struct ata_port_operations nv_adm
26889 .host_stop = nv_adma_host_stop,
26890 };
26891
26892 -static struct ata_port_operations nv_swncq_ops = {
26893 +static const struct ata_port_operations nv_swncq_ops = {
26894 .inherits = &nv_generic_ops,
26895
26896 .qc_defer = ata_std_qc_defer,
26897 diff -urNp linux-2.6.32.46/drivers/ata/sata_promise.c linux-2.6.32.46/drivers/ata/sata_promise.c
26898 --- linux-2.6.32.46/drivers/ata/sata_promise.c 2011-03-27 14:31:47.000000000 -0400
26899 +++ linux-2.6.32.46/drivers/ata/sata_promise.c 2011-04-17 15:56:46.000000000 -0400
26900 @@ -195,7 +195,7 @@ static const struct ata_port_operations
26901 .error_handler = pdc_error_handler,
26902 };
26903
26904 -static struct ata_port_operations pdc_sata_ops = {
26905 +static const struct ata_port_operations pdc_sata_ops = {
26906 .inherits = &pdc_common_ops,
26907 .cable_detect = pdc_sata_cable_detect,
26908 .freeze = pdc_sata_freeze,
26909 @@ -208,14 +208,14 @@ static struct ata_port_operations pdc_sa
26910
26911 /* First-generation chips need a more restrictive ->check_atapi_dma op,
26912 and ->freeze/thaw that ignore the hotplug controls. */
26913 -static struct ata_port_operations pdc_old_sata_ops = {
26914 +static const struct ata_port_operations pdc_old_sata_ops = {
26915 .inherits = &pdc_sata_ops,
26916 .freeze = pdc_freeze,
26917 .thaw = pdc_thaw,
26918 .check_atapi_dma = pdc_old_sata_check_atapi_dma,
26919 };
26920
26921 -static struct ata_port_operations pdc_pata_ops = {
26922 +static const struct ata_port_operations pdc_pata_ops = {
26923 .inherits = &pdc_common_ops,
26924 .cable_detect = pdc_pata_cable_detect,
26925 .freeze = pdc_freeze,
26926 diff -urNp linux-2.6.32.46/drivers/ata/sata_qstor.c linux-2.6.32.46/drivers/ata/sata_qstor.c
26927 --- linux-2.6.32.46/drivers/ata/sata_qstor.c 2011-03-27 14:31:47.000000000 -0400
26928 +++ linux-2.6.32.46/drivers/ata/sata_qstor.c 2011-04-17 15:56:46.000000000 -0400
26929 @@ -132,7 +132,7 @@ static struct scsi_host_template qs_ata_
26930 .dma_boundary = QS_DMA_BOUNDARY,
26931 };
26932
26933 -static struct ata_port_operations qs_ata_ops = {
26934 +static const struct ata_port_operations qs_ata_ops = {
26935 .inherits = &ata_sff_port_ops,
26936
26937 .check_atapi_dma = qs_check_atapi_dma,
26938 diff -urNp linux-2.6.32.46/drivers/ata/sata_sil24.c linux-2.6.32.46/drivers/ata/sata_sil24.c
26939 --- linux-2.6.32.46/drivers/ata/sata_sil24.c 2011-03-27 14:31:47.000000000 -0400
26940 +++ linux-2.6.32.46/drivers/ata/sata_sil24.c 2011-04-17 15:56:46.000000000 -0400
26941 @@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
26942 .dma_boundary = ATA_DMA_BOUNDARY,
26943 };
26944
26945 -static struct ata_port_operations sil24_ops = {
26946 +static const struct ata_port_operations sil24_ops = {
26947 .inherits = &sata_pmp_port_ops,
26948
26949 .qc_defer = sil24_qc_defer,
26950 diff -urNp linux-2.6.32.46/drivers/ata/sata_sil.c linux-2.6.32.46/drivers/ata/sata_sil.c
26951 --- linux-2.6.32.46/drivers/ata/sata_sil.c 2011-03-27 14:31:47.000000000 -0400
26952 +++ linux-2.6.32.46/drivers/ata/sata_sil.c 2011-04-17 15:56:46.000000000 -0400
26953 @@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht
26954 .sg_tablesize = ATA_MAX_PRD
26955 };
26956
26957 -static struct ata_port_operations sil_ops = {
26958 +static const struct ata_port_operations sil_ops = {
26959 .inherits = &ata_bmdma32_port_ops,
26960 .dev_config = sil_dev_config,
26961 .set_mode = sil_set_mode,
26962 diff -urNp linux-2.6.32.46/drivers/ata/sata_sis.c linux-2.6.32.46/drivers/ata/sata_sis.c
26963 --- linux-2.6.32.46/drivers/ata/sata_sis.c 2011-03-27 14:31:47.000000000 -0400
26964 +++ linux-2.6.32.46/drivers/ata/sata_sis.c 2011-04-17 15:56:46.000000000 -0400
26965 @@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
26966 ATA_BMDMA_SHT(DRV_NAME),
26967 };
26968
26969 -static struct ata_port_operations sis_ops = {
26970 +static const struct ata_port_operations sis_ops = {
26971 .inherits = &ata_bmdma_port_ops,
26972 .scr_read = sis_scr_read,
26973 .scr_write = sis_scr_write,
26974 diff -urNp linux-2.6.32.46/drivers/ata/sata_svw.c linux-2.6.32.46/drivers/ata/sata_svw.c
26975 --- linux-2.6.32.46/drivers/ata/sata_svw.c 2011-03-27 14:31:47.000000000 -0400
26976 +++ linux-2.6.32.46/drivers/ata/sata_svw.c 2011-04-17 15:56:46.000000000 -0400
26977 @@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
26978 };
26979
26980
26981 -static struct ata_port_operations k2_sata_ops = {
26982 +static const struct ata_port_operations k2_sata_ops = {
26983 .inherits = &ata_bmdma_port_ops,
26984 .sff_tf_load = k2_sata_tf_load,
26985 .sff_tf_read = k2_sata_tf_read,
26986 diff -urNp linux-2.6.32.46/drivers/ata/sata_sx4.c linux-2.6.32.46/drivers/ata/sata_sx4.c
26987 --- linux-2.6.32.46/drivers/ata/sata_sx4.c 2011-03-27 14:31:47.000000000 -0400
26988 +++ linux-2.6.32.46/drivers/ata/sata_sx4.c 2011-04-17 15:56:46.000000000 -0400
26989 @@ -248,7 +248,7 @@ static struct scsi_host_template pdc_sat
26990 };
26991
26992 /* TODO: inherit from base port_ops after converting to new EH */
26993 -static struct ata_port_operations pdc_20621_ops = {
26994 +static const struct ata_port_operations pdc_20621_ops = {
26995 .inherits = &ata_sff_port_ops,
26996
26997 .check_atapi_dma = pdc_check_atapi_dma,
26998 diff -urNp linux-2.6.32.46/drivers/ata/sata_uli.c linux-2.6.32.46/drivers/ata/sata_uli.c
26999 --- linux-2.6.32.46/drivers/ata/sata_uli.c 2011-03-27 14:31:47.000000000 -0400
27000 +++ linux-2.6.32.46/drivers/ata/sata_uli.c 2011-04-17 15:56:46.000000000 -0400
27001 @@ -79,7 +79,7 @@ static struct scsi_host_template uli_sht
27002 ATA_BMDMA_SHT(DRV_NAME),
27003 };
27004
27005 -static struct ata_port_operations uli_ops = {
27006 +static const struct ata_port_operations uli_ops = {
27007 .inherits = &ata_bmdma_port_ops,
27008 .scr_read = uli_scr_read,
27009 .scr_write = uli_scr_write,
27010 diff -urNp linux-2.6.32.46/drivers/ata/sata_via.c linux-2.6.32.46/drivers/ata/sata_via.c
27011 --- linux-2.6.32.46/drivers/ata/sata_via.c 2011-05-10 22:12:01.000000000 -0400
27012 +++ linux-2.6.32.46/drivers/ata/sata_via.c 2011-05-10 22:15:08.000000000 -0400
27013 @@ -115,32 +115,32 @@ static struct scsi_host_template svia_sh
27014 ATA_BMDMA_SHT(DRV_NAME),
27015 };
27016
27017 -static struct ata_port_operations svia_base_ops = {
27018 +static const struct ata_port_operations svia_base_ops = {
27019 .inherits = &ata_bmdma_port_ops,
27020 .sff_tf_load = svia_tf_load,
27021 };
27022
27023 -static struct ata_port_operations vt6420_sata_ops = {
27024 +static const struct ata_port_operations vt6420_sata_ops = {
27025 .inherits = &svia_base_ops,
27026 .freeze = svia_noop_freeze,
27027 .prereset = vt6420_prereset,
27028 .bmdma_start = vt6420_bmdma_start,
27029 };
27030
27031 -static struct ata_port_operations vt6421_pata_ops = {
27032 +static const struct ata_port_operations vt6421_pata_ops = {
27033 .inherits = &svia_base_ops,
27034 .cable_detect = vt6421_pata_cable_detect,
27035 .set_piomode = vt6421_set_pio_mode,
27036 .set_dmamode = vt6421_set_dma_mode,
27037 };
27038
27039 -static struct ata_port_operations vt6421_sata_ops = {
27040 +static const struct ata_port_operations vt6421_sata_ops = {
27041 .inherits = &svia_base_ops,
27042 .scr_read = svia_scr_read,
27043 .scr_write = svia_scr_write,
27044 };
27045
27046 -static struct ata_port_operations vt8251_ops = {
27047 +static const struct ata_port_operations vt8251_ops = {
27048 .inherits = &svia_base_ops,
27049 .hardreset = sata_std_hardreset,
27050 .scr_read = vt8251_scr_read,
27051 diff -urNp linux-2.6.32.46/drivers/ata/sata_vsc.c linux-2.6.32.46/drivers/ata/sata_vsc.c
27052 --- linux-2.6.32.46/drivers/ata/sata_vsc.c 2011-03-27 14:31:47.000000000 -0400
27053 +++ linux-2.6.32.46/drivers/ata/sata_vsc.c 2011-04-17 15:56:46.000000000 -0400
27054 @@ -306,7 +306,7 @@ static struct scsi_host_template vsc_sat
27055 };
27056
27057
27058 -static struct ata_port_operations vsc_sata_ops = {
27059 +static const struct ata_port_operations vsc_sata_ops = {
27060 .inherits = &ata_bmdma_port_ops,
27061 /* The IRQ handling is not quite standard SFF behaviour so we
27062 cannot use the default lost interrupt handler */
27063 diff -urNp linux-2.6.32.46/drivers/atm/adummy.c linux-2.6.32.46/drivers/atm/adummy.c
27064 --- linux-2.6.32.46/drivers/atm/adummy.c 2011-03-27 14:31:47.000000000 -0400
27065 +++ linux-2.6.32.46/drivers/atm/adummy.c 2011-04-17 15:56:46.000000000 -0400
27066 @@ -77,7 +77,7 @@ adummy_send(struct atm_vcc *vcc, struct
27067 vcc->pop(vcc, skb);
27068 else
27069 dev_kfree_skb_any(skb);
27070 - atomic_inc(&vcc->stats->tx);
27071 + atomic_inc_unchecked(&vcc->stats->tx);
27072
27073 return 0;
27074 }
27075 diff -urNp linux-2.6.32.46/drivers/atm/ambassador.c linux-2.6.32.46/drivers/atm/ambassador.c
27076 --- linux-2.6.32.46/drivers/atm/ambassador.c 2011-03-27 14:31:47.000000000 -0400
27077 +++ linux-2.6.32.46/drivers/atm/ambassador.c 2011-04-17 15:56:46.000000000 -0400
27078 @@ -453,7 +453,7 @@ static void tx_complete (amb_dev * dev,
27079 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
27080
27081 // VC layer stats
27082 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
27083 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
27084
27085 // free the descriptor
27086 kfree (tx_descr);
27087 @@ -494,7 +494,7 @@ static void rx_complete (amb_dev * dev,
27088 dump_skb ("<<<", vc, skb);
27089
27090 // VC layer stats
27091 - atomic_inc(&atm_vcc->stats->rx);
27092 + atomic_inc_unchecked(&atm_vcc->stats->rx);
27093 __net_timestamp(skb);
27094 // end of our responsability
27095 atm_vcc->push (atm_vcc, skb);
27096 @@ -509,7 +509,7 @@ static void rx_complete (amb_dev * dev,
27097 } else {
27098 PRINTK (KERN_INFO, "dropped over-size frame");
27099 // should we count this?
27100 - atomic_inc(&atm_vcc->stats->rx_drop);
27101 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
27102 }
27103
27104 } else {
27105 @@ -1341,7 +1341,7 @@ static int amb_send (struct atm_vcc * at
27106 }
27107
27108 if (check_area (skb->data, skb->len)) {
27109 - atomic_inc(&atm_vcc->stats->tx_err);
27110 + atomic_inc_unchecked(&atm_vcc->stats->tx_err);
27111 return -ENOMEM; // ?
27112 }
27113
27114 diff -urNp linux-2.6.32.46/drivers/atm/atmtcp.c linux-2.6.32.46/drivers/atm/atmtcp.c
27115 --- linux-2.6.32.46/drivers/atm/atmtcp.c 2011-03-27 14:31:47.000000000 -0400
27116 +++ linux-2.6.32.46/drivers/atm/atmtcp.c 2011-04-17 15:56:46.000000000 -0400
27117 @@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc
27118 if (vcc->pop) vcc->pop(vcc,skb);
27119 else dev_kfree_skb(skb);
27120 if (dev_data) return 0;
27121 - atomic_inc(&vcc->stats->tx_err);
27122 + atomic_inc_unchecked(&vcc->stats->tx_err);
27123 return -ENOLINK;
27124 }
27125 size = skb->len+sizeof(struct atmtcp_hdr);
27126 @@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc
27127 if (!new_skb) {
27128 if (vcc->pop) vcc->pop(vcc,skb);
27129 else dev_kfree_skb(skb);
27130 - atomic_inc(&vcc->stats->tx_err);
27131 + atomic_inc_unchecked(&vcc->stats->tx_err);
27132 return -ENOBUFS;
27133 }
27134 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
27135 @@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc
27136 if (vcc->pop) vcc->pop(vcc,skb);
27137 else dev_kfree_skb(skb);
27138 out_vcc->push(out_vcc,new_skb);
27139 - atomic_inc(&vcc->stats->tx);
27140 - atomic_inc(&out_vcc->stats->rx);
27141 + atomic_inc_unchecked(&vcc->stats->tx);
27142 + atomic_inc_unchecked(&out_vcc->stats->rx);
27143 return 0;
27144 }
27145
27146 @@ -300,7 +300,7 @@ static int atmtcp_c_send(struct atm_vcc
27147 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
27148 read_unlock(&vcc_sklist_lock);
27149 if (!out_vcc) {
27150 - atomic_inc(&vcc->stats->tx_err);
27151 + atomic_inc_unchecked(&vcc->stats->tx_err);
27152 goto done;
27153 }
27154 skb_pull(skb,sizeof(struct atmtcp_hdr));
27155 @@ -312,8 +312,8 @@ static int atmtcp_c_send(struct atm_vcc
27156 __net_timestamp(new_skb);
27157 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
27158 out_vcc->push(out_vcc,new_skb);
27159 - atomic_inc(&vcc->stats->tx);
27160 - atomic_inc(&out_vcc->stats->rx);
27161 + atomic_inc_unchecked(&vcc->stats->tx);
27162 + atomic_inc_unchecked(&out_vcc->stats->rx);
27163 done:
27164 if (vcc->pop) vcc->pop(vcc,skb);
27165 else dev_kfree_skb(skb);
27166 diff -urNp linux-2.6.32.46/drivers/atm/eni.c linux-2.6.32.46/drivers/atm/eni.c
27167 --- linux-2.6.32.46/drivers/atm/eni.c 2011-03-27 14:31:47.000000000 -0400
27168 +++ linux-2.6.32.46/drivers/atm/eni.c 2011-04-17 15:56:46.000000000 -0400
27169 @@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
27170 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
27171 vcc->dev->number);
27172 length = 0;
27173 - atomic_inc(&vcc->stats->rx_err);
27174 + atomic_inc_unchecked(&vcc->stats->rx_err);
27175 }
27176 else {
27177 length = ATM_CELL_SIZE-1; /* no HEC */
27178 @@ -580,7 +580,7 @@ static int rx_aal5(struct atm_vcc *vcc)
27179 size);
27180 }
27181 eff = length = 0;
27182 - atomic_inc(&vcc->stats->rx_err);
27183 + atomic_inc_unchecked(&vcc->stats->rx_err);
27184 }
27185 else {
27186 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
27187 @@ -597,7 +597,7 @@ static int rx_aal5(struct atm_vcc *vcc)
27188 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
27189 vcc->dev->number,vcc->vci,length,size << 2,descr);
27190 length = eff = 0;
27191 - atomic_inc(&vcc->stats->rx_err);
27192 + atomic_inc_unchecked(&vcc->stats->rx_err);
27193 }
27194 }
27195 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
27196 @@ -770,7 +770,7 @@ rx_dequeued++;
27197 vcc->push(vcc,skb);
27198 pushed++;
27199 }
27200 - atomic_inc(&vcc->stats->rx);
27201 + atomic_inc_unchecked(&vcc->stats->rx);
27202 }
27203 wake_up(&eni_dev->rx_wait);
27204 }
27205 @@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *d
27206 PCI_DMA_TODEVICE);
27207 if (vcc->pop) vcc->pop(vcc,skb);
27208 else dev_kfree_skb_irq(skb);
27209 - atomic_inc(&vcc->stats->tx);
27210 + atomic_inc_unchecked(&vcc->stats->tx);
27211 wake_up(&eni_dev->tx_wait);
27212 dma_complete++;
27213 }
27214 diff -urNp linux-2.6.32.46/drivers/atm/firestream.c linux-2.6.32.46/drivers/atm/firestream.c
27215 --- linux-2.6.32.46/drivers/atm/firestream.c 2011-03-27 14:31:47.000000000 -0400
27216 +++ linux-2.6.32.46/drivers/atm/firestream.c 2011-04-17 15:56:46.000000000 -0400
27217 @@ -748,7 +748,7 @@ static void process_txdone_queue (struct
27218 }
27219 }
27220
27221 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
27222 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
27223
27224 fs_dprintk (FS_DEBUG_TXMEM, "i");
27225 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
27226 @@ -815,7 +815,7 @@ static void process_incoming (struct fs_
27227 #endif
27228 skb_put (skb, qe->p1 & 0xffff);
27229 ATM_SKB(skb)->vcc = atm_vcc;
27230 - atomic_inc(&atm_vcc->stats->rx);
27231 + atomic_inc_unchecked(&atm_vcc->stats->rx);
27232 __net_timestamp(skb);
27233 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
27234 atm_vcc->push (atm_vcc, skb);
27235 @@ -836,12 +836,12 @@ static void process_incoming (struct fs_
27236 kfree (pe);
27237 }
27238 if (atm_vcc)
27239 - atomic_inc(&atm_vcc->stats->rx_drop);
27240 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
27241 break;
27242 case 0x1f: /* Reassembly abort: no buffers. */
27243 /* Silently increment error counter. */
27244 if (atm_vcc)
27245 - atomic_inc(&atm_vcc->stats->rx_drop);
27246 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
27247 break;
27248 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
27249 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
27250 diff -urNp linux-2.6.32.46/drivers/atm/fore200e.c linux-2.6.32.46/drivers/atm/fore200e.c
27251 --- linux-2.6.32.46/drivers/atm/fore200e.c 2011-03-27 14:31:47.000000000 -0400
27252 +++ linux-2.6.32.46/drivers/atm/fore200e.c 2011-04-17 15:56:46.000000000 -0400
27253 @@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200
27254 #endif
27255 /* check error condition */
27256 if (*entry->status & STATUS_ERROR)
27257 - atomic_inc(&vcc->stats->tx_err);
27258 + atomic_inc_unchecked(&vcc->stats->tx_err);
27259 else
27260 - atomic_inc(&vcc->stats->tx);
27261 + atomic_inc_unchecked(&vcc->stats->tx);
27262 }
27263 }
27264
27265 @@ -1082,7 +1082,7 @@ fore200e_push_rpd(struct fore200e* fore2
27266 if (skb == NULL) {
27267 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
27268
27269 - atomic_inc(&vcc->stats->rx_drop);
27270 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27271 return -ENOMEM;
27272 }
27273
27274 @@ -1125,14 +1125,14 @@ fore200e_push_rpd(struct fore200e* fore2
27275
27276 dev_kfree_skb_any(skb);
27277
27278 - atomic_inc(&vcc->stats->rx_drop);
27279 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27280 return -ENOMEM;
27281 }
27282
27283 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
27284
27285 vcc->push(vcc, skb);
27286 - atomic_inc(&vcc->stats->rx);
27287 + atomic_inc_unchecked(&vcc->stats->rx);
27288
27289 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
27290
27291 @@ -1210,7 +1210,7 @@ fore200e_rx_irq(struct fore200e* fore200
27292 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
27293 fore200e->atm_dev->number,
27294 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
27295 - atomic_inc(&vcc->stats->rx_err);
27296 + atomic_inc_unchecked(&vcc->stats->rx_err);
27297 }
27298 }
27299
27300 @@ -1655,7 +1655,7 @@ fore200e_send(struct atm_vcc *vcc, struc
27301 goto retry_here;
27302 }
27303
27304 - atomic_inc(&vcc->stats->tx_err);
27305 + atomic_inc_unchecked(&vcc->stats->tx_err);
27306
27307 fore200e->tx_sat++;
27308 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
27309 diff -urNp linux-2.6.32.46/drivers/atm/he.c linux-2.6.32.46/drivers/atm/he.c
27310 --- linux-2.6.32.46/drivers/atm/he.c 2011-03-27 14:31:47.000000000 -0400
27311 +++ linux-2.6.32.46/drivers/atm/he.c 2011-04-17 15:56:46.000000000 -0400
27312 @@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, i
27313
27314 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
27315 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
27316 - atomic_inc(&vcc->stats->rx_drop);
27317 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27318 goto return_host_buffers;
27319 }
27320
27321 @@ -1802,7 +1802,7 @@ he_service_rbrq(struct he_dev *he_dev, i
27322 RBRQ_LEN_ERR(he_dev->rbrq_head)
27323 ? "LEN_ERR" : "",
27324 vcc->vpi, vcc->vci);
27325 - atomic_inc(&vcc->stats->rx_err);
27326 + atomic_inc_unchecked(&vcc->stats->rx_err);
27327 goto return_host_buffers;
27328 }
27329
27330 @@ -1861,7 +1861,7 @@ he_service_rbrq(struct he_dev *he_dev, i
27331 vcc->push(vcc, skb);
27332 spin_lock(&he_dev->global_lock);
27333
27334 - atomic_inc(&vcc->stats->rx);
27335 + atomic_inc_unchecked(&vcc->stats->rx);
27336
27337 return_host_buffers:
27338 ++pdus_assembled;
27339 @@ -2206,7 +2206,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
27340 tpd->vcc->pop(tpd->vcc, tpd->skb);
27341 else
27342 dev_kfree_skb_any(tpd->skb);
27343 - atomic_inc(&tpd->vcc->stats->tx_err);
27344 + atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
27345 }
27346 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
27347 return;
27348 @@ -2618,7 +2618,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
27349 vcc->pop(vcc, skb);
27350 else
27351 dev_kfree_skb_any(skb);
27352 - atomic_inc(&vcc->stats->tx_err);
27353 + atomic_inc_unchecked(&vcc->stats->tx_err);
27354 return -EINVAL;
27355 }
27356
27357 @@ -2629,7 +2629,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
27358 vcc->pop(vcc, skb);
27359 else
27360 dev_kfree_skb_any(skb);
27361 - atomic_inc(&vcc->stats->tx_err);
27362 + atomic_inc_unchecked(&vcc->stats->tx_err);
27363 return -EINVAL;
27364 }
27365 #endif
27366 @@ -2641,7 +2641,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
27367 vcc->pop(vcc, skb);
27368 else
27369 dev_kfree_skb_any(skb);
27370 - atomic_inc(&vcc->stats->tx_err);
27371 + atomic_inc_unchecked(&vcc->stats->tx_err);
27372 spin_unlock_irqrestore(&he_dev->global_lock, flags);
27373 return -ENOMEM;
27374 }
27375 @@ -2683,7 +2683,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
27376 vcc->pop(vcc, skb);
27377 else
27378 dev_kfree_skb_any(skb);
27379 - atomic_inc(&vcc->stats->tx_err);
27380 + atomic_inc_unchecked(&vcc->stats->tx_err);
27381 spin_unlock_irqrestore(&he_dev->global_lock, flags);
27382 return -ENOMEM;
27383 }
27384 @@ -2714,7 +2714,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
27385 __enqueue_tpd(he_dev, tpd, cid);
27386 spin_unlock_irqrestore(&he_dev->global_lock, flags);
27387
27388 - atomic_inc(&vcc->stats->tx);
27389 + atomic_inc_unchecked(&vcc->stats->tx);
27390
27391 return 0;
27392 }
27393 diff -urNp linux-2.6.32.46/drivers/atm/horizon.c linux-2.6.32.46/drivers/atm/horizon.c
27394 --- linux-2.6.32.46/drivers/atm/horizon.c 2011-03-27 14:31:47.000000000 -0400
27395 +++ linux-2.6.32.46/drivers/atm/horizon.c 2011-04-17 15:56:46.000000000 -0400
27396 @@ -1033,7 +1033,7 @@ static void rx_schedule (hrz_dev * dev,
27397 {
27398 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
27399 // VC layer stats
27400 - atomic_inc(&vcc->stats->rx);
27401 + atomic_inc_unchecked(&vcc->stats->rx);
27402 __net_timestamp(skb);
27403 // end of our responsability
27404 vcc->push (vcc, skb);
27405 @@ -1185,7 +1185,7 @@ static void tx_schedule (hrz_dev * const
27406 dev->tx_iovec = NULL;
27407
27408 // VC layer stats
27409 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
27410 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
27411
27412 // free the skb
27413 hrz_kfree_skb (skb);
27414 diff -urNp linux-2.6.32.46/drivers/atm/idt77252.c linux-2.6.32.46/drivers/atm/idt77252.c
27415 --- linux-2.6.32.46/drivers/atm/idt77252.c 2011-03-27 14:31:47.000000000 -0400
27416 +++ linux-2.6.32.46/drivers/atm/idt77252.c 2011-04-17 15:56:46.000000000 -0400
27417 @@ -810,7 +810,7 @@ drain_scq(struct idt77252_dev *card, str
27418 else
27419 dev_kfree_skb(skb);
27420
27421 - atomic_inc(&vcc->stats->tx);
27422 + atomic_inc_unchecked(&vcc->stats->tx);
27423 }
27424
27425 atomic_dec(&scq->used);
27426 @@ -1073,13 +1073,13 @@ dequeue_rx(struct idt77252_dev *card, st
27427 if ((sb = dev_alloc_skb(64)) == NULL) {
27428 printk("%s: Can't allocate buffers for aal0.\n",
27429 card->name);
27430 - atomic_add(i, &vcc->stats->rx_drop);
27431 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
27432 break;
27433 }
27434 if (!atm_charge(vcc, sb->truesize)) {
27435 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
27436 card->name);
27437 - atomic_add(i - 1, &vcc->stats->rx_drop);
27438 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
27439 dev_kfree_skb(sb);
27440 break;
27441 }
27442 @@ -1096,7 +1096,7 @@ dequeue_rx(struct idt77252_dev *card, st
27443 ATM_SKB(sb)->vcc = vcc;
27444 __net_timestamp(sb);
27445 vcc->push(vcc, sb);
27446 - atomic_inc(&vcc->stats->rx);
27447 + atomic_inc_unchecked(&vcc->stats->rx);
27448
27449 cell += ATM_CELL_PAYLOAD;
27450 }
27451 @@ -1133,13 +1133,13 @@ dequeue_rx(struct idt77252_dev *card, st
27452 "(CDC: %08x)\n",
27453 card->name, len, rpp->len, readl(SAR_REG_CDC));
27454 recycle_rx_pool_skb(card, rpp);
27455 - atomic_inc(&vcc->stats->rx_err);
27456 + atomic_inc_unchecked(&vcc->stats->rx_err);
27457 return;
27458 }
27459 if (stat & SAR_RSQE_CRC) {
27460 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
27461 recycle_rx_pool_skb(card, rpp);
27462 - atomic_inc(&vcc->stats->rx_err);
27463 + atomic_inc_unchecked(&vcc->stats->rx_err);
27464 return;
27465 }
27466 if (skb_queue_len(&rpp->queue) > 1) {
27467 @@ -1150,7 +1150,7 @@ dequeue_rx(struct idt77252_dev *card, st
27468 RXPRINTK("%s: Can't alloc RX skb.\n",
27469 card->name);
27470 recycle_rx_pool_skb(card, rpp);
27471 - atomic_inc(&vcc->stats->rx_err);
27472 + atomic_inc_unchecked(&vcc->stats->rx_err);
27473 return;
27474 }
27475 if (!atm_charge(vcc, skb->truesize)) {
27476 @@ -1169,7 +1169,7 @@ dequeue_rx(struct idt77252_dev *card, st
27477 __net_timestamp(skb);
27478
27479 vcc->push(vcc, skb);
27480 - atomic_inc(&vcc->stats->rx);
27481 + atomic_inc_unchecked(&vcc->stats->rx);
27482
27483 return;
27484 }
27485 @@ -1191,7 +1191,7 @@ dequeue_rx(struct idt77252_dev *card, st
27486 __net_timestamp(skb);
27487
27488 vcc->push(vcc, skb);
27489 - atomic_inc(&vcc->stats->rx);
27490 + atomic_inc_unchecked(&vcc->stats->rx);
27491
27492 if (skb->truesize > SAR_FB_SIZE_3)
27493 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
27494 @@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *car
27495 if (vcc->qos.aal != ATM_AAL0) {
27496 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
27497 card->name, vpi, vci);
27498 - atomic_inc(&vcc->stats->rx_drop);
27499 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27500 goto drop;
27501 }
27502
27503 if ((sb = dev_alloc_skb(64)) == NULL) {
27504 printk("%s: Can't allocate buffers for AAL0.\n",
27505 card->name);
27506 - atomic_inc(&vcc->stats->rx_err);
27507 + atomic_inc_unchecked(&vcc->stats->rx_err);
27508 goto drop;
27509 }
27510
27511 @@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *car
27512 ATM_SKB(sb)->vcc = vcc;
27513 __net_timestamp(sb);
27514 vcc->push(vcc, sb);
27515 - atomic_inc(&vcc->stats->rx);
27516 + atomic_inc_unchecked(&vcc->stats->rx);
27517
27518 drop:
27519 skb_pull(queue, 64);
27520 @@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
27521
27522 if (vc == NULL) {
27523 printk("%s: NULL connection in send().\n", card->name);
27524 - atomic_inc(&vcc->stats->tx_err);
27525 + atomic_inc_unchecked(&vcc->stats->tx_err);
27526 dev_kfree_skb(skb);
27527 return -EINVAL;
27528 }
27529 if (!test_bit(VCF_TX, &vc->flags)) {
27530 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
27531 - atomic_inc(&vcc->stats->tx_err);
27532 + atomic_inc_unchecked(&vcc->stats->tx_err);
27533 dev_kfree_skb(skb);
27534 return -EINVAL;
27535 }
27536 @@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
27537 break;
27538 default:
27539 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
27540 - atomic_inc(&vcc->stats->tx_err);
27541 + atomic_inc_unchecked(&vcc->stats->tx_err);
27542 dev_kfree_skb(skb);
27543 return -EINVAL;
27544 }
27545
27546 if (skb_shinfo(skb)->nr_frags != 0) {
27547 printk("%s: No scatter-gather yet.\n", card->name);
27548 - atomic_inc(&vcc->stats->tx_err);
27549 + atomic_inc_unchecked(&vcc->stats->tx_err);
27550 dev_kfree_skb(skb);
27551 return -EINVAL;
27552 }
27553 @@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
27554
27555 err = queue_skb(card, vc, skb, oam);
27556 if (err) {
27557 - atomic_inc(&vcc->stats->tx_err);
27558 + atomic_inc_unchecked(&vcc->stats->tx_err);
27559 dev_kfree_skb(skb);
27560 return err;
27561 }
27562 @@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
27563 skb = dev_alloc_skb(64);
27564 if (!skb) {
27565 printk("%s: Out of memory in send_oam().\n", card->name);
27566 - atomic_inc(&vcc->stats->tx_err);
27567 + atomic_inc_unchecked(&vcc->stats->tx_err);
27568 return -ENOMEM;
27569 }
27570 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
27571 diff -urNp linux-2.6.32.46/drivers/atm/iphase.c linux-2.6.32.46/drivers/atm/iphase.c
27572 --- linux-2.6.32.46/drivers/atm/iphase.c 2011-03-27 14:31:47.000000000 -0400
27573 +++ linux-2.6.32.46/drivers/atm/iphase.c 2011-04-17 15:56:46.000000000 -0400
27574 @@ -1123,7 +1123,7 @@ static int rx_pkt(struct atm_dev *dev)
27575 status = (u_short) (buf_desc_ptr->desc_mode);
27576 if (status & (RX_CER | RX_PTE | RX_OFL))
27577 {
27578 - atomic_inc(&vcc->stats->rx_err);
27579 + atomic_inc_unchecked(&vcc->stats->rx_err);
27580 IF_ERR(printk("IA: bad packet, dropping it");)
27581 if (status & RX_CER) {
27582 IF_ERR(printk(" cause: packet CRC error\n");)
27583 @@ -1146,7 +1146,7 @@ static int rx_pkt(struct atm_dev *dev)
27584 len = dma_addr - buf_addr;
27585 if (len > iadev->rx_buf_sz) {
27586 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
27587 - atomic_inc(&vcc->stats->rx_err);
27588 + atomic_inc_unchecked(&vcc->stats->rx_err);
27589 goto out_free_desc;
27590 }
27591
27592 @@ -1296,7 +1296,7 @@ static void rx_dle_intr(struct atm_dev *
27593 ia_vcc = INPH_IA_VCC(vcc);
27594 if (ia_vcc == NULL)
27595 {
27596 - atomic_inc(&vcc->stats->rx_err);
27597 + atomic_inc_unchecked(&vcc->stats->rx_err);
27598 dev_kfree_skb_any(skb);
27599 atm_return(vcc, atm_guess_pdu2truesize(len));
27600 goto INCR_DLE;
27601 @@ -1308,7 +1308,7 @@ static void rx_dle_intr(struct atm_dev *
27602 if ((length > iadev->rx_buf_sz) || (length >
27603 (skb->len - sizeof(struct cpcs_trailer))))
27604 {
27605 - atomic_inc(&vcc->stats->rx_err);
27606 + atomic_inc_unchecked(&vcc->stats->rx_err);
27607 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
27608 length, skb->len);)
27609 dev_kfree_skb_any(skb);
27610 @@ -1324,7 +1324,7 @@ static void rx_dle_intr(struct atm_dev *
27611
27612 IF_RX(printk("rx_dle_intr: skb push");)
27613 vcc->push(vcc,skb);
27614 - atomic_inc(&vcc->stats->rx);
27615 + atomic_inc_unchecked(&vcc->stats->rx);
27616 iadev->rx_pkt_cnt++;
27617 }
27618 INCR_DLE:
27619 @@ -2806,15 +2806,15 @@ static int ia_ioctl(struct atm_dev *dev,
27620 {
27621 struct k_sonet_stats *stats;
27622 stats = &PRIV(_ia_dev[board])->sonet_stats;
27623 - printk("section_bip: %d\n", atomic_read(&stats->section_bip));
27624 - printk("line_bip : %d\n", atomic_read(&stats->line_bip));
27625 - printk("path_bip : %d\n", atomic_read(&stats->path_bip));
27626 - printk("line_febe : %d\n", atomic_read(&stats->line_febe));
27627 - printk("path_febe : %d\n", atomic_read(&stats->path_febe));
27628 - printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
27629 - printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
27630 - printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
27631 - printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
27632 + printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
27633 + printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
27634 + printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
27635 + printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
27636 + printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
27637 + printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
27638 + printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
27639 + printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
27640 + printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
27641 }
27642 ia_cmds.status = 0;
27643 break;
27644 @@ -2919,7 +2919,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
27645 if ((desc == 0) || (desc > iadev->num_tx_desc))
27646 {
27647 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
27648 - atomic_inc(&vcc->stats->tx);
27649 + atomic_inc_unchecked(&vcc->stats->tx);
27650 if (vcc->pop)
27651 vcc->pop(vcc, skb);
27652 else
27653 @@ -3024,14 +3024,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
27654 ATM_DESC(skb) = vcc->vci;
27655 skb_queue_tail(&iadev->tx_dma_q, skb);
27656
27657 - atomic_inc(&vcc->stats->tx);
27658 + atomic_inc_unchecked(&vcc->stats->tx);
27659 iadev->tx_pkt_cnt++;
27660 /* Increment transaction counter */
27661 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
27662
27663 #if 0
27664 /* add flow control logic */
27665 - if (atomic_read(&vcc->stats->tx) % 20 == 0) {
27666 + if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
27667 if (iavcc->vc_desc_cnt > 10) {
27668 vcc->tx_quota = vcc->tx_quota * 3 / 4;
27669 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
27670 diff -urNp linux-2.6.32.46/drivers/atm/lanai.c linux-2.6.32.46/drivers/atm/lanai.c
27671 --- linux-2.6.32.46/drivers/atm/lanai.c 2011-03-27 14:31:47.000000000 -0400
27672 +++ linux-2.6.32.46/drivers/atm/lanai.c 2011-04-17 15:56:46.000000000 -0400
27673 @@ -1305,7 +1305,7 @@ static void lanai_send_one_aal5(struct l
27674 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
27675 lanai_endtx(lanai, lvcc);
27676 lanai_free_skb(lvcc->tx.atmvcc, skb);
27677 - atomic_inc(&lvcc->tx.atmvcc->stats->tx);
27678 + atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
27679 }
27680
27681 /* Try to fill the buffer - don't call unless there is backlog */
27682 @@ -1428,7 +1428,7 @@ static void vcc_rx_aal5(struct lanai_vcc
27683 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
27684 __net_timestamp(skb);
27685 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
27686 - atomic_inc(&lvcc->rx.atmvcc->stats->rx);
27687 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
27688 out:
27689 lvcc->rx.buf.ptr = end;
27690 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
27691 @@ -1670,7 +1670,7 @@ static int handle_service(struct lanai_d
27692 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
27693 "vcc %d\n", lanai->number, (unsigned int) s, vci);
27694 lanai->stats.service_rxnotaal5++;
27695 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27696 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27697 return 0;
27698 }
27699 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
27700 @@ -1682,7 +1682,7 @@ static int handle_service(struct lanai_d
27701 int bytes;
27702 read_unlock(&vcc_sklist_lock);
27703 DPRINTK("got trashed rx pdu on vci %d\n", vci);
27704 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27705 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27706 lvcc->stats.x.aal5.service_trash++;
27707 bytes = (SERVICE_GET_END(s) * 16) -
27708 (((unsigned long) lvcc->rx.buf.ptr) -
27709 @@ -1694,7 +1694,7 @@ static int handle_service(struct lanai_d
27710 }
27711 if (s & SERVICE_STREAM) {
27712 read_unlock(&vcc_sklist_lock);
27713 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27714 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27715 lvcc->stats.x.aal5.service_stream++;
27716 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
27717 "PDU on VCI %d!\n", lanai->number, vci);
27718 @@ -1702,7 +1702,7 @@ static int handle_service(struct lanai_d
27719 return 0;
27720 }
27721 DPRINTK("got rx crc error on vci %d\n", vci);
27722 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27723 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27724 lvcc->stats.x.aal5.service_rxcrc++;
27725 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
27726 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
27727 diff -urNp linux-2.6.32.46/drivers/atm/nicstar.c linux-2.6.32.46/drivers/atm/nicstar.c
27728 --- linux-2.6.32.46/drivers/atm/nicstar.c 2011-03-27 14:31:47.000000000 -0400
27729 +++ linux-2.6.32.46/drivers/atm/nicstar.c 2011-04-17 15:56:46.000000000 -0400
27730 @@ -1723,7 +1723,7 @@ static int ns_send(struct atm_vcc *vcc,
27731 if ((vc = (vc_map *) vcc->dev_data) == NULL)
27732 {
27733 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", card->index);
27734 - atomic_inc(&vcc->stats->tx_err);
27735 + atomic_inc_unchecked(&vcc->stats->tx_err);
27736 dev_kfree_skb_any(skb);
27737 return -EINVAL;
27738 }
27739 @@ -1731,7 +1731,7 @@ static int ns_send(struct atm_vcc *vcc,
27740 if (!vc->tx)
27741 {
27742 printk("nicstar%d: Trying to transmit on a non-tx VC.\n", card->index);
27743 - atomic_inc(&vcc->stats->tx_err);
27744 + atomic_inc_unchecked(&vcc->stats->tx_err);
27745 dev_kfree_skb_any(skb);
27746 return -EINVAL;
27747 }
27748 @@ -1739,7 +1739,7 @@ static int ns_send(struct atm_vcc *vcc,
27749 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0)
27750 {
27751 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", card->index);
27752 - atomic_inc(&vcc->stats->tx_err);
27753 + atomic_inc_unchecked(&vcc->stats->tx_err);
27754 dev_kfree_skb_any(skb);
27755 return -EINVAL;
27756 }
27757 @@ -1747,7 +1747,7 @@ static int ns_send(struct atm_vcc *vcc,
27758 if (skb_shinfo(skb)->nr_frags != 0)
27759 {
27760 printk("nicstar%d: No scatter-gather yet.\n", card->index);
27761 - atomic_inc(&vcc->stats->tx_err);
27762 + atomic_inc_unchecked(&vcc->stats->tx_err);
27763 dev_kfree_skb_any(skb);
27764 return -EINVAL;
27765 }
27766 @@ -1792,11 +1792,11 @@ static int ns_send(struct atm_vcc *vcc,
27767
27768 if (push_scqe(card, vc, scq, &scqe, skb) != 0)
27769 {
27770 - atomic_inc(&vcc->stats->tx_err);
27771 + atomic_inc_unchecked(&vcc->stats->tx_err);
27772 dev_kfree_skb_any(skb);
27773 return -EIO;
27774 }
27775 - atomic_inc(&vcc->stats->tx);
27776 + atomic_inc_unchecked(&vcc->stats->tx);
27777
27778 return 0;
27779 }
27780 @@ -2111,14 +2111,14 @@ static void dequeue_rx(ns_dev *card, ns_
27781 {
27782 printk("nicstar%d: Can't allocate buffers for aal0.\n",
27783 card->index);
27784 - atomic_add(i,&vcc->stats->rx_drop);
27785 + atomic_add_unchecked(i,&vcc->stats->rx_drop);
27786 break;
27787 }
27788 if (!atm_charge(vcc, sb->truesize))
27789 {
27790 RXPRINTK("nicstar%d: atm_charge() dropped aal0 packets.\n",
27791 card->index);
27792 - atomic_add(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
27793 + atomic_add_unchecked(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
27794 dev_kfree_skb_any(sb);
27795 break;
27796 }
27797 @@ -2133,7 +2133,7 @@ static void dequeue_rx(ns_dev *card, ns_
27798 ATM_SKB(sb)->vcc = vcc;
27799 __net_timestamp(sb);
27800 vcc->push(vcc, sb);
27801 - atomic_inc(&vcc->stats->rx);
27802 + atomic_inc_unchecked(&vcc->stats->rx);
27803 cell += ATM_CELL_PAYLOAD;
27804 }
27805
27806 @@ -2152,7 +2152,7 @@ static void dequeue_rx(ns_dev *card, ns_
27807 if (iovb == NULL)
27808 {
27809 printk("nicstar%d: Out of iovec buffers.\n", card->index);
27810 - atomic_inc(&vcc->stats->rx_drop);
27811 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27812 recycle_rx_buf(card, skb);
27813 return;
27814 }
27815 @@ -2182,7 +2182,7 @@ static void dequeue_rx(ns_dev *card, ns_
27816 else if (NS_SKB(iovb)->iovcnt >= NS_MAX_IOVECS)
27817 {
27818 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
27819 - atomic_inc(&vcc->stats->rx_err);
27820 + atomic_inc_unchecked(&vcc->stats->rx_err);
27821 recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
27822 NS_SKB(iovb)->iovcnt = 0;
27823 iovb->len = 0;
27824 @@ -2202,7 +2202,7 @@ static void dequeue_rx(ns_dev *card, ns_
27825 printk("nicstar%d: Expected a small buffer, and this is not one.\n",
27826 card->index);
27827 which_list(card, skb);
27828 - atomic_inc(&vcc->stats->rx_err);
27829 + atomic_inc_unchecked(&vcc->stats->rx_err);
27830 recycle_rx_buf(card, skb);
27831 vc->rx_iov = NULL;
27832 recycle_iov_buf(card, iovb);
27833 @@ -2216,7 +2216,7 @@ static void dequeue_rx(ns_dev *card, ns_
27834 printk("nicstar%d: Expected a large buffer, and this is not one.\n",
27835 card->index);
27836 which_list(card, skb);
27837 - atomic_inc(&vcc->stats->rx_err);
27838 + atomic_inc_unchecked(&vcc->stats->rx_err);
27839 recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
27840 NS_SKB(iovb)->iovcnt);
27841 vc->rx_iov = NULL;
27842 @@ -2240,7 +2240,7 @@ static void dequeue_rx(ns_dev *card, ns_
27843 printk(" - PDU size mismatch.\n");
27844 else
27845 printk(".\n");
27846 - atomic_inc(&vcc->stats->rx_err);
27847 + atomic_inc_unchecked(&vcc->stats->rx_err);
27848 recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
27849 NS_SKB(iovb)->iovcnt);
27850 vc->rx_iov = NULL;
27851 @@ -2256,7 +2256,7 @@ static void dequeue_rx(ns_dev *card, ns_
27852 if (!atm_charge(vcc, skb->truesize))
27853 {
27854 push_rxbufs(card, skb);
27855 - atomic_inc(&vcc->stats->rx_drop);
27856 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27857 }
27858 else
27859 {
27860 @@ -2268,7 +2268,7 @@ static void dequeue_rx(ns_dev *card, ns_
27861 ATM_SKB(skb)->vcc = vcc;
27862 __net_timestamp(skb);
27863 vcc->push(vcc, skb);
27864 - atomic_inc(&vcc->stats->rx);
27865 + atomic_inc_unchecked(&vcc->stats->rx);
27866 }
27867 }
27868 else if (NS_SKB(iovb)->iovcnt == 2) /* One small plus one large buffer */
27869 @@ -2283,7 +2283,7 @@ static void dequeue_rx(ns_dev *card, ns_
27870 if (!atm_charge(vcc, sb->truesize))
27871 {
27872 push_rxbufs(card, sb);
27873 - atomic_inc(&vcc->stats->rx_drop);
27874 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27875 }
27876 else
27877 {
27878 @@ -2295,7 +2295,7 @@ static void dequeue_rx(ns_dev *card, ns_
27879 ATM_SKB(sb)->vcc = vcc;
27880 __net_timestamp(sb);
27881 vcc->push(vcc, sb);
27882 - atomic_inc(&vcc->stats->rx);
27883 + atomic_inc_unchecked(&vcc->stats->rx);
27884 }
27885
27886 push_rxbufs(card, skb);
27887 @@ -2306,7 +2306,7 @@ static void dequeue_rx(ns_dev *card, ns_
27888 if (!atm_charge(vcc, skb->truesize))
27889 {
27890 push_rxbufs(card, skb);
27891 - atomic_inc(&vcc->stats->rx_drop);
27892 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27893 }
27894 else
27895 {
27896 @@ -2320,7 +2320,7 @@ static void dequeue_rx(ns_dev *card, ns_
27897 ATM_SKB(skb)->vcc = vcc;
27898 __net_timestamp(skb);
27899 vcc->push(vcc, skb);
27900 - atomic_inc(&vcc->stats->rx);
27901 + atomic_inc_unchecked(&vcc->stats->rx);
27902 }
27903
27904 push_rxbufs(card, sb);
27905 @@ -2342,7 +2342,7 @@ static void dequeue_rx(ns_dev *card, ns_
27906 if (hb == NULL)
27907 {
27908 printk("nicstar%d: Out of huge buffers.\n", card->index);
27909 - atomic_inc(&vcc->stats->rx_drop);
27910 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27911 recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
27912 NS_SKB(iovb)->iovcnt);
27913 vc->rx_iov = NULL;
27914 @@ -2393,7 +2393,7 @@ static void dequeue_rx(ns_dev *card, ns_
27915 }
27916 else
27917 dev_kfree_skb_any(hb);
27918 - atomic_inc(&vcc->stats->rx_drop);
27919 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27920 }
27921 else
27922 {
27923 @@ -2427,7 +2427,7 @@ static void dequeue_rx(ns_dev *card, ns_
27924 #endif /* NS_USE_DESTRUCTORS */
27925 __net_timestamp(hb);
27926 vcc->push(vcc, hb);
27927 - atomic_inc(&vcc->stats->rx);
27928 + atomic_inc_unchecked(&vcc->stats->rx);
27929 }
27930 }
27931
27932 diff -urNp linux-2.6.32.46/drivers/atm/solos-pci.c linux-2.6.32.46/drivers/atm/solos-pci.c
27933 --- linux-2.6.32.46/drivers/atm/solos-pci.c 2011-04-17 17:00:52.000000000 -0400
27934 +++ linux-2.6.32.46/drivers/atm/solos-pci.c 2011-05-16 21:46:57.000000000 -0400
27935 @@ -708,7 +708,7 @@ void solos_bh(unsigned long card_arg)
27936 }
27937 atm_charge(vcc, skb->truesize);
27938 vcc->push(vcc, skb);
27939 - atomic_inc(&vcc->stats->rx);
27940 + atomic_inc_unchecked(&vcc->stats->rx);
27941 break;
27942
27943 case PKT_STATUS:
27944 @@ -914,6 +914,8 @@ static int print_buffer(struct sk_buff *
27945 char msg[500];
27946 char item[10];
27947
27948 + pax_track_stack();
27949 +
27950 len = buf->len;
27951 for (i = 0; i < len; i++){
27952 if(i % 8 == 0)
27953 @@ -1023,7 +1025,7 @@ static uint32_t fpga_tx(struct solos_car
27954 vcc = SKB_CB(oldskb)->vcc;
27955
27956 if (vcc) {
27957 - atomic_inc(&vcc->stats->tx);
27958 + atomic_inc_unchecked(&vcc->stats->tx);
27959 solos_pop(vcc, oldskb);
27960 } else
27961 dev_kfree_skb_irq(oldskb);
27962 diff -urNp linux-2.6.32.46/drivers/atm/suni.c linux-2.6.32.46/drivers/atm/suni.c
27963 --- linux-2.6.32.46/drivers/atm/suni.c 2011-03-27 14:31:47.000000000 -0400
27964 +++ linux-2.6.32.46/drivers/atm/suni.c 2011-04-17 15:56:46.000000000 -0400
27965 @@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
27966
27967
27968 #define ADD_LIMITED(s,v) \
27969 - atomic_add((v),&stats->s); \
27970 - if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
27971 + atomic_add_unchecked((v),&stats->s); \
27972 + if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
27973
27974
27975 static void suni_hz(unsigned long from_timer)
27976 diff -urNp linux-2.6.32.46/drivers/atm/uPD98402.c linux-2.6.32.46/drivers/atm/uPD98402.c
27977 --- linux-2.6.32.46/drivers/atm/uPD98402.c 2011-03-27 14:31:47.000000000 -0400
27978 +++ linux-2.6.32.46/drivers/atm/uPD98402.c 2011-04-17 15:56:46.000000000 -0400
27979 @@ -41,7 +41,7 @@ static int fetch_stats(struct atm_dev *d
27980 struct sonet_stats tmp;
27981 int error = 0;
27982
27983 - atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
27984 + atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
27985 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
27986 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
27987 if (zero && !error) {
27988 @@ -160,9 +160,9 @@ static int uPD98402_ioctl(struct atm_dev
27989
27990
27991 #define ADD_LIMITED(s,v) \
27992 - { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
27993 - if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
27994 - atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
27995 + { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
27996 + if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
27997 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
27998
27999
28000 static void stat_event(struct atm_dev *dev)
28001 @@ -193,7 +193,7 @@ static void uPD98402_int(struct atm_dev
28002 if (reason & uPD98402_INT_PFM) stat_event(dev);
28003 if (reason & uPD98402_INT_PCO) {
28004 (void) GET(PCOCR); /* clear interrupt cause */
28005 - atomic_add(GET(HECCT),
28006 + atomic_add_unchecked(GET(HECCT),
28007 &PRIV(dev)->sonet_stats.uncorr_hcs);
28008 }
28009 if ((reason & uPD98402_INT_RFO) &&
28010 @@ -221,9 +221,9 @@ static int uPD98402_start(struct atm_dev
28011 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
28012 uPD98402_INT_LOS),PIMR); /* enable them */
28013 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
28014 - atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
28015 - atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
28016 - atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
28017 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
28018 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
28019 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
28020 return 0;
28021 }
28022
28023 diff -urNp linux-2.6.32.46/drivers/atm/zatm.c linux-2.6.32.46/drivers/atm/zatm.c
28024 --- linux-2.6.32.46/drivers/atm/zatm.c 2011-03-27 14:31:47.000000000 -0400
28025 +++ linux-2.6.32.46/drivers/atm/zatm.c 2011-04-17 15:56:46.000000000 -0400
28026 @@ -458,7 +458,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
28027 }
28028 if (!size) {
28029 dev_kfree_skb_irq(skb);
28030 - if (vcc) atomic_inc(&vcc->stats->rx_err);
28031 + if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
28032 continue;
28033 }
28034 if (!atm_charge(vcc,skb->truesize)) {
28035 @@ -468,7 +468,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
28036 skb->len = size;
28037 ATM_SKB(skb)->vcc = vcc;
28038 vcc->push(vcc,skb);
28039 - atomic_inc(&vcc->stats->rx);
28040 + atomic_inc_unchecked(&vcc->stats->rx);
28041 }
28042 zout(pos & 0xffff,MTA(mbx));
28043 #if 0 /* probably a stupid idea */
28044 @@ -732,7 +732,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
28045 skb_queue_head(&zatm_vcc->backlog,skb);
28046 break;
28047 }
28048 - atomic_inc(&vcc->stats->tx);
28049 + atomic_inc_unchecked(&vcc->stats->tx);
28050 wake_up(&zatm_vcc->tx_wait);
28051 }
28052
28053 diff -urNp linux-2.6.32.46/drivers/base/bus.c linux-2.6.32.46/drivers/base/bus.c
28054 --- linux-2.6.32.46/drivers/base/bus.c 2011-03-27 14:31:47.000000000 -0400
28055 +++ linux-2.6.32.46/drivers/base/bus.c 2011-04-17 15:56:46.000000000 -0400
28056 @@ -70,7 +70,7 @@ static ssize_t drv_attr_store(struct kob
28057 return ret;
28058 }
28059
28060 -static struct sysfs_ops driver_sysfs_ops = {
28061 +static const struct sysfs_ops driver_sysfs_ops = {
28062 .show = drv_attr_show,
28063 .store = drv_attr_store,
28064 };
28065 @@ -115,7 +115,7 @@ static ssize_t bus_attr_store(struct kob
28066 return ret;
28067 }
28068
28069 -static struct sysfs_ops bus_sysfs_ops = {
28070 +static const struct sysfs_ops bus_sysfs_ops = {
28071 .show = bus_attr_show,
28072 .store = bus_attr_store,
28073 };
28074 @@ -154,7 +154,7 @@ static int bus_uevent_filter(struct kset
28075 return 0;
28076 }
28077
28078 -static struct kset_uevent_ops bus_uevent_ops = {
28079 +static const struct kset_uevent_ops bus_uevent_ops = {
28080 .filter = bus_uevent_filter,
28081 };
28082
28083 diff -urNp linux-2.6.32.46/drivers/base/class.c linux-2.6.32.46/drivers/base/class.c
28084 --- linux-2.6.32.46/drivers/base/class.c 2011-03-27 14:31:47.000000000 -0400
28085 +++ linux-2.6.32.46/drivers/base/class.c 2011-04-17 15:56:46.000000000 -0400
28086 @@ -63,7 +63,7 @@ static void class_release(struct kobject
28087 kfree(cp);
28088 }
28089
28090 -static struct sysfs_ops class_sysfs_ops = {
28091 +static const struct sysfs_ops class_sysfs_ops = {
28092 .show = class_attr_show,
28093 .store = class_attr_store,
28094 };
28095 diff -urNp linux-2.6.32.46/drivers/base/core.c linux-2.6.32.46/drivers/base/core.c
28096 --- linux-2.6.32.46/drivers/base/core.c 2011-03-27 14:31:47.000000000 -0400
28097 +++ linux-2.6.32.46/drivers/base/core.c 2011-04-17 15:56:46.000000000 -0400
28098 @@ -100,7 +100,7 @@ static ssize_t dev_attr_store(struct kob
28099 return ret;
28100 }
28101
28102 -static struct sysfs_ops dev_sysfs_ops = {
28103 +static const struct sysfs_ops dev_sysfs_ops = {
28104 .show = dev_attr_show,
28105 .store = dev_attr_store,
28106 };
28107 @@ -252,7 +252,7 @@ static int dev_uevent(struct kset *kset,
28108 return retval;
28109 }
28110
28111 -static struct kset_uevent_ops device_uevent_ops = {
28112 +static const struct kset_uevent_ops device_uevent_ops = {
28113 .filter = dev_uevent_filter,
28114 .name = dev_uevent_name,
28115 .uevent = dev_uevent,
28116 diff -urNp linux-2.6.32.46/drivers/base/memory.c linux-2.6.32.46/drivers/base/memory.c
28117 --- linux-2.6.32.46/drivers/base/memory.c 2011-03-27 14:31:47.000000000 -0400
28118 +++ linux-2.6.32.46/drivers/base/memory.c 2011-04-17 15:56:46.000000000 -0400
28119 @@ -44,7 +44,7 @@ static int memory_uevent(struct kset *ks
28120 return retval;
28121 }
28122
28123 -static struct kset_uevent_ops memory_uevent_ops = {
28124 +static const struct kset_uevent_ops memory_uevent_ops = {
28125 .name = memory_uevent_name,
28126 .uevent = memory_uevent,
28127 };
28128 diff -urNp linux-2.6.32.46/drivers/base/sys.c linux-2.6.32.46/drivers/base/sys.c
28129 --- linux-2.6.32.46/drivers/base/sys.c 2011-03-27 14:31:47.000000000 -0400
28130 +++ linux-2.6.32.46/drivers/base/sys.c 2011-04-17 15:56:46.000000000 -0400
28131 @@ -54,7 +54,7 @@ sysdev_store(struct kobject *kobj, struc
28132 return -EIO;
28133 }
28134
28135 -static struct sysfs_ops sysfs_ops = {
28136 +static const struct sysfs_ops sysfs_ops = {
28137 .show = sysdev_show,
28138 .store = sysdev_store,
28139 };
28140 @@ -104,7 +104,7 @@ static ssize_t sysdev_class_store(struct
28141 return -EIO;
28142 }
28143
28144 -static struct sysfs_ops sysfs_class_ops = {
28145 +static const struct sysfs_ops sysfs_class_ops = {
28146 .show = sysdev_class_show,
28147 .store = sysdev_class_store,
28148 };
28149 diff -urNp linux-2.6.32.46/drivers/block/cciss.c linux-2.6.32.46/drivers/block/cciss.c
28150 --- linux-2.6.32.46/drivers/block/cciss.c 2011-03-27 14:31:47.000000000 -0400
28151 +++ linux-2.6.32.46/drivers/block/cciss.c 2011-08-05 20:33:55.000000000 -0400
28152 @@ -1011,6 +1011,8 @@ static int cciss_ioctl32_passthru(struct
28153 int err;
28154 u32 cp;
28155
28156 + memset(&arg64, 0, sizeof(arg64));
28157 +
28158 err = 0;
28159 err |=
28160 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
28161 @@ -2852,7 +2854,7 @@ static unsigned long pollcomplete(int ct
28162 /* Wait (up to 20 seconds) for a command to complete */
28163
28164 for (i = 20 * HZ; i > 0; i--) {
28165 - done = hba[ctlr]->access.command_completed(hba[ctlr]);
28166 + done = hba[ctlr]->access->command_completed(hba[ctlr]);
28167 if (done == FIFO_EMPTY)
28168 schedule_timeout_uninterruptible(1);
28169 else
28170 @@ -2876,7 +2878,7 @@ static int sendcmd_core(ctlr_info_t *h,
28171 resend_cmd1:
28172
28173 /* Disable interrupt on the board. */
28174 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
28175 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
28176
28177 /* Make sure there is room in the command FIFO */
28178 /* Actually it should be completely empty at this time */
28179 @@ -2884,13 +2886,13 @@ resend_cmd1:
28180 /* tape side of the driver. */
28181 for (i = 200000; i > 0; i--) {
28182 /* if fifo isn't full go */
28183 - if (!(h->access.fifo_full(h)))
28184 + if (!(h->access->fifo_full(h)))
28185 break;
28186 udelay(10);
28187 printk(KERN_WARNING "cciss cciss%d: SendCmd FIFO full,"
28188 " waiting!\n", h->ctlr);
28189 }
28190 - h->access.submit_command(h, c); /* Send the cmd */
28191 + h->access->submit_command(h, c); /* Send the cmd */
28192 do {
28193 complete = pollcomplete(h->ctlr);
28194
28195 @@ -3023,7 +3025,7 @@ static void start_io(ctlr_info_t *h)
28196 while (!hlist_empty(&h->reqQ)) {
28197 c = hlist_entry(h->reqQ.first, CommandList_struct, list);
28198 /* can't do anything if fifo is full */
28199 - if ((h->access.fifo_full(h))) {
28200 + if ((h->access->fifo_full(h))) {
28201 printk(KERN_WARNING "cciss: fifo full\n");
28202 break;
28203 }
28204 @@ -3033,7 +3035,7 @@ static void start_io(ctlr_info_t *h)
28205 h->Qdepth--;
28206
28207 /* Tell the controller execute command */
28208 - h->access.submit_command(h, c);
28209 + h->access->submit_command(h, c);
28210
28211 /* Put job onto the completed Q */
28212 addQ(&h->cmpQ, c);
28213 @@ -3393,17 +3395,17 @@ startio:
28214
28215 static inline unsigned long get_next_completion(ctlr_info_t *h)
28216 {
28217 - return h->access.command_completed(h);
28218 + return h->access->command_completed(h);
28219 }
28220
28221 static inline int interrupt_pending(ctlr_info_t *h)
28222 {
28223 - return h->access.intr_pending(h);
28224 + return h->access->intr_pending(h);
28225 }
28226
28227 static inline long interrupt_not_for_us(ctlr_info_t *h)
28228 {
28229 - return (((h->access.intr_pending(h) == 0) ||
28230 + return (((h->access->intr_pending(h) == 0) ||
28231 (h->interrupts_enabled == 0)));
28232 }
28233
28234 @@ -3892,7 +3894,7 @@ static int __devinit cciss_pci_init(ctlr
28235 */
28236 c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
28237 c->product_name = products[prod_index].product_name;
28238 - c->access = *(products[prod_index].access);
28239 + c->access = products[prod_index].access;
28240 c->nr_cmds = c->max_commands - 4;
28241 if ((readb(&c->cfgtable->Signature[0]) != 'C') ||
28242 (readb(&c->cfgtable->Signature[1]) != 'I') ||
28243 @@ -4291,7 +4293,7 @@ static int __devinit cciss_init_one(stru
28244 }
28245
28246 /* make sure the board interrupts are off */
28247 - hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_OFF);
28248 + hba[i]->access->set_intr_mask(hba[i], CCISS_INTR_OFF);
28249 if (request_irq(hba[i]->intr[SIMPLE_MODE_INT], do_cciss_intr,
28250 IRQF_DISABLED | IRQF_SHARED, hba[i]->devname, hba[i])) {
28251 printk(KERN_ERR "cciss: Unable to get irq %d for %s\n",
28252 @@ -4341,7 +4343,7 @@ static int __devinit cciss_init_one(stru
28253 cciss_scsi_setup(i);
28254
28255 /* Turn the interrupts on so we can service requests */
28256 - hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_ON);
28257 + hba[i]->access->set_intr_mask(hba[i], CCISS_INTR_ON);
28258
28259 /* Get the firmware version */
28260 inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
28261 diff -urNp linux-2.6.32.46/drivers/block/cciss.h linux-2.6.32.46/drivers/block/cciss.h
28262 --- linux-2.6.32.46/drivers/block/cciss.h 2011-08-09 18:35:28.000000000 -0400
28263 +++ linux-2.6.32.46/drivers/block/cciss.h 2011-08-09 18:33:59.000000000 -0400
28264 @@ -90,7 +90,7 @@ struct ctlr_info
28265 // information about each logical volume
28266 drive_info_struct *drv[CISS_MAX_LUN];
28267
28268 - struct access_method access;
28269 + struct access_method *access;
28270
28271 /* queue and queue Info */
28272 struct hlist_head reqQ;
28273 diff -urNp linux-2.6.32.46/drivers/block/cpqarray.c linux-2.6.32.46/drivers/block/cpqarray.c
28274 --- linux-2.6.32.46/drivers/block/cpqarray.c 2011-03-27 14:31:47.000000000 -0400
28275 +++ linux-2.6.32.46/drivers/block/cpqarray.c 2011-08-05 20:33:55.000000000 -0400
28276 @@ -402,7 +402,7 @@ static int __init cpqarray_register_ctlr
28277 if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
28278 goto Enomem4;
28279 }
28280 - hba[i]->access.set_intr_mask(hba[i], 0);
28281 + hba[i]->access->set_intr_mask(hba[i], 0);
28282 if (request_irq(hba[i]->intr, do_ida_intr,
28283 IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i]))
28284 {
28285 @@ -460,7 +460,7 @@ static int __init cpqarray_register_ctlr
28286 add_timer(&hba[i]->timer);
28287
28288 /* Enable IRQ now that spinlock and rate limit timer are set up */
28289 - hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
28290 + hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
28291
28292 for(j=0; j<NWD; j++) {
28293 struct gendisk *disk = ida_gendisk[i][j];
28294 @@ -695,7 +695,7 @@ DBGINFO(
28295 for(i=0; i<NR_PRODUCTS; i++) {
28296 if (board_id == products[i].board_id) {
28297 c->product_name = products[i].product_name;
28298 - c->access = *(products[i].access);
28299 + c->access = products[i].access;
28300 break;
28301 }
28302 }
28303 @@ -793,7 +793,7 @@ static int __init cpqarray_eisa_detect(v
28304 hba[ctlr]->intr = intr;
28305 sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
28306 hba[ctlr]->product_name = products[j].product_name;
28307 - hba[ctlr]->access = *(products[j].access);
28308 + hba[ctlr]->access = products[j].access;
28309 hba[ctlr]->ctlr = ctlr;
28310 hba[ctlr]->board_id = board_id;
28311 hba[ctlr]->pci_dev = NULL; /* not PCI */
28312 @@ -896,6 +896,8 @@ static void do_ida_request(struct reques
28313 struct scatterlist tmp_sg[SG_MAX];
28314 int i, dir, seg;
28315
28316 + pax_track_stack();
28317 +
28318 if (blk_queue_plugged(q))
28319 goto startio;
28320
28321 @@ -968,7 +970,7 @@ static void start_io(ctlr_info_t *h)
28322
28323 while((c = h->reqQ) != NULL) {
28324 /* Can't do anything if we're busy */
28325 - if (h->access.fifo_full(h) == 0)
28326 + if (h->access->fifo_full(h) == 0)
28327 return;
28328
28329 /* Get the first entry from the request Q */
28330 @@ -976,7 +978,7 @@ static void start_io(ctlr_info_t *h)
28331 h->Qdepth--;
28332
28333 /* Tell the controller to do our bidding */
28334 - h->access.submit_command(h, c);
28335 + h->access->submit_command(h, c);
28336
28337 /* Get onto the completion Q */
28338 addQ(&h->cmpQ, c);
28339 @@ -1038,7 +1040,7 @@ static irqreturn_t do_ida_intr(int irq,
28340 unsigned long flags;
28341 __u32 a,a1;
28342
28343 - istat = h->access.intr_pending(h);
28344 + istat = h->access->intr_pending(h);
28345 /* Is this interrupt for us? */
28346 if (istat == 0)
28347 return IRQ_NONE;
28348 @@ -1049,7 +1051,7 @@ static irqreturn_t do_ida_intr(int irq,
28349 */
28350 spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
28351 if (istat & FIFO_NOT_EMPTY) {
28352 - while((a = h->access.command_completed(h))) {
28353 + while((a = h->access->command_completed(h))) {
28354 a1 = a; a &= ~3;
28355 if ((c = h->cmpQ) == NULL)
28356 {
28357 @@ -1434,11 +1436,11 @@ static int sendcmd(
28358 /*
28359 * Disable interrupt
28360 */
28361 - info_p->access.set_intr_mask(info_p, 0);
28362 + info_p->access->set_intr_mask(info_p, 0);
28363 /* Make sure there is room in the command FIFO */
28364 /* Actually it should be completely empty at this time. */
28365 for (i = 200000; i > 0; i--) {
28366 - temp = info_p->access.fifo_full(info_p);
28367 + temp = info_p->access->fifo_full(info_p);
28368 if (temp != 0) {
28369 break;
28370 }
28371 @@ -1451,7 +1453,7 @@ DBG(
28372 /*
28373 * Send the cmd
28374 */
28375 - info_p->access.submit_command(info_p, c);
28376 + info_p->access->submit_command(info_p, c);
28377 complete = pollcomplete(ctlr);
28378
28379 pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
28380 @@ -1534,9 +1536,9 @@ static int revalidate_allvol(ctlr_info_t
28381 * we check the new geometry. Then turn interrupts back on when
28382 * we're done.
28383 */
28384 - host->access.set_intr_mask(host, 0);
28385 + host->access->set_intr_mask(host, 0);
28386 getgeometry(ctlr);
28387 - host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
28388 + host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
28389
28390 for(i=0; i<NWD; i++) {
28391 struct gendisk *disk = ida_gendisk[ctlr][i];
28392 @@ -1576,7 +1578,7 @@ static int pollcomplete(int ctlr)
28393 /* Wait (up to 2 seconds) for a command to complete */
28394
28395 for (i = 200000; i > 0; i--) {
28396 - done = hba[ctlr]->access.command_completed(hba[ctlr]);
28397 + done = hba[ctlr]->access->command_completed(hba[ctlr]);
28398 if (done == 0) {
28399 udelay(10); /* a short fixed delay */
28400 } else
28401 diff -urNp linux-2.6.32.46/drivers/block/cpqarray.h linux-2.6.32.46/drivers/block/cpqarray.h
28402 --- linux-2.6.32.46/drivers/block/cpqarray.h 2011-03-27 14:31:47.000000000 -0400
28403 +++ linux-2.6.32.46/drivers/block/cpqarray.h 2011-08-05 20:33:55.000000000 -0400
28404 @@ -99,7 +99,7 @@ struct ctlr_info {
28405 drv_info_t drv[NWD];
28406 struct proc_dir_entry *proc;
28407
28408 - struct access_method access;
28409 + struct access_method *access;
28410
28411 cmdlist_t *reqQ;
28412 cmdlist_t *cmpQ;
28413 diff -urNp linux-2.6.32.46/drivers/block/DAC960.c linux-2.6.32.46/drivers/block/DAC960.c
28414 --- linux-2.6.32.46/drivers/block/DAC960.c 2011-03-27 14:31:47.000000000 -0400
28415 +++ linux-2.6.32.46/drivers/block/DAC960.c 2011-05-16 21:46:57.000000000 -0400
28416 @@ -1973,6 +1973,8 @@ static bool DAC960_V1_ReadDeviceConfigur
28417 unsigned long flags;
28418 int Channel, TargetID;
28419
28420 + pax_track_stack();
28421 +
28422 if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
28423 DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
28424 sizeof(DAC960_SCSI_Inquiry_T) +
28425 diff -urNp linux-2.6.32.46/drivers/block/loop.c linux-2.6.32.46/drivers/block/loop.c
28426 --- linux-2.6.32.46/drivers/block/loop.c 2011-06-25 12:55:34.000000000 -0400
28427 +++ linux-2.6.32.46/drivers/block/loop.c 2011-10-06 09:37:14.000000000 -0400
28428 @@ -282,7 +282,7 @@ static int __do_lo_send_write(struct fil
28429 mm_segment_t old_fs = get_fs();
28430
28431 set_fs(get_ds());
28432 - bw = file->f_op->write(file, buf, len, &pos);
28433 + bw = file->f_op->write(file, (const char __force_user *)buf, len, &pos);
28434 set_fs(old_fs);
28435 if (likely(bw == len))
28436 return 0;
28437 diff -urNp linux-2.6.32.46/drivers/block/nbd.c linux-2.6.32.46/drivers/block/nbd.c
28438 --- linux-2.6.32.46/drivers/block/nbd.c 2011-06-25 12:55:34.000000000 -0400
28439 +++ linux-2.6.32.46/drivers/block/nbd.c 2011-06-25 12:56:37.000000000 -0400
28440 @@ -155,6 +155,8 @@ static int sock_xmit(struct nbd_device *
28441 struct kvec iov;
28442 sigset_t blocked, oldset;
28443
28444 + pax_track_stack();
28445 +
28446 if (unlikely(!sock)) {
28447 printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
28448 lo->disk->disk_name, (send ? "send" : "recv"));
28449 @@ -569,6 +571,8 @@ static void do_nbd_request(struct reques
28450 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
28451 unsigned int cmd, unsigned long arg)
28452 {
28453 + pax_track_stack();
28454 +
28455 switch (cmd) {
28456 case NBD_DISCONNECT: {
28457 struct request sreq;
28458 diff -urNp linux-2.6.32.46/drivers/block/pktcdvd.c linux-2.6.32.46/drivers/block/pktcdvd.c
28459 --- linux-2.6.32.46/drivers/block/pktcdvd.c 2011-03-27 14:31:47.000000000 -0400
28460 +++ linux-2.6.32.46/drivers/block/pktcdvd.c 2011-04-17 15:56:46.000000000 -0400
28461 @@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kob
28462 return len;
28463 }
28464
28465 -static struct sysfs_ops kobj_pkt_ops = {
28466 +static const struct sysfs_ops kobj_pkt_ops = {
28467 .show = kobj_pkt_show,
28468 .store = kobj_pkt_store
28469 };
28470 diff -urNp linux-2.6.32.46/drivers/char/agp/frontend.c linux-2.6.32.46/drivers/char/agp/frontend.c
28471 --- linux-2.6.32.46/drivers/char/agp/frontend.c 2011-03-27 14:31:47.000000000 -0400
28472 +++ linux-2.6.32.46/drivers/char/agp/frontend.c 2011-04-17 15:56:46.000000000 -0400
28473 @@ -824,7 +824,7 @@ static int agpioc_reserve_wrap(struct ag
28474 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
28475 return -EFAULT;
28476
28477 - if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
28478 + if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
28479 return -EFAULT;
28480
28481 client = agp_find_client_by_pid(reserve.pid);
28482 diff -urNp linux-2.6.32.46/drivers/char/briq_panel.c linux-2.6.32.46/drivers/char/briq_panel.c
28483 --- linux-2.6.32.46/drivers/char/briq_panel.c 2011-03-27 14:31:47.000000000 -0400
28484 +++ linux-2.6.32.46/drivers/char/briq_panel.c 2011-04-18 19:48:57.000000000 -0400
28485 @@ -10,6 +10,7 @@
28486 #include <linux/types.h>
28487 #include <linux/errno.h>
28488 #include <linux/tty.h>
28489 +#include <linux/mutex.h>
28490 #include <linux/timer.h>
28491 #include <linux/kernel.h>
28492 #include <linux/wait.h>
28493 @@ -36,6 +37,7 @@ static int vfd_is_open;
28494 static unsigned char vfd[40];
28495 static int vfd_cursor;
28496 static unsigned char ledpb, led;
28497 +static DEFINE_MUTEX(vfd_mutex);
28498
28499 static void update_vfd(void)
28500 {
28501 @@ -142,12 +144,15 @@ static ssize_t briq_panel_write(struct f
28502 if (!vfd_is_open)
28503 return -EBUSY;
28504
28505 + mutex_lock(&vfd_mutex);
28506 for (;;) {
28507 char c;
28508 if (!indx)
28509 break;
28510 - if (get_user(c, buf))
28511 + if (get_user(c, buf)) {
28512 + mutex_unlock(&vfd_mutex);
28513 return -EFAULT;
28514 + }
28515 if (esc) {
28516 set_led(c);
28517 esc = 0;
28518 @@ -177,6 +182,7 @@ static ssize_t briq_panel_write(struct f
28519 buf++;
28520 }
28521 update_vfd();
28522 + mutex_unlock(&vfd_mutex);
28523
28524 return len;
28525 }
28526 diff -urNp linux-2.6.32.46/drivers/char/genrtc.c linux-2.6.32.46/drivers/char/genrtc.c
28527 --- linux-2.6.32.46/drivers/char/genrtc.c 2011-03-27 14:31:47.000000000 -0400
28528 +++ linux-2.6.32.46/drivers/char/genrtc.c 2011-04-18 19:45:42.000000000 -0400
28529 @@ -272,6 +272,7 @@ static int gen_rtc_ioctl(struct inode *i
28530 switch (cmd) {
28531
28532 case RTC_PLL_GET:
28533 + memset(&pll, 0, sizeof(pll));
28534 if (get_rtc_pll(&pll))
28535 return -EINVAL;
28536 else
28537 diff -urNp linux-2.6.32.46/drivers/char/hpet.c linux-2.6.32.46/drivers/char/hpet.c
28538 --- linux-2.6.32.46/drivers/char/hpet.c 2011-03-27 14:31:47.000000000 -0400
28539 +++ linux-2.6.32.46/drivers/char/hpet.c 2011-04-23 12:56:11.000000000 -0400
28540 @@ -430,7 +430,7 @@ static int hpet_release(struct inode *in
28541 return 0;
28542 }
28543
28544 -static int hpet_ioctl_common(struct hpet_dev *, int, unsigned long, int);
28545 +static int hpet_ioctl_common(struct hpet_dev *, unsigned int, unsigned long, int);
28546
28547 static int
28548 hpet_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
28549 @@ -565,7 +565,7 @@ static inline unsigned long hpet_time_di
28550 }
28551
28552 static int
28553 -hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
28554 +hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg, int kernel)
28555 {
28556 struct hpet_timer __iomem *timer;
28557 struct hpet __iomem *hpet;
28558 @@ -608,11 +608,11 @@ hpet_ioctl_common(struct hpet_dev *devp,
28559 {
28560 struct hpet_info info;
28561
28562 + memset(&info, 0, sizeof(info));
28563 +
28564 if (devp->hd_ireqfreq)
28565 info.hi_ireqfreq =
28566 hpet_time_div(hpetp, devp->hd_ireqfreq);
28567 - else
28568 - info.hi_ireqfreq = 0;
28569 info.hi_flags =
28570 readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK;
28571 info.hi_hpet = hpetp->hp_which;
28572 diff -urNp linux-2.6.32.46/drivers/char/hvc_beat.c linux-2.6.32.46/drivers/char/hvc_beat.c
28573 --- linux-2.6.32.46/drivers/char/hvc_beat.c 2011-03-27 14:31:47.000000000 -0400
28574 +++ linux-2.6.32.46/drivers/char/hvc_beat.c 2011-04-17 15:56:46.000000000 -0400
28575 @@ -84,7 +84,7 @@ static int hvc_beat_put_chars(uint32_t v
28576 return cnt;
28577 }
28578
28579 -static struct hv_ops hvc_beat_get_put_ops = {
28580 +static const struct hv_ops hvc_beat_get_put_ops = {
28581 .get_chars = hvc_beat_get_chars,
28582 .put_chars = hvc_beat_put_chars,
28583 };
28584 diff -urNp linux-2.6.32.46/drivers/char/hvc_console.c linux-2.6.32.46/drivers/char/hvc_console.c
28585 --- linux-2.6.32.46/drivers/char/hvc_console.c 2011-03-27 14:31:47.000000000 -0400
28586 +++ linux-2.6.32.46/drivers/char/hvc_console.c 2011-04-17 15:56:46.000000000 -0400
28587 @@ -125,7 +125,7 @@ static struct hvc_struct *hvc_get_by_ind
28588 * console interfaces but can still be used as a tty device. This has to be
28589 * static because kmalloc will not work during early console init.
28590 */
28591 -static struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
28592 +static const struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
28593 static uint32_t vtermnos[MAX_NR_HVC_CONSOLES] =
28594 {[0 ... MAX_NR_HVC_CONSOLES - 1] = -1};
28595
28596 @@ -247,7 +247,7 @@ static void destroy_hvc_struct(struct kr
28597 * vty adapters do NOT get an hvc_instantiate() callback since they
28598 * appear after early console init.
28599 */
28600 -int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops)
28601 +int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
28602 {
28603 struct hvc_struct *hp;
28604
28605 @@ -756,7 +756,7 @@ static const struct tty_operations hvc_o
28606 };
28607
28608 struct hvc_struct __devinit *hvc_alloc(uint32_t vtermno, int data,
28609 - struct hv_ops *ops, int outbuf_size)
28610 + const struct hv_ops *ops, int outbuf_size)
28611 {
28612 struct hvc_struct *hp;
28613 int i;
28614 diff -urNp linux-2.6.32.46/drivers/char/hvc_console.h linux-2.6.32.46/drivers/char/hvc_console.h
28615 --- linux-2.6.32.46/drivers/char/hvc_console.h 2011-03-27 14:31:47.000000000 -0400
28616 +++ linux-2.6.32.46/drivers/char/hvc_console.h 2011-04-17 15:56:46.000000000 -0400
28617 @@ -55,7 +55,7 @@ struct hvc_struct {
28618 int outbuf_size;
28619 int n_outbuf;
28620 uint32_t vtermno;
28621 - struct hv_ops *ops;
28622 + const struct hv_ops *ops;
28623 int irq_requested;
28624 int data;
28625 struct winsize ws;
28626 @@ -76,11 +76,11 @@ struct hv_ops {
28627 };
28628
28629 /* Register a vterm and a slot index for use as a console (console_init) */
28630 -extern int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops);
28631 +extern int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops);
28632
28633 /* register a vterm for hvc tty operation (module_init or hotplug add) */
28634 extern struct hvc_struct * __devinit hvc_alloc(uint32_t vtermno, int data,
28635 - struct hv_ops *ops, int outbuf_size);
28636 + const struct hv_ops *ops, int outbuf_size);
28637 /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
28638 extern int hvc_remove(struct hvc_struct *hp);
28639
28640 diff -urNp linux-2.6.32.46/drivers/char/hvc_iseries.c linux-2.6.32.46/drivers/char/hvc_iseries.c
28641 --- linux-2.6.32.46/drivers/char/hvc_iseries.c 2011-03-27 14:31:47.000000000 -0400
28642 +++ linux-2.6.32.46/drivers/char/hvc_iseries.c 2011-04-17 15:56:46.000000000 -0400
28643 @@ -197,7 +197,7 @@ done:
28644 return sent;
28645 }
28646
28647 -static struct hv_ops hvc_get_put_ops = {
28648 +static const struct hv_ops hvc_get_put_ops = {
28649 .get_chars = get_chars,
28650 .put_chars = put_chars,
28651 .notifier_add = notifier_add_irq,
28652 diff -urNp linux-2.6.32.46/drivers/char/hvc_iucv.c linux-2.6.32.46/drivers/char/hvc_iucv.c
28653 --- linux-2.6.32.46/drivers/char/hvc_iucv.c 2011-03-27 14:31:47.000000000 -0400
28654 +++ linux-2.6.32.46/drivers/char/hvc_iucv.c 2011-04-17 15:56:46.000000000 -0400
28655 @@ -924,7 +924,7 @@ static int hvc_iucv_pm_restore_thaw(stru
28656
28657
28658 /* HVC operations */
28659 -static struct hv_ops hvc_iucv_ops = {
28660 +static const struct hv_ops hvc_iucv_ops = {
28661 .get_chars = hvc_iucv_get_chars,
28662 .put_chars = hvc_iucv_put_chars,
28663 .notifier_add = hvc_iucv_notifier_add,
28664 diff -urNp linux-2.6.32.46/drivers/char/hvc_rtas.c linux-2.6.32.46/drivers/char/hvc_rtas.c
28665 --- linux-2.6.32.46/drivers/char/hvc_rtas.c 2011-03-27 14:31:47.000000000 -0400
28666 +++ linux-2.6.32.46/drivers/char/hvc_rtas.c 2011-04-17 15:56:46.000000000 -0400
28667 @@ -71,7 +71,7 @@ static int hvc_rtas_read_console(uint32_
28668 return i;
28669 }
28670
28671 -static struct hv_ops hvc_rtas_get_put_ops = {
28672 +static const struct hv_ops hvc_rtas_get_put_ops = {
28673 .get_chars = hvc_rtas_read_console,
28674 .put_chars = hvc_rtas_write_console,
28675 };
28676 diff -urNp linux-2.6.32.46/drivers/char/hvcs.c linux-2.6.32.46/drivers/char/hvcs.c
28677 --- linux-2.6.32.46/drivers/char/hvcs.c 2011-03-27 14:31:47.000000000 -0400
28678 +++ linux-2.6.32.46/drivers/char/hvcs.c 2011-04-17 15:56:46.000000000 -0400
28679 @@ -82,6 +82,7 @@
28680 #include <asm/hvcserver.h>
28681 #include <asm/uaccess.h>
28682 #include <asm/vio.h>
28683 +#include <asm/local.h>
28684
28685 /*
28686 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
28687 @@ -269,7 +270,7 @@ struct hvcs_struct {
28688 unsigned int index;
28689
28690 struct tty_struct *tty;
28691 - int open_count;
28692 + local_t open_count;
28693
28694 /*
28695 * Used to tell the driver kernel_thread what operations need to take
28696 @@ -419,7 +420,7 @@ static ssize_t hvcs_vterm_state_store(st
28697
28698 spin_lock_irqsave(&hvcsd->lock, flags);
28699
28700 - if (hvcsd->open_count > 0) {
28701 + if (local_read(&hvcsd->open_count) > 0) {
28702 spin_unlock_irqrestore(&hvcsd->lock, flags);
28703 printk(KERN_INFO "HVCS: vterm state unchanged. "
28704 "The hvcs device node is still in use.\n");
28705 @@ -1135,7 +1136,7 @@ static int hvcs_open(struct tty_struct *
28706 if ((retval = hvcs_partner_connect(hvcsd)))
28707 goto error_release;
28708
28709 - hvcsd->open_count = 1;
28710 + local_set(&hvcsd->open_count, 1);
28711 hvcsd->tty = tty;
28712 tty->driver_data = hvcsd;
28713
28714 @@ -1169,7 +1170,7 @@ fast_open:
28715
28716 spin_lock_irqsave(&hvcsd->lock, flags);
28717 kref_get(&hvcsd->kref);
28718 - hvcsd->open_count++;
28719 + local_inc(&hvcsd->open_count);
28720 hvcsd->todo_mask |= HVCS_SCHED_READ;
28721 spin_unlock_irqrestore(&hvcsd->lock, flags);
28722
28723 @@ -1213,7 +1214,7 @@ static void hvcs_close(struct tty_struct
28724 hvcsd = tty->driver_data;
28725
28726 spin_lock_irqsave(&hvcsd->lock, flags);
28727 - if (--hvcsd->open_count == 0) {
28728 + if (local_dec_and_test(&hvcsd->open_count)) {
28729
28730 vio_disable_interrupts(hvcsd->vdev);
28731
28732 @@ -1239,10 +1240,10 @@ static void hvcs_close(struct tty_struct
28733 free_irq(irq, hvcsd);
28734 kref_put(&hvcsd->kref, destroy_hvcs_struct);
28735 return;
28736 - } else if (hvcsd->open_count < 0) {
28737 + } else if (local_read(&hvcsd->open_count) < 0) {
28738 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
28739 " is missmanaged.\n",
28740 - hvcsd->vdev->unit_address, hvcsd->open_count);
28741 + hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
28742 }
28743
28744 spin_unlock_irqrestore(&hvcsd->lock, flags);
28745 @@ -1258,7 +1259,7 @@ static void hvcs_hangup(struct tty_struc
28746
28747 spin_lock_irqsave(&hvcsd->lock, flags);
28748 /* Preserve this so that we know how many kref refs to put */
28749 - temp_open_count = hvcsd->open_count;
28750 + temp_open_count = local_read(&hvcsd->open_count);
28751
28752 /*
28753 * Don't kref put inside the spinlock because the destruction
28754 @@ -1273,7 +1274,7 @@ static void hvcs_hangup(struct tty_struc
28755 hvcsd->tty->driver_data = NULL;
28756 hvcsd->tty = NULL;
28757
28758 - hvcsd->open_count = 0;
28759 + local_set(&hvcsd->open_count, 0);
28760
28761 /* This will drop any buffered data on the floor which is OK in a hangup
28762 * scenario. */
28763 @@ -1344,7 +1345,7 @@ static int hvcs_write(struct tty_struct
28764 * the middle of a write operation? This is a crummy place to do this
28765 * but we want to keep it all in the spinlock.
28766 */
28767 - if (hvcsd->open_count <= 0) {
28768 + if (local_read(&hvcsd->open_count) <= 0) {
28769 spin_unlock_irqrestore(&hvcsd->lock, flags);
28770 return -ENODEV;
28771 }
28772 @@ -1418,7 +1419,7 @@ static int hvcs_write_room(struct tty_st
28773 {
28774 struct hvcs_struct *hvcsd = tty->driver_data;
28775
28776 - if (!hvcsd || hvcsd->open_count <= 0)
28777 + if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
28778 return 0;
28779
28780 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
28781 diff -urNp linux-2.6.32.46/drivers/char/hvc_udbg.c linux-2.6.32.46/drivers/char/hvc_udbg.c
28782 --- linux-2.6.32.46/drivers/char/hvc_udbg.c 2011-03-27 14:31:47.000000000 -0400
28783 +++ linux-2.6.32.46/drivers/char/hvc_udbg.c 2011-04-17 15:56:46.000000000 -0400
28784 @@ -58,7 +58,7 @@ static int hvc_udbg_get(uint32_t vtermno
28785 return i;
28786 }
28787
28788 -static struct hv_ops hvc_udbg_ops = {
28789 +static const struct hv_ops hvc_udbg_ops = {
28790 .get_chars = hvc_udbg_get,
28791 .put_chars = hvc_udbg_put,
28792 };
28793 diff -urNp linux-2.6.32.46/drivers/char/hvc_vio.c linux-2.6.32.46/drivers/char/hvc_vio.c
28794 --- linux-2.6.32.46/drivers/char/hvc_vio.c 2011-03-27 14:31:47.000000000 -0400
28795 +++ linux-2.6.32.46/drivers/char/hvc_vio.c 2011-04-17 15:56:46.000000000 -0400
28796 @@ -77,7 +77,7 @@ static int filtered_get_chars(uint32_t v
28797 return got;
28798 }
28799
28800 -static struct hv_ops hvc_get_put_ops = {
28801 +static const struct hv_ops hvc_get_put_ops = {
28802 .get_chars = filtered_get_chars,
28803 .put_chars = hvc_put_chars,
28804 .notifier_add = notifier_add_irq,
28805 diff -urNp linux-2.6.32.46/drivers/char/hvc_xen.c linux-2.6.32.46/drivers/char/hvc_xen.c
28806 --- linux-2.6.32.46/drivers/char/hvc_xen.c 2011-03-27 14:31:47.000000000 -0400
28807 +++ linux-2.6.32.46/drivers/char/hvc_xen.c 2011-04-17 15:56:46.000000000 -0400
28808 @@ -120,7 +120,7 @@ static int read_console(uint32_t vtermno
28809 return recv;
28810 }
28811
28812 -static struct hv_ops hvc_ops = {
28813 +static const struct hv_ops hvc_ops = {
28814 .get_chars = read_console,
28815 .put_chars = write_console,
28816 .notifier_add = notifier_add_irq,
28817 diff -urNp linux-2.6.32.46/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.32.46/drivers/char/ipmi/ipmi_msghandler.c
28818 --- linux-2.6.32.46/drivers/char/ipmi/ipmi_msghandler.c 2011-03-27 14:31:47.000000000 -0400
28819 +++ linux-2.6.32.46/drivers/char/ipmi/ipmi_msghandler.c 2011-05-16 21:46:57.000000000 -0400
28820 @@ -414,7 +414,7 @@ struct ipmi_smi {
28821 struct proc_dir_entry *proc_dir;
28822 char proc_dir_name[10];
28823
28824 - atomic_t stats[IPMI_NUM_STATS];
28825 + atomic_unchecked_t stats[IPMI_NUM_STATS];
28826
28827 /*
28828 * run_to_completion duplicate of smb_info, smi_info
28829 @@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
28830
28831
28832 #define ipmi_inc_stat(intf, stat) \
28833 - atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
28834 + atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
28835 #define ipmi_get_stat(intf, stat) \
28836 - ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
28837 + ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
28838
28839 static int is_lan_addr(struct ipmi_addr *addr)
28840 {
28841 @@ -2808,7 +2808,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
28842 INIT_LIST_HEAD(&intf->cmd_rcvrs);
28843 init_waitqueue_head(&intf->waitq);
28844 for (i = 0; i < IPMI_NUM_STATS; i++)
28845 - atomic_set(&intf->stats[i], 0);
28846 + atomic_set_unchecked(&intf->stats[i], 0);
28847
28848 intf->proc_dir = NULL;
28849
28850 @@ -4160,6 +4160,8 @@ static void send_panic_events(char *str)
28851 struct ipmi_smi_msg smi_msg;
28852 struct ipmi_recv_msg recv_msg;
28853
28854 + pax_track_stack();
28855 +
28856 si = (struct ipmi_system_interface_addr *) &addr;
28857 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
28858 si->channel = IPMI_BMC_CHANNEL;
28859 diff -urNp linux-2.6.32.46/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.32.46/drivers/char/ipmi/ipmi_si_intf.c
28860 --- linux-2.6.32.46/drivers/char/ipmi/ipmi_si_intf.c 2011-03-27 14:31:47.000000000 -0400
28861 +++ linux-2.6.32.46/drivers/char/ipmi/ipmi_si_intf.c 2011-04-17 15:56:46.000000000 -0400
28862 @@ -277,7 +277,7 @@ struct smi_info {
28863 unsigned char slave_addr;
28864
28865 /* Counters and things for the proc filesystem. */
28866 - atomic_t stats[SI_NUM_STATS];
28867 + atomic_unchecked_t stats[SI_NUM_STATS];
28868
28869 struct task_struct *thread;
28870
28871 @@ -285,9 +285,9 @@ struct smi_info {
28872 };
28873
28874 #define smi_inc_stat(smi, stat) \
28875 - atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
28876 + atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
28877 #define smi_get_stat(smi, stat) \
28878 - ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
28879 + ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
28880
28881 #define SI_MAX_PARMS 4
28882
28883 @@ -2931,7 +2931,7 @@ static int try_smi_init(struct smi_info
28884 atomic_set(&new_smi->req_events, 0);
28885 new_smi->run_to_completion = 0;
28886 for (i = 0; i < SI_NUM_STATS; i++)
28887 - atomic_set(&new_smi->stats[i], 0);
28888 + atomic_set_unchecked(&new_smi->stats[i], 0);
28889
28890 new_smi->interrupt_disabled = 0;
28891 atomic_set(&new_smi->stop_operation, 0);
28892 diff -urNp linux-2.6.32.46/drivers/char/istallion.c linux-2.6.32.46/drivers/char/istallion.c
28893 --- linux-2.6.32.46/drivers/char/istallion.c 2011-03-27 14:31:47.000000000 -0400
28894 +++ linux-2.6.32.46/drivers/char/istallion.c 2011-05-16 21:46:57.000000000 -0400
28895 @@ -187,7 +187,6 @@ static struct ktermios stli_deftermios
28896 * re-used for each stats call.
28897 */
28898 static comstats_t stli_comstats;
28899 -static combrd_t stli_brdstats;
28900 static struct asystats stli_cdkstats;
28901
28902 /*****************************************************************************/
28903 @@ -4058,6 +4057,7 @@ static int stli_getbrdstats(combrd_t __u
28904 {
28905 struct stlibrd *brdp;
28906 unsigned int i;
28907 + combrd_t stli_brdstats;
28908
28909 if (copy_from_user(&stli_brdstats, bp, sizeof(combrd_t)))
28910 return -EFAULT;
28911 @@ -4269,6 +4269,8 @@ static int stli_getportstruct(struct stl
28912 struct stliport stli_dummyport;
28913 struct stliport *portp;
28914
28915 + pax_track_stack();
28916 +
28917 if (copy_from_user(&stli_dummyport, arg, sizeof(struct stliport)))
28918 return -EFAULT;
28919 portp = stli_getport(stli_dummyport.brdnr, stli_dummyport.panelnr,
28920 @@ -4291,6 +4293,8 @@ static int stli_getbrdstruct(struct stli
28921 struct stlibrd stli_dummybrd;
28922 struct stlibrd *brdp;
28923
28924 + pax_track_stack();
28925 +
28926 if (copy_from_user(&stli_dummybrd, arg, sizeof(struct stlibrd)))
28927 return -EFAULT;
28928 if (stli_dummybrd.brdnr >= STL_MAXBRDS)
28929 diff -urNp linux-2.6.32.46/drivers/char/Kconfig linux-2.6.32.46/drivers/char/Kconfig
28930 --- linux-2.6.32.46/drivers/char/Kconfig 2011-03-27 14:31:47.000000000 -0400
28931 +++ linux-2.6.32.46/drivers/char/Kconfig 2011-04-18 19:20:15.000000000 -0400
28932 @@ -90,7 +90,8 @@ config VT_HW_CONSOLE_BINDING
28933
28934 config DEVKMEM
28935 bool "/dev/kmem virtual device support"
28936 - default y
28937 + default n
28938 + depends on !GRKERNSEC_KMEM
28939 help
28940 Say Y here if you want to support the /dev/kmem device. The
28941 /dev/kmem device is rarely used, but can be used for certain
28942 @@ -1114,6 +1115,7 @@ config DEVPORT
28943 bool
28944 depends on !M68K
28945 depends on ISA || PCI
28946 + depends on !GRKERNSEC_KMEM
28947 default y
28948
28949 source "drivers/s390/char/Kconfig"
28950 diff -urNp linux-2.6.32.46/drivers/char/keyboard.c linux-2.6.32.46/drivers/char/keyboard.c
28951 --- linux-2.6.32.46/drivers/char/keyboard.c 2011-03-27 14:31:47.000000000 -0400
28952 +++ linux-2.6.32.46/drivers/char/keyboard.c 2011-04-17 15:56:46.000000000 -0400
28953 @@ -635,6 +635,16 @@ static void k_spec(struct vc_data *vc, u
28954 kbd->kbdmode == VC_MEDIUMRAW) &&
28955 value != KVAL(K_SAK))
28956 return; /* SAK is allowed even in raw mode */
28957 +
28958 +#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
28959 + {
28960 + void *func = fn_handler[value];
28961 + if (func == fn_show_state || func == fn_show_ptregs ||
28962 + func == fn_show_mem)
28963 + return;
28964 + }
28965 +#endif
28966 +
28967 fn_handler[value](vc);
28968 }
28969
28970 @@ -1386,7 +1396,7 @@ static const struct input_device_id kbd_
28971 .evbit = { BIT_MASK(EV_SND) },
28972 },
28973
28974 - { }, /* Terminating entry */
28975 + { 0 }, /* Terminating entry */
28976 };
28977
28978 MODULE_DEVICE_TABLE(input, kbd_ids);
28979 diff -urNp linux-2.6.32.46/drivers/char/mem.c linux-2.6.32.46/drivers/char/mem.c
28980 --- linux-2.6.32.46/drivers/char/mem.c 2011-03-27 14:31:47.000000000 -0400
28981 +++ linux-2.6.32.46/drivers/char/mem.c 2011-04-17 15:56:46.000000000 -0400
28982 @@ -18,6 +18,7 @@
28983 #include <linux/raw.h>
28984 #include <linux/tty.h>
28985 #include <linux/capability.h>
28986 +#include <linux/security.h>
28987 #include <linux/ptrace.h>
28988 #include <linux/device.h>
28989 #include <linux/highmem.h>
28990 @@ -35,6 +36,10 @@
28991 # include <linux/efi.h>
28992 #endif
28993
28994 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
28995 +extern struct file_operations grsec_fops;
28996 +#endif
28997 +
28998 static inline unsigned long size_inside_page(unsigned long start,
28999 unsigned long size)
29000 {
29001 @@ -102,9 +107,13 @@ static inline int range_is_allowed(unsig
29002
29003 while (cursor < to) {
29004 if (!devmem_is_allowed(pfn)) {
29005 +#ifdef CONFIG_GRKERNSEC_KMEM
29006 + gr_handle_mem_readwrite(from, to);
29007 +#else
29008 printk(KERN_INFO
29009 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
29010 current->comm, from, to);
29011 +#endif
29012 return 0;
29013 }
29014 cursor += PAGE_SIZE;
29015 @@ -112,6 +121,11 @@ static inline int range_is_allowed(unsig
29016 }
29017 return 1;
29018 }
29019 +#elif defined(CONFIG_GRKERNSEC_KMEM)
29020 +static inline int range_is_allowed(unsigned long pfn, unsigned long size)
29021 +{
29022 + return 0;
29023 +}
29024 #else
29025 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
29026 {
29027 @@ -155,6 +169,8 @@ static ssize_t read_mem(struct file * fi
29028 #endif
29029
29030 while (count > 0) {
29031 + char *temp;
29032 +
29033 /*
29034 * Handle first page in case it's not aligned
29035 */
29036 @@ -177,11 +193,31 @@ static ssize_t read_mem(struct file * fi
29037 if (!ptr)
29038 return -EFAULT;
29039
29040 - if (copy_to_user(buf, ptr, sz)) {
29041 +#ifdef CONFIG_PAX_USERCOPY
29042 + temp = kmalloc(sz, GFP_KERNEL);
29043 + if (!temp) {
29044 + unxlate_dev_mem_ptr(p, ptr);
29045 + return -ENOMEM;
29046 + }
29047 + memcpy(temp, ptr, sz);
29048 +#else
29049 + temp = ptr;
29050 +#endif
29051 +
29052 + if (copy_to_user(buf, temp, sz)) {
29053 +
29054 +#ifdef CONFIG_PAX_USERCOPY
29055 + kfree(temp);
29056 +#endif
29057 +
29058 unxlate_dev_mem_ptr(p, ptr);
29059 return -EFAULT;
29060 }
29061
29062 +#ifdef CONFIG_PAX_USERCOPY
29063 + kfree(temp);
29064 +#endif
29065 +
29066 unxlate_dev_mem_ptr(p, ptr);
29067
29068 buf += sz;
29069 @@ -419,9 +455,8 @@ static ssize_t read_kmem(struct file *fi
29070 size_t count, loff_t *ppos)
29071 {
29072 unsigned long p = *ppos;
29073 - ssize_t low_count, read, sz;
29074 + ssize_t low_count, read, sz, err = 0;
29075 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
29076 - int err = 0;
29077
29078 read = 0;
29079 if (p < (unsigned long) high_memory) {
29080 @@ -444,6 +479,8 @@ static ssize_t read_kmem(struct file *fi
29081 }
29082 #endif
29083 while (low_count > 0) {
29084 + char *temp;
29085 +
29086 sz = size_inside_page(p, low_count);
29087
29088 /*
29089 @@ -453,7 +490,22 @@ static ssize_t read_kmem(struct file *fi
29090 */
29091 kbuf = xlate_dev_kmem_ptr((char *)p);
29092
29093 - if (copy_to_user(buf, kbuf, sz))
29094 +#ifdef CONFIG_PAX_USERCOPY
29095 + temp = kmalloc(sz, GFP_KERNEL);
29096 + if (!temp)
29097 + return -ENOMEM;
29098 + memcpy(temp, kbuf, sz);
29099 +#else
29100 + temp = kbuf;
29101 +#endif
29102 +
29103 + err = copy_to_user(buf, temp, sz);
29104 +
29105 +#ifdef CONFIG_PAX_USERCOPY
29106 + kfree(temp);
29107 +#endif
29108 +
29109 + if (err)
29110 return -EFAULT;
29111 buf += sz;
29112 p += sz;
29113 @@ -889,6 +941,9 @@ static const struct memdev {
29114 #ifdef CONFIG_CRASH_DUMP
29115 [12] = { "oldmem", 0, &oldmem_fops, NULL },
29116 #endif
29117 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
29118 + [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
29119 +#endif
29120 };
29121
29122 static int memory_open(struct inode *inode, struct file *filp)
29123 diff -urNp linux-2.6.32.46/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.46/drivers/char/pcmcia/ipwireless/tty.c
29124 --- linux-2.6.32.46/drivers/char/pcmcia/ipwireless/tty.c 2011-03-27 14:31:47.000000000 -0400
29125 +++ linux-2.6.32.46/drivers/char/pcmcia/ipwireless/tty.c 2011-04-17 15:56:46.000000000 -0400
29126 @@ -29,6 +29,7 @@
29127 #include <linux/tty_driver.h>
29128 #include <linux/tty_flip.h>
29129 #include <linux/uaccess.h>
29130 +#include <asm/local.h>
29131
29132 #include "tty.h"
29133 #include "network.h"
29134 @@ -51,7 +52,7 @@ struct ipw_tty {
29135 int tty_type;
29136 struct ipw_network *network;
29137 struct tty_struct *linux_tty;
29138 - int open_count;
29139 + local_t open_count;
29140 unsigned int control_lines;
29141 struct mutex ipw_tty_mutex;
29142 int tx_bytes_queued;
29143 @@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *l
29144 mutex_unlock(&tty->ipw_tty_mutex);
29145 return -ENODEV;
29146 }
29147 - if (tty->open_count == 0)
29148 + if (local_read(&tty->open_count) == 0)
29149 tty->tx_bytes_queued = 0;
29150
29151 - tty->open_count++;
29152 + local_inc(&tty->open_count);
29153
29154 tty->linux_tty = linux_tty;
29155 linux_tty->driver_data = tty;
29156 @@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *l
29157
29158 static void do_ipw_close(struct ipw_tty *tty)
29159 {
29160 - tty->open_count--;
29161 -
29162 - if (tty->open_count == 0) {
29163 + if (local_dec_return(&tty->open_count) == 0) {
29164 struct tty_struct *linux_tty = tty->linux_tty;
29165
29166 if (linux_tty != NULL) {
29167 @@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct
29168 return;
29169
29170 mutex_lock(&tty->ipw_tty_mutex);
29171 - if (tty->open_count == 0) {
29172 + if (local_read(&tty->open_count) == 0) {
29173 mutex_unlock(&tty->ipw_tty_mutex);
29174 return;
29175 }
29176 @@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_
29177 return;
29178 }
29179
29180 - if (!tty->open_count) {
29181 + if (!local_read(&tty->open_count)) {
29182 mutex_unlock(&tty->ipw_tty_mutex);
29183 return;
29184 }
29185 @@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *
29186 return -ENODEV;
29187
29188 mutex_lock(&tty->ipw_tty_mutex);
29189 - if (!tty->open_count) {
29190 + if (!local_read(&tty->open_count)) {
29191 mutex_unlock(&tty->ipw_tty_mutex);
29192 return -EINVAL;
29193 }
29194 @@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_str
29195 if (!tty)
29196 return -ENODEV;
29197
29198 - if (!tty->open_count)
29199 + if (!local_read(&tty->open_count))
29200 return -EINVAL;
29201
29202 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
29203 @@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tt
29204 if (!tty)
29205 return 0;
29206
29207 - if (!tty->open_count)
29208 + if (!local_read(&tty->open_count))
29209 return 0;
29210
29211 return tty->tx_bytes_queued;
29212 @@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struc
29213 if (!tty)
29214 return -ENODEV;
29215
29216 - if (!tty->open_count)
29217 + if (!local_read(&tty->open_count))
29218 return -EINVAL;
29219
29220 return get_control_lines(tty);
29221 @@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
29222 if (!tty)
29223 return -ENODEV;
29224
29225 - if (!tty->open_count)
29226 + if (!local_read(&tty->open_count))
29227 return -EINVAL;
29228
29229 return set_control_lines(tty, set, clear);
29230 @@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *
29231 if (!tty)
29232 return -ENODEV;
29233
29234 - if (!tty->open_count)
29235 + if (!local_read(&tty->open_count))
29236 return -EINVAL;
29237
29238 /* FIXME: Exactly how is the tty object locked here .. */
29239 @@ -591,7 +590,7 @@ void ipwireless_tty_free(struct ipw_tty
29240 against a parallel ioctl etc */
29241 mutex_lock(&ttyj->ipw_tty_mutex);
29242 }
29243 - while (ttyj->open_count)
29244 + while (local_read(&ttyj->open_count))
29245 do_ipw_close(ttyj);
29246 ipwireless_disassociate_network_ttys(network,
29247 ttyj->channel_idx);
29248 diff -urNp linux-2.6.32.46/drivers/char/pty.c linux-2.6.32.46/drivers/char/pty.c
29249 --- linux-2.6.32.46/drivers/char/pty.c 2011-03-27 14:31:47.000000000 -0400
29250 +++ linux-2.6.32.46/drivers/char/pty.c 2011-08-05 20:33:55.000000000 -0400
29251 @@ -736,8 +736,10 @@ static void __init unix98_pty_init(void)
29252 register_sysctl_table(pty_root_table);
29253
29254 /* Now create the /dev/ptmx special device */
29255 + pax_open_kernel();
29256 tty_default_fops(&ptmx_fops);
29257 - ptmx_fops.open = ptmx_open;
29258 + *(void **)&ptmx_fops.open = ptmx_open;
29259 + pax_close_kernel();
29260
29261 cdev_init(&ptmx_cdev, &ptmx_fops);
29262 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
29263 diff -urNp linux-2.6.32.46/drivers/char/random.c linux-2.6.32.46/drivers/char/random.c
29264 --- linux-2.6.32.46/drivers/char/random.c 2011-08-16 20:37:25.000000000 -0400
29265 +++ linux-2.6.32.46/drivers/char/random.c 2011-08-16 20:43:23.000000000 -0400
29266 @@ -254,8 +254,13 @@
29267 /*
29268 * Configuration information
29269 */
29270 +#ifdef CONFIG_GRKERNSEC_RANDNET
29271 +#define INPUT_POOL_WORDS 512
29272 +#define OUTPUT_POOL_WORDS 128
29273 +#else
29274 #define INPUT_POOL_WORDS 128
29275 #define OUTPUT_POOL_WORDS 32
29276 +#endif
29277 #define SEC_XFER_SIZE 512
29278
29279 /*
29280 @@ -292,10 +297,17 @@ static struct poolinfo {
29281 int poolwords;
29282 int tap1, tap2, tap3, tap4, tap5;
29283 } poolinfo_table[] = {
29284 +#ifdef CONFIG_GRKERNSEC_RANDNET
29285 + /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
29286 + { 512, 411, 308, 208, 104, 1 },
29287 + /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
29288 + { 128, 103, 76, 51, 25, 1 },
29289 +#else
29290 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
29291 { 128, 103, 76, 51, 25, 1 },
29292 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
29293 { 32, 26, 20, 14, 7, 1 },
29294 +#endif
29295 #if 0
29296 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
29297 { 2048, 1638, 1231, 819, 411, 1 },
29298 @@ -1209,7 +1221,7 @@ EXPORT_SYMBOL(generate_random_uuid);
29299 #include <linux/sysctl.h>
29300
29301 static int min_read_thresh = 8, min_write_thresh;
29302 -static int max_read_thresh = INPUT_POOL_WORDS * 32;
29303 +static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
29304 static int max_write_thresh = INPUT_POOL_WORDS * 32;
29305 static char sysctl_bootid[16];
29306
29307 diff -urNp linux-2.6.32.46/drivers/char/rocket.c linux-2.6.32.46/drivers/char/rocket.c
29308 --- linux-2.6.32.46/drivers/char/rocket.c 2011-03-27 14:31:47.000000000 -0400
29309 +++ linux-2.6.32.46/drivers/char/rocket.c 2011-05-16 21:46:57.000000000 -0400
29310 @@ -1266,6 +1266,8 @@ static int get_ports(struct r_port *info
29311 struct rocket_ports tmp;
29312 int board;
29313
29314 + pax_track_stack();
29315 +
29316 if (!retports)
29317 return -EFAULT;
29318 memset(&tmp, 0, sizeof (tmp));
29319 diff -urNp linux-2.6.32.46/drivers/char/sonypi.c linux-2.6.32.46/drivers/char/sonypi.c
29320 --- linux-2.6.32.46/drivers/char/sonypi.c 2011-03-27 14:31:47.000000000 -0400
29321 +++ linux-2.6.32.46/drivers/char/sonypi.c 2011-04-17 15:56:46.000000000 -0400
29322 @@ -55,6 +55,7 @@
29323 #include <asm/uaccess.h>
29324 #include <asm/io.h>
29325 #include <asm/system.h>
29326 +#include <asm/local.h>
29327
29328 #include <linux/sonypi.h>
29329
29330 @@ -491,7 +492,7 @@ static struct sonypi_device {
29331 spinlock_t fifo_lock;
29332 wait_queue_head_t fifo_proc_list;
29333 struct fasync_struct *fifo_async;
29334 - int open_count;
29335 + local_t open_count;
29336 int model;
29337 struct input_dev *input_jog_dev;
29338 struct input_dev *input_key_dev;
29339 @@ -895,7 +896,7 @@ static int sonypi_misc_fasync(int fd, st
29340 static int sonypi_misc_release(struct inode *inode, struct file *file)
29341 {
29342 mutex_lock(&sonypi_device.lock);
29343 - sonypi_device.open_count--;
29344 + local_dec(&sonypi_device.open_count);
29345 mutex_unlock(&sonypi_device.lock);
29346 return 0;
29347 }
29348 @@ -905,9 +906,9 @@ static int sonypi_misc_open(struct inode
29349 lock_kernel();
29350 mutex_lock(&sonypi_device.lock);
29351 /* Flush input queue on first open */
29352 - if (!sonypi_device.open_count)
29353 + if (!local_read(&sonypi_device.open_count))
29354 kfifo_reset(sonypi_device.fifo);
29355 - sonypi_device.open_count++;
29356 + local_inc(&sonypi_device.open_count);
29357 mutex_unlock(&sonypi_device.lock);
29358 unlock_kernel();
29359 return 0;
29360 diff -urNp linux-2.6.32.46/drivers/char/stallion.c linux-2.6.32.46/drivers/char/stallion.c
29361 --- linux-2.6.32.46/drivers/char/stallion.c 2011-03-27 14:31:47.000000000 -0400
29362 +++ linux-2.6.32.46/drivers/char/stallion.c 2011-05-16 21:46:57.000000000 -0400
29363 @@ -2448,6 +2448,8 @@ static int stl_getportstruct(struct stlp
29364 struct stlport stl_dummyport;
29365 struct stlport *portp;
29366
29367 + pax_track_stack();
29368 +
29369 if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
29370 return -EFAULT;
29371 portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
29372 diff -urNp linux-2.6.32.46/drivers/char/tpm/tpm_bios.c linux-2.6.32.46/drivers/char/tpm/tpm_bios.c
29373 --- linux-2.6.32.46/drivers/char/tpm/tpm_bios.c 2011-03-27 14:31:47.000000000 -0400
29374 +++ linux-2.6.32.46/drivers/char/tpm/tpm_bios.c 2011-10-06 09:37:08.000000000 -0400
29375 @@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start
29376 event = addr;
29377
29378 if ((event->event_type == 0 && event->event_size == 0) ||
29379 - ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
29380 + (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
29381 return NULL;
29382
29383 return addr;
29384 @@ -197,7 +197,7 @@ static void *tpm_bios_measurements_next(
29385 return NULL;
29386
29387 if ((event->event_type == 0 && event->event_size == 0) ||
29388 - ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
29389 + (event->event_size >= limit - v - sizeof(struct tcpa_event)))
29390 return NULL;
29391
29392 (*pos)++;
29393 @@ -290,7 +290,8 @@ static int tpm_binary_bios_measurements_
29394 int i;
29395
29396 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
29397 - seq_putc(m, data[i]);
29398 + if (!seq_putc(m, data[i]))
29399 + return -EFAULT;
29400
29401 return 0;
29402 }
29403 @@ -409,8 +410,13 @@ static int read_log(struct tpm_bios_log
29404 log->bios_event_log_end = log->bios_event_log + len;
29405
29406 virt = acpi_os_map_memory(start, len);
29407 + if (!virt) {
29408 + kfree(log->bios_event_log);
29409 + log->bios_event_log = NULL;
29410 + return -EFAULT;
29411 + }
29412
29413 - memcpy(log->bios_event_log, virt, len);
29414 + memcpy(log->bios_event_log, (const char __force_kernel *)virt, len);
29415
29416 acpi_os_unmap_memory(virt, len);
29417 return 0;
29418 diff -urNp linux-2.6.32.46/drivers/char/tpm/tpm.c linux-2.6.32.46/drivers/char/tpm/tpm.c
29419 --- linux-2.6.32.46/drivers/char/tpm/tpm.c 2011-04-17 17:00:52.000000000 -0400
29420 +++ linux-2.6.32.46/drivers/char/tpm/tpm.c 2011-10-17 02:49:00.000000000 -0400
29421 @@ -374,6 +374,9 @@ static ssize_t tpm_transmit(struct tpm_c
29422 u32 count, ordinal;
29423 unsigned long stop;
29424
29425 + if (bufsiz > TPM_BUFSIZE)
29426 + bufsiz = TPM_BUFSIZE;
29427 +
29428 count = be32_to_cpu(*((__be32 *) (buf + 2)));
29429 ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
29430 if (count == 0)
29431 @@ -402,7 +405,7 @@ static ssize_t tpm_transmit(struct tpm_c
29432 chip->vendor.req_complete_val)
29433 goto out_recv;
29434
29435 - if ((status == chip->vendor.req_canceled)) {
29436 + if (status == chip->vendor.req_canceled) {
29437 dev_err(chip->dev, "Operation Canceled\n");
29438 rc = -ECANCELED;
29439 goto out;
29440 @@ -821,6 +824,8 @@ ssize_t tpm_show_pubek(struct device *de
29441
29442 struct tpm_chip *chip = dev_get_drvdata(dev);
29443
29444 + pax_track_stack();
29445 +
29446 tpm_cmd.header.in = tpm_readpubek_header;
29447 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
29448 "attempting to read the PUBEK");
29449 @@ -1041,6 +1046,7 @@ ssize_t tpm_read(struct file *file, char
29450 {
29451 struct tpm_chip *chip = file->private_data;
29452 ssize_t ret_size;
29453 + int rc;
29454
29455 del_singleshot_timer_sync(&chip->user_read_timer);
29456 flush_scheduled_work();
29457 @@ -1051,8 +1057,11 @@ ssize_t tpm_read(struct file *file, char
29458 ret_size = size;
29459
29460 mutex_lock(&chip->buffer_mutex);
29461 - if (copy_to_user(buf, chip->data_buffer, ret_size))
29462 + rc = copy_to_user(buf, chip->data_buffer, ret_size);
29463 + memset(chip->data_buffer, 0, ret_size);
29464 + if (rc)
29465 ret_size = -EFAULT;
29466 +
29467 mutex_unlock(&chip->buffer_mutex);
29468 }
29469
29470 diff -urNp linux-2.6.32.46/drivers/char/tty_io.c linux-2.6.32.46/drivers/char/tty_io.c
29471 --- linux-2.6.32.46/drivers/char/tty_io.c 2011-03-27 14:31:47.000000000 -0400
29472 +++ linux-2.6.32.46/drivers/char/tty_io.c 2011-08-05 20:33:55.000000000 -0400
29473 @@ -2582,8 +2582,10 @@ long tty_ioctl(struct file *file, unsign
29474 return retval;
29475 }
29476
29477 +EXPORT_SYMBOL(tty_ioctl);
29478 +
29479 #ifdef CONFIG_COMPAT
29480 -static long tty_compat_ioctl(struct file *file, unsigned int cmd,
29481 +long tty_compat_ioctl(struct file *file, unsigned int cmd,
29482 unsigned long arg)
29483 {
29484 struct inode *inode = file->f_dentry->d_inode;
29485 @@ -2607,6 +2609,8 @@ static long tty_compat_ioctl(struct file
29486
29487 return retval;
29488 }
29489 +
29490 +EXPORT_SYMBOL(tty_compat_ioctl);
29491 #endif
29492
29493 /*
29494 @@ -3052,7 +3056,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
29495
29496 void tty_default_fops(struct file_operations *fops)
29497 {
29498 - *fops = tty_fops;
29499 + memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
29500 }
29501
29502 /*
29503 diff -urNp linux-2.6.32.46/drivers/char/tty_ldisc.c linux-2.6.32.46/drivers/char/tty_ldisc.c
29504 --- linux-2.6.32.46/drivers/char/tty_ldisc.c 2011-07-13 17:23:04.000000000 -0400
29505 +++ linux-2.6.32.46/drivers/char/tty_ldisc.c 2011-07-13 17:23:18.000000000 -0400
29506 @@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *
29507 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
29508 struct tty_ldisc_ops *ldo = ld->ops;
29509
29510 - ldo->refcount--;
29511 + atomic_dec(&ldo->refcount);
29512 module_put(ldo->owner);
29513 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
29514
29515 @@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct
29516 spin_lock_irqsave(&tty_ldisc_lock, flags);
29517 tty_ldiscs[disc] = new_ldisc;
29518 new_ldisc->num = disc;
29519 - new_ldisc->refcount = 0;
29520 + atomic_set(&new_ldisc->refcount, 0);
29521 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
29522
29523 return ret;
29524 @@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
29525 return -EINVAL;
29526
29527 spin_lock_irqsave(&tty_ldisc_lock, flags);
29528 - if (tty_ldiscs[disc]->refcount)
29529 + if (atomic_read(&tty_ldiscs[disc]->refcount))
29530 ret = -EBUSY;
29531 else
29532 tty_ldiscs[disc] = NULL;
29533 @@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(i
29534 if (ldops) {
29535 ret = ERR_PTR(-EAGAIN);
29536 if (try_module_get(ldops->owner)) {
29537 - ldops->refcount++;
29538 + atomic_inc(&ldops->refcount);
29539 ret = ldops;
29540 }
29541 }
29542 @@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_o
29543 unsigned long flags;
29544
29545 spin_lock_irqsave(&tty_ldisc_lock, flags);
29546 - ldops->refcount--;
29547 + atomic_dec(&ldops->refcount);
29548 module_put(ldops->owner);
29549 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
29550 }
29551 diff -urNp linux-2.6.32.46/drivers/char/virtio_console.c linux-2.6.32.46/drivers/char/virtio_console.c
29552 --- linux-2.6.32.46/drivers/char/virtio_console.c 2011-03-27 14:31:47.000000000 -0400
29553 +++ linux-2.6.32.46/drivers/char/virtio_console.c 2011-08-05 20:33:55.000000000 -0400
29554 @@ -133,7 +133,9 @@ static int get_chars(u32 vtermno, char *
29555 * virtqueue, so we let the drivers do some boutique early-output thing. */
29556 int __init virtio_cons_early_init(int (*put_chars)(u32, const char *, int))
29557 {
29558 - virtio_cons.put_chars = put_chars;
29559 + pax_open_kernel();
29560 + *(void **)&virtio_cons.put_chars = put_chars;
29561 + pax_close_kernel();
29562 return hvc_instantiate(0, 0, &virtio_cons);
29563 }
29564
29565 @@ -213,11 +215,13 @@ static int __devinit virtcons_probe(stru
29566 out_vq = vqs[1];
29567
29568 /* Start using the new console output. */
29569 - virtio_cons.get_chars = get_chars;
29570 - virtio_cons.put_chars = put_chars;
29571 - virtio_cons.notifier_add = notifier_add_vio;
29572 - virtio_cons.notifier_del = notifier_del_vio;
29573 - virtio_cons.notifier_hangup = notifier_del_vio;
29574 + pax_open_kernel();
29575 + *(void **)&virtio_cons.get_chars = get_chars;
29576 + *(void **)&virtio_cons.put_chars = put_chars;
29577 + *(void **)&virtio_cons.notifier_add = notifier_add_vio;
29578 + *(void **)&virtio_cons.notifier_del = notifier_del_vio;
29579 + *(void **)&virtio_cons.notifier_hangup = notifier_del_vio;
29580 + pax_close_kernel();
29581
29582 /* The first argument of hvc_alloc() is the virtual console number, so
29583 * we use zero. The second argument is the parameter for the
29584 diff -urNp linux-2.6.32.46/drivers/char/vt.c linux-2.6.32.46/drivers/char/vt.c
29585 --- linux-2.6.32.46/drivers/char/vt.c 2011-03-27 14:31:47.000000000 -0400
29586 +++ linux-2.6.32.46/drivers/char/vt.c 2011-04-17 15:56:46.000000000 -0400
29587 @@ -243,7 +243,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier
29588
29589 static void notify_write(struct vc_data *vc, unsigned int unicode)
29590 {
29591 - struct vt_notifier_param param = { .vc = vc, unicode = unicode };
29592 + struct vt_notifier_param param = { .vc = vc, .c = unicode };
29593 atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
29594 }
29595
29596 diff -urNp linux-2.6.32.46/drivers/char/vt_ioctl.c linux-2.6.32.46/drivers/char/vt_ioctl.c
29597 --- linux-2.6.32.46/drivers/char/vt_ioctl.c 2011-03-27 14:31:47.000000000 -0400
29598 +++ linux-2.6.32.46/drivers/char/vt_ioctl.c 2011-04-17 15:56:46.000000000 -0400
29599 @@ -210,9 +210,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __
29600 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
29601 return -EFAULT;
29602
29603 - if (!capable(CAP_SYS_TTY_CONFIG))
29604 - perm = 0;
29605 -
29606 switch (cmd) {
29607 case KDGKBENT:
29608 key_map = key_maps[s];
29609 @@ -224,8 +221,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __
29610 val = (i ? K_HOLE : K_NOSUCHMAP);
29611 return put_user(val, &user_kbe->kb_value);
29612 case KDSKBENT:
29613 + if (!capable(CAP_SYS_TTY_CONFIG))
29614 + perm = 0;
29615 +
29616 if (!perm)
29617 return -EPERM;
29618 +
29619 if (!i && v == K_NOSUCHMAP) {
29620 /* deallocate map */
29621 key_map = key_maps[s];
29622 @@ -325,9 +326,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
29623 int i, j, k;
29624 int ret;
29625
29626 - if (!capable(CAP_SYS_TTY_CONFIG))
29627 - perm = 0;
29628 -
29629 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
29630 if (!kbs) {
29631 ret = -ENOMEM;
29632 @@ -361,6 +359,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
29633 kfree(kbs);
29634 return ((p && *p) ? -EOVERFLOW : 0);
29635 case KDSKBSENT:
29636 + if (!capable(CAP_SYS_TTY_CONFIG))
29637 + perm = 0;
29638 +
29639 if (!perm) {
29640 ret = -EPERM;
29641 goto reterr;
29642 diff -urNp linux-2.6.32.46/drivers/cpufreq/cpufreq.c linux-2.6.32.46/drivers/cpufreq/cpufreq.c
29643 --- linux-2.6.32.46/drivers/cpufreq/cpufreq.c 2011-06-25 12:55:34.000000000 -0400
29644 +++ linux-2.6.32.46/drivers/cpufreq/cpufreq.c 2011-06-25 12:56:37.000000000 -0400
29645 @@ -750,7 +750,7 @@ static void cpufreq_sysfs_release(struct
29646 complete(&policy->kobj_unregister);
29647 }
29648
29649 -static struct sysfs_ops sysfs_ops = {
29650 +static const struct sysfs_ops sysfs_ops = {
29651 .show = show,
29652 .store = store,
29653 };
29654 diff -urNp linux-2.6.32.46/drivers/cpuidle/sysfs.c linux-2.6.32.46/drivers/cpuidle/sysfs.c
29655 --- linux-2.6.32.46/drivers/cpuidle/sysfs.c 2011-03-27 14:31:47.000000000 -0400
29656 +++ linux-2.6.32.46/drivers/cpuidle/sysfs.c 2011-04-17 15:56:46.000000000 -0400
29657 @@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobj
29658 return ret;
29659 }
29660
29661 -static struct sysfs_ops cpuidle_sysfs_ops = {
29662 +static const struct sysfs_ops cpuidle_sysfs_ops = {
29663 .show = cpuidle_show,
29664 .store = cpuidle_store,
29665 };
29666 @@ -277,7 +277,7 @@ static ssize_t cpuidle_state_show(struct
29667 return ret;
29668 }
29669
29670 -static struct sysfs_ops cpuidle_state_sysfs_ops = {
29671 +static const struct sysfs_ops cpuidle_state_sysfs_ops = {
29672 .show = cpuidle_state_show,
29673 };
29674
29675 @@ -294,7 +294,7 @@ static struct kobj_type ktype_state_cpui
29676 .release = cpuidle_state_sysfs_release,
29677 };
29678
29679 -static void inline cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
29680 +static inline void cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
29681 {
29682 kobject_put(&device->kobjs[i]->kobj);
29683 wait_for_completion(&device->kobjs[i]->kobj_unregister);
29684 diff -urNp linux-2.6.32.46/drivers/crypto/hifn_795x.c linux-2.6.32.46/drivers/crypto/hifn_795x.c
29685 --- linux-2.6.32.46/drivers/crypto/hifn_795x.c 2011-03-27 14:31:47.000000000 -0400
29686 +++ linux-2.6.32.46/drivers/crypto/hifn_795x.c 2011-05-16 21:46:57.000000000 -0400
29687 @@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device
29688 0xCA, 0x34, 0x2B, 0x2E};
29689 struct scatterlist sg;
29690
29691 + pax_track_stack();
29692 +
29693 memset(src, 0, sizeof(src));
29694 memset(ctx.key, 0, sizeof(ctx.key));
29695
29696 diff -urNp linux-2.6.32.46/drivers/crypto/padlock-aes.c linux-2.6.32.46/drivers/crypto/padlock-aes.c
29697 --- linux-2.6.32.46/drivers/crypto/padlock-aes.c 2011-03-27 14:31:47.000000000 -0400
29698 +++ linux-2.6.32.46/drivers/crypto/padlock-aes.c 2011-05-16 21:46:57.000000000 -0400
29699 @@ -108,6 +108,8 @@ static int aes_set_key(struct crypto_tfm
29700 struct crypto_aes_ctx gen_aes;
29701 int cpu;
29702
29703 + pax_track_stack();
29704 +
29705 if (key_len % 8) {
29706 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
29707 return -EINVAL;
29708 diff -urNp linux-2.6.32.46/drivers/dma/ioat/dma.c linux-2.6.32.46/drivers/dma/ioat/dma.c
29709 --- linux-2.6.32.46/drivers/dma/ioat/dma.c 2011-03-27 14:31:47.000000000 -0400
29710 +++ linux-2.6.32.46/drivers/dma/ioat/dma.c 2011-04-17 15:56:46.000000000 -0400
29711 @@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, str
29712 return entry->show(&chan->common, page);
29713 }
29714
29715 -struct sysfs_ops ioat_sysfs_ops = {
29716 +const struct sysfs_ops ioat_sysfs_ops = {
29717 .show = ioat_attr_show,
29718 };
29719
29720 diff -urNp linux-2.6.32.46/drivers/dma/ioat/dma.h linux-2.6.32.46/drivers/dma/ioat/dma.h
29721 --- linux-2.6.32.46/drivers/dma/ioat/dma.h 2011-03-27 14:31:47.000000000 -0400
29722 +++ linux-2.6.32.46/drivers/dma/ioat/dma.h 2011-04-17 15:56:46.000000000 -0400
29723 @@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_c
29724 unsigned long *phys_complete);
29725 void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
29726 void ioat_kobject_del(struct ioatdma_device *device);
29727 -extern struct sysfs_ops ioat_sysfs_ops;
29728 +extern const struct sysfs_ops ioat_sysfs_ops;
29729 extern struct ioat_sysfs_entry ioat_version_attr;
29730 extern struct ioat_sysfs_entry ioat_cap_attr;
29731 #endif /* IOATDMA_H */
29732 diff -urNp linux-2.6.32.46/drivers/edac/edac_device_sysfs.c linux-2.6.32.46/drivers/edac/edac_device_sysfs.c
29733 --- linux-2.6.32.46/drivers/edac/edac_device_sysfs.c 2011-03-27 14:31:47.000000000 -0400
29734 +++ linux-2.6.32.46/drivers/edac/edac_device_sysfs.c 2011-04-17 15:56:46.000000000 -0400
29735 @@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(s
29736 }
29737
29738 /* edac_dev file operations for an 'ctl_info' */
29739 -static struct sysfs_ops device_ctl_info_ops = {
29740 +static const struct sysfs_ops device_ctl_info_ops = {
29741 .show = edac_dev_ctl_info_show,
29742 .store = edac_dev_ctl_info_store
29743 };
29744 @@ -373,7 +373,7 @@ static ssize_t edac_dev_instance_store(s
29745 }
29746
29747 /* edac_dev file operations for an 'instance' */
29748 -static struct sysfs_ops device_instance_ops = {
29749 +static const struct sysfs_ops device_instance_ops = {
29750 .show = edac_dev_instance_show,
29751 .store = edac_dev_instance_store
29752 };
29753 @@ -476,7 +476,7 @@ static ssize_t edac_dev_block_store(stru
29754 }
29755
29756 /* edac_dev file operations for a 'block' */
29757 -static struct sysfs_ops device_block_ops = {
29758 +static const struct sysfs_ops device_block_ops = {
29759 .show = edac_dev_block_show,
29760 .store = edac_dev_block_store
29761 };
29762 diff -urNp linux-2.6.32.46/drivers/edac/edac_mc_sysfs.c linux-2.6.32.46/drivers/edac/edac_mc_sysfs.c
29763 --- linux-2.6.32.46/drivers/edac/edac_mc_sysfs.c 2011-03-27 14:31:47.000000000 -0400
29764 +++ linux-2.6.32.46/drivers/edac/edac_mc_sysfs.c 2011-04-17 15:56:46.000000000 -0400
29765 @@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kob
29766 return -EIO;
29767 }
29768
29769 -static struct sysfs_ops csrowfs_ops = {
29770 +static const struct sysfs_ops csrowfs_ops = {
29771 .show = csrowdev_show,
29772 .store = csrowdev_store
29773 };
29774 @@ -575,7 +575,7 @@ static ssize_t mcidev_store(struct kobje
29775 }
29776
29777 /* Intermediate show/store table */
29778 -static struct sysfs_ops mci_ops = {
29779 +static const struct sysfs_ops mci_ops = {
29780 .show = mcidev_show,
29781 .store = mcidev_store
29782 };
29783 diff -urNp linux-2.6.32.46/drivers/edac/edac_pci_sysfs.c linux-2.6.32.46/drivers/edac/edac_pci_sysfs.c
29784 --- linux-2.6.32.46/drivers/edac/edac_pci_sysfs.c 2011-03-27 14:31:47.000000000 -0400
29785 +++ linux-2.6.32.46/drivers/edac/edac_pci_sysfs.c 2011-05-04 17:56:20.000000000 -0400
29786 @@ -25,8 +25,8 @@ static int edac_pci_log_pe = 1; /* log
29787 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
29788 static int edac_pci_poll_msec = 1000; /* one second workq period */
29789
29790 -static atomic_t pci_parity_count = ATOMIC_INIT(0);
29791 -static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
29792 +static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
29793 +static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
29794
29795 static struct kobject *edac_pci_top_main_kobj;
29796 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
29797 @@ -121,7 +121,7 @@ static ssize_t edac_pci_instance_store(s
29798 }
29799
29800 /* fs_ops table */
29801 -static struct sysfs_ops pci_instance_ops = {
29802 +static const struct sysfs_ops pci_instance_ops = {
29803 .show = edac_pci_instance_show,
29804 .store = edac_pci_instance_store
29805 };
29806 @@ -261,7 +261,7 @@ static ssize_t edac_pci_dev_store(struct
29807 return -EIO;
29808 }
29809
29810 -static struct sysfs_ops edac_pci_sysfs_ops = {
29811 +static const struct sysfs_ops edac_pci_sysfs_ops = {
29812 .show = edac_pci_dev_show,
29813 .store = edac_pci_dev_store
29814 };
29815 @@ -579,7 +579,7 @@ static void edac_pci_dev_parity_test(str
29816 edac_printk(KERN_CRIT, EDAC_PCI,
29817 "Signaled System Error on %s\n",
29818 pci_name(dev));
29819 - atomic_inc(&pci_nonparity_count);
29820 + atomic_inc_unchecked(&pci_nonparity_count);
29821 }
29822
29823 if (status & (PCI_STATUS_PARITY)) {
29824 @@ -587,7 +587,7 @@ static void edac_pci_dev_parity_test(str
29825 "Master Data Parity Error on %s\n",
29826 pci_name(dev));
29827
29828 - atomic_inc(&pci_parity_count);
29829 + atomic_inc_unchecked(&pci_parity_count);
29830 }
29831
29832 if (status & (PCI_STATUS_DETECTED_PARITY)) {
29833 @@ -595,7 +595,7 @@ static void edac_pci_dev_parity_test(str
29834 "Detected Parity Error on %s\n",
29835 pci_name(dev));
29836
29837 - atomic_inc(&pci_parity_count);
29838 + atomic_inc_unchecked(&pci_parity_count);
29839 }
29840 }
29841
29842 @@ -616,7 +616,7 @@ static void edac_pci_dev_parity_test(str
29843 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
29844 "Signaled System Error on %s\n",
29845 pci_name(dev));
29846 - atomic_inc(&pci_nonparity_count);
29847 + atomic_inc_unchecked(&pci_nonparity_count);
29848 }
29849
29850 if (status & (PCI_STATUS_PARITY)) {
29851 @@ -624,7 +624,7 @@ static void edac_pci_dev_parity_test(str
29852 "Master Data Parity Error on "
29853 "%s\n", pci_name(dev));
29854
29855 - atomic_inc(&pci_parity_count);
29856 + atomic_inc_unchecked(&pci_parity_count);
29857 }
29858
29859 if (status & (PCI_STATUS_DETECTED_PARITY)) {
29860 @@ -632,7 +632,7 @@ static void edac_pci_dev_parity_test(str
29861 "Detected Parity Error on %s\n",
29862 pci_name(dev));
29863
29864 - atomic_inc(&pci_parity_count);
29865 + atomic_inc_unchecked(&pci_parity_count);
29866 }
29867 }
29868 }
29869 @@ -674,7 +674,7 @@ void edac_pci_do_parity_check(void)
29870 if (!check_pci_errors)
29871 return;
29872
29873 - before_count = atomic_read(&pci_parity_count);
29874 + before_count = atomic_read_unchecked(&pci_parity_count);
29875
29876 /* scan all PCI devices looking for a Parity Error on devices and
29877 * bridges.
29878 @@ -686,7 +686,7 @@ void edac_pci_do_parity_check(void)
29879 /* Only if operator has selected panic on PCI Error */
29880 if (edac_pci_get_panic_on_pe()) {
29881 /* If the count is different 'after' from 'before' */
29882 - if (before_count != atomic_read(&pci_parity_count))
29883 + if (before_count != atomic_read_unchecked(&pci_parity_count))
29884 panic("EDAC: PCI Parity Error");
29885 }
29886 }
29887 diff -urNp linux-2.6.32.46/drivers/firewire/core-card.c linux-2.6.32.46/drivers/firewire/core-card.c
29888 --- linux-2.6.32.46/drivers/firewire/core-card.c 2011-03-27 14:31:47.000000000 -0400
29889 +++ linux-2.6.32.46/drivers/firewire/core-card.c 2011-08-23 21:22:32.000000000 -0400
29890 @@ -558,7 +558,7 @@ void fw_card_release(struct kref *kref)
29891
29892 void fw_core_remove_card(struct fw_card *card)
29893 {
29894 - struct fw_card_driver dummy_driver = dummy_driver_template;
29895 + fw_card_driver_no_const dummy_driver = dummy_driver_template;
29896
29897 card->driver->update_phy_reg(card, 4,
29898 PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
29899 diff -urNp linux-2.6.32.46/drivers/firewire/core-cdev.c linux-2.6.32.46/drivers/firewire/core-cdev.c
29900 --- linux-2.6.32.46/drivers/firewire/core-cdev.c 2011-03-27 14:31:47.000000000 -0400
29901 +++ linux-2.6.32.46/drivers/firewire/core-cdev.c 2011-04-17 15:56:46.000000000 -0400
29902 @@ -1141,8 +1141,7 @@ static int init_iso_resource(struct clie
29903 int ret;
29904
29905 if ((request->channels == 0 && request->bandwidth == 0) ||
29906 - request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
29907 - request->bandwidth < 0)
29908 + request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
29909 return -EINVAL;
29910
29911 r = kmalloc(sizeof(*r), GFP_KERNEL);
29912 diff -urNp linux-2.6.32.46/drivers/firewire/core.h linux-2.6.32.46/drivers/firewire/core.h
29913 --- linux-2.6.32.46/drivers/firewire/core.h 2011-03-27 14:31:47.000000000 -0400
29914 +++ linux-2.6.32.46/drivers/firewire/core.h 2011-08-23 20:24:26.000000000 -0400
29915 @@ -86,6 +86,7 @@ struct fw_card_driver {
29916
29917 int (*stop_iso)(struct fw_iso_context *ctx);
29918 };
29919 +typedef struct fw_card_driver __no_const fw_card_driver_no_const;
29920
29921 void fw_card_initialize(struct fw_card *card,
29922 const struct fw_card_driver *driver, struct device *device);
29923 diff -urNp linux-2.6.32.46/drivers/firewire/core-transaction.c linux-2.6.32.46/drivers/firewire/core-transaction.c
29924 --- linux-2.6.32.46/drivers/firewire/core-transaction.c 2011-03-27 14:31:47.000000000 -0400
29925 +++ linux-2.6.32.46/drivers/firewire/core-transaction.c 2011-05-16 21:46:57.000000000 -0400
29926 @@ -36,6 +36,7 @@
29927 #include <linux/string.h>
29928 #include <linux/timer.h>
29929 #include <linux/types.h>
29930 +#include <linux/sched.h>
29931
29932 #include <asm/byteorder.h>
29933
29934 @@ -344,6 +345,8 @@ int fw_run_transaction(struct fw_card *c
29935 struct transaction_callback_data d;
29936 struct fw_transaction t;
29937
29938 + pax_track_stack();
29939 +
29940 init_completion(&d.done);
29941 d.payload = payload;
29942 fw_send_request(card, &t, tcode, destination_id, generation, speed,
29943 diff -urNp linux-2.6.32.46/drivers/firmware/dmi_scan.c linux-2.6.32.46/drivers/firmware/dmi_scan.c
29944 --- linux-2.6.32.46/drivers/firmware/dmi_scan.c 2011-03-27 14:31:47.000000000 -0400
29945 +++ linux-2.6.32.46/drivers/firmware/dmi_scan.c 2011-10-06 09:37:08.000000000 -0400
29946 @@ -391,11 +391,6 @@ void __init dmi_scan_machine(void)
29947 }
29948 }
29949 else {
29950 - /*
29951 - * no iounmap() for that ioremap(); it would be a no-op, but
29952 - * it's so early in setup that sucker gets confused into doing
29953 - * what it shouldn't if we actually call it.
29954 - */
29955 p = dmi_ioremap(0xF0000, 0x10000);
29956 if (p == NULL)
29957 goto error;
29958 @@ -667,7 +662,7 @@ int dmi_walk(void (*decode)(const struct
29959 if (buf == NULL)
29960 return -1;
29961
29962 - dmi_table(buf, dmi_len, dmi_num, decode, private_data);
29963 + dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data);
29964
29965 iounmap(buf);
29966 return 0;
29967 diff -urNp linux-2.6.32.46/drivers/firmware/edd.c linux-2.6.32.46/drivers/firmware/edd.c
29968 --- linux-2.6.32.46/drivers/firmware/edd.c 2011-03-27 14:31:47.000000000 -0400
29969 +++ linux-2.6.32.46/drivers/firmware/edd.c 2011-04-17 15:56:46.000000000 -0400
29970 @@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, str
29971 return ret;
29972 }
29973
29974 -static struct sysfs_ops edd_attr_ops = {
29975 +static const struct sysfs_ops edd_attr_ops = {
29976 .show = edd_attr_show,
29977 };
29978
29979 diff -urNp linux-2.6.32.46/drivers/firmware/efivars.c linux-2.6.32.46/drivers/firmware/efivars.c
29980 --- linux-2.6.32.46/drivers/firmware/efivars.c 2011-03-27 14:31:47.000000000 -0400
29981 +++ linux-2.6.32.46/drivers/firmware/efivars.c 2011-04-17 15:56:46.000000000 -0400
29982 @@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct
29983 return ret;
29984 }
29985
29986 -static struct sysfs_ops efivar_attr_ops = {
29987 +static const struct sysfs_ops efivar_attr_ops = {
29988 .show = efivar_attr_show,
29989 .store = efivar_attr_store,
29990 };
29991 diff -urNp linux-2.6.32.46/drivers/firmware/iscsi_ibft.c linux-2.6.32.46/drivers/firmware/iscsi_ibft.c
29992 --- linux-2.6.32.46/drivers/firmware/iscsi_ibft.c 2011-03-27 14:31:47.000000000 -0400
29993 +++ linux-2.6.32.46/drivers/firmware/iscsi_ibft.c 2011-04-17 15:56:46.000000000 -0400
29994 @@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struc
29995 return ret;
29996 }
29997
29998 -static struct sysfs_ops ibft_attr_ops = {
29999 +static const struct sysfs_ops ibft_attr_ops = {
30000 .show = ibft_show_attribute,
30001 };
30002
30003 diff -urNp linux-2.6.32.46/drivers/firmware/memmap.c linux-2.6.32.46/drivers/firmware/memmap.c
30004 --- linux-2.6.32.46/drivers/firmware/memmap.c 2011-03-27 14:31:47.000000000 -0400
30005 +++ linux-2.6.32.46/drivers/firmware/memmap.c 2011-04-17 15:56:46.000000000 -0400
30006 @@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
30007 NULL
30008 };
30009
30010 -static struct sysfs_ops memmap_attr_ops = {
30011 +static const struct sysfs_ops memmap_attr_ops = {
30012 .show = memmap_attr_show,
30013 };
30014
30015 diff -urNp linux-2.6.32.46/drivers/gpio/vr41xx_giu.c linux-2.6.32.46/drivers/gpio/vr41xx_giu.c
30016 --- linux-2.6.32.46/drivers/gpio/vr41xx_giu.c 2011-03-27 14:31:47.000000000 -0400
30017 +++ linux-2.6.32.46/drivers/gpio/vr41xx_giu.c 2011-05-04 17:56:28.000000000 -0400
30018 @@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
30019 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
30020 maskl, pendl, maskh, pendh);
30021
30022 - atomic_inc(&irq_err_count);
30023 + atomic_inc_unchecked(&irq_err_count);
30024
30025 return -EINVAL;
30026 }
30027 diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_crtc.c linux-2.6.32.46/drivers/gpu/drm/drm_crtc.c
30028 --- linux-2.6.32.46/drivers/gpu/drm/drm_crtc.c 2011-03-27 14:31:47.000000000 -0400
30029 +++ linux-2.6.32.46/drivers/gpu/drm/drm_crtc.c 2011-10-06 09:37:14.000000000 -0400
30030 @@ -1323,7 +1323,7 @@ int drm_mode_getconnector(struct drm_dev
30031 */
30032 if ((out_resp->count_modes >= mode_count) && mode_count) {
30033 copied = 0;
30034 - mode_ptr = (struct drm_mode_modeinfo *)(unsigned long)out_resp->modes_ptr;
30035 + mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
30036 list_for_each_entry(mode, &connector->modes, head) {
30037 drm_crtc_convert_to_umode(&u_mode, mode);
30038 if (copy_to_user(mode_ptr + copied,
30039 @@ -1338,8 +1338,8 @@ int drm_mode_getconnector(struct drm_dev
30040
30041 if ((out_resp->count_props >= props_count) && props_count) {
30042 copied = 0;
30043 - prop_ptr = (uint32_t *)(unsigned long)(out_resp->props_ptr);
30044 - prop_values = (uint64_t *)(unsigned long)(out_resp->prop_values_ptr);
30045 + prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr);
30046 + prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr);
30047 for (i = 0; i < DRM_CONNECTOR_MAX_PROPERTY; i++) {
30048 if (connector->property_ids[i] != 0) {
30049 if (put_user(connector->property_ids[i],
30050 @@ -1361,7 +1361,7 @@ int drm_mode_getconnector(struct drm_dev
30051
30052 if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
30053 copied = 0;
30054 - encoder_ptr = (uint32_t *)(unsigned long)(out_resp->encoders_ptr);
30055 + encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
30056 for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
30057 if (connector->encoder_ids[i] != 0) {
30058 if (put_user(connector->encoder_ids[i],
30059 @@ -1513,7 +1513,7 @@ int drm_mode_setcrtc(struct drm_device *
30060 }
30061
30062 for (i = 0; i < crtc_req->count_connectors; i++) {
30063 - set_connectors_ptr = (uint32_t *)(unsigned long)crtc_req->set_connectors_ptr;
30064 + set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
30065 if (get_user(out_id, &set_connectors_ptr[i])) {
30066 ret = -EFAULT;
30067 goto out;
30068 @@ -2118,7 +2118,7 @@ int drm_mode_getproperty_ioctl(struct dr
30069 out_resp->flags = property->flags;
30070
30071 if ((out_resp->count_values >= value_count) && value_count) {
30072 - values_ptr = (uint64_t *)(unsigned long)out_resp->values_ptr;
30073 + values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
30074 for (i = 0; i < value_count; i++) {
30075 if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
30076 ret = -EFAULT;
30077 @@ -2131,7 +2131,7 @@ int drm_mode_getproperty_ioctl(struct dr
30078 if (property->flags & DRM_MODE_PROP_ENUM) {
30079 if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
30080 copied = 0;
30081 - enum_ptr = (struct drm_mode_property_enum *)(unsigned long)out_resp->enum_blob_ptr;
30082 + enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
30083 list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
30084
30085 if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
30086 @@ -2154,7 +2154,7 @@ int drm_mode_getproperty_ioctl(struct dr
30087 if ((out_resp->count_enum_blobs >= blob_count) && blob_count) {
30088 copied = 0;
30089 blob_id_ptr = (uint32_t *)(unsigned long)out_resp->enum_blob_ptr;
30090 - blob_length_ptr = (uint32_t *)(unsigned long)out_resp->values_ptr;
30091 + blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr;
30092
30093 list_for_each_entry(prop_blob, &property->enum_blob_list, head) {
30094 if (put_user(prop_blob->base.id, blob_id_ptr + copied)) {
30095 @@ -2226,7 +2226,7 @@ int drm_mode_getblob_ioctl(struct drm_de
30096 blob = obj_to_blob(obj);
30097
30098 if (out_resp->length == blob->length) {
30099 - blob_ptr = (void *)(unsigned long)out_resp->data;
30100 + blob_ptr = (void __user *)(unsigned long)out_resp->data;
30101 if (copy_to_user(blob_ptr, blob->data, blob->length)){
30102 ret = -EFAULT;
30103 goto done;
30104 diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.32.46/drivers/gpu/drm/drm_crtc_helper.c
30105 --- linux-2.6.32.46/drivers/gpu/drm/drm_crtc_helper.c 2011-03-27 14:31:47.000000000 -0400
30106 +++ linux-2.6.32.46/drivers/gpu/drm/drm_crtc_helper.c 2011-05-16 21:46:57.000000000 -0400
30107 @@ -573,7 +573,7 @@ static bool drm_encoder_crtc_ok(struct d
30108 struct drm_crtc *tmp;
30109 int crtc_mask = 1;
30110
30111 - WARN(!crtc, "checking null crtc?");
30112 + BUG_ON(!crtc);
30113
30114 dev = crtc->dev;
30115
30116 @@ -642,6 +642,8 @@ bool drm_crtc_helper_set_mode(struct drm
30117
30118 adjusted_mode = drm_mode_duplicate(dev, mode);
30119
30120 + pax_track_stack();
30121 +
30122 crtc->enabled = drm_helper_crtc_in_use(crtc);
30123
30124 if (!crtc->enabled)
30125 diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_drv.c linux-2.6.32.46/drivers/gpu/drm/drm_drv.c
30126 --- linux-2.6.32.46/drivers/gpu/drm/drm_drv.c 2011-03-27 14:31:47.000000000 -0400
30127 +++ linux-2.6.32.46/drivers/gpu/drm/drm_drv.c 2011-04-17 15:56:46.000000000 -0400
30128 @@ -417,7 +417,7 @@ int drm_ioctl(struct inode *inode, struc
30129 char *kdata = NULL;
30130
30131 atomic_inc(&dev->ioctl_count);
30132 - atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
30133 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
30134 ++file_priv->ioctl_count;
30135
30136 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
30137 diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_fops.c linux-2.6.32.46/drivers/gpu/drm/drm_fops.c
30138 --- linux-2.6.32.46/drivers/gpu/drm/drm_fops.c 2011-03-27 14:31:47.000000000 -0400
30139 +++ linux-2.6.32.46/drivers/gpu/drm/drm_fops.c 2011-04-17 15:56:46.000000000 -0400
30140 @@ -66,7 +66,7 @@ static int drm_setup(struct drm_device *
30141 }
30142
30143 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
30144 - atomic_set(&dev->counts[i], 0);
30145 + atomic_set_unchecked(&dev->counts[i], 0);
30146
30147 dev->sigdata.lock = NULL;
30148
30149 @@ -130,9 +130,9 @@ int drm_open(struct inode *inode, struct
30150
30151 retcode = drm_open_helper(inode, filp, dev);
30152 if (!retcode) {
30153 - atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
30154 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
30155 spin_lock(&dev->count_lock);
30156 - if (!dev->open_count++) {
30157 + if (local_inc_return(&dev->open_count) == 1) {
30158 spin_unlock(&dev->count_lock);
30159 retcode = drm_setup(dev);
30160 goto out;
30161 @@ -435,7 +435,7 @@ int drm_release(struct inode *inode, str
30162
30163 lock_kernel();
30164
30165 - DRM_DEBUG("open_count = %d\n", dev->open_count);
30166 + DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
30167
30168 if (dev->driver->preclose)
30169 dev->driver->preclose(dev, file_priv);
30170 @@ -447,7 +447,7 @@ int drm_release(struct inode *inode, str
30171 DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
30172 task_pid_nr(current),
30173 (long)old_encode_dev(file_priv->minor->device),
30174 - dev->open_count);
30175 + local_read(&dev->open_count));
30176
30177 /* if the master has gone away we can't do anything with the lock */
30178 if (file_priv->minor->master)
30179 @@ -524,9 +524,9 @@ int drm_release(struct inode *inode, str
30180 * End inline drm_release
30181 */
30182
30183 - atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
30184 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
30185 spin_lock(&dev->count_lock);
30186 - if (!--dev->open_count) {
30187 + if (local_dec_and_test(&dev->open_count)) {
30188 if (atomic_read(&dev->ioctl_count)) {
30189 DRM_ERROR("Device busy: %d\n",
30190 atomic_read(&dev->ioctl_count));
30191 diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_gem.c linux-2.6.32.46/drivers/gpu/drm/drm_gem.c
30192 --- linux-2.6.32.46/drivers/gpu/drm/drm_gem.c 2011-03-27 14:31:47.000000000 -0400
30193 +++ linux-2.6.32.46/drivers/gpu/drm/drm_gem.c 2011-04-17 15:56:46.000000000 -0400
30194 @@ -83,11 +83,11 @@ drm_gem_init(struct drm_device *dev)
30195 spin_lock_init(&dev->object_name_lock);
30196 idr_init(&dev->object_name_idr);
30197 atomic_set(&dev->object_count, 0);
30198 - atomic_set(&dev->object_memory, 0);
30199 + atomic_set_unchecked(&dev->object_memory, 0);
30200 atomic_set(&dev->pin_count, 0);
30201 - atomic_set(&dev->pin_memory, 0);
30202 + atomic_set_unchecked(&dev->pin_memory, 0);
30203 atomic_set(&dev->gtt_count, 0);
30204 - atomic_set(&dev->gtt_memory, 0);
30205 + atomic_set_unchecked(&dev->gtt_memory, 0);
30206
30207 mm = kzalloc(sizeof(struct drm_gem_mm), GFP_KERNEL);
30208 if (!mm) {
30209 @@ -150,7 +150,7 @@ drm_gem_object_alloc(struct drm_device *
30210 goto fput;
30211 }
30212 atomic_inc(&dev->object_count);
30213 - atomic_add(obj->size, &dev->object_memory);
30214 + atomic_add_unchecked(obj->size, &dev->object_memory);
30215 return obj;
30216 fput:
30217 fput(obj->filp);
30218 @@ -429,7 +429,7 @@ drm_gem_object_free(struct kref *kref)
30219
30220 fput(obj->filp);
30221 atomic_dec(&dev->object_count);
30222 - atomic_sub(obj->size, &dev->object_memory);
30223 + atomic_sub_unchecked(obj->size, &dev->object_memory);
30224 kfree(obj);
30225 }
30226 EXPORT_SYMBOL(drm_gem_object_free);
30227 diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_info.c linux-2.6.32.46/drivers/gpu/drm/drm_info.c
30228 --- linux-2.6.32.46/drivers/gpu/drm/drm_info.c 2011-03-27 14:31:47.000000000 -0400
30229 +++ linux-2.6.32.46/drivers/gpu/drm/drm_info.c 2011-04-17 15:56:46.000000000 -0400
30230 @@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void
30231 struct drm_local_map *map;
30232 struct drm_map_list *r_list;
30233
30234 - /* Hardcoded from _DRM_FRAME_BUFFER,
30235 - _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
30236 - _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
30237 - const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
30238 + static const char * const types[] = {
30239 + [_DRM_FRAME_BUFFER] = "FB",
30240 + [_DRM_REGISTERS] = "REG",
30241 + [_DRM_SHM] = "SHM",
30242 + [_DRM_AGP] = "AGP",
30243 + [_DRM_SCATTER_GATHER] = "SG",
30244 + [_DRM_CONSISTENT] = "PCI",
30245 + [_DRM_GEM] = "GEM" };
30246 const char *type;
30247 int i;
30248
30249 @@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void
30250 map = r_list->map;
30251 if (!map)
30252 continue;
30253 - if (map->type < 0 || map->type > 5)
30254 + if (map->type >= ARRAY_SIZE(types))
30255 type = "??";
30256 else
30257 type = types[map->type];
30258 @@ -265,10 +269,10 @@ int drm_gem_object_info(struct seq_file
30259 struct drm_device *dev = node->minor->dev;
30260
30261 seq_printf(m, "%d objects\n", atomic_read(&dev->object_count));
30262 - seq_printf(m, "%d object bytes\n", atomic_read(&dev->object_memory));
30263 + seq_printf(m, "%d object bytes\n", atomic_read_unchecked(&dev->object_memory));
30264 seq_printf(m, "%d pinned\n", atomic_read(&dev->pin_count));
30265 - seq_printf(m, "%d pin bytes\n", atomic_read(&dev->pin_memory));
30266 - seq_printf(m, "%d gtt bytes\n", atomic_read(&dev->gtt_memory));
30267 + seq_printf(m, "%d pin bytes\n", atomic_read_unchecked(&dev->pin_memory));
30268 + seq_printf(m, "%d gtt bytes\n", atomic_read_unchecked(&dev->gtt_memory));
30269 seq_printf(m, "%d gtt total\n", dev->gtt_total);
30270 return 0;
30271 }
30272 @@ -288,7 +292,11 @@ int drm_vma_info(struct seq_file *m, voi
30273 mutex_lock(&dev->struct_mutex);
30274 seq_printf(m, "vma use count: %d, high_memory = %p, 0x%08llx\n",
30275 atomic_read(&dev->vma_count),
30276 +#ifdef CONFIG_GRKERNSEC_HIDESYM
30277 + NULL, 0);
30278 +#else
30279 high_memory, (u64)virt_to_phys(high_memory));
30280 +#endif
30281
30282 list_for_each_entry(pt, &dev->vmalist, head) {
30283 vma = pt->vma;
30284 @@ -296,14 +304,23 @@ int drm_vma_info(struct seq_file *m, voi
30285 continue;
30286 seq_printf(m,
30287 "\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx000",
30288 - pt->pid, vma->vm_start, vma->vm_end,
30289 + pt->pid,
30290 +#ifdef CONFIG_GRKERNSEC_HIDESYM
30291 + 0, 0,
30292 +#else
30293 + vma->vm_start, vma->vm_end,
30294 +#endif
30295 vma->vm_flags & VM_READ ? 'r' : '-',
30296 vma->vm_flags & VM_WRITE ? 'w' : '-',
30297 vma->vm_flags & VM_EXEC ? 'x' : '-',
30298 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
30299 vma->vm_flags & VM_LOCKED ? 'l' : '-',
30300 vma->vm_flags & VM_IO ? 'i' : '-',
30301 +#ifdef CONFIG_GRKERNSEC_HIDESYM
30302 + 0);
30303 +#else
30304 vma->vm_pgoff);
30305 +#endif
30306
30307 #if defined(__i386__)
30308 pgprot = pgprot_val(vma->vm_page_prot);
30309 diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_ioc32.c linux-2.6.32.46/drivers/gpu/drm/drm_ioc32.c
30310 --- linux-2.6.32.46/drivers/gpu/drm/drm_ioc32.c 2011-03-27 14:31:47.000000000 -0400
30311 +++ linux-2.6.32.46/drivers/gpu/drm/drm_ioc32.c 2011-10-06 09:37:14.000000000 -0400
30312 @@ -463,7 +463,7 @@ static int compat_drm_infobufs(struct fi
30313 request = compat_alloc_user_space(nbytes);
30314 if (!access_ok(VERIFY_WRITE, request, nbytes))
30315 return -EFAULT;
30316 - list = (struct drm_buf_desc *) (request + 1);
30317 + list = (struct drm_buf_desc __user *) (request + 1);
30318
30319 if (__put_user(count, &request->count)
30320 || __put_user(list, &request->list))
30321 @@ -525,7 +525,7 @@ static int compat_drm_mapbufs(struct fil
30322 request = compat_alloc_user_space(nbytes);
30323 if (!access_ok(VERIFY_WRITE, request, nbytes))
30324 return -EFAULT;
30325 - list = (struct drm_buf_pub *) (request + 1);
30326 + list = (struct drm_buf_pub __user *) (request + 1);
30327
30328 if (__put_user(count, &request->count)
30329 || __put_user(list, &request->list))
30330 diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.46/drivers/gpu/drm/drm_ioctl.c
30331 --- linux-2.6.32.46/drivers/gpu/drm/drm_ioctl.c 2011-03-27 14:31:47.000000000 -0400
30332 +++ linux-2.6.32.46/drivers/gpu/drm/drm_ioctl.c 2011-04-17 15:56:46.000000000 -0400
30333 @@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev,
30334 stats->data[i].value =
30335 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
30336 else
30337 - stats->data[i].value = atomic_read(&dev->counts[i]);
30338 + stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
30339 stats->data[i].type = dev->types[i];
30340 }
30341
30342 diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_lock.c linux-2.6.32.46/drivers/gpu/drm/drm_lock.c
30343 --- linux-2.6.32.46/drivers/gpu/drm/drm_lock.c 2011-03-27 14:31:47.000000000 -0400
30344 +++ linux-2.6.32.46/drivers/gpu/drm/drm_lock.c 2011-04-17 15:56:46.000000000 -0400
30345 @@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, voi
30346 if (drm_lock_take(&master->lock, lock->context)) {
30347 master->lock.file_priv = file_priv;
30348 master->lock.lock_time = jiffies;
30349 - atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
30350 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
30351 break; /* Got lock */
30352 }
30353
30354 @@ -165,7 +165,7 @@ int drm_unlock(struct drm_device *dev, v
30355 return -EINVAL;
30356 }
30357
30358 - atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
30359 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
30360
30361 /* kernel_context_switch isn't used by any of the x86 drm
30362 * modules but is required by the Sparc driver.
30363 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i810/i810_dma.c linux-2.6.32.46/drivers/gpu/drm/i810/i810_dma.c
30364 --- linux-2.6.32.46/drivers/gpu/drm/i810/i810_dma.c 2011-03-27 14:31:47.000000000 -0400
30365 +++ linux-2.6.32.46/drivers/gpu/drm/i810/i810_dma.c 2011-04-17 15:56:46.000000000 -0400
30366 @@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_de
30367 dma->buflist[vertex->idx],
30368 vertex->discard, vertex->used);
30369
30370 - atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
30371 - atomic_inc(&dev->counts[_DRM_STAT_DMA]);
30372 + atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
30373 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
30374 sarea_priv->last_enqueue = dev_priv->counter - 1;
30375 sarea_priv->last_dispatch = (int)hw_status[5];
30376
30377 @@ -1115,8 +1115,8 @@ static int i810_dma_mc(struct drm_device
30378 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
30379 mc->last_render);
30380
30381 - atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
30382 - atomic_inc(&dev->counts[_DRM_STAT_DMA]);
30383 + atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
30384 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
30385 sarea_priv->last_enqueue = dev_priv->counter - 1;
30386 sarea_priv->last_dispatch = (int)hw_status[5];
30387
30388 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i810/i810_drv.h linux-2.6.32.46/drivers/gpu/drm/i810/i810_drv.h
30389 --- linux-2.6.32.46/drivers/gpu/drm/i810/i810_drv.h 2011-03-27 14:31:47.000000000 -0400
30390 +++ linux-2.6.32.46/drivers/gpu/drm/i810/i810_drv.h 2011-05-04 17:56:28.000000000 -0400
30391 @@ -108,8 +108,8 @@ typedef struct drm_i810_private {
30392 int page_flipping;
30393
30394 wait_queue_head_t irq_queue;
30395 - atomic_t irq_received;
30396 - atomic_t irq_emitted;
30397 + atomic_unchecked_t irq_received;
30398 + atomic_unchecked_t irq_emitted;
30399
30400 int front_offset;
30401 } drm_i810_private_t;
30402 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i830/i830_drv.h linux-2.6.32.46/drivers/gpu/drm/i830/i830_drv.h
30403 --- linux-2.6.32.46/drivers/gpu/drm/i830/i830_drv.h 2011-03-27 14:31:47.000000000 -0400
30404 +++ linux-2.6.32.46/drivers/gpu/drm/i830/i830_drv.h 2011-05-04 17:56:28.000000000 -0400
30405 @@ -115,8 +115,8 @@ typedef struct drm_i830_private {
30406 int page_flipping;
30407
30408 wait_queue_head_t irq_queue;
30409 - atomic_t irq_received;
30410 - atomic_t irq_emitted;
30411 + atomic_unchecked_t irq_received;
30412 + atomic_unchecked_t irq_emitted;
30413
30414 int use_mi_batchbuffer_start;
30415
30416 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i830/i830_irq.c linux-2.6.32.46/drivers/gpu/drm/i830/i830_irq.c
30417 --- linux-2.6.32.46/drivers/gpu/drm/i830/i830_irq.c 2011-03-27 14:31:47.000000000 -0400
30418 +++ linux-2.6.32.46/drivers/gpu/drm/i830/i830_irq.c 2011-05-04 17:56:28.000000000 -0400
30419 @@ -47,7 +47,7 @@ irqreturn_t i830_driver_irq_handler(DRM_
30420
30421 I830_WRITE16(I830REG_INT_IDENTITY_R, temp);
30422
30423 - atomic_inc(&dev_priv->irq_received);
30424 + atomic_inc_unchecked(&dev_priv->irq_received);
30425 wake_up_interruptible(&dev_priv->irq_queue);
30426
30427 return IRQ_HANDLED;
30428 @@ -60,14 +60,14 @@ static int i830_emit_irq(struct drm_devi
30429
30430 DRM_DEBUG("%s\n", __func__);
30431
30432 - atomic_inc(&dev_priv->irq_emitted);
30433 + atomic_inc_unchecked(&dev_priv->irq_emitted);
30434
30435 BEGIN_LP_RING(2);
30436 OUT_RING(0);
30437 OUT_RING(GFX_OP_USER_INTERRUPT);
30438 ADVANCE_LP_RING();
30439
30440 - return atomic_read(&dev_priv->irq_emitted);
30441 + return atomic_read_unchecked(&dev_priv->irq_emitted);
30442 }
30443
30444 static int i830_wait_irq(struct drm_device * dev, int irq_nr)
30445 @@ -79,7 +79,7 @@ static int i830_wait_irq(struct drm_devi
30446
30447 DRM_DEBUG("%s\n", __func__);
30448
30449 - if (atomic_read(&dev_priv->irq_received) >= irq_nr)
30450 + if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
30451 return 0;
30452
30453 dev_priv->sarea_priv->perf_boxes |= I830_BOX_WAIT;
30454 @@ -88,7 +88,7 @@ static int i830_wait_irq(struct drm_devi
30455
30456 for (;;) {
30457 __set_current_state(TASK_INTERRUPTIBLE);
30458 - if (atomic_read(&dev_priv->irq_received) >= irq_nr)
30459 + if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
30460 break;
30461 if ((signed)(end - jiffies) <= 0) {
30462 DRM_ERROR("timeout iir %x imr %x ier %x hwstam %x\n",
30463 @@ -163,8 +163,8 @@ void i830_driver_irq_preinstall(struct d
30464 I830_WRITE16(I830REG_HWSTAM, 0xffff);
30465 I830_WRITE16(I830REG_INT_MASK_R, 0x0);
30466 I830_WRITE16(I830REG_INT_ENABLE_R, 0x0);
30467 - atomic_set(&dev_priv->irq_received, 0);
30468 - atomic_set(&dev_priv->irq_emitted, 0);
30469 + atomic_set_unchecked(&dev_priv->irq_received, 0);
30470 + atomic_set_unchecked(&dev_priv->irq_emitted, 0);
30471 init_waitqueue_head(&dev_priv->irq_queue);
30472 }
30473
30474 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7017.c
30475 --- linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7017.c 2011-03-27 14:31:47.000000000 -0400
30476 +++ linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7017.c 2011-04-17 15:56:46.000000000 -0400
30477 @@ -443,7 +443,7 @@ static void ch7017_destroy(struct intel_
30478 }
30479 }
30480
30481 -struct intel_dvo_dev_ops ch7017_ops = {
30482 +const struct intel_dvo_dev_ops ch7017_ops = {
30483 .init = ch7017_init,
30484 .detect = ch7017_detect,
30485 .mode_valid = ch7017_mode_valid,
30486 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7xxx.c
30487 --- linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-03-27 14:31:47.000000000 -0400
30488 +++ linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-04-17 15:56:46.000000000 -0400
30489 @@ -356,7 +356,7 @@ static void ch7xxx_destroy(struct intel_
30490 }
30491 }
30492
30493 -struct intel_dvo_dev_ops ch7xxx_ops = {
30494 +const struct intel_dvo_dev_ops ch7xxx_ops = {
30495 .init = ch7xxx_init,
30496 .detect = ch7xxx_detect,
30497 .mode_valid = ch7xxx_mode_valid,
30498 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/dvo.h linux-2.6.32.46/drivers/gpu/drm/i915/dvo.h
30499 --- linux-2.6.32.46/drivers/gpu/drm/i915/dvo.h 2011-03-27 14:31:47.000000000 -0400
30500 +++ linux-2.6.32.46/drivers/gpu/drm/i915/dvo.h 2011-04-17 15:56:46.000000000 -0400
30501 @@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
30502 *
30503 * \return singly-linked list of modes or NULL if no modes found.
30504 */
30505 - struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
30506 + struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
30507
30508 /**
30509 * Clean up driver-specific bits of the output
30510 */
30511 - void (*destroy) (struct intel_dvo_device *dvo);
30512 + void (* const destroy) (struct intel_dvo_device *dvo);
30513
30514 /**
30515 * Debugging hook to dump device registers to log file
30516 */
30517 - void (*dump_regs)(struct intel_dvo_device *dvo);
30518 + void (* const dump_regs)(struct intel_dvo_device *dvo);
30519 };
30520
30521 -extern struct intel_dvo_dev_ops sil164_ops;
30522 -extern struct intel_dvo_dev_ops ch7xxx_ops;
30523 -extern struct intel_dvo_dev_ops ivch_ops;
30524 -extern struct intel_dvo_dev_ops tfp410_ops;
30525 -extern struct intel_dvo_dev_ops ch7017_ops;
30526 +extern const struct intel_dvo_dev_ops sil164_ops;
30527 +extern const struct intel_dvo_dev_ops ch7xxx_ops;
30528 +extern const struct intel_dvo_dev_ops ivch_ops;
30529 +extern const struct intel_dvo_dev_ops tfp410_ops;
30530 +extern const struct intel_dvo_dev_ops ch7017_ops;
30531
30532 #endif /* _INTEL_DVO_H */
30533 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ivch.c
30534 --- linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ivch.c 2011-03-27 14:31:47.000000000 -0400
30535 +++ linux-2.6.32.46/drivers/gpu/drm/i915/dvo_ivch.c 2011-04-17 15:56:46.000000000 -0400
30536 @@ -430,7 +430,7 @@ static void ivch_destroy(struct intel_dv
30537 }
30538 }
30539
30540 -struct intel_dvo_dev_ops ivch_ops= {
30541 +const struct intel_dvo_dev_ops ivch_ops= {
30542 .init = ivch_init,
30543 .dpms = ivch_dpms,
30544 .save = ivch_save,
30545 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.32.46/drivers/gpu/drm/i915/dvo_sil164.c
30546 --- linux-2.6.32.46/drivers/gpu/drm/i915/dvo_sil164.c 2011-03-27 14:31:47.000000000 -0400
30547 +++ linux-2.6.32.46/drivers/gpu/drm/i915/dvo_sil164.c 2011-04-17 15:56:46.000000000 -0400
30548 @@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_
30549 }
30550 }
30551
30552 -struct intel_dvo_dev_ops sil164_ops = {
30553 +const struct intel_dvo_dev_ops sil164_ops = {
30554 .init = sil164_init,
30555 .detect = sil164_detect,
30556 .mode_valid = sil164_mode_valid,
30557 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.32.46/drivers/gpu/drm/i915/dvo_tfp410.c
30558 --- linux-2.6.32.46/drivers/gpu/drm/i915/dvo_tfp410.c 2011-03-27 14:31:47.000000000 -0400
30559 +++ linux-2.6.32.46/drivers/gpu/drm/i915/dvo_tfp410.c 2011-04-17 15:56:46.000000000 -0400
30560 @@ -323,7 +323,7 @@ static void tfp410_destroy(struct intel_
30561 }
30562 }
30563
30564 -struct intel_dvo_dev_ops tfp410_ops = {
30565 +const struct intel_dvo_dev_ops tfp410_ops = {
30566 .init = tfp410_init,
30567 .detect = tfp410_detect,
30568 .mode_valid = tfp410_mode_valid,
30569 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/i915_debugfs.c linux-2.6.32.46/drivers/gpu/drm/i915/i915_debugfs.c
30570 --- linux-2.6.32.46/drivers/gpu/drm/i915/i915_debugfs.c 2011-03-27 14:31:47.000000000 -0400
30571 +++ linux-2.6.32.46/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-04 17:56:28.000000000 -0400
30572 @@ -192,7 +192,7 @@ static int i915_interrupt_info(struct se
30573 I915_READ(GTIMR));
30574 }
30575 seq_printf(m, "Interrupts received: %d\n",
30576 - atomic_read(&dev_priv->irq_received));
30577 + atomic_read_unchecked(&dev_priv->irq_received));
30578 if (dev_priv->hw_status_page != NULL) {
30579 seq_printf(m, "Current sequence: %d\n",
30580 i915_get_gem_seqno(dev));
30581 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.c
30582 --- linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.c 2011-03-27 14:31:47.000000000 -0400
30583 +++ linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.c 2011-04-17 15:56:46.000000000 -0400
30584 @@ -285,7 +285,7 @@ i915_pci_resume(struct pci_dev *pdev)
30585 return i915_resume(dev);
30586 }
30587
30588 -static struct vm_operations_struct i915_gem_vm_ops = {
30589 +static const struct vm_operations_struct i915_gem_vm_ops = {
30590 .fault = i915_gem_fault,
30591 .open = drm_gem_vm_open,
30592 .close = drm_gem_vm_close,
30593 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.h linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.h
30594 --- linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.h 2011-03-27 14:31:47.000000000 -0400
30595 +++ linux-2.6.32.46/drivers/gpu/drm/i915/i915_drv.h 2011-08-05 20:33:55.000000000 -0400
30596 @@ -168,7 +168,7 @@ struct drm_i915_display_funcs {
30597 /* display clock increase/decrease */
30598 /* pll clock increase/decrease */
30599 /* clock gating init */
30600 -};
30601 +} __no_const;
30602
30603 typedef struct drm_i915_private {
30604 struct drm_device *dev;
30605 @@ -197,7 +197,7 @@ typedef struct drm_i915_private {
30606 int page_flipping;
30607
30608 wait_queue_head_t irq_queue;
30609 - atomic_t irq_received;
30610 + atomic_unchecked_t irq_received;
30611 /** Protects user_irq_refcount and irq_mask_reg */
30612 spinlock_t user_irq_lock;
30613 /** Refcount for i915_user_irq_get() versus i915_user_irq_put(). */
30614 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/i915_gem.c linux-2.6.32.46/drivers/gpu/drm/i915/i915_gem.c
30615 --- linux-2.6.32.46/drivers/gpu/drm/i915/i915_gem.c 2011-03-27 14:31:47.000000000 -0400
30616 +++ linux-2.6.32.46/drivers/gpu/drm/i915/i915_gem.c 2011-04-17 15:56:46.000000000 -0400
30617 @@ -102,7 +102,7 @@ i915_gem_get_aperture_ioctl(struct drm_d
30618
30619 args->aper_size = dev->gtt_total;
30620 args->aper_available_size = (args->aper_size -
30621 - atomic_read(&dev->pin_memory));
30622 + atomic_read_unchecked(&dev->pin_memory));
30623
30624 return 0;
30625 }
30626 @@ -492,6 +492,11 @@ i915_gem_pread_ioctl(struct drm_device *
30627 return -EINVAL;
30628 }
30629
30630 + if (!access_ok(VERIFY_WRITE, (char __user *) (uintptr_t)args->data_ptr, args->size)) {
30631 + drm_gem_object_unreference(obj);
30632 + return -EFAULT;
30633 + }
30634 +
30635 if (i915_gem_object_needs_bit17_swizzle(obj)) {
30636 ret = i915_gem_shmem_pread_slow(dev, obj, args, file_priv);
30637 } else {
30638 @@ -965,6 +970,11 @@ i915_gem_pwrite_ioctl(struct drm_device
30639 return -EINVAL;
30640 }
30641
30642 + if (!access_ok(VERIFY_READ, (char __user *) (uintptr_t)args->data_ptr, args->size)) {
30643 + drm_gem_object_unreference(obj);
30644 + return -EFAULT;
30645 + }
30646 +
30647 /* We can only do the GTT pwrite on untiled buffers, as otherwise
30648 * it would end up going through the fenced access, and we'll get
30649 * different detiling behavior between reading and writing.
30650 @@ -2054,7 +2064,7 @@ i915_gem_object_unbind(struct drm_gem_ob
30651
30652 if (obj_priv->gtt_space) {
30653 atomic_dec(&dev->gtt_count);
30654 - atomic_sub(obj->size, &dev->gtt_memory);
30655 + atomic_sub_unchecked(obj->size, &dev->gtt_memory);
30656
30657 drm_mm_put_block(obj_priv->gtt_space);
30658 obj_priv->gtt_space = NULL;
30659 @@ -2697,7 +2707,7 @@ i915_gem_object_bind_to_gtt(struct drm_g
30660 goto search_free;
30661 }
30662 atomic_inc(&dev->gtt_count);
30663 - atomic_add(obj->size, &dev->gtt_memory);
30664 + atomic_add_unchecked(obj->size, &dev->gtt_memory);
30665
30666 /* Assert that the object is not currently in any GPU domain. As it
30667 * wasn't in the GTT, there shouldn't be any way it could have been in
30668 @@ -3751,9 +3761,9 @@ i915_gem_execbuffer(struct drm_device *d
30669 "%d/%d gtt bytes\n",
30670 atomic_read(&dev->object_count),
30671 atomic_read(&dev->pin_count),
30672 - atomic_read(&dev->object_memory),
30673 - atomic_read(&dev->pin_memory),
30674 - atomic_read(&dev->gtt_memory),
30675 + atomic_read_unchecked(&dev->object_memory),
30676 + atomic_read_unchecked(&dev->pin_memory),
30677 + atomic_read_unchecked(&dev->gtt_memory),
30678 dev->gtt_total);
30679 }
30680 goto err;
30681 @@ -3985,7 +3995,7 @@ i915_gem_object_pin(struct drm_gem_objec
30682 */
30683 if (obj_priv->pin_count == 1) {
30684 atomic_inc(&dev->pin_count);
30685 - atomic_add(obj->size, &dev->pin_memory);
30686 + atomic_add_unchecked(obj->size, &dev->pin_memory);
30687 if (!obj_priv->active &&
30688 (obj->write_domain & I915_GEM_GPU_DOMAINS) == 0 &&
30689 !list_empty(&obj_priv->list))
30690 @@ -4018,7 +4028,7 @@ i915_gem_object_unpin(struct drm_gem_obj
30691 list_move_tail(&obj_priv->list,
30692 &dev_priv->mm.inactive_list);
30693 atomic_dec(&dev->pin_count);
30694 - atomic_sub(obj->size, &dev->pin_memory);
30695 + atomic_sub_unchecked(obj->size, &dev->pin_memory);
30696 }
30697 i915_verify_inactive(dev, __FILE__, __LINE__);
30698 }
30699 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/i915_irq.c linux-2.6.32.46/drivers/gpu/drm/i915/i915_irq.c
30700 --- linux-2.6.32.46/drivers/gpu/drm/i915/i915_irq.c 2011-03-27 14:31:47.000000000 -0400
30701 +++ linux-2.6.32.46/drivers/gpu/drm/i915/i915_irq.c 2011-05-04 17:56:28.000000000 -0400
30702 @@ -528,7 +528,7 @@ irqreturn_t i915_driver_irq_handler(DRM_
30703 int irq_received;
30704 int ret = IRQ_NONE;
30705
30706 - atomic_inc(&dev_priv->irq_received);
30707 + atomic_inc_unchecked(&dev_priv->irq_received);
30708
30709 if (IS_IGDNG(dev))
30710 return igdng_irq_handler(dev);
30711 @@ -1021,7 +1021,7 @@ void i915_driver_irq_preinstall(struct d
30712 {
30713 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
30714
30715 - atomic_set(&dev_priv->irq_received, 0);
30716 + atomic_set_unchecked(&dev_priv->irq_received, 0);
30717
30718 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
30719 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
30720 diff -urNp linux-2.6.32.46/drivers/gpu/drm/i915/intel_sdvo.c linux-2.6.32.46/drivers/gpu/drm/i915/intel_sdvo.c
30721 --- linux-2.6.32.46/drivers/gpu/drm/i915/intel_sdvo.c 2011-03-27 14:31:47.000000000 -0400
30722 +++ linux-2.6.32.46/drivers/gpu/drm/i915/intel_sdvo.c 2011-08-05 20:33:55.000000000 -0400
30723 @@ -2795,7 +2795,9 @@ bool intel_sdvo_init(struct drm_device *
30724 sdvo_priv->slave_addr = intel_sdvo_get_slave_addr(dev, output_device);
30725
30726 /* Save the bit-banging i2c functionality for use by the DDC wrapper */
30727 - intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
30728 + pax_open_kernel();
30729 + *(void **)&intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
30730 + pax_close_kernel();
30731
30732 /* Read the regs to test if we can talk to the device */
30733 for (i = 0; i < 0x40; i++) {
30734 diff -urNp linux-2.6.32.46/drivers/gpu/drm/mga/mga_drv.h linux-2.6.32.46/drivers/gpu/drm/mga/mga_drv.h
30735 --- linux-2.6.32.46/drivers/gpu/drm/mga/mga_drv.h 2011-03-27 14:31:47.000000000 -0400
30736 +++ linux-2.6.32.46/drivers/gpu/drm/mga/mga_drv.h 2011-05-04 17:56:28.000000000 -0400
30737 @@ -120,9 +120,9 @@ typedef struct drm_mga_private {
30738 u32 clear_cmd;
30739 u32 maccess;
30740
30741 - atomic_t vbl_received; /**< Number of vblanks received. */
30742 + atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
30743 wait_queue_head_t fence_queue;
30744 - atomic_t last_fence_retired;
30745 + atomic_unchecked_t last_fence_retired;
30746 u32 next_fence_to_post;
30747
30748 unsigned int fb_cpp;
30749 diff -urNp linux-2.6.32.46/drivers/gpu/drm/mga/mga_irq.c linux-2.6.32.46/drivers/gpu/drm/mga/mga_irq.c
30750 --- linux-2.6.32.46/drivers/gpu/drm/mga/mga_irq.c 2011-03-27 14:31:47.000000000 -0400
30751 +++ linux-2.6.32.46/drivers/gpu/drm/mga/mga_irq.c 2011-05-04 17:56:28.000000000 -0400
30752 @@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_de
30753 if (crtc != 0)
30754 return 0;
30755
30756 - return atomic_read(&dev_priv->vbl_received);
30757 + return atomic_read_unchecked(&dev_priv->vbl_received);
30758 }
30759
30760
30761 @@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
30762 /* VBLANK interrupt */
30763 if (status & MGA_VLINEPEN) {
30764 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
30765 - atomic_inc(&dev_priv->vbl_received);
30766 + atomic_inc_unchecked(&dev_priv->vbl_received);
30767 drm_handle_vblank(dev, 0);
30768 handled = 1;
30769 }
30770 @@ -80,7 +80,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
30771 MGA_WRITE(MGA_PRIMEND, prim_end);
30772 }
30773
30774 - atomic_inc(&dev_priv->last_fence_retired);
30775 + atomic_inc_unchecked(&dev_priv->last_fence_retired);
30776 DRM_WAKEUP(&dev_priv->fence_queue);
30777 handled = 1;
30778 }
30779 @@ -131,7 +131,7 @@ int mga_driver_fence_wait(struct drm_dev
30780 * using fences.
30781 */
30782 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
30783 - (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
30784 + (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
30785 - *sequence) <= (1 << 23)));
30786
30787 *sequence = cur_fence;
30788 diff -urNp linux-2.6.32.46/drivers/gpu/drm/r128/r128_cce.c linux-2.6.32.46/drivers/gpu/drm/r128/r128_cce.c
30789 --- linux-2.6.32.46/drivers/gpu/drm/r128/r128_cce.c 2011-03-27 14:31:47.000000000 -0400
30790 +++ linux-2.6.32.46/drivers/gpu/drm/r128/r128_cce.c 2011-05-04 17:56:28.000000000 -0400
30791 @@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_d
30792
30793 /* GH: Simple idle check.
30794 */
30795 - atomic_set(&dev_priv->idle_count, 0);
30796 + atomic_set_unchecked(&dev_priv->idle_count, 0);
30797
30798 /* We don't support anything other than bus-mastering ring mode,
30799 * but the ring can be in either AGP or PCI space for the ring
30800 diff -urNp linux-2.6.32.46/drivers/gpu/drm/r128/r128_drv.h linux-2.6.32.46/drivers/gpu/drm/r128/r128_drv.h
30801 --- linux-2.6.32.46/drivers/gpu/drm/r128/r128_drv.h 2011-03-27 14:31:47.000000000 -0400
30802 +++ linux-2.6.32.46/drivers/gpu/drm/r128/r128_drv.h 2011-05-04 17:56:28.000000000 -0400
30803 @@ -90,14 +90,14 @@ typedef struct drm_r128_private {
30804 int is_pci;
30805 unsigned long cce_buffers_offset;
30806
30807 - atomic_t idle_count;
30808 + atomic_unchecked_t idle_count;
30809
30810 int page_flipping;
30811 int current_page;
30812 u32 crtc_offset;
30813 u32 crtc_offset_cntl;
30814
30815 - atomic_t vbl_received;
30816 + atomic_unchecked_t vbl_received;
30817
30818 u32 color_fmt;
30819 unsigned int front_offset;
30820 diff -urNp linux-2.6.32.46/drivers/gpu/drm/r128/r128_irq.c linux-2.6.32.46/drivers/gpu/drm/r128/r128_irq.c
30821 --- linux-2.6.32.46/drivers/gpu/drm/r128/r128_irq.c 2011-03-27 14:31:47.000000000 -0400
30822 +++ linux-2.6.32.46/drivers/gpu/drm/r128/r128_irq.c 2011-05-04 17:56:28.000000000 -0400
30823 @@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_d
30824 if (crtc != 0)
30825 return 0;
30826
30827 - return atomic_read(&dev_priv->vbl_received);
30828 + return atomic_read_unchecked(&dev_priv->vbl_received);
30829 }
30830
30831 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
30832 @@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_
30833 /* VBLANK interrupt */
30834 if (status & R128_CRTC_VBLANK_INT) {
30835 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
30836 - atomic_inc(&dev_priv->vbl_received);
30837 + atomic_inc_unchecked(&dev_priv->vbl_received);
30838 drm_handle_vblank(dev, 0);
30839 return IRQ_HANDLED;
30840 }
30841 diff -urNp linux-2.6.32.46/drivers/gpu/drm/r128/r128_state.c linux-2.6.32.46/drivers/gpu/drm/r128/r128_state.c
30842 --- linux-2.6.32.46/drivers/gpu/drm/r128/r128_state.c 2011-03-27 14:31:47.000000000 -0400
30843 +++ linux-2.6.32.46/drivers/gpu/drm/r128/r128_state.c 2011-05-04 17:56:28.000000000 -0400
30844 @@ -323,10 +323,10 @@ static void r128_clear_box(drm_r128_priv
30845
30846 static void r128_cce_performance_boxes(drm_r128_private_t * dev_priv)
30847 {
30848 - if (atomic_read(&dev_priv->idle_count) == 0) {
30849 + if (atomic_read_unchecked(&dev_priv->idle_count) == 0) {
30850 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
30851 } else {
30852 - atomic_set(&dev_priv->idle_count, 0);
30853 + atomic_set_unchecked(&dev_priv->idle_count, 0);
30854 }
30855 }
30856
30857 diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/atom.c linux-2.6.32.46/drivers/gpu/drm/radeon/atom.c
30858 --- linux-2.6.32.46/drivers/gpu/drm/radeon/atom.c 2011-05-10 22:12:01.000000000 -0400
30859 +++ linux-2.6.32.46/drivers/gpu/drm/radeon/atom.c 2011-05-16 21:46:57.000000000 -0400
30860 @@ -1115,6 +1115,8 @@ struct atom_context *atom_parse(struct c
30861 char name[512];
30862 int i;
30863
30864 + pax_track_stack();
30865 +
30866 ctx->card = card;
30867 ctx->bios = bios;
30868
30869 diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.46/drivers/gpu/drm/radeon/mkregtable.c
30870 --- linux-2.6.32.46/drivers/gpu/drm/radeon/mkregtable.c 2011-03-27 14:31:47.000000000 -0400
30871 +++ linux-2.6.32.46/drivers/gpu/drm/radeon/mkregtable.c 2011-04-17 15:56:46.000000000 -0400
30872 @@ -637,14 +637,14 @@ static int parser_auth(struct table *t,
30873 regex_t mask_rex;
30874 regmatch_t match[4];
30875 char buf[1024];
30876 - size_t end;
30877 + long end;
30878 int len;
30879 int done = 0;
30880 int r;
30881 unsigned o;
30882 struct offset *offset;
30883 char last_reg_s[10];
30884 - int last_reg;
30885 + unsigned long last_reg;
30886
30887 if (regcomp
30888 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
30889 diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_atombios.c
30890 --- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_atombios.c 2011-03-27 14:31:47.000000000 -0400
30891 +++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-16 21:46:57.000000000 -0400
30892 @@ -275,6 +275,8 @@ bool radeon_get_atom_connector_info_from
30893 bool linkb;
30894 struct radeon_i2c_bus_rec ddc_bus;
30895
30896 + pax_track_stack();
30897 +
30898 atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
30899
30900 if (data_offset == 0)
30901 @@ -520,13 +522,13 @@ static uint16_t atombios_get_connector_o
30902 }
30903 }
30904
30905 -struct bios_connector {
30906 +static struct bios_connector {
30907 bool valid;
30908 uint16_t line_mux;
30909 uint16_t devices;
30910 int connector_type;
30911 struct radeon_i2c_bus_rec ddc_bus;
30912 -};
30913 +} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
30914
30915 bool radeon_get_atom_connector_info_from_supported_devices_table(struct
30916 drm_device
30917 @@ -542,7 +544,6 @@ bool radeon_get_atom_connector_info_from
30918 uint8_t dac;
30919 union atom_supported_devices *supported_devices;
30920 int i, j;
30921 - struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
30922
30923 atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
30924
30925 diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_display.c
30926 --- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_display.c 2011-03-27 14:31:47.000000000 -0400
30927 +++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_display.c 2011-04-17 15:56:46.000000000 -0400
30928 @@ -482,7 +482,7 @@ void radeon_compute_pll(struct radeon_pl
30929
30930 if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
30931 error = freq - current_freq;
30932 - error = error < 0 ? 0xffffffff : error;
30933 + error = (int32_t)error < 0 ? 0xffffffff : error;
30934 } else
30935 error = abs(current_freq - freq);
30936 vco_diff = abs(vco - best_vco);
30937 diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_drv.h linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_drv.h
30938 --- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_drv.h 2011-03-27 14:31:47.000000000 -0400
30939 +++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-04 17:56:28.000000000 -0400
30940 @@ -253,7 +253,7 @@ typedef struct drm_radeon_private {
30941
30942 /* SW interrupt */
30943 wait_queue_head_t swi_queue;
30944 - atomic_t swi_emitted;
30945 + atomic_unchecked_t swi_emitted;
30946 int vblank_crtc;
30947 uint32_t irq_enable_reg;
30948 uint32_t r500_disp_irq_reg;
30949 diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_fence.c linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_fence.c
30950 --- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_fence.c 2011-03-27 14:31:47.000000000 -0400
30951 +++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-04 17:56:28.000000000 -0400
30952 @@ -47,7 +47,7 @@ int radeon_fence_emit(struct radeon_devi
30953 write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
30954 return 0;
30955 }
30956 - fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
30957 + fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
30958 if (!rdev->cp.ready) {
30959 /* FIXME: cp is not running assume everythings is done right
30960 * away
30961 @@ -364,7 +364,7 @@ int radeon_fence_driver_init(struct rade
30962 return r;
30963 }
30964 WREG32(rdev->fence_drv.scratch_reg, 0);
30965 - atomic_set(&rdev->fence_drv.seq, 0);
30966 + atomic_set_unchecked(&rdev->fence_drv.seq, 0);
30967 INIT_LIST_HEAD(&rdev->fence_drv.created);
30968 INIT_LIST_HEAD(&rdev->fence_drv.emited);
30969 INIT_LIST_HEAD(&rdev->fence_drv.signaled);
30970 diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon.h linux-2.6.32.46/drivers/gpu/drm/radeon/radeon.h
30971 --- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon.h 2011-03-27 14:31:47.000000000 -0400
30972 +++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon.h 2011-08-05 20:33:55.000000000 -0400
30973 @@ -149,7 +149,7 @@ int radeon_pm_init(struct radeon_device
30974 */
30975 struct radeon_fence_driver {
30976 uint32_t scratch_reg;
30977 - atomic_t seq;
30978 + atomic_unchecked_t seq;
30979 uint32_t last_seq;
30980 unsigned long count_timeout;
30981 wait_queue_head_t queue;
30982 @@ -640,7 +640,7 @@ struct radeon_asic {
30983 uint32_t offset, uint32_t obj_size);
30984 int (*clear_surface_reg)(struct radeon_device *rdev, int reg);
30985 void (*bandwidth_update)(struct radeon_device *rdev);
30986 -};
30987 +} __no_const;
30988
30989 /*
30990 * Asic structures
30991 diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ioc32.c linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ioc32.c
30992 --- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-03-27 14:31:47.000000000 -0400
30993 +++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-04-23 13:57:24.000000000 -0400
30994 @@ -368,7 +368,7 @@ static int compat_radeon_cp_setparam(str
30995 request = compat_alloc_user_space(sizeof(*request));
30996 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
30997 || __put_user(req32.param, &request->param)
30998 - || __put_user((void __user *)(unsigned long)req32.value,
30999 + || __put_user((unsigned long)req32.value,
31000 &request->value))
31001 return -EFAULT;
31002
31003 diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_irq.c linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_irq.c
31004 --- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_irq.c 2011-03-27 14:31:47.000000000 -0400
31005 +++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-04 17:56:28.000000000 -0400
31006 @@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_de
31007 unsigned int ret;
31008 RING_LOCALS;
31009
31010 - atomic_inc(&dev_priv->swi_emitted);
31011 - ret = atomic_read(&dev_priv->swi_emitted);
31012 + atomic_inc_unchecked(&dev_priv->swi_emitted);
31013 + ret = atomic_read_unchecked(&dev_priv->swi_emitted);
31014
31015 BEGIN_RING(4);
31016 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
31017 @@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct
31018 drm_radeon_private_t *dev_priv =
31019 (drm_radeon_private_t *) dev->dev_private;
31020
31021 - atomic_set(&dev_priv->swi_emitted, 0);
31022 + atomic_set_unchecked(&dev_priv->swi_emitted, 0);
31023 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
31024
31025 dev->max_vblank_count = 0x001fffff;
31026 diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_state.c
31027 --- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_state.c 2011-03-27 14:31:47.000000000 -0400
31028 +++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_state.c 2011-04-17 15:56:46.000000000 -0400
31029 @@ -3021,7 +3021,7 @@ static int radeon_cp_getparam(struct drm
31030 {
31031 drm_radeon_private_t *dev_priv = dev->dev_private;
31032 drm_radeon_getparam_t *param = data;
31033 - int value;
31034 + int value = 0;
31035
31036 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
31037
31038 diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ttm.c
31039 --- linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ttm.c 2011-03-27 14:31:47.000000000 -0400
31040 +++ linux-2.6.32.46/drivers/gpu/drm/radeon/radeon_ttm.c 2011-04-17 15:56:46.000000000 -0400
31041 @@ -535,27 +535,10 @@ void radeon_ttm_fini(struct radeon_devic
31042 DRM_INFO("radeon: ttm finalized\n");
31043 }
31044
31045 -static struct vm_operations_struct radeon_ttm_vm_ops;
31046 -static const struct vm_operations_struct *ttm_vm_ops = NULL;
31047 -
31048 -static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
31049 -{
31050 - struct ttm_buffer_object *bo;
31051 - int r;
31052 -
31053 - bo = (struct ttm_buffer_object *)vma->vm_private_data;
31054 - if (bo == NULL) {
31055 - return VM_FAULT_NOPAGE;
31056 - }
31057 - r = ttm_vm_ops->fault(vma, vmf);
31058 - return r;
31059 -}
31060 -
31061 int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
31062 {
31063 struct drm_file *file_priv;
31064 struct radeon_device *rdev;
31065 - int r;
31066
31067 if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
31068 return drm_mmap(filp, vma);
31069 @@ -563,20 +546,9 @@ int radeon_mmap(struct file *filp, struc
31070
31071 file_priv = (struct drm_file *)filp->private_data;
31072 rdev = file_priv->minor->dev->dev_private;
31073 - if (rdev == NULL) {
31074 + if (!rdev)
31075 return -EINVAL;
31076 - }
31077 - r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
31078 - if (unlikely(r != 0)) {
31079 - return r;
31080 - }
31081 - if (unlikely(ttm_vm_ops == NULL)) {
31082 - ttm_vm_ops = vma->vm_ops;
31083 - radeon_ttm_vm_ops = *ttm_vm_ops;
31084 - radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
31085 - }
31086 - vma->vm_ops = &radeon_ttm_vm_ops;
31087 - return 0;
31088 + return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
31089 }
31090
31091
31092 diff -urNp linux-2.6.32.46/drivers/gpu/drm/radeon/rs690.c linux-2.6.32.46/drivers/gpu/drm/radeon/rs690.c
31093 --- linux-2.6.32.46/drivers/gpu/drm/radeon/rs690.c 2011-03-27 14:31:47.000000000 -0400
31094 +++ linux-2.6.32.46/drivers/gpu/drm/radeon/rs690.c 2011-04-17 15:56:46.000000000 -0400
31095 @@ -302,9 +302,11 @@ void rs690_crtc_bandwidth_compute(struct
31096 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
31097 rdev->pm.sideport_bandwidth.full)
31098 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
31099 - read_delay_latency.full = rfixed_const(370 * 800 * 1000);
31100 + read_delay_latency.full = rfixed_const(800 * 1000);
31101 read_delay_latency.full = rfixed_div(read_delay_latency,
31102 rdev->pm.igp_sideport_mclk);
31103 + a.full = rfixed_const(370);
31104 + read_delay_latency.full = rfixed_mul(read_delay_latency, a);
31105 } else {
31106 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
31107 rdev->pm.k8_bandwidth.full)
31108 diff -urNp linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo.c
31109 --- linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo.c 2011-08-29 22:24:44.000000000 -0400
31110 +++ linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo.c 2011-08-29 22:25:07.000000000 -0400
31111 @@ -67,7 +67,7 @@ static struct attribute *ttm_bo_global_a
31112 NULL
31113 };
31114
31115 -static struct sysfs_ops ttm_bo_global_ops = {
31116 +static const struct sysfs_ops ttm_bo_global_ops = {
31117 .show = &ttm_bo_global_show
31118 };
31119
31120 diff -urNp linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo_vm.c
31121 --- linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-03-27 14:31:47.000000000 -0400
31122 +++ linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-04-17 15:56:46.000000000 -0400
31123 @@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_are
31124 {
31125 struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
31126 vma->vm_private_data;
31127 - struct ttm_bo_device *bdev = bo->bdev;
31128 + struct ttm_bo_device *bdev;
31129 unsigned long bus_base;
31130 unsigned long bus_offset;
31131 unsigned long bus_size;
31132 @@ -88,6 +88,10 @@ static int ttm_bo_vm_fault(struct vm_are
31133 unsigned long address = (unsigned long)vmf->virtual_address;
31134 int retval = VM_FAULT_NOPAGE;
31135
31136 + if (!bo)
31137 + return VM_FAULT_NOPAGE;
31138 + bdev = bo->bdev;
31139 +
31140 /*
31141 * Work around locking order reversal in fault / nopfn
31142 * between mmap_sem and bo_reserve: Perform a trylock operation
31143 diff -urNp linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_global.c
31144 --- linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_global.c 2011-03-27 14:31:47.000000000 -0400
31145 +++ linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_global.c 2011-04-17 15:56:46.000000000 -0400
31146 @@ -36,7 +36,7 @@
31147 struct ttm_global_item {
31148 struct mutex mutex;
31149 void *object;
31150 - int refcount;
31151 + atomic_t refcount;
31152 };
31153
31154 static struct ttm_global_item glob[TTM_GLOBAL_NUM];
31155 @@ -49,7 +49,7 @@ void ttm_global_init(void)
31156 struct ttm_global_item *item = &glob[i];
31157 mutex_init(&item->mutex);
31158 item->object = NULL;
31159 - item->refcount = 0;
31160 + atomic_set(&item->refcount, 0);
31161 }
31162 }
31163
31164 @@ -59,7 +59,7 @@ void ttm_global_release(void)
31165 for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
31166 struct ttm_global_item *item = &glob[i];
31167 BUG_ON(item->object != NULL);
31168 - BUG_ON(item->refcount != 0);
31169 + BUG_ON(atomic_read(&item->refcount) != 0);
31170 }
31171 }
31172
31173 @@ -70,7 +70,7 @@ int ttm_global_item_ref(struct ttm_globa
31174 void *object;
31175
31176 mutex_lock(&item->mutex);
31177 - if (item->refcount == 0) {
31178 + if (atomic_read(&item->refcount) == 0) {
31179 item->object = kzalloc(ref->size, GFP_KERNEL);
31180 if (unlikely(item->object == NULL)) {
31181 ret = -ENOMEM;
31182 @@ -83,7 +83,7 @@ int ttm_global_item_ref(struct ttm_globa
31183 goto out_err;
31184
31185 }
31186 - ++item->refcount;
31187 + atomic_inc(&item->refcount);
31188 ref->object = item->object;
31189 object = item->object;
31190 mutex_unlock(&item->mutex);
31191 @@ -100,9 +100,9 @@ void ttm_global_item_unref(struct ttm_gl
31192 struct ttm_global_item *item = &glob[ref->global_type];
31193
31194 mutex_lock(&item->mutex);
31195 - BUG_ON(item->refcount == 0);
31196 + BUG_ON(atomic_read(&item->refcount) == 0);
31197 BUG_ON(ref->object != item->object);
31198 - if (--item->refcount == 0) {
31199 + if (atomic_dec_and_test(&item->refcount)) {
31200 ref->release(ref);
31201 item->object = NULL;
31202 }
31203 diff -urNp linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_memory.c
31204 --- linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_memory.c 2011-03-27 14:31:47.000000000 -0400
31205 +++ linux-2.6.32.46/drivers/gpu/drm/ttm/ttm_memory.c 2011-04-17 15:56:46.000000000 -0400
31206 @@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_at
31207 NULL
31208 };
31209
31210 -static struct sysfs_ops ttm_mem_zone_ops = {
31211 +static const struct sysfs_ops ttm_mem_zone_ops = {
31212 .show = &ttm_mem_zone_show,
31213 .store = &ttm_mem_zone_store
31214 };
31215 diff -urNp linux-2.6.32.46/drivers/gpu/drm/via/via_drv.h linux-2.6.32.46/drivers/gpu/drm/via/via_drv.h
31216 --- linux-2.6.32.46/drivers/gpu/drm/via/via_drv.h 2011-03-27 14:31:47.000000000 -0400
31217 +++ linux-2.6.32.46/drivers/gpu/drm/via/via_drv.h 2011-05-04 17:56:28.000000000 -0400
31218 @@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
31219 typedef uint32_t maskarray_t[5];
31220
31221 typedef struct drm_via_irq {
31222 - atomic_t irq_received;
31223 + atomic_unchecked_t irq_received;
31224 uint32_t pending_mask;
31225 uint32_t enable_mask;
31226 wait_queue_head_t irq_queue;
31227 @@ -75,7 +75,7 @@ typedef struct drm_via_private {
31228 struct timeval last_vblank;
31229 int last_vblank_valid;
31230 unsigned usec_per_vblank;
31231 - atomic_t vbl_received;
31232 + atomic_unchecked_t vbl_received;
31233 drm_via_state_t hc_state;
31234 char pci_buf[VIA_PCI_BUF_SIZE];
31235 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
31236 diff -urNp linux-2.6.32.46/drivers/gpu/drm/via/via_irq.c linux-2.6.32.46/drivers/gpu/drm/via/via_irq.c
31237 --- linux-2.6.32.46/drivers/gpu/drm/via/via_irq.c 2011-03-27 14:31:47.000000000 -0400
31238 +++ linux-2.6.32.46/drivers/gpu/drm/via/via_irq.c 2011-05-04 17:56:28.000000000 -0400
31239 @@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_de
31240 if (crtc != 0)
31241 return 0;
31242
31243 - return atomic_read(&dev_priv->vbl_received);
31244 + return atomic_read_unchecked(&dev_priv->vbl_received);
31245 }
31246
31247 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
31248 @@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_I
31249
31250 status = VIA_READ(VIA_REG_INTERRUPT);
31251 if (status & VIA_IRQ_VBLANK_PENDING) {
31252 - atomic_inc(&dev_priv->vbl_received);
31253 - if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
31254 + atomic_inc_unchecked(&dev_priv->vbl_received);
31255 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
31256 do_gettimeofday(&cur_vblank);
31257 if (dev_priv->last_vblank_valid) {
31258 dev_priv->usec_per_vblank =
31259 @@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
31260 dev_priv->last_vblank = cur_vblank;
31261 dev_priv->last_vblank_valid = 1;
31262 }
31263 - if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
31264 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
31265 DRM_DEBUG("US per vblank is: %u\n",
31266 dev_priv->usec_per_vblank);
31267 }
31268 @@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
31269
31270 for (i = 0; i < dev_priv->num_irqs; ++i) {
31271 if (status & cur_irq->pending_mask) {
31272 - atomic_inc(&cur_irq->irq_received);
31273 + atomic_inc_unchecked(&cur_irq->irq_received);
31274 DRM_WAKEUP(&cur_irq->irq_queue);
31275 handled = 1;
31276 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i) {
31277 @@ -244,11 +244,11 @@ via_driver_irq_wait(struct drm_device *
31278 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
31279 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
31280 masks[irq][4]));
31281 - cur_irq_sequence = atomic_read(&cur_irq->irq_received);
31282 + cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
31283 } else {
31284 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
31285 (((cur_irq_sequence =
31286 - atomic_read(&cur_irq->irq_received)) -
31287 + atomic_read_unchecked(&cur_irq->irq_received)) -
31288 *sequence) <= (1 << 23)));
31289 }
31290 *sequence = cur_irq_sequence;
31291 @@ -286,7 +286,7 @@ void via_driver_irq_preinstall(struct dr
31292 }
31293
31294 for (i = 0; i < dev_priv->num_irqs; ++i) {
31295 - atomic_set(&cur_irq->irq_received, 0);
31296 + atomic_set_unchecked(&cur_irq->irq_received, 0);
31297 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
31298 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
31299 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
31300 @@ -368,7 +368,7 @@ int via_wait_irq(struct drm_device *dev,
31301 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
31302 case VIA_IRQ_RELATIVE:
31303 irqwait->request.sequence +=
31304 - atomic_read(&cur_irq->irq_received);
31305 + atomic_read_unchecked(&cur_irq->irq_received);
31306 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
31307 case VIA_IRQ_ABSOLUTE:
31308 break;
31309 diff -urNp linux-2.6.32.46/drivers/hid/hid-core.c linux-2.6.32.46/drivers/hid/hid-core.c
31310 --- linux-2.6.32.46/drivers/hid/hid-core.c 2011-05-10 22:12:01.000000000 -0400
31311 +++ linux-2.6.32.46/drivers/hid/hid-core.c 2011-05-10 22:12:32.000000000 -0400
31312 @@ -1752,7 +1752,7 @@ static bool hid_ignore(struct hid_device
31313
31314 int hid_add_device(struct hid_device *hdev)
31315 {
31316 - static atomic_t id = ATOMIC_INIT(0);
31317 + static atomic_unchecked_t id = ATOMIC_INIT(0);
31318 int ret;
31319
31320 if (WARN_ON(hdev->status & HID_STAT_ADDED))
31321 @@ -1766,7 +1766,7 @@ int hid_add_device(struct hid_device *hd
31322 /* XXX hack, any other cleaner solution after the driver core
31323 * is converted to allow more than 20 bytes as the device name? */
31324 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
31325 - hdev->vendor, hdev->product, atomic_inc_return(&id));
31326 + hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
31327
31328 ret = device_add(&hdev->dev);
31329 if (!ret)
31330 diff -urNp linux-2.6.32.46/drivers/hid/usbhid/hiddev.c linux-2.6.32.46/drivers/hid/usbhid/hiddev.c
31331 --- linux-2.6.32.46/drivers/hid/usbhid/hiddev.c 2011-03-27 14:31:47.000000000 -0400
31332 +++ linux-2.6.32.46/drivers/hid/usbhid/hiddev.c 2011-04-17 15:56:46.000000000 -0400
31333 @@ -617,7 +617,7 @@ static long hiddev_ioctl(struct file *fi
31334 return put_user(HID_VERSION, (int __user *)arg);
31335
31336 case HIDIOCAPPLICATION:
31337 - if (arg < 0 || arg >= hid->maxapplication)
31338 + if (arg >= hid->maxapplication)
31339 return -EINVAL;
31340
31341 for (i = 0; i < hid->maxcollection; i++)
31342 diff -urNp linux-2.6.32.46/drivers/hwmon/lis3lv02d.c linux-2.6.32.46/drivers/hwmon/lis3lv02d.c
31343 --- linux-2.6.32.46/drivers/hwmon/lis3lv02d.c 2011-03-27 14:31:47.000000000 -0400
31344 +++ linux-2.6.32.46/drivers/hwmon/lis3lv02d.c 2011-05-04 17:56:28.000000000 -0400
31345 @@ -146,7 +146,7 @@ static irqreturn_t lis302dl_interrupt(in
31346 * the lid is closed. This leads to interrupts as soon as a little move
31347 * is done.
31348 */
31349 - atomic_inc(&lis3_dev.count);
31350 + atomic_inc_unchecked(&lis3_dev.count);
31351
31352 wake_up_interruptible(&lis3_dev.misc_wait);
31353 kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
31354 @@ -160,7 +160,7 @@ static int lis3lv02d_misc_open(struct in
31355 if (test_and_set_bit(0, &lis3_dev.misc_opened))
31356 return -EBUSY; /* already open */
31357
31358 - atomic_set(&lis3_dev.count, 0);
31359 + atomic_set_unchecked(&lis3_dev.count, 0);
31360
31361 /*
31362 * The sensor can generate interrupts for free-fall and direction
31363 @@ -206,7 +206,7 @@ static ssize_t lis3lv02d_misc_read(struc
31364 add_wait_queue(&lis3_dev.misc_wait, &wait);
31365 while (true) {
31366 set_current_state(TASK_INTERRUPTIBLE);
31367 - data = atomic_xchg(&lis3_dev.count, 0);
31368 + data = atomic_xchg_unchecked(&lis3_dev.count, 0);
31369 if (data)
31370 break;
31371
31372 @@ -244,7 +244,7 @@ out:
31373 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
31374 {
31375 poll_wait(file, &lis3_dev.misc_wait, wait);
31376 - if (atomic_read(&lis3_dev.count))
31377 + if (atomic_read_unchecked(&lis3_dev.count))
31378 return POLLIN | POLLRDNORM;
31379 return 0;
31380 }
31381 diff -urNp linux-2.6.32.46/drivers/hwmon/lis3lv02d.h linux-2.6.32.46/drivers/hwmon/lis3lv02d.h
31382 --- linux-2.6.32.46/drivers/hwmon/lis3lv02d.h 2011-03-27 14:31:47.000000000 -0400
31383 +++ linux-2.6.32.46/drivers/hwmon/lis3lv02d.h 2011-05-04 17:56:28.000000000 -0400
31384 @@ -201,7 +201,7 @@ struct lis3lv02d {
31385
31386 struct input_polled_dev *idev; /* input device */
31387 struct platform_device *pdev; /* platform device */
31388 - atomic_t count; /* interrupt count after last read */
31389 + atomic_unchecked_t count; /* interrupt count after last read */
31390 int xcalib; /* calibrated null value for x */
31391 int ycalib; /* calibrated null value for y */
31392 int zcalib; /* calibrated null value for z */
31393 diff -urNp linux-2.6.32.46/drivers/hwmon/sht15.c linux-2.6.32.46/drivers/hwmon/sht15.c
31394 --- linux-2.6.32.46/drivers/hwmon/sht15.c 2011-03-27 14:31:47.000000000 -0400
31395 +++ linux-2.6.32.46/drivers/hwmon/sht15.c 2011-05-04 17:56:28.000000000 -0400
31396 @@ -112,7 +112,7 @@ struct sht15_data {
31397 int supply_uV;
31398 int supply_uV_valid;
31399 struct work_struct update_supply_work;
31400 - atomic_t interrupt_handled;
31401 + atomic_unchecked_t interrupt_handled;
31402 };
31403
31404 /**
31405 @@ -245,13 +245,13 @@ static inline int sht15_update_single_va
31406 return ret;
31407
31408 gpio_direction_input(data->pdata->gpio_data);
31409 - atomic_set(&data->interrupt_handled, 0);
31410 + atomic_set_unchecked(&data->interrupt_handled, 0);
31411
31412 enable_irq(gpio_to_irq(data->pdata->gpio_data));
31413 if (gpio_get_value(data->pdata->gpio_data) == 0) {
31414 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
31415 /* Only relevant if the interrupt hasn't occured. */
31416 - if (!atomic_read(&data->interrupt_handled))
31417 + if (!atomic_read_unchecked(&data->interrupt_handled))
31418 schedule_work(&data->read_work);
31419 }
31420 ret = wait_event_timeout(data->wait_queue,
31421 @@ -398,7 +398,7 @@ static irqreturn_t sht15_interrupt_fired
31422 struct sht15_data *data = d;
31423 /* First disable the interrupt */
31424 disable_irq_nosync(irq);
31425 - atomic_inc(&data->interrupt_handled);
31426 + atomic_inc_unchecked(&data->interrupt_handled);
31427 /* Then schedule a reading work struct */
31428 if (data->flag != SHT15_READING_NOTHING)
31429 schedule_work(&data->read_work);
31430 @@ -449,11 +449,11 @@ static void sht15_bh_read_data(struct wo
31431 here as could have gone low in meantime so verify
31432 it hasn't!
31433 */
31434 - atomic_set(&data->interrupt_handled, 0);
31435 + atomic_set_unchecked(&data->interrupt_handled, 0);
31436 enable_irq(gpio_to_irq(data->pdata->gpio_data));
31437 /* If still not occured or another handler has been scheduled */
31438 if (gpio_get_value(data->pdata->gpio_data)
31439 - || atomic_read(&data->interrupt_handled))
31440 + || atomic_read_unchecked(&data->interrupt_handled))
31441 return;
31442 }
31443 /* Read the data back from the device */
31444 diff -urNp linux-2.6.32.46/drivers/hwmon/w83791d.c linux-2.6.32.46/drivers/hwmon/w83791d.c
31445 --- linux-2.6.32.46/drivers/hwmon/w83791d.c 2011-03-27 14:31:47.000000000 -0400
31446 +++ linux-2.6.32.46/drivers/hwmon/w83791d.c 2011-04-17 15:56:46.000000000 -0400
31447 @@ -330,8 +330,8 @@ static int w83791d_detect(struct i2c_cli
31448 struct i2c_board_info *info);
31449 static int w83791d_remove(struct i2c_client *client);
31450
31451 -static int w83791d_read(struct i2c_client *client, u8 register);
31452 -static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
31453 +static int w83791d_read(struct i2c_client *client, u8 reg);
31454 +static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
31455 static struct w83791d_data *w83791d_update_device(struct device *dev);
31456
31457 #ifdef DEBUG
31458 diff -urNp linux-2.6.32.46/drivers/i2c/busses/i2c-amd756-s4882.c linux-2.6.32.46/drivers/i2c/busses/i2c-amd756-s4882.c
31459 --- linux-2.6.32.46/drivers/i2c/busses/i2c-amd756-s4882.c 2011-03-27 14:31:47.000000000 -0400
31460 +++ linux-2.6.32.46/drivers/i2c/busses/i2c-amd756-s4882.c 2011-08-23 21:22:32.000000000 -0400
31461 @@ -43,7 +43,7 @@
31462 extern struct i2c_adapter amd756_smbus;
31463
31464 static struct i2c_adapter *s4882_adapter;
31465 -static struct i2c_algorithm *s4882_algo;
31466 +static i2c_algorithm_no_const *s4882_algo;
31467
31468 /* Wrapper access functions for multiplexed SMBus */
31469 static DEFINE_MUTEX(amd756_lock);
31470 diff -urNp linux-2.6.32.46/drivers/i2c/busses/i2c-nforce2-s4985.c linux-2.6.32.46/drivers/i2c/busses/i2c-nforce2-s4985.c
31471 --- linux-2.6.32.46/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-03-27 14:31:47.000000000 -0400
31472 +++ linux-2.6.32.46/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-08-23 21:22:32.000000000 -0400
31473 @@ -41,7 +41,7 @@
31474 extern struct i2c_adapter *nforce2_smbus;
31475
31476 static struct i2c_adapter *s4985_adapter;
31477 -static struct i2c_algorithm *s4985_algo;
31478 +static i2c_algorithm_no_const *s4985_algo;
31479
31480 /* Wrapper access functions for multiplexed SMBus */
31481 static DEFINE_MUTEX(nforce2_lock);
31482 diff -urNp linux-2.6.32.46/drivers/ide/ide-cd.c linux-2.6.32.46/drivers/ide/ide-cd.c
31483 --- linux-2.6.32.46/drivers/ide/ide-cd.c 2011-03-27 14:31:47.000000000 -0400
31484 +++ linux-2.6.32.46/drivers/ide/ide-cd.c 2011-04-17 15:56:46.000000000 -0400
31485 @@ -774,7 +774,7 @@ static void cdrom_do_block_pc(ide_drive_
31486 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
31487 if ((unsigned long)buf & alignment
31488 || blk_rq_bytes(rq) & q->dma_pad_mask
31489 - || object_is_on_stack(buf))
31490 + || object_starts_on_stack(buf))
31491 drive->dma = 0;
31492 }
31493 }
31494 diff -urNp linux-2.6.32.46/drivers/ide/ide-floppy.c linux-2.6.32.46/drivers/ide/ide-floppy.c
31495 --- linux-2.6.32.46/drivers/ide/ide-floppy.c 2011-03-27 14:31:47.000000000 -0400
31496 +++ linux-2.6.32.46/drivers/ide/ide-floppy.c 2011-05-16 21:46:57.000000000 -0400
31497 @@ -373,6 +373,8 @@ static int ide_floppy_get_capacity(ide_d
31498 u8 pc_buf[256], header_len, desc_cnt;
31499 int i, rc = 1, blocks, length;
31500
31501 + pax_track_stack();
31502 +
31503 ide_debug_log(IDE_DBG_FUNC, "enter");
31504
31505 drive->bios_cyl = 0;
31506 diff -urNp linux-2.6.32.46/drivers/ide/setup-pci.c linux-2.6.32.46/drivers/ide/setup-pci.c
31507 --- linux-2.6.32.46/drivers/ide/setup-pci.c 2011-03-27 14:31:47.000000000 -0400
31508 +++ linux-2.6.32.46/drivers/ide/setup-pci.c 2011-05-16 21:46:57.000000000 -0400
31509 @@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev
31510 int ret, i, n_ports = dev2 ? 4 : 2;
31511 struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
31512
31513 + pax_track_stack();
31514 +
31515 for (i = 0; i < n_ports / 2; i++) {
31516 ret = ide_setup_pci_controller(pdev[i], d, !i);
31517 if (ret < 0)
31518 diff -urNp linux-2.6.32.46/drivers/ieee1394/dv1394.c linux-2.6.32.46/drivers/ieee1394/dv1394.c
31519 --- linux-2.6.32.46/drivers/ieee1394/dv1394.c 2011-03-27 14:31:47.000000000 -0400
31520 +++ linux-2.6.32.46/drivers/ieee1394/dv1394.c 2011-04-23 12:56:11.000000000 -0400
31521 @@ -739,7 +739,7 @@ static void frame_prepare(struct video_c
31522 based upon DIF section and sequence
31523 */
31524
31525 -static void inline
31526 +static inline void
31527 frame_put_packet (struct frame *f, struct packet *p)
31528 {
31529 int section_type = p->data[0] >> 5; /* section type is in bits 5 - 7 */
31530 diff -urNp linux-2.6.32.46/drivers/ieee1394/hosts.c linux-2.6.32.46/drivers/ieee1394/hosts.c
31531 --- linux-2.6.32.46/drivers/ieee1394/hosts.c 2011-03-27 14:31:47.000000000 -0400
31532 +++ linux-2.6.32.46/drivers/ieee1394/hosts.c 2011-04-17 15:56:46.000000000 -0400
31533 @@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso
31534 }
31535
31536 static struct hpsb_host_driver dummy_driver = {
31537 + .name = "dummy",
31538 .transmit_packet = dummy_transmit_packet,
31539 .devctl = dummy_devctl,
31540 .isoctl = dummy_isoctl
31541 diff -urNp linux-2.6.32.46/drivers/ieee1394/init_ohci1394_dma.c linux-2.6.32.46/drivers/ieee1394/init_ohci1394_dma.c
31542 --- linux-2.6.32.46/drivers/ieee1394/init_ohci1394_dma.c 2011-03-27 14:31:47.000000000 -0400
31543 +++ linux-2.6.32.46/drivers/ieee1394/init_ohci1394_dma.c 2011-04-17 15:56:46.000000000 -0400
31544 @@ -257,7 +257,7 @@ void __init init_ohci1394_dma_on_all_con
31545 for (func = 0; func < 8; func++) {
31546 u32 class = read_pci_config(num,slot,func,
31547 PCI_CLASS_REVISION);
31548 - if ((class == 0xffffffff))
31549 + if (class == 0xffffffff)
31550 continue; /* No device at this func */
31551
31552 if (class>>8 != PCI_CLASS_SERIAL_FIREWIRE_OHCI)
31553 diff -urNp linux-2.6.32.46/drivers/ieee1394/ohci1394.c linux-2.6.32.46/drivers/ieee1394/ohci1394.c
31554 --- linux-2.6.32.46/drivers/ieee1394/ohci1394.c 2011-03-27 14:31:47.000000000 -0400
31555 +++ linux-2.6.32.46/drivers/ieee1394/ohci1394.c 2011-04-23 12:56:11.000000000 -0400
31556 @@ -147,9 +147,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_
31557 printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
31558
31559 /* Module Parameters */
31560 -static int phys_dma = 1;
31561 +static int phys_dma;
31562 module_param(phys_dma, int, 0444);
31563 -MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
31564 +MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
31565
31566 static void dma_trm_tasklet(unsigned long data);
31567 static void dma_trm_reset(struct dma_trm_ctx *d);
31568 diff -urNp linux-2.6.32.46/drivers/ieee1394/sbp2.c linux-2.6.32.46/drivers/ieee1394/sbp2.c
31569 --- linux-2.6.32.46/drivers/ieee1394/sbp2.c 2011-03-27 14:31:47.000000000 -0400
31570 +++ linux-2.6.32.46/drivers/ieee1394/sbp2.c 2011-04-23 12:56:11.000000000 -0400
31571 @@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 prot
31572 MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
31573 MODULE_LICENSE("GPL");
31574
31575 -static int sbp2_module_init(void)
31576 +static int __init sbp2_module_init(void)
31577 {
31578 int ret;
31579
31580 diff -urNp linux-2.6.32.46/drivers/infiniband/core/cm.c linux-2.6.32.46/drivers/infiniband/core/cm.c
31581 --- linux-2.6.32.46/drivers/infiniband/core/cm.c 2011-03-27 14:31:47.000000000 -0400
31582 +++ linux-2.6.32.46/drivers/infiniband/core/cm.c 2011-04-17 15:56:46.000000000 -0400
31583 @@ -112,7 +112,7 @@ static char const counter_group_names[CM
31584
31585 struct cm_counter_group {
31586 struct kobject obj;
31587 - atomic_long_t counter[CM_ATTR_COUNT];
31588 + atomic_long_unchecked_t counter[CM_ATTR_COUNT];
31589 };
31590
31591 struct cm_counter_attribute {
31592 @@ -1386,7 +1386,7 @@ static void cm_dup_req_handler(struct cm
31593 struct ib_mad_send_buf *msg = NULL;
31594 int ret;
31595
31596 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
31597 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
31598 counter[CM_REQ_COUNTER]);
31599
31600 /* Quick state check to discard duplicate REQs. */
31601 @@ -1764,7 +1764,7 @@ static void cm_dup_rep_handler(struct cm
31602 if (!cm_id_priv)
31603 return;
31604
31605 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
31606 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
31607 counter[CM_REP_COUNTER]);
31608 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
31609 if (ret)
31610 @@ -1931,7 +1931,7 @@ static int cm_rtu_handler(struct cm_work
31611 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
31612 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
31613 spin_unlock_irq(&cm_id_priv->lock);
31614 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
31615 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
31616 counter[CM_RTU_COUNTER]);
31617 goto out;
31618 }
31619 @@ -2110,7 +2110,7 @@ static int cm_dreq_handler(struct cm_wor
31620 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
31621 dreq_msg->local_comm_id);
31622 if (!cm_id_priv) {
31623 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
31624 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
31625 counter[CM_DREQ_COUNTER]);
31626 cm_issue_drep(work->port, work->mad_recv_wc);
31627 return -EINVAL;
31628 @@ -2131,7 +2131,7 @@ static int cm_dreq_handler(struct cm_wor
31629 case IB_CM_MRA_REP_RCVD:
31630 break;
31631 case IB_CM_TIMEWAIT:
31632 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
31633 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
31634 counter[CM_DREQ_COUNTER]);
31635 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
31636 goto unlock;
31637 @@ -2145,7 +2145,7 @@ static int cm_dreq_handler(struct cm_wor
31638 cm_free_msg(msg);
31639 goto deref;
31640 case IB_CM_DREQ_RCVD:
31641 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
31642 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
31643 counter[CM_DREQ_COUNTER]);
31644 goto unlock;
31645 default:
31646 @@ -2501,7 +2501,7 @@ static int cm_mra_handler(struct cm_work
31647 ib_modify_mad(cm_id_priv->av.port->mad_agent,
31648 cm_id_priv->msg, timeout)) {
31649 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
31650 - atomic_long_inc(&work->port->
31651 + atomic_long_inc_unchecked(&work->port->
31652 counter_group[CM_RECV_DUPLICATES].
31653 counter[CM_MRA_COUNTER]);
31654 goto out;
31655 @@ -2510,7 +2510,7 @@ static int cm_mra_handler(struct cm_work
31656 break;
31657 case IB_CM_MRA_REQ_RCVD:
31658 case IB_CM_MRA_REP_RCVD:
31659 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
31660 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
31661 counter[CM_MRA_COUNTER]);
31662 /* fall through */
31663 default:
31664 @@ -2672,7 +2672,7 @@ static int cm_lap_handler(struct cm_work
31665 case IB_CM_LAP_IDLE:
31666 break;
31667 case IB_CM_MRA_LAP_SENT:
31668 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
31669 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
31670 counter[CM_LAP_COUNTER]);
31671 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
31672 goto unlock;
31673 @@ -2688,7 +2688,7 @@ static int cm_lap_handler(struct cm_work
31674 cm_free_msg(msg);
31675 goto deref;
31676 case IB_CM_LAP_RCVD:
31677 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
31678 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
31679 counter[CM_LAP_COUNTER]);
31680 goto unlock;
31681 default:
31682 @@ -2972,7 +2972,7 @@ static int cm_sidr_req_handler(struct cm
31683 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
31684 if (cur_cm_id_priv) {
31685 spin_unlock_irq(&cm.lock);
31686 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
31687 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
31688 counter[CM_SIDR_REQ_COUNTER]);
31689 goto out; /* Duplicate message. */
31690 }
31691 @@ -3184,10 +3184,10 @@ static void cm_send_handler(struct ib_ma
31692 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
31693 msg->retries = 1;
31694
31695 - atomic_long_add(1 + msg->retries,
31696 + atomic_long_add_unchecked(1 + msg->retries,
31697 &port->counter_group[CM_XMIT].counter[attr_index]);
31698 if (msg->retries)
31699 - atomic_long_add(msg->retries,
31700 + atomic_long_add_unchecked(msg->retries,
31701 &port->counter_group[CM_XMIT_RETRIES].
31702 counter[attr_index]);
31703
31704 @@ -3397,7 +3397,7 @@ static void cm_recv_handler(struct ib_ma
31705 }
31706
31707 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
31708 - atomic_long_inc(&port->counter_group[CM_RECV].
31709 + atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
31710 counter[attr_id - CM_ATTR_ID_OFFSET]);
31711
31712 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
31713 @@ -3595,10 +3595,10 @@ static ssize_t cm_show_counter(struct ko
31714 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
31715
31716 return sprintf(buf, "%ld\n",
31717 - atomic_long_read(&group->counter[cm_attr->index]));
31718 + atomic_long_read_unchecked(&group->counter[cm_attr->index]));
31719 }
31720
31721 -static struct sysfs_ops cm_counter_ops = {
31722 +static const struct sysfs_ops cm_counter_ops = {
31723 .show = cm_show_counter
31724 };
31725
31726 diff -urNp linux-2.6.32.46/drivers/infiniband/core/fmr_pool.c linux-2.6.32.46/drivers/infiniband/core/fmr_pool.c
31727 --- linux-2.6.32.46/drivers/infiniband/core/fmr_pool.c 2011-03-27 14:31:47.000000000 -0400
31728 +++ linux-2.6.32.46/drivers/infiniband/core/fmr_pool.c 2011-05-04 17:56:28.000000000 -0400
31729 @@ -97,8 +97,8 @@ struct ib_fmr_pool {
31730
31731 struct task_struct *thread;
31732
31733 - atomic_t req_ser;
31734 - atomic_t flush_ser;
31735 + atomic_unchecked_t req_ser;
31736 + atomic_unchecked_t flush_ser;
31737
31738 wait_queue_head_t force_wait;
31739 };
31740 @@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *p
31741 struct ib_fmr_pool *pool = pool_ptr;
31742
31743 do {
31744 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
31745 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
31746 ib_fmr_batch_release(pool);
31747
31748 - atomic_inc(&pool->flush_ser);
31749 + atomic_inc_unchecked(&pool->flush_ser);
31750 wake_up_interruptible(&pool->force_wait);
31751
31752 if (pool->flush_function)
31753 @@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *p
31754 }
31755
31756 set_current_state(TASK_INTERRUPTIBLE);
31757 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
31758 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
31759 !kthread_should_stop())
31760 schedule();
31761 __set_current_state(TASK_RUNNING);
31762 @@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(s
31763 pool->dirty_watermark = params->dirty_watermark;
31764 pool->dirty_len = 0;
31765 spin_lock_init(&pool->pool_lock);
31766 - atomic_set(&pool->req_ser, 0);
31767 - atomic_set(&pool->flush_ser, 0);
31768 + atomic_set_unchecked(&pool->req_ser, 0);
31769 + atomic_set_unchecked(&pool->flush_ser, 0);
31770 init_waitqueue_head(&pool->force_wait);
31771
31772 pool->thread = kthread_run(ib_fmr_cleanup_thread,
31773 @@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool
31774 }
31775 spin_unlock_irq(&pool->pool_lock);
31776
31777 - serial = atomic_inc_return(&pool->req_ser);
31778 + serial = atomic_inc_return_unchecked(&pool->req_ser);
31779 wake_up_process(pool->thread);
31780
31781 if (wait_event_interruptible(pool->force_wait,
31782 - atomic_read(&pool->flush_ser) - serial >= 0))
31783 + atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
31784 return -EINTR;
31785
31786 return 0;
31787 @@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr
31788 } else {
31789 list_add_tail(&fmr->list, &pool->dirty_list);
31790 if (++pool->dirty_len >= pool->dirty_watermark) {
31791 - atomic_inc(&pool->req_ser);
31792 + atomic_inc_unchecked(&pool->req_ser);
31793 wake_up_process(pool->thread);
31794 }
31795 }
31796 diff -urNp linux-2.6.32.46/drivers/infiniband/core/sysfs.c linux-2.6.32.46/drivers/infiniband/core/sysfs.c
31797 --- linux-2.6.32.46/drivers/infiniband/core/sysfs.c 2011-03-27 14:31:47.000000000 -0400
31798 +++ linux-2.6.32.46/drivers/infiniband/core/sysfs.c 2011-04-17 15:56:46.000000000 -0400
31799 @@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kob
31800 return port_attr->show(p, port_attr, buf);
31801 }
31802
31803 -static struct sysfs_ops port_sysfs_ops = {
31804 +static const struct sysfs_ops port_sysfs_ops = {
31805 .show = port_attr_show
31806 };
31807
31808 diff -urNp linux-2.6.32.46/drivers/infiniband/core/uverbs_marshall.c linux-2.6.32.46/drivers/infiniband/core/uverbs_marshall.c
31809 --- linux-2.6.32.46/drivers/infiniband/core/uverbs_marshall.c 2011-03-27 14:31:47.000000000 -0400
31810 +++ linux-2.6.32.46/drivers/infiniband/core/uverbs_marshall.c 2011-04-17 15:56:46.000000000 -0400
31811 @@ -40,18 +40,21 @@ void ib_copy_ah_attr_to_user(struct ib_u
31812 dst->grh.sgid_index = src->grh.sgid_index;
31813 dst->grh.hop_limit = src->grh.hop_limit;
31814 dst->grh.traffic_class = src->grh.traffic_class;
31815 + memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved));
31816 dst->dlid = src->dlid;
31817 dst->sl = src->sl;
31818 dst->src_path_bits = src->src_path_bits;
31819 dst->static_rate = src->static_rate;
31820 dst->is_global = src->ah_flags & IB_AH_GRH ? 1 : 0;
31821 dst->port_num = src->port_num;
31822 + dst->reserved = 0;
31823 }
31824 EXPORT_SYMBOL(ib_copy_ah_attr_to_user);
31825
31826 void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
31827 struct ib_qp_attr *src)
31828 {
31829 + dst->qp_state = src->qp_state;
31830 dst->cur_qp_state = src->cur_qp_state;
31831 dst->path_mtu = src->path_mtu;
31832 dst->path_mig_state = src->path_mig_state;
31833 @@ -83,6 +86,7 @@ void ib_copy_qp_attr_to_user(struct ib_u
31834 dst->rnr_retry = src->rnr_retry;
31835 dst->alt_port_num = src->alt_port_num;
31836 dst->alt_timeout = src->alt_timeout;
31837 + memset(dst->reserved, 0, sizeof(dst->reserved));
31838 }
31839 EXPORT_SYMBOL(ib_copy_qp_attr_to_user);
31840
31841 diff -urNp linux-2.6.32.46/drivers/infiniband/hw/ipath/ipath_fs.c linux-2.6.32.46/drivers/infiniband/hw/ipath/ipath_fs.c
31842 --- linux-2.6.32.46/drivers/infiniband/hw/ipath/ipath_fs.c 2011-03-27 14:31:47.000000000 -0400
31843 +++ linux-2.6.32.46/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-16 21:46:57.000000000 -0400
31844 @@ -110,6 +110,8 @@ static ssize_t atomic_counters_read(stru
31845 struct infinipath_counters counters;
31846 struct ipath_devdata *dd;
31847
31848 + pax_track_stack();
31849 +
31850 dd = file->f_path.dentry->d_inode->i_private;
31851 dd->ipath_f_read_counters(dd, &counters);
31852
31853 diff -urNp linux-2.6.32.46/drivers/infiniband/hw/nes/nes.c linux-2.6.32.46/drivers/infiniband/hw/nes/nes.c
31854 --- linux-2.6.32.46/drivers/infiniband/hw/nes/nes.c 2011-03-27 14:31:47.000000000 -0400
31855 +++ linux-2.6.32.46/drivers/infiniband/hw/nes/nes.c 2011-05-04 17:56:28.000000000 -0400
31856 @@ -102,7 +102,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limi
31857 LIST_HEAD(nes_adapter_list);
31858 static LIST_HEAD(nes_dev_list);
31859
31860 -atomic_t qps_destroyed;
31861 +atomic_unchecked_t qps_destroyed;
31862
31863 static unsigned int ee_flsh_adapter;
31864 static unsigned int sysfs_nonidx_addr;
31865 @@ -259,7 +259,7 @@ static void nes_cqp_rem_ref_callback(str
31866 struct nes_adapter *nesadapter = nesdev->nesadapter;
31867 u32 qp_id;
31868
31869 - atomic_inc(&qps_destroyed);
31870 + atomic_inc_unchecked(&qps_destroyed);
31871
31872 /* Free the control structures */
31873
31874 diff -urNp linux-2.6.32.46/drivers/infiniband/hw/nes/nes_cm.c linux-2.6.32.46/drivers/infiniband/hw/nes/nes_cm.c
31875 --- linux-2.6.32.46/drivers/infiniband/hw/nes/nes_cm.c 2011-03-27 14:31:47.000000000 -0400
31876 +++ linux-2.6.32.46/drivers/infiniband/hw/nes/nes_cm.c 2011-05-04 17:56:28.000000000 -0400
31877 @@ -69,11 +69,11 @@ u32 cm_packets_received;
31878 u32 cm_listens_created;
31879 u32 cm_listens_destroyed;
31880 u32 cm_backlog_drops;
31881 -atomic_t cm_loopbacks;
31882 -atomic_t cm_nodes_created;
31883 -atomic_t cm_nodes_destroyed;
31884 -atomic_t cm_accel_dropped_pkts;
31885 -atomic_t cm_resets_recvd;
31886 +atomic_unchecked_t cm_loopbacks;
31887 +atomic_unchecked_t cm_nodes_created;
31888 +atomic_unchecked_t cm_nodes_destroyed;
31889 +atomic_unchecked_t cm_accel_dropped_pkts;
31890 +atomic_unchecked_t cm_resets_recvd;
31891
31892 static inline int mini_cm_accelerated(struct nes_cm_core *,
31893 struct nes_cm_node *);
31894 @@ -149,13 +149,13 @@ static struct nes_cm_ops nes_cm_api = {
31895
31896 static struct nes_cm_core *g_cm_core;
31897
31898 -atomic_t cm_connects;
31899 -atomic_t cm_accepts;
31900 -atomic_t cm_disconnects;
31901 -atomic_t cm_closes;
31902 -atomic_t cm_connecteds;
31903 -atomic_t cm_connect_reqs;
31904 -atomic_t cm_rejects;
31905 +atomic_unchecked_t cm_connects;
31906 +atomic_unchecked_t cm_accepts;
31907 +atomic_unchecked_t cm_disconnects;
31908 +atomic_unchecked_t cm_closes;
31909 +atomic_unchecked_t cm_connecteds;
31910 +atomic_unchecked_t cm_connect_reqs;
31911 +atomic_unchecked_t cm_rejects;
31912
31913
31914 /**
31915 @@ -1195,7 +1195,7 @@ static struct nes_cm_node *make_cm_node(
31916 cm_node->rem_mac);
31917
31918 add_hte_node(cm_core, cm_node);
31919 - atomic_inc(&cm_nodes_created);
31920 + atomic_inc_unchecked(&cm_nodes_created);
31921
31922 return cm_node;
31923 }
31924 @@ -1253,7 +1253,7 @@ static int rem_ref_cm_node(struct nes_cm
31925 }
31926
31927 atomic_dec(&cm_core->node_cnt);
31928 - atomic_inc(&cm_nodes_destroyed);
31929 + atomic_inc_unchecked(&cm_nodes_destroyed);
31930 nesqp = cm_node->nesqp;
31931 if (nesqp) {
31932 nesqp->cm_node = NULL;
31933 @@ -1320,7 +1320,7 @@ static int process_options(struct nes_cm
31934
31935 static void drop_packet(struct sk_buff *skb)
31936 {
31937 - atomic_inc(&cm_accel_dropped_pkts);
31938 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
31939 dev_kfree_skb_any(skb);
31940 }
31941
31942 @@ -1377,7 +1377,7 @@ static void handle_rst_pkt(struct nes_cm
31943
31944 int reset = 0; /* whether to send reset in case of err.. */
31945 int passive_state;
31946 - atomic_inc(&cm_resets_recvd);
31947 + atomic_inc_unchecked(&cm_resets_recvd);
31948 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
31949 " refcnt=%d\n", cm_node, cm_node->state,
31950 atomic_read(&cm_node->ref_count));
31951 @@ -2000,7 +2000,7 @@ static struct nes_cm_node *mini_cm_conne
31952 rem_ref_cm_node(cm_node->cm_core, cm_node);
31953 return NULL;
31954 }
31955 - atomic_inc(&cm_loopbacks);
31956 + atomic_inc_unchecked(&cm_loopbacks);
31957 loopbackremotenode->loopbackpartner = cm_node;
31958 loopbackremotenode->tcp_cntxt.rcv_wscale =
31959 NES_CM_DEFAULT_RCV_WND_SCALE;
31960 @@ -2262,7 +2262,7 @@ static int mini_cm_recv_pkt(struct nes_c
31961 add_ref_cm_node(cm_node);
31962 } else if (cm_node->state == NES_CM_STATE_TSA) {
31963 rem_ref_cm_node(cm_core, cm_node);
31964 - atomic_inc(&cm_accel_dropped_pkts);
31965 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
31966 dev_kfree_skb_any(skb);
31967 break;
31968 }
31969 @@ -2568,7 +2568,7 @@ static int nes_cm_disconn_true(struct ne
31970
31971 if ((cm_id) && (cm_id->event_handler)) {
31972 if (issue_disconn) {
31973 - atomic_inc(&cm_disconnects);
31974 + atomic_inc_unchecked(&cm_disconnects);
31975 cm_event.event = IW_CM_EVENT_DISCONNECT;
31976 cm_event.status = disconn_status;
31977 cm_event.local_addr = cm_id->local_addr;
31978 @@ -2590,7 +2590,7 @@ static int nes_cm_disconn_true(struct ne
31979 }
31980
31981 if (issue_close) {
31982 - atomic_inc(&cm_closes);
31983 + atomic_inc_unchecked(&cm_closes);
31984 nes_disconnect(nesqp, 1);
31985
31986 cm_id->provider_data = nesqp;
31987 @@ -2710,7 +2710,7 @@ int nes_accept(struct iw_cm_id *cm_id, s
31988
31989 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
31990 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
31991 - atomic_inc(&cm_accepts);
31992 + atomic_inc_unchecked(&cm_accepts);
31993
31994 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
31995 atomic_read(&nesvnic->netdev->refcnt));
31996 @@ -2919,7 +2919,7 @@ int nes_reject(struct iw_cm_id *cm_id, c
31997
31998 struct nes_cm_core *cm_core;
31999
32000 - atomic_inc(&cm_rejects);
32001 + atomic_inc_unchecked(&cm_rejects);
32002 cm_node = (struct nes_cm_node *) cm_id->provider_data;
32003 loopback = cm_node->loopbackpartner;
32004 cm_core = cm_node->cm_core;
32005 @@ -2982,7 +2982,7 @@ int nes_connect(struct iw_cm_id *cm_id,
32006 ntohl(cm_id->local_addr.sin_addr.s_addr),
32007 ntohs(cm_id->local_addr.sin_port));
32008
32009 - atomic_inc(&cm_connects);
32010 + atomic_inc_unchecked(&cm_connects);
32011 nesqp->active_conn = 1;
32012
32013 /* cache the cm_id in the qp */
32014 @@ -3195,7 +3195,7 @@ static void cm_event_connected(struct ne
32015 if (nesqp->destroyed) {
32016 return;
32017 }
32018 - atomic_inc(&cm_connecteds);
32019 + atomic_inc_unchecked(&cm_connecteds);
32020 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
32021 " local port 0x%04X. jiffies = %lu.\n",
32022 nesqp->hwqp.qp_id,
32023 @@ -3403,7 +3403,7 @@ static void cm_event_reset(struct nes_cm
32024
32025 ret = cm_id->event_handler(cm_id, &cm_event);
32026 cm_id->add_ref(cm_id);
32027 - atomic_inc(&cm_closes);
32028 + atomic_inc_unchecked(&cm_closes);
32029 cm_event.event = IW_CM_EVENT_CLOSE;
32030 cm_event.status = IW_CM_EVENT_STATUS_OK;
32031 cm_event.provider_data = cm_id->provider_data;
32032 @@ -3439,7 +3439,7 @@ static void cm_event_mpa_req(struct nes_
32033 return;
32034 cm_id = cm_node->cm_id;
32035
32036 - atomic_inc(&cm_connect_reqs);
32037 + atomic_inc_unchecked(&cm_connect_reqs);
32038 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
32039 cm_node, cm_id, jiffies);
32040
32041 @@ -3477,7 +3477,7 @@ static void cm_event_mpa_reject(struct n
32042 return;
32043 cm_id = cm_node->cm_id;
32044
32045 - atomic_inc(&cm_connect_reqs);
32046 + atomic_inc_unchecked(&cm_connect_reqs);
32047 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
32048 cm_node, cm_id, jiffies);
32049
32050 diff -urNp linux-2.6.32.46/drivers/infiniband/hw/nes/nes.h linux-2.6.32.46/drivers/infiniband/hw/nes/nes.h
32051 --- linux-2.6.32.46/drivers/infiniband/hw/nes/nes.h 2011-03-27 14:31:47.000000000 -0400
32052 +++ linux-2.6.32.46/drivers/infiniband/hw/nes/nes.h 2011-05-04 17:56:28.000000000 -0400
32053 @@ -174,17 +174,17 @@ extern unsigned int nes_debug_level;
32054 extern unsigned int wqm_quanta;
32055 extern struct list_head nes_adapter_list;
32056
32057 -extern atomic_t cm_connects;
32058 -extern atomic_t cm_accepts;
32059 -extern atomic_t cm_disconnects;
32060 -extern atomic_t cm_closes;
32061 -extern atomic_t cm_connecteds;
32062 -extern atomic_t cm_connect_reqs;
32063 -extern atomic_t cm_rejects;
32064 -extern atomic_t mod_qp_timouts;
32065 -extern atomic_t qps_created;
32066 -extern atomic_t qps_destroyed;
32067 -extern atomic_t sw_qps_destroyed;
32068 +extern atomic_unchecked_t cm_connects;
32069 +extern atomic_unchecked_t cm_accepts;
32070 +extern atomic_unchecked_t cm_disconnects;
32071 +extern atomic_unchecked_t cm_closes;
32072 +extern atomic_unchecked_t cm_connecteds;
32073 +extern atomic_unchecked_t cm_connect_reqs;
32074 +extern atomic_unchecked_t cm_rejects;
32075 +extern atomic_unchecked_t mod_qp_timouts;
32076 +extern atomic_unchecked_t qps_created;
32077 +extern atomic_unchecked_t qps_destroyed;
32078 +extern atomic_unchecked_t sw_qps_destroyed;
32079 extern u32 mh_detected;
32080 extern u32 mh_pauses_sent;
32081 extern u32 cm_packets_sent;
32082 @@ -196,11 +196,11 @@ extern u32 cm_packets_retrans;
32083 extern u32 cm_listens_created;
32084 extern u32 cm_listens_destroyed;
32085 extern u32 cm_backlog_drops;
32086 -extern atomic_t cm_loopbacks;
32087 -extern atomic_t cm_nodes_created;
32088 -extern atomic_t cm_nodes_destroyed;
32089 -extern atomic_t cm_accel_dropped_pkts;
32090 -extern atomic_t cm_resets_recvd;
32091 +extern atomic_unchecked_t cm_loopbacks;
32092 +extern atomic_unchecked_t cm_nodes_created;
32093 +extern atomic_unchecked_t cm_nodes_destroyed;
32094 +extern atomic_unchecked_t cm_accel_dropped_pkts;
32095 +extern atomic_unchecked_t cm_resets_recvd;
32096
32097 extern u32 int_mod_timer_init;
32098 extern u32 int_mod_cq_depth_256;
32099 diff -urNp linux-2.6.32.46/drivers/infiniband/hw/nes/nes_nic.c linux-2.6.32.46/drivers/infiniband/hw/nes/nes_nic.c
32100 --- linux-2.6.32.46/drivers/infiniband/hw/nes/nes_nic.c 2011-03-27 14:31:47.000000000 -0400
32101 +++ linux-2.6.32.46/drivers/infiniband/hw/nes/nes_nic.c 2011-05-04 17:56:28.000000000 -0400
32102 @@ -1210,17 +1210,17 @@ static void nes_netdev_get_ethtool_stats
32103 target_stat_values[++index] = mh_detected;
32104 target_stat_values[++index] = mh_pauses_sent;
32105 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
32106 - target_stat_values[++index] = atomic_read(&cm_connects);
32107 - target_stat_values[++index] = atomic_read(&cm_accepts);
32108 - target_stat_values[++index] = atomic_read(&cm_disconnects);
32109 - target_stat_values[++index] = atomic_read(&cm_connecteds);
32110 - target_stat_values[++index] = atomic_read(&cm_connect_reqs);
32111 - target_stat_values[++index] = atomic_read(&cm_rejects);
32112 - target_stat_values[++index] = atomic_read(&mod_qp_timouts);
32113 - target_stat_values[++index] = atomic_read(&qps_created);
32114 - target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
32115 - target_stat_values[++index] = atomic_read(&qps_destroyed);
32116 - target_stat_values[++index] = atomic_read(&cm_closes);
32117 + target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
32118 + target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
32119 + target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
32120 + target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
32121 + target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
32122 + target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
32123 + target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
32124 + target_stat_values[++index] = atomic_read_unchecked(&qps_created);
32125 + target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
32126 + target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
32127 + target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
32128 target_stat_values[++index] = cm_packets_sent;
32129 target_stat_values[++index] = cm_packets_bounced;
32130 target_stat_values[++index] = cm_packets_created;
32131 @@ -1230,11 +1230,11 @@ static void nes_netdev_get_ethtool_stats
32132 target_stat_values[++index] = cm_listens_created;
32133 target_stat_values[++index] = cm_listens_destroyed;
32134 target_stat_values[++index] = cm_backlog_drops;
32135 - target_stat_values[++index] = atomic_read(&cm_loopbacks);
32136 - target_stat_values[++index] = atomic_read(&cm_nodes_created);
32137 - target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
32138 - target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
32139 - target_stat_values[++index] = atomic_read(&cm_resets_recvd);
32140 + target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
32141 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
32142 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
32143 + target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
32144 + target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
32145 target_stat_values[++index] = int_mod_timer_init;
32146 target_stat_values[++index] = int_mod_cq_depth_1;
32147 target_stat_values[++index] = int_mod_cq_depth_4;
32148 diff -urNp linux-2.6.32.46/drivers/infiniband/hw/nes/nes_verbs.c linux-2.6.32.46/drivers/infiniband/hw/nes/nes_verbs.c
32149 --- linux-2.6.32.46/drivers/infiniband/hw/nes/nes_verbs.c 2011-03-27 14:31:47.000000000 -0400
32150 +++ linux-2.6.32.46/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-04 17:56:28.000000000 -0400
32151 @@ -45,9 +45,9 @@
32152
32153 #include <rdma/ib_umem.h>
32154
32155 -atomic_t mod_qp_timouts;
32156 -atomic_t qps_created;
32157 -atomic_t sw_qps_destroyed;
32158 +atomic_unchecked_t mod_qp_timouts;
32159 +atomic_unchecked_t qps_created;
32160 +atomic_unchecked_t sw_qps_destroyed;
32161
32162 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
32163
32164 @@ -1240,7 +1240,7 @@ static struct ib_qp *nes_create_qp(struc
32165 if (init_attr->create_flags)
32166 return ERR_PTR(-EINVAL);
32167
32168 - atomic_inc(&qps_created);
32169 + atomic_inc_unchecked(&qps_created);
32170 switch (init_attr->qp_type) {
32171 case IB_QPT_RC:
32172 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
32173 @@ -1568,7 +1568,7 @@ static int nes_destroy_qp(struct ib_qp *
32174 struct iw_cm_event cm_event;
32175 int ret;
32176
32177 - atomic_inc(&sw_qps_destroyed);
32178 + atomic_inc_unchecked(&sw_qps_destroyed);
32179 nesqp->destroyed = 1;
32180
32181 /* Blow away the connection if it exists. */
32182 diff -urNp linux-2.6.32.46/drivers/input/gameport/gameport.c linux-2.6.32.46/drivers/input/gameport/gameport.c
32183 --- linux-2.6.32.46/drivers/input/gameport/gameport.c 2011-03-27 14:31:47.000000000 -0400
32184 +++ linux-2.6.32.46/drivers/input/gameport/gameport.c 2011-05-04 17:56:28.000000000 -0400
32185 @@ -515,13 +515,13 @@ EXPORT_SYMBOL(gameport_set_phys);
32186 */
32187 static void gameport_init_port(struct gameport *gameport)
32188 {
32189 - static atomic_t gameport_no = ATOMIC_INIT(0);
32190 + static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
32191
32192 __module_get(THIS_MODULE);
32193
32194 mutex_init(&gameport->drv_mutex);
32195 device_initialize(&gameport->dev);
32196 - dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return(&gameport_no) - 1);
32197 + dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
32198 gameport->dev.bus = &gameport_bus;
32199 gameport->dev.release = gameport_release_port;
32200 if (gameport->parent)
32201 diff -urNp linux-2.6.32.46/drivers/input/input.c linux-2.6.32.46/drivers/input/input.c
32202 --- linux-2.6.32.46/drivers/input/input.c 2011-03-27 14:31:47.000000000 -0400
32203 +++ linux-2.6.32.46/drivers/input/input.c 2011-05-04 17:56:28.000000000 -0400
32204 @@ -1558,7 +1558,7 @@ EXPORT_SYMBOL(input_set_capability);
32205 */
32206 int input_register_device(struct input_dev *dev)
32207 {
32208 - static atomic_t input_no = ATOMIC_INIT(0);
32209 + static atomic_unchecked_t input_no = ATOMIC_INIT(0);
32210 struct input_handler *handler;
32211 const char *path;
32212 int error;
32213 @@ -1585,7 +1585,7 @@ int input_register_device(struct input_d
32214 dev->setkeycode = input_default_setkeycode;
32215
32216 dev_set_name(&dev->dev, "input%ld",
32217 - (unsigned long) atomic_inc_return(&input_no) - 1);
32218 + (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
32219
32220 error = device_add(&dev->dev);
32221 if (error)
32222 diff -urNp linux-2.6.32.46/drivers/input/joystick/sidewinder.c linux-2.6.32.46/drivers/input/joystick/sidewinder.c
32223 --- linux-2.6.32.46/drivers/input/joystick/sidewinder.c 2011-03-27 14:31:47.000000000 -0400
32224 +++ linux-2.6.32.46/drivers/input/joystick/sidewinder.c 2011-05-18 20:09:36.000000000 -0400
32225 @@ -30,6 +30,7 @@
32226 #include <linux/kernel.h>
32227 #include <linux/module.h>
32228 #include <linux/slab.h>
32229 +#include <linux/sched.h>
32230 #include <linux/init.h>
32231 #include <linux/input.h>
32232 #include <linux/gameport.h>
32233 @@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
32234 unsigned char buf[SW_LENGTH];
32235 int i;
32236
32237 + pax_track_stack();
32238 +
32239 i = sw_read_packet(sw->gameport, buf, sw->length, 0);
32240
32241 if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
32242 diff -urNp linux-2.6.32.46/drivers/input/joystick/xpad.c linux-2.6.32.46/drivers/input/joystick/xpad.c
32243 --- linux-2.6.32.46/drivers/input/joystick/xpad.c 2011-03-27 14:31:47.000000000 -0400
32244 +++ linux-2.6.32.46/drivers/input/joystick/xpad.c 2011-05-04 17:56:28.000000000 -0400
32245 @@ -621,7 +621,7 @@ static void xpad_led_set(struct led_clas
32246
32247 static int xpad_led_probe(struct usb_xpad *xpad)
32248 {
32249 - static atomic_t led_seq = ATOMIC_INIT(0);
32250 + static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
32251 long led_no;
32252 struct xpad_led *led;
32253 struct led_classdev *led_cdev;
32254 @@ -634,7 +634,7 @@ static int xpad_led_probe(struct usb_xpa
32255 if (!led)
32256 return -ENOMEM;
32257
32258 - led_no = (long)atomic_inc_return(&led_seq) - 1;
32259 + led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
32260
32261 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
32262 led->xpad = xpad;
32263 diff -urNp linux-2.6.32.46/drivers/input/serio/serio.c linux-2.6.32.46/drivers/input/serio/serio.c
32264 --- linux-2.6.32.46/drivers/input/serio/serio.c 2011-03-27 14:31:47.000000000 -0400
32265 +++ linux-2.6.32.46/drivers/input/serio/serio.c 2011-05-04 17:56:28.000000000 -0400
32266 @@ -527,7 +527,7 @@ static void serio_release_port(struct de
32267 */
32268 static void serio_init_port(struct serio *serio)
32269 {
32270 - static atomic_t serio_no = ATOMIC_INIT(0);
32271 + static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
32272
32273 __module_get(THIS_MODULE);
32274
32275 @@ -536,7 +536,7 @@ static void serio_init_port(struct serio
32276 mutex_init(&serio->drv_mutex);
32277 device_initialize(&serio->dev);
32278 dev_set_name(&serio->dev, "serio%ld",
32279 - (long)atomic_inc_return(&serio_no) - 1);
32280 + (long)atomic_inc_return_unchecked(&serio_no) - 1);
32281 serio->dev.bus = &serio_bus;
32282 serio->dev.release = serio_release_port;
32283 if (serio->parent) {
32284 diff -urNp linux-2.6.32.46/drivers/isdn/gigaset/common.c linux-2.6.32.46/drivers/isdn/gigaset/common.c
32285 --- linux-2.6.32.46/drivers/isdn/gigaset/common.c 2011-03-27 14:31:47.000000000 -0400
32286 +++ linux-2.6.32.46/drivers/isdn/gigaset/common.c 2011-04-17 15:56:46.000000000 -0400
32287 @@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct
32288 cs->commands_pending = 0;
32289 cs->cur_at_seq = 0;
32290 cs->gotfwver = -1;
32291 - cs->open_count = 0;
32292 + local_set(&cs->open_count, 0);
32293 cs->dev = NULL;
32294 cs->tty = NULL;
32295 cs->tty_dev = NULL;
32296 diff -urNp linux-2.6.32.46/drivers/isdn/gigaset/gigaset.h linux-2.6.32.46/drivers/isdn/gigaset/gigaset.h
32297 --- linux-2.6.32.46/drivers/isdn/gigaset/gigaset.h 2011-03-27 14:31:47.000000000 -0400
32298 +++ linux-2.6.32.46/drivers/isdn/gigaset/gigaset.h 2011-04-17 15:56:46.000000000 -0400
32299 @@ -34,6 +34,7 @@
32300 #include <linux/tty_driver.h>
32301 #include <linux/list.h>
32302 #include <asm/atomic.h>
32303 +#include <asm/local.h>
32304
32305 #define GIG_VERSION {0,5,0,0}
32306 #define GIG_COMPAT {0,4,0,0}
32307 @@ -446,7 +447,7 @@ struct cardstate {
32308 spinlock_t cmdlock;
32309 unsigned curlen, cmdbytes;
32310
32311 - unsigned open_count;
32312 + local_t open_count;
32313 struct tty_struct *tty;
32314 struct tasklet_struct if_wake_tasklet;
32315 unsigned control_state;
32316 diff -urNp linux-2.6.32.46/drivers/isdn/gigaset/interface.c linux-2.6.32.46/drivers/isdn/gigaset/interface.c
32317 --- linux-2.6.32.46/drivers/isdn/gigaset/interface.c 2011-03-27 14:31:47.000000000 -0400
32318 +++ linux-2.6.32.46/drivers/isdn/gigaset/interface.c 2011-04-17 15:56:46.000000000 -0400
32319 @@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tt
32320 return -ERESTARTSYS; // FIXME -EINTR?
32321 tty->driver_data = cs;
32322
32323 - ++cs->open_count;
32324 -
32325 - if (cs->open_count == 1) {
32326 + if (local_inc_return(&cs->open_count) == 1) {
32327 spin_lock_irqsave(&cs->lock, flags);
32328 cs->tty = tty;
32329 spin_unlock_irqrestore(&cs->lock, flags);
32330 @@ -195,10 +193,10 @@ static void if_close(struct tty_struct *
32331
32332 if (!cs->connected)
32333 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
32334 - else if (!cs->open_count)
32335 + else if (!local_read(&cs->open_count))
32336 dev_warn(cs->dev, "%s: device not opened\n", __func__);
32337 else {
32338 - if (!--cs->open_count) {
32339 + if (!local_dec_return(&cs->open_count)) {
32340 spin_lock_irqsave(&cs->lock, flags);
32341 cs->tty = NULL;
32342 spin_unlock_irqrestore(&cs->lock, flags);
32343 @@ -233,7 +231,7 @@ static int if_ioctl(struct tty_struct *t
32344 if (!cs->connected) {
32345 gig_dbg(DEBUG_IF, "not connected");
32346 retval = -ENODEV;
32347 - } else if (!cs->open_count)
32348 + } else if (!local_read(&cs->open_count))
32349 dev_warn(cs->dev, "%s: device not opened\n", __func__);
32350 else {
32351 retval = 0;
32352 @@ -361,7 +359,7 @@ static int if_write(struct tty_struct *t
32353 if (!cs->connected) {
32354 gig_dbg(DEBUG_IF, "not connected");
32355 retval = -ENODEV;
32356 - } else if (!cs->open_count)
32357 + } else if (!local_read(&cs->open_count))
32358 dev_warn(cs->dev, "%s: device not opened\n", __func__);
32359 else if (cs->mstate != MS_LOCKED) {
32360 dev_warn(cs->dev, "can't write to unlocked device\n");
32361 @@ -395,7 +393,7 @@ static int if_write_room(struct tty_stru
32362 if (!cs->connected) {
32363 gig_dbg(DEBUG_IF, "not connected");
32364 retval = -ENODEV;
32365 - } else if (!cs->open_count)
32366 + } else if (!local_read(&cs->open_count))
32367 dev_warn(cs->dev, "%s: device not opened\n", __func__);
32368 else if (cs->mstate != MS_LOCKED) {
32369 dev_warn(cs->dev, "can't write to unlocked device\n");
32370 @@ -425,7 +423,7 @@ static int if_chars_in_buffer(struct tty
32371
32372 if (!cs->connected)
32373 gig_dbg(DEBUG_IF, "not connected");
32374 - else if (!cs->open_count)
32375 + else if (!local_read(&cs->open_count))
32376 dev_warn(cs->dev, "%s: device not opened\n", __func__);
32377 else if (cs->mstate != MS_LOCKED)
32378 dev_warn(cs->dev, "can't write to unlocked device\n");
32379 @@ -453,7 +451,7 @@ static void if_throttle(struct tty_struc
32380
32381 if (!cs->connected)
32382 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
32383 - else if (!cs->open_count)
32384 + else if (!local_read(&cs->open_count))
32385 dev_warn(cs->dev, "%s: device not opened\n", __func__);
32386 else {
32387 //FIXME
32388 @@ -478,7 +476,7 @@ static void if_unthrottle(struct tty_str
32389
32390 if (!cs->connected)
32391 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
32392 - else if (!cs->open_count)
32393 + else if (!local_read(&cs->open_count))
32394 dev_warn(cs->dev, "%s: device not opened\n", __func__);
32395 else {
32396 //FIXME
32397 @@ -510,7 +508,7 @@ static void if_set_termios(struct tty_st
32398 goto out;
32399 }
32400
32401 - if (!cs->open_count) {
32402 + if (!local_read(&cs->open_count)) {
32403 dev_warn(cs->dev, "%s: device not opened\n", __func__);
32404 goto out;
32405 }
32406 diff -urNp linux-2.6.32.46/drivers/isdn/hardware/avm/b1.c linux-2.6.32.46/drivers/isdn/hardware/avm/b1.c
32407 --- linux-2.6.32.46/drivers/isdn/hardware/avm/b1.c 2011-03-27 14:31:47.000000000 -0400
32408 +++ linux-2.6.32.46/drivers/isdn/hardware/avm/b1.c 2011-04-17 15:56:46.000000000 -0400
32409 @@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capilo
32410 }
32411 if (left) {
32412 if (t4file->user) {
32413 - if (copy_from_user(buf, dp, left))
32414 + if (left > sizeof buf || copy_from_user(buf, dp, left))
32415 return -EFAULT;
32416 } else {
32417 memcpy(buf, dp, left);
32418 @@ -221,7 +221,7 @@ int b1_load_config(avmcard *card, capilo
32419 }
32420 if (left) {
32421 if (config->user) {
32422 - if (copy_from_user(buf, dp, left))
32423 + if (left > sizeof buf || copy_from_user(buf, dp, left))
32424 return -EFAULT;
32425 } else {
32426 memcpy(buf, dp, left);
32427 diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/capidtmf.c linux-2.6.32.46/drivers/isdn/hardware/eicon/capidtmf.c
32428 --- linux-2.6.32.46/drivers/isdn/hardware/eicon/capidtmf.c 2011-03-27 14:31:47.000000000 -0400
32429 +++ linux-2.6.32.46/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-16 21:46:57.000000000 -0400
32430 @@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_sta
32431 byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
32432 short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
32433
32434 + pax_track_stack();
32435
32436 if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
32437 {
32438 diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/capifunc.c linux-2.6.32.46/drivers/isdn/hardware/eicon/capifunc.c
32439 --- linux-2.6.32.46/drivers/isdn/hardware/eicon/capifunc.c 2011-03-27 14:31:47.000000000 -0400
32440 +++ linux-2.6.32.46/drivers/isdn/hardware/eicon/capifunc.c 2011-05-16 21:46:57.000000000 -0400
32441 @@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
32442 IDI_SYNC_REQ req;
32443 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
32444
32445 + pax_track_stack();
32446 +
32447 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
32448
32449 for (x = 0; x < MAX_DESCRIPTORS; x++) {
32450 diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/diddfunc.c linux-2.6.32.46/drivers/isdn/hardware/eicon/diddfunc.c
32451 --- linux-2.6.32.46/drivers/isdn/hardware/eicon/diddfunc.c 2011-03-27 14:31:47.000000000 -0400
32452 +++ linux-2.6.32.46/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-16 21:46:57.000000000 -0400
32453 @@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_di
32454 IDI_SYNC_REQ req;
32455 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
32456
32457 + pax_track_stack();
32458 +
32459 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
32460
32461 for (x = 0; x < MAX_DESCRIPTORS; x++) {
32462 diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/divasfunc.c linux-2.6.32.46/drivers/isdn/hardware/eicon/divasfunc.c
32463 --- linux-2.6.32.46/drivers/isdn/hardware/eicon/divasfunc.c 2011-03-27 14:31:47.000000000 -0400
32464 +++ linux-2.6.32.46/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-16 21:46:57.000000000 -0400
32465 @@ -161,6 +161,8 @@ static int DIVA_INIT_FUNCTION connect_di
32466 IDI_SYNC_REQ req;
32467 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
32468
32469 + pax_track_stack();
32470 +
32471 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
32472
32473 for (x = 0; x < MAX_DESCRIPTORS; x++) {
32474 diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/divasync.h linux-2.6.32.46/drivers/isdn/hardware/eicon/divasync.h
32475 --- linux-2.6.32.46/drivers/isdn/hardware/eicon/divasync.h 2011-03-27 14:31:47.000000000 -0400
32476 +++ linux-2.6.32.46/drivers/isdn/hardware/eicon/divasync.h 2011-08-05 20:33:55.000000000 -0400
32477 @@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
32478 } diva_didd_add_adapter_t;
32479 typedef struct _diva_didd_remove_adapter {
32480 IDI_CALL p_request;
32481 -} diva_didd_remove_adapter_t;
32482 +} __no_const diva_didd_remove_adapter_t;
32483 typedef struct _diva_didd_read_adapter_array {
32484 void * buffer;
32485 dword length;
32486 diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/idifunc.c linux-2.6.32.46/drivers/isdn/hardware/eicon/idifunc.c
32487 --- linux-2.6.32.46/drivers/isdn/hardware/eicon/idifunc.c 2011-03-27 14:31:47.000000000 -0400
32488 +++ linux-2.6.32.46/drivers/isdn/hardware/eicon/idifunc.c 2011-05-16 21:46:57.000000000 -0400
32489 @@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_di
32490 IDI_SYNC_REQ req;
32491 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
32492
32493 + pax_track_stack();
32494 +
32495 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
32496
32497 for (x = 0; x < MAX_DESCRIPTORS; x++) {
32498 diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/message.c linux-2.6.32.46/drivers/isdn/hardware/eicon/message.c
32499 --- linux-2.6.32.46/drivers/isdn/hardware/eicon/message.c 2011-03-27 14:31:47.000000000 -0400
32500 +++ linux-2.6.32.46/drivers/isdn/hardware/eicon/message.c 2011-05-16 21:46:57.000000000 -0400
32501 @@ -4889,6 +4889,8 @@ static void sig_ind(PLCI *plci)
32502 dword d;
32503 word w;
32504
32505 + pax_track_stack();
32506 +
32507 a = plci->adapter;
32508 Id = ((word)plci->Id<<8)|a->Id;
32509 PUT_WORD(&SS_Ind[4],0x0000);
32510 @@ -7484,6 +7486,8 @@ static word add_b1(PLCI *plci, API_PARSE
32511 word j, n, w;
32512 dword d;
32513
32514 + pax_track_stack();
32515 +
32516
32517 for(i=0;i<8;i++) bp_parms[i].length = 0;
32518 for(i=0;i<2;i++) global_config[i].length = 0;
32519 @@ -7958,6 +7962,8 @@ static word add_b23(PLCI *plci, API_PARS
32520 const byte llc3[] = {4,3,2,2,6,6,0};
32521 const byte header[] = {0,2,3,3,0,0,0};
32522
32523 + pax_track_stack();
32524 +
32525 for(i=0;i<8;i++) bp_parms[i].length = 0;
32526 for(i=0;i<6;i++) b2_config_parms[i].length = 0;
32527 for(i=0;i<5;i++) b3_config_parms[i].length = 0;
32528 @@ -14761,6 +14767,8 @@ static void group_optimization(DIVA_CAPI
32529 word appl_number_group_type[MAX_APPL];
32530 PLCI *auxplci;
32531
32532 + pax_track_stack();
32533 +
32534 set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
32535
32536 if(!a->group_optimization_enabled)
32537 diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/mntfunc.c linux-2.6.32.46/drivers/isdn/hardware/eicon/mntfunc.c
32538 --- linux-2.6.32.46/drivers/isdn/hardware/eicon/mntfunc.c 2011-03-27 14:31:47.000000000 -0400
32539 +++ linux-2.6.32.46/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-16 21:46:57.000000000 -0400
32540 @@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_di
32541 IDI_SYNC_REQ req;
32542 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
32543
32544 + pax_track_stack();
32545 +
32546 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
32547
32548 for (x = 0; x < MAX_DESCRIPTORS; x++) {
32549 diff -urNp linux-2.6.32.46/drivers/isdn/hardware/eicon/xdi_adapter.h linux-2.6.32.46/drivers/isdn/hardware/eicon/xdi_adapter.h
32550 --- linux-2.6.32.46/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-03-27 14:31:47.000000000 -0400
32551 +++ linux-2.6.32.46/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-08-05 20:33:55.000000000 -0400
32552 @@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
32553 typedef struct _diva_os_idi_adapter_interface {
32554 diva_init_card_proc_t cleanup_adapter_proc;
32555 diva_cmd_card_proc_t cmd_proc;
32556 -} diva_os_idi_adapter_interface_t;
32557 +} __no_const diva_os_idi_adapter_interface_t;
32558
32559 typedef struct _diva_os_xdi_adapter {
32560 struct list_head link;
32561 diff -urNp linux-2.6.32.46/drivers/isdn/i4l/isdn_common.c linux-2.6.32.46/drivers/isdn/i4l/isdn_common.c
32562 --- linux-2.6.32.46/drivers/isdn/i4l/isdn_common.c 2011-03-27 14:31:47.000000000 -0400
32563 +++ linux-2.6.32.46/drivers/isdn/i4l/isdn_common.c 2011-05-16 21:46:57.000000000 -0400
32564 @@ -1290,6 +1290,8 @@ isdn_ioctl(struct inode *inode, struct f
32565 } iocpar;
32566 void __user *argp = (void __user *)arg;
32567
32568 + pax_track_stack();
32569 +
32570 #define name iocpar.name
32571 #define bname iocpar.bname
32572 #define iocts iocpar.iocts
32573 diff -urNp linux-2.6.32.46/drivers/isdn/icn/icn.c linux-2.6.32.46/drivers/isdn/icn/icn.c
32574 --- linux-2.6.32.46/drivers/isdn/icn/icn.c 2011-03-27 14:31:47.000000000 -0400
32575 +++ linux-2.6.32.46/drivers/isdn/icn/icn.c 2011-04-17 15:56:46.000000000 -0400
32576 @@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len
32577 if (count > len)
32578 count = len;
32579 if (user) {
32580 - if (copy_from_user(msg, buf, count))
32581 + if (count > sizeof msg || copy_from_user(msg, buf, count))
32582 return -EFAULT;
32583 } else
32584 memcpy(msg, buf, count);
32585 diff -urNp linux-2.6.32.46/drivers/isdn/mISDN/socket.c linux-2.6.32.46/drivers/isdn/mISDN/socket.c
32586 --- linux-2.6.32.46/drivers/isdn/mISDN/socket.c 2011-03-27 14:31:47.000000000 -0400
32587 +++ linux-2.6.32.46/drivers/isdn/mISDN/socket.c 2011-04-17 15:56:46.000000000 -0400
32588 @@ -391,6 +391,7 @@ data_sock_ioctl(struct socket *sock, uns
32589 if (dev) {
32590 struct mISDN_devinfo di;
32591
32592 + memset(&di, 0, sizeof(di));
32593 di.id = dev->id;
32594 di.Dprotocols = dev->Dprotocols;
32595 di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
32596 @@ -671,6 +672,7 @@ base_sock_ioctl(struct socket *sock, uns
32597 if (dev) {
32598 struct mISDN_devinfo di;
32599
32600 + memset(&di, 0, sizeof(di));
32601 di.id = dev->id;
32602 di.Dprotocols = dev->Dprotocols;
32603 di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
32604 diff -urNp linux-2.6.32.46/drivers/isdn/sc/interrupt.c linux-2.6.32.46/drivers/isdn/sc/interrupt.c
32605 --- linux-2.6.32.46/drivers/isdn/sc/interrupt.c 2011-03-27 14:31:47.000000000 -0400
32606 +++ linux-2.6.32.46/drivers/isdn/sc/interrupt.c 2011-04-17 15:56:46.000000000 -0400
32607 @@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy,
32608 }
32609 else if(callid>=0x0000 && callid<=0x7FFF)
32610 {
32611 + int len;
32612 +
32613 pr_debug("%s: Got Incoming Call\n",
32614 sc_adapter[card]->devicename);
32615 - strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4]));
32616 - strcpy(setup.eazmsn,
32617 - sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn);
32618 + len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]),
32619 + sizeof(setup.phone));
32620 + if (len >= sizeof(setup.phone))
32621 + continue;
32622 + len = strlcpy(setup.eazmsn,
32623 + sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
32624 + sizeof(setup.eazmsn));
32625 + if (len >= sizeof(setup.eazmsn))
32626 + continue;
32627 setup.si1 = 7;
32628 setup.si2 = 0;
32629 setup.plan = 0;
32630 @@ -176,7 +184,9 @@ irqreturn_t interrupt_handler(int dummy,
32631 * Handle a GetMyNumber Rsp
32632 */
32633 if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){
32634 - strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array);
32635 + strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
32636 + rcvmsg.msg_data.byte_array,
32637 + sizeof(rcvmsg.msg_data.byte_array));
32638 continue;
32639 }
32640
32641 diff -urNp linux-2.6.32.46/drivers/lguest/core.c linux-2.6.32.46/drivers/lguest/core.c
32642 --- linux-2.6.32.46/drivers/lguest/core.c 2011-03-27 14:31:47.000000000 -0400
32643 +++ linux-2.6.32.46/drivers/lguest/core.c 2011-04-17 15:56:46.000000000 -0400
32644 @@ -91,9 +91,17 @@ static __init int map_switcher(void)
32645 * it's worked so far. The end address needs +1 because __get_vm_area
32646 * allocates an extra guard page, so we need space for that.
32647 */
32648 +
32649 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
32650 + switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
32651 + VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
32652 + + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
32653 +#else
32654 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
32655 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
32656 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
32657 +#endif
32658 +
32659 if (!switcher_vma) {
32660 err = -ENOMEM;
32661 printk("lguest: could not map switcher pages high\n");
32662 @@ -118,7 +126,7 @@ static __init int map_switcher(void)
32663 * Now the Switcher is mapped at the right address, we can't fail!
32664 * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
32665 */
32666 - memcpy(switcher_vma->addr, start_switcher_text,
32667 + memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
32668 end_switcher_text - start_switcher_text);
32669
32670 printk(KERN_INFO "lguest: mapped switcher at %p\n",
32671 diff -urNp linux-2.6.32.46/drivers/lguest/x86/core.c linux-2.6.32.46/drivers/lguest/x86/core.c
32672 --- linux-2.6.32.46/drivers/lguest/x86/core.c 2011-03-27 14:31:47.000000000 -0400
32673 +++ linux-2.6.32.46/drivers/lguest/x86/core.c 2011-04-17 15:56:46.000000000 -0400
32674 @@ -59,7 +59,7 @@ static struct {
32675 /* Offset from where switcher.S was compiled to where we've copied it */
32676 static unsigned long switcher_offset(void)
32677 {
32678 - return SWITCHER_ADDR - (unsigned long)start_switcher_text;
32679 + return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
32680 }
32681
32682 /* This cpu's struct lguest_pages. */
32683 @@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg
32684 * These copies are pretty cheap, so we do them unconditionally: */
32685 /* Save the current Host top-level page directory.
32686 */
32687 +
32688 +#ifdef CONFIG_PAX_PER_CPU_PGD
32689 + pages->state.host_cr3 = read_cr3();
32690 +#else
32691 pages->state.host_cr3 = __pa(current->mm->pgd);
32692 +#endif
32693 +
32694 /*
32695 * Set up the Guest's page tables to see this CPU's pages (and no
32696 * other CPU's pages).
32697 @@ -535,7 +541,7 @@ void __init lguest_arch_host_init(void)
32698 * compiled-in switcher code and the high-mapped copy we just made.
32699 */
32700 for (i = 0; i < IDT_ENTRIES; i++)
32701 - default_idt_entries[i] += switcher_offset();
32702 + default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
32703
32704 /*
32705 * Set up the Switcher's per-cpu areas.
32706 @@ -618,7 +624,7 @@ void __init lguest_arch_host_init(void)
32707 * it will be undisturbed when we switch. To change %cs and jump we
32708 * need this structure to feed to Intel's "lcall" instruction.
32709 */
32710 - lguest_entry.offset = (long)switch_to_guest + switcher_offset();
32711 + lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
32712 lguest_entry.segment = LGUEST_CS;
32713
32714 /*
32715 diff -urNp linux-2.6.32.46/drivers/lguest/x86/switcher_32.S linux-2.6.32.46/drivers/lguest/x86/switcher_32.S
32716 --- linux-2.6.32.46/drivers/lguest/x86/switcher_32.S 2011-03-27 14:31:47.000000000 -0400
32717 +++ linux-2.6.32.46/drivers/lguest/x86/switcher_32.S 2011-04-17 15:56:46.000000000 -0400
32718 @@ -87,6 +87,7 @@
32719 #include <asm/page.h>
32720 #include <asm/segment.h>
32721 #include <asm/lguest.h>
32722 +#include <asm/processor-flags.h>
32723
32724 // We mark the start of the code to copy
32725 // It's placed in .text tho it's never run here
32726 @@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
32727 // Changes type when we load it: damn Intel!
32728 // For after we switch over our page tables
32729 // That entry will be read-only: we'd crash.
32730 +
32731 +#ifdef CONFIG_PAX_KERNEXEC
32732 + mov %cr0, %edx
32733 + xor $X86_CR0_WP, %edx
32734 + mov %edx, %cr0
32735 +#endif
32736 +
32737 movl $(GDT_ENTRY_TSS*8), %edx
32738 ltr %dx
32739
32740 @@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
32741 // Let's clear it again for our return.
32742 // The GDT descriptor of the Host
32743 // Points to the table after two "size" bytes
32744 - movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
32745 + movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
32746 // Clear "used" from type field (byte 5, bit 2)
32747 - andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
32748 + andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
32749 +
32750 +#ifdef CONFIG_PAX_KERNEXEC
32751 + mov %cr0, %eax
32752 + xor $X86_CR0_WP, %eax
32753 + mov %eax, %cr0
32754 +#endif
32755
32756 // Once our page table's switched, the Guest is live!
32757 // The Host fades as we run this final step.
32758 @@ -295,13 +309,12 @@ deliver_to_host:
32759 // I consulted gcc, and it gave
32760 // These instructions, which I gladly credit:
32761 leal (%edx,%ebx,8), %eax
32762 - movzwl (%eax),%edx
32763 - movl 4(%eax), %eax
32764 - xorw %ax, %ax
32765 - orl %eax, %edx
32766 + movl 4(%eax), %edx
32767 + movw (%eax), %dx
32768 // Now the address of the handler's in %edx
32769 // We call it now: its "iret" drops us home.
32770 - jmp *%edx
32771 + ljmp $__KERNEL_CS, $1f
32772 +1: jmp *%edx
32773
32774 // Every interrupt can come to us here
32775 // But we must truly tell each apart.
32776 diff -urNp linux-2.6.32.46/drivers/macintosh/via-pmu-backlight.c linux-2.6.32.46/drivers/macintosh/via-pmu-backlight.c
32777 --- linux-2.6.32.46/drivers/macintosh/via-pmu-backlight.c 2011-03-27 14:31:47.000000000 -0400
32778 +++ linux-2.6.32.46/drivers/macintosh/via-pmu-backlight.c 2011-04-17 15:56:46.000000000 -0400
32779 @@ -15,7 +15,7 @@
32780
32781 #define MAX_PMU_LEVEL 0xFF
32782
32783 -static struct backlight_ops pmu_backlight_data;
32784 +static const struct backlight_ops pmu_backlight_data;
32785 static DEFINE_SPINLOCK(pmu_backlight_lock);
32786 static int sleeping, uses_pmu_bl;
32787 static u8 bl_curve[FB_BACKLIGHT_LEVELS];
32788 @@ -115,7 +115,7 @@ static int pmu_backlight_get_brightness(
32789 return bd->props.brightness;
32790 }
32791
32792 -static struct backlight_ops pmu_backlight_data = {
32793 +static const struct backlight_ops pmu_backlight_data = {
32794 .get_brightness = pmu_backlight_get_brightness,
32795 .update_status = pmu_backlight_update_status,
32796
32797 diff -urNp linux-2.6.32.46/drivers/macintosh/via-pmu.c linux-2.6.32.46/drivers/macintosh/via-pmu.c
32798 --- linux-2.6.32.46/drivers/macintosh/via-pmu.c 2011-03-27 14:31:47.000000000 -0400
32799 +++ linux-2.6.32.46/drivers/macintosh/via-pmu.c 2011-04-17 15:56:46.000000000 -0400
32800 @@ -2232,7 +2232,7 @@ static int pmu_sleep_valid(suspend_state
32801 && (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
32802 }
32803
32804 -static struct platform_suspend_ops pmu_pm_ops = {
32805 +static const struct platform_suspend_ops pmu_pm_ops = {
32806 .enter = powerbook_sleep,
32807 .valid = pmu_sleep_valid,
32808 };
32809 diff -urNp linux-2.6.32.46/drivers/md/dm.c linux-2.6.32.46/drivers/md/dm.c
32810 --- linux-2.6.32.46/drivers/md/dm.c 2011-08-09 18:35:29.000000000 -0400
32811 +++ linux-2.6.32.46/drivers/md/dm.c 2011-08-09 18:33:59.000000000 -0400
32812 @@ -165,9 +165,9 @@ struct mapped_device {
32813 /*
32814 * Event handling.
32815 */
32816 - atomic_t event_nr;
32817 + atomic_unchecked_t event_nr;
32818 wait_queue_head_t eventq;
32819 - atomic_t uevent_seq;
32820 + atomic_unchecked_t uevent_seq;
32821 struct list_head uevent_list;
32822 spinlock_t uevent_lock; /* Protect access to uevent_list */
32823
32824 @@ -1776,8 +1776,8 @@ static struct mapped_device *alloc_dev(i
32825 rwlock_init(&md->map_lock);
32826 atomic_set(&md->holders, 1);
32827 atomic_set(&md->open_count, 0);
32828 - atomic_set(&md->event_nr, 0);
32829 - atomic_set(&md->uevent_seq, 0);
32830 + atomic_set_unchecked(&md->event_nr, 0);
32831 + atomic_set_unchecked(&md->uevent_seq, 0);
32832 INIT_LIST_HEAD(&md->uevent_list);
32833 spin_lock_init(&md->uevent_lock);
32834
32835 @@ -1927,7 +1927,7 @@ static void event_callback(void *context
32836
32837 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
32838
32839 - atomic_inc(&md->event_nr);
32840 + atomic_inc_unchecked(&md->event_nr);
32841 wake_up(&md->eventq);
32842 }
32843
32844 @@ -2562,18 +2562,18 @@ void dm_kobject_uevent(struct mapped_dev
32845
32846 uint32_t dm_next_uevent_seq(struct mapped_device *md)
32847 {
32848 - return atomic_add_return(1, &md->uevent_seq);
32849 + return atomic_add_return_unchecked(1, &md->uevent_seq);
32850 }
32851
32852 uint32_t dm_get_event_nr(struct mapped_device *md)
32853 {
32854 - return atomic_read(&md->event_nr);
32855 + return atomic_read_unchecked(&md->event_nr);
32856 }
32857
32858 int dm_wait_event(struct mapped_device *md, int event_nr)
32859 {
32860 return wait_event_interruptible(md->eventq,
32861 - (event_nr != atomic_read(&md->event_nr)));
32862 + (event_nr != atomic_read_unchecked(&md->event_nr)));
32863 }
32864
32865 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
32866 diff -urNp linux-2.6.32.46/drivers/md/dm-ioctl.c linux-2.6.32.46/drivers/md/dm-ioctl.c
32867 --- linux-2.6.32.46/drivers/md/dm-ioctl.c 2011-03-27 14:31:47.000000000 -0400
32868 +++ linux-2.6.32.46/drivers/md/dm-ioctl.c 2011-04-17 15:56:46.000000000 -0400
32869 @@ -1437,7 +1437,7 @@ static int validate_params(uint cmd, str
32870 cmd == DM_LIST_VERSIONS_CMD)
32871 return 0;
32872
32873 - if ((cmd == DM_DEV_CREATE_CMD)) {
32874 + if (cmd == DM_DEV_CREATE_CMD) {
32875 if (!*param->name) {
32876 DMWARN("name not supplied when creating device");
32877 return -EINVAL;
32878 diff -urNp linux-2.6.32.46/drivers/md/dm-raid1.c linux-2.6.32.46/drivers/md/dm-raid1.c
32879 --- linux-2.6.32.46/drivers/md/dm-raid1.c 2011-03-27 14:31:47.000000000 -0400
32880 +++ linux-2.6.32.46/drivers/md/dm-raid1.c 2011-05-04 17:56:28.000000000 -0400
32881 @@ -41,7 +41,7 @@ enum dm_raid1_error {
32882
32883 struct mirror {
32884 struct mirror_set *ms;
32885 - atomic_t error_count;
32886 + atomic_unchecked_t error_count;
32887 unsigned long error_type;
32888 struct dm_dev *dev;
32889 sector_t offset;
32890 @@ -203,7 +203,7 @@ static void fail_mirror(struct mirror *m
32891 * simple way to tell if a device has encountered
32892 * errors.
32893 */
32894 - atomic_inc(&m->error_count);
32895 + atomic_inc_unchecked(&m->error_count);
32896
32897 if (test_and_set_bit(error_type, &m->error_type))
32898 return;
32899 @@ -225,7 +225,7 @@ static void fail_mirror(struct mirror *m
32900 }
32901
32902 for (new = ms->mirror; new < ms->mirror + ms->nr_mirrors; new++)
32903 - if (!atomic_read(&new->error_count)) {
32904 + if (!atomic_read_unchecked(&new->error_count)) {
32905 set_default_mirror(new);
32906 break;
32907 }
32908 @@ -363,7 +363,7 @@ static struct mirror *choose_mirror(stru
32909 struct mirror *m = get_default_mirror(ms);
32910
32911 do {
32912 - if (likely(!atomic_read(&m->error_count)))
32913 + if (likely(!atomic_read_unchecked(&m->error_count)))
32914 return m;
32915
32916 if (m-- == ms->mirror)
32917 @@ -377,7 +377,7 @@ static int default_ok(struct mirror *m)
32918 {
32919 struct mirror *default_mirror = get_default_mirror(m->ms);
32920
32921 - return !atomic_read(&default_mirror->error_count);
32922 + return !atomic_read_unchecked(&default_mirror->error_count);
32923 }
32924
32925 static int mirror_available(struct mirror_set *ms, struct bio *bio)
32926 @@ -484,7 +484,7 @@ static void do_reads(struct mirror_set *
32927 */
32928 if (likely(region_in_sync(ms, region, 1)))
32929 m = choose_mirror(ms, bio->bi_sector);
32930 - else if (m && atomic_read(&m->error_count))
32931 + else if (m && atomic_read_unchecked(&m->error_count))
32932 m = NULL;
32933
32934 if (likely(m))
32935 @@ -855,7 +855,7 @@ static int get_mirror(struct mirror_set
32936 }
32937
32938 ms->mirror[mirror].ms = ms;
32939 - atomic_set(&(ms->mirror[mirror].error_count), 0);
32940 + atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
32941 ms->mirror[mirror].error_type = 0;
32942 ms->mirror[mirror].offset = offset;
32943
32944 @@ -1241,7 +1241,7 @@ static void mirror_resume(struct dm_targ
32945 */
32946 static char device_status_char(struct mirror *m)
32947 {
32948 - if (!atomic_read(&(m->error_count)))
32949 + if (!atomic_read_unchecked(&(m->error_count)))
32950 return 'A';
32951
32952 return (test_bit(DM_RAID1_WRITE_ERROR, &(m->error_type))) ? 'D' :
32953 diff -urNp linux-2.6.32.46/drivers/md/dm-stripe.c linux-2.6.32.46/drivers/md/dm-stripe.c
32954 --- linux-2.6.32.46/drivers/md/dm-stripe.c 2011-03-27 14:31:47.000000000 -0400
32955 +++ linux-2.6.32.46/drivers/md/dm-stripe.c 2011-05-04 17:56:28.000000000 -0400
32956 @@ -20,7 +20,7 @@ struct stripe {
32957 struct dm_dev *dev;
32958 sector_t physical_start;
32959
32960 - atomic_t error_count;
32961 + atomic_unchecked_t error_count;
32962 };
32963
32964 struct stripe_c {
32965 @@ -188,7 +188,7 @@ static int stripe_ctr(struct dm_target *
32966 kfree(sc);
32967 return r;
32968 }
32969 - atomic_set(&(sc->stripe[i].error_count), 0);
32970 + atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
32971 }
32972
32973 ti->private = sc;
32974 @@ -257,7 +257,7 @@ static int stripe_status(struct dm_targe
32975 DMEMIT("%d ", sc->stripes);
32976 for (i = 0; i < sc->stripes; i++) {
32977 DMEMIT("%s ", sc->stripe[i].dev->name);
32978 - buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
32979 + buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
32980 'D' : 'A';
32981 }
32982 buffer[i] = '\0';
32983 @@ -304,8 +304,8 @@ static int stripe_end_io(struct dm_targe
32984 */
32985 for (i = 0; i < sc->stripes; i++)
32986 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
32987 - atomic_inc(&(sc->stripe[i].error_count));
32988 - if (atomic_read(&(sc->stripe[i].error_count)) <
32989 + atomic_inc_unchecked(&(sc->stripe[i].error_count));
32990 + if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
32991 DM_IO_ERROR_THRESHOLD)
32992 queue_work(kstriped, &sc->kstriped_ws);
32993 }
32994 diff -urNp linux-2.6.32.46/drivers/md/dm-sysfs.c linux-2.6.32.46/drivers/md/dm-sysfs.c
32995 --- linux-2.6.32.46/drivers/md/dm-sysfs.c 2011-03-27 14:31:47.000000000 -0400
32996 +++ linux-2.6.32.46/drivers/md/dm-sysfs.c 2011-04-17 15:56:46.000000000 -0400
32997 @@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
32998 NULL,
32999 };
33000
33001 -static struct sysfs_ops dm_sysfs_ops = {
33002 +static const struct sysfs_ops dm_sysfs_ops = {
33003 .show = dm_attr_show,
33004 };
33005
33006 diff -urNp linux-2.6.32.46/drivers/md/dm-table.c linux-2.6.32.46/drivers/md/dm-table.c
33007 --- linux-2.6.32.46/drivers/md/dm-table.c 2011-06-25 12:55:34.000000000 -0400
33008 +++ linux-2.6.32.46/drivers/md/dm-table.c 2011-06-25 12:56:37.000000000 -0400
33009 @@ -376,7 +376,7 @@ static int device_area_is_invalid(struct
33010 if (!dev_size)
33011 return 0;
33012
33013 - if ((start >= dev_size) || (start + len > dev_size)) {
33014 + if ((start >= dev_size) || (len > dev_size - start)) {
33015 DMWARN("%s: %s too small for target: "
33016 "start=%llu, len=%llu, dev_size=%llu",
33017 dm_device_name(ti->table->md), bdevname(bdev, b),
33018 diff -urNp linux-2.6.32.46/drivers/md/md.c linux-2.6.32.46/drivers/md/md.c
33019 --- linux-2.6.32.46/drivers/md/md.c 2011-07-13 17:23:04.000000000 -0400
33020 +++ linux-2.6.32.46/drivers/md/md.c 2011-07-13 17:23:18.000000000 -0400
33021 @@ -153,10 +153,10 @@ static int start_readonly;
33022 * start build, activate spare
33023 */
33024 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
33025 -static atomic_t md_event_count;
33026 +static atomic_unchecked_t md_event_count;
33027 void md_new_event(mddev_t *mddev)
33028 {
33029 - atomic_inc(&md_event_count);
33030 + atomic_inc_unchecked(&md_event_count);
33031 wake_up(&md_event_waiters);
33032 }
33033 EXPORT_SYMBOL_GPL(md_new_event);
33034 @@ -166,7 +166,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
33035 */
33036 static void md_new_event_inintr(mddev_t *mddev)
33037 {
33038 - atomic_inc(&md_event_count);
33039 + atomic_inc_unchecked(&md_event_count);
33040 wake_up(&md_event_waiters);
33041 }
33042
33043 @@ -1218,7 +1218,7 @@ static int super_1_load(mdk_rdev_t *rdev
33044
33045 rdev->preferred_minor = 0xffff;
33046 rdev->data_offset = le64_to_cpu(sb->data_offset);
33047 - atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
33048 + atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
33049
33050 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
33051 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
33052 @@ -1392,7 +1392,7 @@ static void super_1_sync(mddev_t *mddev,
33053 else
33054 sb->resync_offset = cpu_to_le64(0);
33055
33056 - sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
33057 + sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
33058
33059 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
33060 sb->size = cpu_to_le64(mddev->dev_sectors);
33061 @@ -2214,7 +2214,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_sho
33062 static ssize_t
33063 errors_show(mdk_rdev_t *rdev, char *page)
33064 {
33065 - return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
33066 + return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
33067 }
33068
33069 static ssize_t
33070 @@ -2223,7 +2223,7 @@ errors_store(mdk_rdev_t *rdev, const cha
33071 char *e;
33072 unsigned long n = simple_strtoul(buf, &e, 10);
33073 if (*buf && (*e == 0 || *e == '\n')) {
33074 - atomic_set(&rdev->corrected_errors, n);
33075 + atomic_set_unchecked(&rdev->corrected_errors, n);
33076 return len;
33077 }
33078 return -EINVAL;
33079 @@ -2517,7 +2517,7 @@ static void rdev_free(struct kobject *ko
33080 mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
33081 kfree(rdev);
33082 }
33083 -static struct sysfs_ops rdev_sysfs_ops = {
33084 +static const struct sysfs_ops rdev_sysfs_ops = {
33085 .show = rdev_attr_show,
33086 .store = rdev_attr_store,
33087 };
33088 @@ -2566,8 +2566,8 @@ static mdk_rdev_t *md_import_device(dev_
33089 rdev->data_offset = 0;
33090 rdev->sb_events = 0;
33091 atomic_set(&rdev->nr_pending, 0);
33092 - atomic_set(&rdev->read_errors, 0);
33093 - atomic_set(&rdev->corrected_errors, 0);
33094 + atomic_set_unchecked(&rdev->read_errors, 0);
33095 + atomic_set_unchecked(&rdev->corrected_errors, 0);
33096
33097 size = rdev->bdev->bd_inode->i_size >> BLOCK_SIZE_BITS;
33098 if (!size) {
33099 @@ -3887,7 +3887,7 @@ static void md_free(struct kobject *ko)
33100 kfree(mddev);
33101 }
33102
33103 -static struct sysfs_ops md_sysfs_ops = {
33104 +static const struct sysfs_ops md_sysfs_ops = {
33105 .show = md_attr_show,
33106 .store = md_attr_store,
33107 };
33108 @@ -4474,7 +4474,8 @@ out:
33109 err = 0;
33110 blk_integrity_unregister(disk);
33111 md_new_event(mddev);
33112 - sysfs_notify_dirent(mddev->sysfs_state);
33113 + if (mddev->sysfs_state)
33114 + sysfs_notify_dirent(mddev->sysfs_state);
33115 return err;
33116 }
33117
33118 @@ -5954,7 +5955,7 @@ static int md_seq_show(struct seq_file *
33119
33120 spin_unlock(&pers_lock);
33121 seq_printf(seq, "\n");
33122 - mi->event = atomic_read(&md_event_count);
33123 + mi->event = atomic_read_unchecked(&md_event_count);
33124 return 0;
33125 }
33126 if (v == (void*)2) {
33127 @@ -6043,7 +6044,7 @@ static int md_seq_show(struct seq_file *
33128 chunk_kb ? "KB" : "B");
33129 if (bitmap->file) {
33130 seq_printf(seq, ", file: ");
33131 - seq_path(seq, &bitmap->file->f_path, " \t\n");
33132 + seq_path(seq, &bitmap->file->f_path, " \t\n\\");
33133 }
33134
33135 seq_printf(seq, "\n");
33136 @@ -6077,7 +6078,7 @@ static int md_seq_open(struct inode *ino
33137 else {
33138 struct seq_file *p = file->private_data;
33139 p->private = mi;
33140 - mi->event = atomic_read(&md_event_count);
33141 + mi->event = atomic_read_unchecked(&md_event_count);
33142 }
33143 return error;
33144 }
33145 @@ -6093,7 +6094,7 @@ static unsigned int mdstat_poll(struct f
33146 /* always allow read */
33147 mask = POLLIN | POLLRDNORM;
33148
33149 - if (mi->event != atomic_read(&md_event_count))
33150 + if (mi->event != atomic_read_unchecked(&md_event_count))
33151 mask |= POLLERR | POLLPRI;
33152 return mask;
33153 }
33154 @@ -6137,7 +6138,7 @@ static int is_mddev_idle(mddev_t *mddev,
33155 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
33156 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
33157 (int)part_stat_read(&disk->part0, sectors[1]) -
33158 - atomic_read(&disk->sync_io);
33159 + atomic_read_unchecked(&disk->sync_io);
33160 /* sync IO will cause sync_io to increase before the disk_stats
33161 * as sync_io is counted when a request starts, and
33162 * disk_stats is counted when it completes.
33163 diff -urNp linux-2.6.32.46/drivers/md/md.h linux-2.6.32.46/drivers/md/md.h
33164 --- linux-2.6.32.46/drivers/md/md.h 2011-03-27 14:31:47.000000000 -0400
33165 +++ linux-2.6.32.46/drivers/md/md.h 2011-05-04 17:56:20.000000000 -0400
33166 @@ -94,10 +94,10 @@ struct mdk_rdev_s
33167 * only maintained for arrays that
33168 * support hot removal
33169 */
33170 - atomic_t read_errors; /* number of consecutive read errors that
33171 + atomic_unchecked_t read_errors; /* number of consecutive read errors that
33172 * we have tried to ignore.
33173 */
33174 - atomic_t corrected_errors; /* number of corrected read errors,
33175 + atomic_unchecked_t corrected_errors; /* number of corrected read errors,
33176 * for reporting to userspace and storing
33177 * in superblock.
33178 */
33179 @@ -304,7 +304,7 @@ static inline void rdev_dec_pending(mdk_
33180
33181 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
33182 {
33183 - atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
33184 + atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
33185 }
33186
33187 struct mdk_personality
33188 diff -urNp linux-2.6.32.46/drivers/md/raid10.c linux-2.6.32.46/drivers/md/raid10.c
33189 --- linux-2.6.32.46/drivers/md/raid10.c 2011-03-27 14:31:47.000000000 -0400
33190 +++ linux-2.6.32.46/drivers/md/raid10.c 2011-05-04 17:56:28.000000000 -0400
33191 @@ -1255,7 +1255,7 @@ static void end_sync_read(struct bio *bi
33192 if (test_bit(BIO_UPTODATE, &bio->bi_flags))
33193 set_bit(R10BIO_Uptodate, &r10_bio->state);
33194 else {
33195 - atomic_add(r10_bio->sectors,
33196 + atomic_add_unchecked(r10_bio->sectors,
33197 &conf->mirrors[d].rdev->corrected_errors);
33198 if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
33199 md_error(r10_bio->mddev,
33200 @@ -1520,7 +1520,7 @@ static void fix_read_error(conf_t *conf,
33201 test_bit(In_sync, &rdev->flags)) {
33202 atomic_inc(&rdev->nr_pending);
33203 rcu_read_unlock();
33204 - atomic_add(s, &rdev->corrected_errors);
33205 + atomic_add_unchecked(s, &rdev->corrected_errors);
33206 if (sync_page_io(rdev->bdev,
33207 r10_bio->devs[sl].addr +
33208 sect + rdev->data_offset,
33209 diff -urNp linux-2.6.32.46/drivers/md/raid1.c linux-2.6.32.46/drivers/md/raid1.c
33210 --- linux-2.6.32.46/drivers/md/raid1.c 2011-03-27 14:31:47.000000000 -0400
33211 +++ linux-2.6.32.46/drivers/md/raid1.c 2011-05-04 17:56:28.000000000 -0400
33212 @@ -1415,7 +1415,7 @@ static void sync_request_write(mddev_t *
33213 if (r1_bio->bios[d]->bi_end_io != end_sync_read)
33214 continue;
33215 rdev = conf->mirrors[d].rdev;
33216 - atomic_add(s, &rdev->corrected_errors);
33217 + atomic_add_unchecked(s, &rdev->corrected_errors);
33218 if (sync_page_io(rdev->bdev,
33219 sect + rdev->data_offset,
33220 s<<9,
33221 @@ -1564,7 +1564,7 @@ static void fix_read_error(conf_t *conf,
33222 /* Well, this device is dead */
33223 md_error(mddev, rdev);
33224 else {
33225 - atomic_add(s, &rdev->corrected_errors);
33226 + atomic_add_unchecked(s, &rdev->corrected_errors);
33227 printk(KERN_INFO
33228 "raid1:%s: read error corrected "
33229 "(%d sectors at %llu on %s)\n",
33230 diff -urNp linux-2.6.32.46/drivers/md/raid5.c linux-2.6.32.46/drivers/md/raid5.c
33231 --- linux-2.6.32.46/drivers/md/raid5.c 2011-06-25 12:55:34.000000000 -0400
33232 +++ linux-2.6.32.46/drivers/md/raid5.c 2011-06-25 12:58:39.000000000 -0400
33233 @@ -482,7 +482,7 @@ static void ops_run_io(struct stripe_hea
33234 bi->bi_next = NULL;
33235 if ((rw & WRITE) &&
33236 test_bit(R5_ReWrite, &sh->dev[i].flags))
33237 - atomic_add(STRIPE_SECTORS,
33238 + atomic_add_unchecked(STRIPE_SECTORS,
33239 &rdev->corrected_errors);
33240 generic_make_request(bi);
33241 } else {
33242 @@ -1517,15 +1517,15 @@ static void raid5_end_read_request(struc
33243 clear_bit(R5_ReadError, &sh->dev[i].flags);
33244 clear_bit(R5_ReWrite, &sh->dev[i].flags);
33245 }
33246 - if (atomic_read(&conf->disks[i].rdev->read_errors))
33247 - atomic_set(&conf->disks[i].rdev->read_errors, 0);
33248 + if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
33249 + atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
33250 } else {
33251 const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
33252 int retry = 0;
33253 rdev = conf->disks[i].rdev;
33254
33255 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
33256 - atomic_inc(&rdev->read_errors);
33257 + atomic_inc_unchecked(&rdev->read_errors);
33258 if (conf->mddev->degraded >= conf->max_degraded)
33259 printk_rl(KERN_WARNING
33260 "raid5:%s: read error not correctable "
33261 @@ -1543,7 +1543,7 @@ static void raid5_end_read_request(struc
33262 (unsigned long long)(sh->sector
33263 + rdev->data_offset),
33264 bdn);
33265 - else if (atomic_read(&rdev->read_errors)
33266 + else if (atomic_read_unchecked(&rdev->read_errors)
33267 > conf->max_nr_stripes)
33268 printk(KERN_WARNING
33269 "raid5:%s: Too many read errors, failing device %s.\n",
33270 @@ -1870,6 +1870,7 @@ static sector_t compute_blocknr(struct s
33271 sector_t r_sector;
33272 struct stripe_head sh2;
33273
33274 + pax_track_stack();
33275
33276 chunk_offset = sector_div(new_sector, sectors_per_chunk);
33277 stripe = new_sector;
33278 diff -urNp linux-2.6.32.46/drivers/media/common/saa7146_hlp.c linux-2.6.32.46/drivers/media/common/saa7146_hlp.c
33279 --- linux-2.6.32.46/drivers/media/common/saa7146_hlp.c 2011-03-27 14:31:47.000000000 -0400
33280 +++ linux-2.6.32.46/drivers/media/common/saa7146_hlp.c 2011-05-16 21:46:57.000000000 -0400
33281 @@ -353,6 +353,8 @@ static void calculate_clipping_registers
33282
33283 int x[32], y[32], w[32], h[32];
33284
33285 + pax_track_stack();
33286 +
33287 /* clear out memory */
33288 memset(&line_list[0], 0x00, sizeof(u32)*32);
33289 memset(&pixel_list[0], 0x00, sizeof(u32)*32);
33290 diff -urNp linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
33291 --- linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-03-27 14:31:47.000000000 -0400
33292 +++ linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-16 21:46:57.000000000 -0400
33293 @@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(stru
33294 u8 buf[HOST_LINK_BUF_SIZE];
33295 int i;
33296
33297 + pax_track_stack();
33298 +
33299 dprintk("%s\n", __func__);
33300
33301 /* check if we have space for a link buf in the rx_buffer */
33302 @@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(s
33303 unsigned long timeout;
33304 int written;
33305
33306 + pax_track_stack();
33307 +
33308 dprintk("%s\n", __func__);
33309
33310 /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
33311 diff -urNp linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_demux.h linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_demux.h
33312 --- linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_demux.h 2011-03-27 14:31:47.000000000 -0400
33313 +++ linux-2.6.32.46/drivers/media/dvb/dvb-core/dvb_demux.h 2011-08-05 20:33:55.000000000 -0400
33314 @@ -71,7 +71,7 @@ struct dvb_demux_feed {
33315 union {
33316 dmx_ts_cb ts;
33317 dmx_section_cb sec;
33318 - } cb;
33319 + } __no_const cb;
33320
33321 struct dvb_demux *demux;
33322 void *priv;
33323 diff -urNp linux-2.6.32.46/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.46/drivers/media/dvb/dvb-core/dvbdev.c
33324 --- linux-2.6.32.46/drivers/media/dvb/dvb-core/dvbdev.c 2011-03-27 14:31:47.000000000 -0400
33325 +++ linux-2.6.32.46/drivers/media/dvb/dvb-core/dvbdev.c 2011-08-23 21:22:32.000000000 -0400
33326 @@ -191,7 +191,7 @@ int dvb_register_device(struct dvb_adapt
33327 const struct dvb_device *template, void *priv, int type)
33328 {
33329 struct dvb_device *dvbdev;
33330 - struct file_operations *dvbdevfops;
33331 + file_operations_no_const *dvbdevfops;
33332 struct device *clsdev;
33333 int minor;
33334 int id;
33335 diff -urNp linux-2.6.32.46/drivers/media/dvb/dvb-usb/cxusb.c linux-2.6.32.46/drivers/media/dvb/dvb-usb/cxusb.c
33336 --- linux-2.6.32.46/drivers/media/dvb/dvb-usb/cxusb.c 2011-03-27 14:31:47.000000000 -0400
33337 +++ linux-2.6.32.46/drivers/media/dvb/dvb-usb/cxusb.c 2011-08-05 20:33:55.000000000 -0400
33338 @@ -1040,7 +1040,7 @@ static struct dib0070_config dib7070p_di
33339 struct dib0700_adapter_state {
33340 int (*set_param_save) (struct dvb_frontend *,
33341 struct dvb_frontend_parameters *);
33342 -};
33343 +} __no_const;
33344
33345 static int dib7070_set_param_override(struct dvb_frontend *fe,
33346 struct dvb_frontend_parameters *fep)
33347 diff -urNp linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_core.c linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_core.c
33348 --- linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-03-27 14:31:47.000000000 -0400
33349 +++ linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-16 21:46:57.000000000 -0400
33350 @@ -332,6 +332,8 @@ int dib0700_download_firmware(struct usb
33351
33352 u8 buf[260];
33353
33354 + pax_track_stack();
33355 +
33356 while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
33357 deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",hx.addr, hx.len, hx.chk);
33358
33359 diff -urNp linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_devices.c linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_devices.c
33360 --- linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_devices.c 2011-05-10 22:12:01.000000000 -0400
33361 +++ linux-2.6.32.46/drivers/media/dvb/dvb-usb/dib0700_devices.c 2011-08-05 20:33:55.000000000 -0400
33362 @@ -28,7 +28,7 @@ MODULE_PARM_DESC(force_lna_activation, "
33363
33364 struct dib0700_adapter_state {
33365 int (*set_param_save) (struct dvb_frontend *, struct dvb_frontend_parameters *);
33366 -};
33367 +} __no_const;
33368
33369 /* Hauppauge Nova-T 500 (aka Bristol)
33370 * has a LNA on GPIO0 which is enabled by setting 1 */
33371 diff -urNp linux-2.6.32.46/drivers/media/dvb/frontends/dib3000.h linux-2.6.32.46/drivers/media/dvb/frontends/dib3000.h
33372 --- linux-2.6.32.46/drivers/media/dvb/frontends/dib3000.h 2011-03-27 14:31:47.000000000 -0400
33373 +++ linux-2.6.32.46/drivers/media/dvb/frontends/dib3000.h 2011-08-05 20:33:55.000000000 -0400
33374 @@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
33375 int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
33376 int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
33377 int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
33378 -};
33379 +} __no_const;
33380
33381 #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
33382 extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
33383 diff -urNp linux-2.6.32.46/drivers/media/dvb/frontends/or51211.c linux-2.6.32.46/drivers/media/dvb/frontends/or51211.c
33384 --- linux-2.6.32.46/drivers/media/dvb/frontends/or51211.c 2011-03-27 14:31:47.000000000 -0400
33385 +++ linux-2.6.32.46/drivers/media/dvb/frontends/or51211.c 2011-05-16 21:46:57.000000000 -0400
33386 @@ -113,6 +113,8 @@ static int or51211_load_firmware (struct
33387 u8 tudata[585];
33388 int i;
33389
33390 + pax_track_stack();
33391 +
33392 dprintk("Firmware is %zd bytes\n",fw->size);
33393
33394 /* Get eprom data */
33395 diff -urNp linux-2.6.32.46/drivers/media/radio/radio-cadet.c linux-2.6.32.46/drivers/media/radio/radio-cadet.c
33396 --- linux-2.6.32.46/drivers/media/radio/radio-cadet.c 2011-03-27 14:31:47.000000000 -0400
33397 +++ linux-2.6.32.46/drivers/media/radio/radio-cadet.c 2011-04-17 15:56:46.000000000 -0400
33398 @@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *f
33399 while (i < count && dev->rdsin != dev->rdsout)
33400 readbuf[i++] = dev->rdsbuf[dev->rdsout++];
33401
33402 - if (copy_to_user(data, readbuf, i))
33403 + if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
33404 return -EFAULT;
33405 return i;
33406 }
33407 diff -urNp linux-2.6.32.46/drivers/media/video/cx18/cx18-driver.c linux-2.6.32.46/drivers/media/video/cx18/cx18-driver.c
33408 --- linux-2.6.32.46/drivers/media/video/cx18/cx18-driver.c 2011-03-27 14:31:47.000000000 -0400
33409 +++ linux-2.6.32.46/drivers/media/video/cx18/cx18-driver.c 2011-05-16 21:46:57.000000000 -0400
33410 @@ -56,7 +56,7 @@ static struct pci_device_id cx18_pci_tbl
33411
33412 MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
33413
33414 -static atomic_t cx18_instance = ATOMIC_INIT(0);
33415 +static atomic_unchecked_t cx18_instance = ATOMIC_INIT(0);
33416
33417 /* Parameter declarations */
33418 static int cardtype[CX18_MAX_CARDS];
33419 @@ -288,6 +288,8 @@ void cx18_read_eeprom(struct cx18 *cx, s
33420 struct i2c_client c;
33421 u8 eedata[256];
33422
33423 + pax_track_stack();
33424 +
33425 memset(&c, 0, sizeof(c));
33426 strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
33427 c.adapter = &cx->i2c_adap[0];
33428 @@ -800,7 +802,7 @@ static int __devinit cx18_probe(struct p
33429 struct cx18 *cx;
33430
33431 /* FIXME - module parameter arrays constrain max instances */
33432 - i = atomic_inc_return(&cx18_instance) - 1;
33433 + i = atomic_inc_return_unchecked(&cx18_instance) - 1;
33434 if (i >= CX18_MAX_CARDS) {
33435 printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
33436 "limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
33437 diff -urNp linux-2.6.32.46/drivers/media/video/ivtv/ivtv-driver.c linux-2.6.32.46/drivers/media/video/ivtv/ivtv-driver.c
33438 --- linux-2.6.32.46/drivers/media/video/ivtv/ivtv-driver.c 2011-03-27 14:31:47.000000000 -0400
33439 +++ linux-2.6.32.46/drivers/media/video/ivtv/ivtv-driver.c 2011-05-04 17:56:28.000000000 -0400
33440 @@ -79,7 +79,7 @@ static struct pci_device_id ivtv_pci_tbl
33441 MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
33442
33443 /* ivtv instance counter */
33444 -static atomic_t ivtv_instance = ATOMIC_INIT(0);
33445 +static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
33446
33447 /* Parameter declarations */
33448 static int cardtype[IVTV_MAX_CARDS];
33449 diff -urNp linux-2.6.32.46/drivers/media/video/omap24xxcam.c linux-2.6.32.46/drivers/media/video/omap24xxcam.c
33450 --- linux-2.6.32.46/drivers/media/video/omap24xxcam.c 2011-03-27 14:31:47.000000000 -0400
33451 +++ linux-2.6.32.46/drivers/media/video/omap24xxcam.c 2011-05-04 17:56:28.000000000 -0400
33452 @@ -401,7 +401,7 @@ static void omap24xxcam_vbq_complete(str
33453 spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
33454
33455 do_gettimeofday(&vb->ts);
33456 - vb->field_count = atomic_add_return(2, &fh->field_count);
33457 + vb->field_count = atomic_add_return_unchecked(2, &fh->field_count);
33458 if (csr & csr_error) {
33459 vb->state = VIDEOBUF_ERROR;
33460 if (!atomic_read(&fh->cam->in_reset)) {
33461 diff -urNp linux-2.6.32.46/drivers/media/video/omap24xxcam.h linux-2.6.32.46/drivers/media/video/omap24xxcam.h
33462 --- linux-2.6.32.46/drivers/media/video/omap24xxcam.h 2011-03-27 14:31:47.000000000 -0400
33463 +++ linux-2.6.32.46/drivers/media/video/omap24xxcam.h 2011-05-04 17:56:28.000000000 -0400
33464 @@ -533,7 +533,7 @@ struct omap24xxcam_fh {
33465 spinlock_t vbq_lock; /* spinlock for the videobuf queue */
33466 struct videobuf_queue vbq;
33467 struct v4l2_pix_format pix; /* serialise pix by vbq->lock */
33468 - atomic_t field_count; /* field counter for videobuf_buffer */
33469 + atomic_unchecked_t field_count; /* field counter for videobuf_buffer */
33470 /* accessing cam here doesn't need serialisation: it's constant */
33471 struct omap24xxcam_device *cam;
33472 };
33473 diff -urNp linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
33474 --- linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-03-27 14:31:47.000000000 -0400
33475 +++ linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-16 21:46:57.000000000 -0400
33476 @@ -119,6 +119,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw
33477 u8 *eeprom;
33478 struct tveeprom tvdata;
33479
33480 + pax_track_stack();
33481 +
33482 memset(&tvdata,0,sizeof(tvdata));
33483
33484 eeprom = pvr2_eeprom_fetch(hdw);
33485 diff -urNp linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
33486 --- linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h 2011-03-27 14:31:47.000000000 -0400
33487 +++ linux-2.6.32.46/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h 2011-08-23 21:22:38.000000000 -0400
33488 @@ -195,7 +195,7 @@ struct pvr2_hdw {
33489
33490 /* I2C stuff */
33491 struct i2c_adapter i2c_adap;
33492 - struct i2c_algorithm i2c_algo;
33493 + i2c_algorithm_no_const i2c_algo;
33494 pvr2_i2c_func i2c_func[PVR2_I2C_FUNC_CNT];
33495 int i2c_cx25840_hack_state;
33496 int i2c_linked;
33497 diff -urNp linux-2.6.32.46/drivers/media/video/saa7134/saa6752hs.c linux-2.6.32.46/drivers/media/video/saa7134/saa6752hs.c
33498 --- linux-2.6.32.46/drivers/media/video/saa7134/saa6752hs.c 2011-03-27 14:31:47.000000000 -0400
33499 +++ linux-2.6.32.46/drivers/media/video/saa7134/saa6752hs.c 2011-05-16 21:46:57.000000000 -0400
33500 @@ -683,6 +683,8 @@ static int saa6752hs_init(struct v4l2_su
33501 unsigned char localPAT[256];
33502 unsigned char localPMT[256];
33503
33504 + pax_track_stack();
33505 +
33506 /* Set video format - must be done first as it resets other settings */
33507 set_reg8(client, 0x41, h->video_format);
33508
33509 diff -urNp linux-2.6.32.46/drivers/media/video/saa7164/saa7164-cmd.c linux-2.6.32.46/drivers/media/video/saa7164/saa7164-cmd.c
33510 --- linux-2.6.32.46/drivers/media/video/saa7164/saa7164-cmd.c 2011-03-27 14:31:47.000000000 -0400
33511 +++ linux-2.6.32.46/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-16 21:46:57.000000000 -0400
33512 @@ -87,6 +87,8 @@ int saa7164_irq_dequeue(struct saa7164_d
33513 wait_queue_head_t *q = 0;
33514 dprintk(DBGLVL_CMD, "%s()\n", __func__);
33515
33516 + pax_track_stack();
33517 +
33518 /* While any outstand message on the bus exists... */
33519 do {
33520
33521 @@ -126,6 +128,8 @@ int saa7164_cmd_dequeue(struct saa7164_d
33522 u8 tmp[512];
33523 dprintk(DBGLVL_CMD, "%s()\n", __func__);
33524
33525 + pax_track_stack();
33526 +
33527 while (loop) {
33528
33529 tmComResInfo_t tRsp = { 0, 0, 0, 0, 0, 0 };
33530 diff -urNp linux-2.6.32.46/drivers/media/video/usbvideo/ibmcam.c linux-2.6.32.46/drivers/media/video/usbvideo/ibmcam.c
33531 --- linux-2.6.32.46/drivers/media/video/usbvideo/ibmcam.c 2011-03-27 14:31:47.000000000 -0400
33532 +++ linux-2.6.32.46/drivers/media/video/usbvideo/ibmcam.c 2011-08-05 20:33:55.000000000 -0400
33533 @@ -3947,15 +3947,15 @@ static struct usb_device_id id_table[] =
33534 static int __init ibmcam_init(void)
33535 {
33536 struct usbvideo_cb cbTbl;
33537 - memset(&cbTbl, 0, sizeof(cbTbl));
33538 - cbTbl.probe = ibmcam_probe;
33539 - cbTbl.setupOnOpen = ibmcam_setup_on_open;
33540 - cbTbl.videoStart = ibmcam_video_start;
33541 - cbTbl.videoStop = ibmcam_video_stop;
33542 - cbTbl.processData = ibmcam_ProcessIsocData;
33543 - cbTbl.postProcess = usbvideo_DeinterlaceFrame;
33544 - cbTbl.adjustPicture = ibmcam_adjust_picture;
33545 - cbTbl.getFPS = ibmcam_calculate_fps;
33546 + memset((void *)&cbTbl, 0, sizeof(cbTbl));
33547 + *(void **)&cbTbl.probe = ibmcam_probe;
33548 + *(void **)&cbTbl.setupOnOpen = ibmcam_setup_on_open;
33549 + *(void **)&cbTbl.videoStart = ibmcam_video_start;
33550 + *(void **)&cbTbl.videoStop = ibmcam_video_stop;
33551 + *(void **)&cbTbl.processData = ibmcam_ProcessIsocData;
33552 + *(void **)&cbTbl.postProcess = usbvideo_DeinterlaceFrame;
33553 + *(void **)&cbTbl.adjustPicture = ibmcam_adjust_picture;
33554 + *(void **)&cbTbl.getFPS = ibmcam_calculate_fps;
33555 return usbvideo_register(
33556 &cams,
33557 MAX_IBMCAM,
33558 diff -urNp linux-2.6.32.46/drivers/media/video/usbvideo/konicawc.c linux-2.6.32.46/drivers/media/video/usbvideo/konicawc.c
33559 --- linux-2.6.32.46/drivers/media/video/usbvideo/konicawc.c 2011-03-27 14:31:47.000000000 -0400
33560 +++ linux-2.6.32.46/drivers/media/video/usbvideo/konicawc.c 2011-08-05 20:33:55.000000000 -0400
33561 @@ -225,7 +225,7 @@ static void konicawc_register_input(stru
33562 int error;
33563
33564 usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
33565 - strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
33566 + strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
33567
33568 cam->input = input_dev = input_allocate_device();
33569 if (!input_dev) {
33570 @@ -935,16 +935,16 @@ static int __init konicawc_init(void)
33571 struct usbvideo_cb cbTbl;
33572 printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_VERSION ":"
33573 DRIVER_DESC "\n");
33574 - memset(&cbTbl, 0, sizeof(cbTbl));
33575 - cbTbl.probe = konicawc_probe;
33576 - cbTbl.setupOnOpen = konicawc_setup_on_open;
33577 - cbTbl.processData = konicawc_process_isoc;
33578 - cbTbl.getFPS = konicawc_calculate_fps;
33579 - cbTbl.setVideoMode = konicawc_set_video_mode;
33580 - cbTbl.startDataPump = konicawc_start_data;
33581 - cbTbl.stopDataPump = konicawc_stop_data;
33582 - cbTbl.adjustPicture = konicawc_adjust_picture;
33583 - cbTbl.userFree = konicawc_free_uvd;
33584 + memset((void * )&cbTbl, 0, sizeof(cbTbl));
33585 + *(void **)&cbTbl.probe = konicawc_probe;
33586 + *(void **)&cbTbl.setupOnOpen = konicawc_setup_on_open;
33587 + *(void **)&cbTbl.processData = konicawc_process_isoc;
33588 + *(void **)&cbTbl.getFPS = konicawc_calculate_fps;
33589 + *(void **)&cbTbl.setVideoMode = konicawc_set_video_mode;
33590 + *(void **)&cbTbl.startDataPump = konicawc_start_data;
33591 + *(void **)&cbTbl.stopDataPump = konicawc_stop_data;
33592 + *(void **)&cbTbl.adjustPicture = konicawc_adjust_picture;
33593 + *(void **)&cbTbl.userFree = konicawc_free_uvd;
33594 return usbvideo_register(
33595 &cams,
33596 MAX_CAMERAS,
33597 diff -urNp linux-2.6.32.46/drivers/media/video/usbvideo/quickcam_messenger.c linux-2.6.32.46/drivers/media/video/usbvideo/quickcam_messenger.c
33598 --- linux-2.6.32.46/drivers/media/video/usbvideo/quickcam_messenger.c 2011-03-27 14:31:47.000000000 -0400
33599 +++ linux-2.6.32.46/drivers/media/video/usbvideo/quickcam_messenger.c 2011-04-17 15:56:46.000000000 -0400
33600 @@ -89,7 +89,7 @@ static void qcm_register_input(struct qc
33601 int error;
33602
33603 usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
33604 - strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
33605 + strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
33606
33607 cam->input = input_dev = input_allocate_device();
33608 if (!input_dev) {
33609 diff -urNp linux-2.6.32.46/drivers/media/video/usbvideo/ultracam.c linux-2.6.32.46/drivers/media/video/usbvideo/ultracam.c
33610 --- linux-2.6.32.46/drivers/media/video/usbvideo/ultracam.c 2011-03-27 14:31:47.000000000 -0400
33611 +++ linux-2.6.32.46/drivers/media/video/usbvideo/ultracam.c 2011-08-05 20:33:55.000000000 -0400
33612 @@ -655,14 +655,14 @@ static int __init ultracam_init(void)
33613 {
33614 struct usbvideo_cb cbTbl;
33615 memset(&cbTbl, 0, sizeof(cbTbl));
33616 - cbTbl.probe = ultracam_probe;
33617 - cbTbl.setupOnOpen = ultracam_setup_on_open;
33618 - cbTbl.videoStart = ultracam_video_start;
33619 - cbTbl.videoStop = ultracam_video_stop;
33620 - cbTbl.processData = ultracam_ProcessIsocData;
33621 - cbTbl.postProcess = usbvideo_DeinterlaceFrame;
33622 - cbTbl.adjustPicture = ultracam_adjust_picture;
33623 - cbTbl.getFPS = ultracam_calculate_fps;
33624 + *(void **)&cbTbl.probe = ultracam_probe;
33625 + *(void **)&cbTbl.setupOnOpen = ultracam_setup_on_open;
33626 + *(void **)&cbTbl.videoStart = ultracam_video_start;
33627 + *(void **)&cbTbl.videoStop = ultracam_video_stop;
33628 + *(void **)&cbTbl.processData = ultracam_ProcessIsocData;
33629 + *(void **)&cbTbl.postProcess = usbvideo_DeinterlaceFrame;
33630 + *(void **)&cbTbl.adjustPicture = ultracam_adjust_picture;
33631 + *(void **)&cbTbl.getFPS = ultracam_calculate_fps;
33632 return usbvideo_register(
33633 &cams,
33634 MAX_CAMERAS,
33635 diff -urNp linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.c linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.c
33636 --- linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.c 2011-03-27 14:31:47.000000000 -0400
33637 +++ linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.c 2011-08-05 20:33:55.000000000 -0400
33638 @@ -697,15 +697,15 @@ int usbvideo_register(
33639 __func__, cams, base_size, num_cams);
33640
33641 /* Copy callbacks, apply defaults for those that are not set */
33642 - memmove(&cams->cb, cbTbl, sizeof(cams->cb));
33643 + memmove((void *)&cams->cb, cbTbl, sizeof(cams->cb));
33644 if (cams->cb.getFrame == NULL)
33645 - cams->cb.getFrame = usbvideo_GetFrame;
33646 + *(void **)&cams->cb.getFrame = usbvideo_GetFrame;
33647 if (cams->cb.disconnect == NULL)
33648 - cams->cb.disconnect = usbvideo_Disconnect;
33649 + *(void **)&cams->cb.disconnect = usbvideo_Disconnect;
33650 if (cams->cb.startDataPump == NULL)
33651 - cams->cb.startDataPump = usbvideo_StartDataPump;
33652 + *(void **)&cams->cb.startDataPump = usbvideo_StartDataPump;
33653 if (cams->cb.stopDataPump == NULL)
33654 - cams->cb.stopDataPump = usbvideo_StopDataPump;
33655 + *(void **)&cams->cb.stopDataPump = usbvideo_StopDataPump;
33656
33657 cams->num_cameras = num_cams;
33658 cams->cam = (struct uvd *) &cams[1];
33659 diff -urNp linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.h linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.h
33660 --- linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.h 2011-03-27 14:31:47.000000000 -0400
33661 +++ linux-2.6.32.46/drivers/media/video/usbvideo/usbvideo.h 2011-08-30 18:20:06.000000000 -0400
33662 @@ -268,7 +268,7 @@ struct usbvideo_cb {
33663 int (*startDataPump)(struct uvd *uvd);
33664 void (*stopDataPump)(struct uvd *uvd);
33665 int (*setVideoMode)(struct uvd *uvd, struct video_window *vw);
33666 -};
33667 +} __no_const;
33668
33669 struct usbvideo {
33670 int num_cameras; /* As allocated */
33671 diff -urNp linux-2.6.32.46/drivers/media/video/usbvision/usbvision-core.c linux-2.6.32.46/drivers/media/video/usbvision/usbvision-core.c
33672 --- linux-2.6.32.46/drivers/media/video/usbvision/usbvision-core.c 2011-03-27 14:31:47.000000000 -0400
33673 +++ linux-2.6.32.46/drivers/media/video/usbvision/usbvision-core.c 2011-05-16 21:46:57.000000000 -0400
33674 @@ -820,6 +820,8 @@ static enum ParseState usbvision_parse_c
33675 unsigned char rv, gv, bv;
33676 static unsigned char *Y, *U, *V;
33677
33678 + pax_track_stack();
33679 +
33680 frame = usbvision->curFrame;
33681 imageSize = frame->frmwidth * frame->frmheight;
33682 if ( (frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
33683 diff -urNp linux-2.6.32.46/drivers/media/video/v4l2-device.c linux-2.6.32.46/drivers/media/video/v4l2-device.c
33684 --- linux-2.6.32.46/drivers/media/video/v4l2-device.c 2011-03-27 14:31:47.000000000 -0400
33685 +++ linux-2.6.32.46/drivers/media/video/v4l2-device.c 2011-05-04 17:56:28.000000000 -0400
33686 @@ -50,9 +50,9 @@ int v4l2_device_register(struct device *
33687 EXPORT_SYMBOL_GPL(v4l2_device_register);
33688
33689 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
33690 - atomic_t *instance)
33691 + atomic_unchecked_t *instance)
33692 {
33693 - int num = atomic_inc_return(instance) - 1;
33694 + int num = atomic_inc_return_unchecked(instance) - 1;
33695 int len = strlen(basename);
33696
33697 if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
33698 diff -urNp linux-2.6.32.46/drivers/media/video/videobuf-dma-sg.c linux-2.6.32.46/drivers/media/video/videobuf-dma-sg.c
33699 --- linux-2.6.32.46/drivers/media/video/videobuf-dma-sg.c 2011-03-27 14:31:47.000000000 -0400
33700 +++ linux-2.6.32.46/drivers/media/video/videobuf-dma-sg.c 2011-05-16 21:46:57.000000000 -0400
33701 @@ -693,6 +693,8 @@ void *videobuf_sg_alloc(size_t size)
33702 {
33703 struct videobuf_queue q;
33704
33705 + pax_track_stack();
33706 +
33707 /* Required to make generic handler to call __videobuf_alloc */
33708 q.int_ops = &sg_ops;
33709
33710 diff -urNp linux-2.6.32.46/drivers/message/fusion/mptbase.c linux-2.6.32.46/drivers/message/fusion/mptbase.c
33711 --- linux-2.6.32.46/drivers/message/fusion/mptbase.c 2011-03-27 14:31:47.000000000 -0400
33712 +++ linux-2.6.32.46/drivers/message/fusion/mptbase.c 2011-04-17 15:56:46.000000000 -0400
33713 @@ -6709,8 +6709,14 @@ procmpt_iocinfo_read(char *buf, char **s
33714 len += sprintf(buf+len, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
33715 len += sprintf(buf+len, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
33716
33717 +#ifdef CONFIG_GRKERNSEC_HIDESYM
33718 + len += sprintf(buf+len, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
33719 + NULL, NULL);
33720 +#else
33721 len += sprintf(buf+len, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
33722 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
33723 +#endif
33724 +
33725 /*
33726 * Rounding UP to nearest 4-kB boundary here...
33727 */
33728 diff -urNp linux-2.6.32.46/drivers/message/fusion/mptsas.c linux-2.6.32.46/drivers/message/fusion/mptsas.c
33729 --- linux-2.6.32.46/drivers/message/fusion/mptsas.c 2011-03-27 14:31:47.000000000 -0400
33730 +++ linux-2.6.32.46/drivers/message/fusion/mptsas.c 2011-04-17 15:56:46.000000000 -0400
33731 @@ -436,6 +436,23 @@ mptsas_is_end_device(struct mptsas_devin
33732 return 0;
33733 }
33734
33735 +static inline void
33736 +mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
33737 +{
33738 + if (phy_info->port_details) {
33739 + phy_info->port_details->rphy = rphy;
33740 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
33741 + ioc->name, rphy));
33742 + }
33743 +
33744 + if (rphy) {
33745 + dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
33746 + &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
33747 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
33748 + ioc->name, rphy, rphy->dev.release));
33749 + }
33750 +}
33751 +
33752 /* no mutex */
33753 static void
33754 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
33755 @@ -474,23 +491,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
33756 return NULL;
33757 }
33758
33759 -static inline void
33760 -mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
33761 -{
33762 - if (phy_info->port_details) {
33763 - phy_info->port_details->rphy = rphy;
33764 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
33765 - ioc->name, rphy));
33766 - }
33767 -
33768 - if (rphy) {
33769 - dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
33770 - &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
33771 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
33772 - ioc->name, rphy, rphy->dev.release));
33773 - }
33774 -}
33775 -
33776 static inline struct sas_port *
33777 mptsas_get_port(struct mptsas_phyinfo *phy_info)
33778 {
33779 diff -urNp linux-2.6.32.46/drivers/message/fusion/mptscsih.c linux-2.6.32.46/drivers/message/fusion/mptscsih.c
33780 --- linux-2.6.32.46/drivers/message/fusion/mptscsih.c 2011-03-27 14:31:47.000000000 -0400
33781 +++ linux-2.6.32.46/drivers/message/fusion/mptscsih.c 2011-04-17 15:56:46.000000000 -0400
33782 @@ -1248,15 +1248,16 @@ mptscsih_info(struct Scsi_Host *SChost)
33783
33784 h = shost_priv(SChost);
33785
33786 - if (h) {
33787 - if (h->info_kbuf == NULL)
33788 - if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
33789 - return h->info_kbuf;
33790 - h->info_kbuf[0] = '\0';
33791 + if (!h)
33792 + return NULL;
33793
33794 - mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
33795 - h->info_kbuf[size-1] = '\0';
33796 - }
33797 + if (h->info_kbuf == NULL)
33798 + if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
33799 + return h->info_kbuf;
33800 + h->info_kbuf[0] = '\0';
33801 +
33802 + mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
33803 + h->info_kbuf[size-1] = '\0';
33804
33805 return h->info_kbuf;
33806 }
33807 diff -urNp linux-2.6.32.46/drivers/message/i2o/i2o_config.c linux-2.6.32.46/drivers/message/i2o/i2o_config.c
33808 --- linux-2.6.32.46/drivers/message/i2o/i2o_config.c 2011-03-27 14:31:47.000000000 -0400
33809 +++ linux-2.6.32.46/drivers/message/i2o/i2o_config.c 2011-05-16 21:46:57.000000000 -0400
33810 @@ -787,6 +787,8 @@ static int i2o_cfg_passthru(unsigned lon
33811 struct i2o_message *msg;
33812 unsigned int iop;
33813
33814 + pax_track_stack();
33815 +
33816 if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
33817 return -EFAULT;
33818
33819 diff -urNp linux-2.6.32.46/drivers/message/i2o/i2o_proc.c linux-2.6.32.46/drivers/message/i2o/i2o_proc.c
33820 --- linux-2.6.32.46/drivers/message/i2o/i2o_proc.c 2011-03-27 14:31:47.000000000 -0400
33821 +++ linux-2.6.32.46/drivers/message/i2o/i2o_proc.c 2011-04-17 15:56:46.000000000 -0400
33822 @@ -259,13 +259,6 @@ static char *scsi_devices[] = {
33823 "Array Controller Device"
33824 };
33825
33826 -static char *chtostr(u8 * chars, int n)
33827 -{
33828 - char tmp[256];
33829 - tmp[0] = 0;
33830 - return strncat(tmp, (char *)chars, n);
33831 -}
33832 -
33833 static int i2o_report_query_status(struct seq_file *seq, int block_status,
33834 char *group)
33835 {
33836 @@ -842,8 +835,7 @@ static int i2o_seq_show_ddm_table(struct
33837
33838 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
33839 seq_printf(seq, "%-#8x", ddm_table.module_id);
33840 - seq_printf(seq, "%-29s",
33841 - chtostr(ddm_table.module_name_version, 28));
33842 + seq_printf(seq, "%-.28s", ddm_table.module_name_version);
33843 seq_printf(seq, "%9d ", ddm_table.data_size);
33844 seq_printf(seq, "%8d", ddm_table.code_size);
33845
33846 @@ -944,8 +936,8 @@ static int i2o_seq_show_drivers_stored(s
33847
33848 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
33849 seq_printf(seq, "%-#8x", dst->module_id);
33850 - seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
33851 - seq_printf(seq, "%-9s", chtostr(dst->date, 8));
33852 + seq_printf(seq, "%-.28s", dst->module_name_version);
33853 + seq_printf(seq, "%-.8s", dst->date);
33854 seq_printf(seq, "%8d ", dst->module_size);
33855 seq_printf(seq, "%8d ", dst->mpb_size);
33856 seq_printf(seq, "0x%04x", dst->module_flags);
33857 @@ -1276,14 +1268,10 @@ static int i2o_seq_show_dev_identity(str
33858 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
33859 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
33860 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
33861 - seq_printf(seq, "Vendor info : %s\n",
33862 - chtostr((u8 *) (work32 + 2), 16));
33863 - seq_printf(seq, "Product info : %s\n",
33864 - chtostr((u8 *) (work32 + 6), 16));
33865 - seq_printf(seq, "Description : %s\n",
33866 - chtostr((u8 *) (work32 + 10), 16));
33867 - seq_printf(seq, "Product rev. : %s\n",
33868 - chtostr((u8 *) (work32 + 14), 8));
33869 + seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
33870 + seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
33871 + seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
33872 + seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
33873
33874 seq_printf(seq, "Serial number : ");
33875 print_serial_number(seq, (u8 *) (work32 + 16),
33876 @@ -1328,10 +1316,8 @@ static int i2o_seq_show_ddm_identity(str
33877 }
33878
33879 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
33880 - seq_printf(seq, "Module name : %s\n",
33881 - chtostr(result.module_name, 24));
33882 - seq_printf(seq, "Module revision : %s\n",
33883 - chtostr(result.module_rev, 8));
33884 + seq_printf(seq, "Module name : %.24s\n", result.module_name);
33885 + seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
33886
33887 seq_printf(seq, "Serial number : ");
33888 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
33889 @@ -1362,14 +1348,10 @@ static int i2o_seq_show_uinfo(struct seq
33890 return 0;
33891 }
33892
33893 - seq_printf(seq, "Device name : %s\n",
33894 - chtostr(result.device_name, 64));
33895 - seq_printf(seq, "Service name : %s\n",
33896 - chtostr(result.service_name, 64));
33897 - seq_printf(seq, "Physical name : %s\n",
33898 - chtostr(result.physical_location, 64));
33899 - seq_printf(seq, "Instance number : %s\n",
33900 - chtostr(result.instance_number, 4));
33901 + seq_printf(seq, "Device name : %.64s\n", result.device_name);
33902 + seq_printf(seq, "Service name : %.64s\n", result.service_name);
33903 + seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
33904 + seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
33905
33906 return 0;
33907 }
33908 diff -urNp linux-2.6.32.46/drivers/message/i2o/iop.c linux-2.6.32.46/drivers/message/i2o/iop.c
33909 --- linux-2.6.32.46/drivers/message/i2o/iop.c 2011-03-27 14:31:47.000000000 -0400
33910 +++ linux-2.6.32.46/drivers/message/i2o/iop.c 2011-05-04 17:56:28.000000000 -0400
33911 @@ -110,10 +110,10 @@ u32 i2o_cntxt_list_add(struct i2o_contro
33912
33913 spin_lock_irqsave(&c->context_list_lock, flags);
33914
33915 - if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
33916 - atomic_inc(&c->context_list_counter);
33917 + if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
33918 + atomic_inc_unchecked(&c->context_list_counter);
33919
33920 - entry->context = atomic_read(&c->context_list_counter);
33921 + entry->context = atomic_read_unchecked(&c->context_list_counter);
33922
33923 list_add(&entry->list, &c->context_list);
33924
33925 @@ -1076,7 +1076,7 @@ struct i2o_controller *i2o_iop_alloc(voi
33926
33927 #if BITS_PER_LONG == 64
33928 spin_lock_init(&c->context_list_lock);
33929 - atomic_set(&c->context_list_counter, 0);
33930 + atomic_set_unchecked(&c->context_list_counter, 0);
33931 INIT_LIST_HEAD(&c->context_list);
33932 #endif
33933
33934 diff -urNp linux-2.6.32.46/drivers/mfd/wm8350-i2c.c linux-2.6.32.46/drivers/mfd/wm8350-i2c.c
33935 --- linux-2.6.32.46/drivers/mfd/wm8350-i2c.c 2011-03-27 14:31:47.000000000 -0400
33936 +++ linux-2.6.32.46/drivers/mfd/wm8350-i2c.c 2011-05-16 21:46:57.000000000 -0400
33937 @@ -43,6 +43,8 @@ static int wm8350_i2c_write_device(struc
33938 u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
33939 int ret;
33940
33941 + pax_track_stack();
33942 +
33943 if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
33944 return -EINVAL;
33945
33946 diff -urNp linux-2.6.32.46/drivers/misc/kgdbts.c linux-2.6.32.46/drivers/misc/kgdbts.c
33947 --- linux-2.6.32.46/drivers/misc/kgdbts.c 2011-03-27 14:31:47.000000000 -0400
33948 +++ linux-2.6.32.46/drivers/misc/kgdbts.c 2011-04-17 15:56:46.000000000 -0400
33949 @@ -118,7 +118,7 @@
33950 } while (0)
33951 #define MAX_CONFIG_LEN 40
33952
33953 -static struct kgdb_io kgdbts_io_ops;
33954 +static const struct kgdb_io kgdbts_io_ops;
33955 static char get_buf[BUFMAX];
33956 static int get_buf_cnt;
33957 static char put_buf[BUFMAX];
33958 @@ -1102,7 +1102,7 @@ static void kgdbts_post_exp_handler(void
33959 module_put(THIS_MODULE);
33960 }
33961
33962 -static struct kgdb_io kgdbts_io_ops = {
33963 +static const struct kgdb_io kgdbts_io_ops = {
33964 .name = "kgdbts",
33965 .read_char = kgdbts_get_char,
33966 .write_char = kgdbts_put_char,
33967 diff -urNp linux-2.6.32.46/drivers/misc/sgi-gru/gruhandles.c linux-2.6.32.46/drivers/misc/sgi-gru/gruhandles.c
33968 --- linux-2.6.32.46/drivers/misc/sgi-gru/gruhandles.c 2011-03-27 14:31:47.000000000 -0400
33969 +++ linux-2.6.32.46/drivers/misc/sgi-gru/gruhandles.c 2011-04-17 15:56:46.000000000 -0400
33970 @@ -39,8 +39,8 @@ struct mcs_op_statistic mcs_op_statistic
33971
33972 static void update_mcs_stats(enum mcs_op op, unsigned long clks)
33973 {
33974 - atomic_long_inc(&mcs_op_statistics[op].count);
33975 - atomic_long_add(clks, &mcs_op_statistics[op].total);
33976 + atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
33977 + atomic_long_add_unchecked(clks, &mcs_op_statistics[op].total);
33978 if (mcs_op_statistics[op].max < clks)
33979 mcs_op_statistics[op].max = clks;
33980 }
33981 diff -urNp linux-2.6.32.46/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.32.46/drivers/misc/sgi-gru/gruprocfs.c
33982 --- linux-2.6.32.46/drivers/misc/sgi-gru/gruprocfs.c 2011-03-27 14:31:47.000000000 -0400
33983 +++ linux-2.6.32.46/drivers/misc/sgi-gru/gruprocfs.c 2011-04-17 15:56:46.000000000 -0400
33984 @@ -32,9 +32,9 @@
33985
33986 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
33987
33988 -static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
33989 +static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
33990 {
33991 - unsigned long val = atomic_long_read(v);
33992 + unsigned long val = atomic_long_read_unchecked(v);
33993
33994 if (val)
33995 seq_printf(s, "%16lu %s\n", val, id);
33996 @@ -136,8 +136,8 @@ static int mcs_statistics_show(struct se
33997 "cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
33998
33999 for (op = 0; op < mcsop_last; op++) {
34000 - count = atomic_long_read(&mcs_op_statistics[op].count);
34001 - total = atomic_long_read(&mcs_op_statistics[op].total);
34002 + count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
34003 + total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
34004 max = mcs_op_statistics[op].max;
34005 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
34006 count ? total / count : 0, max);
34007 diff -urNp linux-2.6.32.46/drivers/misc/sgi-gru/grutables.h linux-2.6.32.46/drivers/misc/sgi-gru/grutables.h
34008 --- linux-2.6.32.46/drivers/misc/sgi-gru/grutables.h 2011-03-27 14:31:47.000000000 -0400
34009 +++ linux-2.6.32.46/drivers/misc/sgi-gru/grutables.h 2011-04-17 15:56:46.000000000 -0400
34010 @@ -167,84 +167,84 @@ extern unsigned int gru_max_gids;
34011 * GRU statistics.
34012 */
34013 struct gru_stats_s {
34014 - atomic_long_t vdata_alloc;
34015 - atomic_long_t vdata_free;
34016 - atomic_long_t gts_alloc;
34017 - atomic_long_t gts_free;
34018 - atomic_long_t vdata_double_alloc;
34019 - atomic_long_t gts_double_allocate;
34020 - atomic_long_t assign_context;
34021 - atomic_long_t assign_context_failed;
34022 - atomic_long_t free_context;
34023 - atomic_long_t load_user_context;
34024 - atomic_long_t load_kernel_context;
34025 - atomic_long_t lock_kernel_context;
34026 - atomic_long_t unlock_kernel_context;
34027 - atomic_long_t steal_user_context;
34028 - atomic_long_t steal_kernel_context;
34029 - atomic_long_t steal_context_failed;
34030 - atomic_long_t nopfn;
34031 - atomic_long_t break_cow;
34032 - atomic_long_t asid_new;
34033 - atomic_long_t asid_next;
34034 - atomic_long_t asid_wrap;
34035 - atomic_long_t asid_reuse;
34036 - atomic_long_t intr;
34037 - atomic_long_t intr_mm_lock_failed;
34038 - atomic_long_t call_os;
34039 - atomic_long_t call_os_offnode_reference;
34040 - atomic_long_t call_os_check_for_bug;
34041 - atomic_long_t call_os_wait_queue;
34042 - atomic_long_t user_flush_tlb;
34043 - atomic_long_t user_unload_context;
34044 - atomic_long_t user_exception;
34045 - atomic_long_t set_context_option;
34046 - atomic_long_t migrate_check;
34047 - atomic_long_t migrated_retarget;
34048 - atomic_long_t migrated_unload;
34049 - atomic_long_t migrated_unload_delay;
34050 - atomic_long_t migrated_nopfn_retarget;
34051 - atomic_long_t migrated_nopfn_unload;
34052 - atomic_long_t tlb_dropin;
34053 - atomic_long_t tlb_dropin_fail_no_asid;
34054 - atomic_long_t tlb_dropin_fail_upm;
34055 - atomic_long_t tlb_dropin_fail_invalid;
34056 - atomic_long_t tlb_dropin_fail_range_active;
34057 - atomic_long_t tlb_dropin_fail_idle;
34058 - atomic_long_t tlb_dropin_fail_fmm;
34059 - atomic_long_t tlb_dropin_fail_no_exception;
34060 - atomic_long_t tlb_dropin_fail_no_exception_war;
34061 - atomic_long_t tfh_stale_on_fault;
34062 - atomic_long_t mmu_invalidate_range;
34063 - atomic_long_t mmu_invalidate_page;
34064 - atomic_long_t mmu_clear_flush_young;
34065 - atomic_long_t flush_tlb;
34066 - atomic_long_t flush_tlb_gru;
34067 - atomic_long_t flush_tlb_gru_tgh;
34068 - atomic_long_t flush_tlb_gru_zero_asid;
34069 -
34070 - atomic_long_t copy_gpa;
34071 -
34072 - atomic_long_t mesq_receive;
34073 - atomic_long_t mesq_receive_none;
34074 - atomic_long_t mesq_send;
34075 - atomic_long_t mesq_send_failed;
34076 - atomic_long_t mesq_noop;
34077 - atomic_long_t mesq_send_unexpected_error;
34078 - atomic_long_t mesq_send_lb_overflow;
34079 - atomic_long_t mesq_send_qlimit_reached;
34080 - atomic_long_t mesq_send_amo_nacked;
34081 - atomic_long_t mesq_send_put_nacked;
34082 - atomic_long_t mesq_qf_not_full;
34083 - atomic_long_t mesq_qf_locked;
34084 - atomic_long_t mesq_qf_noop_not_full;
34085 - atomic_long_t mesq_qf_switch_head_failed;
34086 - atomic_long_t mesq_qf_unexpected_error;
34087 - atomic_long_t mesq_noop_unexpected_error;
34088 - atomic_long_t mesq_noop_lb_overflow;
34089 - atomic_long_t mesq_noop_qlimit_reached;
34090 - atomic_long_t mesq_noop_amo_nacked;
34091 - atomic_long_t mesq_noop_put_nacked;
34092 + atomic_long_unchecked_t vdata_alloc;
34093 + atomic_long_unchecked_t vdata_free;
34094 + atomic_long_unchecked_t gts_alloc;
34095 + atomic_long_unchecked_t gts_free;
34096 + atomic_long_unchecked_t vdata_double_alloc;
34097 + atomic_long_unchecked_t gts_double_allocate;
34098 + atomic_long_unchecked_t assign_context;
34099 + atomic_long_unchecked_t assign_context_failed;
34100 + atomic_long_unchecked_t free_context;
34101 + atomic_long_unchecked_t load_user_context;
34102 + atomic_long_unchecked_t load_kernel_context;
34103 + atomic_long_unchecked_t lock_kernel_context;
34104 + atomic_long_unchecked_t unlock_kernel_context;
34105 + atomic_long_unchecked_t steal_user_context;
34106 + atomic_long_unchecked_t steal_kernel_context;
34107 + atomic_long_unchecked_t steal_context_failed;
34108 + atomic_long_unchecked_t nopfn;
34109 + atomic_long_unchecked_t break_cow;
34110 + atomic_long_unchecked_t asid_new;
34111 + atomic_long_unchecked_t asid_next;
34112 + atomic_long_unchecked_t asid_wrap;
34113 + atomic_long_unchecked_t asid_reuse;
34114 + atomic_long_unchecked_t intr;
34115 + atomic_long_unchecked_t intr_mm_lock_failed;
34116 + atomic_long_unchecked_t call_os;
34117 + atomic_long_unchecked_t call_os_offnode_reference;
34118 + atomic_long_unchecked_t call_os_check_for_bug;
34119 + atomic_long_unchecked_t call_os_wait_queue;
34120 + atomic_long_unchecked_t user_flush_tlb;
34121 + atomic_long_unchecked_t user_unload_context;
34122 + atomic_long_unchecked_t user_exception;
34123 + atomic_long_unchecked_t set_context_option;
34124 + atomic_long_unchecked_t migrate_check;
34125 + atomic_long_unchecked_t migrated_retarget;
34126 + atomic_long_unchecked_t migrated_unload;
34127 + atomic_long_unchecked_t migrated_unload_delay;
34128 + atomic_long_unchecked_t migrated_nopfn_retarget;
34129 + atomic_long_unchecked_t migrated_nopfn_unload;
34130 + atomic_long_unchecked_t tlb_dropin;
34131 + atomic_long_unchecked_t tlb_dropin_fail_no_asid;
34132 + atomic_long_unchecked_t tlb_dropin_fail_upm;
34133 + atomic_long_unchecked_t tlb_dropin_fail_invalid;
34134 + atomic_long_unchecked_t tlb_dropin_fail_range_active;
34135 + atomic_long_unchecked_t tlb_dropin_fail_idle;
34136 + atomic_long_unchecked_t tlb_dropin_fail_fmm;
34137 + atomic_long_unchecked_t tlb_dropin_fail_no_exception;
34138 + atomic_long_unchecked_t tlb_dropin_fail_no_exception_war;
34139 + atomic_long_unchecked_t tfh_stale_on_fault;
34140 + atomic_long_unchecked_t mmu_invalidate_range;
34141 + atomic_long_unchecked_t mmu_invalidate_page;
34142 + atomic_long_unchecked_t mmu_clear_flush_young;
34143 + atomic_long_unchecked_t flush_tlb;
34144 + atomic_long_unchecked_t flush_tlb_gru;
34145 + atomic_long_unchecked_t flush_tlb_gru_tgh;
34146 + atomic_long_unchecked_t flush_tlb_gru_zero_asid;
34147 +
34148 + atomic_long_unchecked_t copy_gpa;
34149 +
34150 + atomic_long_unchecked_t mesq_receive;
34151 + atomic_long_unchecked_t mesq_receive_none;
34152 + atomic_long_unchecked_t mesq_send;
34153 + atomic_long_unchecked_t mesq_send_failed;
34154 + atomic_long_unchecked_t mesq_noop;
34155 + atomic_long_unchecked_t mesq_send_unexpected_error;
34156 + atomic_long_unchecked_t mesq_send_lb_overflow;
34157 + atomic_long_unchecked_t mesq_send_qlimit_reached;
34158 + atomic_long_unchecked_t mesq_send_amo_nacked;
34159 + atomic_long_unchecked_t mesq_send_put_nacked;
34160 + atomic_long_unchecked_t mesq_qf_not_full;
34161 + atomic_long_unchecked_t mesq_qf_locked;
34162 + atomic_long_unchecked_t mesq_qf_noop_not_full;
34163 + atomic_long_unchecked_t mesq_qf_switch_head_failed;
34164 + atomic_long_unchecked_t mesq_qf_unexpected_error;
34165 + atomic_long_unchecked_t mesq_noop_unexpected_error;
34166 + atomic_long_unchecked_t mesq_noop_lb_overflow;
34167 + atomic_long_unchecked_t mesq_noop_qlimit_reached;
34168 + atomic_long_unchecked_t mesq_noop_amo_nacked;
34169 + atomic_long_unchecked_t mesq_noop_put_nacked;
34170
34171 };
34172
34173 @@ -252,8 +252,8 @@ enum mcs_op {cchop_allocate, cchop_start
34174 cchop_deallocate, tghop_invalidate, mcsop_last};
34175
34176 struct mcs_op_statistic {
34177 - atomic_long_t count;
34178 - atomic_long_t total;
34179 + atomic_long_unchecked_t count;
34180 + atomic_long_unchecked_t total;
34181 unsigned long max;
34182 };
34183
34184 @@ -276,7 +276,7 @@ extern struct mcs_op_statistic mcs_op_st
34185
34186 #define STAT(id) do { \
34187 if (gru_options & OPT_STATS) \
34188 - atomic_long_inc(&gru_stats.id); \
34189 + atomic_long_inc_unchecked(&gru_stats.id); \
34190 } while (0)
34191
34192 #ifdef CONFIG_SGI_GRU_DEBUG
34193 diff -urNp linux-2.6.32.46/drivers/misc/sgi-xp/xpc.h linux-2.6.32.46/drivers/misc/sgi-xp/xpc.h
34194 --- linux-2.6.32.46/drivers/misc/sgi-xp/xpc.h 2011-03-27 14:31:47.000000000 -0400
34195 +++ linux-2.6.32.46/drivers/misc/sgi-xp/xpc.h 2011-08-05 20:33:55.000000000 -0400
34196 @@ -876,7 +876,7 @@ extern struct xpc_registration xpc_regis
34197 /* found in xpc_main.c */
34198 extern struct device *xpc_part;
34199 extern struct device *xpc_chan;
34200 -extern struct xpc_arch_operations xpc_arch_ops;
34201 +extern const struct xpc_arch_operations xpc_arch_ops;
34202 extern int xpc_disengage_timelimit;
34203 extern int xpc_disengage_timedout;
34204 extern int xpc_activate_IRQ_rcvd;
34205 diff -urNp linux-2.6.32.46/drivers/misc/sgi-xp/xpc_main.c linux-2.6.32.46/drivers/misc/sgi-xp/xpc_main.c
34206 --- linux-2.6.32.46/drivers/misc/sgi-xp/xpc_main.c 2011-03-27 14:31:47.000000000 -0400
34207 +++ linux-2.6.32.46/drivers/misc/sgi-xp/xpc_main.c 2011-08-05 20:33:55.000000000 -0400
34208 @@ -169,7 +169,7 @@ static struct notifier_block xpc_die_not
34209 .notifier_call = xpc_system_die,
34210 };
34211
34212 -struct xpc_arch_operations xpc_arch_ops;
34213 +const struct xpc_arch_operations xpc_arch_ops;
34214
34215 /*
34216 * Timer function to enforce the timelimit on the partition disengage.
34217 diff -urNp linux-2.6.32.46/drivers/misc/sgi-xp/xpc_sn2.c linux-2.6.32.46/drivers/misc/sgi-xp/xpc_sn2.c
34218 --- linux-2.6.32.46/drivers/misc/sgi-xp/xpc_sn2.c 2011-03-27 14:31:47.000000000 -0400
34219 +++ linux-2.6.32.46/drivers/misc/sgi-xp/xpc_sn2.c 2011-08-05 20:33:55.000000000 -0400
34220 @@ -2350,7 +2350,7 @@ xpc_received_payload_sn2(struct xpc_chan
34221 xpc_acknowledge_msgs_sn2(ch, get, msg->flags);
34222 }
34223
34224 -static struct xpc_arch_operations xpc_arch_ops_sn2 = {
34225 +static const struct xpc_arch_operations xpc_arch_ops_sn2 = {
34226 .setup_partitions = xpc_setup_partitions_sn2,
34227 .teardown_partitions = xpc_teardown_partitions_sn2,
34228 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_sn2,
34229 @@ -2413,7 +2413,9 @@ xpc_init_sn2(void)
34230 int ret;
34231 size_t buf_size;
34232
34233 - xpc_arch_ops = xpc_arch_ops_sn2;
34234 + pax_open_kernel();
34235 + memcpy((void *)&xpc_arch_ops, &xpc_arch_ops_sn2, sizeof(xpc_arch_ops_sn2));
34236 + pax_close_kernel();
34237
34238 if (offsetof(struct xpc_msg_sn2, payload) > XPC_MSG_HDR_MAX_SIZE) {
34239 dev_err(xpc_part, "header portion of struct xpc_msg_sn2 is "
34240 diff -urNp linux-2.6.32.46/drivers/misc/sgi-xp/xpc_uv.c linux-2.6.32.46/drivers/misc/sgi-xp/xpc_uv.c
34241 --- linux-2.6.32.46/drivers/misc/sgi-xp/xpc_uv.c 2011-03-27 14:31:47.000000000 -0400
34242 +++ linux-2.6.32.46/drivers/misc/sgi-xp/xpc_uv.c 2011-08-05 20:33:55.000000000 -0400
34243 @@ -1669,7 +1669,7 @@ xpc_received_payload_uv(struct xpc_chann
34244 XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
34245 }
34246
34247 -static struct xpc_arch_operations xpc_arch_ops_uv = {
34248 +static const struct xpc_arch_operations xpc_arch_ops_uv = {
34249 .setup_partitions = xpc_setup_partitions_uv,
34250 .teardown_partitions = xpc_teardown_partitions_uv,
34251 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_uv,
34252 @@ -1729,7 +1729,9 @@ static struct xpc_arch_operations xpc_ar
34253 int
34254 xpc_init_uv(void)
34255 {
34256 - xpc_arch_ops = xpc_arch_ops_uv;
34257 + pax_open_kernel();
34258 + memcpy((void *)&xpc_arch_ops, &xpc_arch_ops_uv, sizeof(xpc_arch_ops_uv));
34259 + pax_close_kernel();
34260
34261 if (sizeof(struct xpc_notify_mq_msghdr_uv) > XPC_MSG_HDR_MAX_SIZE) {
34262 dev_err(xpc_part, "xpc_notify_mq_msghdr_uv is larger than %d\n",
34263 diff -urNp linux-2.6.32.46/drivers/misc/sgi-xp/xp.h linux-2.6.32.46/drivers/misc/sgi-xp/xp.h
34264 --- linux-2.6.32.46/drivers/misc/sgi-xp/xp.h 2011-03-27 14:31:47.000000000 -0400
34265 +++ linux-2.6.32.46/drivers/misc/sgi-xp/xp.h 2011-08-05 20:33:55.000000000 -0400
34266 @@ -289,7 +289,7 @@ struct xpc_interface {
34267 xpc_notify_func, void *);
34268 void (*received) (short, int, void *);
34269 enum xp_retval (*partid_to_nasids) (short, void *);
34270 -};
34271 +} __no_const;
34272
34273 extern struct xpc_interface xpc_interface;
34274
34275 diff -urNp linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0001.c
34276 --- linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0001.c 2011-03-27 14:31:47.000000000 -0400
34277 +++ linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-16 21:46:57.000000000 -0400
34278 @@ -743,6 +743,8 @@ static int chip_ready (struct map_info *
34279 struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
34280 unsigned long timeo = jiffies + HZ;
34281
34282 + pax_track_stack();
34283 +
34284 /* Prevent setting state FL_SYNCING for chip in suspended state. */
34285 if (mode == FL_SYNCING && chip->oldstate != FL_READY)
34286 goto sleep;
34287 @@ -1642,6 +1644,8 @@ static int __xipram do_write_buffer(stru
34288 unsigned long initial_adr;
34289 int initial_len = len;
34290
34291 + pax_track_stack();
34292 +
34293 wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
34294 adr += chip->start;
34295 initial_adr = adr;
34296 @@ -1860,6 +1864,8 @@ static int __xipram do_erase_oneblock(st
34297 int retries = 3;
34298 int ret;
34299
34300 + pax_track_stack();
34301 +
34302 adr += chip->start;
34303
34304 retry:
34305 diff -urNp linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0020.c linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0020.c
34306 --- linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0020.c 2011-03-27 14:31:47.000000000 -0400
34307 +++ linux-2.6.32.46/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-16 21:46:57.000000000 -0400
34308 @@ -255,6 +255,8 @@ static inline int do_read_onechip(struct
34309 unsigned long cmd_addr;
34310 struct cfi_private *cfi = map->fldrv_priv;
34311
34312 + pax_track_stack();
34313 +
34314 adr += chip->start;
34315
34316 /* Ensure cmd read/writes are aligned. */
34317 @@ -428,6 +430,8 @@ static inline int do_write_buffer(struct
34318 DECLARE_WAITQUEUE(wait, current);
34319 int wbufsize, z;
34320
34321 + pax_track_stack();
34322 +
34323 /* M58LW064A requires bus alignment for buffer wriets -- saw */
34324 if (adr & (map_bankwidth(map)-1))
34325 return -EINVAL;
34326 @@ -742,6 +746,8 @@ static inline int do_erase_oneblock(stru
34327 DECLARE_WAITQUEUE(wait, current);
34328 int ret = 0;
34329
34330 + pax_track_stack();
34331 +
34332 adr += chip->start;
34333
34334 /* Let's determine this according to the interleave only once */
34335 @@ -1047,6 +1053,8 @@ static inline int do_lock_oneblock(struc
34336 unsigned long timeo = jiffies + HZ;
34337 DECLARE_WAITQUEUE(wait, current);
34338
34339 + pax_track_stack();
34340 +
34341 adr += chip->start;
34342
34343 /* Let's determine this according to the interleave only once */
34344 @@ -1196,6 +1204,8 @@ static inline int do_unlock_oneblock(str
34345 unsigned long timeo = jiffies + HZ;
34346 DECLARE_WAITQUEUE(wait, current);
34347
34348 + pax_track_stack();
34349 +
34350 adr += chip->start;
34351
34352 /* Let's determine this according to the interleave only once */
34353 diff -urNp linux-2.6.32.46/drivers/mtd/devices/doc2000.c linux-2.6.32.46/drivers/mtd/devices/doc2000.c
34354 --- linux-2.6.32.46/drivers/mtd/devices/doc2000.c 2011-03-27 14:31:47.000000000 -0400
34355 +++ linux-2.6.32.46/drivers/mtd/devices/doc2000.c 2011-04-17 15:56:46.000000000 -0400
34356 @@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
34357
34358 /* The ECC will not be calculated correctly if less than 512 is written */
34359 /* DBB-
34360 - if (len != 0x200 && eccbuf)
34361 + if (len != 0x200)
34362 printk(KERN_WARNING
34363 "ECC needs a full sector write (adr: %lx size %lx)\n",
34364 (long) to, (long) len);
34365 diff -urNp linux-2.6.32.46/drivers/mtd/devices/doc2001.c linux-2.6.32.46/drivers/mtd/devices/doc2001.c
34366 --- linux-2.6.32.46/drivers/mtd/devices/doc2001.c 2011-03-27 14:31:47.000000000 -0400
34367 +++ linux-2.6.32.46/drivers/mtd/devices/doc2001.c 2011-04-17 15:56:46.000000000 -0400
34368 @@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
34369 struct Nand *mychip = &this->chips[from >> (this->chipshift)];
34370
34371 /* Don't allow read past end of device */
34372 - if (from >= this->totlen)
34373 + if (from >= this->totlen || !len)
34374 return -EINVAL;
34375
34376 /* Don't allow a single read to cross a 512-byte block boundary */
34377 diff -urNp linux-2.6.32.46/drivers/mtd/ftl.c linux-2.6.32.46/drivers/mtd/ftl.c
34378 --- linux-2.6.32.46/drivers/mtd/ftl.c 2011-03-27 14:31:47.000000000 -0400
34379 +++ linux-2.6.32.46/drivers/mtd/ftl.c 2011-05-16 21:46:57.000000000 -0400
34380 @@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *
34381 loff_t offset;
34382 uint16_t srcunitswap = cpu_to_le16(srcunit);
34383
34384 + pax_track_stack();
34385 +
34386 eun = &part->EUNInfo[srcunit];
34387 xfer = &part->XferInfo[xferunit];
34388 DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
34389 diff -urNp linux-2.6.32.46/drivers/mtd/inftlcore.c linux-2.6.32.46/drivers/mtd/inftlcore.c
34390 --- linux-2.6.32.46/drivers/mtd/inftlcore.c 2011-03-27 14:31:47.000000000 -0400
34391 +++ linux-2.6.32.46/drivers/mtd/inftlcore.c 2011-05-16 21:46:57.000000000 -0400
34392 @@ -260,6 +260,8 @@ static u16 INFTL_foldchain(struct INFTLr
34393 struct inftl_oob oob;
34394 size_t retlen;
34395
34396 + pax_track_stack();
34397 +
34398 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
34399 "pending=%d)\n", inftl, thisVUC, pendingblock);
34400
34401 diff -urNp linux-2.6.32.46/drivers/mtd/inftlmount.c linux-2.6.32.46/drivers/mtd/inftlmount.c
34402 --- linux-2.6.32.46/drivers/mtd/inftlmount.c 2011-03-27 14:31:47.000000000 -0400
34403 +++ linux-2.6.32.46/drivers/mtd/inftlmount.c 2011-05-16 21:46:57.000000000 -0400
34404 @@ -54,6 +54,8 @@ static int find_boot_record(struct INFTL
34405 struct INFTLPartition *ip;
34406 size_t retlen;
34407
34408 + pax_track_stack();
34409 +
34410 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
34411
34412 /*
34413 diff -urNp linux-2.6.32.46/drivers/mtd/lpddr/qinfo_probe.c linux-2.6.32.46/drivers/mtd/lpddr/qinfo_probe.c
34414 --- linux-2.6.32.46/drivers/mtd/lpddr/qinfo_probe.c 2011-03-27 14:31:47.000000000 -0400
34415 +++ linux-2.6.32.46/drivers/mtd/lpddr/qinfo_probe.c 2011-05-16 21:46:57.000000000 -0400
34416 @@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map
34417 {
34418 map_word pfow_val[4];
34419
34420 + pax_track_stack();
34421 +
34422 /* Check identification string */
34423 pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
34424 pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
34425 diff -urNp linux-2.6.32.46/drivers/mtd/mtdchar.c linux-2.6.32.46/drivers/mtd/mtdchar.c
34426 --- linux-2.6.32.46/drivers/mtd/mtdchar.c 2011-03-27 14:31:47.000000000 -0400
34427 +++ linux-2.6.32.46/drivers/mtd/mtdchar.c 2011-05-16 21:46:57.000000000 -0400
34428 @@ -460,6 +460,8 @@ static int mtd_ioctl(struct inode *inode
34429 u_long size;
34430 struct mtd_info_user info;
34431
34432 + pax_track_stack();
34433 +
34434 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
34435
34436 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
34437 diff -urNp linux-2.6.32.46/drivers/mtd/nftlcore.c linux-2.6.32.46/drivers/mtd/nftlcore.c
34438 --- linux-2.6.32.46/drivers/mtd/nftlcore.c 2011-03-27 14:31:47.000000000 -0400
34439 +++ linux-2.6.32.46/drivers/mtd/nftlcore.c 2011-05-16 21:46:57.000000000 -0400
34440 @@ -254,6 +254,8 @@ static u16 NFTL_foldchain (struct NFTLre
34441 int inplace = 1;
34442 size_t retlen;
34443
34444 + pax_track_stack();
34445 +
34446 memset(BlockMap, 0xff, sizeof(BlockMap));
34447 memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
34448
34449 diff -urNp linux-2.6.32.46/drivers/mtd/nftlmount.c linux-2.6.32.46/drivers/mtd/nftlmount.c
34450 --- linux-2.6.32.46/drivers/mtd/nftlmount.c 2011-03-27 14:31:47.000000000 -0400
34451 +++ linux-2.6.32.46/drivers/mtd/nftlmount.c 2011-05-18 20:09:37.000000000 -0400
34452 @@ -23,6 +23,7 @@
34453 #include <asm/errno.h>
34454 #include <linux/delay.h>
34455 #include <linux/slab.h>
34456 +#include <linux/sched.h>
34457 #include <linux/mtd/mtd.h>
34458 #include <linux/mtd/nand.h>
34459 #include <linux/mtd/nftl.h>
34460 @@ -44,6 +45,8 @@ static int find_boot_record(struct NFTLr
34461 struct mtd_info *mtd = nftl->mbd.mtd;
34462 unsigned int i;
34463
34464 + pax_track_stack();
34465 +
34466 /* Assume logical EraseSize == physical erasesize for starting the scan.
34467 We'll sort it out later if we find a MediaHeader which says otherwise */
34468 /* Actually, we won't. The new DiskOnChip driver has already scanned
34469 diff -urNp linux-2.6.32.46/drivers/mtd/ubi/build.c linux-2.6.32.46/drivers/mtd/ubi/build.c
34470 --- linux-2.6.32.46/drivers/mtd/ubi/build.c 2011-03-27 14:31:47.000000000 -0400
34471 +++ linux-2.6.32.46/drivers/mtd/ubi/build.c 2011-04-17 15:56:46.000000000 -0400
34472 @@ -1255,7 +1255,7 @@ module_exit(ubi_exit);
34473 static int __init bytes_str_to_int(const char *str)
34474 {
34475 char *endp;
34476 - unsigned long result;
34477 + unsigned long result, scale = 1;
34478
34479 result = simple_strtoul(str, &endp, 0);
34480 if (str == endp || result >= INT_MAX) {
34481 @@ -1266,11 +1266,11 @@ static int __init bytes_str_to_int(const
34482
34483 switch (*endp) {
34484 case 'G':
34485 - result *= 1024;
34486 + scale *= 1024;
34487 case 'M':
34488 - result *= 1024;
34489 + scale *= 1024;
34490 case 'K':
34491 - result *= 1024;
34492 + scale *= 1024;
34493 if (endp[1] == 'i' && endp[2] == 'B')
34494 endp += 2;
34495 case '\0':
34496 @@ -1281,7 +1281,13 @@ static int __init bytes_str_to_int(const
34497 return -EINVAL;
34498 }
34499
34500 - return result;
34501 + if ((intoverflow_t)result*scale >= INT_MAX) {
34502 + printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
34503 + str);
34504 + return -EINVAL;
34505 + }
34506 +
34507 + return result*scale;
34508 }
34509
34510 /**
34511 diff -urNp linux-2.6.32.46/drivers/net/bnx2.c linux-2.6.32.46/drivers/net/bnx2.c
34512 --- linux-2.6.32.46/drivers/net/bnx2.c 2011-03-27 14:31:47.000000000 -0400
34513 +++ linux-2.6.32.46/drivers/net/bnx2.c 2011-05-16 21:46:57.000000000 -0400
34514 @@ -5809,6 +5809,8 @@ bnx2_test_nvram(struct bnx2 *bp)
34515 int rc = 0;
34516 u32 magic, csum;
34517
34518 + pax_track_stack();
34519 +
34520 if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
34521 goto test_nvram_done;
34522
34523 diff -urNp linux-2.6.32.46/drivers/net/cxgb3/l2t.h linux-2.6.32.46/drivers/net/cxgb3/l2t.h
34524 --- linux-2.6.32.46/drivers/net/cxgb3/l2t.h 2011-03-27 14:31:47.000000000 -0400
34525 +++ linux-2.6.32.46/drivers/net/cxgb3/l2t.h 2011-08-05 20:33:55.000000000 -0400
34526 @@ -86,7 +86,7 @@ typedef void (*arp_failure_handler_func)
34527 */
34528 struct l2t_skb_cb {
34529 arp_failure_handler_func arp_failure_handler;
34530 -};
34531 +} __no_const;
34532
34533 #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
34534
34535 diff -urNp linux-2.6.32.46/drivers/net/cxgb3/t3_hw.c linux-2.6.32.46/drivers/net/cxgb3/t3_hw.c
34536 --- linux-2.6.32.46/drivers/net/cxgb3/t3_hw.c 2011-03-27 14:31:47.000000000 -0400
34537 +++ linux-2.6.32.46/drivers/net/cxgb3/t3_hw.c 2011-05-16 21:46:57.000000000 -0400
34538 @@ -699,6 +699,8 @@ static int get_vpd_params(struct adapter
34539 int i, addr, ret;
34540 struct t3_vpd vpd;
34541
34542 + pax_track_stack();
34543 +
34544 /*
34545 * Card information is normally at VPD_BASE but some early cards had
34546 * it at 0.
34547 diff -urNp linux-2.6.32.46/drivers/net/e1000e/82571.c linux-2.6.32.46/drivers/net/e1000e/82571.c
34548 --- linux-2.6.32.46/drivers/net/e1000e/82571.c 2011-03-27 14:31:47.000000000 -0400
34549 +++ linux-2.6.32.46/drivers/net/e1000e/82571.c 2011-08-23 21:22:32.000000000 -0400
34550 @@ -212,7 +212,7 @@ static s32 e1000_init_mac_params_82571(s
34551 {
34552 struct e1000_hw *hw = &adapter->hw;
34553 struct e1000_mac_info *mac = &hw->mac;
34554 - struct e1000_mac_operations *func = &mac->ops;
34555 + e1000_mac_operations_no_const *func = &mac->ops;
34556 u32 swsm = 0;
34557 u32 swsm2 = 0;
34558 bool force_clear_smbi = false;
34559 @@ -1656,7 +1656,7 @@ static void e1000_clear_hw_cntrs_82571(s
34560 temp = er32(ICRXDMTC);
34561 }
34562
34563 -static struct e1000_mac_operations e82571_mac_ops = {
34564 +static const struct e1000_mac_operations e82571_mac_ops = {
34565 /* .check_mng_mode: mac type dependent */
34566 /* .check_for_link: media type dependent */
34567 .id_led_init = e1000e_id_led_init,
34568 @@ -1674,7 +1674,7 @@ static struct e1000_mac_operations e8257
34569 .setup_led = e1000e_setup_led_generic,
34570 };
34571
34572 -static struct e1000_phy_operations e82_phy_ops_igp = {
34573 +static const struct e1000_phy_operations e82_phy_ops_igp = {
34574 .acquire_phy = e1000_get_hw_semaphore_82571,
34575 .check_reset_block = e1000e_check_reset_block_generic,
34576 .commit_phy = NULL,
34577 @@ -1691,7 +1691,7 @@ static struct e1000_phy_operations e82_p
34578 .cfg_on_link_up = NULL,
34579 };
34580
34581 -static struct e1000_phy_operations e82_phy_ops_m88 = {
34582 +static const struct e1000_phy_operations e82_phy_ops_m88 = {
34583 .acquire_phy = e1000_get_hw_semaphore_82571,
34584 .check_reset_block = e1000e_check_reset_block_generic,
34585 .commit_phy = e1000e_phy_sw_reset,
34586 @@ -1708,7 +1708,7 @@ static struct e1000_phy_operations e82_p
34587 .cfg_on_link_up = NULL,
34588 };
34589
34590 -static struct e1000_phy_operations e82_phy_ops_bm = {
34591 +static const struct e1000_phy_operations e82_phy_ops_bm = {
34592 .acquire_phy = e1000_get_hw_semaphore_82571,
34593 .check_reset_block = e1000e_check_reset_block_generic,
34594 .commit_phy = e1000e_phy_sw_reset,
34595 @@ -1725,7 +1725,7 @@ static struct e1000_phy_operations e82_p
34596 .cfg_on_link_up = NULL,
34597 };
34598
34599 -static struct e1000_nvm_operations e82571_nvm_ops = {
34600 +static const struct e1000_nvm_operations e82571_nvm_ops = {
34601 .acquire_nvm = e1000_acquire_nvm_82571,
34602 .read_nvm = e1000e_read_nvm_eerd,
34603 .release_nvm = e1000_release_nvm_82571,
34604 diff -urNp linux-2.6.32.46/drivers/net/e1000e/e1000.h linux-2.6.32.46/drivers/net/e1000e/e1000.h
34605 --- linux-2.6.32.46/drivers/net/e1000e/e1000.h 2011-03-27 14:31:47.000000000 -0400
34606 +++ linux-2.6.32.46/drivers/net/e1000e/e1000.h 2011-04-17 15:56:46.000000000 -0400
34607 @@ -375,9 +375,9 @@ struct e1000_info {
34608 u32 pba;
34609 u32 max_hw_frame_size;
34610 s32 (*get_variants)(struct e1000_adapter *);
34611 - struct e1000_mac_operations *mac_ops;
34612 - struct e1000_phy_operations *phy_ops;
34613 - struct e1000_nvm_operations *nvm_ops;
34614 + const struct e1000_mac_operations *mac_ops;
34615 + const struct e1000_phy_operations *phy_ops;
34616 + const struct e1000_nvm_operations *nvm_ops;
34617 };
34618
34619 /* hardware capability, feature, and workaround flags */
34620 diff -urNp linux-2.6.32.46/drivers/net/e1000e/es2lan.c linux-2.6.32.46/drivers/net/e1000e/es2lan.c
34621 --- linux-2.6.32.46/drivers/net/e1000e/es2lan.c 2011-03-27 14:31:47.000000000 -0400
34622 +++ linux-2.6.32.46/drivers/net/e1000e/es2lan.c 2011-08-23 21:22:32.000000000 -0400
34623 @@ -207,7 +207,7 @@ static s32 e1000_init_mac_params_80003es
34624 {
34625 struct e1000_hw *hw = &adapter->hw;
34626 struct e1000_mac_info *mac = &hw->mac;
34627 - struct e1000_mac_operations *func = &mac->ops;
34628 + e1000_mac_operations_no_const *func = &mac->ops;
34629
34630 /* Set media type */
34631 switch (adapter->pdev->device) {
34632 @@ -1365,7 +1365,7 @@ static void e1000_clear_hw_cntrs_80003es
34633 temp = er32(ICRXDMTC);
34634 }
34635
34636 -static struct e1000_mac_operations es2_mac_ops = {
34637 +static const struct e1000_mac_operations es2_mac_ops = {
34638 .id_led_init = e1000e_id_led_init,
34639 .check_mng_mode = e1000e_check_mng_mode_generic,
34640 /* check_for_link dependent on media type */
34641 @@ -1383,7 +1383,7 @@ static struct e1000_mac_operations es2_m
34642 .setup_led = e1000e_setup_led_generic,
34643 };
34644
34645 -static struct e1000_phy_operations es2_phy_ops = {
34646 +static const struct e1000_phy_operations es2_phy_ops = {
34647 .acquire_phy = e1000_acquire_phy_80003es2lan,
34648 .check_reset_block = e1000e_check_reset_block_generic,
34649 .commit_phy = e1000e_phy_sw_reset,
34650 @@ -1400,7 +1400,7 @@ static struct e1000_phy_operations es2_p
34651 .cfg_on_link_up = e1000_cfg_on_link_up_80003es2lan,
34652 };
34653
34654 -static struct e1000_nvm_operations es2_nvm_ops = {
34655 +static const struct e1000_nvm_operations es2_nvm_ops = {
34656 .acquire_nvm = e1000_acquire_nvm_80003es2lan,
34657 .read_nvm = e1000e_read_nvm_eerd,
34658 .release_nvm = e1000_release_nvm_80003es2lan,
34659 diff -urNp linux-2.6.32.46/drivers/net/e1000e/hw.h linux-2.6.32.46/drivers/net/e1000e/hw.h
34660 --- linux-2.6.32.46/drivers/net/e1000e/hw.h 2011-03-27 14:31:47.000000000 -0400
34661 +++ linux-2.6.32.46/drivers/net/e1000e/hw.h 2011-08-23 21:27:38.000000000 -0400
34662 @@ -753,6 +753,7 @@ struct e1000_mac_operations {
34663 s32 (*setup_physical_interface)(struct e1000_hw *);
34664 s32 (*setup_led)(struct e1000_hw *);
34665 };
34666 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
34667
34668 /* Function pointers for the PHY. */
34669 struct e1000_phy_operations {
34670 @@ -774,6 +775,7 @@ struct e1000_phy_operations {
34671 s32 (*write_phy_reg_locked)(struct e1000_hw *, u32, u16);
34672 s32 (*cfg_on_link_up)(struct e1000_hw *);
34673 };
34674 +typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
34675
34676 /* Function pointers for the NVM. */
34677 struct e1000_nvm_operations {
34678 @@ -785,9 +787,10 @@ struct e1000_nvm_operations {
34679 s32 (*validate_nvm)(struct e1000_hw *);
34680 s32 (*write_nvm)(struct e1000_hw *, u16, u16, u16 *);
34681 };
34682 +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
34683
34684 struct e1000_mac_info {
34685 - struct e1000_mac_operations ops;
34686 + e1000_mac_operations_no_const ops;
34687
34688 u8 addr[6];
34689 u8 perm_addr[6];
34690 @@ -823,7 +826,7 @@ struct e1000_mac_info {
34691 };
34692
34693 struct e1000_phy_info {
34694 - struct e1000_phy_operations ops;
34695 + e1000_phy_operations_no_const ops;
34696
34697 enum e1000_phy_type type;
34698
34699 @@ -857,7 +860,7 @@ struct e1000_phy_info {
34700 };
34701
34702 struct e1000_nvm_info {
34703 - struct e1000_nvm_operations ops;
34704 + e1000_nvm_operations_no_const ops;
34705
34706 enum e1000_nvm_type type;
34707 enum e1000_nvm_override override;
34708 diff -urNp linux-2.6.32.46/drivers/net/e1000e/ich8lan.c linux-2.6.32.46/drivers/net/e1000e/ich8lan.c
34709 --- linux-2.6.32.46/drivers/net/e1000e/ich8lan.c 2011-05-10 22:12:01.000000000 -0400
34710 +++ linux-2.6.32.46/drivers/net/e1000e/ich8lan.c 2011-08-23 21:22:32.000000000 -0400
34711 @@ -3463,7 +3463,7 @@ static void e1000_clear_hw_cntrs_ich8lan
34712 }
34713 }
34714
34715 -static struct e1000_mac_operations ich8_mac_ops = {
34716 +static const struct e1000_mac_operations ich8_mac_ops = {
34717 .id_led_init = e1000e_id_led_init,
34718 .check_mng_mode = e1000_check_mng_mode_ich8lan,
34719 .check_for_link = e1000_check_for_copper_link_ich8lan,
34720 @@ -3481,7 +3481,7 @@ static struct e1000_mac_operations ich8_
34721 /* id_led_init dependent on mac type */
34722 };
34723
34724 -static struct e1000_phy_operations ich8_phy_ops = {
34725 +static const struct e1000_phy_operations ich8_phy_ops = {
34726 .acquire_phy = e1000_acquire_swflag_ich8lan,
34727 .check_reset_block = e1000_check_reset_block_ich8lan,
34728 .commit_phy = NULL,
34729 @@ -3497,7 +3497,7 @@ static struct e1000_phy_operations ich8_
34730 .write_phy_reg = e1000e_write_phy_reg_igp,
34731 };
34732
34733 -static struct e1000_nvm_operations ich8_nvm_ops = {
34734 +static const struct e1000_nvm_operations ich8_nvm_ops = {
34735 .acquire_nvm = e1000_acquire_nvm_ich8lan,
34736 .read_nvm = e1000_read_nvm_ich8lan,
34737 .release_nvm = e1000_release_nvm_ich8lan,
34738 diff -urNp linux-2.6.32.46/drivers/net/hamradio/6pack.c linux-2.6.32.46/drivers/net/hamradio/6pack.c
34739 --- linux-2.6.32.46/drivers/net/hamradio/6pack.c 2011-07-13 17:23:04.000000000 -0400
34740 +++ linux-2.6.32.46/drivers/net/hamradio/6pack.c 2011-07-13 17:23:18.000000000 -0400
34741 @@ -461,6 +461,8 @@ static void sixpack_receive_buf(struct t
34742 unsigned char buf[512];
34743 int count1;
34744
34745 + pax_track_stack();
34746 +
34747 if (!count)
34748 return;
34749
34750 diff -urNp linux-2.6.32.46/drivers/net/ibmveth.c linux-2.6.32.46/drivers/net/ibmveth.c
34751 --- linux-2.6.32.46/drivers/net/ibmveth.c 2011-03-27 14:31:47.000000000 -0400
34752 +++ linux-2.6.32.46/drivers/net/ibmveth.c 2011-04-17 15:56:46.000000000 -0400
34753 @@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attr
34754 NULL,
34755 };
34756
34757 -static struct sysfs_ops veth_pool_ops = {
34758 +static const struct sysfs_ops veth_pool_ops = {
34759 .show = veth_pool_show,
34760 .store = veth_pool_store,
34761 };
34762 diff -urNp linux-2.6.32.46/drivers/net/igb/e1000_82575.c linux-2.6.32.46/drivers/net/igb/e1000_82575.c
34763 --- linux-2.6.32.46/drivers/net/igb/e1000_82575.c 2011-08-29 22:24:44.000000000 -0400
34764 +++ linux-2.6.32.46/drivers/net/igb/e1000_82575.c 2011-08-29 22:25:07.000000000 -0400
34765 @@ -1411,7 +1411,7 @@ void igb_vmdq_set_replication_pf(struct
34766 wr32(E1000_VT_CTL, vt_ctl);
34767 }
34768
34769 -static struct e1000_mac_operations e1000_mac_ops_82575 = {
34770 +static const struct e1000_mac_operations e1000_mac_ops_82575 = {
34771 .reset_hw = igb_reset_hw_82575,
34772 .init_hw = igb_init_hw_82575,
34773 .check_for_link = igb_check_for_link_82575,
34774 @@ -1420,13 +1420,13 @@ static struct e1000_mac_operations e1000
34775 .get_speed_and_duplex = igb_get_speed_and_duplex_copper,
34776 };
34777
34778 -static struct e1000_phy_operations e1000_phy_ops_82575 = {
34779 +static const struct e1000_phy_operations e1000_phy_ops_82575 = {
34780 .acquire = igb_acquire_phy_82575,
34781 .get_cfg_done = igb_get_cfg_done_82575,
34782 .release = igb_release_phy_82575,
34783 };
34784
34785 -static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
34786 +static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
34787 .acquire = igb_acquire_nvm_82575,
34788 .read = igb_read_nvm_eerd,
34789 .release = igb_release_nvm_82575,
34790 diff -urNp linux-2.6.32.46/drivers/net/igb/e1000_hw.h linux-2.6.32.46/drivers/net/igb/e1000_hw.h
34791 --- linux-2.6.32.46/drivers/net/igb/e1000_hw.h 2011-03-27 14:31:47.000000000 -0400
34792 +++ linux-2.6.32.46/drivers/net/igb/e1000_hw.h 2011-08-23 21:28:01.000000000 -0400
34793 @@ -288,6 +288,7 @@ struct e1000_mac_operations {
34794 s32 (*read_mac_addr)(struct e1000_hw *);
34795 s32 (*get_speed_and_duplex)(struct e1000_hw *, u16 *, u16 *);
34796 };
34797 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
34798
34799 struct e1000_phy_operations {
34800 s32 (*acquire)(struct e1000_hw *);
34801 @@ -303,6 +304,7 @@ struct e1000_phy_operations {
34802 s32 (*set_d3_lplu_state)(struct e1000_hw *, bool);
34803 s32 (*write_reg)(struct e1000_hw *, u32, u16);
34804 };
34805 +typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
34806
34807 struct e1000_nvm_operations {
34808 s32 (*acquire)(struct e1000_hw *);
34809 @@ -310,6 +312,7 @@ struct e1000_nvm_operations {
34810 void (*release)(struct e1000_hw *);
34811 s32 (*write)(struct e1000_hw *, u16, u16, u16 *);
34812 };
34813 +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
34814
34815 struct e1000_info {
34816 s32 (*get_invariants)(struct e1000_hw *);
34817 @@ -321,7 +324,7 @@ struct e1000_info {
34818 extern const struct e1000_info e1000_82575_info;
34819
34820 struct e1000_mac_info {
34821 - struct e1000_mac_operations ops;
34822 + e1000_mac_operations_no_const ops;
34823
34824 u8 addr[6];
34825 u8 perm_addr[6];
34826 @@ -365,7 +368,7 @@ struct e1000_mac_info {
34827 };
34828
34829 struct e1000_phy_info {
34830 - struct e1000_phy_operations ops;
34831 + e1000_phy_operations_no_const ops;
34832
34833 enum e1000_phy_type type;
34834
34835 @@ -400,7 +403,7 @@ struct e1000_phy_info {
34836 };
34837
34838 struct e1000_nvm_info {
34839 - struct e1000_nvm_operations ops;
34840 + e1000_nvm_operations_no_const ops;
34841
34842 enum e1000_nvm_type type;
34843 enum e1000_nvm_override override;
34844 @@ -446,6 +449,7 @@ struct e1000_mbx_operations {
34845 s32 (*check_for_ack)(struct e1000_hw *, u16);
34846 s32 (*check_for_rst)(struct e1000_hw *, u16);
34847 };
34848 +typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
34849
34850 struct e1000_mbx_stats {
34851 u32 msgs_tx;
34852 @@ -457,7 +461,7 @@ struct e1000_mbx_stats {
34853 };
34854
34855 struct e1000_mbx_info {
34856 - struct e1000_mbx_operations ops;
34857 + e1000_mbx_operations_no_const ops;
34858 struct e1000_mbx_stats stats;
34859 u32 timeout;
34860 u32 usec_delay;
34861 diff -urNp linux-2.6.32.46/drivers/net/igbvf/vf.h linux-2.6.32.46/drivers/net/igbvf/vf.h
34862 --- linux-2.6.32.46/drivers/net/igbvf/vf.h 2011-03-27 14:31:47.000000000 -0400
34863 +++ linux-2.6.32.46/drivers/net/igbvf/vf.h 2011-08-23 21:22:38.000000000 -0400
34864 @@ -187,9 +187,10 @@ struct e1000_mac_operations {
34865 s32 (*read_mac_addr)(struct e1000_hw *);
34866 s32 (*set_vfta)(struct e1000_hw *, u16, bool);
34867 };
34868 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
34869
34870 struct e1000_mac_info {
34871 - struct e1000_mac_operations ops;
34872 + e1000_mac_operations_no_const ops;
34873 u8 addr[6];
34874 u8 perm_addr[6];
34875
34876 @@ -211,6 +212,7 @@ struct e1000_mbx_operations {
34877 s32 (*check_for_ack)(struct e1000_hw *);
34878 s32 (*check_for_rst)(struct e1000_hw *);
34879 };
34880 +typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
34881
34882 struct e1000_mbx_stats {
34883 u32 msgs_tx;
34884 @@ -222,7 +224,7 @@ struct e1000_mbx_stats {
34885 };
34886
34887 struct e1000_mbx_info {
34888 - struct e1000_mbx_operations ops;
34889 + e1000_mbx_operations_no_const ops;
34890 struct e1000_mbx_stats stats;
34891 u32 timeout;
34892 u32 usec_delay;
34893 diff -urNp linux-2.6.32.46/drivers/net/iseries_veth.c linux-2.6.32.46/drivers/net/iseries_veth.c
34894 --- linux-2.6.32.46/drivers/net/iseries_veth.c 2011-03-27 14:31:47.000000000 -0400
34895 +++ linux-2.6.32.46/drivers/net/iseries_veth.c 2011-04-17 15:56:46.000000000 -0400
34896 @@ -384,7 +384,7 @@ static struct attribute *veth_cnx_defaul
34897 NULL
34898 };
34899
34900 -static struct sysfs_ops veth_cnx_sysfs_ops = {
34901 +static const struct sysfs_ops veth_cnx_sysfs_ops = {
34902 .show = veth_cnx_attribute_show
34903 };
34904
34905 @@ -441,7 +441,7 @@ static struct attribute *veth_port_defau
34906 NULL
34907 };
34908
34909 -static struct sysfs_ops veth_port_sysfs_ops = {
34910 +static const struct sysfs_ops veth_port_sysfs_ops = {
34911 .show = veth_port_attribute_show
34912 };
34913
34914 diff -urNp linux-2.6.32.46/drivers/net/ixgb/ixgb_main.c linux-2.6.32.46/drivers/net/ixgb/ixgb_main.c
34915 --- linux-2.6.32.46/drivers/net/ixgb/ixgb_main.c 2011-03-27 14:31:47.000000000 -0400
34916 +++ linux-2.6.32.46/drivers/net/ixgb/ixgb_main.c 2011-05-16 21:46:57.000000000 -0400
34917 @@ -1052,6 +1052,8 @@ ixgb_set_multi(struct net_device *netdev
34918 u32 rctl;
34919 int i;
34920
34921 + pax_track_stack();
34922 +
34923 /* Check for Promiscuous and All Multicast modes */
34924
34925 rctl = IXGB_READ_REG(hw, RCTL);
34926 diff -urNp linux-2.6.32.46/drivers/net/ixgb/ixgb_param.c linux-2.6.32.46/drivers/net/ixgb/ixgb_param.c
34927 --- linux-2.6.32.46/drivers/net/ixgb/ixgb_param.c 2011-03-27 14:31:47.000000000 -0400
34928 +++ linux-2.6.32.46/drivers/net/ixgb/ixgb_param.c 2011-05-16 21:46:57.000000000 -0400
34929 @@ -260,6 +260,9 @@ void __devinit
34930 ixgb_check_options(struct ixgb_adapter *adapter)
34931 {
34932 int bd = adapter->bd_number;
34933 +
34934 + pax_track_stack();
34935 +
34936 if (bd >= IXGB_MAX_NIC) {
34937 printk(KERN_NOTICE
34938 "Warning: no configuration for board #%i\n", bd);
34939 diff -urNp linux-2.6.32.46/drivers/net/ixgbe/ixgbe_type.h linux-2.6.32.46/drivers/net/ixgbe/ixgbe_type.h
34940 --- linux-2.6.32.46/drivers/net/ixgbe/ixgbe_type.h 2011-03-27 14:31:47.000000000 -0400
34941 +++ linux-2.6.32.46/drivers/net/ixgbe/ixgbe_type.h 2011-08-23 21:22:38.000000000 -0400
34942 @@ -2327,6 +2327,7 @@ struct ixgbe_eeprom_operations {
34943 s32 (*validate_checksum)(struct ixgbe_hw *, u16 *);
34944 s32 (*update_checksum)(struct ixgbe_hw *);
34945 };
34946 +typedef struct ixgbe_eeprom_operations __no_const ixgbe_eeprom_operations_no_const;
34947
34948 struct ixgbe_mac_operations {
34949 s32 (*init_hw)(struct ixgbe_hw *);
34950 @@ -2376,6 +2377,7 @@ struct ixgbe_mac_operations {
34951 /* Flow Control */
34952 s32 (*fc_enable)(struct ixgbe_hw *, s32);
34953 };
34954 +typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
34955
34956 struct ixgbe_phy_operations {
34957 s32 (*identify)(struct ixgbe_hw *);
34958 @@ -2394,9 +2396,10 @@ struct ixgbe_phy_operations {
34959 s32 (*read_i2c_eeprom)(struct ixgbe_hw *, u8 , u8 *);
34960 s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
34961 };
34962 +typedef struct ixgbe_phy_operations __no_const ixgbe_phy_operations_no_const;
34963
34964 struct ixgbe_eeprom_info {
34965 - struct ixgbe_eeprom_operations ops;
34966 + ixgbe_eeprom_operations_no_const ops;
34967 enum ixgbe_eeprom_type type;
34968 u32 semaphore_delay;
34969 u16 word_size;
34970 @@ -2404,7 +2407,7 @@ struct ixgbe_eeprom_info {
34971 };
34972
34973 struct ixgbe_mac_info {
34974 - struct ixgbe_mac_operations ops;
34975 + ixgbe_mac_operations_no_const ops;
34976 enum ixgbe_mac_type type;
34977 u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
34978 u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
34979 @@ -2423,7 +2426,7 @@ struct ixgbe_mac_info {
34980 };
34981
34982 struct ixgbe_phy_info {
34983 - struct ixgbe_phy_operations ops;
34984 + ixgbe_phy_operations_no_const ops;
34985 struct mdio_if_info mdio;
34986 enum ixgbe_phy_type type;
34987 u32 id;
34988 diff -urNp linux-2.6.32.46/drivers/net/mlx4/main.c linux-2.6.32.46/drivers/net/mlx4/main.c
34989 --- linux-2.6.32.46/drivers/net/mlx4/main.c 2011-03-27 14:31:47.000000000 -0400
34990 +++ linux-2.6.32.46/drivers/net/mlx4/main.c 2011-05-18 20:09:37.000000000 -0400
34991 @@ -38,6 +38,7 @@
34992 #include <linux/errno.h>
34993 #include <linux/pci.h>
34994 #include <linux/dma-mapping.h>
34995 +#include <linux/sched.h>
34996
34997 #include <linux/mlx4/device.h>
34998 #include <linux/mlx4/doorbell.h>
34999 @@ -730,6 +731,8 @@ static int mlx4_init_hca(struct mlx4_dev
35000 u64 icm_size;
35001 int err;
35002
35003 + pax_track_stack();
35004 +
35005 err = mlx4_QUERY_FW(dev);
35006 if (err) {
35007 if (err == -EACCES)
35008 diff -urNp linux-2.6.32.46/drivers/net/niu.c linux-2.6.32.46/drivers/net/niu.c
35009 --- linux-2.6.32.46/drivers/net/niu.c 2011-05-10 22:12:01.000000000 -0400
35010 +++ linux-2.6.32.46/drivers/net/niu.c 2011-05-16 21:46:57.000000000 -0400
35011 @@ -9128,6 +9128,8 @@ static void __devinit niu_try_msix(struc
35012 int i, num_irqs, err;
35013 u8 first_ldg;
35014
35015 + pax_track_stack();
35016 +
35017 first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
35018 for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
35019 ldg_num_map[i] = first_ldg + i;
35020 diff -urNp linux-2.6.32.46/drivers/net/pcnet32.c linux-2.6.32.46/drivers/net/pcnet32.c
35021 --- linux-2.6.32.46/drivers/net/pcnet32.c 2011-03-27 14:31:47.000000000 -0400
35022 +++ linux-2.6.32.46/drivers/net/pcnet32.c 2011-08-05 20:33:55.000000000 -0400
35023 @@ -79,7 +79,7 @@ static int cards_found;
35024 /*
35025 * VLB I/O addresses
35026 */
35027 -static unsigned int pcnet32_portlist[] __initdata =
35028 +static unsigned int pcnet32_portlist[] __devinitdata =
35029 { 0x300, 0x320, 0x340, 0x360, 0 };
35030
35031 static int pcnet32_debug = 0;
35032 @@ -267,7 +267,7 @@ struct pcnet32_private {
35033 struct sk_buff **rx_skbuff;
35034 dma_addr_t *tx_dma_addr;
35035 dma_addr_t *rx_dma_addr;
35036 - struct pcnet32_access a;
35037 + struct pcnet32_access *a;
35038 spinlock_t lock; /* Guard lock */
35039 unsigned int cur_rx, cur_tx; /* The next free ring entry */
35040 unsigned int rx_ring_size; /* current rx ring size */
35041 @@ -457,9 +457,9 @@ static void pcnet32_netif_start(struct n
35042 u16 val;
35043
35044 netif_wake_queue(dev);
35045 - val = lp->a.read_csr(ioaddr, CSR3);
35046 + val = lp->a->read_csr(ioaddr, CSR3);
35047 val &= 0x00ff;
35048 - lp->a.write_csr(ioaddr, CSR3, val);
35049 + lp->a->write_csr(ioaddr, CSR3, val);
35050 napi_enable(&lp->napi);
35051 }
35052
35053 @@ -744,7 +744,7 @@ static u32 pcnet32_get_link(struct net_d
35054 r = mii_link_ok(&lp->mii_if);
35055 } else if (lp->chip_version >= PCNET32_79C970A) {
35056 ulong ioaddr = dev->base_addr; /* card base I/O address */
35057 - r = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
35058 + r = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
35059 } else { /* can not detect link on really old chips */
35060 r = 1;
35061 }
35062 @@ -806,7 +806,7 @@ static int pcnet32_set_ringparam(struct
35063 pcnet32_netif_stop(dev);
35064
35065 spin_lock_irqsave(&lp->lock, flags);
35066 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
35067 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
35068
35069 size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
35070
35071 @@ -886,7 +886,7 @@ static void pcnet32_ethtool_test(struct
35072 static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
35073 {
35074 struct pcnet32_private *lp = netdev_priv(dev);
35075 - struct pcnet32_access *a = &lp->a; /* access to registers */
35076 + struct pcnet32_access *a = lp->a; /* access to registers */
35077 ulong ioaddr = dev->base_addr; /* card base I/O address */
35078 struct sk_buff *skb; /* sk buff */
35079 int x, i; /* counters */
35080 @@ -906,21 +906,21 @@ static int pcnet32_loopback_test(struct
35081 pcnet32_netif_stop(dev);
35082
35083 spin_lock_irqsave(&lp->lock, flags);
35084 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
35085 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
35086
35087 numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size));
35088
35089 /* Reset the PCNET32 */
35090 - lp->a.reset(ioaddr);
35091 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
35092 + lp->a->reset(ioaddr);
35093 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
35094
35095 /* switch pcnet32 to 32bit mode */
35096 - lp->a.write_bcr(ioaddr, 20, 2);
35097 + lp->a->write_bcr(ioaddr, 20, 2);
35098
35099 /* purge & init rings but don't actually restart */
35100 pcnet32_restart(dev, 0x0000);
35101
35102 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
35103 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
35104
35105 /* Initialize Transmit buffers. */
35106 size = data_len + 15;
35107 @@ -966,10 +966,10 @@ static int pcnet32_loopback_test(struct
35108
35109 /* set int loopback in CSR15 */
35110 x = a->read_csr(ioaddr, CSR15) & 0xfffc;
35111 - lp->a.write_csr(ioaddr, CSR15, x | 0x0044);
35112 + lp->a->write_csr(ioaddr, CSR15, x | 0x0044);
35113
35114 teststatus = cpu_to_le16(0x8000);
35115 - lp->a.write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
35116 + lp->a->write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
35117
35118 /* Check status of descriptors */
35119 for (x = 0; x < numbuffs; x++) {
35120 @@ -990,7 +990,7 @@ static int pcnet32_loopback_test(struct
35121 }
35122 }
35123
35124 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
35125 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
35126 wmb();
35127 if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) {
35128 printk(KERN_DEBUG "%s: RX loopback packets:\n", dev->name);
35129 @@ -1039,7 +1039,7 @@ static int pcnet32_loopback_test(struct
35130 pcnet32_restart(dev, CSR0_NORMAL);
35131 } else {
35132 pcnet32_purge_rx_ring(dev);
35133 - lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
35134 + lp->a->write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
35135 }
35136 spin_unlock_irqrestore(&lp->lock, flags);
35137
35138 @@ -1049,7 +1049,7 @@ static int pcnet32_loopback_test(struct
35139 static void pcnet32_led_blink_callback(struct net_device *dev)
35140 {
35141 struct pcnet32_private *lp = netdev_priv(dev);
35142 - struct pcnet32_access *a = &lp->a;
35143 + struct pcnet32_access *a = lp->a;
35144 ulong ioaddr = dev->base_addr;
35145 unsigned long flags;
35146 int i;
35147 @@ -1066,7 +1066,7 @@ static void pcnet32_led_blink_callback(s
35148 static int pcnet32_phys_id(struct net_device *dev, u32 data)
35149 {
35150 struct pcnet32_private *lp = netdev_priv(dev);
35151 - struct pcnet32_access *a = &lp->a;
35152 + struct pcnet32_access *a = lp->a;
35153 ulong ioaddr = dev->base_addr;
35154 unsigned long flags;
35155 int i, regs[4];
35156 @@ -1112,7 +1112,7 @@ static int pcnet32_suspend(struct net_de
35157 {
35158 int csr5;
35159 struct pcnet32_private *lp = netdev_priv(dev);
35160 - struct pcnet32_access *a = &lp->a;
35161 + struct pcnet32_access *a = lp->a;
35162 ulong ioaddr = dev->base_addr;
35163 int ticks;
35164
35165 @@ -1388,8 +1388,8 @@ static int pcnet32_poll(struct napi_stru
35166 spin_lock_irqsave(&lp->lock, flags);
35167 if (pcnet32_tx(dev)) {
35168 /* reset the chip to clear the error condition, then restart */
35169 - lp->a.reset(ioaddr);
35170 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
35171 + lp->a->reset(ioaddr);
35172 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
35173 pcnet32_restart(dev, CSR0_START);
35174 netif_wake_queue(dev);
35175 }
35176 @@ -1401,12 +1401,12 @@ static int pcnet32_poll(struct napi_stru
35177 __napi_complete(napi);
35178
35179 /* clear interrupt masks */
35180 - val = lp->a.read_csr(ioaddr, CSR3);
35181 + val = lp->a->read_csr(ioaddr, CSR3);
35182 val &= 0x00ff;
35183 - lp->a.write_csr(ioaddr, CSR3, val);
35184 + lp->a->write_csr(ioaddr, CSR3, val);
35185
35186 /* Set interrupt enable. */
35187 - lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN);
35188 + lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN);
35189
35190 spin_unlock_irqrestore(&lp->lock, flags);
35191 }
35192 @@ -1429,7 +1429,7 @@ static void pcnet32_get_regs(struct net_
35193 int i, csr0;
35194 u16 *buff = ptr;
35195 struct pcnet32_private *lp = netdev_priv(dev);
35196 - struct pcnet32_access *a = &lp->a;
35197 + struct pcnet32_access *a = lp->a;
35198 ulong ioaddr = dev->base_addr;
35199 unsigned long flags;
35200
35201 @@ -1466,9 +1466,9 @@ static void pcnet32_get_regs(struct net_
35202 for (j = 0; j < PCNET32_MAX_PHYS; j++) {
35203 if (lp->phymask & (1 << j)) {
35204 for (i = 0; i < PCNET32_REGS_PER_PHY; i++) {
35205 - lp->a.write_bcr(ioaddr, 33,
35206 + lp->a->write_bcr(ioaddr, 33,
35207 (j << 5) | i);
35208 - *buff++ = lp->a.read_bcr(ioaddr, 34);
35209 + *buff++ = lp->a->read_bcr(ioaddr, 34);
35210 }
35211 }
35212 }
35213 @@ -1858,7 +1858,7 @@ pcnet32_probe1(unsigned long ioaddr, int
35214 ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
35215 lp->options |= PCNET32_PORT_FD;
35216
35217 - lp->a = *a;
35218 + lp->a = a;
35219
35220 /* prior to register_netdev, dev->name is not yet correct */
35221 if (pcnet32_alloc_ring(dev, pci_name(lp->pci_dev))) {
35222 @@ -1917,7 +1917,7 @@ pcnet32_probe1(unsigned long ioaddr, int
35223 if (lp->mii) {
35224 /* lp->phycount and lp->phymask are set to 0 by memset above */
35225
35226 - lp->mii_if.phy_id = ((lp->a.read_bcr(ioaddr, 33)) >> 5) & 0x1f;
35227 + lp->mii_if.phy_id = ((lp->a->read_bcr(ioaddr, 33)) >> 5) & 0x1f;
35228 /* scan for PHYs */
35229 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
35230 unsigned short id1, id2;
35231 @@ -1938,7 +1938,7 @@ pcnet32_probe1(unsigned long ioaddr, int
35232 "Found PHY %04x:%04x at address %d.\n",
35233 id1, id2, i);
35234 }
35235 - lp->a.write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
35236 + lp->a->write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
35237 if (lp->phycount > 1) {
35238 lp->options |= PCNET32_PORT_MII;
35239 }
35240 @@ -2109,10 +2109,10 @@ static int pcnet32_open(struct net_devic
35241 }
35242
35243 /* Reset the PCNET32 */
35244 - lp->a.reset(ioaddr);
35245 + lp->a->reset(ioaddr);
35246
35247 /* switch pcnet32 to 32bit mode */
35248 - lp->a.write_bcr(ioaddr, 20, 2);
35249 + lp->a->write_bcr(ioaddr, 20, 2);
35250
35251 if (netif_msg_ifup(lp))
35252 printk(KERN_DEBUG
35253 @@ -2122,14 +2122,14 @@ static int pcnet32_open(struct net_devic
35254 (u32) (lp->init_dma_addr));
35255
35256 /* set/reset autoselect bit */
35257 - val = lp->a.read_bcr(ioaddr, 2) & ~2;
35258 + val = lp->a->read_bcr(ioaddr, 2) & ~2;
35259 if (lp->options & PCNET32_PORT_ASEL)
35260 val |= 2;
35261 - lp->a.write_bcr(ioaddr, 2, val);
35262 + lp->a->write_bcr(ioaddr, 2, val);
35263
35264 /* handle full duplex setting */
35265 if (lp->mii_if.full_duplex) {
35266 - val = lp->a.read_bcr(ioaddr, 9) & ~3;
35267 + val = lp->a->read_bcr(ioaddr, 9) & ~3;
35268 if (lp->options & PCNET32_PORT_FD) {
35269 val |= 1;
35270 if (lp->options == (PCNET32_PORT_FD | PCNET32_PORT_AUI))
35271 @@ -2139,14 +2139,14 @@ static int pcnet32_open(struct net_devic
35272 if (lp->chip_version == 0x2627)
35273 val |= 3;
35274 }
35275 - lp->a.write_bcr(ioaddr, 9, val);
35276 + lp->a->write_bcr(ioaddr, 9, val);
35277 }
35278
35279 /* set/reset GPSI bit in test register */
35280 - val = lp->a.read_csr(ioaddr, 124) & ~0x10;
35281 + val = lp->a->read_csr(ioaddr, 124) & ~0x10;
35282 if ((lp->options & PCNET32_PORT_PORTSEL) == PCNET32_PORT_GPSI)
35283 val |= 0x10;
35284 - lp->a.write_csr(ioaddr, 124, val);
35285 + lp->a->write_csr(ioaddr, 124, val);
35286
35287 /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
35288 if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
35289 @@ -2167,24 +2167,24 @@ static int pcnet32_open(struct net_devic
35290 * duplex, and/or enable auto negotiation, and clear DANAS
35291 */
35292 if (lp->mii && !(lp->options & PCNET32_PORT_ASEL)) {
35293 - lp->a.write_bcr(ioaddr, 32,
35294 - lp->a.read_bcr(ioaddr, 32) | 0x0080);
35295 + lp->a->write_bcr(ioaddr, 32,
35296 + lp->a->read_bcr(ioaddr, 32) | 0x0080);
35297 /* disable Auto Negotiation, set 10Mpbs, HD */
35298 - val = lp->a.read_bcr(ioaddr, 32) & ~0xb8;
35299 + val = lp->a->read_bcr(ioaddr, 32) & ~0xb8;
35300 if (lp->options & PCNET32_PORT_FD)
35301 val |= 0x10;
35302 if (lp->options & PCNET32_PORT_100)
35303 val |= 0x08;
35304 - lp->a.write_bcr(ioaddr, 32, val);
35305 + lp->a->write_bcr(ioaddr, 32, val);
35306 } else {
35307 if (lp->options & PCNET32_PORT_ASEL) {
35308 - lp->a.write_bcr(ioaddr, 32,
35309 - lp->a.read_bcr(ioaddr,
35310 + lp->a->write_bcr(ioaddr, 32,
35311 + lp->a->read_bcr(ioaddr,
35312 32) | 0x0080);
35313 /* enable auto negotiate, setup, disable fd */
35314 - val = lp->a.read_bcr(ioaddr, 32) & ~0x98;
35315 + val = lp->a->read_bcr(ioaddr, 32) & ~0x98;
35316 val |= 0x20;
35317 - lp->a.write_bcr(ioaddr, 32, val);
35318 + lp->a->write_bcr(ioaddr, 32, val);
35319 }
35320 }
35321 } else {
35322 @@ -2197,10 +2197,10 @@ static int pcnet32_open(struct net_devic
35323 * There is really no good other way to handle multiple PHYs
35324 * other than turning off all automatics
35325 */
35326 - val = lp->a.read_bcr(ioaddr, 2);
35327 - lp->a.write_bcr(ioaddr, 2, val & ~2);
35328 - val = lp->a.read_bcr(ioaddr, 32);
35329 - lp->a.write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
35330 + val = lp->a->read_bcr(ioaddr, 2);
35331 + lp->a->write_bcr(ioaddr, 2, val & ~2);
35332 + val = lp->a->read_bcr(ioaddr, 32);
35333 + lp->a->write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
35334
35335 if (!(lp->options & PCNET32_PORT_ASEL)) {
35336 /* setup ecmd */
35337 @@ -2210,7 +2210,7 @@ static int pcnet32_open(struct net_devic
35338 ecmd.speed =
35339 lp->
35340 options & PCNET32_PORT_100 ? SPEED_100 : SPEED_10;
35341 - bcr9 = lp->a.read_bcr(ioaddr, 9);
35342 + bcr9 = lp->a->read_bcr(ioaddr, 9);
35343
35344 if (lp->options & PCNET32_PORT_FD) {
35345 ecmd.duplex = DUPLEX_FULL;
35346 @@ -2219,7 +2219,7 @@ static int pcnet32_open(struct net_devic
35347 ecmd.duplex = DUPLEX_HALF;
35348 bcr9 |= ~(1 << 0);
35349 }
35350 - lp->a.write_bcr(ioaddr, 9, bcr9);
35351 + lp->a->write_bcr(ioaddr, 9, bcr9);
35352 }
35353
35354 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
35355 @@ -2252,9 +2252,9 @@ static int pcnet32_open(struct net_devic
35356
35357 #ifdef DO_DXSUFLO
35358 if (lp->dxsuflo) { /* Disable transmit stop on underflow */
35359 - val = lp->a.read_csr(ioaddr, CSR3);
35360 + val = lp->a->read_csr(ioaddr, CSR3);
35361 val |= 0x40;
35362 - lp->a.write_csr(ioaddr, CSR3, val);
35363 + lp->a->write_csr(ioaddr, CSR3, val);
35364 }
35365 #endif
35366
35367 @@ -2270,11 +2270,11 @@ static int pcnet32_open(struct net_devic
35368 napi_enable(&lp->napi);
35369
35370 /* Re-initialize the PCNET32, and start it when done. */
35371 - lp->a.write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
35372 - lp->a.write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
35373 + lp->a->write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
35374 + lp->a->write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
35375
35376 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
35377 - lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
35378 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
35379 + lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
35380
35381 netif_start_queue(dev);
35382
35383 @@ -2286,20 +2286,20 @@ static int pcnet32_open(struct net_devic
35384
35385 i = 0;
35386 while (i++ < 100)
35387 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
35388 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
35389 break;
35390 /*
35391 * We used to clear the InitDone bit, 0x0100, here but Mark Stockton
35392 * reports that doing so triggers a bug in the '974.
35393 */
35394 - lp->a.write_csr(ioaddr, CSR0, CSR0_NORMAL);
35395 + lp->a->write_csr(ioaddr, CSR0, CSR0_NORMAL);
35396
35397 if (netif_msg_ifup(lp))
35398 printk(KERN_DEBUG
35399 "%s: pcnet32 open after %d ticks, init block %#x csr0 %4.4x.\n",
35400 dev->name, i,
35401 (u32) (lp->init_dma_addr),
35402 - lp->a.read_csr(ioaddr, CSR0));
35403 + lp->a->read_csr(ioaddr, CSR0));
35404
35405 spin_unlock_irqrestore(&lp->lock, flags);
35406
35407 @@ -2313,7 +2313,7 @@ static int pcnet32_open(struct net_devic
35408 * Switch back to 16bit mode to avoid problems with dumb
35409 * DOS packet driver after a warm reboot
35410 */
35411 - lp->a.write_bcr(ioaddr, 20, 4);
35412 + lp->a->write_bcr(ioaddr, 20, 4);
35413
35414 err_free_irq:
35415 spin_unlock_irqrestore(&lp->lock, flags);
35416 @@ -2420,7 +2420,7 @@ static void pcnet32_restart(struct net_d
35417
35418 /* wait for stop */
35419 for (i = 0; i < 100; i++)
35420 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_STOP)
35421 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_STOP)
35422 break;
35423
35424 if (i >= 100 && netif_msg_drv(lp))
35425 @@ -2433,13 +2433,13 @@ static void pcnet32_restart(struct net_d
35426 return;
35427
35428 /* ReInit Ring */
35429 - lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
35430 + lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
35431 i = 0;
35432 while (i++ < 1000)
35433 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
35434 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
35435 break;
35436
35437 - lp->a.write_csr(ioaddr, CSR0, csr0_bits);
35438 + lp->a->write_csr(ioaddr, CSR0, csr0_bits);
35439 }
35440
35441 static void pcnet32_tx_timeout(struct net_device *dev)
35442 @@ -2452,8 +2452,8 @@ static void pcnet32_tx_timeout(struct ne
35443 if (pcnet32_debug & NETIF_MSG_DRV)
35444 printk(KERN_ERR
35445 "%s: transmit timed out, status %4.4x, resetting.\n",
35446 - dev->name, lp->a.read_csr(ioaddr, CSR0));
35447 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
35448 + dev->name, lp->a->read_csr(ioaddr, CSR0));
35449 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
35450 dev->stats.tx_errors++;
35451 if (netif_msg_tx_err(lp)) {
35452 int i;
35453 @@ -2497,7 +2497,7 @@ static netdev_tx_t pcnet32_start_xmit(st
35454 if (netif_msg_tx_queued(lp)) {
35455 printk(KERN_DEBUG
35456 "%s: pcnet32_start_xmit() called, csr0 %4.4x.\n",
35457 - dev->name, lp->a.read_csr(ioaddr, CSR0));
35458 + dev->name, lp->a->read_csr(ioaddr, CSR0));
35459 }
35460
35461 /* Default status -- will not enable Successful-TxDone
35462 @@ -2528,7 +2528,7 @@ static netdev_tx_t pcnet32_start_xmit(st
35463 dev->stats.tx_bytes += skb->len;
35464
35465 /* Trigger an immediate send poll. */
35466 - lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
35467 + lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
35468
35469 dev->trans_start = jiffies;
35470
35471 @@ -2555,18 +2555,18 @@ pcnet32_interrupt(int irq, void *dev_id)
35472
35473 spin_lock(&lp->lock);
35474
35475 - csr0 = lp->a.read_csr(ioaddr, CSR0);
35476 + csr0 = lp->a->read_csr(ioaddr, CSR0);
35477 while ((csr0 & 0x8f00) && --boguscnt >= 0) {
35478 if (csr0 == 0xffff) {
35479 break; /* PCMCIA remove happened */
35480 }
35481 /* Acknowledge all of the current interrupt sources ASAP. */
35482 - lp->a.write_csr(ioaddr, CSR0, csr0 & ~0x004f);
35483 + lp->a->write_csr(ioaddr, CSR0, csr0 & ~0x004f);
35484
35485 if (netif_msg_intr(lp))
35486 printk(KERN_DEBUG
35487 "%s: interrupt csr0=%#2.2x new csr=%#2.2x.\n",
35488 - dev->name, csr0, lp->a.read_csr(ioaddr, CSR0));
35489 + dev->name, csr0, lp->a->read_csr(ioaddr, CSR0));
35490
35491 /* Log misc errors. */
35492 if (csr0 & 0x4000)
35493 @@ -2595,19 +2595,19 @@ pcnet32_interrupt(int irq, void *dev_id)
35494 if (napi_schedule_prep(&lp->napi)) {
35495 u16 val;
35496 /* set interrupt masks */
35497 - val = lp->a.read_csr(ioaddr, CSR3);
35498 + val = lp->a->read_csr(ioaddr, CSR3);
35499 val |= 0x5f00;
35500 - lp->a.write_csr(ioaddr, CSR3, val);
35501 + lp->a->write_csr(ioaddr, CSR3, val);
35502
35503 __napi_schedule(&lp->napi);
35504 break;
35505 }
35506 - csr0 = lp->a.read_csr(ioaddr, CSR0);
35507 + csr0 = lp->a->read_csr(ioaddr, CSR0);
35508 }
35509
35510 if (netif_msg_intr(lp))
35511 printk(KERN_DEBUG "%s: exiting interrupt, csr0=%#4.4x.\n",
35512 - dev->name, lp->a.read_csr(ioaddr, CSR0));
35513 + dev->name, lp->a->read_csr(ioaddr, CSR0));
35514
35515 spin_unlock(&lp->lock);
35516
35517 @@ -2627,21 +2627,21 @@ static int pcnet32_close(struct net_devi
35518
35519 spin_lock_irqsave(&lp->lock, flags);
35520
35521 - dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
35522 + dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
35523
35524 if (netif_msg_ifdown(lp))
35525 printk(KERN_DEBUG
35526 "%s: Shutting down ethercard, status was %2.2x.\n",
35527 - dev->name, lp->a.read_csr(ioaddr, CSR0));
35528 + dev->name, lp->a->read_csr(ioaddr, CSR0));
35529
35530 /* We stop the PCNET32 here -- it occasionally polls memory if we don't. */
35531 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
35532 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
35533
35534 /*
35535 * Switch back to 16bit mode to avoid problems with dumb
35536 * DOS packet driver after a warm reboot
35537 */
35538 - lp->a.write_bcr(ioaddr, 20, 4);
35539 + lp->a->write_bcr(ioaddr, 20, 4);
35540
35541 spin_unlock_irqrestore(&lp->lock, flags);
35542
35543 @@ -2664,7 +2664,7 @@ static struct net_device_stats *pcnet32_
35544 unsigned long flags;
35545
35546 spin_lock_irqsave(&lp->lock, flags);
35547 - dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
35548 + dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
35549 spin_unlock_irqrestore(&lp->lock, flags);
35550
35551 return &dev->stats;
35552 @@ -2686,10 +2686,10 @@ static void pcnet32_load_multicast(struc
35553 if (dev->flags & IFF_ALLMULTI) {
35554 ib->filter[0] = cpu_to_le32(~0U);
35555 ib->filter[1] = cpu_to_le32(~0U);
35556 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
35557 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
35558 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
35559 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
35560 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
35561 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
35562 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
35563 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
35564 return;
35565 }
35566 /* clear the multicast filter */
35567 @@ -2710,7 +2710,7 @@ static void pcnet32_load_multicast(struc
35568 mcast_table[crc >> 4] |= cpu_to_le16(1 << (crc & 0xf));
35569 }
35570 for (i = 0; i < 4; i++)
35571 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i,
35572 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER + i,
35573 le16_to_cpu(mcast_table[i]));
35574 return;
35575 }
35576 @@ -2726,7 +2726,7 @@ static void pcnet32_set_multicast_list(s
35577
35578 spin_lock_irqsave(&lp->lock, flags);
35579 suspended = pcnet32_suspend(dev, &flags, 0);
35580 - csr15 = lp->a.read_csr(ioaddr, CSR15);
35581 + csr15 = lp->a->read_csr(ioaddr, CSR15);
35582 if (dev->flags & IFF_PROMISC) {
35583 /* Log any net taps. */
35584 if (netif_msg_hw(lp))
35585 @@ -2735,21 +2735,21 @@ static void pcnet32_set_multicast_list(s
35586 lp->init_block->mode =
35587 cpu_to_le16(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) <<
35588 7);
35589 - lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000);
35590 + lp->a->write_csr(ioaddr, CSR15, csr15 | 0x8000);
35591 } else {
35592 lp->init_block->mode =
35593 cpu_to_le16((lp->options & PCNET32_PORT_PORTSEL) << 7);
35594 - lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff);
35595 + lp->a->write_csr(ioaddr, CSR15, csr15 & 0x7fff);
35596 pcnet32_load_multicast(dev);
35597 }
35598
35599 if (suspended) {
35600 int csr5;
35601 /* clear SUSPEND (SPND) - CSR5 bit 0 */
35602 - csr5 = lp->a.read_csr(ioaddr, CSR5);
35603 - lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
35604 + csr5 = lp->a->read_csr(ioaddr, CSR5);
35605 + lp->a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
35606 } else {
35607 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
35608 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
35609 pcnet32_restart(dev, CSR0_NORMAL);
35610 netif_wake_queue(dev);
35611 }
35612 @@ -2767,8 +2767,8 @@ static int mdio_read(struct net_device *
35613 if (!lp->mii)
35614 return 0;
35615
35616 - lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
35617 - val_out = lp->a.read_bcr(ioaddr, 34);
35618 + lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
35619 + val_out = lp->a->read_bcr(ioaddr, 34);
35620
35621 return val_out;
35622 }
35623 @@ -2782,8 +2782,8 @@ static void mdio_write(struct net_device
35624 if (!lp->mii)
35625 return;
35626
35627 - lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
35628 - lp->a.write_bcr(ioaddr, 34, val);
35629 + lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
35630 + lp->a->write_bcr(ioaddr, 34, val);
35631 }
35632
35633 static int pcnet32_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
35634 @@ -2862,7 +2862,7 @@ static void pcnet32_check_media(struct n
35635 curr_link = mii_link_ok(&lp->mii_if);
35636 } else {
35637 ulong ioaddr = dev->base_addr; /* card base I/O address */
35638 - curr_link = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
35639 + curr_link = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
35640 }
35641 if (!curr_link) {
35642 if (prev_link || verbose) {
35643 @@ -2887,13 +2887,13 @@ static void pcnet32_check_media(struct n
35644 (ecmd.duplex ==
35645 DUPLEX_FULL) ? "full" : "half");
35646 }
35647 - bcr9 = lp->a.read_bcr(dev->base_addr, 9);
35648 + bcr9 = lp->a->read_bcr(dev->base_addr, 9);
35649 if ((bcr9 & (1 << 0)) != lp->mii_if.full_duplex) {
35650 if (lp->mii_if.full_duplex)
35651 bcr9 |= (1 << 0);
35652 else
35653 bcr9 &= ~(1 << 0);
35654 - lp->a.write_bcr(dev->base_addr, 9, bcr9);
35655 + lp->a->write_bcr(dev->base_addr, 9, bcr9);
35656 }
35657 } else {
35658 if (netif_msg_link(lp))
35659 diff -urNp linux-2.6.32.46/drivers/net/tg3.h linux-2.6.32.46/drivers/net/tg3.h
35660 --- linux-2.6.32.46/drivers/net/tg3.h 2011-03-27 14:31:47.000000000 -0400
35661 +++ linux-2.6.32.46/drivers/net/tg3.h 2011-04-17 15:56:46.000000000 -0400
35662 @@ -95,6 +95,7 @@
35663 #define CHIPREV_ID_5750_A0 0x4000
35664 #define CHIPREV_ID_5750_A1 0x4001
35665 #define CHIPREV_ID_5750_A3 0x4003
35666 +#define CHIPREV_ID_5750_C1 0x4201
35667 #define CHIPREV_ID_5750_C2 0x4202
35668 #define CHIPREV_ID_5752_A0_HW 0x5000
35669 #define CHIPREV_ID_5752_A0 0x6000
35670 diff -urNp linux-2.6.32.46/drivers/net/tokenring/abyss.c linux-2.6.32.46/drivers/net/tokenring/abyss.c
35671 --- linux-2.6.32.46/drivers/net/tokenring/abyss.c 2011-03-27 14:31:47.000000000 -0400
35672 +++ linux-2.6.32.46/drivers/net/tokenring/abyss.c 2011-08-05 20:33:55.000000000 -0400
35673 @@ -451,10 +451,12 @@ static struct pci_driver abyss_driver =
35674
35675 static int __init abyss_init (void)
35676 {
35677 - abyss_netdev_ops = tms380tr_netdev_ops;
35678 + pax_open_kernel();
35679 + memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
35680
35681 - abyss_netdev_ops.ndo_open = abyss_open;
35682 - abyss_netdev_ops.ndo_stop = abyss_close;
35683 + *(void **)&abyss_netdev_ops.ndo_open = abyss_open;
35684 + *(void **)&abyss_netdev_ops.ndo_stop = abyss_close;
35685 + pax_close_kernel();
35686
35687 return pci_register_driver(&abyss_driver);
35688 }
35689 diff -urNp linux-2.6.32.46/drivers/net/tokenring/madgemc.c linux-2.6.32.46/drivers/net/tokenring/madgemc.c
35690 --- linux-2.6.32.46/drivers/net/tokenring/madgemc.c 2011-03-27 14:31:47.000000000 -0400
35691 +++ linux-2.6.32.46/drivers/net/tokenring/madgemc.c 2011-08-05 20:33:55.000000000 -0400
35692 @@ -755,9 +755,11 @@ static struct mca_driver madgemc_driver
35693
35694 static int __init madgemc_init (void)
35695 {
35696 - madgemc_netdev_ops = tms380tr_netdev_ops;
35697 - madgemc_netdev_ops.ndo_open = madgemc_open;
35698 - madgemc_netdev_ops.ndo_stop = madgemc_close;
35699 + pax_open_kernel();
35700 + memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
35701 + *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open;
35702 + *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close;
35703 + pax_close_kernel();
35704
35705 return mca_register_driver (&madgemc_driver);
35706 }
35707 diff -urNp linux-2.6.32.46/drivers/net/tokenring/proteon.c linux-2.6.32.46/drivers/net/tokenring/proteon.c
35708 --- linux-2.6.32.46/drivers/net/tokenring/proteon.c 2011-03-27 14:31:47.000000000 -0400
35709 +++ linux-2.6.32.46/drivers/net/tokenring/proteon.c 2011-08-05 20:33:55.000000000 -0400
35710 @@ -353,9 +353,11 @@ static int __init proteon_init(void)
35711 struct platform_device *pdev;
35712 int i, num = 0, err = 0;
35713
35714 - proteon_netdev_ops = tms380tr_netdev_ops;
35715 - proteon_netdev_ops.ndo_open = proteon_open;
35716 - proteon_netdev_ops.ndo_stop = tms380tr_close;
35717 + pax_open_kernel();
35718 + memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
35719 + *(void **)&proteon_netdev_ops.ndo_open = proteon_open;
35720 + *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close;
35721 + pax_close_kernel();
35722
35723 err = platform_driver_register(&proteon_driver);
35724 if (err)
35725 diff -urNp linux-2.6.32.46/drivers/net/tokenring/skisa.c linux-2.6.32.46/drivers/net/tokenring/skisa.c
35726 --- linux-2.6.32.46/drivers/net/tokenring/skisa.c 2011-03-27 14:31:47.000000000 -0400
35727 +++ linux-2.6.32.46/drivers/net/tokenring/skisa.c 2011-08-05 20:33:55.000000000 -0400
35728 @@ -363,9 +363,11 @@ static int __init sk_isa_init(void)
35729 struct platform_device *pdev;
35730 int i, num = 0, err = 0;
35731
35732 - sk_isa_netdev_ops = tms380tr_netdev_ops;
35733 - sk_isa_netdev_ops.ndo_open = sk_isa_open;
35734 - sk_isa_netdev_ops.ndo_stop = tms380tr_close;
35735 + pax_open_kernel();
35736 + memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
35737 + *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open;
35738 + *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close;
35739 + pax_close_kernel();
35740
35741 err = platform_driver_register(&sk_isa_driver);
35742 if (err)
35743 diff -urNp linux-2.6.32.46/drivers/net/tulip/de2104x.c linux-2.6.32.46/drivers/net/tulip/de2104x.c
35744 --- linux-2.6.32.46/drivers/net/tulip/de2104x.c 2011-03-27 14:31:47.000000000 -0400
35745 +++ linux-2.6.32.46/drivers/net/tulip/de2104x.c 2011-05-16 21:46:57.000000000 -0400
35746 @@ -1785,6 +1785,8 @@ static void __devinit de21041_get_srom_i
35747 struct de_srom_info_leaf *il;
35748 void *bufp;
35749
35750 + pax_track_stack();
35751 +
35752 /* download entire eeprom */
35753 for (i = 0; i < DE_EEPROM_WORDS; i++)
35754 ((__le16 *)ee_data)[i] =
35755 diff -urNp linux-2.6.32.46/drivers/net/tulip/de4x5.c linux-2.6.32.46/drivers/net/tulip/de4x5.c
35756 --- linux-2.6.32.46/drivers/net/tulip/de4x5.c 2011-03-27 14:31:47.000000000 -0400
35757 +++ linux-2.6.32.46/drivers/net/tulip/de4x5.c 2011-04-17 15:56:46.000000000 -0400
35758 @@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, stru
35759 for (i=0; i<ETH_ALEN; i++) {
35760 tmp.addr[i] = dev->dev_addr[i];
35761 }
35762 - if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
35763 + if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
35764 break;
35765
35766 case DE4X5_SET_HWADDR: /* Set the hardware address */
35767 @@ -5512,7 +5512,7 @@ de4x5_ioctl(struct net_device *dev, stru
35768 spin_lock_irqsave(&lp->lock, flags);
35769 memcpy(&statbuf, &lp->pktStats, ioc->len);
35770 spin_unlock_irqrestore(&lp->lock, flags);
35771 - if (copy_to_user(ioc->data, &statbuf, ioc->len))
35772 + if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
35773 return -EFAULT;
35774 break;
35775 }
35776 diff -urNp linux-2.6.32.46/drivers/net/usb/hso.c linux-2.6.32.46/drivers/net/usb/hso.c
35777 --- linux-2.6.32.46/drivers/net/usb/hso.c 2011-03-27 14:31:47.000000000 -0400
35778 +++ linux-2.6.32.46/drivers/net/usb/hso.c 2011-04-17 15:56:46.000000000 -0400
35779 @@ -71,7 +71,7 @@
35780 #include <asm/byteorder.h>
35781 #include <linux/serial_core.h>
35782 #include <linux/serial.h>
35783 -
35784 +#include <asm/local.h>
35785
35786 #define DRIVER_VERSION "1.2"
35787 #define MOD_AUTHOR "Option Wireless"
35788 @@ -258,7 +258,7 @@ struct hso_serial {
35789
35790 /* from usb_serial_port */
35791 struct tty_struct *tty;
35792 - int open_count;
35793 + local_t open_count;
35794 spinlock_t serial_lock;
35795
35796 int (*write_data) (struct hso_serial *serial);
35797 @@ -1180,7 +1180,7 @@ static void put_rxbuf_data_and_resubmit_
35798 struct urb *urb;
35799
35800 urb = serial->rx_urb[0];
35801 - if (serial->open_count > 0) {
35802 + if (local_read(&serial->open_count) > 0) {
35803 count = put_rxbuf_data(urb, serial);
35804 if (count == -1)
35805 return;
35806 @@ -1216,7 +1216,7 @@ static void hso_std_serial_read_bulk_cal
35807 DUMP1(urb->transfer_buffer, urb->actual_length);
35808
35809 /* Anyone listening? */
35810 - if (serial->open_count == 0)
35811 + if (local_read(&serial->open_count) == 0)
35812 return;
35813
35814 if (status == 0) {
35815 @@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
35816 spin_unlock_irq(&serial->serial_lock);
35817
35818 /* check for port already opened, if not set the termios */
35819 - serial->open_count++;
35820 - if (serial->open_count == 1) {
35821 + if (local_inc_return(&serial->open_count) == 1) {
35822 tty->low_latency = 1;
35823 serial->rx_state = RX_IDLE;
35824 /* Force default termio settings */
35825 @@ -1325,7 +1324,7 @@ static int hso_serial_open(struct tty_st
35826 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
35827 if (result) {
35828 hso_stop_serial_device(serial->parent);
35829 - serial->open_count--;
35830 + local_dec(&serial->open_count);
35831 kref_put(&serial->parent->ref, hso_serial_ref_free);
35832 }
35833 } else {
35834 @@ -1362,10 +1361,10 @@ static void hso_serial_close(struct tty_
35835
35836 /* reset the rts and dtr */
35837 /* do the actual close */
35838 - serial->open_count--;
35839 + local_dec(&serial->open_count);
35840
35841 - if (serial->open_count <= 0) {
35842 - serial->open_count = 0;
35843 + if (local_read(&serial->open_count) <= 0) {
35844 + local_set(&serial->open_count, 0);
35845 spin_lock_irq(&serial->serial_lock);
35846 if (serial->tty == tty) {
35847 serial->tty->driver_data = NULL;
35848 @@ -1447,7 +1446,7 @@ static void hso_serial_set_termios(struc
35849
35850 /* the actual setup */
35851 spin_lock_irqsave(&serial->serial_lock, flags);
35852 - if (serial->open_count)
35853 + if (local_read(&serial->open_count))
35854 _hso_serial_set_termios(tty, old);
35855 else
35856 tty->termios = old;
35857 @@ -3097,7 +3096,7 @@ static int hso_resume(struct usb_interfa
35858 /* Start all serial ports */
35859 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
35860 if (serial_table[i] && (serial_table[i]->interface == iface)) {
35861 - if (dev2ser(serial_table[i])->open_count) {
35862 + if (local_read(&dev2ser(serial_table[i])->open_count)) {
35863 result =
35864 hso_start_serial_device(serial_table[i], GFP_NOIO);
35865 hso_kick_transmit(dev2ser(serial_table[i]));
35866 diff -urNp linux-2.6.32.46/drivers/net/vxge/vxge-config.h linux-2.6.32.46/drivers/net/vxge/vxge-config.h
35867 --- linux-2.6.32.46/drivers/net/vxge/vxge-config.h 2011-03-27 14:31:47.000000000 -0400
35868 +++ linux-2.6.32.46/drivers/net/vxge/vxge-config.h 2011-08-05 20:33:55.000000000 -0400
35869 @@ -474,7 +474,7 @@ struct vxge_hw_uld_cbs {
35870 void (*link_down)(struct __vxge_hw_device *devh);
35871 void (*crit_err)(struct __vxge_hw_device *devh,
35872 enum vxge_hw_event type, u64 ext_data);
35873 -};
35874 +} __no_const;
35875
35876 /*
35877 * struct __vxge_hw_blockpool_entry - Block private data structure
35878 diff -urNp linux-2.6.32.46/drivers/net/vxge/vxge-main.c linux-2.6.32.46/drivers/net/vxge/vxge-main.c
35879 --- linux-2.6.32.46/drivers/net/vxge/vxge-main.c 2011-03-27 14:31:47.000000000 -0400
35880 +++ linux-2.6.32.46/drivers/net/vxge/vxge-main.c 2011-05-16 21:46:57.000000000 -0400
35881 @@ -93,6 +93,8 @@ static inline void VXGE_COMPLETE_VPATH_T
35882 struct sk_buff *completed[NR_SKB_COMPLETED];
35883 int more;
35884
35885 + pax_track_stack();
35886 +
35887 do {
35888 more = 0;
35889 skb_ptr = completed;
35890 @@ -1779,6 +1781,8 @@ static enum vxge_hw_status vxge_rth_conf
35891 u8 mtable[256] = {0}; /* CPU to vpath mapping */
35892 int index;
35893
35894 + pax_track_stack();
35895 +
35896 /*
35897 * Filling
35898 * - itable with bucket numbers
35899 diff -urNp linux-2.6.32.46/drivers/net/vxge/vxge-traffic.h linux-2.6.32.46/drivers/net/vxge/vxge-traffic.h
35900 --- linux-2.6.32.46/drivers/net/vxge/vxge-traffic.h 2011-03-27 14:31:47.000000000 -0400
35901 +++ linux-2.6.32.46/drivers/net/vxge/vxge-traffic.h 2011-08-05 20:33:55.000000000 -0400
35902 @@ -2123,7 +2123,7 @@ struct vxge_hw_mempool_cbs {
35903 struct vxge_hw_mempool_dma *dma_object,
35904 u32 index,
35905 u32 is_last);
35906 -};
35907 +} __no_const;
35908
35909 void
35910 __vxge_hw_mempool_destroy(
35911 diff -urNp linux-2.6.32.46/drivers/net/wan/cycx_x25.c linux-2.6.32.46/drivers/net/wan/cycx_x25.c
35912 --- linux-2.6.32.46/drivers/net/wan/cycx_x25.c 2011-03-27 14:31:47.000000000 -0400
35913 +++ linux-2.6.32.46/drivers/net/wan/cycx_x25.c 2011-05-16 21:46:57.000000000 -0400
35914 @@ -1017,6 +1017,8 @@ static void hex_dump(char *msg, unsigned
35915 unsigned char hex[1024],
35916 * phex = hex;
35917
35918 + pax_track_stack();
35919 +
35920 if (len >= (sizeof(hex) / 2))
35921 len = (sizeof(hex) / 2) - 1;
35922
35923 diff -urNp linux-2.6.32.46/drivers/net/wan/hdlc_x25.c linux-2.6.32.46/drivers/net/wan/hdlc_x25.c
35924 --- linux-2.6.32.46/drivers/net/wan/hdlc_x25.c 2011-03-27 14:31:47.000000000 -0400
35925 +++ linux-2.6.32.46/drivers/net/wan/hdlc_x25.c 2011-08-05 20:33:55.000000000 -0400
35926 @@ -136,16 +136,16 @@ static netdev_tx_t x25_xmit(struct sk_bu
35927
35928 static int x25_open(struct net_device *dev)
35929 {
35930 - struct lapb_register_struct cb;
35931 + static struct lapb_register_struct cb = {
35932 + .connect_confirmation = x25_connected,
35933 + .connect_indication = x25_connected,
35934 + .disconnect_confirmation = x25_disconnected,
35935 + .disconnect_indication = x25_disconnected,
35936 + .data_indication = x25_data_indication,
35937 + .data_transmit = x25_data_transmit
35938 + };
35939 int result;
35940
35941 - cb.connect_confirmation = x25_connected;
35942 - cb.connect_indication = x25_connected;
35943 - cb.disconnect_confirmation = x25_disconnected;
35944 - cb.disconnect_indication = x25_disconnected;
35945 - cb.data_indication = x25_data_indication;
35946 - cb.data_transmit = x25_data_transmit;
35947 -
35948 result = lapb_register(dev, &cb);
35949 if (result != LAPB_OK)
35950 return result;
35951 diff -urNp linux-2.6.32.46/drivers/net/wimax/i2400m/usb-fw.c linux-2.6.32.46/drivers/net/wimax/i2400m/usb-fw.c
35952 --- linux-2.6.32.46/drivers/net/wimax/i2400m/usb-fw.c 2011-03-27 14:31:47.000000000 -0400
35953 +++ linux-2.6.32.46/drivers/net/wimax/i2400m/usb-fw.c 2011-05-16 21:46:57.000000000 -0400
35954 @@ -263,6 +263,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(stru
35955 int do_autopm = 1;
35956 DECLARE_COMPLETION_ONSTACK(notif_completion);
35957
35958 + pax_track_stack();
35959 +
35960 d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
35961 i2400m, ack, ack_size);
35962 BUG_ON(_ack == i2400m->bm_ack_buf);
35963 diff -urNp linux-2.6.32.46/drivers/net/wireless/airo.c linux-2.6.32.46/drivers/net/wireless/airo.c
35964 --- linux-2.6.32.46/drivers/net/wireless/airo.c 2011-03-27 14:31:47.000000000 -0400
35965 +++ linux-2.6.32.46/drivers/net/wireless/airo.c 2011-05-16 21:46:57.000000000 -0400
35966 @@ -3003,6 +3003,8 @@ static void airo_process_scan_results (s
35967 BSSListElement * loop_net;
35968 BSSListElement * tmp_net;
35969
35970 + pax_track_stack();
35971 +
35972 /* Blow away current list of scan results */
35973 list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
35974 list_move_tail (&loop_net->list, &ai->network_free_list);
35975 @@ -3783,6 +3785,8 @@ static u16 setup_card(struct airo_info *
35976 WepKeyRid wkr;
35977 int rc;
35978
35979 + pax_track_stack();
35980 +
35981 memset( &mySsid, 0, sizeof( mySsid ) );
35982 kfree (ai->flash);
35983 ai->flash = NULL;
35984 @@ -4758,6 +4762,8 @@ static int proc_stats_rid_open( struct i
35985 __le32 *vals = stats.vals;
35986 int len;
35987
35988 + pax_track_stack();
35989 +
35990 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
35991 return -ENOMEM;
35992 data = (struct proc_data *)file->private_data;
35993 @@ -5487,6 +5493,8 @@ static int proc_BSSList_open( struct ino
35994 /* If doLoseSync is not 1, we won't do a Lose Sync */
35995 int doLoseSync = -1;
35996
35997 + pax_track_stack();
35998 +
35999 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
36000 return -ENOMEM;
36001 data = (struct proc_data *)file->private_data;
36002 @@ -7193,6 +7201,8 @@ static int airo_get_aplist(struct net_de
36003 int i;
36004 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
36005
36006 + pax_track_stack();
36007 +
36008 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
36009 if (!qual)
36010 return -ENOMEM;
36011 @@ -7753,6 +7763,8 @@ static void airo_read_wireless_stats(str
36012 CapabilityRid cap_rid;
36013 __le32 *vals = stats_rid.vals;
36014
36015 + pax_track_stack();
36016 +
36017 /* Get stats out of the card */
36018 clear_bit(JOB_WSTATS, &local->jobs);
36019 if (local->power.event) {
36020 diff -urNp linux-2.6.32.46/drivers/net/wireless/ath/ath5k/debug.c linux-2.6.32.46/drivers/net/wireless/ath/ath5k/debug.c
36021 --- linux-2.6.32.46/drivers/net/wireless/ath/ath5k/debug.c 2011-03-27 14:31:47.000000000 -0400
36022 +++ linux-2.6.32.46/drivers/net/wireless/ath/ath5k/debug.c 2011-05-16 21:46:57.000000000 -0400
36023 @@ -205,6 +205,8 @@ static ssize_t read_file_beacon(struct f
36024 unsigned int v;
36025 u64 tsf;
36026
36027 + pax_track_stack();
36028 +
36029 v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
36030 len += snprintf(buf+len, sizeof(buf)-len,
36031 "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
36032 @@ -318,6 +320,8 @@ static ssize_t read_file_debug(struct fi
36033 unsigned int len = 0;
36034 unsigned int i;
36035
36036 + pax_track_stack();
36037 +
36038 len += snprintf(buf+len, sizeof(buf)-len,
36039 "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
36040
36041 diff -urNp linux-2.6.32.46/drivers/net/wireless/ath/ath9k/debug.c linux-2.6.32.46/drivers/net/wireless/ath/ath9k/debug.c
36042 --- linux-2.6.32.46/drivers/net/wireless/ath/ath9k/debug.c 2011-03-27 14:31:47.000000000 -0400
36043 +++ linux-2.6.32.46/drivers/net/wireless/ath/ath9k/debug.c 2011-05-16 21:46:57.000000000 -0400
36044 @@ -220,6 +220,8 @@ static ssize_t read_file_interrupt(struc
36045 char buf[512];
36046 unsigned int len = 0;
36047
36048 + pax_track_stack();
36049 +
36050 len += snprintf(buf + len, sizeof(buf) - len,
36051 "%8s: %10u\n", "RX", sc->debug.stats.istats.rxok);
36052 len += snprintf(buf + len, sizeof(buf) - len,
36053 @@ -360,6 +362,8 @@ static ssize_t read_file_wiphy(struct fi
36054 int i;
36055 u8 addr[ETH_ALEN];
36056
36057 + pax_track_stack();
36058 +
36059 len += snprintf(buf + len, sizeof(buf) - len,
36060 "primary: %s (%s chan=%d ht=%d)\n",
36061 wiphy_name(sc->pri_wiphy->hw->wiphy),
36062 diff -urNp linux-2.6.32.46/drivers/net/wireless/b43/debugfs.c linux-2.6.32.46/drivers/net/wireless/b43/debugfs.c
36063 --- linux-2.6.32.46/drivers/net/wireless/b43/debugfs.c 2011-03-27 14:31:47.000000000 -0400
36064 +++ linux-2.6.32.46/drivers/net/wireless/b43/debugfs.c 2011-04-17 15:56:46.000000000 -0400
36065 @@ -43,7 +43,7 @@ static struct dentry *rootdir;
36066 struct b43_debugfs_fops {
36067 ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
36068 int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
36069 - struct file_operations fops;
36070 + const struct file_operations fops;
36071 /* Offset of struct b43_dfs_file in struct b43_dfsentry */
36072 size_t file_struct_offset;
36073 };
36074 diff -urNp linux-2.6.32.46/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.32.46/drivers/net/wireless/b43legacy/debugfs.c
36075 --- linux-2.6.32.46/drivers/net/wireless/b43legacy/debugfs.c 2011-03-27 14:31:47.000000000 -0400
36076 +++ linux-2.6.32.46/drivers/net/wireless/b43legacy/debugfs.c 2011-04-17 15:56:46.000000000 -0400
36077 @@ -44,7 +44,7 @@ static struct dentry *rootdir;
36078 struct b43legacy_debugfs_fops {
36079 ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
36080 int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
36081 - struct file_operations fops;
36082 + const struct file_operations fops;
36083 /* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
36084 size_t file_struct_offset;
36085 /* Take wl->irq_lock before calling read/write? */
36086 diff -urNp linux-2.6.32.46/drivers/net/wireless/ipw2x00/ipw2100.c linux-2.6.32.46/drivers/net/wireless/ipw2x00/ipw2100.c
36087 --- linux-2.6.32.46/drivers/net/wireless/ipw2x00/ipw2100.c 2011-03-27 14:31:47.000000000 -0400
36088 +++ linux-2.6.32.46/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-16 21:46:57.000000000 -0400
36089 @@ -2014,6 +2014,8 @@ static int ipw2100_set_essid(struct ipw2
36090 int err;
36091 DECLARE_SSID_BUF(ssid);
36092
36093 + pax_track_stack();
36094 +
36095 IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
36096
36097 if (ssid_len)
36098 @@ -5380,6 +5382,8 @@ static int ipw2100_set_key(struct ipw210
36099 struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
36100 int err;
36101
36102 + pax_track_stack();
36103 +
36104 IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
36105 idx, keylen, len);
36106
36107 diff -urNp linux-2.6.32.46/drivers/net/wireless/ipw2x00/libipw_rx.c linux-2.6.32.46/drivers/net/wireless/ipw2x00/libipw_rx.c
36108 --- linux-2.6.32.46/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-03-27 14:31:47.000000000 -0400
36109 +++ linux-2.6.32.46/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-16 21:46:57.000000000 -0400
36110 @@ -1566,6 +1566,8 @@ static void libipw_process_probe_respons
36111 unsigned long flags;
36112 DECLARE_SSID_BUF(ssid);
36113
36114 + pax_track_stack();
36115 +
36116 LIBIPW_DEBUG_SCAN("'%s' (%pM"
36117 "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
36118 print_ssid(ssid, info_element->data, info_element->len),
36119 diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-1000.c
36120 --- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-1000.c 2011-03-27 14:31:47.000000000 -0400
36121 +++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-1000.c 2011-04-17 15:56:46.000000000 -0400
36122 @@ -137,7 +137,7 @@ static struct iwl_lib_ops iwl1000_lib =
36123 },
36124 };
36125
36126 -static struct iwl_ops iwl1000_ops = {
36127 +static const struct iwl_ops iwl1000_ops = {
36128 .ucode = &iwl5000_ucode,
36129 .lib = &iwl1000_lib,
36130 .hcmd = &iwl5000_hcmd,
36131 diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl3945-base.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl3945-base.c
36132 --- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl3945-base.c 2011-03-27 14:31:47.000000000 -0400
36133 +++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl3945-base.c 2011-08-05 20:33:55.000000000 -0400
36134 @@ -3927,7 +3927,9 @@ static int iwl3945_pci_probe(struct pci_
36135 */
36136 if (iwl3945_mod_params.disable_hw_scan) {
36137 IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
36138 - iwl3945_hw_ops.hw_scan = NULL;
36139 + pax_open_kernel();
36140 + *(void **)&iwl3945_hw_ops.hw_scan = NULL;
36141 + pax_close_kernel();
36142 }
36143
36144
36145 diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-3945.c
36146 --- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-3945.c 2011-03-27 14:31:47.000000000 -0400
36147 +++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-3945.c 2011-04-17 15:56:46.000000000 -0400
36148 @@ -2874,7 +2874,7 @@ static struct iwl_hcmd_utils_ops iwl3945
36149 .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
36150 };
36151
36152 -static struct iwl_ops iwl3945_ops = {
36153 +static const struct iwl_ops iwl3945_ops = {
36154 .ucode = &iwl3945_ucode,
36155 .lib = &iwl3945_lib,
36156 .hcmd = &iwl3945_hcmd,
36157 diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-4965.c
36158 --- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-4965.c 2011-03-27 14:31:47.000000000 -0400
36159 +++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-4965.c 2011-04-17 15:56:46.000000000 -0400
36160 @@ -2345,7 +2345,7 @@ static struct iwl_lib_ops iwl4965_lib =
36161 },
36162 };
36163
36164 -static struct iwl_ops iwl4965_ops = {
36165 +static const struct iwl_ops iwl4965_ops = {
36166 .ucode = &iwl4965_ucode,
36167 .lib = &iwl4965_lib,
36168 .hcmd = &iwl4965_hcmd,
36169 diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-5000.c
36170 --- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-5000.c 2011-06-25 12:55:34.000000000 -0400
36171 +++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-5000.c 2011-06-25 12:56:37.000000000 -0400
36172 @@ -1633,14 +1633,14 @@ static struct iwl_lib_ops iwl5150_lib =
36173 },
36174 };
36175
36176 -struct iwl_ops iwl5000_ops = {
36177 +const struct iwl_ops iwl5000_ops = {
36178 .ucode = &iwl5000_ucode,
36179 .lib = &iwl5000_lib,
36180 .hcmd = &iwl5000_hcmd,
36181 .utils = &iwl5000_hcmd_utils,
36182 };
36183
36184 -static struct iwl_ops iwl5150_ops = {
36185 +static const struct iwl_ops iwl5150_ops = {
36186 .ucode = &iwl5000_ucode,
36187 .lib = &iwl5150_lib,
36188 .hcmd = &iwl5000_hcmd,
36189 diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-6000.c
36190 --- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-03-27 14:31:47.000000000 -0400
36191 +++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-04-17 15:56:46.000000000 -0400
36192 @@ -146,7 +146,7 @@ static struct iwl_hcmd_utils_ops iwl6000
36193 .calc_rssi = iwl5000_calc_rssi,
36194 };
36195
36196 -static struct iwl_ops iwl6000_ops = {
36197 +static const struct iwl_ops iwl6000_ops = {
36198 .ucode = &iwl5000_ucode,
36199 .lib = &iwl6000_lib,
36200 .hcmd = &iwl5000_hcmd,
36201 diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn.c
36202 --- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn.c 2011-03-27 14:31:47.000000000 -0400
36203 +++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn.c 2011-08-05 20:33:55.000000000 -0400
36204 @@ -2911,7 +2911,9 @@ static int iwl_pci_probe(struct pci_dev
36205 if (iwl_debug_level & IWL_DL_INFO)
36206 dev_printk(KERN_DEBUG, &(pdev->dev),
36207 "Disabling hw_scan\n");
36208 - iwl_hw_ops.hw_scan = NULL;
36209 + pax_open_kernel();
36210 + *(void **)&iwl_hw_ops.hw_scan = NULL;
36211 + pax_close_kernel();
36212 }
36213
36214 hw = iwl_alloc_all(cfg, &iwl_hw_ops);
36215 diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
36216 --- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-03-27 14:31:47.000000000 -0400
36217 +++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-16 21:46:57.000000000 -0400
36218 @@ -857,6 +857,8 @@ static void rs_tx_status(void *priv_r, s
36219 u8 active_index = 0;
36220 s32 tpt = 0;
36221
36222 + pax_track_stack();
36223 +
36224 IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
36225
36226 if (!ieee80211_is_data(hdr->frame_control) ||
36227 @@ -2722,6 +2724,8 @@ static void rs_fill_link_cmd(struct iwl_
36228 u8 valid_tx_ant = 0;
36229 struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
36230
36231 + pax_track_stack();
36232 +
36233 /* Override starting rate (index 0) if needed for debug purposes */
36234 rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
36235
36236 diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debugfs.c
36237 --- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-03-27 14:31:47.000000000 -0400
36238 +++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-16 21:46:57.000000000 -0400
36239 @@ -524,6 +524,8 @@ static ssize_t iwl_dbgfs_status_read(str
36240 int pos = 0;
36241 const size_t bufsz = sizeof(buf);
36242
36243 + pax_track_stack();
36244 +
36245 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
36246 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
36247 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_SYNC_ACTIVE: %d\n",
36248 @@ -658,6 +660,8 @@ static ssize_t iwl_dbgfs_qos_read(struct
36249 const size_t bufsz = sizeof(buf);
36250 ssize_t ret;
36251
36252 + pax_track_stack();
36253 +
36254 for (i = 0; i < AC_NUM; i++) {
36255 pos += scnprintf(buf + pos, bufsz - pos,
36256 "\tcw_min\tcw_max\taifsn\ttxop\n");
36257 diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debug.h
36258 --- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-03-27 14:31:47.000000000 -0400
36259 +++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-04-17 15:56:46.000000000 -0400
36260 @@ -118,8 +118,8 @@ void iwl_dbgfs_unregister(struct iwl_pri
36261 #endif
36262
36263 #else
36264 -#define IWL_DEBUG(__priv, level, fmt, args...)
36265 -#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
36266 +#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
36267 +#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
36268 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
36269 void *p, u32 len)
36270 {}
36271 diff -urNp linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-dev.h linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-dev.h
36272 --- linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-dev.h 2011-03-27 14:31:47.000000000 -0400
36273 +++ linux-2.6.32.46/drivers/net/wireless/iwlwifi/iwl-dev.h 2011-04-17 15:56:46.000000000 -0400
36274 @@ -68,7 +68,7 @@ struct iwl_tx_queue;
36275
36276 /* shared structures from iwl-5000.c */
36277 extern struct iwl_mod_params iwl50_mod_params;
36278 -extern struct iwl_ops iwl5000_ops;
36279 +extern const struct iwl_ops iwl5000_ops;
36280 extern struct iwl_ucode_ops iwl5000_ucode;
36281 extern struct iwl_lib_ops iwl5000_lib;
36282 extern struct iwl_hcmd_ops iwl5000_hcmd;
36283 diff -urNp linux-2.6.32.46/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-2.6.32.46/drivers/net/wireless/iwmc3200wifi/debugfs.c
36284 --- linux-2.6.32.46/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-03-27 14:31:47.000000000 -0400
36285 +++ linux-2.6.32.46/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-16 21:46:57.000000000 -0400
36286 @@ -299,6 +299,8 @@ static ssize_t iwm_debugfs_fw_err_read(s
36287 int buf_len = 512;
36288 size_t len = 0;
36289
36290 + pax_track_stack();
36291 +
36292 if (*ppos != 0)
36293 return 0;
36294 if (count < sizeof(buf))
36295 diff -urNp linux-2.6.32.46/drivers/net/wireless/libertas/debugfs.c linux-2.6.32.46/drivers/net/wireless/libertas/debugfs.c
36296 --- linux-2.6.32.46/drivers/net/wireless/libertas/debugfs.c 2011-03-27 14:31:47.000000000 -0400
36297 +++ linux-2.6.32.46/drivers/net/wireless/libertas/debugfs.c 2011-04-17 15:56:46.000000000 -0400
36298 @@ -708,7 +708,7 @@ out_unlock:
36299 struct lbs_debugfs_files {
36300 const char *name;
36301 int perm;
36302 - struct file_operations fops;
36303 + const struct file_operations fops;
36304 };
36305
36306 static const struct lbs_debugfs_files debugfs_files[] = {
36307 diff -urNp linux-2.6.32.46/drivers/net/wireless/rndis_wlan.c linux-2.6.32.46/drivers/net/wireless/rndis_wlan.c
36308 --- linux-2.6.32.46/drivers/net/wireless/rndis_wlan.c 2011-03-27 14:31:47.000000000 -0400
36309 +++ linux-2.6.32.46/drivers/net/wireless/rndis_wlan.c 2011-04-17 15:56:46.000000000 -0400
36310 @@ -1176,7 +1176,7 @@ static int set_rts_threshold(struct usbn
36311
36312 devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
36313
36314 - if (rts_threshold < 0 || rts_threshold > 2347)
36315 + if (rts_threshold > 2347)
36316 rts_threshold = 2347;
36317
36318 tmp = cpu_to_le32(rts_threshold);
36319 diff -urNp linux-2.6.32.46/drivers/oprofile/buffer_sync.c linux-2.6.32.46/drivers/oprofile/buffer_sync.c
36320 --- linux-2.6.32.46/drivers/oprofile/buffer_sync.c 2011-03-27 14:31:47.000000000 -0400
36321 +++ linux-2.6.32.46/drivers/oprofile/buffer_sync.c 2011-04-17 15:56:46.000000000 -0400
36322 @@ -341,7 +341,7 @@ static void add_data(struct op_entry *en
36323 if (cookie == NO_COOKIE)
36324 offset = pc;
36325 if (cookie == INVALID_COOKIE) {
36326 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
36327 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
36328 offset = pc;
36329 }
36330 if (cookie != last_cookie) {
36331 @@ -385,14 +385,14 @@ add_sample(struct mm_struct *mm, struct
36332 /* add userspace sample */
36333
36334 if (!mm) {
36335 - atomic_inc(&oprofile_stats.sample_lost_no_mm);
36336 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
36337 return 0;
36338 }
36339
36340 cookie = lookup_dcookie(mm, s->eip, &offset);
36341
36342 if (cookie == INVALID_COOKIE) {
36343 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
36344 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
36345 return 0;
36346 }
36347
36348 @@ -561,7 +561,7 @@ void sync_buffer(int cpu)
36349 /* ignore backtraces if failed to add a sample */
36350 if (state == sb_bt_start) {
36351 state = sb_bt_ignore;
36352 - atomic_inc(&oprofile_stats.bt_lost_no_mapping);
36353 + atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
36354 }
36355 }
36356 release_mm(mm);
36357 diff -urNp linux-2.6.32.46/drivers/oprofile/event_buffer.c linux-2.6.32.46/drivers/oprofile/event_buffer.c
36358 --- linux-2.6.32.46/drivers/oprofile/event_buffer.c 2011-03-27 14:31:47.000000000 -0400
36359 +++ linux-2.6.32.46/drivers/oprofile/event_buffer.c 2011-04-17 15:56:46.000000000 -0400
36360 @@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
36361 }
36362
36363 if (buffer_pos == buffer_size) {
36364 - atomic_inc(&oprofile_stats.event_lost_overflow);
36365 + atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
36366 return;
36367 }
36368
36369 diff -urNp linux-2.6.32.46/drivers/oprofile/oprof.c linux-2.6.32.46/drivers/oprofile/oprof.c
36370 --- linux-2.6.32.46/drivers/oprofile/oprof.c 2011-03-27 14:31:47.000000000 -0400
36371 +++ linux-2.6.32.46/drivers/oprofile/oprof.c 2011-04-17 15:56:46.000000000 -0400
36372 @@ -110,7 +110,7 @@ static void switch_worker(struct work_st
36373 if (oprofile_ops.switch_events())
36374 return;
36375
36376 - atomic_inc(&oprofile_stats.multiplex_counter);
36377 + atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
36378 start_switch_worker();
36379 }
36380
36381 diff -urNp linux-2.6.32.46/drivers/oprofile/oprofilefs.c linux-2.6.32.46/drivers/oprofile/oprofilefs.c
36382 --- linux-2.6.32.46/drivers/oprofile/oprofilefs.c 2011-03-27 14:31:47.000000000 -0400
36383 +++ linux-2.6.32.46/drivers/oprofile/oprofilefs.c 2011-04-17 15:56:46.000000000 -0400
36384 @@ -187,7 +187,7 @@ static const struct file_operations atom
36385
36386
36387 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
36388 - char const *name, atomic_t *val)
36389 + char const *name, atomic_unchecked_t *val)
36390 {
36391 struct dentry *d = __oprofilefs_create_file(sb, root, name,
36392 &atomic_ro_fops, 0444);
36393 diff -urNp linux-2.6.32.46/drivers/oprofile/oprofile_stats.c linux-2.6.32.46/drivers/oprofile/oprofile_stats.c
36394 --- linux-2.6.32.46/drivers/oprofile/oprofile_stats.c 2011-03-27 14:31:47.000000000 -0400
36395 +++ linux-2.6.32.46/drivers/oprofile/oprofile_stats.c 2011-04-17 15:56:46.000000000 -0400
36396 @@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
36397 cpu_buf->sample_invalid_eip = 0;
36398 }
36399
36400 - atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
36401 - atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
36402 - atomic_set(&oprofile_stats.event_lost_overflow, 0);
36403 - atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
36404 - atomic_set(&oprofile_stats.multiplex_counter, 0);
36405 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
36406 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
36407 + atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
36408 + atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
36409 + atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
36410 }
36411
36412
36413 diff -urNp linux-2.6.32.46/drivers/oprofile/oprofile_stats.h linux-2.6.32.46/drivers/oprofile/oprofile_stats.h
36414 --- linux-2.6.32.46/drivers/oprofile/oprofile_stats.h 2011-03-27 14:31:47.000000000 -0400
36415 +++ linux-2.6.32.46/drivers/oprofile/oprofile_stats.h 2011-04-17 15:56:46.000000000 -0400
36416 @@ -13,11 +13,11 @@
36417 #include <asm/atomic.h>
36418
36419 struct oprofile_stat_struct {
36420 - atomic_t sample_lost_no_mm;
36421 - atomic_t sample_lost_no_mapping;
36422 - atomic_t bt_lost_no_mapping;
36423 - atomic_t event_lost_overflow;
36424 - atomic_t multiplex_counter;
36425 + atomic_unchecked_t sample_lost_no_mm;
36426 + atomic_unchecked_t sample_lost_no_mapping;
36427 + atomic_unchecked_t bt_lost_no_mapping;
36428 + atomic_unchecked_t event_lost_overflow;
36429 + atomic_unchecked_t multiplex_counter;
36430 };
36431
36432 extern struct oprofile_stat_struct oprofile_stats;
36433 diff -urNp linux-2.6.32.46/drivers/parisc/pdc_stable.c linux-2.6.32.46/drivers/parisc/pdc_stable.c
36434 --- linux-2.6.32.46/drivers/parisc/pdc_stable.c 2011-03-27 14:31:47.000000000 -0400
36435 +++ linux-2.6.32.46/drivers/parisc/pdc_stable.c 2011-04-17 15:56:46.000000000 -0400
36436 @@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj
36437 return ret;
36438 }
36439
36440 -static struct sysfs_ops pdcspath_attr_ops = {
36441 +static const struct sysfs_ops pdcspath_attr_ops = {
36442 .show = pdcspath_attr_show,
36443 .store = pdcspath_attr_store,
36444 };
36445 diff -urNp linux-2.6.32.46/drivers/parport/procfs.c linux-2.6.32.46/drivers/parport/procfs.c
36446 --- linux-2.6.32.46/drivers/parport/procfs.c 2011-03-27 14:31:47.000000000 -0400
36447 +++ linux-2.6.32.46/drivers/parport/procfs.c 2011-04-17 15:56:46.000000000 -0400
36448 @@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
36449
36450 *ppos += len;
36451
36452 - return copy_to_user(result, buffer, len) ? -EFAULT : 0;
36453 + return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
36454 }
36455
36456 #ifdef CONFIG_PARPORT_1284
36457 @@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
36458
36459 *ppos += len;
36460
36461 - return copy_to_user (result, buffer, len) ? -EFAULT : 0;
36462 + return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
36463 }
36464 #endif /* IEEE1284.3 support. */
36465
36466 diff -urNp linux-2.6.32.46/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.32.46/drivers/pci/hotplug/acpiphp_glue.c
36467 --- linux-2.6.32.46/drivers/pci/hotplug/acpiphp_glue.c 2011-03-27 14:31:47.000000000 -0400
36468 +++ linux-2.6.32.46/drivers/pci/hotplug/acpiphp_glue.c 2011-04-17 15:56:46.000000000 -0400
36469 @@ -111,7 +111,7 @@ static int post_dock_fixups(struct notif
36470 }
36471
36472
36473 -static struct acpi_dock_ops acpiphp_dock_ops = {
36474 +static const struct acpi_dock_ops acpiphp_dock_ops = {
36475 .handler = handle_hotplug_event_func,
36476 };
36477
36478 diff -urNp linux-2.6.32.46/drivers/pci/hotplug/cpci_hotplug.h linux-2.6.32.46/drivers/pci/hotplug/cpci_hotplug.h
36479 --- linux-2.6.32.46/drivers/pci/hotplug/cpci_hotplug.h 2011-03-27 14:31:47.000000000 -0400
36480 +++ linux-2.6.32.46/drivers/pci/hotplug/cpci_hotplug.h 2011-08-05 20:33:55.000000000 -0400
36481 @@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
36482 int (*hardware_test) (struct slot* slot, u32 value);
36483 u8 (*get_power) (struct slot* slot);
36484 int (*set_power) (struct slot* slot, int value);
36485 -};
36486 +} __no_const;
36487
36488 struct cpci_hp_controller {
36489 unsigned int irq;
36490 diff -urNp linux-2.6.32.46/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.32.46/drivers/pci/hotplug/cpqphp_nvram.c
36491 --- linux-2.6.32.46/drivers/pci/hotplug/cpqphp_nvram.c 2011-03-27 14:31:47.000000000 -0400
36492 +++ linux-2.6.32.46/drivers/pci/hotplug/cpqphp_nvram.c 2011-04-17 15:56:46.000000000 -0400
36493 @@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
36494
36495 void compaq_nvram_init (void __iomem *rom_start)
36496 {
36497 +
36498 +#ifndef CONFIG_PAX_KERNEXEC
36499 if (rom_start) {
36500 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
36501 }
36502 +#endif
36503 +
36504 dbg("int15 entry = %p\n", compaq_int15_entry_point);
36505
36506 /* initialize our int15 lock */
36507 diff -urNp linux-2.6.32.46/drivers/pci/hotplug/fakephp.c linux-2.6.32.46/drivers/pci/hotplug/fakephp.c
36508 --- linux-2.6.32.46/drivers/pci/hotplug/fakephp.c 2011-03-27 14:31:47.000000000 -0400
36509 +++ linux-2.6.32.46/drivers/pci/hotplug/fakephp.c 2011-04-17 15:56:46.000000000 -0400
36510 @@ -73,7 +73,7 @@ static void legacy_release(struct kobjec
36511 }
36512
36513 static struct kobj_type legacy_ktype = {
36514 - .sysfs_ops = &(struct sysfs_ops){
36515 + .sysfs_ops = &(const struct sysfs_ops){
36516 .store = legacy_store, .show = legacy_show
36517 },
36518 .release = &legacy_release,
36519 diff -urNp linux-2.6.32.46/drivers/pci/intel-iommu.c linux-2.6.32.46/drivers/pci/intel-iommu.c
36520 --- linux-2.6.32.46/drivers/pci/intel-iommu.c 2011-05-10 22:12:01.000000000 -0400
36521 +++ linux-2.6.32.46/drivers/pci/intel-iommu.c 2011-05-10 22:12:33.000000000 -0400
36522 @@ -2643,7 +2643,7 @@ error:
36523 return 0;
36524 }
36525
36526 -static dma_addr_t intel_map_page(struct device *dev, struct page *page,
36527 +dma_addr_t intel_map_page(struct device *dev, struct page *page,
36528 unsigned long offset, size_t size,
36529 enum dma_data_direction dir,
36530 struct dma_attrs *attrs)
36531 @@ -2719,7 +2719,7 @@ static void add_unmap(struct dmar_domain
36532 spin_unlock_irqrestore(&async_umap_flush_lock, flags);
36533 }
36534
36535 -static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
36536 +void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
36537 size_t size, enum dma_data_direction dir,
36538 struct dma_attrs *attrs)
36539 {
36540 @@ -2768,7 +2768,7 @@ static void intel_unmap_page(struct devi
36541 }
36542 }
36543
36544 -static void *intel_alloc_coherent(struct device *hwdev, size_t size,
36545 +void *intel_alloc_coherent(struct device *hwdev, size_t size,
36546 dma_addr_t *dma_handle, gfp_t flags)
36547 {
36548 void *vaddr;
36549 @@ -2800,7 +2800,7 @@ static void *intel_alloc_coherent(struct
36550 return NULL;
36551 }
36552
36553 -static void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
36554 +void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
36555 dma_addr_t dma_handle)
36556 {
36557 int order;
36558 @@ -2812,7 +2812,7 @@ static void intel_free_coherent(struct d
36559 free_pages((unsigned long)vaddr, order);
36560 }
36561
36562 -static void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
36563 +void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
36564 int nelems, enum dma_data_direction dir,
36565 struct dma_attrs *attrs)
36566 {
36567 @@ -2872,7 +2872,7 @@ static int intel_nontranslate_map_sg(str
36568 return nelems;
36569 }
36570
36571 -static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
36572 +int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
36573 enum dma_data_direction dir, struct dma_attrs *attrs)
36574 {
36575 int i;
36576 @@ -2941,12 +2941,12 @@ static int intel_map_sg(struct device *h
36577 return nelems;
36578 }
36579
36580 -static int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
36581 +int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
36582 {
36583 return !dma_addr;
36584 }
36585
36586 -struct dma_map_ops intel_dma_ops = {
36587 +const struct dma_map_ops intel_dma_ops = {
36588 .alloc_coherent = intel_alloc_coherent,
36589 .free_coherent = intel_free_coherent,
36590 .map_sg = intel_map_sg,
36591 diff -urNp linux-2.6.32.46/drivers/pci/pcie/aspm.c linux-2.6.32.46/drivers/pci/pcie/aspm.c
36592 --- linux-2.6.32.46/drivers/pci/pcie/aspm.c 2011-03-27 14:31:47.000000000 -0400
36593 +++ linux-2.6.32.46/drivers/pci/pcie/aspm.c 2011-04-17 15:56:46.000000000 -0400
36594 @@ -27,9 +27,9 @@
36595 #define MODULE_PARAM_PREFIX "pcie_aspm."
36596
36597 /* Note: those are not register definitions */
36598 -#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
36599 -#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
36600 -#define ASPM_STATE_L1 (4) /* L1 state */
36601 +#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
36602 +#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
36603 +#define ASPM_STATE_L1 (4U) /* L1 state */
36604 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
36605 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
36606
36607 diff -urNp linux-2.6.32.46/drivers/pci/probe.c linux-2.6.32.46/drivers/pci/probe.c
36608 --- linux-2.6.32.46/drivers/pci/probe.c 2011-03-27 14:31:47.000000000 -0400
36609 +++ linux-2.6.32.46/drivers/pci/probe.c 2011-04-17 15:56:46.000000000 -0400
36610 @@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
36611 return ret;
36612 }
36613
36614 -static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
36615 +static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
36616 struct device_attribute *attr,
36617 char *buf)
36618 {
36619 return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
36620 }
36621
36622 -static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
36623 +static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
36624 struct device_attribute *attr,
36625 char *buf)
36626 {
36627 diff -urNp linux-2.6.32.46/drivers/pci/proc.c linux-2.6.32.46/drivers/pci/proc.c
36628 --- linux-2.6.32.46/drivers/pci/proc.c 2011-03-27 14:31:47.000000000 -0400
36629 +++ linux-2.6.32.46/drivers/pci/proc.c 2011-04-17 15:56:46.000000000 -0400
36630 @@ -480,7 +480,16 @@ static const struct file_operations proc
36631 static int __init pci_proc_init(void)
36632 {
36633 struct pci_dev *dev = NULL;
36634 +
36635 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
36636 +#ifdef CONFIG_GRKERNSEC_PROC_USER
36637 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
36638 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
36639 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
36640 +#endif
36641 +#else
36642 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
36643 +#endif
36644 proc_create("devices", 0, proc_bus_pci_dir,
36645 &proc_bus_pci_dev_operations);
36646 proc_initialized = 1;
36647 diff -urNp linux-2.6.32.46/drivers/pci/slot.c linux-2.6.32.46/drivers/pci/slot.c
36648 --- linux-2.6.32.46/drivers/pci/slot.c 2011-03-27 14:31:47.000000000 -0400
36649 +++ linux-2.6.32.46/drivers/pci/slot.c 2011-04-17 15:56:46.000000000 -0400
36650 @@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struc
36651 return attribute->store ? attribute->store(slot, buf, len) : -EIO;
36652 }
36653
36654 -static struct sysfs_ops pci_slot_sysfs_ops = {
36655 +static const struct sysfs_ops pci_slot_sysfs_ops = {
36656 .show = pci_slot_attr_show,
36657 .store = pci_slot_attr_store,
36658 };
36659 diff -urNp linux-2.6.32.46/drivers/pcmcia/pcmcia_ioctl.c linux-2.6.32.46/drivers/pcmcia/pcmcia_ioctl.c
36660 --- linux-2.6.32.46/drivers/pcmcia/pcmcia_ioctl.c 2011-03-27 14:31:47.000000000 -0400
36661 +++ linux-2.6.32.46/drivers/pcmcia/pcmcia_ioctl.c 2011-04-17 15:56:46.000000000 -0400
36662 @@ -819,7 +819,7 @@ static int ds_ioctl(struct inode * inode
36663 return -EFAULT;
36664 }
36665 }
36666 - buf = kmalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
36667 + buf = kzalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
36668 if (!buf)
36669 return -ENOMEM;
36670
36671 diff -urNp linux-2.6.32.46/drivers/platform/x86/acer-wmi.c linux-2.6.32.46/drivers/platform/x86/acer-wmi.c
36672 --- linux-2.6.32.46/drivers/platform/x86/acer-wmi.c 2011-03-27 14:31:47.000000000 -0400
36673 +++ linux-2.6.32.46/drivers/platform/x86/acer-wmi.c 2011-04-17 15:56:46.000000000 -0400
36674 @@ -918,7 +918,7 @@ static int update_bl_status(struct backl
36675 return 0;
36676 }
36677
36678 -static struct backlight_ops acer_bl_ops = {
36679 +static const struct backlight_ops acer_bl_ops = {
36680 .get_brightness = read_brightness,
36681 .update_status = update_bl_status,
36682 };
36683 diff -urNp linux-2.6.32.46/drivers/platform/x86/asus_acpi.c linux-2.6.32.46/drivers/platform/x86/asus_acpi.c
36684 --- linux-2.6.32.46/drivers/platform/x86/asus_acpi.c 2011-03-27 14:31:47.000000000 -0400
36685 +++ linux-2.6.32.46/drivers/platform/x86/asus_acpi.c 2011-04-17 15:56:46.000000000 -0400
36686 @@ -1396,7 +1396,7 @@ static int asus_hotk_remove(struct acpi_
36687 return 0;
36688 }
36689
36690 -static struct backlight_ops asus_backlight_data = {
36691 +static const struct backlight_ops asus_backlight_data = {
36692 .get_brightness = read_brightness,
36693 .update_status = set_brightness_status,
36694 };
36695 diff -urNp linux-2.6.32.46/drivers/platform/x86/asus-laptop.c linux-2.6.32.46/drivers/platform/x86/asus-laptop.c
36696 --- linux-2.6.32.46/drivers/platform/x86/asus-laptop.c 2011-03-27 14:31:47.000000000 -0400
36697 +++ linux-2.6.32.46/drivers/platform/x86/asus-laptop.c 2011-04-17 15:56:46.000000000 -0400
36698 @@ -250,7 +250,7 @@ static struct backlight_device *asus_bac
36699 */
36700 static int read_brightness(struct backlight_device *bd);
36701 static int update_bl_status(struct backlight_device *bd);
36702 -static struct backlight_ops asusbl_ops = {
36703 +static const struct backlight_ops asusbl_ops = {
36704 .get_brightness = read_brightness,
36705 .update_status = update_bl_status,
36706 };
36707 diff -urNp linux-2.6.32.46/drivers/platform/x86/compal-laptop.c linux-2.6.32.46/drivers/platform/x86/compal-laptop.c
36708 --- linux-2.6.32.46/drivers/platform/x86/compal-laptop.c 2011-03-27 14:31:47.000000000 -0400
36709 +++ linux-2.6.32.46/drivers/platform/x86/compal-laptop.c 2011-04-17 15:56:46.000000000 -0400
36710 @@ -163,7 +163,7 @@ static int bl_update_status(struct backl
36711 return set_lcd_level(b->props.brightness);
36712 }
36713
36714 -static struct backlight_ops compalbl_ops = {
36715 +static const struct backlight_ops compalbl_ops = {
36716 .get_brightness = bl_get_brightness,
36717 .update_status = bl_update_status,
36718 };
36719 diff -urNp linux-2.6.32.46/drivers/platform/x86/dell-laptop.c linux-2.6.32.46/drivers/platform/x86/dell-laptop.c
36720 --- linux-2.6.32.46/drivers/platform/x86/dell-laptop.c 2011-05-10 22:12:01.000000000 -0400
36721 +++ linux-2.6.32.46/drivers/platform/x86/dell-laptop.c 2011-05-10 22:12:33.000000000 -0400
36722 @@ -318,7 +318,7 @@ static int dell_get_intensity(struct bac
36723 return buffer.output[1];
36724 }
36725
36726 -static struct backlight_ops dell_ops = {
36727 +static const struct backlight_ops dell_ops = {
36728 .get_brightness = dell_get_intensity,
36729 .update_status = dell_send_intensity,
36730 };
36731 diff -urNp linux-2.6.32.46/drivers/platform/x86/eeepc-laptop.c linux-2.6.32.46/drivers/platform/x86/eeepc-laptop.c
36732 --- linux-2.6.32.46/drivers/platform/x86/eeepc-laptop.c 2011-03-27 14:31:47.000000000 -0400
36733 +++ linux-2.6.32.46/drivers/platform/x86/eeepc-laptop.c 2011-04-17 15:56:46.000000000 -0400
36734 @@ -245,7 +245,7 @@ static struct device *eeepc_hwmon_device
36735 */
36736 static int read_brightness(struct backlight_device *bd);
36737 static int update_bl_status(struct backlight_device *bd);
36738 -static struct backlight_ops eeepcbl_ops = {
36739 +static const struct backlight_ops eeepcbl_ops = {
36740 .get_brightness = read_brightness,
36741 .update_status = update_bl_status,
36742 };
36743 diff -urNp linux-2.6.32.46/drivers/platform/x86/fujitsu-laptop.c linux-2.6.32.46/drivers/platform/x86/fujitsu-laptop.c
36744 --- linux-2.6.32.46/drivers/platform/x86/fujitsu-laptop.c 2011-03-27 14:31:47.000000000 -0400
36745 +++ linux-2.6.32.46/drivers/platform/x86/fujitsu-laptop.c 2011-04-17 15:56:46.000000000 -0400
36746 @@ -436,7 +436,7 @@ static int bl_update_status(struct backl
36747 return ret;
36748 }
36749
36750 -static struct backlight_ops fujitsubl_ops = {
36751 +static const struct backlight_ops fujitsubl_ops = {
36752 .get_brightness = bl_get_brightness,
36753 .update_status = bl_update_status,
36754 };
36755 diff -urNp linux-2.6.32.46/drivers/platform/x86/msi-laptop.c linux-2.6.32.46/drivers/platform/x86/msi-laptop.c
36756 --- linux-2.6.32.46/drivers/platform/x86/msi-laptop.c 2011-03-27 14:31:47.000000000 -0400
36757 +++ linux-2.6.32.46/drivers/platform/x86/msi-laptop.c 2011-04-17 15:56:46.000000000 -0400
36758 @@ -161,7 +161,7 @@ static int bl_update_status(struct backl
36759 return set_lcd_level(b->props.brightness);
36760 }
36761
36762 -static struct backlight_ops msibl_ops = {
36763 +static const struct backlight_ops msibl_ops = {
36764 .get_brightness = bl_get_brightness,
36765 .update_status = bl_update_status,
36766 };
36767 diff -urNp linux-2.6.32.46/drivers/platform/x86/panasonic-laptop.c linux-2.6.32.46/drivers/platform/x86/panasonic-laptop.c
36768 --- linux-2.6.32.46/drivers/platform/x86/panasonic-laptop.c 2011-03-27 14:31:47.000000000 -0400
36769 +++ linux-2.6.32.46/drivers/platform/x86/panasonic-laptop.c 2011-04-17 15:56:46.000000000 -0400
36770 @@ -352,7 +352,7 @@ static int bl_set_status(struct backligh
36771 return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
36772 }
36773
36774 -static struct backlight_ops pcc_backlight_ops = {
36775 +static const struct backlight_ops pcc_backlight_ops = {
36776 .get_brightness = bl_get,
36777 .update_status = bl_set_status,
36778 };
36779 diff -urNp linux-2.6.32.46/drivers/platform/x86/sony-laptop.c linux-2.6.32.46/drivers/platform/x86/sony-laptop.c
36780 --- linux-2.6.32.46/drivers/platform/x86/sony-laptop.c 2011-03-27 14:31:47.000000000 -0400
36781 +++ linux-2.6.32.46/drivers/platform/x86/sony-laptop.c 2011-04-17 15:56:46.000000000 -0400
36782 @@ -850,7 +850,7 @@ static int sony_backlight_get_brightness
36783 }
36784
36785 static struct backlight_device *sony_backlight_device;
36786 -static struct backlight_ops sony_backlight_ops = {
36787 +static const struct backlight_ops sony_backlight_ops = {
36788 .update_status = sony_backlight_update_status,
36789 .get_brightness = sony_backlight_get_brightness,
36790 };
36791 diff -urNp linux-2.6.32.46/drivers/platform/x86/thinkpad_acpi.c linux-2.6.32.46/drivers/platform/x86/thinkpad_acpi.c
36792 --- linux-2.6.32.46/drivers/platform/x86/thinkpad_acpi.c 2011-03-27 14:31:47.000000000 -0400
36793 +++ linux-2.6.32.46/drivers/platform/x86/thinkpad_acpi.c 2011-08-05 20:33:55.000000000 -0400
36794 @@ -2137,7 +2137,7 @@ static int hotkey_mask_get(void)
36795 return 0;
36796 }
36797
36798 -void static hotkey_mask_warn_incomplete_mask(void)
36799 +static void hotkey_mask_warn_incomplete_mask(void)
36800 {
36801 /* log only what the user can fix... */
36802 const u32 wantedmask = hotkey_driver_mask &
36803 @@ -6122,7 +6122,7 @@ static void tpacpi_brightness_notify_cha
36804 BACKLIGHT_UPDATE_HOTKEY);
36805 }
36806
36807 -static struct backlight_ops ibm_backlight_data = {
36808 +static const struct backlight_ops ibm_backlight_data = {
36809 .get_brightness = brightness_get,
36810 .update_status = brightness_update_status,
36811 };
36812 diff -urNp linux-2.6.32.46/drivers/platform/x86/toshiba_acpi.c linux-2.6.32.46/drivers/platform/x86/toshiba_acpi.c
36813 --- linux-2.6.32.46/drivers/platform/x86/toshiba_acpi.c 2011-03-27 14:31:47.000000000 -0400
36814 +++ linux-2.6.32.46/drivers/platform/x86/toshiba_acpi.c 2011-04-17 15:56:46.000000000 -0400
36815 @@ -671,7 +671,7 @@ static acpi_status remove_device(void)
36816 return AE_OK;
36817 }
36818
36819 -static struct backlight_ops toshiba_backlight_data = {
36820 +static const struct backlight_ops toshiba_backlight_data = {
36821 .get_brightness = get_lcd,
36822 .update_status = set_lcd_status,
36823 };
36824 diff -urNp linux-2.6.32.46/drivers/pnp/pnpbios/bioscalls.c linux-2.6.32.46/drivers/pnp/pnpbios/bioscalls.c
36825 --- linux-2.6.32.46/drivers/pnp/pnpbios/bioscalls.c 2011-03-27 14:31:47.000000000 -0400
36826 +++ linux-2.6.32.46/drivers/pnp/pnpbios/bioscalls.c 2011-04-17 15:56:46.000000000 -0400
36827 @@ -60,7 +60,7 @@ do { \
36828 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
36829 } while(0)
36830
36831 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
36832 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
36833 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
36834
36835 /*
36836 @@ -97,7 +97,10 @@ static inline u16 call_pnp_bios(u16 func
36837
36838 cpu = get_cpu();
36839 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
36840 +
36841 + pax_open_kernel();
36842 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
36843 + pax_close_kernel();
36844
36845 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
36846 spin_lock_irqsave(&pnp_bios_lock, flags);
36847 @@ -135,7 +138,10 @@ static inline u16 call_pnp_bios(u16 func
36848 :"memory");
36849 spin_unlock_irqrestore(&pnp_bios_lock, flags);
36850
36851 + pax_open_kernel();
36852 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
36853 + pax_close_kernel();
36854 +
36855 put_cpu();
36856
36857 /* If we get here and this is set then the PnP BIOS faulted on us. */
36858 @@ -469,7 +475,7 @@ int pnp_bios_read_escd(char *data, u32 n
36859 return status;
36860 }
36861
36862 -void pnpbios_calls_init(union pnp_bios_install_struct *header)
36863 +void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
36864 {
36865 int i;
36866
36867 @@ -477,6 +483,8 @@ void pnpbios_calls_init(union pnp_bios_i
36868 pnp_bios_callpoint.offset = header->fields.pm16offset;
36869 pnp_bios_callpoint.segment = PNP_CS16;
36870
36871 + pax_open_kernel();
36872 +
36873 for_each_possible_cpu(i) {
36874 struct desc_struct *gdt = get_cpu_gdt_table(i);
36875 if (!gdt)
36876 @@ -488,4 +496,6 @@ void pnpbios_calls_init(union pnp_bios_i
36877 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
36878 (unsigned long)__va(header->fields.pm16dseg));
36879 }
36880 +
36881 + pax_close_kernel();
36882 }
36883 diff -urNp linux-2.6.32.46/drivers/pnp/resource.c linux-2.6.32.46/drivers/pnp/resource.c
36884 --- linux-2.6.32.46/drivers/pnp/resource.c 2011-03-27 14:31:47.000000000 -0400
36885 +++ linux-2.6.32.46/drivers/pnp/resource.c 2011-04-17 15:56:46.000000000 -0400
36886 @@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
36887 return 1;
36888
36889 /* check if the resource is valid */
36890 - if (*irq < 0 || *irq > 15)
36891 + if (*irq > 15)
36892 return 0;
36893
36894 /* check if the resource is reserved */
36895 @@ -419,7 +419,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
36896 return 1;
36897
36898 /* check if the resource is valid */
36899 - if (*dma < 0 || *dma == 4 || *dma > 7)
36900 + if (*dma == 4 || *dma > 7)
36901 return 0;
36902
36903 /* check if the resource is reserved */
36904 diff -urNp linux-2.6.32.46/drivers/power/bq27x00_battery.c linux-2.6.32.46/drivers/power/bq27x00_battery.c
36905 --- linux-2.6.32.46/drivers/power/bq27x00_battery.c 2011-03-27 14:31:47.000000000 -0400
36906 +++ linux-2.6.32.46/drivers/power/bq27x00_battery.c 2011-08-05 20:33:55.000000000 -0400
36907 @@ -44,7 +44,7 @@ struct bq27x00_device_info;
36908 struct bq27x00_access_methods {
36909 int (*read)(u8 reg, int *rt_value, int b_single,
36910 struct bq27x00_device_info *di);
36911 -};
36912 +} __no_const;
36913
36914 struct bq27x00_device_info {
36915 struct device *dev;
36916 diff -urNp linux-2.6.32.46/drivers/rtc/rtc-dev.c linux-2.6.32.46/drivers/rtc/rtc-dev.c
36917 --- linux-2.6.32.46/drivers/rtc/rtc-dev.c 2011-03-27 14:31:47.000000000 -0400
36918 +++ linux-2.6.32.46/drivers/rtc/rtc-dev.c 2011-04-17 15:56:46.000000000 -0400
36919 @@ -14,6 +14,7 @@
36920 #include <linux/module.h>
36921 #include <linux/rtc.h>
36922 #include <linux/sched.h>
36923 +#include <linux/grsecurity.h>
36924 #include "rtc-core.h"
36925
36926 static dev_t rtc_devt;
36927 @@ -357,6 +358,8 @@ static long rtc_dev_ioctl(struct file *f
36928 if (copy_from_user(&tm, uarg, sizeof(tm)))
36929 return -EFAULT;
36930
36931 + gr_log_timechange();
36932 +
36933 return rtc_set_time(rtc, &tm);
36934
36935 case RTC_PIE_ON:
36936 diff -urNp linux-2.6.32.46/drivers/s390/cio/qdio_perf.c linux-2.6.32.46/drivers/s390/cio/qdio_perf.c
36937 --- linux-2.6.32.46/drivers/s390/cio/qdio_perf.c 2011-03-27 14:31:47.000000000 -0400
36938 +++ linux-2.6.32.46/drivers/s390/cio/qdio_perf.c 2011-04-17 15:56:46.000000000 -0400
36939 @@ -31,51 +31,51 @@ static struct proc_dir_entry *qdio_perf_
36940 static int qdio_perf_proc_show(struct seq_file *m, void *v)
36941 {
36942 seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
36943 - (long)atomic_long_read(&perf_stats.qdio_int));
36944 + (long)atomic_long_read_unchecked(&perf_stats.qdio_int));
36945 seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
36946 - (long)atomic_long_read(&perf_stats.pci_int));
36947 + (long)atomic_long_read_unchecked(&perf_stats.pci_int));
36948 seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
36949 - (long)atomic_long_read(&perf_stats.thin_int));
36950 + (long)atomic_long_read_unchecked(&perf_stats.thin_int));
36951 seq_printf(m, "\n");
36952 seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
36953 - (long)atomic_long_read(&perf_stats.tasklet_inbound));
36954 + (long)atomic_long_read_unchecked(&perf_stats.tasklet_inbound));
36955 seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
36956 - (long)atomic_long_read(&perf_stats.tasklet_outbound));
36957 + (long)atomic_long_read_unchecked(&perf_stats.tasklet_outbound));
36958 seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
36959 - (long)atomic_long_read(&perf_stats.tasklet_thinint),
36960 - (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
36961 + (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint),
36962 + (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint_loop));
36963 seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
36964 - (long)atomic_long_read(&perf_stats.thinint_inbound),
36965 - (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
36966 + (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound),
36967 + (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop));
36968 seq_printf(m, "\n");
36969 seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
36970 - (long)atomic_long_read(&perf_stats.siga_in));
36971 + (long)atomic_long_read_unchecked(&perf_stats.siga_in));
36972 seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
36973 - (long)atomic_long_read(&perf_stats.siga_out));
36974 + (long)atomic_long_read_unchecked(&perf_stats.siga_out));
36975 seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
36976 - (long)atomic_long_read(&perf_stats.siga_sync));
36977 + (long)atomic_long_read_unchecked(&perf_stats.siga_sync));
36978 seq_printf(m, "\n");
36979 seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
36980 - (long)atomic_long_read(&perf_stats.inbound_handler));
36981 + (long)atomic_long_read_unchecked(&perf_stats.inbound_handler));
36982 seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
36983 - (long)atomic_long_read(&perf_stats.outbound_handler));
36984 + (long)atomic_long_read_unchecked(&perf_stats.outbound_handler));
36985 seq_printf(m, "\n");
36986 seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
36987 - (long)atomic_long_read(&perf_stats.fast_requeue));
36988 + (long)atomic_long_read_unchecked(&perf_stats.fast_requeue));
36989 seq_printf(m, "Number of outbound target full condition\t: %li\n",
36990 - (long)atomic_long_read(&perf_stats.outbound_target_full));
36991 + (long)atomic_long_read_unchecked(&perf_stats.outbound_target_full));
36992 seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
36993 - (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
36994 + (long)atomic_long_read_unchecked(&perf_stats.debug_tl_out_timer));
36995 seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
36996 - (long)atomic_long_read(&perf_stats.debug_stop_polling));
36997 + (long)atomic_long_read_unchecked(&perf_stats.debug_stop_polling));
36998 seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
36999 - (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
37000 + (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop2));
37001 seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
37002 - (long)atomic_long_read(&perf_stats.debug_eqbs_all),
37003 - (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
37004 + (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_all),
37005 + (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_incomplete));
37006 seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
37007 - (long)atomic_long_read(&perf_stats.debug_sqbs_all),
37008 - (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
37009 + (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_all),
37010 + (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_incomplete));
37011 seq_printf(m, "\n");
37012 return 0;
37013 }
37014 diff -urNp linux-2.6.32.46/drivers/s390/cio/qdio_perf.h linux-2.6.32.46/drivers/s390/cio/qdio_perf.h
37015 --- linux-2.6.32.46/drivers/s390/cio/qdio_perf.h 2011-03-27 14:31:47.000000000 -0400
37016 +++ linux-2.6.32.46/drivers/s390/cio/qdio_perf.h 2011-04-17 15:56:46.000000000 -0400
37017 @@ -13,46 +13,46 @@
37018
37019 struct qdio_perf_stats {
37020 /* interrupt handler calls */
37021 - atomic_long_t qdio_int;
37022 - atomic_long_t pci_int;
37023 - atomic_long_t thin_int;
37024 + atomic_long_unchecked_t qdio_int;
37025 + atomic_long_unchecked_t pci_int;
37026 + atomic_long_unchecked_t thin_int;
37027
37028 /* tasklet runs */
37029 - atomic_long_t tasklet_inbound;
37030 - atomic_long_t tasklet_outbound;
37031 - atomic_long_t tasklet_thinint;
37032 - atomic_long_t tasklet_thinint_loop;
37033 - atomic_long_t thinint_inbound;
37034 - atomic_long_t thinint_inbound_loop;
37035 - atomic_long_t thinint_inbound_loop2;
37036 + atomic_long_unchecked_t tasklet_inbound;
37037 + atomic_long_unchecked_t tasklet_outbound;
37038 + atomic_long_unchecked_t tasklet_thinint;
37039 + atomic_long_unchecked_t tasklet_thinint_loop;
37040 + atomic_long_unchecked_t thinint_inbound;
37041 + atomic_long_unchecked_t thinint_inbound_loop;
37042 + atomic_long_unchecked_t thinint_inbound_loop2;
37043
37044 /* signal adapter calls */
37045 - atomic_long_t siga_out;
37046 - atomic_long_t siga_in;
37047 - atomic_long_t siga_sync;
37048 + atomic_long_unchecked_t siga_out;
37049 + atomic_long_unchecked_t siga_in;
37050 + atomic_long_unchecked_t siga_sync;
37051
37052 /* misc */
37053 - atomic_long_t inbound_handler;
37054 - atomic_long_t outbound_handler;
37055 - atomic_long_t fast_requeue;
37056 - atomic_long_t outbound_target_full;
37057 + atomic_long_unchecked_t inbound_handler;
37058 + atomic_long_unchecked_t outbound_handler;
37059 + atomic_long_unchecked_t fast_requeue;
37060 + atomic_long_unchecked_t outbound_target_full;
37061
37062 /* for debugging */
37063 - atomic_long_t debug_tl_out_timer;
37064 - atomic_long_t debug_stop_polling;
37065 - atomic_long_t debug_eqbs_all;
37066 - atomic_long_t debug_eqbs_incomplete;
37067 - atomic_long_t debug_sqbs_all;
37068 - atomic_long_t debug_sqbs_incomplete;
37069 + atomic_long_unchecked_t debug_tl_out_timer;
37070 + atomic_long_unchecked_t debug_stop_polling;
37071 + atomic_long_unchecked_t debug_eqbs_all;
37072 + atomic_long_unchecked_t debug_eqbs_incomplete;
37073 + atomic_long_unchecked_t debug_sqbs_all;
37074 + atomic_long_unchecked_t debug_sqbs_incomplete;
37075 };
37076
37077 extern struct qdio_perf_stats perf_stats;
37078 extern int qdio_performance_stats;
37079
37080 -static inline void qdio_perf_stat_inc(atomic_long_t *count)
37081 +static inline void qdio_perf_stat_inc(atomic_long_unchecked_t *count)
37082 {
37083 if (qdio_performance_stats)
37084 - atomic_long_inc(count);
37085 + atomic_long_inc_unchecked(count);
37086 }
37087
37088 int qdio_setup_perf_stats(void);
37089 diff -urNp linux-2.6.32.46/drivers/scsi/aacraid/aacraid.h linux-2.6.32.46/drivers/scsi/aacraid/aacraid.h
37090 --- linux-2.6.32.46/drivers/scsi/aacraid/aacraid.h 2011-03-27 14:31:47.000000000 -0400
37091 +++ linux-2.6.32.46/drivers/scsi/aacraid/aacraid.h 2011-08-05 20:33:55.000000000 -0400
37092 @@ -471,7 +471,7 @@ struct adapter_ops
37093 int (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
37094 /* Administrative operations */
37095 int (*adapter_comm)(struct aac_dev * dev, int comm);
37096 -};
37097 +} __no_const;
37098
37099 /*
37100 * Define which interrupt handler needs to be installed
37101 diff -urNp linux-2.6.32.46/drivers/scsi/aacraid/commctrl.c linux-2.6.32.46/drivers/scsi/aacraid/commctrl.c
37102 --- linux-2.6.32.46/drivers/scsi/aacraid/commctrl.c 2011-03-27 14:31:47.000000000 -0400
37103 +++ linux-2.6.32.46/drivers/scsi/aacraid/commctrl.c 2011-05-16 21:46:57.000000000 -0400
37104 @@ -481,6 +481,7 @@ static int aac_send_raw_srb(struct aac_d
37105 u32 actual_fibsize64, actual_fibsize = 0;
37106 int i;
37107
37108 + pax_track_stack();
37109
37110 if (dev->in_reset) {
37111 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
37112 diff -urNp linux-2.6.32.46/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.32.46/drivers/scsi/aic94xx/aic94xx_init.c
37113 --- linux-2.6.32.46/drivers/scsi/aic94xx/aic94xx_init.c 2011-03-27 14:31:47.000000000 -0400
37114 +++ linux-2.6.32.46/drivers/scsi/aic94xx/aic94xx_init.c 2011-04-17 15:56:46.000000000 -0400
37115 @@ -485,7 +485,7 @@ static ssize_t asd_show_update_bios(stru
37116 flash_error_table[i].reason);
37117 }
37118
37119 -static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUGO,
37120 +static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUSR,
37121 asd_show_update_bios, asd_store_update_bios);
37122
37123 static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
37124 diff -urNp linux-2.6.32.46/drivers/scsi/bfa/bfa_iocfc.h linux-2.6.32.46/drivers/scsi/bfa/bfa_iocfc.h
37125 --- linux-2.6.32.46/drivers/scsi/bfa/bfa_iocfc.h 2011-03-27 14:31:47.000000000 -0400
37126 +++ linux-2.6.32.46/drivers/scsi/bfa/bfa_iocfc.h 2011-08-05 20:33:55.000000000 -0400
37127 @@ -61,7 +61,7 @@ struct bfa_hwif_s {
37128 void (*hw_isr_mode_set)(struct bfa_s *bfa, bfa_boolean_t msix);
37129 void (*hw_msix_getvecs)(struct bfa_s *bfa, u32 *vecmap,
37130 u32 *nvecs, u32 *maxvec);
37131 -};
37132 +} __no_const;
37133 typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
37134
37135 struct bfa_iocfc_s {
37136 diff -urNp linux-2.6.32.46/drivers/scsi/bfa/bfa_ioc.h linux-2.6.32.46/drivers/scsi/bfa/bfa_ioc.h
37137 --- linux-2.6.32.46/drivers/scsi/bfa/bfa_ioc.h 2011-03-27 14:31:47.000000000 -0400
37138 +++ linux-2.6.32.46/drivers/scsi/bfa/bfa_ioc.h 2011-08-05 20:33:55.000000000 -0400
37139 @@ -127,7 +127,7 @@ struct bfa_ioc_cbfn_s {
37140 bfa_ioc_disable_cbfn_t disable_cbfn;
37141 bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
37142 bfa_ioc_reset_cbfn_t reset_cbfn;
37143 -};
37144 +} __no_const;
37145
37146 /**
37147 * Heartbeat failure notification queue element.
37148 diff -urNp linux-2.6.32.46/drivers/scsi/BusLogic.c linux-2.6.32.46/drivers/scsi/BusLogic.c
37149 --- linux-2.6.32.46/drivers/scsi/BusLogic.c 2011-03-27 14:31:47.000000000 -0400
37150 +++ linux-2.6.32.46/drivers/scsi/BusLogic.c 2011-05-16 21:46:57.000000000 -0400
37151 @@ -961,6 +961,8 @@ static int __init BusLogic_InitializeFla
37152 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
37153 *PrototypeHostAdapter)
37154 {
37155 + pax_track_stack();
37156 +
37157 /*
37158 If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
37159 Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
37160 diff -urNp linux-2.6.32.46/drivers/scsi/dpt_i2o.c linux-2.6.32.46/drivers/scsi/dpt_i2o.c
37161 --- linux-2.6.32.46/drivers/scsi/dpt_i2o.c 2011-03-27 14:31:47.000000000 -0400
37162 +++ linux-2.6.32.46/drivers/scsi/dpt_i2o.c 2011-05-16 21:46:57.000000000 -0400
37163 @@ -1804,6 +1804,8 @@ static int adpt_i2o_passthru(adpt_hba* p
37164 dma_addr_t addr;
37165 ulong flags = 0;
37166
37167 + pax_track_stack();
37168 +
37169 memset(&msg, 0, MAX_MESSAGE_SIZE*4);
37170 // get user msg size in u32s
37171 if(get_user(size, &user_msg[0])){
37172 @@ -2297,6 +2299,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pH
37173 s32 rcode;
37174 dma_addr_t addr;
37175
37176 + pax_track_stack();
37177 +
37178 memset(msg, 0 , sizeof(msg));
37179 len = scsi_bufflen(cmd);
37180 direction = 0x00000000;
37181 diff -urNp linux-2.6.32.46/drivers/scsi/eata.c linux-2.6.32.46/drivers/scsi/eata.c
37182 --- linux-2.6.32.46/drivers/scsi/eata.c 2011-03-27 14:31:47.000000000 -0400
37183 +++ linux-2.6.32.46/drivers/scsi/eata.c 2011-05-16 21:46:57.000000000 -0400
37184 @@ -1087,6 +1087,8 @@ static int port_detect(unsigned long por
37185 struct hostdata *ha;
37186 char name[16];
37187
37188 + pax_track_stack();
37189 +
37190 sprintf(name, "%s%d", driver_name, j);
37191
37192 if (!request_region(port_base, REGION_SIZE, driver_name)) {
37193 diff -urNp linux-2.6.32.46/drivers/scsi/fcoe/libfcoe.c linux-2.6.32.46/drivers/scsi/fcoe/libfcoe.c
37194 --- linux-2.6.32.46/drivers/scsi/fcoe/libfcoe.c 2011-03-27 14:31:47.000000000 -0400
37195 +++ linux-2.6.32.46/drivers/scsi/fcoe/libfcoe.c 2011-05-16 21:46:57.000000000 -0400
37196 @@ -809,6 +809,8 @@ static void fcoe_ctlr_recv_els(struct fc
37197 size_t rlen;
37198 size_t dlen;
37199
37200 + pax_track_stack();
37201 +
37202 fiph = (struct fip_header *)skb->data;
37203 sub = fiph->fip_subcode;
37204 if (sub != FIP_SC_REQ && sub != FIP_SC_REP)
37205 diff -urNp linux-2.6.32.46/drivers/scsi/fnic/fnic_main.c linux-2.6.32.46/drivers/scsi/fnic/fnic_main.c
37206 --- linux-2.6.32.46/drivers/scsi/fnic/fnic_main.c 2011-03-27 14:31:47.000000000 -0400
37207 +++ linux-2.6.32.46/drivers/scsi/fnic/fnic_main.c 2011-08-05 20:33:55.000000000 -0400
37208 @@ -669,7 +669,7 @@ static int __devinit fnic_probe(struct p
37209 /* Start local port initiatialization */
37210
37211 lp->link_up = 0;
37212 - lp->tt = fnic_transport_template;
37213 + memcpy((void *)&lp->tt, &fnic_transport_template, sizeof(fnic_transport_template));
37214
37215 lp->max_retry_count = fnic->config.flogi_retries;
37216 lp->max_rport_retry_count = fnic->config.plogi_retries;
37217 diff -urNp linux-2.6.32.46/drivers/scsi/gdth.c linux-2.6.32.46/drivers/scsi/gdth.c
37218 --- linux-2.6.32.46/drivers/scsi/gdth.c 2011-03-27 14:31:47.000000000 -0400
37219 +++ linux-2.6.32.46/drivers/scsi/gdth.c 2011-05-16 21:46:57.000000000 -0400
37220 @@ -4102,6 +4102,8 @@ static int ioc_lockdrv(void __user *arg)
37221 ulong flags;
37222 gdth_ha_str *ha;
37223
37224 + pax_track_stack();
37225 +
37226 if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
37227 return -EFAULT;
37228 ha = gdth_find_ha(ldrv.ionode);
37229 @@ -4134,6 +4136,8 @@ static int ioc_resetdrv(void __user *arg
37230 gdth_ha_str *ha;
37231 int rval;
37232
37233 + pax_track_stack();
37234 +
37235 if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
37236 res.number >= MAX_HDRIVES)
37237 return -EFAULT;
37238 @@ -4169,6 +4173,8 @@ static int ioc_general(void __user *arg,
37239 gdth_ha_str *ha;
37240 int rval;
37241
37242 + pax_track_stack();
37243 +
37244 if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
37245 return -EFAULT;
37246 ha = gdth_find_ha(gen.ionode);
37247 @@ -4625,6 +4631,9 @@ static void gdth_flush(gdth_ha_str *ha)
37248 int i;
37249 gdth_cmd_str gdtcmd;
37250 char cmnd[MAX_COMMAND_SIZE];
37251 +
37252 + pax_track_stack();
37253 +
37254 memset(cmnd, 0xff, MAX_COMMAND_SIZE);
37255
37256 TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
37257 diff -urNp linux-2.6.32.46/drivers/scsi/gdth_proc.c linux-2.6.32.46/drivers/scsi/gdth_proc.c
37258 --- linux-2.6.32.46/drivers/scsi/gdth_proc.c 2011-03-27 14:31:47.000000000 -0400
37259 +++ linux-2.6.32.46/drivers/scsi/gdth_proc.c 2011-05-16 21:46:57.000000000 -0400
37260 @@ -46,6 +46,9 @@ static int gdth_set_asc_info(struct Scsi
37261 ulong64 paddr;
37262
37263 char cmnd[MAX_COMMAND_SIZE];
37264 +
37265 + pax_track_stack();
37266 +
37267 memset(cmnd, 0xff, 12);
37268 memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
37269
37270 @@ -174,6 +177,8 @@ static int gdth_get_info(char *buffer,ch
37271 gdth_hget_str *phg;
37272 char cmnd[MAX_COMMAND_SIZE];
37273
37274 + pax_track_stack();
37275 +
37276 gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
37277 estr = kmalloc(sizeof(*estr), GFP_KERNEL);
37278 if (!gdtcmd || !estr)
37279 diff -urNp linux-2.6.32.46/drivers/scsi/hosts.c linux-2.6.32.46/drivers/scsi/hosts.c
37280 --- linux-2.6.32.46/drivers/scsi/hosts.c 2011-03-27 14:31:47.000000000 -0400
37281 +++ linux-2.6.32.46/drivers/scsi/hosts.c 2011-05-04 17:56:28.000000000 -0400
37282 @@ -40,7 +40,7 @@
37283 #include "scsi_logging.h"
37284
37285
37286 -static atomic_t scsi_host_next_hn; /* host_no for next new host */
37287 +static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
37288
37289
37290 static void scsi_host_cls_release(struct device *dev)
37291 @@ -344,7 +344,7 @@ struct Scsi_Host *scsi_host_alloc(struct
37292 * subtract one because we increment first then return, but we need to
37293 * know what the next host number was before increment
37294 */
37295 - shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
37296 + shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
37297 shost->dma_channel = 0xff;
37298
37299 /* These three are default values which can be overridden */
37300 diff -urNp linux-2.6.32.46/drivers/scsi/ipr.c linux-2.6.32.46/drivers/scsi/ipr.c
37301 --- linux-2.6.32.46/drivers/scsi/ipr.c 2011-03-27 14:31:47.000000000 -0400
37302 +++ linux-2.6.32.46/drivers/scsi/ipr.c 2011-04-17 15:56:46.000000000 -0400
37303 @@ -5286,7 +5286,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
37304 return true;
37305 }
37306
37307 -static struct ata_port_operations ipr_sata_ops = {
37308 +static const struct ata_port_operations ipr_sata_ops = {
37309 .phy_reset = ipr_ata_phy_reset,
37310 .hardreset = ipr_sata_reset,
37311 .post_internal_cmd = ipr_ata_post_internal,
37312 diff -urNp linux-2.6.32.46/drivers/scsi/ips.h linux-2.6.32.46/drivers/scsi/ips.h
37313 --- linux-2.6.32.46/drivers/scsi/ips.h 2011-03-27 14:31:47.000000000 -0400
37314 +++ linux-2.6.32.46/drivers/scsi/ips.h 2011-08-05 20:33:55.000000000 -0400
37315 @@ -1027,7 +1027,7 @@ typedef struct {
37316 int (*intr)(struct ips_ha *);
37317 void (*enableint)(struct ips_ha *);
37318 uint32_t (*statupd)(struct ips_ha *);
37319 -} ips_hw_func_t;
37320 +} __no_const ips_hw_func_t;
37321
37322 typedef struct ips_ha {
37323 uint8_t ha_id[IPS_MAX_CHANNELS+1];
37324 diff -urNp linux-2.6.32.46/drivers/scsi/libfc/fc_exch.c linux-2.6.32.46/drivers/scsi/libfc/fc_exch.c
37325 --- linux-2.6.32.46/drivers/scsi/libfc/fc_exch.c 2011-03-27 14:31:47.000000000 -0400
37326 +++ linux-2.6.32.46/drivers/scsi/libfc/fc_exch.c 2011-08-23 21:22:32.000000000 -0400
37327 @@ -86,12 +86,12 @@ struct fc_exch_mgr {
37328 * all together if not used XXX
37329 */
37330 struct {
37331 - atomic_t no_free_exch;
37332 - atomic_t no_free_exch_xid;
37333 - atomic_t xid_not_found;
37334 - atomic_t xid_busy;
37335 - atomic_t seq_not_found;
37336 - atomic_t non_bls_resp;
37337 + atomic_unchecked_t no_free_exch;
37338 + atomic_unchecked_t no_free_exch_xid;
37339 + atomic_unchecked_t xid_not_found;
37340 + atomic_unchecked_t xid_busy;
37341 + atomic_unchecked_t seq_not_found;
37342 + atomic_unchecked_t non_bls_resp;
37343 } stats;
37344 };
37345 #define fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
37346 @@ -510,7 +510,7 @@ static struct fc_exch *fc_exch_em_alloc(
37347 /* allocate memory for exchange */
37348 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
37349 if (!ep) {
37350 - atomic_inc(&mp->stats.no_free_exch);
37351 + atomic_inc_unchecked(&mp->stats.no_free_exch);
37352 goto out;
37353 }
37354 memset(ep, 0, sizeof(*ep));
37355 @@ -557,7 +557,7 @@ out:
37356 return ep;
37357 err:
37358 spin_unlock_bh(&pool->lock);
37359 - atomic_inc(&mp->stats.no_free_exch_xid);
37360 + atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
37361 mempool_free(ep, mp->ep_pool);
37362 return NULL;
37363 }
37364 @@ -690,7 +690,7 @@ static enum fc_pf_rjt_reason fc_seq_look
37365 xid = ntohs(fh->fh_ox_id); /* we originated exch */
37366 ep = fc_exch_find(mp, xid);
37367 if (!ep) {
37368 - atomic_inc(&mp->stats.xid_not_found);
37369 + atomic_inc_unchecked(&mp->stats.xid_not_found);
37370 reject = FC_RJT_OX_ID;
37371 goto out;
37372 }
37373 @@ -720,7 +720,7 @@ static enum fc_pf_rjt_reason fc_seq_look
37374 ep = fc_exch_find(mp, xid);
37375 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
37376 if (ep) {
37377 - atomic_inc(&mp->stats.xid_busy);
37378 + atomic_inc_unchecked(&mp->stats.xid_busy);
37379 reject = FC_RJT_RX_ID;
37380 goto rel;
37381 }
37382 @@ -731,7 +731,7 @@ static enum fc_pf_rjt_reason fc_seq_look
37383 }
37384 xid = ep->xid; /* get our XID */
37385 } else if (!ep) {
37386 - atomic_inc(&mp->stats.xid_not_found);
37387 + atomic_inc_unchecked(&mp->stats.xid_not_found);
37388 reject = FC_RJT_RX_ID; /* XID not found */
37389 goto out;
37390 }
37391 @@ -752,7 +752,7 @@ static enum fc_pf_rjt_reason fc_seq_look
37392 } else {
37393 sp = &ep->seq;
37394 if (sp->id != fh->fh_seq_id) {
37395 - atomic_inc(&mp->stats.seq_not_found);
37396 + atomic_inc_unchecked(&mp->stats.seq_not_found);
37397 reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
37398 goto rel;
37399 }
37400 @@ -1163,22 +1163,22 @@ static void fc_exch_recv_seq_resp(struct
37401
37402 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
37403 if (!ep) {
37404 - atomic_inc(&mp->stats.xid_not_found);
37405 + atomic_inc_unchecked(&mp->stats.xid_not_found);
37406 goto out;
37407 }
37408 if (ep->esb_stat & ESB_ST_COMPLETE) {
37409 - atomic_inc(&mp->stats.xid_not_found);
37410 + atomic_inc_unchecked(&mp->stats.xid_not_found);
37411 goto out;
37412 }
37413 if (ep->rxid == FC_XID_UNKNOWN)
37414 ep->rxid = ntohs(fh->fh_rx_id);
37415 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
37416 - atomic_inc(&mp->stats.xid_not_found);
37417 + atomic_inc_unchecked(&mp->stats.xid_not_found);
37418 goto rel;
37419 }
37420 if (ep->did != ntoh24(fh->fh_s_id) &&
37421 ep->did != FC_FID_FLOGI) {
37422 - atomic_inc(&mp->stats.xid_not_found);
37423 + atomic_inc_unchecked(&mp->stats.xid_not_found);
37424 goto rel;
37425 }
37426 sof = fr_sof(fp);
37427 @@ -1189,7 +1189,7 @@ static void fc_exch_recv_seq_resp(struct
37428 } else {
37429 sp = &ep->seq;
37430 if (sp->id != fh->fh_seq_id) {
37431 - atomic_inc(&mp->stats.seq_not_found);
37432 + atomic_inc_unchecked(&mp->stats.seq_not_found);
37433 goto rel;
37434 }
37435 }
37436 @@ -1249,9 +1249,9 @@ static void fc_exch_recv_resp(struct fc_
37437 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
37438
37439 if (!sp)
37440 - atomic_inc(&mp->stats.xid_not_found);
37441 + atomic_inc_unchecked(&mp->stats.xid_not_found);
37442 else
37443 - atomic_inc(&mp->stats.non_bls_resp);
37444 + atomic_inc_unchecked(&mp->stats.non_bls_resp);
37445
37446 fc_frame_free(fp);
37447 }
37448 diff -urNp linux-2.6.32.46/drivers/scsi/libsas/sas_ata.c linux-2.6.32.46/drivers/scsi/libsas/sas_ata.c
37449 --- linux-2.6.32.46/drivers/scsi/libsas/sas_ata.c 2011-03-27 14:31:47.000000000 -0400
37450 +++ linux-2.6.32.46/drivers/scsi/libsas/sas_ata.c 2011-04-23 12:56:11.000000000 -0400
37451 @@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_l
37452 }
37453 }
37454
37455 -static struct ata_port_operations sas_sata_ops = {
37456 +static const struct ata_port_operations sas_sata_ops = {
37457 .phy_reset = sas_ata_phy_reset,
37458 .post_internal_cmd = sas_ata_post_internal,
37459 .qc_defer = ata_std_qc_defer,
37460 diff -urNp linux-2.6.32.46/drivers/scsi/lpfc/lpfc_debugfs.c linux-2.6.32.46/drivers/scsi/lpfc/lpfc_debugfs.c
37461 --- linux-2.6.32.46/drivers/scsi/lpfc/lpfc_debugfs.c 2011-03-27 14:31:47.000000000 -0400
37462 +++ linux-2.6.32.46/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-16 21:46:57.000000000 -0400
37463 @@ -124,7 +124,7 @@ struct lpfc_debug {
37464 int len;
37465 };
37466
37467 -static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
37468 +static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
37469 static unsigned long lpfc_debugfs_start_time = 0L;
37470
37471 /**
37472 @@ -158,7 +158,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_v
37473 lpfc_debugfs_enable = 0;
37474
37475 len = 0;
37476 - index = (atomic_read(&vport->disc_trc_cnt) + 1) &
37477 + index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
37478 (lpfc_debugfs_max_disc_trc - 1);
37479 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
37480 dtp = vport->disc_trc + i;
37481 @@ -219,7 +219,7 @@ lpfc_debugfs_slow_ring_trc_data(struct l
37482 lpfc_debugfs_enable = 0;
37483
37484 len = 0;
37485 - index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
37486 + index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
37487 (lpfc_debugfs_max_slow_ring_trc - 1);
37488 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
37489 dtp = phba->slow_ring_trc + i;
37490 @@ -397,6 +397,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpf
37491 uint32_t *ptr;
37492 char buffer[1024];
37493
37494 + pax_track_stack();
37495 +
37496 off = 0;
37497 spin_lock_irq(&phba->hbalock);
37498
37499 @@ -634,14 +636,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport
37500 !vport || !vport->disc_trc)
37501 return;
37502
37503 - index = atomic_inc_return(&vport->disc_trc_cnt) &
37504 + index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
37505 (lpfc_debugfs_max_disc_trc - 1);
37506 dtp = vport->disc_trc + index;
37507 dtp->fmt = fmt;
37508 dtp->data1 = data1;
37509 dtp->data2 = data2;
37510 dtp->data3 = data3;
37511 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
37512 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
37513 dtp->jif = jiffies;
37514 #endif
37515 return;
37516 @@ -672,14 +674,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_h
37517 !phba || !phba->slow_ring_trc)
37518 return;
37519
37520 - index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
37521 + index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
37522 (lpfc_debugfs_max_slow_ring_trc - 1);
37523 dtp = phba->slow_ring_trc + index;
37524 dtp->fmt = fmt;
37525 dtp->data1 = data1;
37526 dtp->data2 = data2;
37527 dtp->data3 = data3;
37528 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
37529 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
37530 dtp->jif = jiffies;
37531 #endif
37532 return;
37533 @@ -1364,7 +1366,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
37534 "slow_ring buffer\n");
37535 goto debug_failed;
37536 }
37537 - atomic_set(&phba->slow_ring_trc_cnt, 0);
37538 + atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
37539 memset(phba->slow_ring_trc, 0,
37540 (sizeof(struct lpfc_debugfs_trc) *
37541 lpfc_debugfs_max_slow_ring_trc));
37542 @@ -1410,7 +1412,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
37543 "buffer\n");
37544 goto debug_failed;
37545 }
37546 - atomic_set(&vport->disc_trc_cnt, 0);
37547 + atomic_set_unchecked(&vport->disc_trc_cnt, 0);
37548
37549 snprintf(name, sizeof(name), "discovery_trace");
37550 vport->debug_disc_trc =
37551 diff -urNp linux-2.6.32.46/drivers/scsi/lpfc/lpfc.h linux-2.6.32.46/drivers/scsi/lpfc/lpfc.h
37552 --- linux-2.6.32.46/drivers/scsi/lpfc/lpfc.h 2011-03-27 14:31:47.000000000 -0400
37553 +++ linux-2.6.32.46/drivers/scsi/lpfc/lpfc.h 2011-05-04 17:56:28.000000000 -0400
37554 @@ -400,7 +400,7 @@ struct lpfc_vport {
37555 struct dentry *debug_nodelist;
37556 struct dentry *vport_debugfs_root;
37557 struct lpfc_debugfs_trc *disc_trc;
37558 - atomic_t disc_trc_cnt;
37559 + atomic_unchecked_t disc_trc_cnt;
37560 #endif
37561 uint8_t stat_data_enabled;
37562 uint8_t stat_data_blocked;
37563 @@ -725,8 +725,8 @@ struct lpfc_hba {
37564 struct timer_list fabric_block_timer;
37565 unsigned long bit_flags;
37566 #define FABRIC_COMANDS_BLOCKED 0
37567 - atomic_t num_rsrc_err;
37568 - atomic_t num_cmd_success;
37569 + atomic_unchecked_t num_rsrc_err;
37570 + atomic_unchecked_t num_cmd_success;
37571 unsigned long last_rsrc_error_time;
37572 unsigned long last_ramp_down_time;
37573 unsigned long last_ramp_up_time;
37574 @@ -740,7 +740,7 @@ struct lpfc_hba {
37575 struct dentry *debug_dumpDif; /* BlockGuard BPL*/
37576 struct dentry *debug_slow_ring_trc;
37577 struct lpfc_debugfs_trc *slow_ring_trc;
37578 - atomic_t slow_ring_trc_cnt;
37579 + atomic_unchecked_t slow_ring_trc_cnt;
37580 #endif
37581
37582 /* Used for deferred freeing of ELS data buffers */
37583 diff -urNp linux-2.6.32.46/drivers/scsi/lpfc/lpfc_init.c linux-2.6.32.46/drivers/scsi/lpfc/lpfc_init.c
37584 --- linux-2.6.32.46/drivers/scsi/lpfc/lpfc_init.c 2011-03-27 14:31:47.000000000 -0400
37585 +++ linux-2.6.32.46/drivers/scsi/lpfc/lpfc_init.c 2011-08-05 20:33:55.000000000 -0400
37586 @@ -8021,8 +8021,10 @@ lpfc_init(void)
37587 printk(LPFC_COPYRIGHT "\n");
37588
37589 if (lpfc_enable_npiv) {
37590 - lpfc_transport_functions.vport_create = lpfc_vport_create;
37591 - lpfc_transport_functions.vport_delete = lpfc_vport_delete;
37592 + pax_open_kernel();
37593 + *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
37594 + *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
37595 + pax_close_kernel();
37596 }
37597 lpfc_transport_template =
37598 fc_attach_transport(&lpfc_transport_functions);
37599 diff -urNp linux-2.6.32.46/drivers/scsi/lpfc/lpfc_scsi.c linux-2.6.32.46/drivers/scsi/lpfc/lpfc_scsi.c
37600 --- linux-2.6.32.46/drivers/scsi/lpfc/lpfc_scsi.c 2011-03-27 14:31:47.000000000 -0400
37601 +++ linux-2.6.32.46/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-04 17:56:28.000000000 -0400
37602 @@ -259,7 +259,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hb
37603 uint32_t evt_posted;
37604
37605 spin_lock_irqsave(&phba->hbalock, flags);
37606 - atomic_inc(&phba->num_rsrc_err);
37607 + atomic_inc_unchecked(&phba->num_rsrc_err);
37608 phba->last_rsrc_error_time = jiffies;
37609
37610 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
37611 @@ -300,7 +300,7 @@ lpfc_rampup_queue_depth(struct lpfc_vpor
37612 unsigned long flags;
37613 struct lpfc_hba *phba = vport->phba;
37614 uint32_t evt_posted;
37615 - atomic_inc(&phba->num_cmd_success);
37616 + atomic_inc_unchecked(&phba->num_cmd_success);
37617
37618 if (vport->cfg_lun_queue_depth <= queue_depth)
37619 return;
37620 @@ -343,8 +343,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
37621 int i;
37622 struct lpfc_rport_data *rdata;
37623
37624 - num_rsrc_err = atomic_read(&phba->num_rsrc_err);
37625 - num_cmd_success = atomic_read(&phba->num_cmd_success);
37626 + num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
37627 + num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
37628
37629 vports = lpfc_create_vport_work_array(phba);
37630 if (vports != NULL)
37631 @@ -378,8 +378,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
37632 }
37633 }
37634 lpfc_destroy_vport_work_array(phba, vports);
37635 - atomic_set(&phba->num_rsrc_err, 0);
37636 - atomic_set(&phba->num_cmd_success, 0);
37637 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
37638 + atomic_set_unchecked(&phba->num_cmd_success, 0);
37639 }
37640
37641 /**
37642 @@ -427,8 +427,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_h
37643 }
37644 }
37645 lpfc_destroy_vport_work_array(phba, vports);
37646 - atomic_set(&phba->num_rsrc_err, 0);
37647 - atomic_set(&phba->num_cmd_success, 0);
37648 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
37649 + atomic_set_unchecked(&phba->num_cmd_success, 0);
37650 }
37651
37652 /**
37653 diff -urNp linux-2.6.32.46/drivers/scsi/megaraid/megaraid_mbox.c linux-2.6.32.46/drivers/scsi/megaraid/megaraid_mbox.c
37654 --- linux-2.6.32.46/drivers/scsi/megaraid/megaraid_mbox.c 2011-03-27 14:31:47.000000000 -0400
37655 +++ linux-2.6.32.46/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-16 21:46:57.000000000 -0400
37656 @@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter
37657 int rval;
37658 int i;
37659
37660 + pax_track_stack();
37661 +
37662 // Allocate memory for the base list of scb for management module.
37663 adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
37664
37665 diff -urNp linux-2.6.32.46/drivers/scsi/osd/osd_initiator.c linux-2.6.32.46/drivers/scsi/osd/osd_initiator.c
37666 --- linux-2.6.32.46/drivers/scsi/osd/osd_initiator.c 2011-03-27 14:31:47.000000000 -0400
37667 +++ linux-2.6.32.46/drivers/scsi/osd/osd_initiator.c 2011-05-16 21:46:57.000000000 -0400
37668 @@ -94,6 +94,8 @@ static int _osd_print_system_info(struct
37669 int nelem = ARRAY_SIZE(get_attrs), a = 0;
37670 int ret;
37671
37672 + pax_track_stack();
37673 +
37674 or = osd_start_request(od, GFP_KERNEL);
37675 if (!or)
37676 return -ENOMEM;
37677 diff -urNp linux-2.6.32.46/drivers/scsi/pmcraid.c linux-2.6.32.46/drivers/scsi/pmcraid.c
37678 --- linux-2.6.32.46/drivers/scsi/pmcraid.c 2011-08-09 18:35:29.000000000 -0400
37679 +++ linux-2.6.32.46/drivers/scsi/pmcraid.c 2011-08-09 18:33:59.000000000 -0400
37680 @@ -189,8 +189,8 @@ static int pmcraid_slave_alloc(struct sc
37681 res->scsi_dev = scsi_dev;
37682 scsi_dev->hostdata = res;
37683 res->change_detected = 0;
37684 - atomic_set(&res->read_failures, 0);
37685 - atomic_set(&res->write_failures, 0);
37686 + atomic_set_unchecked(&res->read_failures, 0);
37687 + atomic_set_unchecked(&res->write_failures, 0);
37688 rc = 0;
37689 }
37690 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
37691 @@ -2396,9 +2396,9 @@ static int pmcraid_error_handler(struct
37692
37693 /* If this was a SCSI read/write command keep count of errors */
37694 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
37695 - atomic_inc(&res->read_failures);
37696 + atomic_inc_unchecked(&res->read_failures);
37697 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
37698 - atomic_inc(&res->write_failures);
37699 + atomic_inc_unchecked(&res->write_failures);
37700
37701 if (!RES_IS_GSCSI(res->cfg_entry) &&
37702 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
37703 @@ -4116,7 +4116,7 @@ static void pmcraid_worker_function(stru
37704
37705 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
37706 /* add resources only after host is added into system */
37707 - if (!atomic_read(&pinstance->expose_resources))
37708 + if (!atomic_read_unchecked(&pinstance->expose_resources))
37709 return;
37710
37711 spin_lock_irqsave(&pinstance->resource_lock, lock_flags);
37712 @@ -4850,7 +4850,7 @@ static int __devinit pmcraid_init_instan
37713 init_waitqueue_head(&pinstance->reset_wait_q);
37714
37715 atomic_set(&pinstance->outstanding_cmds, 0);
37716 - atomic_set(&pinstance->expose_resources, 0);
37717 + atomic_set_unchecked(&pinstance->expose_resources, 0);
37718
37719 INIT_LIST_HEAD(&pinstance->free_res_q);
37720 INIT_LIST_HEAD(&pinstance->used_res_q);
37721 @@ -5502,7 +5502,7 @@ static int __devinit pmcraid_probe(
37722 /* Schedule worker thread to handle CCN and take care of adding and
37723 * removing devices to OS
37724 */
37725 - atomic_set(&pinstance->expose_resources, 1);
37726 + atomic_set_unchecked(&pinstance->expose_resources, 1);
37727 schedule_work(&pinstance->worker_q);
37728 return rc;
37729
37730 diff -urNp linux-2.6.32.46/drivers/scsi/pmcraid.h linux-2.6.32.46/drivers/scsi/pmcraid.h
37731 --- linux-2.6.32.46/drivers/scsi/pmcraid.h 2011-03-27 14:31:47.000000000 -0400
37732 +++ linux-2.6.32.46/drivers/scsi/pmcraid.h 2011-05-04 17:56:28.000000000 -0400
37733 @@ -690,7 +690,7 @@ struct pmcraid_instance {
37734 atomic_t outstanding_cmds;
37735
37736 /* should add/delete resources to mid-layer now ?*/
37737 - atomic_t expose_resources;
37738 + atomic_unchecked_t expose_resources;
37739
37740 /* Tasklet to handle deferred processing */
37741 struct tasklet_struct isr_tasklet[PMCRAID_NUM_MSIX_VECTORS];
37742 @@ -727,8 +727,8 @@ struct pmcraid_resource_entry {
37743 struct list_head queue; /* link to "to be exposed" resources */
37744 struct pmcraid_config_table_entry cfg_entry;
37745 struct scsi_device *scsi_dev; /* Link scsi_device structure */
37746 - atomic_t read_failures; /* count of failed READ commands */
37747 - atomic_t write_failures; /* count of failed WRITE commands */
37748 + atomic_unchecked_t read_failures; /* count of failed READ commands */
37749 + atomic_unchecked_t write_failures; /* count of failed WRITE commands */
37750
37751 /* To indicate add/delete/modify during CCN */
37752 u8 change_detected;
37753 diff -urNp linux-2.6.32.46/drivers/scsi/qla2xxx/qla_def.h linux-2.6.32.46/drivers/scsi/qla2xxx/qla_def.h
37754 --- linux-2.6.32.46/drivers/scsi/qla2xxx/qla_def.h 2011-03-27 14:31:47.000000000 -0400
37755 +++ linux-2.6.32.46/drivers/scsi/qla2xxx/qla_def.h 2011-08-05 20:33:55.000000000 -0400
37756 @@ -2089,7 +2089,7 @@ struct isp_operations {
37757
37758 int (*get_flash_version) (struct scsi_qla_host *, void *);
37759 int (*start_scsi) (srb_t *);
37760 -};
37761 +} __no_const;
37762
37763 /* MSI-X Support *************************************************************/
37764
37765 diff -urNp linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_def.h linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_def.h
37766 --- linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_def.h 2011-03-27 14:31:47.000000000 -0400
37767 +++ linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_def.h 2011-05-04 17:56:28.000000000 -0400
37768 @@ -240,7 +240,7 @@ struct ddb_entry {
37769 atomic_t retry_relogin_timer; /* Min Time between relogins
37770 * (4000 only) */
37771 atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
37772 - atomic_t relogin_retry_count; /* Num of times relogin has been
37773 + atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
37774 * retried */
37775
37776 uint16_t port;
37777 diff -urNp linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_init.c linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_init.c
37778 --- linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_init.c 2011-03-27 14:31:47.000000000 -0400
37779 +++ linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_init.c 2011-05-04 17:56:28.000000000 -0400
37780 @@ -482,7 +482,7 @@ static struct ddb_entry * qla4xxx_alloc_
37781 atomic_set(&ddb_entry->port_down_timer, ha->port_down_retry_count);
37782 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
37783 atomic_set(&ddb_entry->relogin_timer, 0);
37784 - atomic_set(&ddb_entry->relogin_retry_count, 0);
37785 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
37786 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
37787 list_add_tail(&ddb_entry->list, &ha->ddb_list);
37788 ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
37789 @@ -1308,7 +1308,7 @@ int qla4xxx_process_ddb_changed(struct s
37790 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
37791 atomic_set(&ddb_entry->port_down_timer,
37792 ha->port_down_retry_count);
37793 - atomic_set(&ddb_entry->relogin_retry_count, 0);
37794 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
37795 atomic_set(&ddb_entry->relogin_timer, 0);
37796 clear_bit(DF_RELOGIN, &ddb_entry->flags);
37797 clear_bit(DF_NO_RELOGIN, &ddb_entry->flags);
37798 diff -urNp linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_os.c linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_os.c
37799 --- linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_os.c 2011-03-27 14:31:47.000000000 -0400
37800 +++ linux-2.6.32.46/drivers/scsi/qla4xxx/ql4_os.c 2011-05-04 17:56:28.000000000 -0400
37801 @@ -641,13 +641,13 @@ static void qla4xxx_timer(struct scsi_ql
37802 ddb_entry->fw_ddb_device_state ==
37803 DDB_DS_SESSION_FAILED) {
37804 /* Reset retry relogin timer */
37805 - atomic_inc(&ddb_entry->relogin_retry_count);
37806 + atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
37807 DEBUG2(printk("scsi%ld: index[%d] relogin"
37808 " timed out-retrying"
37809 " relogin (%d)\n",
37810 ha->host_no,
37811 ddb_entry->fw_ddb_index,
37812 - atomic_read(&ddb_entry->
37813 + atomic_read_unchecked(&ddb_entry->
37814 relogin_retry_count))
37815 );
37816 start_dpc++;
37817 diff -urNp linux-2.6.32.46/drivers/scsi/scsi.c linux-2.6.32.46/drivers/scsi/scsi.c
37818 --- linux-2.6.32.46/drivers/scsi/scsi.c 2011-03-27 14:31:47.000000000 -0400
37819 +++ linux-2.6.32.46/drivers/scsi/scsi.c 2011-05-04 17:56:28.000000000 -0400
37820 @@ -652,7 +652,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *
37821 unsigned long timeout;
37822 int rtn = 0;
37823
37824 - atomic_inc(&cmd->device->iorequest_cnt);
37825 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
37826
37827 /* check if the device is still usable */
37828 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
37829 diff -urNp linux-2.6.32.46/drivers/scsi/scsi_debug.c linux-2.6.32.46/drivers/scsi/scsi_debug.c
37830 --- linux-2.6.32.46/drivers/scsi/scsi_debug.c 2011-03-27 14:31:47.000000000 -0400
37831 +++ linux-2.6.32.46/drivers/scsi/scsi_debug.c 2011-05-16 21:46:57.000000000 -0400
37832 @@ -1395,6 +1395,8 @@ static int resp_mode_select(struct scsi_
37833 unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
37834 unsigned char *cmd = (unsigned char *)scp->cmnd;
37835
37836 + pax_track_stack();
37837 +
37838 if ((errsts = check_readiness(scp, 1, devip)))
37839 return errsts;
37840 memset(arr, 0, sizeof(arr));
37841 @@ -1492,6 +1494,8 @@ static int resp_log_sense(struct scsi_cm
37842 unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
37843 unsigned char *cmd = (unsigned char *)scp->cmnd;
37844
37845 + pax_track_stack();
37846 +
37847 if ((errsts = check_readiness(scp, 1, devip)))
37848 return errsts;
37849 memset(arr, 0, sizeof(arr));
37850 diff -urNp linux-2.6.32.46/drivers/scsi/scsi_lib.c linux-2.6.32.46/drivers/scsi/scsi_lib.c
37851 --- linux-2.6.32.46/drivers/scsi/scsi_lib.c 2011-05-10 22:12:01.000000000 -0400
37852 +++ linux-2.6.32.46/drivers/scsi/scsi_lib.c 2011-05-10 22:12:33.000000000 -0400
37853 @@ -1384,7 +1384,7 @@ static void scsi_kill_request(struct req
37854
37855 scsi_init_cmd_errh(cmd);
37856 cmd->result = DID_NO_CONNECT << 16;
37857 - atomic_inc(&cmd->device->iorequest_cnt);
37858 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
37859
37860 /*
37861 * SCSI request completion path will do scsi_device_unbusy(),
37862 @@ -1415,9 +1415,9 @@ static void scsi_softirq_done(struct req
37863 */
37864 cmd->serial_number = 0;
37865
37866 - atomic_inc(&cmd->device->iodone_cnt);
37867 + atomic_inc_unchecked(&cmd->device->iodone_cnt);
37868 if (cmd->result)
37869 - atomic_inc(&cmd->device->ioerr_cnt);
37870 + atomic_inc_unchecked(&cmd->device->ioerr_cnt);
37871
37872 disposition = scsi_decide_disposition(cmd);
37873 if (disposition != SUCCESS &&
37874 diff -urNp linux-2.6.32.46/drivers/scsi/scsi_sysfs.c linux-2.6.32.46/drivers/scsi/scsi_sysfs.c
37875 --- linux-2.6.32.46/drivers/scsi/scsi_sysfs.c 2011-06-25 12:55:34.000000000 -0400
37876 +++ linux-2.6.32.46/drivers/scsi/scsi_sysfs.c 2011-06-25 12:56:37.000000000 -0400
37877 @@ -662,7 +662,7 @@ show_iostat_##field(struct device *dev,
37878 char *buf) \
37879 { \
37880 struct scsi_device *sdev = to_scsi_device(dev); \
37881 - unsigned long long count = atomic_read(&sdev->field); \
37882 + unsigned long long count = atomic_read_unchecked(&sdev->field); \
37883 return snprintf(buf, 20, "0x%llx\n", count); \
37884 } \
37885 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
37886 diff -urNp linux-2.6.32.46/drivers/scsi/scsi_tgt_lib.c linux-2.6.32.46/drivers/scsi/scsi_tgt_lib.c
37887 --- linux-2.6.32.46/drivers/scsi/scsi_tgt_lib.c 2011-03-27 14:31:47.000000000 -0400
37888 +++ linux-2.6.32.46/drivers/scsi/scsi_tgt_lib.c 2011-10-06 09:37:14.000000000 -0400
37889 @@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct sc
37890 int err;
37891
37892 dprintk("%lx %u\n", uaddr, len);
37893 - err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
37894 + err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL);
37895 if (err) {
37896 /*
37897 * TODO: need to fixup sg_tablesize, max_segment_size,
37898 diff -urNp linux-2.6.32.46/drivers/scsi/scsi_transport_fc.c linux-2.6.32.46/drivers/scsi/scsi_transport_fc.c
37899 --- linux-2.6.32.46/drivers/scsi/scsi_transport_fc.c 2011-03-27 14:31:47.000000000 -0400
37900 +++ linux-2.6.32.46/drivers/scsi/scsi_transport_fc.c 2011-05-04 17:56:28.000000000 -0400
37901 @@ -480,7 +480,7 @@ MODULE_PARM_DESC(dev_loss_tmo,
37902 * Netlink Infrastructure
37903 */
37904
37905 -static atomic_t fc_event_seq;
37906 +static atomic_unchecked_t fc_event_seq;
37907
37908 /**
37909 * fc_get_event_number - Obtain the next sequential FC event number
37910 @@ -493,7 +493,7 @@ static atomic_t fc_event_seq;
37911 u32
37912 fc_get_event_number(void)
37913 {
37914 - return atomic_add_return(1, &fc_event_seq);
37915 + return atomic_add_return_unchecked(1, &fc_event_seq);
37916 }
37917 EXPORT_SYMBOL(fc_get_event_number);
37918
37919 @@ -641,7 +641,7 @@ static __init int fc_transport_init(void
37920 {
37921 int error;
37922
37923 - atomic_set(&fc_event_seq, 0);
37924 + atomic_set_unchecked(&fc_event_seq, 0);
37925
37926 error = transport_class_register(&fc_host_class);
37927 if (error)
37928 diff -urNp linux-2.6.32.46/drivers/scsi/scsi_transport_iscsi.c linux-2.6.32.46/drivers/scsi/scsi_transport_iscsi.c
37929 --- linux-2.6.32.46/drivers/scsi/scsi_transport_iscsi.c 2011-03-27 14:31:47.000000000 -0400
37930 +++ linux-2.6.32.46/drivers/scsi/scsi_transport_iscsi.c 2011-05-04 17:56:28.000000000 -0400
37931 @@ -81,7 +81,7 @@ struct iscsi_internal {
37932 struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
37933 };
37934
37935 -static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
37936 +static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
37937 static struct workqueue_struct *iscsi_eh_timer_workq;
37938
37939 /*
37940 @@ -728,7 +728,7 @@ int iscsi_add_session(struct iscsi_cls_s
37941 int err;
37942
37943 ihost = shost->shost_data;
37944 - session->sid = atomic_add_return(1, &iscsi_session_nr);
37945 + session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
37946
37947 if (id == ISCSI_MAX_TARGET) {
37948 for (id = 0; id < ISCSI_MAX_TARGET; id++) {
37949 @@ -2060,7 +2060,7 @@ static __init int iscsi_transport_init(v
37950 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
37951 ISCSI_TRANSPORT_VERSION);
37952
37953 - atomic_set(&iscsi_session_nr, 0);
37954 + atomic_set_unchecked(&iscsi_session_nr, 0);
37955
37956 err = class_register(&iscsi_transport_class);
37957 if (err)
37958 diff -urNp linux-2.6.32.46/drivers/scsi/scsi_transport_srp.c linux-2.6.32.46/drivers/scsi/scsi_transport_srp.c
37959 --- linux-2.6.32.46/drivers/scsi/scsi_transport_srp.c 2011-03-27 14:31:47.000000000 -0400
37960 +++ linux-2.6.32.46/drivers/scsi/scsi_transport_srp.c 2011-05-04 17:56:28.000000000 -0400
37961 @@ -33,7 +33,7 @@
37962 #include "scsi_transport_srp_internal.h"
37963
37964 struct srp_host_attrs {
37965 - atomic_t next_port_id;
37966 + atomic_unchecked_t next_port_id;
37967 };
37968 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
37969
37970 @@ -62,7 +62,7 @@ static int srp_host_setup(struct transpo
37971 struct Scsi_Host *shost = dev_to_shost(dev);
37972 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
37973
37974 - atomic_set(&srp_host->next_port_id, 0);
37975 + atomic_set_unchecked(&srp_host->next_port_id, 0);
37976 return 0;
37977 }
37978
37979 @@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct S
37980 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
37981 rport->roles = ids->roles;
37982
37983 - id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
37984 + id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
37985 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
37986
37987 transport_setup_device(&rport->dev);
37988 diff -urNp linux-2.6.32.46/drivers/scsi/sg.c linux-2.6.32.46/drivers/scsi/sg.c
37989 --- linux-2.6.32.46/drivers/scsi/sg.c 2011-03-27 14:31:47.000000000 -0400
37990 +++ linux-2.6.32.46/drivers/scsi/sg.c 2011-10-06 09:37:08.000000000 -0400
37991 @@ -1064,7 +1064,7 @@ sg_ioctl(struct inode *inode, struct fil
37992 sdp->disk->disk_name,
37993 MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
37994 NULL,
37995 - (char *)arg);
37996 + (char __user *)arg);
37997 case BLKTRACESTART:
37998 return blk_trace_startstop(sdp->device->request_queue, 1);
37999 case BLKTRACESTOP:
38000 @@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
38001 const struct file_operations * fops;
38002 };
38003
38004 -static struct sg_proc_leaf sg_proc_leaf_arr[] = {
38005 +static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
38006 {"allow_dio", &adio_fops},
38007 {"debug", &debug_fops},
38008 {"def_reserved_size", &dressz_fops},
38009 @@ -2307,7 +2307,7 @@ sg_proc_init(void)
38010 {
38011 int k, mask;
38012 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
38013 - struct sg_proc_leaf * leaf;
38014 + const struct sg_proc_leaf * leaf;
38015
38016 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
38017 if (!sg_proc_sgp)
38018 diff -urNp linux-2.6.32.46/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.32.46/drivers/scsi/sym53c8xx_2/sym_glue.c
38019 --- linux-2.6.32.46/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-03-27 14:31:47.000000000 -0400
38020 +++ linux-2.6.32.46/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-16 21:46:57.000000000 -0400
38021 @@ -1754,6 +1754,8 @@ static int __devinit sym2_probe(struct p
38022 int do_iounmap = 0;
38023 int do_disable_device = 1;
38024
38025 + pax_track_stack();
38026 +
38027 memset(&sym_dev, 0, sizeof(sym_dev));
38028 memset(&nvram, 0, sizeof(nvram));
38029 sym_dev.pdev = pdev;
38030 diff -urNp linux-2.6.32.46/drivers/serial/kgdboc.c linux-2.6.32.46/drivers/serial/kgdboc.c
38031 --- linux-2.6.32.46/drivers/serial/kgdboc.c 2011-03-27 14:31:47.000000000 -0400
38032 +++ linux-2.6.32.46/drivers/serial/kgdboc.c 2011-04-17 15:56:46.000000000 -0400
38033 @@ -18,7 +18,7 @@
38034
38035 #define MAX_CONFIG_LEN 40
38036
38037 -static struct kgdb_io kgdboc_io_ops;
38038 +static const struct kgdb_io kgdboc_io_ops;
38039
38040 /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
38041 static int configured = -1;
38042 @@ -154,7 +154,7 @@ static void kgdboc_post_exp_handler(void
38043 module_put(THIS_MODULE);
38044 }
38045
38046 -static struct kgdb_io kgdboc_io_ops = {
38047 +static const struct kgdb_io kgdboc_io_ops = {
38048 .name = "kgdboc",
38049 .read_char = kgdboc_get_char,
38050 .write_char = kgdboc_put_char,
38051 diff -urNp linux-2.6.32.46/drivers/spi/spi.c linux-2.6.32.46/drivers/spi/spi.c
38052 --- linux-2.6.32.46/drivers/spi/spi.c 2011-03-27 14:31:47.000000000 -0400
38053 +++ linux-2.6.32.46/drivers/spi/spi.c 2011-05-04 17:56:28.000000000 -0400
38054 @@ -774,7 +774,7 @@ int spi_sync(struct spi_device *spi, str
38055 EXPORT_SYMBOL_GPL(spi_sync);
38056
38057 /* portable code must never pass more than 32 bytes */
38058 -#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
38059 +#define SPI_BUFSIZ max(32U,SMP_CACHE_BYTES)
38060
38061 static u8 *buf;
38062
38063 diff -urNp linux-2.6.32.46/drivers/staging/android/binder.c linux-2.6.32.46/drivers/staging/android/binder.c
38064 --- linux-2.6.32.46/drivers/staging/android/binder.c 2011-03-27 14:31:47.000000000 -0400
38065 +++ linux-2.6.32.46/drivers/staging/android/binder.c 2011-04-17 15:56:46.000000000 -0400
38066 @@ -2756,7 +2756,7 @@ static void binder_vma_close(struct vm_a
38067 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
38068 }
38069
38070 -static struct vm_operations_struct binder_vm_ops = {
38071 +static const struct vm_operations_struct binder_vm_ops = {
38072 .open = binder_vma_open,
38073 .close = binder_vma_close,
38074 };
38075 diff -urNp linux-2.6.32.46/drivers/staging/b3dfg/b3dfg.c linux-2.6.32.46/drivers/staging/b3dfg/b3dfg.c
38076 --- linux-2.6.32.46/drivers/staging/b3dfg/b3dfg.c 2011-03-27 14:31:47.000000000 -0400
38077 +++ linux-2.6.32.46/drivers/staging/b3dfg/b3dfg.c 2011-04-17 15:56:46.000000000 -0400
38078 @@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_are
38079 return VM_FAULT_NOPAGE;
38080 }
38081
38082 -static struct vm_operations_struct b3dfg_vm_ops = {
38083 +static const struct vm_operations_struct b3dfg_vm_ops = {
38084 .fault = b3dfg_vma_fault,
38085 };
38086
38087 @@ -848,7 +848,7 @@ static int b3dfg_mmap(struct file *filp,
38088 return r;
38089 }
38090
38091 -static struct file_operations b3dfg_fops = {
38092 +static const struct file_operations b3dfg_fops = {
38093 .owner = THIS_MODULE,
38094 .open = b3dfg_open,
38095 .release = b3dfg_release,
38096 diff -urNp linux-2.6.32.46/drivers/staging/comedi/comedi_fops.c linux-2.6.32.46/drivers/staging/comedi/comedi_fops.c
38097 --- linux-2.6.32.46/drivers/staging/comedi/comedi_fops.c 2011-08-09 18:35:29.000000000 -0400
38098 +++ linux-2.6.32.46/drivers/staging/comedi/comedi_fops.c 2011-08-09 18:34:00.000000000 -0400
38099 @@ -1389,7 +1389,7 @@ void comedi_unmap(struct vm_area_struct
38100 mutex_unlock(&dev->mutex);
38101 }
38102
38103 -static struct vm_operations_struct comedi_vm_ops = {
38104 +static const struct vm_operations_struct comedi_vm_ops = {
38105 .close = comedi_unmap,
38106 };
38107
38108 diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.32.46/drivers/staging/dream/qdsp5/adsp_driver.c
38109 --- linux-2.6.32.46/drivers/staging/dream/qdsp5/adsp_driver.c 2011-03-27 14:31:47.000000000 -0400
38110 +++ linux-2.6.32.46/drivers/staging/dream/qdsp5/adsp_driver.c 2011-04-17 15:56:46.000000000 -0400
38111 @@ -576,7 +576,7 @@ static struct adsp_device *inode_to_devi
38112 static dev_t adsp_devno;
38113 static struct class *adsp_class;
38114
38115 -static struct file_operations adsp_fops = {
38116 +static const struct file_operations adsp_fops = {
38117 .owner = THIS_MODULE,
38118 .open = adsp_open,
38119 .unlocked_ioctl = adsp_ioctl,
38120 diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_aac.c
38121 --- linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_aac.c 2011-03-27 14:31:47.000000000 -0400
38122 +++ linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_aac.c 2011-04-17 15:56:46.000000000 -0400
38123 @@ -1022,7 +1022,7 @@ done:
38124 return rc;
38125 }
38126
38127 -static struct file_operations audio_aac_fops = {
38128 +static const struct file_operations audio_aac_fops = {
38129 .owner = THIS_MODULE,
38130 .open = audio_open,
38131 .release = audio_release,
38132 diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_amrnb.c
38133 --- linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_amrnb.c 2011-03-27 14:31:47.000000000 -0400
38134 +++ linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_amrnb.c 2011-04-17 15:56:46.000000000 -0400
38135 @@ -833,7 +833,7 @@ done:
38136 return rc;
38137 }
38138
38139 -static struct file_operations audio_amrnb_fops = {
38140 +static const struct file_operations audio_amrnb_fops = {
38141 .owner = THIS_MODULE,
38142 .open = audamrnb_open,
38143 .release = audamrnb_release,
38144 diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_evrc.c
38145 --- linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_evrc.c 2011-03-27 14:31:47.000000000 -0400
38146 +++ linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_evrc.c 2011-04-17 15:56:46.000000000 -0400
38147 @@ -805,7 +805,7 @@ dma_fail:
38148 return rc;
38149 }
38150
38151 -static struct file_operations audio_evrc_fops = {
38152 +static const struct file_operations audio_evrc_fops = {
38153 .owner = THIS_MODULE,
38154 .open = audevrc_open,
38155 .release = audevrc_release,
38156 diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_in.c
38157 --- linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_in.c 2011-03-27 14:31:47.000000000 -0400
38158 +++ linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_in.c 2011-04-17 15:56:46.000000000 -0400
38159 @@ -913,7 +913,7 @@ static int audpre_open(struct inode *ino
38160 return 0;
38161 }
38162
38163 -static struct file_operations audio_fops = {
38164 +static const struct file_operations audio_fops = {
38165 .owner = THIS_MODULE,
38166 .open = audio_in_open,
38167 .release = audio_in_release,
38168 @@ -922,7 +922,7 @@ static struct file_operations audio_fops
38169 .unlocked_ioctl = audio_in_ioctl,
38170 };
38171
38172 -static struct file_operations audpre_fops = {
38173 +static const struct file_operations audpre_fops = {
38174 .owner = THIS_MODULE,
38175 .open = audpre_open,
38176 .unlocked_ioctl = audpre_ioctl,
38177 diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_mp3.c
38178 --- linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_mp3.c 2011-03-27 14:31:47.000000000 -0400
38179 +++ linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_mp3.c 2011-04-17 15:56:46.000000000 -0400
38180 @@ -941,7 +941,7 @@ done:
38181 return rc;
38182 }
38183
38184 -static struct file_operations audio_mp3_fops = {
38185 +static const struct file_operations audio_mp3_fops = {
38186 .owner = THIS_MODULE,
38187 .open = audio_open,
38188 .release = audio_release,
38189 diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_out.c
38190 --- linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_out.c 2011-03-27 14:31:47.000000000 -0400
38191 +++ linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_out.c 2011-04-17 15:56:46.000000000 -0400
38192 @@ -810,7 +810,7 @@ static int audpp_open(struct inode *inod
38193 return 0;
38194 }
38195
38196 -static struct file_operations audio_fops = {
38197 +static const struct file_operations audio_fops = {
38198 .owner = THIS_MODULE,
38199 .open = audio_open,
38200 .release = audio_release,
38201 @@ -819,7 +819,7 @@ static struct file_operations audio_fops
38202 .unlocked_ioctl = audio_ioctl,
38203 };
38204
38205 -static struct file_operations audpp_fops = {
38206 +static const struct file_operations audpp_fops = {
38207 .owner = THIS_MODULE,
38208 .open = audpp_open,
38209 .unlocked_ioctl = audpp_ioctl,
38210 diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_qcelp.c
38211 --- linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_qcelp.c 2011-03-27 14:31:47.000000000 -0400
38212 +++ linux-2.6.32.46/drivers/staging/dream/qdsp5/audio_qcelp.c 2011-04-17 15:56:46.000000000 -0400
38213 @@ -816,7 +816,7 @@ err:
38214 return rc;
38215 }
38216
38217 -static struct file_operations audio_qcelp_fops = {
38218 +static const struct file_operations audio_qcelp_fops = {
38219 .owner = THIS_MODULE,
38220 .open = audqcelp_open,
38221 .release = audqcelp_release,
38222 diff -urNp linux-2.6.32.46/drivers/staging/dream/qdsp5/snd.c linux-2.6.32.46/drivers/staging/dream/qdsp5/snd.c
38223 --- linux-2.6.32.46/drivers/staging/dream/qdsp5/snd.c 2011-03-27 14:31:47.000000000 -0400
38224 +++ linux-2.6.32.46/drivers/staging/dream/qdsp5/snd.c 2011-04-17 15:56:46.000000000 -0400
38225 @@ -242,7 +242,7 @@ err:
38226 return rc;
38227 }
38228
38229 -static struct file_operations snd_fops = {
38230 +static const struct file_operations snd_fops = {
38231 .owner = THIS_MODULE,
38232 .open = snd_open,
38233 .release = snd_release,
38234 diff -urNp linux-2.6.32.46/drivers/staging/dream/smd/smd_qmi.c linux-2.6.32.46/drivers/staging/dream/smd/smd_qmi.c
38235 --- linux-2.6.32.46/drivers/staging/dream/smd/smd_qmi.c 2011-03-27 14:31:47.000000000 -0400
38236 +++ linux-2.6.32.46/drivers/staging/dream/smd/smd_qmi.c 2011-04-17 15:56:46.000000000 -0400
38237 @@ -793,7 +793,7 @@ static int qmi_release(struct inode *ip,
38238 return 0;
38239 }
38240
38241 -static struct file_operations qmi_fops = {
38242 +static const struct file_operations qmi_fops = {
38243 .owner = THIS_MODULE,
38244 .read = qmi_read,
38245 .write = qmi_write,
38246 diff -urNp linux-2.6.32.46/drivers/staging/dream/smd/smd_rpcrouter_device.c linux-2.6.32.46/drivers/staging/dream/smd/smd_rpcrouter_device.c
38247 --- linux-2.6.32.46/drivers/staging/dream/smd/smd_rpcrouter_device.c 2011-03-27 14:31:47.000000000 -0400
38248 +++ linux-2.6.32.46/drivers/staging/dream/smd/smd_rpcrouter_device.c 2011-04-17 15:56:46.000000000 -0400
38249 @@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file
38250 return rc;
38251 }
38252
38253 -static struct file_operations rpcrouter_server_fops = {
38254 +static const struct file_operations rpcrouter_server_fops = {
38255 .owner = THIS_MODULE,
38256 .open = rpcrouter_open,
38257 .release = rpcrouter_release,
38258 @@ -224,7 +224,7 @@ static struct file_operations rpcrouter_
38259 .unlocked_ioctl = rpcrouter_ioctl,
38260 };
38261
38262 -static struct file_operations rpcrouter_router_fops = {
38263 +static const struct file_operations rpcrouter_router_fops = {
38264 .owner = THIS_MODULE,
38265 .open = rpcrouter_open,
38266 .release = rpcrouter_release,
38267 diff -urNp linux-2.6.32.46/drivers/staging/dst/dcore.c linux-2.6.32.46/drivers/staging/dst/dcore.c
38268 --- linux-2.6.32.46/drivers/staging/dst/dcore.c 2011-03-27 14:31:47.000000000 -0400
38269 +++ linux-2.6.32.46/drivers/staging/dst/dcore.c 2011-04-17 15:56:46.000000000 -0400
38270 @@ -149,7 +149,7 @@ static int dst_bdev_release(struct gendi
38271 return 0;
38272 }
38273
38274 -static struct block_device_operations dst_blk_ops = {
38275 +static const struct block_device_operations dst_blk_ops = {
38276 .open = dst_bdev_open,
38277 .release = dst_bdev_release,
38278 .owner = THIS_MODULE,
38279 @@ -588,7 +588,7 @@ static struct dst_node *dst_alloc_node(s
38280 n->size = ctl->size;
38281
38282 atomic_set(&n->refcnt, 1);
38283 - atomic_long_set(&n->gen, 0);
38284 + atomic_long_set_unchecked(&n->gen, 0);
38285 snprintf(n->name, sizeof(n->name), "%s", ctl->name);
38286
38287 err = dst_node_sysfs_init(n);
38288 diff -urNp linux-2.6.32.46/drivers/staging/dst/trans.c linux-2.6.32.46/drivers/staging/dst/trans.c
38289 --- linux-2.6.32.46/drivers/staging/dst/trans.c 2011-03-27 14:31:47.000000000 -0400
38290 +++ linux-2.6.32.46/drivers/staging/dst/trans.c 2011-04-17 15:56:46.000000000 -0400
38291 @@ -169,7 +169,7 @@ int dst_process_bio(struct dst_node *n,
38292 t->error = 0;
38293 t->retries = 0;
38294 atomic_set(&t->refcnt, 1);
38295 - t->gen = atomic_long_inc_return(&n->gen);
38296 + t->gen = atomic_long_inc_return_unchecked(&n->gen);
38297
38298 t->enc = bio_data_dir(bio);
38299 dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
38300 diff -urNp linux-2.6.32.46/drivers/staging/et131x/et1310_tx.c linux-2.6.32.46/drivers/staging/et131x/et1310_tx.c
38301 --- linux-2.6.32.46/drivers/staging/et131x/et1310_tx.c 2011-03-27 14:31:47.000000000 -0400
38302 +++ linux-2.6.32.46/drivers/staging/et131x/et1310_tx.c 2011-05-04 17:56:28.000000000 -0400
38303 @@ -710,11 +710,11 @@ inline void et131x_free_send_packet(stru
38304 struct net_device_stats *stats = &etdev->net_stats;
38305
38306 if (pMpTcb->Flags & fMP_DEST_BROAD)
38307 - atomic_inc(&etdev->Stats.brdcstxmt);
38308 + atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
38309 else if (pMpTcb->Flags & fMP_DEST_MULTI)
38310 - atomic_inc(&etdev->Stats.multixmt);
38311 + atomic_inc_unchecked(&etdev->Stats.multixmt);
38312 else
38313 - atomic_inc(&etdev->Stats.unixmt);
38314 + atomic_inc_unchecked(&etdev->Stats.unixmt);
38315
38316 if (pMpTcb->Packet) {
38317 stats->tx_bytes += pMpTcb->Packet->len;
38318 diff -urNp linux-2.6.32.46/drivers/staging/et131x/et131x_adapter.h linux-2.6.32.46/drivers/staging/et131x/et131x_adapter.h
38319 --- linux-2.6.32.46/drivers/staging/et131x/et131x_adapter.h 2011-03-27 14:31:47.000000000 -0400
38320 +++ linux-2.6.32.46/drivers/staging/et131x/et131x_adapter.h 2011-05-04 17:56:28.000000000 -0400
38321 @@ -145,11 +145,11 @@ typedef struct _ce_stats_t {
38322 * operations
38323 */
38324 u32 unircv; /* # multicast packets received */
38325 - atomic_t unixmt; /* # multicast packets for Tx */
38326 + atomic_unchecked_t unixmt; /* # multicast packets for Tx */
38327 u32 multircv; /* # multicast packets received */
38328 - atomic_t multixmt; /* # multicast packets for Tx */
38329 + atomic_unchecked_t multixmt; /* # multicast packets for Tx */
38330 u32 brdcstrcv; /* # broadcast packets received */
38331 - atomic_t brdcstxmt; /* # broadcast packets for Tx */
38332 + atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
38333 u32 norcvbuf; /* # Rx packets discarded */
38334 u32 noxmtbuf; /* # Tx packets discarded */
38335
38336 diff -urNp linux-2.6.32.46/drivers/staging/go7007/go7007-v4l2.c linux-2.6.32.46/drivers/staging/go7007/go7007-v4l2.c
38337 --- linux-2.6.32.46/drivers/staging/go7007/go7007-v4l2.c 2011-03-27 14:31:47.000000000 -0400
38338 +++ linux-2.6.32.46/drivers/staging/go7007/go7007-v4l2.c 2011-04-17 15:56:46.000000000 -0400
38339 @@ -1700,7 +1700,7 @@ static int go7007_vm_fault(struct vm_are
38340 return 0;
38341 }
38342
38343 -static struct vm_operations_struct go7007_vm_ops = {
38344 +static const struct vm_operations_struct go7007_vm_ops = {
38345 .open = go7007_vm_open,
38346 .close = go7007_vm_close,
38347 .fault = go7007_vm_fault,
38348 diff -urNp linux-2.6.32.46/drivers/staging/hv/blkvsc_drv.c linux-2.6.32.46/drivers/staging/hv/blkvsc_drv.c
38349 --- linux-2.6.32.46/drivers/staging/hv/blkvsc_drv.c 2011-03-27 14:31:47.000000000 -0400
38350 +++ linux-2.6.32.46/drivers/staging/hv/blkvsc_drv.c 2011-04-17 15:56:46.000000000 -0400
38351 @@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKV
38352 /* The one and only one */
38353 static struct blkvsc_driver_context g_blkvsc_drv;
38354
38355 -static struct block_device_operations block_ops = {
38356 +static const struct block_device_operations block_ops = {
38357 .owner = THIS_MODULE,
38358 .open = blkvsc_open,
38359 .release = blkvsc_release,
38360 diff -urNp linux-2.6.32.46/drivers/staging/hv/Channel.c linux-2.6.32.46/drivers/staging/hv/Channel.c
38361 --- linux-2.6.32.46/drivers/staging/hv/Channel.c 2011-04-17 17:00:52.000000000 -0400
38362 +++ linux-2.6.32.46/drivers/staging/hv/Channel.c 2011-05-04 17:56:28.000000000 -0400
38363 @@ -464,8 +464,8 @@ int VmbusChannelEstablishGpadl(struct vm
38364
38365 DPRINT_ENTER(VMBUS);
38366
38367 - nextGpadlHandle = atomic_read(&gVmbusConnection.NextGpadlHandle);
38368 - atomic_inc(&gVmbusConnection.NextGpadlHandle);
38369 + nextGpadlHandle = atomic_read_unchecked(&gVmbusConnection.NextGpadlHandle);
38370 + atomic_inc_unchecked(&gVmbusConnection.NextGpadlHandle);
38371
38372 VmbusChannelCreateGpadlHeader(Kbuffer, Size, &msgInfo, &msgCount);
38373 ASSERT(msgInfo != NULL);
38374 diff -urNp linux-2.6.32.46/drivers/staging/hv/Hv.c linux-2.6.32.46/drivers/staging/hv/Hv.c
38375 --- linux-2.6.32.46/drivers/staging/hv/Hv.c 2011-03-27 14:31:47.000000000 -0400
38376 +++ linux-2.6.32.46/drivers/staging/hv/Hv.c 2011-04-17 15:56:46.000000000 -0400
38377 @@ -161,7 +161,7 @@ static u64 HvDoHypercall(u64 Control, vo
38378 u64 outputAddress = (Output) ? virt_to_phys(Output) : 0;
38379 u32 outputAddressHi = outputAddress >> 32;
38380 u32 outputAddressLo = outputAddress & 0xFFFFFFFF;
38381 - volatile void *hypercallPage = gHvContext.HypercallPage;
38382 + volatile void *hypercallPage = ktva_ktla(gHvContext.HypercallPage);
38383
38384 DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
38385 Control, Input, Output);
38386 diff -urNp linux-2.6.32.46/drivers/staging/hv/VmbusApi.h linux-2.6.32.46/drivers/staging/hv/VmbusApi.h
38387 --- linux-2.6.32.46/drivers/staging/hv/VmbusApi.h 2011-03-27 14:31:47.000000000 -0400
38388 +++ linux-2.6.32.46/drivers/staging/hv/VmbusApi.h 2011-08-29 22:32:57.000000000 -0400
38389 @@ -109,7 +109,7 @@ struct vmbus_channel_interface {
38390 u32 *GpadlHandle);
38391 int (*TeardownGpadl)(struct hv_device *device, u32 GpadlHandle);
38392 void (*GetInfo)(struct hv_device *dev, struct hv_device_info *devinfo);
38393 -};
38394 +} __no_const;
38395
38396 /* Base driver object */
38397 struct hv_driver {
38398 diff -urNp linux-2.6.32.46/drivers/staging/hv/vmbus_drv.c linux-2.6.32.46/drivers/staging/hv/vmbus_drv.c
38399 --- linux-2.6.32.46/drivers/staging/hv/vmbus_drv.c 2011-03-27 14:31:47.000000000 -0400
38400 +++ linux-2.6.32.46/drivers/staging/hv/vmbus_drv.c 2011-05-04 17:56:28.000000000 -0400
38401 @@ -532,7 +532,7 @@ static int vmbus_child_device_register(s
38402 to_device_context(root_device_obj);
38403 struct device_context *child_device_ctx =
38404 to_device_context(child_device_obj);
38405 - static atomic_t device_num = ATOMIC_INIT(0);
38406 + static atomic_unchecked_t device_num = ATOMIC_INIT(0);
38407
38408 DPRINT_ENTER(VMBUS_DRV);
38409
38410 @@ -541,7 +541,7 @@ static int vmbus_child_device_register(s
38411
38412 /* Set the device name. Otherwise, device_register() will fail. */
38413 dev_set_name(&child_device_ctx->device, "vmbus_0_%d",
38414 - atomic_inc_return(&device_num));
38415 + atomic_inc_return_unchecked(&device_num));
38416
38417 /* The new device belongs to this bus */
38418 child_device_ctx->device.bus = &g_vmbus_drv.bus; /* device->dev.bus; */
38419 diff -urNp linux-2.6.32.46/drivers/staging/hv/VmbusPrivate.h linux-2.6.32.46/drivers/staging/hv/VmbusPrivate.h
38420 --- linux-2.6.32.46/drivers/staging/hv/VmbusPrivate.h 2011-04-17 17:00:52.000000000 -0400
38421 +++ linux-2.6.32.46/drivers/staging/hv/VmbusPrivate.h 2011-05-04 17:56:28.000000000 -0400
38422 @@ -59,7 +59,7 @@ enum VMBUS_CONNECT_STATE {
38423 struct VMBUS_CONNECTION {
38424 enum VMBUS_CONNECT_STATE ConnectState;
38425
38426 - atomic_t NextGpadlHandle;
38427 + atomic_unchecked_t NextGpadlHandle;
38428
38429 /*
38430 * Represents channel interrupts. Each bit position represents a
38431 diff -urNp linux-2.6.32.46/drivers/staging/iio/ring_generic.h linux-2.6.32.46/drivers/staging/iio/ring_generic.h
38432 --- linux-2.6.32.46/drivers/staging/iio/ring_generic.h 2011-03-27 14:31:47.000000000 -0400
38433 +++ linux-2.6.32.46/drivers/staging/iio/ring_generic.h 2011-08-23 20:24:26.000000000 -0400
38434 @@ -87,7 +87,7 @@ struct iio_ring_access_funcs {
38435
38436 int (*is_enabled)(struct iio_ring_buffer *ring);
38437 int (*enable)(struct iio_ring_buffer *ring);
38438 -};
38439 +} __no_const;
38440
38441 /**
38442 * struct iio_ring_buffer - general ring buffer structure
38443 diff -urNp linux-2.6.32.46/drivers/staging/octeon/ethernet.c linux-2.6.32.46/drivers/staging/octeon/ethernet.c
38444 --- linux-2.6.32.46/drivers/staging/octeon/ethernet.c 2011-03-27 14:31:47.000000000 -0400
38445 +++ linux-2.6.32.46/drivers/staging/octeon/ethernet.c 2011-05-04 17:56:28.000000000 -0400
38446 @@ -294,11 +294,11 @@ static struct net_device_stats *cvm_oct_
38447 * since the RX tasklet also increments it.
38448 */
38449 #ifdef CONFIG_64BIT
38450 - atomic64_add(rx_status.dropped_packets,
38451 - (atomic64_t *)&priv->stats.rx_dropped);
38452 + atomic64_add_unchecked(rx_status.dropped_packets,
38453 + (atomic64_unchecked_t *)&priv->stats.rx_dropped);
38454 #else
38455 - atomic_add(rx_status.dropped_packets,
38456 - (atomic_t *)&priv->stats.rx_dropped);
38457 + atomic_add_unchecked(rx_status.dropped_packets,
38458 + (atomic_unchecked_t *)&priv->stats.rx_dropped);
38459 #endif
38460 }
38461
38462 diff -urNp linux-2.6.32.46/drivers/staging/octeon/ethernet-rx.c linux-2.6.32.46/drivers/staging/octeon/ethernet-rx.c
38463 --- linux-2.6.32.46/drivers/staging/octeon/ethernet-rx.c 2011-03-27 14:31:47.000000000 -0400
38464 +++ linux-2.6.32.46/drivers/staging/octeon/ethernet-rx.c 2011-05-04 17:56:28.000000000 -0400
38465 @@ -406,11 +406,11 @@ void cvm_oct_tasklet_rx(unsigned long un
38466 /* Increment RX stats for virtual ports */
38467 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
38468 #ifdef CONFIG_64BIT
38469 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
38470 - atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
38471 + atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
38472 + atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
38473 #else
38474 - atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
38475 - atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
38476 + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
38477 + atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
38478 #endif
38479 }
38480 netif_receive_skb(skb);
38481 @@ -424,9 +424,9 @@ void cvm_oct_tasklet_rx(unsigned long un
38482 dev->name);
38483 */
38484 #ifdef CONFIG_64BIT
38485 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
38486 + atomic64_add_unchecked(1, (atomic64_t *)&priv->stats.rx_dropped);
38487 #else
38488 - atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
38489 + atomic_add_unchecked(1, (atomic_t *)&priv->stats.rx_dropped);
38490 #endif
38491 dev_kfree_skb_irq(skb);
38492 }
38493 diff -urNp linux-2.6.32.46/drivers/staging/panel/panel.c linux-2.6.32.46/drivers/staging/panel/panel.c
38494 --- linux-2.6.32.46/drivers/staging/panel/panel.c 2011-03-27 14:31:47.000000000 -0400
38495 +++ linux-2.6.32.46/drivers/staging/panel/panel.c 2011-04-17 15:56:46.000000000 -0400
38496 @@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *ino
38497 return 0;
38498 }
38499
38500 -static struct file_operations lcd_fops = {
38501 +static const struct file_operations lcd_fops = {
38502 .write = lcd_write,
38503 .open = lcd_open,
38504 .release = lcd_release,
38505 @@ -1565,7 +1565,7 @@ static int keypad_release(struct inode *
38506 return 0;
38507 }
38508
38509 -static struct file_operations keypad_fops = {
38510 +static const struct file_operations keypad_fops = {
38511 .read = keypad_read, /* read */
38512 .open = keypad_open, /* open */
38513 .release = keypad_release, /* close */
38514 diff -urNp linux-2.6.32.46/drivers/staging/phison/phison.c linux-2.6.32.46/drivers/staging/phison/phison.c
38515 --- linux-2.6.32.46/drivers/staging/phison/phison.c 2011-03-27 14:31:47.000000000 -0400
38516 +++ linux-2.6.32.46/drivers/staging/phison/phison.c 2011-04-17 15:56:46.000000000 -0400
38517 @@ -43,7 +43,7 @@ static struct scsi_host_template phison_
38518 ATA_BMDMA_SHT(DRV_NAME),
38519 };
38520
38521 -static struct ata_port_operations phison_ops = {
38522 +static const struct ata_port_operations phison_ops = {
38523 .inherits = &ata_bmdma_port_ops,
38524 .prereset = phison_pre_reset,
38525 };
38526 diff -urNp linux-2.6.32.46/drivers/staging/poch/poch.c linux-2.6.32.46/drivers/staging/poch/poch.c
38527 --- linux-2.6.32.46/drivers/staging/poch/poch.c 2011-03-27 14:31:47.000000000 -0400
38528 +++ linux-2.6.32.46/drivers/staging/poch/poch.c 2011-04-17 15:56:46.000000000 -0400
38529 @@ -1057,7 +1057,7 @@ static int poch_ioctl(struct inode *inod
38530 return 0;
38531 }
38532
38533 -static struct file_operations poch_fops = {
38534 +static const struct file_operations poch_fops = {
38535 .owner = THIS_MODULE,
38536 .open = poch_open,
38537 .release = poch_release,
38538 diff -urNp linux-2.6.32.46/drivers/staging/pohmelfs/inode.c linux-2.6.32.46/drivers/staging/pohmelfs/inode.c
38539 --- linux-2.6.32.46/drivers/staging/pohmelfs/inode.c 2011-03-27 14:31:47.000000000 -0400
38540 +++ linux-2.6.32.46/drivers/staging/pohmelfs/inode.c 2011-05-04 17:56:20.000000000 -0400
38541 @@ -1850,7 +1850,7 @@ static int pohmelfs_fill_super(struct su
38542 mutex_init(&psb->mcache_lock);
38543 psb->mcache_root = RB_ROOT;
38544 psb->mcache_timeout = msecs_to_jiffies(5000);
38545 - atomic_long_set(&psb->mcache_gen, 0);
38546 + atomic_long_set_unchecked(&psb->mcache_gen, 0);
38547
38548 psb->trans_max_pages = 100;
38549
38550 @@ -1865,7 +1865,7 @@ static int pohmelfs_fill_super(struct su
38551 INIT_LIST_HEAD(&psb->crypto_ready_list);
38552 INIT_LIST_HEAD(&psb->crypto_active_list);
38553
38554 - atomic_set(&psb->trans_gen, 1);
38555 + atomic_set_unchecked(&psb->trans_gen, 1);
38556 atomic_long_set(&psb->total_inodes, 0);
38557
38558 mutex_init(&psb->state_lock);
38559 diff -urNp linux-2.6.32.46/drivers/staging/pohmelfs/mcache.c linux-2.6.32.46/drivers/staging/pohmelfs/mcache.c
38560 --- linux-2.6.32.46/drivers/staging/pohmelfs/mcache.c 2011-03-27 14:31:47.000000000 -0400
38561 +++ linux-2.6.32.46/drivers/staging/pohmelfs/mcache.c 2011-04-17 15:56:46.000000000 -0400
38562 @@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
38563 m->data = data;
38564 m->start = start;
38565 m->size = size;
38566 - m->gen = atomic_long_inc_return(&psb->mcache_gen);
38567 + m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
38568
38569 mutex_lock(&psb->mcache_lock);
38570 err = pohmelfs_mcache_insert(psb, m);
38571 diff -urNp linux-2.6.32.46/drivers/staging/pohmelfs/netfs.h linux-2.6.32.46/drivers/staging/pohmelfs/netfs.h
38572 --- linux-2.6.32.46/drivers/staging/pohmelfs/netfs.h 2011-03-27 14:31:47.000000000 -0400
38573 +++ linux-2.6.32.46/drivers/staging/pohmelfs/netfs.h 2011-05-04 17:56:20.000000000 -0400
38574 @@ -570,14 +570,14 @@ struct pohmelfs_config;
38575 struct pohmelfs_sb {
38576 struct rb_root mcache_root;
38577 struct mutex mcache_lock;
38578 - atomic_long_t mcache_gen;
38579 + atomic_long_unchecked_t mcache_gen;
38580 unsigned long mcache_timeout;
38581
38582 unsigned int idx;
38583
38584 unsigned int trans_retries;
38585
38586 - atomic_t trans_gen;
38587 + atomic_unchecked_t trans_gen;
38588
38589 unsigned int crypto_attached_size;
38590 unsigned int crypto_align_size;
38591 diff -urNp linux-2.6.32.46/drivers/staging/pohmelfs/trans.c linux-2.6.32.46/drivers/staging/pohmelfs/trans.c
38592 --- linux-2.6.32.46/drivers/staging/pohmelfs/trans.c 2011-03-27 14:31:47.000000000 -0400
38593 +++ linux-2.6.32.46/drivers/staging/pohmelfs/trans.c 2011-05-04 17:56:28.000000000 -0400
38594 @@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_tran
38595 int err;
38596 struct netfs_cmd *cmd = t->iovec.iov_base;
38597
38598 - t->gen = atomic_inc_return(&psb->trans_gen);
38599 + t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
38600
38601 cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
38602 t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
38603 diff -urNp linux-2.6.32.46/drivers/staging/sep/sep_driver.c linux-2.6.32.46/drivers/staging/sep/sep_driver.c
38604 --- linux-2.6.32.46/drivers/staging/sep/sep_driver.c 2011-03-27 14:31:47.000000000 -0400
38605 +++ linux-2.6.32.46/drivers/staging/sep/sep_driver.c 2011-04-17 15:56:46.000000000 -0400
38606 @@ -2603,7 +2603,7 @@ static struct pci_driver sep_pci_driver
38607 static dev_t sep_devno;
38608
38609 /* the files operations structure of the driver */
38610 -static struct file_operations sep_file_operations = {
38611 +static const struct file_operations sep_file_operations = {
38612 .owner = THIS_MODULE,
38613 .ioctl = sep_ioctl,
38614 .poll = sep_poll,
38615 diff -urNp linux-2.6.32.46/drivers/staging/usbip/usbip_common.h linux-2.6.32.46/drivers/staging/usbip/usbip_common.h
38616 --- linux-2.6.32.46/drivers/staging/usbip/usbip_common.h 2011-04-17 17:00:52.000000000 -0400
38617 +++ linux-2.6.32.46/drivers/staging/usbip/usbip_common.h 2011-08-23 20:24:26.000000000 -0400
38618 @@ -374,7 +374,7 @@ struct usbip_device {
38619 void (*shutdown)(struct usbip_device *);
38620 void (*reset)(struct usbip_device *);
38621 void (*unusable)(struct usbip_device *);
38622 - } eh_ops;
38623 + } __no_const eh_ops;
38624 };
38625
38626
38627 diff -urNp linux-2.6.32.46/drivers/staging/usbip/vhci.h linux-2.6.32.46/drivers/staging/usbip/vhci.h
38628 --- linux-2.6.32.46/drivers/staging/usbip/vhci.h 2011-03-27 14:31:47.000000000 -0400
38629 +++ linux-2.6.32.46/drivers/staging/usbip/vhci.h 2011-05-04 17:56:28.000000000 -0400
38630 @@ -92,7 +92,7 @@ struct vhci_hcd {
38631 unsigned resuming:1;
38632 unsigned long re_timeout;
38633
38634 - atomic_t seqnum;
38635 + atomic_unchecked_t seqnum;
38636
38637 /*
38638 * NOTE:
38639 diff -urNp linux-2.6.32.46/drivers/staging/usbip/vhci_hcd.c linux-2.6.32.46/drivers/staging/usbip/vhci_hcd.c
38640 --- linux-2.6.32.46/drivers/staging/usbip/vhci_hcd.c 2011-05-10 22:12:01.000000000 -0400
38641 +++ linux-2.6.32.46/drivers/staging/usbip/vhci_hcd.c 2011-05-10 22:12:33.000000000 -0400
38642 @@ -534,7 +534,7 @@ static void vhci_tx_urb(struct urb *urb)
38643 return;
38644 }
38645
38646 - priv->seqnum = atomic_inc_return(&the_controller->seqnum);
38647 + priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
38648 if (priv->seqnum == 0xffff)
38649 usbip_uinfo("seqnum max\n");
38650
38651 @@ -793,7 +793,7 @@ static int vhci_urb_dequeue(struct usb_h
38652 return -ENOMEM;
38653 }
38654
38655 - unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
38656 + unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
38657 if (unlink->seqnum == 0xffff)
38658 usbip_uinfo("seqnum max\n");
38659
38660 @@ -988,7 +988,7 @@ static int vhci_start(struct usb_hcd *hc
38661 vdev->rhport = rhport;
38662 }
38663
38664 - atomic_set(&vhci->seqnum, 0);
38665 + atomic_set_unchecked(&vhci->seqnum, 0);
38666 spin_lock_init(&vhci->lock);
38667
38668
38669 diff -urNp linux-2.6.32.46/drivers/staging/usbip/vhci_rx.c linux-2.6.32.46/drivers/staging/usbip/vhci_rx.c
38670 --- linux-2.6.32.46/drivers/staging/usbip/vhci_rx.c 2011-04-17 17:00:52.000000000 -0400
38671 +++ linux-2.6.32.46/drivers/staging/usbip/vhci_rx.c 2011-05-04 17:56:28.000000000 -0400
38672 @@ -78,7 +78,7 @@ static void vhci_recv_ret_submit(struct
38673 usbip_uerr("cannot find a urb of seqnum %u\n",
38674 pdu->base.seqnum);
38675 usbip_uinfo("max seqnum %d\n",
38676 - atomic_read(&the_controller->seqnum));
38677 + atomic_read_unchecked(&the_controller->seqnum));
38678 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
38679 return;
38680 }
38681 diff -urNp linux-2.6.32.46/drivers/staging/vme/devices/vme_user.c linux-2.6.32.46/drivers/staging/vme/devices/vme_user.c
38682 --- linux-2.6.32.46/drivers/staging/vme/devices/vme_user.c 2011-03-27 14:31:47.000000000 -0400
38683 +++ linux-2.6.32.46/drivers/staging/vme/devices/vme_user.c 2011-04-17 15:56:46.000000000 -0400
38684 @@ -136,7 +136,7 @@ static int vme_user_ioctl(struct inode *
38685 static int __init vme_user_probe(struct device *, int, int);
38686 static int __exit vme_user_remove(struct device *, int, int);
38687
38688 -static struct file_operations vme_user_fops = {
38689 +static const struct file_operations vme_user_fops = {
38690 .open = vme_user_open,
38691 .release = vme_user_release,
38692 .read = vme_user_read,
38693 diff -urNp linux-2.6.32.46/drivers/staging/vt6655/hostap.c linux-2.6.32.46/drivers/staging/vt6655/hostap.c
38694 --- linux-2.6.32.46/drivers/staging/vt6655/hostap.c 2011-03-27 14:31:47.000000000 -0400
38695 +++ linux-2.6.32.46/drivers/staging/vt6655/hostap.c 2011-09-14 09:51:07.000000000 -0400
38696 @@ -84,7 +84,7 @@ static int hostap_enable_hostapd(PSDevic
38697 PSDevice apdev_priv;
38698 struct net_device *dev = pDevice->dev;
38699 int ret;
38700 - const struct net_device_ops apdev_netdev_ops = {
38701 + net_device_ops_no_const apdev_netdev_ops = {
38702 .ndo_start_xmit = pDevice->tx_80211,
38703 };
38704
38705 diff -urNp linux-2.6.32.46/drivers/staging/vt6656/hostap.c linux-2.6.32.46/drivers/staging/vt6656/hostap.c
38706 --- linux-2.6.32.46/drivers/staging/vt6656/hostap.c 2011-03-27 14:31:47.000000000 -0400
38707 +++ linux-2.6.32.46/drivers/staging/vt6656/hostap.c 2011-09-14 09:49:53.000000000 -0400
38708 @@ -86,7 +86,7 @@ static int hostap_enable_hostapd(PSDevic
38709 PSDevice apdev_priv;
38710 struct net_device *dev = pDevice->dev;
38711 int ret;
38712 - const struct net_device_ops apdev_netdev_ops = {
38713 + net_device_ops_no_const apdev_netdev_ops = {
38714 .ndo_start_xmit = pDevice->tx_80211,
38715 };
38716
38717 diff -urNp linux-2.6.32.46/drivers/staging/wlan-ng/hfa384x_usb.c linux-2.6.32.46/drivers/staging/wlan-ng/hfa384x_usb.c
38718 --- linux-2.6.32.46/drivers/staging/wlan-ng/hfa384x_usb.c 2011-03-27 14:31:47.000000000 -0400
38719 +++ linux-2.6.32.46/drivers/staging/wlan-ng/hfa384x_usb.c 2011-08-23 20:24:26.000000000 -0400
38720 @@ -205,7 +205,7 @@ static void unlocked_usbctlx_complete(hf
38721
38722 struct usbctlx_completor {
38723 int (*complete) (struct usbctlx_completor *);
38724 -};
38725 +} __no_const;
38726 typedef struct usbctlx_completor usbctlx_completor_t;
38727
38728 static int
38729 diff -urNp linux-2.6.32.46/drivers/telephony/ixj.c linux-2.6.32.46/drivers/telephony/ixj.c
38730 --- linux-2.6.32.46/drivers/telephony/ixj.c 2011-03-27 14:31:47.000000000 -0400
38731 +++ linux-2.6.32.46/drivers/telephony/ixj.c 2011-05-16 21:46:57.000000000 -0400
38732 @@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
38733 bool mContinue;
38734 char *pIn, *pOut;
38735
38736 + pax_track_stack();
38737 +
38738 if (!SCI_Prepare(j))
38739 return 0;
38740
38741 diff -urNp linux-2.6.32.46/drivers/uio/uio.c linux-2.6.32.46/drivers/uio/uio.c
38742 --- linux-2.6.32.46/drivers/uio/uio.c 2011-03-27 14:31:47.000000000 -0400
38743 +++ linux-2.6.32.46/drivers/uio/uio.c 2011-05-04 17:56:20.000000000 -0400
38744 @@ -23,6 +23,7 @@
38745 #include <linux/string.h>
38746 #include <linux/kobject.h>
38747 #include <linux/uio_driver.h>
38748 +#include <asm/local.h>
38749
38750 #define UIO_MAX_DEVICES 255
38751
38752 @@ -30,10 +31,10 @@ struct uio_device {
38753 struct module *owner;
38754 struct device *dev;
38755 int minor;
38756 - atomic_t event;
38757 + atomic_unchecked_t event;
38758 struct fasync_struct *async_queue;
38759 wait_queue_head_t wait;
38760 - int vma_count;
38761 + local_t vma_count;
38762 struct uio_info *info;
38763 struct kobject *map_dir;
38764 struct kobject *portio_dir;
38765 @@ -129,7 +130,7 @@ static ssize_t map_type_show(struct kobj
38766 return entry->show(mem, buf);
38767 }
38768
38769 -static struct sysfs_ops map_sysfs_ops = {
38770 +static const struct sysfs_ops map_sysfs_ops = {
38771 .show = map_type_show,
38772 };
38773
38774 @@ -217,7 +218,7 @@ static ssize_t portio_type_show(struct k
38775 return entry->show(port, buf);
38776 }
38777
38778 -static struct sysfs_ops portio_sysfs_ops = {
38779 +static const struct sysfs_ops portio_sysfs_ops = {
38780 .show = portio_type_show,
38781 };
38782
38783 @@ -255,7 +256,7 @@ static ssize_t show_event(struct device
38784 struct uio_device *idev = dev_get_drvdata(dev);
38785 if (idev)
38786 return sprintf(buf, "%u\n",
38787 - (unsigned int)atomic_read(&idev->event));
38788 + (unsigned int)atomic_read_unchecked(&idev->event));
38789 else
38790 return -ENODEV;
38791 }
38792 @@ -424,7 +425,7 @@ void uio_event_notify(struct uio_info *i
38793 {
38794 struct uio_device *idev = info->uio_dev;
38795
38796 - atomic_inc(&idev->event);
38797 + atomic_inc_unchecked(&idev->event);
38798 wake_up_interruptible(&idev->wait);
38799 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
38800 }
38801 @@ -477,7 +478,7 @@ static int uio_open(struct inode *inode,
38802 }
38803
38804 listener->dev = idev;
38805 - listener->event_count = atomic_read(&idev->event);
38806 + listener->event_count = atomic_read_unchecked(&idev->event);
38807 filep->private_data = listener;
38808
38809 if (idev->info->open) {
38810 @@ -528,7 +529,7 @@ static unsigned int uio_poll(struct file
38811 return -EIO;
38812
38813 poll_wait(filep, &idev->wait, wait);
38814 - if (listener->event_count != atomic_read(&idev->event))
38815 + if (listener->event_count != atomic_read_unchecked(&idev->event))
38816 return POLLIN | POLLRDNORM;
38817 return 0;
38818 }
38819 @@ -553,7 +554,7 @@ static ssize_t uio_read(struct file *fil
38820 do {
38821 set_current_state(TASK_INTERRUPTIBLE);
38822
38823 - event_count = atomic_read(&idev->event);
38824 + event_count = atomic_read_unchecked(&idev->event);
38825 if (event_count != listener->event_count) {
38826 if (copy_to_user(buf, &event_count, count))
38827 retval = -EFAULT;
38828 @@ -624,13 +625,13 @@ static int uio_find_mem_index(struct vm_
38829 static void uio_vma_open(struct vm_area_struct *vma)
38830 {
38831 struct uio_device *idev = vma->vm_private_data;
38832 - idev->vma_count++;
38833 + local_inc(&idev->vma_count);
38834 }
38835
38836 static void uio_vma_close(struct vm_area_struct *vma)
38837 {
38838 struct uio_device *idev = vma->vm_private_data;
38839 - idev->vma_count--;
38840 + local_dec(&idev->vma_count);
38841 }
38842
38843 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
38844 @@ -840,7 +841,7 @@ int __uio_register_device(struct module
38845 idev->owner = owner;
38846 idev->info = info;
38847 init_waitqueue_head(&idev->wait);
38848 - atomic_set(&idev->event, 0);
38849 + atomic_set_unchecked(&idev->event, 0);
38850
38851 ret = uio_get_minor(idev);
38852 if (ret)
38853 diff -urNp linux-2.6.32.46/drivers/usb/atm/usbatm.c linux-2.6.32.46/drivers/usb/atm/usbatm.c
38854 --- linux-2.6.32.46/drivers/usb/atm/usbatm.c 2011-03-27 14:31:47.000000000 -0400
38855 +++ linux-2.6.32.46/drivers/usb/atm/usbatm.c 2011-04-17 15:56:46.000000000 -0400
38856 @@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(stru
38857 if (printk_ratelimit())
38858 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
38859 __func__, vpi, vci);
38860 - atomic_inc(&vcc->stats->rx_err);
38861 + atomic_inc_unchecked(&vcc->stats->rx_err);
38862 return;
38863 }
38864
38865 @@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(stru
38866 if (length > ATM_MAX_AAL5_PDU) {
38867 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
38868 __func__, length, vcc);
38869 - atomic_inc(&vcc->stats->rx_err);
38870 + atomic_inc_unchecked(&vcc->stats->rx_err);
38871 goto out;
38872 }
38873
38874 @@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(stru
38875 if (sarb->len < pdu_length) {
38876 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
38877 __func__, pdu_length, sarb->len, vcc);
38878 - atomic_inc(&vcc->stats->rx_err);
38879 + atomic_inc_unchecked(&vcc->stats->rx_err);
38880 goto out;
38881 }
38882
38883 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
38884 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
38885 __func__, vcc);
38886 - atomic_inc(&vcc->stats->rx_err);
38887 + atomic_inc_unchecked(&vcc->stats->rx_err);
38888 goto out;
38889 }
38890
38891 @@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(stru
38892 if (printk_ratelimit())
38893 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
38894 __func__, length);
38895 - atomic_inc(&vcc->stats->rx_drop);
38896 + atomic_inc_unchecked(&vcc->stats->rx_drop);
38897 goto out;
38898 }
38899
38900 @@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(stru
38901
38902 vcc->push(vcc, skb);
38903
38904 - atomic_inc(&vcc->stats->rx);
38905 + atomic_inc_unchecked(&vcc->stats->rx);
38906 out:
38907 skb_trim(sarb, 0);
38908 }
38909 @@ -616,7 +616,7 @@ static void usbatm_tx_process(unsigned l
38910 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
38911
38912 usbatm_pop(vcc, skb);
38913 - atomic_inc(&vcc->stats->tx);
38914 + atomic_inc_unchecked(&vcc->stats->tx);
38915
38916 skb = skb_dequeue(&instance->sndqueue);
38917 }
38918 @@ -775,11 +775,11 @@ static int usbatm_atm_proc_read(struct a
38919 if (!left--)
38920 return sprintf(page,
38921 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
38922 - atomic_read(&atm_dev->stats.aal5.tx),
38923 - atomic_read(&atm_dev->stats.aal5.tx_err),
38924 - atomic_read(&atm_dev->stats.aal5.rx),
38925 - atomic_read(&atm_dev->stats.aal5.rx_err),
38926 - atomic_read(&atm_dev->stats.aal5.rx_drop));
38927 + atomic_read_unchecked(&atm_dev->stats.aal5.tx),
38928 + atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
38929 + atomic_read_unchecked(&atm_dev->stats.aal5.rx),
38930 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
38931 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
38932
38933 if (!left--) {
38934 if (instance->disconnected)
38935 diff -urNp linux-2.6.32.46/drivers/usb/class/cdc-wdm.c linux-2.6.32.46/drivers/usb/class/cdc-wdm.c
38936 --- linux-2.6.32.46/drivers/usb/class/cdc-wdm.c 2011-03-27 14:31:47.000000000 -0400
38937 +++ linux-2.6.32.46/drivers/usb/class/cdc-wdm.c 2011-04-17 15:56:46.000000000 -0400
38938 @@ -314,7 +314,7 @@ static ssize_t wdm_write
38939 if (r < 0)
38940 goto outnp;
38941
38942 - if (!file->f_flags && O_NONBLOCK)
38943 + if (!(file->f_flags & O_NONBLOCK))
38944 r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
38945 &desc->flags));
38946 else
38947 diff -urNp linux-2.6.32.46/drivers/usb/core/hcd.c linux-2.6.32.46/drivers/usb/core/hcd.c
38948 --- linux-2.6.32.46/drivers/usb/core/hcd.c 2011-03-27 14:31:47.000000000 -0400
38949 +++ linux-2.6.32.46/drivers/usb/core/hcd.c 2011-04-17 15:56:46.000000000 -0400
38950 @@ -2216,7 +2216,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
38951
38952 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
38953
38954 -struct usb_mon_operations *mon_ops;
38955 +const struct usb_mon_operations *mon_ops;
38956
38957 /*
38958 * The registration is unlocked.
38959 @@ -2226,7 +2226,7 @@ struct usb_mon_operations *mon_ops;
38960 * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
38961 */
38962
38963 -int usb_mon_register (struct usb_mon_operations *ops)
38964 +int usb_mon_register (const struct usb_mon_operations *ops)
38965 {
38966
38967 if (mon_ops)
38968 diff -urNp linux-2.6.32.46/drivers/usb/core/hcd.h linux-2.6.32.46/drivers/usb/core/hcd.h
38969 --- linux-2.6.32.46/drivers/usb/core/hcd.h 2011-03-27 14:31:47.000000000 -0400
38970 +++ linux-2.6.32.46/drivers/usb/core/hcd.h 2011-04-17 15:56:46.000000000 -0400
38971 @@ -486,13 +486,13 @@ static inline void usbfs_cleanup(void) {
38972 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
38973
38974 struct usb_mon_operations {
38975 - void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
38976 - void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
38977 - void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
38978 + void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
38979 + void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
38980 + void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
38981 /* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
38982 };
38983
38984 -extern struct usb_mon_operations *mon_ops;
38985 +extern const struct usb_mon_operations *mon_ops;
38986
38987 static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
38988 {
38989 @@ -514,7 +514,7 @@ static inline void usbmon_urb_complete(s
38990 (*mon_ops->urb_complete)(bus, urb, status);
38991 }
38992
38993 -int usb_mon_register(struct usb_mon_operations *ops);
38994 +int usb_mon_register(const struct usb_mon_operations *ops);
38995 void usb_mon_deregister(void);
38996
38997 #else
38998 diff -urNp linux-2.6.32.46/drivers/usb/core/message.c linux-2.6.32.46/drivers/usb/core/message.c
38999 --- linux-2.6.32.46/drivers/usb/core/message.c 2011-03-27 14:31:47.000000000 -0400
39000 +++ linux-2.6.32.46/drivers/usb/core/message.c 2011-04-17 15:56:46.000000000 -0400
39001 @@ -914,8 +914,8 @@ char *usb_cache_string(struct usb_device
39002 buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
39003 if (buf) {
39004 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
39005 - if (len > 0) {
39006 - smallbuf = kmalloc(++len, GFP_NOIO);
39007 + if (len++ > 0) {
39008 + smallbuf = kmalloc(len, GFP_NOIO);
39009 if (!smallbuf)
39010 return buf;
39011 memcpy(smallbuf, buf, len);
39012 diff -urNp linux-2.6.32.46/drivers/usb/misc/appledisplay.c linux-2.6.32.46/drivers/usb/misc/appledisplay.c
39013 --- linux-2.6.32.46/drivers/usb/misc/appledisplay.c 2011-03-27 14:31:47.000000000 -0400
39014 +++ linux-2.6.32.46/drivers/usb/misc/appledisplay.c 2011-04-17 15:56:46.000000000 -0400
39015 @@ -178,7 +178,7 @@ static int appledisplay_bl_get_brightnes
39016 return pdata->msgdata[1];
39017 }
39018
39019 -static struct backlight_ops appledisplay_bl_data = {
39020 +static const struct backlight_ops appledisplay_bl_data = {
39021 .get_brightness = appledisplay_bl_get_brightness,
39022 .update_status = appledisplay_bl_update_status,
39023 };
39024 diff -urNp linux-2.6.32.46/drivers/usb/mon/mon_main.c linux-2.6.32.46/drivers/usb/mon/mon_main.c
39025 --- linux-2.6.32.46/drivers/usb/mon/mon_main.c 2011-03-27 14:31:47.000000000 -0400
39026 +++ linux-2.6.32.46/drivers/usb/mon/mon_main.c 2011-04-17 15:56:46.000000000 -0400
39027 @@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
39028 /*
39029 * Ops
39030 */
39031 -static struct usb_mon_operations mon_ops_0 = {
39032 +static const struct usb_mon_operations mon_ops_0 = {
39033 .urb_submit = mon_submit,
39034 .urb_submit_error = mon_submit_error,
39035 .urb_complete = mon_complete,
39036 diff -urNp linux-2.6.32.46/drivers/usb/wusbcore/wa-hc.h linux-2.6.32.46/drivers/usb/wusbcore/wa-hc.h
39037 --- linux-2.6.32.46/drivers/usb/wusbcore/wa-hc.h 2011-03-27 14:31:47.000000000 -0400
39038 +++ linux-2.6.32.46/drivers/usb/wusbcore/wa-hc.h 2011-05-04 17:56:28.000000000 -0400
39039 @@ -192,7 +192,7 @@ struct wahc {
39040 struct list_head xfer_delayed_list;
39041 spinlock_t xfer_list_lock;
39042 struct work_struct xfer_work;
39043 - atomic_t xfer_id_count;
39044 + atomic_unchecked_t xfer_id_count;
39045 };
39046
39047
39048 @@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *
39049 INIT_LIST_HEAD(&wa->xfer_delayed_list);
39050 spin_lock_init(&wa->xfer_list_lock);
39051 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
39052 - atomic_set(&wa->xfer_id_count, 1);
39053 + atomic_set_unchecked(&wa->xfer_id_count, 1);
39054 }
39055
39056 /**
39057 diff -urNp linux-2.6.32.46/drivers/usb/wusbcore/wa-xfer.c linux-2.6.32.46/drivers/usb/wusbcore/wa-xfer.c
39058 --- linux-2.6.32.46/drivers/usb/wusbcore/wa-xfer.c 2011-03-27 14:31:47.000000000 -0400
39059 +++ linux-2.6.32.46/drivers/usb/wusbcore/wa-xfer.c 2011-05-04 17:56:28.000000000 -0400
39060 @@ -293,7 +293,7 @@ out:
39061 */
39062 static void wa_xfer_id_init(struct wa_xfer *xfer)
39063 {
39064 - xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
39065 + xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
39066 }
39067
39068 /*
39069 diff -urNp linux-2.6.32.46/drivers/uwb/wlp/messages.c linux-2.6.32.46/drivers/uwb/wlp/messages.c
39070 --- linux-2.6.32.46/drivers/uwb/wlp/messages.c 2011-03-27 14:31:47.000000000 -0400
39071 +++ linux-2.6.32.46/drivers/uwb/wlp/messages.c 2011-04-17 15:56:46.000000000 -0400
39072 @@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct
39073 size_t len = skb->len;
39074 size_t used;
39075 ssize_t result;
39076 - struct wlp_nonce enonce, rnonce;
39077 + struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
39078 enum wlp_assc_error assc_err;
39079 char enonce_buf[WLP_WSS_NONCE_STRSIZE];
39080 char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
39081 diff -urNp linux-2.6.32.46/drivers/uwb/wlp/sysfs.c linux-2.6.32.46/drivers/uwb/wlp/sysfs.c
39082 --- linux-2.6.32.46/drivers/uwb/wlp/sysfs.c 2011-03-27 14:31:47.000000000 -0400
39083 +++ linux-2.6.32.46/drivers/uwb/wlp/sysfs.c 2011-04-17 15:56:46.000000000 -0400
39084 @@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobjec
39085 return ret;
39086 }
39087
39088 -static
39089 -struct sysfs_ops wss_sysfs_ops = {
39090 +static const struct sysfs_ops wss_sysfs_ops = {
39091 .show = wlp_wss_attr_show,
39092 .store = wlp_wss_attr_store,
39093 };
39094 diff -urNp linux-2.6.32.46/drivers/video/atmel_lcdfb.c linux-2.6.32.46/drivers/video/atmel_lcdfb.c
39095 --- linux-2.6.32.46/drivers/video/atmel_lcdfb.c 2011-03-27 14:31:47.000000000 -0400
39096 +++ linux-2.6.32.46/drivers/video/atmel_lcdfb.c 2011-04-17 15:56:46.000000000 -0400
39097 @@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struc
39098 return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
39099 }
39100
39101 -static struct backlight_ops atmel_lcdc_bl_ops = {
39102 +static const struct backlight_ops atmel_lcdc_bl_ops = {
39103 .update_status = atmel_bl_update_status,
39104 .get_brightness = atmel_bl_get_brightness,
39105 };
39106 diff -urNp linux-2.6.32.46/drivers/video/aty/aty128fb.c linux-2.6.32.46/drivers/video/aty/aty128fb.c
39107 --- linux-2.6.32.46/drivers/video/aty/aty128fb.c 2011-03-27 14:31:47.000000000 -0400
39108 +++ linux-2.6.32.46/drivers/video/aty/aty128fb.c 2011-04-17 15:56:46.000000000 -0400
39109 @@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(stru
39110 return bd->props.brightness;
39111 }
39112
39113 -static struct backlight_ops aty128_bl_data = {
39114 +static const struct backlight_ops aty128_bl_data = {
39115 .get_brightness = aty128_bl_get_brightness,
39116 .update_status = aty128_bl_update_status,
39117 };
39118 diff -urNp linux-2.6.32.46/drivers/video/aty/atyfb_base.c linux-2.6.32.46/drivers/video/aty/atyfb_base.c
39119 --- linux-2.6.32.46/drivers/video/aty/atyfb_base.c 2011-03-27 14:31:47.000000000 -0400
39120 +++ linux-2.6.32.46/drivers/video/aty/atyfb_base.c 2011-04-17 15:56:46.000000000 -0400
39121 @@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct
39122 return bd->props.brightness;
39123 }
39124
39125 -static struct backlight_ops aty_bl_data = {
39126 +static const struct backlight_ops aty_bl_data = {
39127 .get_brightness = aty_bl_get_brightness,
39128 .update_status = aty_bl_update_status,
39129 };
39130 diff -urNp linux-2.6.32.46/drivers/video/aty/radeon_backlight.c linux-2.6.32.46/drivers/video/aty/radeon_backlight.c
39131 --- linux-2.6.32.46/drivers/video/aty/radeon_backlight.c 2011-03-27 14:31:47.000000000 -0400
39132 +++ linux-2.6.32.46/drivers/video/aty/radeon_backlight.c 2011-04-17 15:56:46.000000000 -0400
39133 @@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(stru
39134 return bd->props.brightness;
39135 }
39136
39137 -static struct backlight_ops radeon_bl_data = {
39138 +static const struct backlight_ops radeon_bl_data = {
39139 .get_brightness = radeon_bl_get_brightness,
39140 .update_status = radeon_bl_update_status,
39141 };
39142 diff -urNp linux-2.6.32.46/drivers/video/backlight/adp5520_bl.c linux-2.6.32.46/drivers/video/backlight/adp5520_bl.c
39143 --- linux-2.6.32.46/drivers/video/backlight/adp5520_bl.c 2011-03-27 14:31:47.000000000 -0400
39144 +++ linux-2.6.32.46/drivers/video/backlight/adp5520_bl.c 2011-04-17 15:56:46.000000000 -0400
39145 @@ -84,7 +84,7 @@ static int adp5520_bl_get_brightness(str
39146 return error ? data->current_brightness : reg_val;
39147 }
39148
39149 -static struct backlight_ops adp5520_bl_ops = {
39150 +static const struct backlight_ops adp5520_bl_ops = {
39151 .update_status = adp5520_bl_update_status,
39152 .get_brightness = adp5520_bl_get_brightness,
39153 };
39154 diff -urNp linux-2.6.32.46/drivers/video/backlight/adx_bl.c linux-2.6.32.46/drivers/video/backlight/adx_bl.c
39155 --- linux-2.6.32.46/drivers/video/backlight/adx_bl.c 2011-03-27 14:31:47.000000000 -0400
39156 +++ linux-2.6.32.46/drivers/video/backlight/adx_bl.c 2011-04-17 15:56:46.000000000 -0400
39157 @@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct
39158 return 1;
39159 }
39160
39161 -static struct backlight_ops adx_backlight_ops = {
39162 +static const struct backlight_ops adx_backlight_ops = {
39163 .options = 0,
39164 .update_status = adx_backlight_update_status,
39165 .get_brightness = adx_backlight_get_brightness,
39166 diff -urNp linux-2.6.32.46/drivers/video/backlight/atmel-pwm-bl.c linux-2.6.32.46/drivers/video/backlight/atmel-pwm-bl.c
39167 --- linux-2.6.32.46/drivers/video/backlight/atmel-pwm-bl.c 2011-03-27 14:31:47.000000000 -0400
39168 +++ linux-2.6.32.46/drivers/video/backlight/atmel-pwm-bl.c 2011-04-17 15:56:46.000000000 -0400
39169 @@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct
39170 return pwm_channel_enable(&pwmbl->pwmc);
39171 }
39172
39173 -static struct backlight_ops atmel_pwm_bl_ops = {
39174 +static const struct backlight_ops atmel_pwm_bl_ops = {
39175 .get_brightness = atmel_pwm_bl_get_intensity,
39176 .update_status = atmel_pwm_bl_set_intensity,
39177 };
39178 diff -urNp linux-2.6.32.46/drivers/video/backlight/backlight.c linux-2.6.32.46/drivers/video/backlight/backlight.c
39179 --- linux-2.6.32.46/drivers/video/backlight/backlight.c 2011-03-27 14:31:47.000000000 -0400
39180 +++ linux-2.6.32.46/drivers/video/backlight/backlight.c 2011-04-17 15:56:46.000000000 -0400
39181 @@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
39182 * ERR_PTR() or a pointer to the newly allocated device.
39183 */
39184 struct backlight_device *backlight_device_register(const char *name,
39185 - struct device *parent, void *devdata, struct backlight_ops *ops)
39186 + struct device *parent, void *devdata, const struct backlight_ops *ops)
39187 {
39188 struct backlight_device *new_bd;
39189 int rc;
39190 diff -urNp linux-2.6.32.46/drivers/video/backlight/corgi_lcd.c linux-2.6.32.46/drivers/video/backlight/corgi_lcd.c
39191 --- linux-2.6.32.46/drivers/video/backlight/corgi_lcd.c 2011-03-27 14:31:47.000000000 -0400
39192 +++ linux-2.6.32.46/drivers/video/backlight/corgi_lcd.c 2011-04-17 15:56:46.000000000 -0400
39193 @@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit
39194 }
39195 EXPORT_SYMBOL(corgi_lcd_limit_intensity);
39196
39197 -static struct backlight_ops corgi_bl_ops = {
39198 +static const struct backlight_ops corgi_bl_ops = {
39199 .get_brightness = corgi_bl_get_intensity,
39200 .update_status = corgi_bl_update_status,
39201 };
39202 diff -urNp linux-2.6.32.46/drivers/video/backlight/cr_bllcd.c linux-2.6.32.46/drivers/video/backlight/cr_bllcd.c
39203 --- linux-2.6.32.46/drivers/video/backlight/cr_bllcd.c 2011-03-27 14:31:47.000000000 -0400
39204 +++ linux-2.6.32.46/drivers/video/backlight/cr_bllcd.c 2011-04-17 15:56:46.000000000 -0400
39205 @@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(st
39206 return intensity;
39207 }
39208
39209 -static struct backlight_ops cr_backlight_ops = {
39210 +static const struct backlight_ops cr_backlight_ops = {
39211 .get_brightness = cr_backlight_get_intensity,
39212 .update_status = cr_backlight_set_intensity,
39213 };
39214 diff -urNp linux-2.6.32.46/drivers/video/backlight/da903x_bl.c linux-2.6.32.46/drivers/video/backlight/da903x_bl.c
39215 --- linux-2.6.32.46/drivers/video/backlight/da903x_bl.c 2011-03-27 14:31:47.000000000 -0400
39216 +++ linux-2.6.32.46/drivers/video/backlight/da903x_bl.c 2011-04-17 15:56:46.000000000 -0400
39217 @@ -94,7 +94,7 @@ static int da903x_backlight_get_brightne
39218 return data->current_brightness;
39219 }
39220
39221 -static struct backlight_ops da903x_backlight_ops = {
39222 +static const struct backlight_ops da903x_backlight_ops = {
39223 .update_status = da903x_backlight_update_status,
39224 .get_brightness = da903x_backlight_get_brightness,
39225 };
39226 diff -urNp linux-2.6.32.46/drivers/video/backlight/generic_bl.c linux-2.6.32.46/drivers/video/backlight/generic_bl.c
39227 --- linux-2.6.32.46/drivers/video/backlight/generic_bl.c 2011-03-27 14:31:47.000000000 -0400
39228 +++ linux-2.6.32.46/drivers/video/backlight/generic_bl.c 2011-04-17 15:56:46.000000000 -0400
39229 @@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
39230 }
39231 EXPORT_SYMBOL(corgibl_limit_intensity);
39232
39233 -static struct backlight_ops genericbl_ops = {
39234 +static const struct backlight_ops genericbl_ops = {
39235 .options = BL_CORE_SUSPENDRESUME,
39236 .get_brightness = genericbl_get_intensity,
39237 .update_status = genericbl_send_intensity,
39238 diff -urNp linux-2.6.32.46/drivers/video/backlight/hp680_bl.c linux-2.6.32.46/drivers/video/backlight/hp680_bl.c
39239 --- linux-2.6.32.46/drivers/video/backlight/hp680_bl.c 2011-03-27 14:31:47.000000000 -0400
39240 +++ linux-2.6.32.46/drivers/video/backlight/hp680_bl.c 2011-04-17 15:56:46.000000000 -0400
39241 @@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct
39242 return current_intensity;
39243 }
39244
39245 -static struct backlight_ops hp680bl_ops = {
39246 +static const struct backlight_ops hp680bl_ops = {
39247 .get_brightness = hp680bl_get_intensity,
39248 .update_status = hp680bl_set_intensity,
39249 };
39250 diff -urNp linux-2.6.32.46/drivers/video/backlight/jornada720_bl.c linux-2.6.32.46/drivers/video/backlight/jornada720_bl.c
39251 --- linux-2.6.32.46/drivers/video/backlight/jornada720_bl.c 2011-03-27 14:31:47.000000000 -0400
39252 +++ linux-2.6.32.46/drivers/video/backlight/jornada720_bl.c 2011-04-17 15:56:46.000000000 -0400
39253 @@ -93,7 +93,7 @@ out:
39254 return ret;
39255 }
39256
39257 -static struct backlight_ops jornada_bl_ops = {
39258 +static const struct backlight_ops jornada_bl_ops = {
39259 .get_brightness = jornada_bl_get_brightness,
39260 .update_status = jornada_bl_update_status,
39261 .options = BL_CORE_SUSPENDRESUME,
39262 diff -urNp linux-2.6.32.46/drivers/video/backlight/kb3886_bl.c linux-2.6.32.46/drivers/video/backlight/kb3886_bl.c
39263 --- linux-2.6.32.46/drivers/video/backlight/kb3886_bl.c 2011-03-27 14:31:47.000000000 -0400
39264 +++ linux-2.6.32.46/drivers/video/backlight/kb3886_bl.c 2011-04-17 15:56:46.000000000 -0400
39265 @@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct
39266 return kb3886bl_intensity;
39267 }
39268
39269 -static struct backlight_ops kb3886bl_ops = {
39270 +static const struct backlight_ops kb3886bl_ops = {
39271 .get_brightness = kb3886bl_get_intensity,
39272 .update_status = kb3886bl_send_intensity,
39273 };
39274 diff -urNp linux-2.6.32.46/drivers/video/backlight/locomolcd.c linux-2.6.32.46/drivers/video/backlight/locomolcd.c
39275 --- linux-2.6.32.46/drivers/video/backlight/locomolcd.c 2011-03-27 14:31:47.000000000 -0400
39276 +++ linux-2.6.32.46/drivers/video/backlight/locomolcd.c 2011-04-17 15:56:46.000000000 -0400
39277 @@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struc
39278 return current_intensity;
39279 }
39280
39281 -static struct backlight_ops locomobl_data = {
39282 +static const struct backlight_ops locomobl_data = {
39283 .get_brightness = locomolcd_get_intensity,
39284 .update_status = locomolcd_set_intensity,
39285 };
39286 diff -urNp linux-2.6.32.46/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.32.46/drivers/video/backlight/mbp_nvidia_bl.c
39287 --- linux-2.6.32.46/drivers/video/backlight/mbp_nvidia_bl.c 2011-05-10 22:12:01.000000000 -0400
39288 +++ linux-2.6.32.46/drivers/video/backlight/mbp_nvidia_bl.c 2011-05-10 22:12:33.000000000 -0400
39289 @@ -33,7 +33,7 @@ struct dmi_match_data {
39290 unsigned long iostart;
39291 unsigned long iolen;
39292 /* Backlight operations structure. */
39293 - struct backlight_ops backlight_ops;
39294 + const struct backlight_ops backlight_ops;
39295 };
39296
39297 /* Module parameters. */
39298 diff -urNp linux-2.6.32.46/drivers/video/backlight/omap1_bl.c linux-2.6.32.46/drivers/video/backlight/omap1_bl.c
39299 --- linux-2.6.32.46/drivers/video/backlight/omap1_bl.c 2011-03-27 14:31:47.000000000 -0400
39300 +++ linux-2.6.32.46/drivers/video/backlight/omap1_bl.c 2011-04-17 15:56:46.000000000 -0400
39301 @@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct b
39302 return bl->current_intensity;
39303 }
39304
39305 -static struct backlight_ops omapbl_ops = {
39306 +static const struct backlight_ops omapbl_ops = {
39307 .get_brightness = omapbl_get_intensity,
39308 .update_status = omapbl_update_status,
39309 };
39310 diff -urNp linux-2.6.32.46/drivers/video/backlight/progear_bl.c linux-2.6.32.46/drivers/video/backlight/progear_bl.c
39311 --- linux-2.6.32.46/drivers/video/backlight/progear_bl.c 2011-03-27 14:31:47.000000000 -0400
39312 +++ linux-2.6.32.46/drivers/video/backlight/progear_bl.c 2011-04-17 15:56:46.000000000 -0400
39313 @@ -54,7 +54,7 @@ static int progearbl_get_intensity(struc
39314 return intensity - HW_LEVEL_MIN;
39315 }
39316
39317 -static struct backlight_ops progearbl_ops = {
39318 +static const struct backlight_ops progearbl_ops = {
39319 .get_brightness = progearbl_get_intensity,
39320 .update_status = progearbl_set_intensity,
39321 };
39322 diff -urNp linux-2.6.32.46/drivers/video/backlight/pwm_bl.c linux-2.6.32.46/drivers/video/backlight/pwm_bl.c
39323 --- linux-2.6.32.46/drivers/video/backlight/pwm_bl.c 2011-03-27 14:31:47.000000000 -0400
39324 +++ linux-2.6.32.46/drivers/video/backlight/pwm_bl.c 2011-04-17 15:56:46.000000000 -0400
39325 @@ -56,7 +56,7 @@ static int pwm_backlight_get_brightness(
39326 return bl->props.brightness;
39327 }
39328
39329 -static struct backlight_ops pwm_backlight_ops = {
39330 +static const struct backlight_ops pwm_backlight_ops = {
39331 .update_status = pwm_backlight_update_status,
39332 .get_brightness = pwm_backlight_get_brightness,
39333 };
39334 diff -urNp linux-2.6.32.46/drivers/video/backlight/tosa_bl.c linux-2.6.32.46/drivers/video/backlight/tosa_bl.c
39335 --- linux-2.6.32.46/drivers/video/backlight/tosa_bl.c 2011-03-27 14:31:47.000000000 -0400
39336 +++ linux-2.6.32.46/drivers/video/backlight/tosa_bl.c 2011-04-17 15:56:46.000000000 -0400
39337 @@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct
39338 return props->brightness;
39339 }
39340
39341 -static struct backlight_ops bl_ops = {
39342 +static const struct backlight_ops bl_ops = {
39343 .get_brightness = tosa_bl_get_brightness,
39344 .update_status = tosa_bl_update_status,
39345 };
39346 diff -urNp linux-2.6.32.46/drivers/video/backlight/wm831x_bl.c linux-2.6.32.46/drivers/video/backlight/wm831x_bl.c
39347 --- linux-2.6.32.46/drivers/video/backlight/wm831x_bl.c 2011-03-27 14:31:47.000000000 -0400
39348 +++ linux-2.6.32.46/drivers/video/backlight/wm831x_bl.c 2011-04-17 15:56:46.000000000 -0400
39349 @@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightne
39350 return data->current_brightness;
39351 }
39352
39353 -static struct backlight_ops wm831x_backlight_ops = {
39354 +static const struct backlight_ops wm831x_backlight_ops = {
39355 .options = BL_CORE_SUSPENDRESUME,
39356 .update_status = wm831x_backlight_update_status,
39357 .get_brightness = wm831x_backlight_get_brightness,
39358 diff -urNp linux-2.6.32.46/drivers/video/bf54x-lq043fb.c linux-2.6.32.46/drivers/video/bf54x-lq043fb.c
39359 --- linux-2.6.32.46/drivers/video/bf54x-lq043fb.c 2011-03-27 14:31:47.000000000 -0400
39360 +++ linux-2.6.32.46/drivers/video/bf54x-lq043fb.c 2011-04-17 15:56:46.000000000 -0400
39361 @@ -463,7 +463,7 @@ static int bl_get_brightness(struct back
39362 return 0;
39363 }
39364
39365 -static struct backlight_ops bfin_lq043fb_bl_ops = {
39366 +static const struct backlight_ops bfin_lq043fb_bl_ops = {
39367 .get_brightness = bl_get_brightness,
39368 };
39369
39370 diff -urNp linux-2.6.32.46/drivers/video/bfin-t350mcqb-fb.c linux-2.6.32.46/drivers/video/bfin-t350mcqb-fb.c
39371 --- linux-2.6.32.46/drivers/video/bfin-t350mcqb-fb.c 2011-03-27 14:31:47.000000000 -0400
39372 +++ linux-2.6.32.46/drivers/video/bfin-t350mcqb-fb.c 2011-04-17 15:56:46.000000000 -0400
39373 @@ -381,7 +381,7 @@ static int bl_get_brightness(struct back
39374 return 0;
39375 }
39376
39377 -static struct backlight_ops bfin_lq043fb_bl_ops = {
39378 +static const struct backlight_ops bfin_lq043fb_bl_ops = {
39379 .get_brightness = bl_get_brightness,
39380 };
39381
39382 diff -urNp linux-2.6.32.46/drivers/video/fbcmap.c linux-2.6.32.46/drivers/video/fbcmap.c
39383 --- linux-2.6.32.46/drivers/video/fbcmap.c 2011-03-27 14:31:47.000000000 -0400
39384 +++ linux-2.6.32.46/drivers/video/fbcmap.c 2011-04-17 15:56:46.000000000 -0400
39385 @@ -266,8 +266,7 @@ int fb_set_user_cmap(struct fb_cmap_user
39386 rc = -ENODEV;
39387 goto out;
39388 }
39389 - if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
39390 - !info->fbops->fb_setcmap)) {
39391 + if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
39392 rc = -EINVAL;
39393 goto out1;
39394 }
39395 diff -urNp linux-2.6.32.46/drivers/video/fbmem.c linux-2.6.32.46/drivers/video/fbmem.c
39396 --- linux-2.6.32.46/drivers/video/fbmem.c 2011-03-27 14:31:47.000000000 -0400
39397 +++ linux-2.6.32.46/drivers/video/fbmem.c 2011-05-16 21:46:57.000000000 -0400
39398 @@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_in
39399 image->dx += image->width + 8;
39400 }
39401 } else if (rotate == FB_ROTATE_UD) {
39402 - for (x = 0; x < num && image->dx >= 0; x++) {
39403 + for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
39404 info->fbops->fb_imageblit(info, image);
39405 image->dx -= image->width + 8;
39406 }
39407 @@ -415,7 +415,7 @@ static void fb_do_show_logo(struct fb_in
39408 image->dy += image->height + 8;
39409 }
39410 } else if (rotate == FB_ROTATE_CCW) {
39411 - for (x = 0; x < num && image->dy >= 0; x++) {
39412 + for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
39413 info->fbops->fb_imageblit(info, image);
39414 image->dy -= image->height + 8;
39415 }
39416 @@ -915,6 +915,8 @@ fb_set_var(struct fb_info *info, struct
39417 int flags = info->flags;
39418 int ret = 0;
39419
39420 + pax_track_stack();
39421 +
39422 if (var->activate & FB_ACTIVATE_INV_MODE) {
39423 struct fb_videomode mode1, mode2;
39424
39425 @@ -1040,6 +1042,8 @@ static long do_fb_ioctl(struct fb_info *
39426 void __user *argp = (void __user *)arg;
39427 long ret = 0;
39428
39429 + pax_track_stack();
39430 +
39431 switch (cmd) {
39432 case FBIOGET_VSCREENINFO:
39433 if (!lock_fb_info(info))
39434 @@ -1119,7 +1123,7 @@ static long do_fb_ioctl(struct fb_info *
39435 return -EFAULT;
39436 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
39437 return -EINVAL;
39438 - if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
39439 + if (con2fb.framebuffer >= FB_MAX)
39440 return -EINVAL;
39441 if (!registered_fb[con2fb.framebuffer])
39442 request_module("fb%d", con2fb.framebuffer);
39443 diff -urNp linux-2.6.32.46/drivers/video/i810/i810_accel.c linux-2.6.32.46/drivers/video/i810/i810_accel.c
39444 --- linux-2.6.32.46/drivers/video/i810/i810_accel.c 2011-03-27 14:31:47.000000000 -0400
39445 +++ linux-2.6.32.46/drivers/video/i810/i810_accel.c 2011-04-17 15:56:46.000000000 -0400
39446 @@ -73,6 +73,7 @@ static inline int wait_for_space(struct
39447 }
39448 }
39449 printk("ringbuffer lockup!!!\n");
39450 + printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
39451 i810_report_error(mmio);
39452 par->dev_flags |= LOCKUP;
39453 info->pixmap.scan_align = 1;
39454 diff -urNp linux-2.6.32.46/drivers/video/logo/logo_linux_clut224.ppm linux-2.6.32.46/drivers/video/logo/logo_linux_clut224.ppm
39455 --- linux-2.6.32.46/drivers/video/logo/logo_linux_clut224.ppm 2011-03-27 14:31:47.000000000 -0400
39456 +++ linux-2.6.32.46/drivers/video/logo/logo_linux_clut224.ppm 2011-08-29 23:49:24.000000000 -0400
39457 @@ -1,1604 +1,1123 @@
39458 P3
39459 -# Standard 224-color Linux logo
39460 80 80
39461 255
39462 - 0 0 0 0 0 0 0 0 0 0 0 0
39463 - 0 0 0 0 0 0 0 0 0 0 0 0
39464 - 0 0 0 0 0 0 0 0 0 0 0 0
39465 - 0 0 0 0 0 0 0 0 0 0 0 0
39466 - 0 0 0 0 0 0 0 0 0 0 0 0
39467 - 0 0 0 0 0 0 0 0 0 0 0 0
39468 - 0 0 0 0 0 0 0 0 0 0 0 0
39469 - 0 0 0 0 0 0 0 0 0 0 0 0
39470 - 0 0 0 0 0 0 0 0 0 0 0 0
39471 - 6 6 6 6 6 6 10 10 10 10 10 10
39472 - 10 10 10 6 6 6 6 6 6 6 6 6
39473 - 0 0 0 0 0 0 0 0 0 0 0 0
39474 - 0 0 0 0 0 0 0 0 0 0 0 0
39475 - 0 0 0 0 0 0 0 0 0 0 0 0
39476 - 0 0 0 0 0 0 0 0 0 0 0 0
39477 - 0 0 0 0 0 0 0 0 0 0 0 0
39478 - 0 0 0 0 0 0 0 0 0 0 0 0
39479 - 0 0 0 0 0 0 0 0 0 0 0 0
39480 - 0 0 0 0 0 0 0 0 0 0 0 0
39481 - 0 0 0 0 0 0 0 0 0 0 0 0
39482 - 0 0 0 0 0 0 0 0 0 0 0 0
39483 - 0 0 0 0 0 0 0 0 0 0 0 0
39484 - 0 0 0 0 0 0 0 0 0 0 0 0
39485 - 0 0 0 0 0 0 0 0 0 0 0 0
39486 - 0 0 0 0 0 0 0 0 0 0 0 0
39487 - 0 0 0 0 0 0 0 0 0 0 0 0
39488 - 0 0 0 0 0 0 0 0 0 0 0 0
39489 - 0 0 0 0 0 0 0 0 0 0 0 0
39490 - 0 0 0 6 6 6 10 10 10 14 14 14
39491 - 22 22 22 26 26 26 30 30 30 34 34 34
39492 - 30 30 30 30 30 30 26 26 26 18 18 18
39493 - 14 14 14 10 10 10 6 6 6 0 0 0
39494 - 0 0 0 0 0 0 0 0 0 0 0 0
39495 - 0 0 0 0 0 0 0 0 0 0 0 0
39496 - 0 0 0 0 0 0 0 0 0 0 0 0
39497 - 0 0 0 0 0 0 0 0 0 0 0 0
39498 - 0 0 0 0 0 0 0 0 0 0 0 0
39499 - 0 0 0 0 0 0 0 0 0 0 0 0
39500 - 0 0 0 0 0 0 0 0 0 0 0 0
39501 - 0 0 0 0 0 0 0 0 0 0 0 0
39502 - 0 0 0 0 0 0 0 0 0 0 0 0
39503 - 0 0 0 0 0 1 0 0 1 0 0 0
39504 - 0 0 0 0 0 0 0 0 0 0 0 0
39505 - 0 0 0 0 0 0 0 0 0 0 0 0
39506 - 0 0 0 0 0 0 0 0 0 0 0 0
39507 - 0 0 0 0 0 0 0 0 0 0 0 0
39508 - 0 0 0 0 0 0 0 0 0 0 0 0
39509 - 0 0 0 0 0 0 0 0 0 0 0 0
39510 - 6 6 6 14 14 14 26 26 26 42 42 42
39511 - 54 54 54 66 66 66 78 78 78 78 78 78
39512 - 78 78 78 74 74 74 66 66 66 54 54 54
39513 - 42 42 42 26 26 26 18 18 18 10 10 10
39514 - 6 6 6 0 0 0 0 0 0 0 0 0
39515 - 0 0 0 0 0 0 0 0 0 0 0 0
39516 - 0 0 0 0 0 0 0 0 0 0 0 0
39517 - 0 0 0 0 0 0 0 0 0 0 0 0
39518 - 0 0 0 0 0 0 0 0 0 0 0 0
39519 - 0 0 0 0 0 0 0 0 0 0 0 0
39520 - 0 0 0 0 0 0 0 0 0 0 0 0
39521 - 0 0 0 0 0 0 0 0 0 0 0 0
39522 - 0 0 0 0 0 0 0 0 0 0 0 0
39523 - 0 0 1 0 0 0 0 0 0 0 0 0
39524 - 0 0 0 0 0 0 0 0 0 0 0 0
39525 - 0 0 0 0 0 0 0 0 0 0 0 0
39526 - 0 0 0 0 0 0 0 0 0 0 0 0
39527 - 0 0 0 0 0 0 0 0 0 0 0 0
39528 - 0 0 0 0 0 0 0 0 0 0 0 0
39529 - 0 0 0 0 0 0 0 0 0 10 10 10
39530 - 22 22 22 42 42 42 66 66 66 86 86 86
39531 - 66 66 66 38 38 38 38 38 38 22 22 22
39532 - 26 26 26 34 34 34 54 54 54 66 66 66
39533 - 86 86 86 70 70 70 46 46 46 26 26 26
39534 - 14 14 14 6 6 6 0 0 0 0 0 0
39535 - 0 0 0 0 0 0 0 0 0 0 0 0
39536 - 0 0 0 0 0 0 0 0 0 0 0 0
39537 - 0 0 0 0 0 0 0 0 0 0 0 0
39538 - 0 0 0 0 0 0 0 0 0 0 0 0
39539 - 0 0 0 0 0 0 0 0 0 0 0 0
39540 - 0 0 0 0 0 0 0 0 0 0 0 0
39541 - 0 0 0 0 0 0 0 0 0 0 0 0
39542 - 0 0 0 0 0 0 0 0 0 0 0 0
39543 - 0 0 1 0 0 1 0 0 1 0 0 0
39544 - 0 0 0 0 0 0 0 0 0 0 0 0
39545 - 0 0 0 0 0 0 0 0 0 0 0 0
39546 - 0 0 0 0 0 0 0 0 0 0 0 0
39547 - 0 0 0 0 0 0 0 0 0 0 0 0
39548 - 0 0 0 0 0 0 0 0 0 0 0 0
39549 - 0 0 0 0 0 0 10 10 10 26 26 26
39550 - 50 50 50 82 82 82 58 58 58 6 6 6
39551 - 2 2 6 2 2 6 2 2 6 2 2 6
39552 - 2 2 6 2 2 6 2 2 6 2 2 6
39553 - 6 6 6 54 54 54 86 86 86 66 66 66
39554 - 38 38 38 18 18 18 6 6 6 0 0 0
39555 - 0 0 0 0 0 0 0 0 0 0 0 0
39556 - 0 0 0 0 0 0 0 0 0 0 0 0
39557 - 0 0 0 0 0 0 0 0 0 0 0 0
39558 - 0 0 0 0 0 0 0 0 0 0 0 0
39559 - 0 0 0 0 0 0 0 0 0 0 0 0
39560 - 0 0 0 0 0 0 0 0 0 0 0 0
39561 - 0 0 0 0 0 0 0 0 0 0 0 0
39562 - 0 0 0 0 0 0 0 0 0 0 0 0
39563 - 0 0 0 0 0 0 0 0 0 0 0 0
39564 - 0 0 0 0 0 0 0 0 0 0 0 0
39565 - 0 0 0 0 0 0 0 0 0 0 0 0
39566 - 0 0 0 0 0 0 0 0 0 0 0 0
39567 - 0 0 0 0 0 0 0 0 0 0 0 0
39568 - 0 0 0 0 0 0 0 0 0 0 0 0
39569 - 0 0 0 6 6 6 22 22 22 50 50 50
39570 - 78 78 78 34 34 34 2 2 6 2 2 6
39571 - 2 2 6 2 2 6 2 2 6 2 2 6
39572 - 2 2 6 2 2 6 2 2 6 2 2 6
39573 - 2 2 6 2 2 6 6 6 6 70 70 70
39574 - 78 78 78 46 46 46 22 22 22 6 6 6
39575 - 0 0 0 0 0 0 0 0 0 0 0 0
39576 - 0 0 0 0 0 0 0 0 0 0 0 0
39577 - 0 0 0 0 0 0 0 0 0 0 0 0
39578 - 0 0 0 0 0 0 0 0 0 0 0 0
39579 - 0 0 0 0 0 0 0 0 0 0 0 0
39580 - 0 0 0 0 0 0 0 0 0 0 0 0
39581 - 0 0 0 0 0 0 0 0 0 0 0 0
39582 - 0 0 0 0 0 0 0 0 0 0 0 0
39583 - 0 0 1 0 0 1 0 0 1 0 0 0
39584 - 0 0 0 0 0 0 0 0 0 0 0 0
39585 - 0 0 0 0 0 0 0 0 0 0 0 0
39586 - 0 0 0 0 0 0 0 0 0 0 0 0
39587 - 0 0 0 0 0 0 0 0 0 0 0 0
39588 - 0 0 0 0 0 0 0 0 0 0 0 0
39589 - 6 6 6 18 18 18 42 42 42 82 82 82
39590 - 26 26 26 2 2 6 2 2 6 2 2 6
39591 - 2 2 6 2 2 6 2 2 6 2 2 6
39592 - 2 2 6 2 2 6 2 2 6 14 14 14
39593 - 46 46 46 34 34 34 6 6 6 2 2 6
39594 - 42 42 42 78 78 78 42 42 42 18 18 18
39595 - 6 6 6 0 0 0 0 0 0 0 0 0
39596 - 0 0 0 0 0 0 0 0 0 0 0 0
39597 - 0 0 0 0 0 0 0 0 0 0 0 0
39598 - 0 0 0 0 0 0 0 0 0 0 0 0
39599 - 0 0 0 0 0 0 0 0 0 0 0 0
39600 - 0 0 0 0 0 0 0 0 0 0 0 0
39601 - 0 0 0 0 0 0 0 0 0 0 0 0
39602 - 0 0 0 0 0 0 0 0 0 0 0 0
39603 - 0 0 1 0 0 0 0 0 1 0 0 0
39604 - 0 0 0 0 0 0 0 0 0 0 0 0
39605 - 0 0 0 0 0 0 0 0 0 0 0 0
39606 - 0 0 0 0 0 0 0 0 0 0 0 0
39607 - 0 0 0 0 0 0 0 0 0 0 0 0
39608 - 0 0 0 0 0 0 0 0 0 0 0 0
39609 - 10 10 10 30 30 30 66 66 66 58 58 58
39610 - 2 2 6 2 2 6 2 2 6 2 2 6
39611 - 2 2 6 2 2 6 2 2 6 2 2 6
39612 - 2 2 6 2 2 6 2 2 6 26 26 26
39613 - 86 86 86 101 101 101 46 46 46 10 10 10
39614 - 2 2 6 58 58 58 70 70 70 34 34 34
39615 - 10 10 10 0 0 0 0 0 0 0 0 0
39616 - 0 0 0 0 0 0 0 0 0 0 0 0
39617 - 0 0 0 0 0 0 0 0 0 0 0 0
39618 - 0 0 0 0 0 0 0 0 0 0 0 0
39619 - 0 0 0 0 0 0 0 0 0 0 0 0
39620 - 0 0 0 0 0 0 0 0 0 0 0 0
39621 - 0 0 0 0 0 0 0 0 0 0 0 0
39622 - 0 0 0 0 0 0 0 0 0 0 0 0
39623 - 0 0 1 0 0 1 0 0 1 0 0 0
39624 - 0 0 0 0 0 0 0 0 0 0 0 0
39625 - 0 0 0 0 0 0 0 0 0 0 0 0
39626 - 0 0 0 0 0 0 0 0 0 0 0 0
39627 - 0 0 0 0 0 0 0 0 0 0 0 0
39628 - 0 0 0 0 0 0 0 0 0 0 0 0
39629 - 14 14 14 42 42 42 86 86 86 10 10 10
39630 - 2 2 6 2 2 6 2 2 6 2 2 6
39631 - 2 2 6 2 2 6 2 2 6 2 2 6
39632 - 2 2 6 2 2 6 2 2 6 30 30 30
39633 - 94 94 94 94 94 94 58 58 58 26 26 26
39634 - 2 2 6 6 6 6 78 78 78 54 54 54
39635 - 22 22 22 6 6 6 0 0 0 0 0 0
39636 - 0 0 0 0 0 0 0 0 0 0 0 0
39637 - 0 0 0 0 0 0 0 0 0 0 0 0
39638 - 0 0 0 0 0 0 0 0 0 0 0 0
39639 - 0 0 0 0 0 0 0 0 0 0 0 0
39640 - 0 0 0 0 0 0 0 0 0 0 0 0
39641 - 0 0 0 0 0 0 0 0 0 0 0 0
39642 - 0 0 0 0 0 0 0 0 0 0 0 0
39643 - 0 0 0 0 0 0 0 0 0 0 0 0
39644 - 0 0 0 0 0 0 0 0 0 0 0 0
39645 - 0 0 0 0 0 0 0 0 0 0 0 0
39646 - 0 0 0 0 0 0 0 0 0 0 0 0
39647 - 0 0 0 0 0 0 0 0 0 0 0 0
39648 - 0 0 0 0 0 0 0 0 0 6 6 6
39649 - 22 22 22 62 62 62 62 62 62 2 2 6
39650 - 2 2 6 2 2 6 2 2 6 2 2 6
39651 - 2 2 6 2 2 6 2 2 6 2 2 6
39652 - 2 2 6 2 2 6 2 2 6 26 26 26
39653 - 54 54 54 38 38 38 18 18 18 10 10 10
39654 - 2 2 6 2 2 6 34 34 34 82 82 82
39655 - 38 38 38 14 14 14 0 0 0 0 0 0
39656 - 0 0 0 0 0 0 0 0 0 0 0 0
39657 - 0 0 0 0 0 0 0 0 0 0 0 0
39658 - 0 0 0 0 0 0 0 0 0 0 0 0
39659 - 0 0 0 0 0 0 0 0 0 0 0 0
39660 - 0 0 0 0 0 0 0 0 0 0 0 0
39661 - 0 0 0 0 0 0 0 0 0 0 0 0
39662 - 0 0 0 0 0 0 0 0 0 0 0 0
39663 - 0 0 0 0 0 1 0 0 1 0 0 0
39664 - 0 0 0 0 0 0 0 0 0 0 0 0
39665 - 0 0 0 0 0 0 0 0 0 0 0 0
39666 - 0 0 0 0 0 0 0 0 0 0 0 0
39667 - 0 0 0 0 0 0 0 0 0 0 0 0
39668 - 0 0 0 0 0 0 0 0 0 6 6 6
39669 - 30 30 30 78 78 78 30 30 30 2 2 6
39670 - 2 2 6 2 2 6 2 2 6 2 2 6
39671 - 2 2 6 2 2 6 2 2 6 2 2 6
39672 - 2 2 6 2 2 6 2 2 6 10 10 10
39673 - 10 10 10 2 2 6 2 2 6 2 2 6
39674 - 2 2 6 2 2 6 2 2 6 78 78 78
39675 - 50 50 50 18 18 18 6 6 6 0 0 0
39676 - 0 0 0 0 0 0 0 0 0 0 0 0
39677 - 0 0 0 0 0 0 0 0 0 0 0 0
39678 - 0 0 0 0 0 0 0 0 0 0 0 0
39679 - 0 0 0 0 0 0 0 0 0 0 0 0
39680 - 0 0 0 0 0 0 0 0 0 0 0 0
39681 - 0 0 0 0 0 0 0 0 0 0 0 0
39682 - 0 0 0 0 0 0 0 0 0 0 0 0
39683 - 0 0 1 0 0 0 0 0 0 0 0 0
39684 - 0 0 0 0 0 0 0 0 0 0 0 0
39685 - 0 0 0 0 0 0 0 0 0 0 0 0
39686 - 0 0 0 0 0 0 0 0 0 0 0 0
39687 - 0 0 0 0 0 0 0 0 0 0 0 0
39688 - 0 0 0 0 0 0 0 0 0 10 10 10
39689 - 38 38 38 86 86 86 14 14 14 2 2 6
39690 - 2 2 6 2 2 6 2 2 6 2 2 6
39691 - 2 2 6 2 2 6 2 2 6 2 2 6
39692 - 2 2 6 2 2 6 2 2 6 2 2 6
39693 - 2 2 6 2 2 6 2 2 6 2 2 6
39694 - 2 2 6 2 2 6 2 2 6 54 54 54
39695 - 66 66 66 26 26 26 6 6 6 0 0 0
39696 - 0 0 0 0 0 0 0 0 0 0 0 0
39697 - 0 0 0 0 0 0 0 0 0 0 0 0
39698 - 0 0 0 0 0 0 0 0 0 0 0 0
39699 - 0 0 0 0 0 0 0 0 0 0 0 0
39700 - 0 0 0 0 0 0 0 0 0 0 0 0
39701 - 0 0 0 0 0 0 0 0 0 0 0 0
39702 - 0 0 0 0 0 0 0 0 0 0 0 0
39703 - 0 0 0 0 0 1 0 0 1 0 0 0
39704 - 0 0 0 0 0 0 0 0 0 0 0 0
39705 - 0 0 0 0 0 0 0 0 0 0 0 0
39706 - 0 0 0 0 0 0 0 0 0 0 0 0
39707 - 0 0 0 0 0 0 0 0 0 0 0 0
39708 - 0 0 0 0 0 0 0 0 0 14 14 14
39709 - 42 42 42 82 82 82 2 2 6 2 2 6
39710 - 2 2 6 6 6 6 10 10 10 2 2 6
39711 - 2 2 6 2 2 6 2 2 6 2 2 6
39712 - 2 2 6 2 2 6 2 2 6 6 6 6
39713 - 14 14 14 10 10 10 2 2 6 2 2 6
39714 - 2 2 6 2 2 6 2 2 6 18 18 18
39715 - 82 82 82 34 34 34 10 10 10 0 0 0
39716 - 0 0 0 0 0 0 0 0 0 0 0 0
39717 - 0 0 0 0 0 0 0 0 0 0 0 0
39718 - 0 0 0 0 0 0 0 0 0 0 0 0
39719 - 0 0 0 0 0 0 0 0 0 0 0 0
39720 - 0 0 0 0 0 0 0 0 0 0 0 0
39721 - 0 0 0 0 0 0 0 0 0 0 0 0
39722 - 0 0 0 0 0 0 0 0 0 0 0 0
39723 - 0 0 1 0 0 0 0 0 0 0 0 0
39724 - 0 0 0 0 0 0 0 0 0 0 0 0
39725 - 0 0 0 0 0 0 0 0 0 0 0 0
39726 - 0 0 0 0 0 0 0 0 0 0 0 0
39727 - 0 0 0 0 0 0 0 0 0 0 0 0
39728 - 0 0 0 0 0 0 0 0 0 14 14 14
39729 - 46 46 46 86 86 86 2 2 6 2 2 6
39730 - 6 6 6 6 6 6 22 22 22 34 34 34
39731 - 6 6 6 2 2 6 2 2 6 2 2 6
39732 - 2 2 6 2 2 6 18 18 18 34 34 34
39733 - 10 10 10 50 50 50 22 22 22 2 2 6
39734 - 2 2 6 2 2 6 2 2 6 10 10 10
39735 - 86 86 86 42 42 42 14 14 14 0 0 0
39736 - 0 0 0 0 0 0 0 0 0 0 0 0
39737 - 0 0 0 0 0 0 0 0 0 0 0 0
39738 - 0 0 0 0 0 0 0 0 0 0 0 0
39739 - 0 0 0 0 0 0 0 0 0 0 0 0
39740 - 0 0 0 0 0 0 0 0 0 0 0 0
39741 - 0 0 0 0 0 0 0 0 0 0 0 0
39742 - 0 0 0 0 0 0 0 0 0 0 0 0
39743 - 0 0 1 0 0 1 0 0 1 0 0 0
39744 - 0 0 0 0 0 0 0 0 0 0 0 0
39745 - 0 0 0 0 0 0 0 0 0 0 0 0
39746 - 0 0 0 0 0 0 0 0 0 0 0 0
39747 - 0 0 0 0 0 0 0 0 0 0 0 0
39748 - 0 0 0 0 0 0 0 0 0 14 14 14
39749 - 46 46 46 86 86 86 2 2 6 2 2 6
39750 - 38 38 38 116 116 116 94 94 94 22 22 22
39751 - 22 22 22 2 2 6 2 2 6 2 2 6
39752 - 14 14 14 86 86 86 138 138 138 162 162 162
39753 -154 154 154 38 38 38 26 26 26 6 6 6
39754 - 2 2 6 2 2 6 2 2 6 2 2 6
39755 - 86 86 86 46 46 46 14 14 14 0 0 0
39756 - 0 0 0 0 0 0 0 0 0 0 0 0
39757 - 0 0 0 0 0 0 0 0 0 0 0 0
39758 - 0 0 0 0 0 0 0 0 0 0 0 0
39759 - 0 0 0 0 0 0 0 0 0 0 0 0
39760 - 0 0 0 0 0 0 0 0 0 0 0 0
39761 - 0 0 0 0 0 0 0 0 0 0 0 0
39762 - 0 0 0 0 0 0 0 0 0 0 0 0
39763 - 0 0 0 0 0 0 0 0 0 0 0 0
39764 - 0 0 0 0 0 0 0 0 0 0 0 0
39765 - 0 0 0 0 0 0 0 0 0 0 0 0
39766 - 0 0 0 0 0 0 0 0 0 0 0 0
39767 - 0 0 0 0 0 0 0 0 0 0 0 0
39768 - 0 0 0 0 0 0 0 0 0 14 14 14
39769 - 46 46 46 86 86 86 2 2 6 14 14 14
39770 -134 134 134 198 198 198 195 195 195 116 116 116
39771 - 10 10 10 2 2 6 2 2 6 6 6 6
39772 -101 98 89 187 187 187 210 210 210 218 218 218
39773 -214 214 214 134 134 134 14 14 14 6 6 6
39774 - 2 2 6 2 2 6 2 2 6 2 2 6
39775 - 86 86 86 50 50 50 18 18 18 6 6 6
39776 - 0 0 0 0 0 0 0 0 0 0 0 0
39777 - 0 0 0 0 0 0 0 0 0 0 0 0
39778 - 0 0 0 0 0 0 0 0 0 0 0 0
39779 - 0 0 0 0 0 0 0 0 0 0 0 0
39780 - 0 0 0 0 0 0 0 0 0 0 0 0
39781 - 0 0 0 0 0 0 0 0 0 0 0 0
39782 - 0 0 0 0 0 0 0 0 1 0 0 0
39783 - 0 0 1 0 0 1 0 0 1 0 0 0
39784 - 0 0 0 0 0 0 0 0 0 0 0 0
39785 - 0 0 0 0 0 0 0 0 0 0 0 0
39786 - 0 0 0 0 0 0 0 0 0 0 0 0
39787 - 0 0 0 0 0 0 0 0 0 0 0 0
39788 - 0 0 0 0 0 0 0 0 0 14 14 14
39789 - 46 46 46 86 86 86 2 2 6 54 54 54
39790 -218 218 218 195 195 195 226 226 226 246 246 246
39791 - 58 58 58 2 2 6 2 2 6 30 30 30
39792 -210 210 210 253 253 253 174 174 174 123 123 123
39793 -221 221 221 234 234 234 74 74 74 2 2 6
39794 - 2 2 6 2 2 6 2 2 6 2 2 6
39795 - 70 70 70 58 58 58 22 22 22 6 6 6
39796 - 0 0 0 0 0 0 0 0 0 0 0 0
39797 - 0 0 0 0 0 0 0 0 0 0 0 0
39798 - 0 0 0 0 0 0 0 0 0 0 0 0
39799 - 0 0 0 0 0 0 0 0 0 0 0 0
39800 - 0 0 0 0 0 0 0 0 0 0 0 0
39801 - 0 0 0 0 0 0 0 0 0 0 0 0
39802 - 0 0 0 0 0 0 0 0 0 0 0 0
39803 - 0 0 0 0 0 0 0 0 0 0 0 0
39804 - 0 0 0 0 0 0 0 0 0 0 0 0
39805 - 0 0 0 0 0 0 0 0 0 0 0 0
39806 - 0 0 0 0 0 0 0 0 0 0 0 0
39807 - 0 0 0 0 0 0 0 0 0 0 0 0
39808 - 0 0 0 0 0 0 0 0 0 14 14 14
39809 - 46 46 46 82 82 82 2 2 6 106 106 106
39810 -170 170 170 26 26 26 86 86 86 226 226 226
39811 -123 123 123 10 10 10 14 14 14 46 46 46
39812 -231 231 231 190 190 190 6 6 6 70 70 70
39813 - 90 90 90 238 238 238 158 158 158 2 2 6
39814 - 2 2 6 2 2 6 2 2 6 2 2 6
39815 - 70 70 70 58 58 58 22 22 22 6 6 6
39816 - 0 0 0 0 0 0 0 0 0 0 0 0
39817 - 0 0 0 0 0 0 0 0 0 0 0 0
39818 - 0 0 0 0 0 0 0 0 0 0 0 0
39819 - 0 0 0 0 0 0 0 0 0 0 0 0
39820 - 0 0 0 0 0 0 0 0 0 0 0 0
39821 - 0 0 0 0 0 0 0 0 0 0 0 0
39822 - 0 0 0 0 0 0 0 0 1 0 0 0
39823 - 0 0 1 0 0 1 0 0 1 0 0 0
39824 - 0 0 0 0 0 0 0 0 0 0 0 0
39825 - 0 0 0 0 0 0 0 0 0 0 0 0
39826 - 0 0 0 0 0 0 0 0 0 0 0 0
39827 - 0 0 0 0 0 0 0 0 0 0 0 0
39828 - 0 0 0 0 0 0 0 0 0 14 14 14
39829 - 42 42 42 86 86 86 6 6 6 116 116 116
39830 -106 106 106 6 6 6 70 70 70 149 149 149
39831 -128 128 128 18 18 18 38 38 38 54 54 54
39832 -221 221 221 106 106 106 2 2 6 14 14 14
39833 - 46 46 46 190 190 190 198 198 198 2 2 6
39834 - 2 2 6 2 2 6 2 2 6 2 2 6
39835 - 74 74 74 62 62 62 22 22 22 6 6 6
39836 - 0 0 0 0 0 0 0 0 0 0 0 0
39837 - 0 0 0 0 0 0 0 0 0 0 0 0
39838 - 0 0 0 0 0 0 0 0 0 0 0 0
39839 - 0 0 0 0 0 0 0 0 0 0 0 0
39840 - 0 0 0 0 0 0 0 0 0 0 0 0
39841 - 0 0 0 0 0 0 0 0 0 0 0 0
39842 - 0 0 0 0 0 0 0 0 1 0 0 0
39843 - 0 0 1 0 0 0 0 0 1 0 0 0
39844 - 0 0 0 0 0 0 0 0 0 0 0 0
39845 - 0 0 0 0 0 0 0 0 0 0 0 0
39846 - 0 0 0 0 0 0 0 0 0 0 0 0
39847 - 0 0 0 0 0 0 0 0 0 0 0 0
39848 - 0 0 0 0 0 0 0 0 0 14 14 14
39849 - 42 42 42 94 94 94 14 14 14 101 101 101
39850 -128 128 128 2 2 6 18 18 18 116 116 116
39851 -118 98 46 121 92 8 121 92 8 98 78 10
39852 -162 162 162 106 106 106 2 2 6 2 2 6
39853 - 2 2 6 195 195 195 195 195 195 6 6 6
39854 - 2 2 6 2 2 6 2 2 6 2 2 6
39855 - 74 74 74 62 62 62 22 22 22 6 6 6
39856 - 0 0 0 0 0 0 0 0 0 0 0 0
39857 - 0 0 0 0 0 0 0 0 0 0 0 0
39858 - 0 0 0 0 0 0 0 0 0 0 0 0
39859 - 0 0 0 0 0 0 0 0 0 0 0 0
39860 - 0 0 0 0 0 0 0 0 0 0 0 0
39861 - 0 0 0 0 0 0 0 0 0 0 0 0
39862 - 0 0 0 0 0 0 0 0 1 0 0 1
39863 - 0 0 1 0 0 0 0 0 1 0 0 0
39864 - 0 0 0 0 0 0 0 0 0 0 0 0
39865 - 0 0 0 0 0 0 0 0 0 0 0 0
39866 - 0 0 0 0 0 0 0 0 0 0 0 0
39867 - 0 0 0 0 0 0 0 0 0 0 0 0
39868 - 0 0 0 0 0 0 0 0 0 10 10 10
39869 - 38 38 38 90 90 90 14 14 14 58 58 58
39870 -210 210 210 26 26 26 54 38 6 154 114 10
39871 -226 170 11 236 186 11 225 175 15 184 144 12
39872 -215 174 15 175 146 61 37 26 9 2 2 6
39873 - 70 70 70 246 246 246 138 138 138 2 2 6
39874 - 2 2 6 2 2 6 2 2 6 2 2 6
39875 - 70 70 70 66 66 66 26 26 26 6 6 6
39876 - 0 0 0 0 0 0 0 0 0 0 0 0
39877 - 0 0 0 0 0 0 0 0 0 0 0 0
39878 - 0 0 0 0 0 0 0 0 0 0 0 0
39879 - 0 0 0 0 0 0 0 0 0 0 0 0
39880 - 0 0 0 0 0 0 0 0 0 0 0 0
39881 - 0 0 0 0 0 0 0 0 0 0 0 0
39882 - 0 0 0 0 0 0 0 0 0 0 0 0
39883 - 0 0 0 0 0 0 0 0 0 0 0 0
39884 - 0 0 0 0 0 0 0 0 0 0 0 0
39885 - 0 0 0 0 0 0 0 0 0 0 0 0
39886 - 0 0 0 0 0 0 0 0 0 0 0 0
39887 - 0 0 0 0 0 0 0 0 0 0 0 0
39888 - 0 0 0 0 0 0 0 0 0 10 10 10
39889 - 38 38 38 86 86 86 14 14 14 10 10 10
39890 -195 195 195 188 164 115 192 133 9 225 175 15
39891 -239 182 13 234 190 10 232 195 16 232 200 30
39892 -245 207 45 241 208 19 232 195 16 184 144 12
39893 -218 194 134 211 206 186 42 42 42 2 2 6
39894 - 2 2 6 2 2 6 2 2 6 2 2 6
39895 - 50 50 50 74 74 74 30 30 30 6 6 6
39896 - 0 0 0 0 0 0 0 0 0 0 0 0
39897 - 0 0 0 0 0 0 0 0 0 0 0 0
39898 - 0 0 0 0 0 0 0 0 0 0 0 0
39899 - 0 0 0 0 0 0 0 0 0 0 0 0
39900 - 0 0 0 0 0 0 0 0 0 0 0 0
39901 - 0 0 0 0 0 0 0 0 0 0 0 0
39902 - 0 0 0 0 0 0 0 0 0 0 0 0
39903 - 0 0 0 0 0 0 0 0 0 0 0 0
39904 - 0 0 0 0 0 0 0 0 0 0 0 0
39905 - 0 0 0 0 0 0 0 0 0 0 0 0
39906 - 0 0 0 0 0 0 0 0 0 0 0 0
39907 - 0 0 0 0 0 0 0 0 0 0 0 0
39908 - 0 0 0 0 0 0 0 0 0 10 10 10
39909 - 34 34 34 86 86 86 14 14 14 2 2 6
39910 -121 87 25 192 133 9 219 162 10 239 182 13
39911 -236 186 11 232 195 16 241 208 19 244 214 54
39912 -246 218 60 246 218 38 246 215 20 241 208 19
39913 -241 208 19 226 184 13 121 87 25 2 2 6
39914 - 2 2 6 2 2 6 2 2 6 2 2 6
39915 - 50 50 50 82 82 82 34 34 34 10 10 10
39916 - 0 0 0 0 0 0 0 0 0 0 0 0
39917 - 0 0 0 0 0 0 0 0 0 0 0 0
39918 - 0 0 0 0 0 0 0 0 0 0 0 0
39919 - 0 0 0 0 0 0 0 0 0 0 0 0
39920 - 0 0 0 0 0 0 0 0 0 0 0 0
39921 - 0 0 0 0 0 0 0 0 0 0 0 0
39922 - 0 0 0 0 0 0 0 0 0 0 0 0
39923 - 0 0 0 0 0 0 0 0 0 0 0 0
39924 - 0 0 0 0 0 0 0 0 0 0 0 0
39925 - 0 0 0 0 0 0 0 0 0 0 0 0
39926 - 0 0 0 0 0 0 0 0 0 0 0 0
39927 - 0 0 0 0 0 0 0 0 0 0 0 0
39928 - 0 0 0 0 0 0 0 0 0 10 10 10
39929 - 34 34 34 82 82 82 30 30 30 61 42 6
39930 -180 123 7 206 145 10 230 174 11 239 182 13
39931 -234 190 10 238 202 15 241 208 19 246 218 74
39932 -246 218 38 246 215 20 246 215 20 246 215 20
39933 -226 184 13 215 174 15 184 144 12 6 6 6
39934 - 2 2 6 2 2 6 2 2 6 2 2 6
39935 - 26 26 26 94 94 94 42 42 42 14 14 14
39936 - 0 0 0 0 0 0 0 0 0 0 0 0
39937 - 0 0 0 0 0 0 0 0 0 0 0 0
39938 - 0 0 0 0 0 0 0 0 0 0 0 0
39939 - 0 0 0 0 0 0 0 0 0 0 0 0
39940 - 0 0 0 0 0 0 0 0 0 0 0 0
39941 - 0 0 0 0 0 0 0 0 0 0 0 0
39942 - 0 0 0 0 0 0 0 0 0 0 0 0
39943 - 0 0 0 0 0 0 0 0 0 0 0 0
39944 - 0 0 0 0 0 0 0 0 0 0 0 0
39945 - 0 0 0 0 0 0 0 0 0 0 0 0
39946 - 0 0 0 0 0 0 0 0 0 0 0 0
39947 - 0 0 0 0 0 0 0 0 0 0 0 0
39948 - 0 0 0 0 0 0 0 0 0 10 10 10
39949 - 30 30 30 78 78 78 50 50 50 104 69 6
39950 -192 133 9 216 158 10 236 178 12 236 186 11
39951 -232 195 16 241 208 19 244 214 54 245 215 43
39952 -246 215 20 246 215 20 241 208 19 198 155 10
39953 -200 144 11 216 158 10 156 118 10 2 2 6
39954 - 2 2 6 2 2 6 2 2 6 2 2 6
39955 - 6 6 6 90 90 90 54 54 54 18 18 18
39956 - 6 6 6 0 0 0 0 0 0 0 0 0
39957 - 0 0 0 0 0 0 0 0 0 0 0 0
39958 - 0 0 0 0 0 0 0 0 0 0 0 0
39959 - 0 0 0 0 0 0 0 0 0 0 0 0
39960 - 0 0 0 0 0 0 0 0 0 0 0 0
39961 - 0 0 0 0 0 0 0 0 0 0 0 0
39962 - 0 0 0 0 0 0 0 0 0 0 0 0
39963 - 0 0 0 0 0 0 0 0 0 0 0 0
39964 - 0 0 0 0 0 0 0 0 0 0 0 0
39965 - 0 0 0 0 0 0 0 0 0 0 0 0
39966 - 0 0 0 0 0 0 0 0 0 0 0 0
39967 - 0 0 0 0 0 0 0 0 0 0 0 0
39968 - 0 0 0 0 0 0 0 0 0 10 10 10
39969 - 30 30 30 78 78 78 46 46 46 22 22 22
39970 -137 92 6 210 162 10 239 182 13 238 190 10
39971 -238 202 15 241 208 19 246 215 20 246 215 20
39972 -241 208 19 203 166 17 185 133 11 210 150 10
39973 -216 158 10 210 150 10 102 78 10 2 2 6
39974 - 6 6 6 54 54 54 14 14 14 2 2 6
39975 - 2 2 6 62 62 62 74 74 74 30 30 30
39976 - 10 10 10 0 0 0 0 0 0 0 0 0
39977 - 0 0 0 0 0 0 0 0 0 0 0 0
39978 - 0 0 0 0 0 0 0 0 0 0 0 0
39979 - 0 0 0 0 0 0 0 0 0 0 0 0
39980 - 0 0 0 0 0 0 0 0 0 0 0 0
39981 - 0 0 0 0 0 0 0 0 0 0 0 0
39982 - 0 0 0 0 0 0 0 0 0 0 0 0
39983 - 0 0 0 0 0 0 0 0 0 0 0 0
39984 - 0 0 0 0 0 0 0 0 0 0 0 0
39985 - 0 0 0 0 0 0 0 0 0 0 0 0
39986 - 0 0 0 0 0 0 0 0 0 0 0 0
39987 - 0 0 0 0 0 0 0 0 0 0 0 0
39988 - 0 0 0 0 0 0 0 0 0 10 10 10
39989 - 34 34 34 78 78 78 50 50 50 6 6 6
39990 - 94 70 30 139 102 15 190 146 13 226 184 13
39991 -232 200 30 232 195 16 215 174 15 190 146 13
39992 -168 122 10 192 133 9 210 150 10 213 154 11
39993 -202 150 34 182 157 106 101 98 89 2 2 6
39994 - 2 2 6 78 78 78 116 116 116 58 58 58
39995 - 2 2 6 22 22 22 90 90 90 46 46 46
39996 - 18 18 18 6 6 6 0 0 0 0 0 0
39997 - 0 0 0 0 0 0 0 0 0 0 0 0
39998 - 0 0 0 0 0 0 0 0 0 0 0 0
39999 - 0 0 0 0 0 0 0 0 0 0 0 0
40000 - 0 0 0 0 0 0 0 0 0 0 0 0
40001 - 0 0 0 0 0 0 0 0 0 0 0 0
40002 - 0 0 0 0 0 0 0 0 0 0 0 0
40003 - 0 0 0 0 0 0 0 0 0 0 0 0
40004 - 0 0 0 0 0 0 0 0 0 0 0 0
40005 - 0 0 0 0 0 0 0 0 0 0 0 0
40006 - 0 0 0 0 0 0 0 0 0 0 0 0
40007 - 0 0 0 0 0 0 0 0 0 0 0 0
40008 - 0 0 0 0 0 0 0 0 0 10 10 10
40009 - 38 38 38 86 86 86 50 50 50 6 6 6
40010 -128 128 128 174 154 114 156 107 11 168 122 10
40011 -198 155 10 184 144 12 197 138 11 200 144 11
40012 -206 145 10 206 145 10 197 138 11 188 164 115
40013 -195 195 195 198 198 198 174 174 174 14 14 14
40014 - 2 2 6 22 22 22 116 116 116 116 116 116
40015 - 22 22 22 2 2 6 74 74 74 70 70 70
40016 - 30 30 30 10 10 10 0 0 0 0 0 0
40017 - 0 0 0 0 0 0 0 0 0 0 0 0
40018 - 0 0 0 0 0 0 0 0 0 0 0 0
40019 - 0 0 0 0 0 0 0 0 0 0 0 0
40020 - 0 0 0 0 0 0 0 0 0 0 0 0
40021 - 0 0 0 0 0 0 0 0 0 0 0 0
40022 - 0 0 0 0 0 0 0 0 0 0 0 0
40023 - 0 0 0 0 0 0 0 0 0 0 0 0
40024 - 0 0 0 0 0 0 0 0 0 0 0 0
40025 - 0 0 0 0 0 0 0 0 0 0 0 0
40026 - 0 0 0 0 0 0 0 0 0 0 0 0
40027 - 0 0 0 0 0 0 0 0 0 0 0 0
40028 - 0 0 0 0 0 0 6 6 6 18 18 18
40029 - 50 50 50 101 101 101 26 26 26 10 10 10
40030 -138 138 138 190 190 190 174 154 114 156 107 11
40031 -197 138 11 200 144 11 197 138 11 192 133 9
40032 -180 123 7 190 142 34 190 178 144 187 187 187
40033 -202 202 202 221 221 221 214 214 214 66 66 66
40034 - 2 2 6 2 2 6 50 50 50 62 62 62
40035 - 6 6 6 2 2 6 10 10 10 90 90 90
40036 - 50 50 50 18 18 18 6 6 6 0 0 0
40037 - 0 0 0 0 0 0 0 0 0 0 0 0
40038 - 0 0 0 0 0 0 0 0 0 0 0 0
40039 - 0 0 0 0 0 0 0 0 0 0 0 0
40040 - 0 0 0 0 0 0 0 0 0 0 0 0
40041 - 0 0 0 0 0 0 0 0 0 0 0 0
40042 - 0 0 0 0 0 0 0 0 0 0 0 0
40043 - 0 0 0 0 0 0 0 0 0 0 0 0
40044 - 0 0 0 0 0 0 0 0 0 0 0 0
40045 - 0 0 0 0 0 0 0 0 0 0 0 0
40046 - 0 0 0 0 0 0 0 0 0 0 0 0
40047 - 0 0 0 0 0 0 0 0 0 0 0 0
40048 - 0 0 0 0 0 0 10 10 10 34 34 34
40049 - 74 74 74 74 74 74 2 2 6 6 6 6
40050 -144 144 144 198 198 198 190 190 190 178 166 146
40051 -154 121 60 156 107 11 156 107 11 168 124 44
40052 -174 154 114 187 187 187 190 190 190 210 210 210
40053 -246 246 246 253 253 253 253 253 253 182 182 182
40054 - 6 6 6 2 2 6 2 2 6 2 2 6
40055 - 2 2 6 2 2 6 2 2 6 62 62 62
40056 - 74 74 74 34 34 34 14 14 14 0 0 0
40057 - 0 0 0 0 0 0 0 0 0 0 0 0
40058 - 0 0 0 0 0 0 0 0 0 0 0 0
40059 - 0 0 0 0 0 0 0 0 0 0 0 0
40060 - 0 0 0 0 0 0 0 0 0 0 0 0
40061 - 0 0 0 0 0 0 0 0 0 0 0 0
40062 - 0 0 0 0 0 0 0 0 0 0 0 0
40063 - 0 0 0 0 0 0 0 0 0 0 0 0
40064 - 0 0 0 0 0 0 0 0 0 0 0 0
40065 - 0 0 0 0 0 0 0 0 0 0 0 0
40066 - 0 0 0 0 0 0 0 0 0 0 0 0
40067 - 0 0 0 0 0 0 0 0 0 0 0 0
40068 - 0 0 0 10 10 10 22 22 22 54 54 54
40069 - 94 94 94 18 18 18 2 2 6 46 46 46
40070 -234 234 234 221 221 221 190 190 190 190 190 190
40071 -190 190 190 187 187 187 187 187 187 190 190 190
40072 -190 190 190 195 195 195 214 214 214 242 242 242
40073 -253 253 253 253 253 253 253 253 253 253 253 253
40074 - 82 82 82 2 2 6 2 2 6 2 2 6
40075 - 2 2 6 2 2 6 2 2 6 14 14 14
40076 - 86 86 86 54 54 54 22 22 22 6 6 6
40077 - 0 0 0 0 0 0 0 0 0 0 0 0
40078 - 0 0 0 0 0 0 0 0 0 0 0 0
40079 - 0 0 0 0 0 0 0 0 0 0 0 0
40080 - 0 0 0 0 0 0 0 0 0 0 0 0
40081 - 0 0 0 0 0 0 0 0 0 0 0 0
40082 - 0 0 0 0 0 0 0 0 0 0 0 0
40083 - 0 0 0 0 0 0 0 0 0 0 0 0
40084 - 0 0 0 0 0 0 0 0 0 0 0 0
40085 - 0 0 0 0 0 0 0 0 0 0 0 0
40086 - 0 0 0 0 0 0 0 0 0 0 0 0
40087 - 0 0 0 0 0 0 0 0 0 0 0 0
40088 - 6 6 6 18 18 18 46 46 46 90 90 90
40089 - 46 46 46 18 18 18 6 6 6 182 182 182
40090 -253 253 253 246 246 246 206 206 206 190 190 190
40091 -190 190 190 190 190 190 190 190 190 190 190 190
40092 -206 206 206 231 231 231 250 250 250 253 253 253
40093 -253 253 253 253 253 253 253 253 253 253 253 253
40094 -202 202 202 14 14 14 2 2 6 2 2 6
40095 - 2 2 6 2 2 6 2 2 6 2 2 6
40096 - 42 42 42 86 86 86 42 42 42 18 18 18
40097 - 6 6 6 0 0 0 0 0 0 0 0 0
40098 - 0 0 0 0 0 0 0 0 0 0 0 0
40099 - 0 0 0 0 0 0 0 0 0 0 0 0
40100 - 0 0 0 0 0 0 0 0 0 0 0 0
40101 - 0 0 0 0 0 0 0 0 0 0 0 0
40102 - 0 0 0 0 0 0 0 0 0 0 0 0
40103 - 0 0 0 0 0 0 0 0 0 0 0 0
40104 - 0 0 0 0 0 0 0 0 0 0 0 0
40105 - 0 0 0 0 0 0 0 0 0 0 0 0
40106 - 0 0 0 0 0 0 0 0 0 0 0 0
40107 - 0 0 0 0 0 0 0 0 0 6 6 6
40108 - 14 14 14 38 38 38 74 74 74 66 66 66
40109 - 2 2 6 6 6 6 90 90 90 250 250 250
40110 -253 253 253 253 253 253 238 238 238 198 198 198
40111 -190 190 190 190 190 190 195 195 195 221 221 221
40112 -246 246 246 253 253 253 253 253 253 253 253 253
40113 -253 253 253 253 253 253 253 253 253 253 253 253
40114 -253 253 253 82 82 82 2 2 6 2 2 6
40115 - 2 2 6 2 2 6 2 2 6 2 2 6
40116 - 2 2 6 78 78 78 70 70 70 34 34 34
40117 - 14 14 14 6 6 6 0 0 0 0 0 0
40118 - 0 0 0 0 0 0 0 0 0 0 0 0
40119 - 0 0 0 0 0 0 0 0 0 0 0 0
40120 - 0 0 0 0 0 0 0 0 0 0 0 0
40121 - 0 0 0 0 0 0 0 0 0 0 0 0
40122 - 0 0 0 0 0 0 0 0 0 0 0 0
40123 - 0 0 0 0 0 0 0 0 0 0 0 0
40124 - 0 0 0 0 0 0 0 0 0 0 0 0
40125 - 0 0 0 0 0 0 0 0 0 0 0 0
40126 - 0 0 0 0 0 0 0 0 0 0 0 0
40127 - 0 0 0 0 0 0 0 0 0 14 14 14
40128 - 34 34 34 66 66 66 78 78 78 6 6 6
40129 - 2 2 6 18 18 18 218 218 218 253 253 253
40130 -253 253 253 253 253 253 253 253 253 246 246 246
40131 -226 226 226 231 231 231 246 246 246 253 253 253
40132 -253 253 253 253 253 253 253 253 253 253 253 253
40133 -253 253 253 253 253 253 253 253 253 253 253 253
40134 -253 253 253 178 178 178 2 2 6 2 2 6
40135 - 2 2 6 2 2 6 2 2 6 2 2 6
40136 - 2 2 6 18 18 18 90 90 90 62 62 62
40137 - 30 30 30 10 10 10 0 0 0 0 0 0
40138 - 0 0 0 0 0 0 0 0 0 0 0 0
40139 - 0 0 0 0 0 0 0 0 0 0 0 0
40140 - 0 0 0 0 0 0 0 0 0 0 0 0
40141 - 0 0 0 0 0 0 0 0 0 0 0 0
40142 - 0 0 0 0 0 0 0 0 0 0 0 0
40143 - 0 0 0 0 0 0 0 0 0 0 0 0
40144 - 0 0 0 0 0 0 0 0 0 0 0 0
40145 - 0 0 0 0 0 0 0 0 0 0 0 0
40146 - 0 0 0 0 0 0 0 0 0 0 0 0
40147 - 0 0 0 0 0 0 10 10 10 26 26 26
40148 - 58 58 58 90 90 90 18 18 18 2 2 6
40149 - 2 2 6 110 110 110 253 253 253 253 253 253
40150 -253 253 253 253 253 253 253 253 253 253 253 253
40151 -250 250 250 253 253 253 253 253 253 253 253 253
40152 -253 253 253 253 253 253 253 253 253 253 253 253
40153 -253 253 253 253 253 253 253 253 253 253 253 253
40154 -253 253 253 231 231 231 18 18 18 2 2 6
40155 - 2 2 6 2 2 6 2 2 6 2 2 6
40156 - 2 2 6 2 2 6 18 18 18 94 94 94
40157 - 54 54 54 26 26 26 10 10 10 0 0 0
40158 - 0 0 0 0 0 0 0 0 0 0 0 0
40159 - 0 0 0 0 0 0 0 0 0 0 0 0
40160 - 0 0 0 0 0 0 0 0 0 0 0 0
40161 - 0 0 0 0 0 0 0 0 0 0 0 0
40162 - 0 0 0 0 0 0 0 0 0 0 0 0
40163 - 0 0 0 0 0 0 0 0 0 0 0 0
40164 - 0 0 0 0 0 0 0 0 0 0 0 0
40165 - 0 0 0 0 0 0 0 0 0 0 0 0
40166 - 0 0 0 0 0 0 0 0 0 0 0 0
40167 - 0 0 0 6 6 6 22 22 22 50 50 50
40168 - 90 90 90 26 26 26 2 2 6 2 2 6
40169 - 14 14 14 195 195 195 250 250 250 253 253 253
40170 -253 253 253 253 253 253 253 253 253 253 253 253
40171 -253 253 253 253 253 253 253 253 253 253 253 253
40172 -253 253 253 253 253 253 253 253 253 253 253 253
40173 -253 253 253 253 253 253 253 253 253 253 253 253
40174 -250 250 250 242 242 242 54 54 54 2 2 6
40175 - 2 2 6 2 2 6 2 2 6 2 2 6
40176 - 2 2 6 2 2 6 2 2 6 38 38 38
40177 - 86 86 86 50 50 50 22 22 22 6 6 6
40178 - 0 0 0 0 0 0 0 0 0 0 0 0
40179 - 0 0 0 0 0 0 0 0 0 0 0 0
40180 - 0 0 0 0 0 0 0 0 0 0 0 0
40181 - 0 0 0 0 0 0 0 0 0 0 0 0
40182 - 0 0 0 0 0 0 0 0 0 0 0 0
40183 - 0 0 0 0 0 0 0 0 0 0 0 0
40184 - 0 0 0 0 0 0 0 0 0 0 0 0
40185 - 0 0 0 0 0 0 0 0 0 0 0 0
40186 - 0 0 0 0 0 0 0 0 0 0 0 0
40187 - 6 6 6 14 14 14 38 38 38 82 82 82
40188 - 34 34 34 2 2 6 2 2 6 2 2 6
40189 - 42 42 42 195 195 195 246 246 246 253 253 253
40190 -253 253 253 253 253 253 253 253 253 250 250 250
40191 -242 242 242 242 242 242 250 250 250 253 253 253
40192 -253 253 253 253 253 253 253 253 253 253 253 253
40193 -253 253 253 250 250 250 246 246 246 238 238 238
40194 -226 226 226 231 231 231 101 101 101 6 6 6
40195 - 2 2 6 2 2 6 2 2 6 2 2 6
40196 - 2 2 6 2 2 6 2 2 6 2 2 6
40197 - 38 38 38 82 82 82 42 42 42 14 14 14
40198 - 6 6 6 0 0 0 0 0 0 0 0 0
40199 - 0 0 0 0 0 0 0 0 0 0 0 0
40200 - 0 0 0 0 0 0 0 0 0 0 0 0
40201 - 0 0 0 0 0 0 0 0 0 0 0 0
40202 - 0 0 0 0 0 0 0 0 0 0 0 0
40203 - 0 0 0 0 0 0 0 0 0 0 0 0
40204 - 0 0 0 0 0 0 0 0 0 0 0 0
40205 - 0 0 0 0 0 0 0 0 0 0 0 0
40206 - 0 0 0 0 0 0 0 0 0 0 0 0
40207 - 10 10 10 26 26 26 62 62 62 66 66 66
40208 - 2 2 6 2 2 6 2 2 6 6 6 6
40209 - 70 70 70 170 170 170 206 206 206 234 234 234
40210 -246 246 246 250 250 250 250 250 250 238 238 238
40211 -226 226 226 231 231 231 238 238 238 250 250 250
40212 -250 250 250 250 250 250 246 246 246 231 231 231
40213 -214 214 214 206 206 206 202 202 202 202 202 202
40214 -198 198 198 202 202 202 182 182 182 18 18 18
40215 - 2 2 6 2 2 6 2 2 6 2 2 6
40216 - 2 2 6 2 2 6 2 2 6 2 2 6
40217 - 2 2 6 62 62 62 66 66 66 30 30 30
40218 - 10 10 10 0 0 0 0 0 0 0 0 0
40219 - 0 0 0 0 0 0 0 0 0 0 0 0
40220 - 0 0 0 0 0 0 0 0 0 0 0 0
40221 - 0 0 0 0 0 0 0 0 0 0 0 0
40222 - 0 0 0 0 0 0 0 0 0 0 0 0
40223 - 0 0 0 0 0 0 0 0 0 0 0 0
40224 - 0 0 0 0 0 0 0 0 0 0 0 0
40225 - 0 0 0 0 0 0 0 0 0 0 0 0
40226 - 0 0 0 0 0 0 0 0 0 0 0 0
40227 - 14 14 14 42 42 42 82 82 82 18 18 18
40228 - 2 2 6 2 2 6 2 2 6 10 10 10
40229 - 94 94 94 182 182 182 218 218 218 242 242 242
40230 -250 250 250 253 253 253 253 253 253 250 250 250
40231 -234 234 234 253 253 253 253 253 253 253 253 253
40232 -253 253 253 253 253 253 253 253 253 246 246 246
40233 -238 238 238 226 226 226 210 210 210 202 202 202
40234 -195 195 195 195 195 195 210 210 210 158 158 158
40235 - 6 6 6 14 14 14 50 50 50 14 14 14
40236 - 2 2 6 2 2 6 2 2 6 2 2 6
40237 - 2 2 6 6 6 6 86 86 86 46 46 46
40238 - 18 18 18 6 6 6 0 0 0 0 0 0
40239 - 0 0 0 0 0 0 0 0 0 0 0 0
40240 - 0 0 0 0 0 0 0 0 0 0 0 0
40241 - 0 0 0 0 0 0 0 0 0 0 0 0
40242 - 0 0 0 0 0 0 0 0 0 0 0 0
40243 - 0 0 0 0 0 0 0 0 0 0 0 0
40244 - 0 0 0 0 0 0 0 0 0 0 0 0
40245 - 0 0 0 0 0 0 0 0 0 0 0 0
40246 - 0 0 0 0 0 0 0 0 0 6 6 6
40247 - 22 22 22 54 54 54 70 70 70 2 2 6
40248 - 2 2 6 10 10 10 2 2 6 22 22 22
40249 -166 166 166 231 231 231 250 250 250 253 253 253
40250 -253 253 253 253 253 253 253 253 253 250 250 250
40251 -242 242 242 253 253 253 253 253 253 253 253 253
40252 -253 253 253 253 253 253 253 253 253 253 253 253
40253 -253 253 253 253 253 253 253 253 253 246 246 246
40254 -231 231 231 206 206 206 198 198 198 226 226 226
40255 - 94 94 94 2 2 6 6 6 6 38 38 38
40256 - 30 30 30 2 2 6 2 2 6 2 2 6
40257 - 2 2 6 2 2 6 62 62 62 66 66 66
40258 - 26 26 26 10 10 10 0 0 0 0 0 0
40259 - 0 0 0 0 0 0 0 0 0 0 0 0
40260 - 0 0 0 0 0 0 0 0 0 0 0 0
40261 - 0 0 0 0 0 0 0 0 0 0 0 0
40262 - 0 0 0 0 0 0 0 0 0 0 0 0
40263 - 0 0 0 0 0 0 0 0 0 0 0 0
40264 - 0 0 0 0 0 0 0 0 0 0 0 0
40265 - 0 0 0 0 0 0 0 0 0 0 0 0
40266 - 0 0 0 0 0 0 0 0 0 10 10 10
40267 - 30 30 30 74 74 74 50 50 50 2 2 6
40268 - 26 26 26 26 26 26 2 2 6 106 106 106
40269 -238 238 238 253 253 253 253 253 253 253 253 253
40270 -253 253 253 253 253 253 253 253 253 253 253 253
40271 -253 253 253 253 253 253 253 253 253 253 253 253
40272 -253 253 253 253 253 253 253 253 253 253 253 253
40273 -253 253 253 253 253 253 253 253 253 253 253 253
40274 -253 253 253 246 246 246 218 218 218 202 202 202
40275 -210 210 210 14 14 14 2 2 6 2 2 6
40276 - 30 30 30 22 22 22 2 2 6 2 2 6
40277 - 2 2 6 2 2 6 18 18 18 86 86 86
40278 - 42 42 42 14 14 14 0 0 0 0 0 0
40279 - 0 0 0 0 0 0 0 0 0 0 0 0
40280 - 0 0 0 0 0 0 0 0 0 0 0 0
40281 - 0 0 0 0 0 0 0 0 0 0 0 0
40282 - 0 0 0 0 0 0 0 0 0 0 0 0
40283 - 0 0 0 0 0 0 0 0 0 0 0 0
40284 - 0 0 0 0 0 0 0 0 0 0 0 0
40285 - 0 0 0 0 0 0 0 0 0 0 0 0
40286 - 0 0 0 0 0 0 0 0 0 14 14 14
40287 - 42 42 42 90 90 90 22 22 22 2 2 6
40288 - 42 42 42 2 2 6 18 18 18 218 218 218
40289 -253 253 253 253 253 253 253 253 253 253 253 253
40290 -253 253 253 253 253 253 253 253 253 253 253 253
40291 -253 253 253 253 253 253 253 253 253 253 253 253
40292 -253 253 253 253 253 253 253 253 253 253 253 253
40293 -253 253 253 253 253 253 253 253 253 253 253 253
40294 -253 253 253 253 253 253 250 250 250 221 221 221
40295 -218 218 218 101 101 101 2 2 6 14 14 14
40296 - 18 18 18 38 38 38 10 10 10 2 2 6
40297 - 2 2 6 2 2 6 2 2 6 78 78 78
40298 - 58 58 58 22 22 22 6 6 6 0 0 0
40299 - 0 0 0 0 0 0 0 0 0 0 0 0
40300 - 0 0 0 0 0 0 0 0 0 0 0 0
40301 - 0 0 0 0 0 0 0 0 0 0 0 0
40302 - 0 0 0 0 0 0 0 0 0 0 0 0
40303 - 0 0 0 0 0 0 0 0 0 0 0 0
40304 - 0 0 0 0 0 0 0 0 0 0 0 0
40305 - 0 0 0 0 0 0 0 0 0 0 0 0
40306 - 0 0 0 0 0 0 6 6 6 18 18 18
40307 - 54 54 54 82 82 82 2 2 6 26 26 26
40308 - 22 22 22 2 2 6 123 123 123 253 253 253
40309 -253 253 253 253 253 253 253 253 253 253 253 253
40310 -253 253 253 253 253 253 253 253 253 253 253 253
40311 -253 253 253 253 253 253 253 253 253 253 253 253
40312 -253 253 253 253 253 253 253 253 253 253 253 253
40313 -253 253 253 253 253 253 253 253 253 253 253 253
40314 -253 253 253 253 253 253 253 253 253 250 250 250
40315 -238 238 238 198 198 198 6 6 6 38 38 38
40316 - 58 58 58 26 26 26 38 38 38 2 2 6
40317 - 2 2 6 2 2 6 2 2 6 46 46 46
40318 - 78 78 78 30 30 30 10 10 10 0 0 0
40319 - 0 0 0 0 0 0 0 0 0 0 0 0
40320 - 0 0 0 0 0 0 0 0 0 0 0 0
40321 - 0 0 0 0 0 0 0 0 0 0 0 0
40322 - 0 0 0 0 0 0 0 0 0 0 0 0
40323 - 0 0 0 0 0 0 0 0 0 0 0 0
40324 - 0 0 0 0 0 0 0 0 0 0 0 0
40325 - 0 0 0 0 0 0 0 0 0 0 0 0
40326 - 0 0 0 0 0 0 10 10 10 30 30 30
40327 - 74 74 74 58 58 58 2 2 6 42 42 42
40328 - 2 2 6 22 22 22 231 231 231 253 253 253
40329 -253 253 253 253 253 253 253 253 253 253 253 253
40330 -253 253 253 253 253 253 253 253 253 250 250 250
40331 -253 253 253 253 253 253 253 253 253 253 253 253
40332 -253 253 253 253 253 253 253 253 253 253 253 253
40333 -253 253 253 253 253 253 253 253 253 253 253 253
40334 -253 253 253 253 253 253 253 253 253 253 253 253
40335 -253 253 253 246 246 246 46 46 46 38 38 38
40336 - 42 42 42 14 14 14 38 38 38 14 14 14
40337 - 2 2 6 2 2 6 2 2 6 6 6 6
40338 - 86 86 86 46 46 46 14 14 14 0 0 0
40339 - 0 0 0 0 0 0 0 0 0 0 0 0
40340 - 0 0 0 0 0 0 0 0 0 0 0 0
40341 - 0 0 0 0 0 0 0 0 0 0 0 0
40342 - 0 0 0 0 0 0 0 0 0 0 0 0
40343 - 0 0 0 0 0 0 0 0 0 0 0 0
40344 - 0 0 0 0 0 0 0 0 0 0 0 0
40345 - 0 0 0 0 0 0 0 0 0 0 0 0
40346 - 0 0 0 6 6 6 14 14 14 42 42 42
40347 - 90 90 90 18 18 18 18 18 18 26 26 26
40348 - 2 2 6 116 116 116 253 253 253 253 253 253
40349 -253 253 253 253 253 253 253 253 253 253 253 253
40350 -253 253 253 253 253 253 250 250 250 238 238 238
40351 -253 253 253 253 253 253 253 253 253 253 253 253
40352 -253 253 253 253 253 253 253 253 253 253 253 253
40353 -253 253 253 253 253 253 253 253 253 253 253 253
40354 -253 253 253 253 253 253 253 253 253 253 253 253
40355 -253 253 253 253 253 253 94 94 94 6 6 6
40356 - 2 2 6 2 2 6 10 10 10 34 34 34
40357 - 2 2 6 2 2 6 2 2 6 2 2 6
40358 - 74 74 74 58 58 58 22 22 22 6 6 6
40359 - 0 0 0 0 0 0 0 0 0 0 0 0
40360 - 0 0 0 0 0 0 0 0 0 0 0 0
40361 - 0 0 0 0 0 0 0 0 0 0 0 0
40362 - 0 0 0 0 0 0 0 0 0 0 0 0
40363 - 0 0 0 0 0 0 0 0 0 0 0 0
40364 - 0 0 0 0 0 0 0 0 0 0 0 0
40365 - 0 0 0 0 0 0 0 0 0 0 0 0
40366 - 0 0 0 10 10 10 26 26 26 66 66 66
40367 - 82 82 82 2 2 6 38 38 38 6 6 6
40368 - 14 14 14 210 210 210 253 253 253 253 253 253
40369 -253 253 253 253 253 253 253 253 253 253 253 253
40370 -253 253 253 253 253 253 246 246 246 242 242 242
40371 -253 253 253 253 253 253 253 253 253 253 253 253
40372 -253 253 253 253 253 253 253 253 253 253 253 253
40373 -253 253 253 253 253 253 253 253 253 253 253 253
40374 -253 253 253 253 253 253 253 253 253 253 253 253
40375 -253 253 253 253 253 253 144 144 144 2 2 6
40376 - 2 2 6 2 2 6 2 2 6 46 46 46
40377 - 2 2 6 2 2 6 2 2 6 2 2 6
40378 - 42 42 42 74 74 74 30 30 30 10 10 10
40379 - 0 0 0 0 0 0 0 0 0 0 0 0
40380 - 0 0 0 0 0 0 0 0 0 0 0 0
40381 - 0 0 0 0 0 0 0 0 0 0 0 0
40382 - 0 0 0 0 0 0 0 0 0 0 0 0
40383 - 0 0 0 0 0 0 0 0 0 0 0 0
40384 - 0 0 0 0 0 0 0 0 0 0 0 0
40385 - 0 0 0 0 0 0 0 0 0 0 0 0
40386 - 6 6 6 14 14 14 42 42 42 90 90 90
40387 - 26 26 26 6 6 6 42 42 42 2 2 6
40388 - 74 74 74 250 250 250 253 253 253 253 253 253
40389 -253 253 253 253 253 253 253 253 253 253 253 253
40390 -253 253 253 253 253 253 242 242 242 242 242 242
40391 -253 253 253 253 253 253 253 253 253 253 253 253
40392 -253 253 253 253 253 253 253 253 253 253 253 253
40393 -253 253 253 253 253 253 253 253 253 253 253 253
40394 -253 253 253 253 253 253 253 253 253 253 253 253
40395 -253 253 253 253 253 253 182 182 182 2 2 6
40396 - 2 2 6 2 2 6 2 2 6 46 46 46
40397 - 2 2 6 2 2 6 2 2 6 2 2 6
40398 - 10 10 10 86 86 86 38 38 38 10 10 10
40399 - 0 0 0 0 0 0 0 0 0 0 0 0
40400 - 0 0 0 0 0 0 0 0 0 0 0 0
40401 - 0 0 0 0 0 0 0 0 0 0 0 0
40402 - 0 0 0 0 0 0 0 0 0 0 0 0
40403 - 0 0 0 0 0 0 0 0 0 0 0 0
40404 - 0 0 0 0 0 0 0 0 0 0 0 0
40405 - 0 0 0 0 0 0 0 0 0 0 0 0
40406 - 10 10 10 26 26 26 66 66 66 82 82 82
40407 - 2 2 6 22 22 22 18 18 18 2 2 6
40408 -149 149 149 253 253 253 253 253 253 253 253 253
40409 -253 253 253 253 253 253 253 253 253 253 253 253
40410 -253 253 253 253 253 253 234 234 234 242 242 242
40411 -253 253 253 253 253 253 253 253 253 253 253 253
40412 -253 253 253 253 253 253 253 253 253 253 253 253
40413 -253 253 253 253 253 253 253 253 253 253 253 253
40414 -253 253 253 253 253 253 253 253 253 253 253 253
40415 -253 253 253 253 253 253 206 206 206 2 2 6
40416 - 2 2 6 2 2 6 2 2 6 38 38 38
40417 - 2 2 6 2 2 6 2 2 6 2 2 6
40418 - 6 6 6 86 86 86 46 46 46 14 14 14
40419 - 0 0 0 0 0 0 0 0 0 0 0 0
40420 - 0 0 0 0 0 0 0 0 0 0 0 0
40421 - 0 0 0 0 0 0 0 0 0 0 0 0
40422 - 0 0 0 0 0 0 0 0 0 0 0 0
40423 - 0 0 0 0 0 0 0 0 0 0 0 0
40424 - 0 0 0 0 0 0 0 0 0 0 0 0
40425 - 0 0 0 0 0 0 0 0 0 6 6 6
40426 - 18 18 18 46 46 46 86 86 86 18 18 18
40427 - 2 2 6 34 34 34 10 10 10 6 6 6
40428 -210 210 210 253 253 253 253 253 253 253 253 253
40429 -253 253 253 253 253 253 253 253 253 253 253 253
40430 -253 253 253 253 253 253 234 234 234 242 242 242
40431 -253 253 253 253 253 253 253 253 253 253 253 253
40432 -253 253 253 253 253 253 253 253 253 253 253 253
40433 -253 253 253 253 253 253 253 253 253 253 253 253
40434 -253 253 253 253 253 253 253 253 253 253 253 253
40435 -253 253 253 253 253 253 221 221 221 6 6 6
40436 - 2 2 6 2 2 6 6 6 6 30 30 30
40437 - 2 2 6 2 2 6 2 2 6 2 2 6
40438 - 2 2 6 82 82 82 54 54 54 18 18 18
40439 - 6 6 6 0 0 0 0 0 0 0 0 0
40440 - 0 0 0 0 0 0 0 0 0 0 0 0
40441 - 0 0 0 0 0 0 0 0 0 0 0 0
40442 - 0 0 0 0 0 0 0 0 0 0 0 0
40443 - 0 0 0 0 0 0 0 0 0 0 0 0
40444 - 0 0 0 0 0 0 0 0 0 0 0 0
40445 - 0 0 0 0 0 0 0 0 0 10 10 10
40446 - 26 26 26 66 66 66 62 62 62 2 2 6
40447 - 2 2 6 38 38 38 10 10 10 26 26 26
40448 -238 238 238 253 253 253 253 253 253 253 253 253
40449 -253 253 253 253 253 253 253 253 253 253 253 253
40450 -253 253 253 253 253 253 231 231 231 238 238 238
40451 -253 253 253 253 253 253 253 253 253 253 253 253
40452 -253 253 253 253 253 253 253 253 253 253 253 253
40453 -253 253 253 253 253 253 253 253 253 253 253 253
40454 -253 253 253 253 253 253 253 253 253 253 253 253
40455 -253 253 253 253 253 253 231 231 231 6 6 6
40456 - 2 2 6 2 2 6 10 10 10 30 30 30
40457 - 2 2 6 2 2 6 2 2 6 2 2 6
40458 - 2 2 6 66 66 66 58 58 58 22 22 22
40459 - 6 6 6 0 0 0 0 0 0 0 0 0
40460 - 0 0 0 0 0 0 0 0 0 0 0 0
40461 - 0 0 0 0 0 0 0 0 0 0 0 0
40462 - 0 0 0 0 0 0 0 0 0 0 0 0
40463 - 0 0 0 0 0 0 0 0 0 0 0 0
40464 - 0 0 0 0 0 0 0 0 0 0 0 0
40465 - 0 0 0 0 0 0 0 0 0 10 10 10
40466 - 38 38 38 78 78 78 6 6 6 2 2 6
40467 - 2 2 6 46 46 46 14 14 14 42 42 42
40468 -246 246 246 253 253 253 253 253 253 253 253 253
40469 -253 253 253 253 253 253 253 253 253 253 253 253
40470 -253 253 253 253 253 253 231 231 231 242 242 242
40471 -253 253 253 253 253 253 253 253 253 253 253 253
40472 -253 253 253 253 253 253 253 253 253 253 253 253
40473 -253 253 253 253 253 253 253 253 253 253 253 253
40474 -253 253 253 253 253 253 253 253 253 253 253 253
40475 -253 253 253 253 253 253 234 234 234 10 10 10
40476 - 2 2 6 2 2 6 22 22 22 14 14 14
40477 - 2 2 6 2 2 6 2 2 6 2 2 6
40478 - 2 2 6 66 66 66 62 62 62 22 22 22
40479 - 6 6 6 0 0 0 0 0 0 0 0 0
40480 - 0 0 0 0 0 0 0 0 0 0 0 0
40481 - 0 0 0 0 0 0 0 0 0 0 0 0
40482 - 0 0 0 0 0 0 0 0 0 0 0 0
40483 - 0 0 0 0 0 0 0 0 0 0 0 0
40484 - 0 0 0 0 0 0 0 0 0 0 0 0
40485 - 0 0 0 0 0 0 6 6 6 18 18 18
40486 - 50 50 50 74 74 74 2 2 6 2 2 6
40487 - 14 14 14 70 70 70 34 34 34 62 62 62
40488 -250 250 250 253 253 253 253 253 253 253 253 253
40489 -253 253 253 253 253 253 253 253 253 253 253 253
40490 -253 253 253 253 253 253 231 231 231 246 246 246
40491 -253 253 253 253 253 253 253 253 253 253 253 253
40492 -253 253 253 253 253 253 253 253 253 253 253 253
40493 -253 253 253 253 253 253 253 253 253 253 253 253
40494 -253 253 253 253 253 253 253 253 253 253 253 253
40495 -253 253 253 253 253 253 234 234 234 14 14 14
40496 - 2 2 6 2 2 6 30 30 30 2 2 6
40497 - 2 2 6 2 2 6 2 2 6 2 2 6
40498 - 2 2 6 66 66 66 62 62 62 22 22 22
40499 - 6 6 6 0 0 0 0 0 0 0 0 0
40500 - 0 0 0 0 0 0 0 0 0 0 0 0
40501 - 0 0 0 0 0 0 0 0 0 0 0 0
40502 - 0 0 0 0 0 0 0 0 0 0 0 0
40503 - 0 0 0 0 0 0 0 0 0 0 0 0
40504 - 0 0 0 0 0 0 0 0 0 0 0 0
40505 - 0 0 0 0 0 0 6 6 6 18 18 18
40506 - 54 54 54 62 62 62 2 2 6 2 2 6
40507 - 2 2 6 30 30 30 46 46 46 70 70 70
40508 -250 250 250 253 253 253 253 253 253 253 253 253
40509 -253 253 253 253 253 253 253 253 253 253 253 253
40510 -253 253 253 253 253 253 231 231 231 246 246 246
40511 -253 253 253 253 253 253 253 253 253 253 253 253
40512 -253 253 253 253 253 253 253 253 253 253 253 253
40513 -253 253 253 253 253 253 253 253 253 253 253 253
40514 -253 253 253 253 253 253 253 253 253 253 253 253
40515 -253 253 253 253 253 253 226 226 226 10 10 10
40516 - 2 2 6 6 6 6 30 30 30 2 2 6
40517 - 2 2 6 2 2 6 2 2 6 2 2 6
40518 - 2 2 6 66 66 66 58 58 58 22 22 22
40519 - 6 6 6 0 0 0 0 0 0 0 0 0
40520 - 0 0 0 0 0 0 0 0 0 0 0 0
40521 - 0 0 0 0 0 0 0 0 0 0 0 0
40522 - 0 0 0 0 0 0 0 0 0 0 0 0
40523 - 0 0 0 0 0 0 0 0 0 0 0 0
40524 - 0 0 0 0 0 0 0 0 0 0 0 0
40525 - 0 0 0 0 0 0 6 6 6 22 22 22
40526 - 58 58 58 62 62 62 2 2 6 2 2 6
40527 - 2 2 6 2 2 6 30 30 30 78 78 78
40528 -250 250 250 253 253 253 253 253 253 253 253 253
40529 -253 253 253 253 253 253 253 253 253 253 253 253
40530 -253 253 253 253 253 253 231 231 231 246 246 246
40531 -253 253 253 253 253 253 253 253 253 253 253 253
40532 -253 253 253 253 253 253 253 253 253 253 253 253
40533 -253 253 253 253 253 253 253 253 253 253 253 253
40534 -253 253 253 253 253 253 253 253 253 253 253 253
40535 -253 253 253 253 253 253 206 206 206 2 2 6
40536 - 22 22 22 34 34 34 18 14 6 22 22 22
40537 - 26 26 26 18 18 18 6 6 6 2 2 6
40538 - 2 2 6 82 82 82 54 54 54 18 18 18
40539 - 6 6 6 0 0 0 0 0 0 0 0 0
40540 - 0 0 0 0 0 0 0 0 0 0 0 0
40541 - 0 0 0 0 0 0 0 0 0 0 0 0
40542 - 0 0 0 0 0 0 0 0 0 0 0 0
40543 - 0 0 0 0 0 0 0 0 0 0 0 0
40544 - 0 0 0 0 0 0 0 0 0 0 0 0
40545 - 0 0 0 0 0 0 6 6 6 26 26 26
40546 - 62 62 62 106 106 106 74 54 14 185 133 11
40547 -210 162 10 121 92 8 6 6 6 62 62 62
40548 -238 238 238 253 253 253 253 253 253 253 253 253
40549 -253 253 253 253 253 253 253 253 253 253 253 253
40550 -253 253 253 253 253 253 231 231 231 246 246 246
40551 -253 253 253 253 253 253 253 253 253 253 253 253
40552 -253 253 253 253 253 253 253 253 253 253 253 253
40553 -253 253 253 253 253 253 253 253 253 253 253 253
40554 -253 253 253 253 253 253 253 253 253 253 253 253
40555 -253 253 253 253 253 253 158 158 158 18 18 18
40556 - 14 14 14 2 2 6 2 2 6 2 2 6
40557 - 6 6 6 18 18 18 66 66 66 38 38 38
40558 - 6 6 6 94 94 94 50 50 50 18 18 18
40559 - 6 6 6 0 0 0 0 0 0 0 0 0
40560 - 0 0 0 0 0 0 0 0 0 0 0 0
40561 - 0 0 0 0 0 0 0 0 0 0 0 0
40562 - 0 0 0 0 0 0 0 0 0 0 0 0
40563 - 0 0 0 0 0 0 0 0 0 0 0 0
40564 - 0 0 0 0 0 0 0 0 0 6 6 6
40565 - 10 10 10 10 10 10 18 18 18 38 38 38
40566 - 78 78 78 142 134 106 216 158 10 242 186 14
40567 -246 190 14 246 190 14 156 118 10 10 10 10
40568 - 90 90 90 238 238 238 253 253 253 253 253 253
40569 -253 253 253 253 253 253 253 253 253 253 253 253
40570 -253 253 253 253 253 253 231 231 231 250 250 250
40571 -253 253 253 253 253 253 253 253 253 253 253 253
40572 -253 253 253 253 253 253 253 253 253 253 253 253
40573 -253 253 253 253 253 253 253 253 253 253 253 253
40574 -253 253 253 253 253 253 253 253 253 246 230 190
40575 -238 204 91 238 204 91 181 142 44 37 26 9
40576 - 2 2 6 2 2 6 2 2 6 2 2 6
40577 - 2 2 6 2 2 6 38 38 38 46 46 46
40578 - 26 26 26 106 106 106 54 54 54 18 18 18
40579 - 6 6 6 0 0 0 0 0 0 0 0 0
40580 - 0 0 0 0 0 0 0 0 0 0 0 0
40581 - 0 0 0 0 0 0 0 0 0 0 0 0
40582 - 0 0 0 0 0 0 0 0 0 0 0 0
40583 - 0 0 0 0 0 0 0 0 0 0 0 0
40584 - 0 0 0 6 6 6 14 14 14 22 22 22
40585 - 30 30 30 38 38 38 50 50 50 70 70 70
40586 -106 106 106 190 142 34 226 170 11 242 186 14
40587 -246 190 14 246 190 14 246 190 14 154 114 10
40588 - 6 6 6 74 74 74 226 226 226 253 253 253
40589 -253 253 253 253 253 253 253 253 253 253 253 253
40590 -253 253 253 253 253 253 231 231 231 250 250 250
40591 -253 253 253 253 253 253 253 253 253 253 253 253
40592 -253 253 253 253 253 253 253 253 253 253 253 253
40593 -253 253 253 253 253 253 253 253 253 253 253 253
40594 -253 253 253 253 253 253 253 253 253 228 184 62
40595 -241 196 14 241 208 19 232 195 16 38 30 10
40596 - 2 2 6 2 2 6 2 2 6 2 2 6
40597 - 2 2 6 6 6 6 30 30 30 26 26 26
40598 -203 166 17 154 142 90 66 66 66 26 26 26
40599 - 6 6 6 0 0 0 0 0 0 0 0 0
40600 - 0 0 0 0 0 0 0 0 0 0 0 0
40601 - 0 0 0 0 0 0 0 0 0 0 0 0
40602 - 0 0 0 0 0 0 0 0 0 0 0 0
40603 - 0 0 0 0 0 0 0 0 0 0 0 0
40604 - 6 6 6 18 18 18 38 38 38 58 58 58
40605 - 78 78 78 86 86 86 101 101 101 123 123 123
40606 -175 146 61 210 150 10 234 174 13 246 186 14
40607 -246 190 14 246 190 14 246 190 14 238 190 10
40608 -102 78 10 2 2 6 46 46 46 198 198 198
40609 -253 253 253 253 253 253 253 253 253 253 253 253
40610 -253 253 253 253 253 253 234 234 234 242 242 242
40611 -253 253 253 253 253 253 253 253 253 253 253 253
40612 -253 253 253 253 253 253 253 253 253 253 253 253
40613 -253 253 253 253 253 253 253 253 253 253 253 253
40614 -253 253 253 253 253 253 253 253 253 224 178 62
40615 -242 186 14 241 196 14 210 166 10 22 18 6
40616 - 2 2 6 2 2 6 2 2 6 2 2 6
40617 - 2 2 6 2 2 6 6 6 6 121 92 8
40618 -238 202 15 232 195 16 82 82 82 34 34 34
40619 - 10 10 10 0 0 0 0 0 0 0 0 0
40620 - 0 0 0 0 0 0 0 0 0 0 0 0
40621 - 0 0 0 0 0 0 0 0 0 0 0 0
40622 - 0 0 0 0 0 0 0 0 0 0 0 0
40623 - 0 0 0 0 0 0 0 0 0 0 0 0
40624 - 14 14 14 38 38 38 70 70 70 154 122 46
40625 -190 142 34 200 144 11 197 138 11 197 138 11
40626 -213 154 11 226 170 11 242 186 14 246 190 14
40627 -246 190 14 246 190 14 246 190 14 246 190 14
40628 -225 175 15 46 32 6 2 2 6 22 22 22
40629 -158 158 158 250 250 250 253 253 253 253 253 253
40630 -253 253 253 253 253 253 253 253 253 253 253 253
40631 -253 253 253 253 253 253 253 253 253 253 253 253
40632 -253 253 253 253 253 253 253 253 253 253 253 253
40633 -253 253 253 253 253 253 253 253 253 253 253 253
40634 -253 253 253 250 250 250 242 242 242 224 178 62
40635 -239 182 13 236 186 11 213 154 11 46 32 6
40636 - 2 2 6 2 2 6 2 2 6 2 2 6
40637 - 2 2 6 2 2 6 61 42 6 225 175 15
40638 -238 190 10 236 186 11 112 100 78 42 42 42
40639 - 14 14 14 0 0 0 0 0 0 0 0 0
40640 - 0 0 0 0 0 0 0 0 0 0 0 0
40641 - 0 0 0 0 0 0 0 0 0 0 0 0
40642 - 0 0 0 0 0 0 0 0 0 0 0 0
40643 - 0 0 0 0 0 0 0 0 0 6 6 6
40644 - 22 22 22 54 54 54 154 122 46 213 154 11
40645 -226 170 11 230 174 11 226 170 11 226 170 11
40646 -236 178 12 242 186 14 246 190 14 246 190 14
40647 -246 190 14 246 190 14 246 190 14 246 190 14
40648 -241 196 14 184 144 12 10 10 10 2 2 6
40649 - 6 6 6 116 116 116 242 242 242 253 253 253
40650 -253 253 253 253 253 253 253 253 253 253 253 253
40651 -253 253 253 253 253 253 253 253 253 253 253 253
40652 -253 253 253 253 253 253 253 253 253 253 253 253
40653 -253 253 253 253 253 253 253 253 253 253 253 253
40654 -253 253 253 231 231 231 198 198 198 214 170 54
40655 -236 178 12 236 178 12 210 150 10 137 92 6
40656 - 18 14 6 2 2 6 2 2 6 2 2 6
40657 - 6 6 6 70 47 6 200 144 11 236 178 12
40658 -239 182 13 239 182 13 124 112 88 58 58 58
40659 - 22 22 22 6 6 6 0 0 0 0 0 0
40660 - 0 0 0 0 0 0 0 0 0 0 0 0
40661 - 0 0 0 0 0 0 0 0 0 0 0 0
40662 - 0 0 0 0 0 0 0 0 0 0 0 0
40663 - 0 0 0 0 0 0 0 0 0 10 10 10
40664 - 30 30 30 70 70 70 180 133 36 226 170 11
40665 -239 182 13 242 186 14 242 186 14 246 186 14
40666 -246 190 14 246 190 14 246 190 14 246 190 14
40667 -246 190 14 246 190 14 246 190 14 246 190 14
40668 -246 190 14 232 195 16 98 70 6 2 2 6
40669 - 2 2 6 2 2 6 66 66 66 221 221 221
40670 -253 253 253 253 253 253 253 253 253 253 253 253
40671 -253 253 253 253 253 253 253 253 253 253 253 253
40672 -253 253 253 253 253 253 253 253 253 253 253 253
40673 -253 253 253 253 253 253 253 253 253 253 253 253
40674 -253 253 253 206 206 206 198 198 198 214 166 58
40675 -230 174 11 230 174 11 216 158 10 192 133 9
40676 -163 110 8 116 81 8 102 78 10 116 81 8
40677 -167 114 7 197 138 11 226 170 11 239 182 13
40678 -242 186 14 242 186 14 162 146 94 78 78 78
40679 - 34 34 34 14 14 14 6 6 6 0 0 0
40680 - 0 0 0 0 0 0 0 0 0 0 0 0
40681 - 0 0 0 0 0 0 0 0 0 0 0 0
40682 - 0 0 0 0 0 0 0 0 0 0 0 0
40683 - 0 0 0 0 0 0 0 0 0 6 6 6
40684 - 30 30 30 78 78 78 190 142 34 226 170 11
40685 -239 182 13 246 190 14 246 190 14 246 190 14
40686 -246 190 14 246 190 14 246 190 14 246 190 14
40687 -246 190 14 246 190 14 246 190 14 246 190 14
40688 -246 190 14 241 196 14 203 166 17 22 18 6
40689 - 2 2 6 2 2 6 2 2 6 38 38 38
40690 -218 218 218 253 253 253 253 253 253 253 253 253
40691 -253 253 253 253 253 253 253 253 253 253 253 253
40692 -253 253 253 253 253 253 253 253 253 253 253 253
40693 -253 253 253 253 253 253 253 253 253 253 253 253
40694 -250 250 250 206 206 206 198 198 198 202 162 69
40695 -226 170 11 236 178 12 224 166 10 210 150 10
40696 -200 144 11 197 138 11 192 133 9 197 138 11
40697 -210 150 10 226 170 11 242 186 14 246 190 14
40698 -246 190 14 246 186 14 225 175 15 124 112 88
40699 - 62 62 62 30 30 30 14 14 14 6 6 6
40700 - 0 0 0 0 0 0 0 0 0 0 0 0
40701 - 0 0 0 0 0 0 0 0 0 0 0 0
40702 - 0 0 0 0 0 0 0 0 0 0 0 0
40703 - 0 0 0 0 0 0 0 0 0 10 10 10
40704 - 30 30 30 78 78 78 174 135 50 224 166 10
40705 -239 182 13 246 190 14 246 190 14 246 190 14
40706 -246 190 14 246 190 14 246 190 14 246 190 14
40707 -246 190 14 246 190 14 246 190 14 246 190 14
40708 -246 190 14 246 190 14 241 196 14 139 102 15
40709 - 2 2 6 2 2 6 2 2 6 2 2 6
40710 - 78 78 78 250 250 250 253 253 253 253 253 253
40711 -253 253 253 253 253 253 253 253 253 253 253 253
40712 -253 253 253 253 253 253 253 253 253 253 253 253
40713 -253 253 253 253 253 253 253 253 253 253 253 253
40714 -250 250 250 214 214 214 198 198 198 190 150 46
40715 -219 162 10 236 178 12 234 174 13 224 166 10
40716 -216 158 10 213 154 11 213 154 11 216 158 10
40717 -226 170 11 239 182 13 246 190 14 246 190 14
40718 -246 190 14 246 190 14 242 186 14 206 162 42
40719 -101 101 101 58 58 58 30 30 30 14 14 14
40720 - 6 6 6 0 0 0 0 0 0 0 0 0
40721 - 0 0 0 0 0 0 0 0 0 0 0 0
40722 - 0 0 0 0 0 0 0 0 0 0 0 0
40723 - 0 0 0 0 0 0 0 0 0 10 10 10
40724 - 30 30 30 74 74 74 174 135 50 216 158 10
40725 -236 178 12 246 190 14 246 190 14 246 190 14
40726 -246 190 14 246 190 14 246 190 14 246 190 14
40727 -246 190 14 246 190 14 246 190 14 246 190 14
40728 -246 190 14 246 190 14 241 196 14 226 184 13
40729 - 61 42 6 2 2 6 2 2 6 2 2 6
40730 - 22 22 22 238 238 238 253 253 253 253 253 253
40731 -253 253 253 253 253 253 253 253 253 253 253 253
40732 -253 253 253 253 253 253 253 253 253 253 253 253
40733 -253 253 253 253 253 253 253 253 253 253 253 253
40734 -253 253 253 226 226 226 187 187 187 180 133 36
40735 -216 158 10 236 178 12 239 182 13 236 178 12
40736 -230 174 11 226 170 11 226 170 11 230 174 11
40737 -236 178 12 242 186 14 246 190 14 246 190 14
40738 -246 190 14 246 190 14 246 186 14 239 182 13
40739 -206 162 42 106 106 106 66 66 66 34 34 34
40740 - 14 14 14 6 6 6 0 0 0 0 0 0
40741 - 0 0 0 0 0 0 0 0 0 0 0 0
40742 - 0 0 0 0 0 0 0 0 0 0 0 0
40743 - 0 0 0 0 0 0 0 0 0 6 6 6
40744 - 26 26 26 70 70 70 163 133 67 213 154 11
40745 -236 178 12 246 190 14 246 190 14 246 190 14
40746 -246 190 14 246 190 14 246 190 14 246 190 14
40747 -246 190 14 246 190 14 246 190 14 246 190 14
40748 -246 190 14 246 190 14 246 190 14 241 196 14
40749 -190 146 13 18 14 6 2 2 6 2 2 6
40750 - 46 46 46 246 246 246 253 253 253 253 253 253
40751 -253 253 253 253 253 253 253 253 253 253 253 253
40752 -253 253 253 253 253 253 253 253 253 253 253 253
40753 -253 253 253 253 253 253 253 253 253 253 253 253
40754 -253 253 253 221 221 221 86 86 86 156 107 11
40755 -216 158 10 236 178 12 242 186 14 246 186 14
40756 -242 186 14 239 182 13 239 182 13 242 186 14
40757 -242 186 14 246 186 14 246 190 14 246 190 14
40758 -246 190 14 246 190 14 246 190 14 246 190 14
40759 -242 186 14 225 175 15 142 122 72 66 66 66
40760 - 30 30 30 10 10 10 0 0 0 0 0 0
40761 - 0 0 0 0 0 0 0 0 0 0 0 0
40762 - 0 0 0 0 0 0 0 0 0 0 0 0
40763 - 0 0 0 0 0 0 0 0 0 6 6 6
40764 - 26 26 26 70 70 70 163 133 67 210 150 10
40765 -236 178 12 246 190 14 246 190 14 246 190 14
40766 -246 190 14 246 190 14 246 190 14 246 190 14
40767 -246 190 14 246 190 14 246 190 14 246 190 14
40768 -246 190 14 246 190 14 246 190 14 246 190 14
40769 -232 195 16 121 92 8 34 34 34 106 106 106
40770 -221 221 221 253 253 253 253 253 253 253 253 253
40771 -253 253 253 253 253 253 253 253 253 253 253 253
40772 -253 253 253 253 253 253 253 253 253 253 253 253
40773 -253 253 253 253 253 253 253 253 253 253 253 253
40774 -242 242 242 82 82 82 18 14 6 163 110 8
40775 -216 158 10 236 178 12 242 186 14 246 190 14
40776 -246 190 14 246 190 14 246 190 14 246 190 14
40777 -246 190 14 246 190 14 246 190 14 246 190 14
40778 -246 190 14 246 190 14 246 190 14 246 190 14
40779 -246 190 14 246 190 14 242 186 14 163 133 67
40780 - 46 46 46 18 18 18 6 6 6 0 0 0
40781 - 0 0 0 0 0 0 0 0 0 0 0 0
40782 - 0 0 0 0 0 0 0 0 0 0 0 0
40783 - 0 0 0 0 0 0 0 0 0 10 10 10
40784 - 30 30 30 78 78 78 163 133 67 210 150 10
40785 -236 178 12 246 186 14 246 190 14 246 190 14
40786 -246 190 14 246 190 14 246 190 14 246 190 14
40787 -246 190 14 246 190 14 246 190 14 246 190 14
40788 -246 190 14 246 190 14 246 190 14 246 190 14
40789 -241 196 14 215 174 15 190 178 144 253 253 253
40790 -253 253 253 253 253 253 253 253 253 253 253 253
40791 -253 253 253 253 253 253 253 253 253 253 253 253
40792 -253 253 253 253 253 253 253 253 253 253 253 253
40793 -253 253 253 253 253 253 253 253 253 218 218 218
40794 - 58 58 58 2 2 6 22 18 6 167 114 7
40795 -216 158 10 236 178 12 246 186 14 246 190 14
40796 -246 190 14 246 190 14 246 190 14 246 190 14
40797 -246 190 14 246 190 14 246 190 14 246 190 14
40798 -246 190 14 246 190 14 246 190 14 246 190 14
40799 -246 190 14 246 186 14 242 186 14 190 150 46
40800 - 54 54 54 22 22 22 6 6 6 0 0 0
40801 - 0 0 0 0 0 0 0 0 0 0 0 0
40802 - 0 0 0 0 0 0 0 0 0 0 0 0
40803 - 0 0 0 0 0 0 0 0 0 14 14 14
40804 - 38 38 38 86 86 86 180 133 36 213 154 11
40805 -236 178 12 246 186 14 246 190 14 246 190 14
40806 -246 190 14 246 190 14 246 190 14 246 190 14
40807 -246 190 14 246 190 14 246 190 14 246 190 14
40808 -246 190 14 246 190 14 246 190 14 246 190 14
40809 -246 190 14 232 195 16 190 146 13 214 214 214
40810 -253 253 253 253 253 253 253 253 253 253 253 253
40811 -253 253 253 253 253 253 253 253 253 253 253 253
40812 -253 253 253 253 253 253 253 253 253 253 253 253
40813 -253 253 253 250 250 250 170 170 170 26 26 26
40814 - 2 2 6 2 2 6 37 26 9 163 110 8
40815 -219 162 10 239 182 13 246 186 14 246 190 14
40816 -246 190 14 246 190 14 246 190 14 246 190 14
40817 -246 190 14 246 190 14 246 190 14 246 190 14
40818 -246 190 14 246 190 14 246 190 14 246 190 14
40819 -246 186 14 236 178 12 224 166 10 142 122 72
40820 - 46 46 46 18 18 18 6 6 6 0 0 0
40821 - 0 0 0 0 0 0 0 0 0 0 0 0
40822 - 0 0 0 0 0 0 0 0 0 0 0 0
40823 - 0 0 0 0 0 0 6 6 6 18 18 18
40824 - 50 50 50 109 106 95 192 133 9 224 166 10
40825 -242 186 14 246 190 14 246 190 14 246 190 14
40826 -246 190 14 246 190 14 246 190 14 246 190 14
40827 -246 190 14 246 190 14 246 190 14 246 190 14
40828 -246 190 14 246 190 14 246 190 14 246 190 14
40829 -242 186 14 226 184 13 210 162 10 142 110 46
40830 -226 226 226 253 253 253 253 253 253 253 253 253
40831 -253 253 253 253 253 253 253 253 253 253 253 253
40832 -253 253 253 253 253 253 253 253 253 253 253 253
40833 -198 198 198 66 66 66 2 2 6 2 2 6
40834 - 2 2 6 2 2 6 50 34 6 156 107 11
40835 -219 162 10 239 182 13 246 186 14 246 190 14
40836 -246 190 14 246 190 14 246 190 14 246 190 14
40837 -246 190 14 246 190 14 246 190 14 246 190 14
40838 -246 190 14 246 190 14 246 190 14 242 186 14
40839 -234 174 13 213 154 11 154 122 46 66 66 66
40840 - 30 30 30 10 10 10 0 0 0 0 0 0
40841 - 0 0 0 0 0 0 0 0 0 0 0 0
40842 - 0 0 0 0 0 0 0 0 0 0 0 0
40843 - 0 0 0 0 0 0 6 6 6 22 22 22
40844 - 58 58 58 154 121 60 206 145 10 234 174 13
40845 -242 186 14 246 186 14 246 190 14 246 190 14
40846 -246 190 14 246 190 14 246 190 14 246 190 14
40847 -246 190 14 246 190 14 246 190 14 246 190 14
40848 -246 190 14 246 190 14 246 190 14 246 190 14
40849 -246 186 14 236 178 12 210 162 10 163 110 8
40850 - 61 42 6 138 138 138 218 218 218 250 250 250
40851 -253 253 253 253 253 253 253 253 253 250 250 250
40852 -242 242 242 210 210 210 144 144 144 66 66 66
40853 - 6 6 6 2 2 6 2 2 6 2 2 6
40854 - 2 2 6 2 2 6 61 42 6 163 110 8
40855 -216 158 10 236 178 12 246 190 14 246 190 14
40856 -246 190 14 246 190 14 246 190 14 246 190 14
40857 -246 190 14 246 190 14 246 190 14 246 190 14
40858 -246 190 14 239 182 13 230 174 11 216 158 10
40859 -190 142 34 124 112 88 70 70 70 38 38 38
40860 - 18 18 18 6 6 6 0 0 0 0 0 0
40861 - 0 0 0 0 0 0 0 0 0 0 0 0
40862 - 0 0 0 0 0 0 0 0 0 0 0 0
40863 - 0 0 0 0 0 0 6 6 6 22 22 22
40864 - 62 62 62 168 124 44 206 145 10 224 166 10
40865 -236 178 12 239 182 13 242 186 14 242 186 14
40866 -246 186 14 246 190 14 246 190 14 246 190 14
40867 -246 190 14 246 190 14 246 190 14 246 190 14
40868 -246 190 14 246 190 14 246 190 14 246 190 14
40869 -246 190 14 236 178 12 216 158 10 175 118 6
40870 - 80 54 7 2 2 6 6 6 6 30 30 30
40871 - 54 54 54 62 62 62 50 50 50 38 38 38
40872 - 14 14 14 2 2 6 2 2 6 2 2 6
40873 - 2 2 6 2 2 6 2 2 6 2 2 6
40874 - 2 2 6 6 6 6 80 54 7 167 114 7
40875 -213 154 11 236 178 12 246 190 14 246 190 14
40876 -246 190 14 246 190 14 246 190 14 246 190 14
40877 -246 190 14 242 186 14 239 182 13 239 182 13
40878 -230 174 11 210 150 10 174 135 50 124 112 88
40879 - 82 82 82 54 54 54 34 34 34 18 18 18
40880 - 6 6 6 0 0 0 0 0 0 0 0 0
40881 - 0 0 0 0 0 0 0 0 0 0 0 0
40882 - 0 0 0 0 0 0 0 0 0 0 0 0
40883 - 0 0 0 0 0 0 6 6 6 18 18 18
40884 - 50 50 50 158 118 36 192 133 9 200 144 11
40885 -216 158 10 219 162 10 224 166 10 226 170 11
40886 -230 174 11 236 178 12 239 182 13 239 182 13
40887 -242 186 14 246 186 14 246 190 14 246 190 14
40888 -246 190 14 246 190 14 246 190 14 246 190 14
40889 -246 186 14 230 174 11 210 150 10 163 110 8
40890 -104 69 6 10 10 10 2 2 6 2 2 6
40891 - 2 2 6 2 2 6 2 2 6 2 2 6
40892 - 2 2 6 2 2 6 2 2 6 2 2 6
40893 - 2 2 6 2 2 6 2 2 6 2 2 6
40894 - 2 2 6 6 6 6 91 60 6 167 114 7
40895 -206 145 10 230 174 11 242 186 14 246 190 14
40896 -246 190 14 246 190 14 246 186 14 242 186 14
40897 -239 182 13 230 174 11 224 166 10 213 154 11
40898 -180 133 36 124 112 88 86 86 86 58 58 58
40899 - 38 38 38 22 22 22 10 10 10 6 6 6
40900 - 0 0 0 0 0 0 0 0 0 0 0 0
40901 - 0 0 0 0 0 0 0 0 0 0 0 0
40902 - 0 0 0 0 0 0 0 0 0 0 0 0
40903 - 0 0 0 0 0 0 0 0 0 14 14 14
40904 - 34 34 34 70 70 70 138 110 50 158 118 36
40905 -167 114 7 180 123 7 192 133 9 197 138 11
40906 -200 144 11 206 145 10 213 154 11 219 162 10
40907 -224 166 10 230 174 11 239 182 13 242 186 14
40908 -246 186 14 246 186 14 246 186 14 246 186 14
40909 -239 182 13 216 158 10 185 133 11 152 99 6
40910 -104 69 6 18 14 6 2 2 6 2 2 6
40911 - 2 2 6 2 2 6 2 2 6 2 2 6
40912 - 2 2 6 2 2 6 2 2 6 2 2 6
40913 - 2 2 6 2 2 6 2 2 6 2 2 6
40914 - 2 2 6 6 6 6 80 54 7 152 99 6
40915 -192 133 9 219 162 10 236 178 12 239 182 13
40916 -246 186 14 242 186 14 239 182 13 236 178 12
40917 -224 166 10 206 145 10 192 133 9 154 121 60
40918 - 94 94 94 62 62 62 42 42 42 22 22 22
40919 - 14 14 14 6 6 6 0 0 0 0 0 0
40920 - 0 0 0 0 0 0 0 0 0 0 0 0
40921 - 0 0 0 0 0 0 0 0 0 0 0 0
40922 - 0 0 0 0 0 0 0 0 0 0 0 0
40923 - 0 0 0 0 0 0 0 0 0 6 6 6
40924 - 18 18 18 34 34 34 58 58 58 78 78 78
40925 -101 98 89 124 112 88 142 110 46 156 107 11
40926 -163 110 8 167 114 7 175 118 6 180 123 7
40927 -185 133 11 197 138 11 210 150 10 219 162 10
40928 -226 170 11 236 178 12 236 178 12 234 174 13
40929 -219 162 10 197 138 11 163 110 8 130 83 6
40930 - 91 60 6 10 10 10 2 2 6 2 2 6
40931 - 18 18 18 38 38 38 38 38 38 38 38 38
40932 - 38 38 38 38 38 38 38 38 38 38 38 38
40933 - 38 38 38 38 38 38 26 26 26 2 2 6
40934 - 2 2 6 6 6 6 70 47 6 137 92 6
40935 -175 118 6 200 144 11 219 162 10 230 174 11
40936 -234 174 13 230 174 11 219 162 10 210 150 10
40937 -192 133 9 163 110 8 124 112 88 82 82 82
40938 - 50 50 50 30 30 30 14 14 14 6 6 6
40939 - 0 0 0 0 0 0 0 0 0 0 0 0
40940 - 0 0 0 0 0 0 0 0 0 0 0 0
40941 - 0 0 0 0 0 0 0 0 0 0 0 0
40942 - 0 0 0 0 0 0 0 0 0 0 0 0
40943 - 0 0 0 0 0 0 0 0 0 0 0 0
40944 - 6 6 6 14 14 14 22 22 22 34 34 34
40945 - 42 42 42 58 58 58 74 74 74 86 86 86
40946 -101 98 89 122 102 70 130 98 46 121 87 25
40947 -137 92 6 152 99 6 163 110 8 180 123 7
40948 -185 133 11 197 138 11 206 145 10 200 144 11
40949 -180 123 7 156 107 11 130 83 6 104 69 6
40950 - 50 34 6 54 54 54 110 110 110 101 98 89
40951 - 86 86 86 82 82 82 78 78 78 78 78 78
40952 - 78 78 78 78 78 78 78 78 78 78 78 78
40953 - 78 78 78 82 82 82 86 86 86 94 94 94
40954 -106 106 106 101 101 101 86 66 34 124 80 6
40955 -156 107 11 180 123 7 192 133 9 200 144 11
40956 -206 145 10 200 144 11 192 133 9 175 118 6
40957 -139 102 15 109 106 95 70 70 70 42 42 42
40958 - 22 22 22 10 10 10 0 0 0 0 0 0
40959 - 0 0 0 0 0 0 0 0 0 0 0 0
40960 - 0 0 0 0 0 0 0 0 0 0 0 0
40961 - 0 0 0 0 0 0 0 0 0 0 0 0
40962 - 0 0 0 0 0 0 0 0 0 0 0 0
40963 - 0 0 0 0 0 0 0 0 0 0 0 0
40964 - 0 0 0 0 0 0 6 6 6 10 10 10
40965 - 14 14 14 22 22 22 30 30 30 38 38 38
40966 - 50 50 50 62 62 62 74 74 74 90 90 90
40967 -101 98 89 112 100 78 121 87 25 124 80 6
40968 -137 92 6 152 99 6 152 99 6 152 99 6
40969 -138 86 6 124 80 6 98 70 6 86 66 30
40970 -101 98 89 82 82 82 58 58 58 46 46 46
40971 - 38 38 38 34 34 34 34 34 34 34 34 34
40972 - 34 34 34 34 34 34 34 34 34 34 34 34
40973 - 34 34 34 34 34 34 38 38 38 42 42 42
40974 - 54 54 54 82 82 82 94 86 76 91 60 6
40975 -134 86 6 156 107 11 167 114 7 175 118 6
40976 -175 118 6 167 114 7 152 99 6 121 87 25
40977 -101 98 89 62 62 62 34 34 34 18 18 18
40978 - 6 6 6 0 0 0 0 0 0 0 0 0
40979 - 0 0 0 0 0 0 0 0 0 0 0 0
40980 - 0 0 0 0 0 0 0 0 0 0 0 0
40981 - 0 0 0 0 0 0 0 0 0 0 0 0
40982 - 0 0 0 0 0 0 0 0 0 0 0 0
40983 - 0 0 0 0 0 0 0 0 0 0 0 0
40984 - 0 0 0 0 0 0 0 0 0 0 0 0
40985 - 0 0 0 6 6 6 6 6 6 10 10 10
40986 - 18 18 18 22 22 22 30 30 30 42 42 42
40987 - 50 50 50 66 66 66 86 86 86 101 98 89
40988 -106 86 58 98 70 6 104 69 6 104 69 6
40989 -104 69 6 91 60 6 82 62 34 90 90 90
40990 - 62 62 62 38 38 38 22 22 22 14 14 14
40991 - 10 10 10 10 10 10 10 10 10 10 10 10
40992 - 10 10 10 10 10 10 6 6 6 10 10 10
40993 - 10 10 10 10 10 10 10 10 10 14 14 14
40994 - 22 22 22 42 42 42 70 70 70 89 81 66
40995 - 80 54 7 104 69 6 124 80 6 137 92 6
40996 -134 86 6 116 81 8 100 82 52 86 86 86
40997 - 58 58 58 30 30 30 14 14 14 6 6 6
40998 - 0 0 0 0 0 0 0 0 0 0 0 0
40999 - 0 0 0 0 0 0 0 0 0 0 0 0
41000 - 0 0 0 0 0 0 0 0 0 0 0 0
41001 - 0 0 0 0 0 0 0 0 0 0 0 0
41002 - 0 0 0 0 0 0 0 0 0 0 0 0
41003 - 0 0 0 0 0 0 0 0 0 0 0 0
41004 - 0 0 0 0 0 0 0 0 0 0 0 0
41005 - 0 0 0 0 0 0 0 0 0 0 0 0
41006 - 0 0 0 6 6 6 10 10 10 14 14 14
41007 - 18 18 18 26 26 26 38 38 38 54 54 54
41008 - 70 70 70 86 86 86 94 86 76 89 81 66
41009 - 89 81 66 86 86 86 74 74 74 50 50 50
41010 - 30 30 30 14 14 14 6 6 6 0 0 0
41011 - 0 0 0 0 0 0 0 0 0 0 0 0
41012 - 0 0 0 0 0 0 0 0 0 0 0 0
41013 - 0 0 0 0 0 0 0 0 0 0 0 0
41014 - 6 6 6 18 18 18 34 34 34 58 58 58
41015 - 82 82 82 89 81 66 89 81 66 89 81 66
41016 - 94 86 66 94 86 76 74 74 74 50 50 50
41017 - 26 26 26 14 14 14 6 6 6 0 0 0
41018 - 0 0 0 0 0 0 0 0 0 0 0 0
41019 - 0 0 0 0 0 0 0 0 0 0 0 0
41020 - 0 0 0 0 0 0 0 0 0 0 0 0
41021 - 0 0 0 0 0 0 0 0 0 0 0 0
41022 - 0 0 0 0 0 0 0 0 0 0 0 0
41023 - 0 0 0 0 0 0 0 0 0 0 0 0
41024 - 0 0 0 0 0 0 0 0 0 0 0 0
41025 - 0 0 0 0 0 0 0 0 0 0 0 0
41026 - 0 0 0 0 0 0 0 0 0 0 0 0
41027 - 6 6 6 6 6 6 14 14 14 18 18 18
41028 - 30 30 30 38 38 38 46 46 46 54 54 54
41029 - 50 50 50 42 42 42 30 30 30 18 18 18
41030 - 10 10 10 0 0 0 0 0 0 0 0 0
41031 - 0 0 0 0 0 0 0 0 0 0 0 0
41032 - 0 0 0 0 0 0 0 0 0 0 0 0
41033 - 0 0 0 0 0 0 0 0 0 0 0 0
41034 - 0 0 0 6 6 6 14 14 14 26 26 26
41035 - 38 38 38 50 50 50 58 58 58 58 58 58
41036 - 54 54 54 42 42 42 30 30 30 18 18 18
41037 - 10 10 10 0 0 0 0 0 0 0 0 0
41038 - 0 0 0 0 0 0 0 0 0 0 0 0
41039 - 0 0 0 0 0 0 0 0 0 0 0 0
41040 - 0 0 0 0 0 0 0 0 0 0 0 0
41041 - 0 0 0 0 0 0 0 0 0 0 0 0
41042 - 0 0 0 0 0 0 0 0 0 0 0 0
41043 - 0 0 0 0 0 0 0 0 0 0 0 0
41044 - 0 0 0 0 0 0 0 0 0 0 0 0
41045 - 0 0 0 0 0 0 0 0 0 0 0 0
41046 - 0 0 0 0 0 0 0 0 0 0 0 0
41047 - 0 0 0 0 0 0 0 0 0 6 6 6
41048 - 6 6 6 10 10 10 14 14 14 18 18 18
41049 - 18 18 18 14 14 14 10 10 10 6 6 6
41050 - 0 0 0 0 0 0 0 0 0 0 0 0
41051 - 0 0 0 0 0 0 0 0 0 0 0 0
41052 - 0 0 0 0 0 0 0 0 0 0 0 0
41053 - 0 0 0 0 0 0 0 0 0 0 0 0
41054 - 0 0 0 0 0 0 0 0 0 6 6 6
41055 - 14 14 14 18 18 18 22 22 22 22 22 22
41056 - 18 18 18 14 14 14 10 10 10 6 6 6
41057 - 0 0 0 0 0 0 0 0 0 0 0 0
41058 - 0 0 0 0 0 0 0 0 0 0 0 0
41059 - 0 0 0 0 0 0 0 0 0 0 0 0
41060 - 0 0 0 0 0 0 0 0 0 0 0 0
41061 - 0 0 0 0 0 0 0 0 0 0 0 0
41062 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41063 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41064 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41065 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41066 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41067 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41068 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41069 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41070 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41071 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41072 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41073 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41074 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41075 +4 4 4 4 4 4
41076 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41077 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41078 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41079 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41080 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41081 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41082 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41083 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41084 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41085 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41086 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41087 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41088 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41089 +4 4 4 4 4 4
41090 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41091 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41092 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41093 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41094 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41095 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41096 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41097 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41098 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41099 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41100 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41101 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41102 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41103 +4 4 4 4 4 4
41104 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41105 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41106 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41107 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41108 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41109 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41110 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41111 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41112 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41113 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41114 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41115 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41116 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41117 +4 4 4 4 4 4
41118 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41119 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41120 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41121 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41122 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41123 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41124 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41125 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41126 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41127 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41128 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41129 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41130 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41131 +4 4 4 4 4 4
41132 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41133 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41134 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41135 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41136 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41137 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41138 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41139 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41140 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41141 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41142 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41143 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41144 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41145 +4 4 4 4 4 4
41146 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41147 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41148 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41149 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41150 +4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
41151 +0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
41152 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41153 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41154 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41155 +4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
41156 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
41157 +4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
41158 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41159 +4 4 4 4 4 4
41160 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41161 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41162 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41163 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41164 +4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
41165 +37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
41166 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41167 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41168 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41169 +4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
41170 +2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
41171 +4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
41172 +1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41173 +4 4 4 4 4 4
41174 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41175 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41176 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41177 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41178 +2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
41179 +153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
41180 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
41181 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41182 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41183 +4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
41184 +60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
41185 +4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
41186 +2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
41187 +4 4 4 4 4 4
41188 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41189 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41190 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41191 +4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
41192 +4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
41193 +165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
41194 +1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
41195 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41196 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
41197 +3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
41198 +163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
41199 +0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
41200 +37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
41201 +4 4 4 4 4 4
41202 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41203 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41204 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41205 +4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
41206 +37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
41207 +156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
41208 +125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
41209 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41210 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
41211 +0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
41212 +174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
41213 +0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
41214 +64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
41215 +4 4 4 4 4 4
41216 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41217 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41218 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41219 +5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
41220 +156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
41221 +156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
41222 +174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
41223 +1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
41224 +4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
41225 +13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
41226 +174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
41227 +22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
41228 +90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
41229 +4 4 4 4 4 4
41230 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41231 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41232 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
41233 +0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
41234 +174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
41235 +156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
41236 +163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
41237 +4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
41238 +5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
41239 +131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
41240 +190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
41241 +90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
41242 +31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
41243 +4 4 4 4 4 4
41244 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41245 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41246 +4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
41247 +4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
41248 +155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
41249 +167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
41250 +153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
41251 +41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
41252 +1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
41253 +177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
41254 +125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
41255 +136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
41256 +7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
41257 +4 4 4 4 4 4
41258 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41259 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41260 +4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
41261 +125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
41262 +156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
41263 +137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
41264 +156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
41265 +167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
41266 +0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
41267 +166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
41268 +6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
41269 +90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
41270 +1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
41271 +4 4 4 4 4 4
41272 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41273 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41274 +1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
41275 +167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
41276 +157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
41277 +26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
41278 +158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
41279 +165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
41280 +60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
41281 +137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
41282 +52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
41283 +13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
41284 +4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
41285 +4 4 4 4 4 4
41286 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41287 +4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
41288 +0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
41289 +158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
41290 +167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
41291 +4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
41292 +174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
41293 +155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
41294 +137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
41295 +16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
41296 +136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
41297 +2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
41298 +4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
41299 +4 4 4 4 4 4
41300 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41301 +4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
41302 +37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
41303 +157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
41304 +153 152 153 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
41305 +4 3 3 4 3 3 4 0 0 6 6 6 4 0 0 37 38 37
41306 +125 124 125 174 174 174 174 174 174 165 164 165 156 155 156 154 153 154
41307 +156 155 156 156 155 156 155 154 155 163 162 163 158 157 158 163 162 163
41308 +174 174 174 174 174 174 174 174 174 125 124 125 37 38 37 0 0 0
41309 +4 0 0 6 9 11 41 54 63 90 154 193 136 185 209 146 190 211
41310 +136 185 209 37 112 160 22 40 52 6 10 14 3 6 7 1 1 2
41311 +1 1 2 3 3 3 1 1 2 3 3 3 4 4 4 4 4 4
41312 +2 2 2 2 0 0 16 19 21 37 38 37 24 26 27 0 0 0
41313 +0 0 0 4 4 4
41314 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
41315 +4 4 4 0 0 0 0 0 0 0 0 0 26 28 28 120 125 127
41316 +158 157 158 174 174 174 165 164 165 157 156 157 155 154 155 156 155 156
41317 +153 152 153 153 152 153 167 166 167 174 174 174 174 174 174 125 124 125
41318 +37 38 37 4 0 0 0 0 0 4 0 0 4 3 3 4 4 4
41319 +4 4 4 4 4 4 5 5 5 4 0 0 4 0 0 4 0 0
41320 +4 3 3 43 57 68 137 136 137 174 174 174 174 174 174 165 164 165
41321 +154 153 154 153 152 153 153 152 153 153 152 153 163 162 163 174 174 174
41322 +174 174 174 153 152 153 60 73 81 6 6 6 4 0 0 4 3 3
41323 +32 43 50 80 127 157 136 185 209 146 190 211 146 190 211 90 154 193
41324 +28 67 93 28 67 93 40 71 93 3 6 7 1 1 2 2 5 5
41325 +50 82 103 79 117 143 26 37 45 0 0 0 3 3 3 1 1 1
41326 +0 0 0 41 54 63 137 136 137 174 174 174 153 152 153 60 73 81
41327 +2 0 0 0 0 0
41328 +4 4 4 4 4 4 4 4 4 4 4 4 6 6 6 2 2 2
41329 +0 0 0 2 0 0 24 26 27 60 74 84 153 152 153 174 174 174
41330 +174 174 174 157 156 157 154 153 154 156 155 156 154 153 154 153 152 153
41331 +165 164 165 174 174 174 177 184 187 137 136 137 43 57 68 6 6 6
41332 +4 0 0 2 0 0 3 3 3 5 5 5 5 5 5 4 4 4
41333 +4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 4 3 3
41334 +4 0 0 4 0 0 24 26 27 60 73 81 153 152 153 174 174 174
41335 +174 174 174 158 157 158 158 157 158 174 174 174 174 174 174 158 157 158
41336 +60 74 84 24 26 27 4 0 0 4 0 0 17 23 27 59 113 148
41337 +136 185 209 191 222 234 146 190 211 136 185 209 31 91 132 7 11 13
41338 +22 40 52 101 161 196 90 154 193 6 9 11 3 4 4 43 95 132
41339 +136 185 209 172 205 220 55 98 126 0 0 0 0 0 0 2 0 0
41340 +26 28 28 153 152 153 177 184 187 167 166 167 177 184 187 165 164 165
41341 +37 38 37 0 0 0
41342 +4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
41343 +13 16 17 60 73 81 137 136 137 174 174 174 174 174 174 165 164 165
41344 +153 152 153 153 152 153 155 154 155 154 153 154 158 157 158 174 174 174
41345 +177 184 187 163 162 163 60 73 81 16 19 21 4 0 0 4 0 0
41346 +4 3 3 4 4 4 5 5 5 5 5 5 4 4 4 5 5 5
41347 +5 5 5 5 5 5 5 5 5 4 4 4 4 4 4 5 5 5
41348 +6 6 6 4 0 0 4 0 0 4 0 0 24 26 27 60 74 84
41349 +166 165 166 174 174 174 177 184 187 165 164 165 125 124 125 24 26 27
41350 +4 0 0 4 0 0 5 5 5 50 82 103 136 185 209 172 205 220
41351 +146 190 211 136 185 209 26 108 161 22 40 52 7 12 15 44 81 103
41352 +71 116 144 28 67 93 37 51 59 41 65 82 100 139 164 101 161 196
41353 +90 154 193 90 154 193 28 67 93 0 0 0 0 0 0 26 28 28
41354 +125 124 125 167 166 167 163 162 163 153 152 153 163 162 163 174 174 174
41355 +85 115 134 4 0 0
41356 +4 4 4 5 5 5 4 4 4 1 0 0 4 0 0 34 47 55
41357 +125 124 125 174 174 174 174 174 174 167 166 167 157 156 157 153 152 153
41358 +155 154 155 155 154 155 158 157 158 166 165 166 167 166 167 154 153 154
41359 +125 124 125 26 28 28 4 0 0 4 0 0 4 0 0 5 5 5
41360 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 1 1 1
41361 +0 0 0 0 0 0 1 1 1 4 4 4 4 4 4 4 4 4
41362 +5 5 5 5 5 5 4 3 3 4 0 0 4 0 0 6 6 6
41363 +37 38 37 131 129 131 137 136 137 37 38 37 0 0 0 4 0 0
41364 +4 5 5 43 61 72 90 154 193 172 205 220 146 190 211 136 185 209
41365 +90 154 193 28 67 93 13 20 25 43 61 72 71 116 144 44 81 103
41366 +2 5 5 7 11 13 59 113 148 101 161 196 90 154 193 28 67 93
41367 +13 20 25 6 10 14 0 0 0 13 16 17 60 73 81 137 136 137
41368 +166 165 166 158 157 158 156 155 156 154 153 154 167 166 167 174 174 174
41369 +60 73 81 4 0 0
41370 +4 4 4 4 4 4 0 0 0 3 3 3 60 74 84 174 174 174
41371 +174 174 174 167 166 167 163 162 163 155 154 155 157 156 157 155 154 155
41372 +156 155 156 163 162 163 167 166 167 158 157 158 125 124 125 37 38 37
41373 +4 3 3 4 0 0 4 0 0 6 6 6 6 6 6 5 5 5
41374 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 2 3 3
41375 +10 13 16 7 11 13 1 0 0 0 0 0 2 2 1 4 4 4
41376 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 4 0 0
41377 +4 0 0 7 11 13 13 16 17 4 0 0 3 3 3 34 47 55
41378 +80 127 157 146 190 211 172 205 220 136 185 209 136 185 209 136 185 209
41379 +28 67 93 22 40 52 55 98 126 55 98 126 21 29 34 7 11 13
41380 +50 82 103 101 161 196 101 161 196 35 83 115 13 20 25 2 2 1
41381 +1 1 2 1 1 2 37 51 59 131 129 131 174 174 174 174 174 174
41382 +167 166 167 163 162 163 163 162 163 167 166 167 174 174 174 125 124 125
41383 +16 19 21 4 0 0
41384 +4 4 4 4 0 0 4 0 0 60 74 84 174 174 174 174 174 174
41385 +158 157 158 155 154 155 155 154 155 156 155 156 155 154 155 158 157 158
41386 +167 166 167 165 164 165 131 129 131 60 73 81 13 16 17 4 0 0
41387 +4 0 0 4 3 3 6 6 6 4 3 3 5 5 5 4 4 4
41388 +4 4 4 3 2 2 0 0 0 0 0 0 7 11 13 45 69 86
41389 +80 127 157 71 116 144 43 61 72 7 11 13 0 0 0 1 1 1
41390 +4 3 3 4 4 4 4 4 4 4 4 4 6 6 6 5 5 5
41391 +3 2 2 4 0 0 1 0 0 21 29 34 59 113 148 136 185 209
41392 +146 190 211 136 185 209 136 185 209 136 185 209 136 185 209 136 185 209
41393 +68 124 159 44 81 103 22 40 52 13 16 17 43 61 72 90 154 193
41394 +136 185 209 59 113 148 21 29 34 3 4 3 1 1 1 0 0 0
41395 +24 26 27 125 124 125 163 162 163 174 174 174 166 165 166 165 164 165
41396 +163 162 163 125 124 125 125 124 125 125 124 125 125 124 125 26 28 28
41397 +4 0 0 4 3 3
41398 +3 3 3 0 0 0 24 26 27 153 152 153 177 184 187 158 157 158
41399 +156 155 156 156 155 156 155 154 155 155 154 155 165 164 165 174 174 174
41400 +155 154 155 60 74 84 26 28 28 4 0 0 4 0 0 3 1 0
41401 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3
41402 +2 0 0 0 0 0 0 0 0 32 43 50 72 125 159 101 161 196
41403 +136 185 209 101 161 196 101 161 196 79 117 143 32 43 50 0 0 0
41404 +0 0 0 2 2 2 4 4 4 4 4 4 3 3 3 1 0 0
41405 +0 0 0 4 5 5 49 76 92 101 161 196 146 190 211 146 190 211
41406 +136 185 209 136 185 209 136 185 209 136 185 209 136 185 209 90 154 193
41407 +28 67 93 13 16 17 37 51 59 80 127 157 136 185 209 90 154 193
41408 +22 40 52 6 9 11 3 4 3 2 2 1 16 19 21 60 73 81
41409 +137 136 137 163 162 163 158 157 158 166 165 166 167 166 167 153 152 153
41410 +60 74 84 37 38 37 6 6 6 13 16 17 4 0 0 1 0 0
41411 +3 2 2 4 4 4
41412 +3 2 2 4 0 0 37 38 37 137 136 137 167 166 167 158 157 158
41413 +157 156 157 154 153 154 157 156 157 167 166 167 174 174 174 125 124 125
41414 +37 38 37 4 0 0 4 0 0 4 0 0 4 3 3 4 4 4
41415 +4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
41416 +0 0 0 16 21 25 55 98 126 90 154 193 136 185 209 101 161 196
41417 +101 161 196 101 161 196 136 185 209 136 185 209 101 161 196 55 98 126
41418 +14 17 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
41419 +22 40 52 90 154 193 146 190 211 146 190 211 136 185 209 136 185 209
41420 +136 185 209 136 185 209 136 185 209 101 161 196 35 83 115 7 11 13
41421 +17 23 27 59 113 148 136 185 209 101 161 196 34 86 122 7 12 15
41422 +2 5 5 3 4 3 6 6 6 60 73 81 131 129 131 163 162 163
41423 +166 165 166 174 174 174 174 174 174 163 162 163 125 124 125 41 54 63
41424 +13 16 17 4 0 0 4 0 0 4 0 0 1 0 0 2 2 2
41425 +4 4 4 4 4 4
41426 +1 1 1 2 1 0 43 57 68 137 136 137 153 152 153 153 152 153
41427 +163 162 163 156 155 156 165 164 165 167 166 167 60 74 84 6 6 6
41428 +4 0 0 4 0 0 5 5 5 4 4 4 4 4 4 4 4 4
41429 +4 5 5 6 6 6 4 3 3 0 0 0 0 0 0 11 15 18
41430 +40 71 93 100 139 164 101 161 196 101 161 196 101 161 196 101 161 196
41431 +101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 136 185 209
41432 +101 161 196 45 69 86 6 6 6 0 0 0 17 23 27 55 98 126
41433 +136 185 209 146 190 211 136 185 209 136 185 209 136 185 209 136 185 209
41434 +136 185 209 136 185 209 90 154 193 22 40 52 7 11 13 50 82 103
41435 +136 185 209 136 185 209 53 118 160 22 40 52 7 11 13 2 5 5
41436 +3 4 3 37 38 37 125 124 125 157 156 157 166 165 166 167 166 167
41437 +174 174 174 174 174 174 137 136 137 60 73 81 4 0 0 4 0 0
41438 +4 0 0 4 0 0 5 5 5 3 3 3 3 3 3 4 4 4
41439 +4 4 4 4 4 4
41440 +4 0 0 4 0 0 41 54 63 137 136 137 125 124 125 131 129 131
41441 +155 154 155 167 166 167 174 174 174 60 74 84 6 6 6 4 0 0
41442 +4 3 3 6 6 6 4 4 4 4 4 4 4 4 4 5 5 5
41443 +4 4 4 1 1 1 0 0 0 3 6 7 41 65 82 72 125 159
41444 +101 161 196 101 161 196 101 161 196 90 154 193 90 154 193 101 161 196
41445 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
41446 +136 185 209 136 185 209 80 127 157 55 98 126 101 161 196 146 190 211
41447 +136 185 209 136 185 209 136 185 209 101 161 196 136 185 209 101 161 196
41448 +136 185 209 101 161 196 35 83 115 22 30 35 101 161 196 172 205 220
41449 +90 154 193 28 67 93 7 11 13 2 5 5 3 4 3 13 16 17
41450 +85 115 134 167 166 167 174 174 174 174 174 174 174 174 174 174 174 174
41451 +167 166 167 60 74 84 13 16 17 4 0 0 4 0 0 4 3 3
41452 +6 6 6 5 5 5 4 4 4 5 5 5 4 4 4 5 5 5
41453 +5 5 5 5 5 5
41454 +1 1 1 4 0 0 41 54 63 137 136 137 137 136 137 125 124 125
41455 +131 129 131 167 166 167 157 156 157 37 38 37 6 6 6 4 0 0
41456 +6 6 6 5 5 5 4 4 4 4 4 4 4 5 5 2 2 1
41457 +0 0 0 0 0 0 26 37 45 58 111 146 101 161 196 101 161 196
41458 +101 161 196 90 154 193 90 154 193 90 154 193 101 161 196 101 161 196
41459 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
41460 +101 161 196 136 185 209 136 185 209 136 185 209 146 190 211 136 185 209
41461 +136 185 209 101 161 196 136 185 209 136 185 209 101 161 196 136 185 209
41462 +101 161 196 136 185 209 136 185 209 136 185 209 136 185 209 16 89 141
41463 +7 11 13 2 5 5 2 5 5 13 16 17 60 73 81 154 154 154
41464 +174 174 174 174 174 174 174 174 174 174 174 174 163 162 163 125 124 125
41465 +24 26 27 4 0 0 4 0 0 4 0 0 5 5 5 5 5 5
41466 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
41467 +5 5 5 4 4 4
41468 +4 0 0 6 6 6 37 38 37 137 136 137 137 136 137 131 129 131
41469 +131 129 131 153 152 153 131 129 131 26 28 28 4 0 0 4 3 3
41470 +6 6 6 4 4 4 4 4 4 4 4 4 0 0 0 0 0 0
41471 +13 20 25 51 88 114 90 154 193 101 161 196 101 161 196 90 154 193
41472 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
41473 +101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 101 161 196
41474 +101 161 196 136 185 209 101 161 196 136 185 209 136 185 209 101 161 196
41475 +136 185 209 101 161 196 136 185 209 101 161 196 101 161 196 101 161 196
41476 +136 185 209 136 185 209 136 185 209 37 112 160 21 29 34 5 7 8
41477 +2 5 5 13 16 17 43 57 68 131 129 131 174 174 174 174 174 174
41478 +174 174 174 167 166 167 157 156 157 125 124 125 37 38 37 4 0 0
41479 +4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
41480 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41481 +4 4 4 4 4 4
41482 +1 1 1 4 0 0 41 54 63 153 152 153 137 136 137 137 136 137
41483 +137 136 137 153 152 153 125 124 125 24 26 27 4 0 0 3 2 2
41484 +4 4 4 4 4 4 4 3 3 4 0 0 3 6 7 43 61 72
41485 +64 123 161 101 161 196 90 154 193 90 154 193 90 154 193 90 154 193
41486 +90 154 193 90 154 193 90 154 193 90 154 193 101 161 196 90 154 193
41487 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
41488 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
41489 +136 185 209 101 161 196 101 161 196 136 185 209 136 185 209 101 161 196
41490 +101 161 196 90 154 193 28 67 93 13 16 17 7 11 13 3 6 7
41491 +37 51 59 125 124 125 163 162 163 174 174 174 167 166 167 166 165 166
41492 +167 166 167 131 129 131 60 73 81 4 0 0 4 0 0 4 0 0
41493 +3 3 3 5 5 5 6 6 6 4 4 4 4 4 4 4 4 4
41494 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41495 +4 4 4 4 4 4
41496 +4 0 0 4 0 0 41 54 63 137 136 137 153 152 153 137 136 137
41497 +153 152 153 157 156 157 125 124 125 24 26 27 0 0 0 2 2 2
41498 +4 4 4 4 4 4 2 0 0 0 0 0 28 67 93 90 154 193
41499 +90 154 193 90 154 193 90 154 193 90 154 193 64 123 161 90 154 193
41500 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
41501 +90 154 193 101 161 196 101 161 196 101 161 196 90 154 193 136 185 209
41502 +101 161 196 101 161 196 136 185 209 101 161 196 136 185 209 101 161 196
41503 +101 161 196 101 161 196 136 185 209 101 161 196 101 161 196 90 154 193
41504 +35 83 115 13 16 17 3 6 7 2 5 5 13 16 17 60 74 84
41505 +154 154 154 166 165 166 165 164 165 158 157 158 163 162 163 157 156 157
41506 +60 74 84 13 16 17 4 0 0 4 0 0 3 2 2 4 4 4
41507 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41508 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41509 +4 4 4 4 4 4
41510 +1 1 1 4 0 0 41 54 63 157 156 157 155 154 155 137 136 137
41511 +153 152 153 158 157 158 137 136 137 26 28 28 2 0 0 2 2 2
41512 +4 4 4 4 4 4 1 0 0 6 10 14 34 86 122 90 154 193
41513 +64 123 161 90 154 193 64 123 161 90 154 193 90 154 193 90 154 193
41514 +64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
41515 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
41516 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
41517 +136 185 209 101 161 196 136 185 209 90 154 193 26 108 161 22 40 52
41518 +13 16 17 5 7 8 2 5 5 2 5 5 37 38 37 165 164 165
41519 +174 174 174 163 162 163 154 154 154 165 164 165 167 166 167 60 73 81
41520 +6 6 6 4 0 0 4 0 0 4 4 4 4 4 4 4 4 4
41521 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41522 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41523 +4 4 4 4 4 4
41524 +4 0 0 6 6 6 41 54 63 156 155 156 158 157 158 153 152 153
41525 +156 155 156 165 164 165 137 136 137 26 28 28 0 0 0 2 2 2
41526 +4 4 5 4 4 4 2 0 0 7 12 15 31 96 139 64 123 161
41527 +90 154 193 64 123 161 90 154 193 90 154 193 64 123 161 90 154 193
41528 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
41529 +90 154 193 90 154 193 90 154 193 101 161 196 101 161 196 101 161 196
41530 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
41531 +101 161 196 136 185 209 26 108 161 22 40 52 7 11 13 5 7 8
41532 +2 5 5 2 5 5 2 5 5 2 2 1 37 38 37 158 157 158
41533 +174 174 174 154 154 154 156 155 156 167 166 167 165 164 165 37 38 37
41534 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41535 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41536 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41537 +4 4 4 4 4 4
41538 +3 1 0 4 0 0 60 73 81 157 156 157 163 162 163 153 152 153
41539 +158 157 158 167 166 167 137 136 137 26 28 28 2 0 0 2 2 2
41540 +4 5 5 4 4 4 4 0 0 7 12 15 24 86 132 26 108 161
41541 +37 112 160 64 123 161 90 154 193 64 123 161 90 154 193 90 154 193
41542 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
41543 +90 154 193 101 161 196 90 154 193 101 161 196 101 161 196 101 161 196
41544 +101 161 196 101 161 196 101 161 196 136 185 209 101 161 196 136 185 209
41545 +90 154 193 35 83 115 13 16 17 13 16 17 7 11 13 3 6 7
41546 +5 7 8 6 6 6 3 4 3 2 2 1 30 32 34 154 154 154
41547 +167 166 167 154 154 154 154 154 154 174 174 174 165 164 165 37 38 37
41548 +6 6 6 4 0 0 6 6 6 4 4 4 4 4 4 4 4 4
41549 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41550 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41551 +4 4 4 4 4 4
41552 +4 0 0 4 0 0 41 54 63 163 162 163 166 165 166 154 154 154
41553 +163 162 163 174 174 174 137 136 137 26 28 28 0 0 0 2 2 2
41554 +4 5 5 4 4 5 1 1 2 6 10 14 28 67 93 18 97 151
41555 +18 97 151 18 97 151 26 108 161 37 112 160 37 112 160 90 154 193
41556 +64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
41557 +90 154 193 101 161 196 101 161 196 90 154 193 101 161 196 101 161 196
41558 +101 161 196 101 161 196 101 161 196 136 185 209 90 154 193 16 89 141
41559 +13 20 25 7 11 13 5 7 8 5 7 8 2 5 5 4 5 5
41560 +3 4 3 4 5 5 3 4 3 0 0 0 37 38 37 158 157 158
41561 +174 174 174 158 157 158 158 157 158 167 166 167 174 174 174 41 54 63
41562 +4 0 0 3 2 2 5 5 5 4 4 4 4 4 4 4 4 4
41563 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41564 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41565 +4 4 4 4 4 4
41566 +1 1 1 4 0 0 60 73 81 165 164 165 174 174 174 158 157 158
41567 +167 166 167 174 174 174 153 152 153 26 28 28 2 0 0 2 2 2
41568 +4 5 5 4 4 4 4 0 0 7 12 15 10 87 144 10 87 144
41569 +18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
41570 +26 108 161 37 112 160 53 118 160 90 154 193 90 154 193 90 154 193
41571 +90 154 193 90 154 193 101 161 196 101 161 196 101 161 196 101 161 196
41572 +101 161 196 136 185 209 90 154 193 26 108 161 22 40 52 13 16 17
41573 +7 11 13 3 6 7 5 7 8 5 7 8 2 5 5 4 5 5
41574 +4 5 5 6 6 6 3 4 3 0 0 0 30 32 34 158 157 158
41575 +174 174 174 156 155 156 155 154 155 165 164 165 154 153 154 37 38 37
41576 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41577 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41578 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41579 +4 4 4 4 4 4
41580 +4 0 0 4 0 0 60 73 81 167 166 167 174 174 174 163 162 163
41581 +174 174 174 174 174 174 153 152 153 26 28 28 0 0 0 3 3 3
41582 +5 5 5 4 4 4 1 1 2 7 12 15 28 67 93 18 97 151
41583 +18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
41584 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41585 +90 154 193 26 108 161 90 154 193 90 154 193 90 154 193 101 161 196
41586 +101 161 196 26 108 161 22 40 52 13 16 17 7 11 13 2 5 5
41587 +2 5 5 6 6 6 2 5 5 4 5 5 4 5 5 4 5 5
41588 +3 4 3 5 5 5 3 4 3 2 0 0 30 32 34 137 136 137
41589 +153 152 153 137 136 137 131 129 131 137 136 137 131 129 131 37 38 37
41590 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41591 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41592 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41593 +4 4 4 4 4 4
41594 +1 1 1 4 0 0 60 73 81 167 166 167 174 174 174 166 165 166
41595 +174 174 174 177 184 187 153 152 153 30 32 34 1 0 0 3 3 3
41596 +5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
41597 +18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
41598 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41599 +26 108 161 26 108 161 26 108 161 90 154 193 90 154 193 26 108 161
41600 +35 83 115 13 16 17 7 11 13 5 7 8 3 6 7 5 7 8
41601 +2 5 5 6 6 6 4 5 5 4 5 5 3 4 3 4 5 5
41602 +3 4 3 6 6 6 3 4 3 0 0 0 26 28 28 125 124 125
41603 +131 129 131 125 124 125 125 124 125 131 129 131 131 129 131 37 38 37
41604 +4 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41605 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41606 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41607 +4 4 4 4 4 4
41608 +3 1 0 4 0 0 60 73 81 174 174 174 177 184 187 167 166 167
41609 +174 174 174 177 184 187 153 152 153 30 32 34 0 0 0 3 3 3
41610 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
41611 +18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
41612 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41613 +26 108 161 90 154 193 26 108 161 26 108 161 24 86 132 13 20 25
41614 +7 11 13 13 20 25 22 40 52 5 7 8 3 4 3 3 4 3
41615 +4 5 5 3 4 3 4 5 5 3 4 3 4 5 5 3 4 3
41616 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
41617 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41618 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41619 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41620 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41621 +4 4 4 4 4 4
41622 +1 1 1 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
41623 +174 174 174 190 197 201 157 156 157 30 32 34 1 0 0 3 3 3
41624 +5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
41625 +18 97 151 19 95 150 19 95 150 18 97 151 18 97 151 26 108 161
41626 +18 97 151 26 108 161 26 108 161 26 108 161 26 108 161 90 154 193
41627 +26 108 161 26 108 161 26 108 161 22 40 52 2 5 5 3 4 3
41628 +28 67 93 37 112 160 34 86 122 2 5 5 3 4 3 3 4 3
41629 +3 4 3 3 4 3 3 4 3 2 2 1 3 4 3 4 4 4
41630 +4 5 5 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41631 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41632 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41633 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41634 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41635 +4 4 4 4 4 4
41636 +4 0 0 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
41637 +174 174 174 190 197 201 158 157 158 30 32 34 0 0 0 2 2 2
41638 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
41639 +10 87 144 19 95 150 19 95 150 18 97 151 18 97 151 18 97 151
41640 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41641 +18 97 151 22 40 52 2 5 5 2 2 1 22 40 52 26 108 161
41642 +90 154 193 37 112 160 22 40 52 3 4 3 13 20 25 22 30 35
41643 +3 6 7 1 1 1 2 2 2 6 9 11 5 5 5 4 3 3
41644 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
41645 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41646 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41647 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41648 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41649 +4 4 4 4 4 4
41650 +1 1 1 4 0 0 60 73 81 177 184 187 193 200 203 174 174 174
41651 +177 184 187 193 200 203 163 162 163 30 32 34 4 0 0 2 2 2
41652 +5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
41653 +10 87 144 10 87 144 19 95 150 19 95 150 19 95 150 18 97 151
41654 +26 108 161 26 108 161 26 108 161 90 154 193 26 108 161 28 67 93
41655 +6 10 14 2 5 5 13 20 25 24 86 132 37 112 160 90 154 193
41656 +10 87 144 7 12 15 2 5 5 28 67 93 37 112 160 28 67 93
41657 +2 2 1 7 12 15 35 83 115 28 67 93 3 6 7 1 0 0
41658 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41659 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41660 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41661 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41662 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41663 +4 4 4 4 4 4
41664 +4 0 0 4 0 0 60 73 81 174 174 174 190 197 201 174 174 174
41665 +177 184 187 193 200 203 163 162 163 30 32 34 0 0 0 2 2 2
41666 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
41667 +10 87 144 16 89 141 19 95 150 10 87 144 26 108 161 26 108 161
41668 +26 108 161 26 108 161 26 108 161 28 67 93 6 10 14 1 1 2
41669 +7 12 15 28 67 93 26 108 161 16 89 141 24 86 132 21 29 34
41670 +3 4 3 21 29 34 37 112 160 37 112 160 27 99 146 21 29 34
41671 +21 29 34 26 108 161 90 154 193 35 83 115 1 1 2 2 0 0
41672 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
41673 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41674 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41675 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41676 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41677 +4 4 4 4 4 4
41678 +3 1 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
41679 +190 197 201 193 200 203 165 164 165 37 38 37 4 0 0 2 2 2
41680 +5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
41681 +10 87 144 10 87 144 16 89 141 18 97 151 18 97 151 10 87 144
41682 +24 86 132 24 86 132 13 20 25 4 5 7 4 5 7 22 40 52
41683 +18 97 151 37 112 160 26 108 161 7 12 15 1 1 1 0 0 0
41684 +28 67 93 37 112 160 26 108 161 28 67 93 22 40 52 28 67 93
41685 +26 108 161 90 154 193 26 108 161 10 87 144 0 0 0 2 0 0
41686 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41687 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41688 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41689 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41690 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41691 +4 4 4 4 4 4
41692 +4 0 0 6 6 6 60 73 81 174 174 174 193 200 203 174 174 174
41693 +190 197 201 193 200 203 165 164 165 30 32 34 0 0 0 2 2 2
41694 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
41695 +10 87 144 10 87 144 10 87 144 18 97 151 28 67 93 6 10 14
41696 +0 0 0 1 1 2 4 5 7 13 20 25 16 89 141 26 108 161
41697 +26 108 161 26 108 161 24 86 132 6 9 11 2 3 3 22 40 52
41698 +37 112 160 16 89 141 22 40 52 28 67 93 26 108 161 26 108 161
41699 +90 154 193 26 108 161 26 108 161 28 67 93 1 1 1 4 0 0
41700 +4 4 4 5 5 5 3 3 3 4 0 0 26 28 28 124 126 130
41701 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41702 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41703 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41704 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41705 +4 4 4 4 4 4
41706 +4 0 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
41707 +193 200 203 193 200 203 167 166 167 37 38 37 4 0 0 2 2 2
41708 +5 5 5 4 4 4 4 0 0 6 10 14 28 67 93 10 87 144
41709 +10 87 144 10 87 144 18 97 151 10 87 144 13 20 25 4 5 7
41710 +1 1 2 1 1 1 22 40 52 26 108 161 26 108 161 26 108 161
41711 +26 108 161 26 108 161 26 108 161 24 86 132 22 40 52 22 40 52
41712 +22 40 52 22 40 52 10 87 144 26 108 161 26 108 161 26 108 161
41713 +26 108 161 26 108 161 90 154 193 10 87 144 0 0 0 4 0 0
41714 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41715 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41716 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41717 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41718 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41719 +4 4 4 4 4 4
41720 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
41721 +190 197 201 205 212 215 167 166 167 30 32 34 0 0 0 2 2 2
41722 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
41723 +10 87 144 10 87 144 10 87 144 10 87 144 22 40 52 1 1 2
41724 +2 0 0 1 1 2 24 86 132 26 108 161 26 108 161 26 108 161
41725 +26 108 161 19 95 150 16 89 141 10 87 144 22 40 52 22 40 52
41726 +10 87 144 26 108 161 37 112 160 26 108 161 26 108 161 26 108 161
41727 +26 108 161 26 108 161 26 108 161 28 67 93 2 0 0 3 1 0
41728 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
41729 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41730 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41731 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41732 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41733 +4 4 4 4 4 4
41734 +4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
41735 +193 200 203 193 200 203 174 174 174 37 38 37 4 0 0 2 2 2
41736 +5 5 5 4 4 4 3 2 2 1 1 2 13 20 25 10 87 144
41737 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 13 20 25
41738 +13 20 25 22 40 52 10 87 144 18 97 151 18 97 151 26 108 161
41739 +10 87 144 13 20 25 6 10 14 21 29 34 24 86 132 18 97 151
41740 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41741 +26 108 161 90 154 193 18 97 151 13 20 25 0 0 0 4 3 3
41742 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41743 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41744 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41745 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41746 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41747 +4 4 4 4 4 4
41748 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
41749 +190 197 201 220 221 221 167 166 167 30 32 34 1 0 0 2 2 2
41750 +5 5 5 4 4 4 4 4 5 2 5 5 4 5 7 13 20 25
41751 +28 67 93 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
41752 +10 87 144 10 87 144 18 97 151 10 87 144 18 97 151 18 97 151
41753 +28 67 93 2 3 3 0 0 0 28 67 93 26 108 161 26 108 161
41754 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41755 +26 108 161 10 87 144 13 20 25 1 1 2 3 2 2 4 4 4
41756 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
41757 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41758 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41759 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41760 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41761 +4 4 4 4 4 4
41762 +4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
41763 +193 200 203 193 200 203 174 174 174 26 28 28 4 0 0 4 3 3
41764 +5 5 5 4 4 4 4 4 4 4 4 5 1 1 2 2 5 5
41765 +4 5 7 22 40 52 10 87 144 10 87 144 18 97 151 10 87 144
41766 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 18 97 151
41767 +10 87 144 28 67 93 22 40 52 10 87 144 26 108 161 18 97 151
41768 +18 97 151 18 97 151 26 108 161 26 108 161 26 108 161 26 108 161
41769 +22 40 52 1 1 2 0 0 0 2 3 3 4 4 4 4 4 4
41770 +4 4 4 5 5 5 4 4 4 0 0 0 26 28 28 131 129 131
41771 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41772 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41773 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41774 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41775 +4 4 4 4 4 4
41776 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
41777 +190 197 201 220 221 221 190 197 201 41 54 63 4 0 0 2 2 2
41778 +6 6 6 4 4 4 4 4 4 4 4 5 4 4 5 3 3 3
41779 +1 1 2 1 1 2 6 10 14 22 40 52 10 87 144 18 97 151
41780 +18 97 151 10 87 144 10 87 144 10 87 144 18 97 151 10 87 144
41781 +10 87 144 18 97 151 26 108 161 18 97 151 18 97 151 10 87 144
41782 +26 108 161 26 108 161 26 108 161 10 87 144 28 67 93 6 10 14
41783 +1 1 2 1 1 2 4 3 3 4 4 5 4 4 4 4 4 4
41784 +5 5 5 5 5 5 1 1 1 4 0 0 37 51 59 137 136 137
41785 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41786 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41787 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41788 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41789 +4 4 4 4 4 4
41790 +4 0 0 4 0 0 60 73 81 220 221 221 193 200 203 174 174 174
41791 +193 200 203 193 200 203 220 221 221 137 136 137 13 16 17 4 0 0
41792 +2 2 2 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5
41793 +4 4 5 4 3 3 1 1 2 4 5 7 13 20 25 28 67 93
41794 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
41795 +10 87 144 18 97 151 18 97 151 10 87 144 18 97 151 26 108 161
41796 +26 108 161 18 97 151 28 67 93 6 10 14 0 0 0 0 0 0
41797 +2 3 3 4 5 5 4 4 5 4 4 4 4 4 4 5 5 5
41798 +3 3 3 1 1 1 0 0 0 16 19 21 125 124 125 137 136 137
41799 +131 129 131 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41800 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41801 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41802 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41803 +4 4 4 4 4 4
41804 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
41805 +193 200 203 190 197 201 220 221 221 220 221 221 153 152 153 30 32 34
41806 +0 0 0 0 0 0 2 2 2 4 4 4 4 4 4 4 4 4
41807 +4 4 4 4 5 5 4 5 7 1 1 2 1 1 2 4 5 7
41808 +13 20 25 28 67 93 10 87 144 18 97 151 10 87 144 10 87 144
41809 +10 87 144 10 87 144 10 87 144 18 97 151 26 108 161 18 97 151
41810 +28 67 93 7 12 15 0 0 0 0 0 0 2 2 1 4 4 4
41811 +4 5 5 4 5 5 4 4 4 4 4 4 3 3 3 0 0 0
41812 +0 0 0 0 0 0 37 38 37 125 124 125 158 157 158 131 129 131
41813 +125 124 125 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41814 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41815 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41816 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41817 +4 4 4 4 4 4
41818 +4 3 3 4 0 0 41 54 63 193 200 203 220 221 221 174 174 174
41819 +193 200 203 193 200 203 193 200 203 220 221 221 244 246 246 193 200 203
41820 +120 125 127 5 5 5 1 0 0 0 0 0 1 1 1 4 4 4
41821 +4 4 4 4 4 4 4 5 5 4 5 5 4 4 5 1 1 2
41822 +4 5 7 4 5 7 22 40 52 10 87 144 10 87 144 10 87 144
41823 +10 87 144 10 87 144 18 97 151 10 87 144 10 87 144 13 20 25
41824 +4 5 7 2 3 3 1 1 2 4 4 4 4 5 5 4 4 4
41825 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 1 2
41826 +24 26 27 60 74 84 153 152 153 163 162 163 137 136 137 125 124 125
41827 +125 124 125 125 124 125 125 124 125 137 136 137 125 124 125 26 28 28
41828 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41829 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41830 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41831 +4 4 4 4 4 4
41832 +4 0 0 6 6 6 26 28 28 156 155 156 220 221 221 220 221 221
41833 +174 174 174 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
41834 +220 221 221 167 166 167 60 73 81 7 11 13 0 0 0 0 0 0
41835 +3 3 3 4 4 4 4 4 4 4 4 4 4 4 5 4 4 5
41836 +4 4 5 1 1 2 1 1 2 4 5 7 22 40 52 10 87 144
41837 +10 87 144 10 87 144 10 87 144 22 40 52 4 5 7 1 1 2
41838 +1 1 2 4 4 5 4 4 4 4 4 4 4 4 4 4 4 4
41839 +5 5 5 2 2 2 0 0 0 4 0 0 16 19 21 60 73 81
41840 +137 136 137 167 166 167 158 157 158 137 136 137 131 129 131 131 129 131
41841 +125 124 125 125 124 125 131 129 131 155 154 155 60 74 84 5 7 8
41842 +0 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41843 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41844 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41845 +4 4 4 4 4 4
41846 +5 5 5 4 0 0 4 0 0 60 73 81 193 200 203 220 221 221
41847 +193 200 203 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
41848 +220 221 221 220 221 221 220 221 221 137 136 137 43 57 68 6 6 6
41849 +4 0 0 1 1 1 4 4 4 4 4 4 4 4 4 4 4 4
41850 +4 4 5 4 4 5 3 2 2 1 1 2 2 5 5 13 20 25
41851 +22 40 52 22 40 52 13 20 25 2 3 3 1 1 2 3 3 3
41852 +4 5 7 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41853 +1 1 1 0 0 0 2 3 3 41 54 63 131 129 131 166 165 166
41854 +166 165 166 155 154 155 153 152 153 137 136 137 137 136 137 125 124 125
41855 +125 124 125 137 136 137 137 136 137 125 124 125 37 38 37 4 3 3
41856 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41857 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41858 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41859 +4 4 4 4 4 4
41860 +4 3 3 6 6 6 6 6 6 13 16 17 60 73 81 167 166 167
41861 +220 221 221 220 221 221 220 221 221 193 200 203 193 200 203 193 200 203
41862 +205 212 215 220 221 221 220 221 221 244 246 246 205 212 215 125 124 125
41863 +24 26 27 0 0 0 0 0 0 2 2 2 5 5 5 5 5 5
41864 +4 4 4 4 4 4 4 4 4 4 4 5 1 1 2 4 5 7
41865 +4 5 7 4 5 7 1 1 2 3 2 2 4 4 5 4 4 4
41866 +4 4 4 4 4 4 5 5 5 4 4 4 0 0 0 0 0 0
41867 +2 0 0 26 28 28 125 124 125 174 174 174 174 174 174 166 165 166
41868 +156 155 156 153 152 153 137 136 137 137 136 137 131 129 131 137 136 137
41869 +137 136 137 137 136 137 60 74 84 30 32 34 4 0 0 4 0 0
41870 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41871 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41872 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41873 +4 4 4 4 4 4
41874 +5 5 5 6 6 6 4 0 0 4 0 0 6 6 6 26 28 28
41875 +125 124 125 174 174 174 220 221 221 220 221 221 220 221 221 193 200 203
41876 +205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
41877 +193 200 203 60 74 84 13 16 17 4 0 0 0 0 0 3 3 3
41878 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 5 3 3 3
41879 +1 1 2 3 3 3 4 4 5 4 4 5 4 4 4 4 4 4
41880 +5 5 5 5 5 5 2 2 2 0 0 0 0 0 0 13 16 17
41881 +60 74 84 174 174 174 193 200 203 174 174 174 167 166 167 163 162 163
41882 +153 152 153 153 152 153 137 136 137 137 136 137 153 152 153 137 136 137
41883 +125 124 125 41 54 63 24 26 27 4 0 0 4 0 0 5 5 5
41884 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41885 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41886 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41887 +4 4 4 4 4 4
41888 +4 3 3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41889 +6 6 6 37 38 37 131 129 131 220 221 221 220 221 221 220 221 221
41890 +193 200 203 193 200 203 220 221 221 205 212 215 220 221 221 244 246 246
41891 +244 246 246 244 246 246 174 174 174 41 54 63 0 0 0 0 0 0
41892 +0 0 0 4 4 4 5 5 5 5 5 5 4 4 4 4 4 5
41893 +4 4 5 4 4 5 4 4 4 4 4 4 6 6 6 6 6 6
41894 +3 3 3 0 0 0 2 0 0 13 16 17 60 73 81 156 155 156
41895 +220 221 221 193 200 203 174 174 174 165 164 165 163 162 163 154 153 154
41896 +153 152 153 153 152 153 158 157 158 163 162 163 137 136 137 60 73 81
41897 +13 16 17 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
41898 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41899 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41900 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41901 +4 4 4 4 4 4
41902 +5 5 5 4 3 3 4 3 3 6 6 6 6 6 6 6 6 6
41903 +6 6 6 6 6 6 6 6 6 37 38 37 167 166 167 244 246 246
41904 +244 246 246 220 221 221 205 212 215 205 212 215 220 221 221 193 200 203
41905 +220 221 221 244 246 246 244 246 246 244 246 246 137 136 137 37 38 37
41906 +3 2 2 0 0 0 1 1 1 5 5 5 5 5 5 4 4 4
41907 +4 4 4 4 4 4 4 4 4 5 5 5 4 4 4 1 1 1
41908 +0 0 0 5 5 5 43 57 68 153 152 153 193 200 203 220 221 221
41909 +177 184 187 174 174 174 167 166 167 166 165 166 158 157 158 157 156 157
41910 +158 157 158 166 165 166 156 155 156 85 115 134 13 16 17 4 0 0
41911 +4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
41912 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41913 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41914 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41915 +4 4 4 4 4 4
41916 +5 5 5 4 3 3 6 6 6 6 6 6 4 0 0 6 6 6
41917 +6 6 6 6 6 6 6 6 6 6 6 6 13 16 17 60 73 81
41918 +177 184 187 220 221 221 220 221 221 220 221 221 205 212 215 220 221 221
41919 +220 221 221 205 212 215 220 221 221 244 246 246 244 246 246 205 212 215
41920 +125 124 125 30 32 34 0 0 0 0 0 0 2 2 2 5 5 5
41921 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 0 0
41922 +37 38 37 131 129 131 205 212 215 220 221 221 193 200 203 174 174 174
41923 +174 174 174 174 174 174 167 166 167 165 164 165 166 165 166 167 166 167
41924 +158 157 158 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
41925 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41926 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41927 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41928 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41929 +4 4 4 4 4 4
41930 +4 4 4 5 5 5 4 3 3 4 3 3 6 6 6 6 6 6
41931 +4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41932 +26 28 28 125 124 125 205 212 215 220 221 221 220 221 221 220 221 221
41933 +205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
41934 +244 246 246 190 197 201 60 74 84 16 19 21 4 0 0 0 0 0
41935 +0 0 0 0 0 0 0 0 0 0 0 0 16 19 21 120 125 127
41936 +177 184 187 220 221 221 205 212 215 177 184 187 174 174 174 177 184 187
41937 +174 174 174 174 174 174 167 166 167 174 174 174 166 165 166 137 136 137
41938 +60 73 81 13 16 17 4 0 0 4 0 0 4 3 3 6 6 6
41939 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41940 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41941 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41942 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41943 +4 4 4 4 4 4
41944 +5 5 5 4 3 3 5 5 5 4 3 3 6 6 6 4 0 0
41945 +6 6 6 6 6 6 4 0 0 6 6 6 4 0 0 6 6 6
41946 +6 6 6 6 6 6 37 38 37 137 136 137 193 200 203 220 221 221
41947 +220 221 221 205 212 215 220 221 221 205 212 215 205 212 215 220 221 221
41948 +220 221 221 220 221 221 244 246 246 166 165 166 43 57 68 2 2 2
41949 +0 0 0 4 0 0 16 19 21 60 73 81 157 156 157 202 210 214
41950 +220 221 221 193 200 203 177 184 187 177 184 187 177 184 187 174 174 174
41951 +174 174 174 174 174 174 174 174 174 157 156 157 60 74 84 24 26 27
41952 +4 0 0 4 0 0 4 0 0 6 6 6 4 4 4 4 4 4
41953 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41954 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41955 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41956 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41957 +4 4 4 4 4 4
41958 +4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
41959 +6 6 6 4 0 0 6 6 6 6 6 6 6 6 6 4 0 0
41960 +4 0 0 4 0 0 6 6 6 24 26 27 60 73 81 167 166 167
41961 +220 221 221 220 221 221 220 221 221 205 212 215 205 212 215 205 212 215
41962 +205 212 215 220 221 221 220 221 221 220 221 221 205 212 215 137 136 137
41963 +60 74 84 125 124 125 137 136 137 190 197 201 220 221 221 193 200 203
41964 +177 184 187 177 184 187 177 184 187 174 174 174 174 174 174 177 184 187
41965 +190 197 201 174 174 174 125 124 125 37 38 37 6 6 6 4 0 0
41966 +4 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41967 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41968 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41969 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41970 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41971 +4 4 4 4 4 4
41972 +4 4 4 4 4 4 5 5 5 5 5 5 4 3 3 6 6 6
41973 +4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 6 6 6
41974 +6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
41975 +125 124 125 193 200 203 244 246 246 220 221 221 205 212 215 205 212 215
41976 +205 212 215 193 200 203 205 212 215 205 212 215 220 221 221 220 221 221
41977 +193 200 203 193 200 203 205 212 215 193 200 203 193 200 203 177 184 187
41978 +190 197 201 190 197 201 174 174 174 190 197 201 193 200 203 190 197 201
41979 +153 152 153 60 73 81 4 0 0 4 0 0 4 0 0 3 2 2
41980 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41981 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41982 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41983 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41984 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41985 +4 4 4 4 4 4
41986 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
41987 +6 6 6 4 3 3 4 3 3 4 3 3 6 6 6 6 6 6
41988 +4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 4 0 0
41989 +4 0 0 26 28 28 131 129 131 220 221 221 244 246 246 220 221 221
41990 +205 212 215 193 200 203 205 212 215 193 200 203 193 200 203 205 212 215
41991 +220 221 221 193 200 203 193 200 203 193 200 203 190 197 201 174 174 174
41992 +174 174 174 190 197 201 193 200 203 193 200 203 167 166 167 125 124 125
41993 +6 6 6 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
41994 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41995 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41996 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41997 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41998 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41999 +4 4 4 4 4 4
42000 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
42001 +5 5 5 4 3 3 5 5 5 6 6 6 4 3 3 5 5 5
42002 +6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
42003 +4 0 0 4 0 0 6 6 6 41 54 63 158 157 158 220 221 221
42004 +220 221 221 220 221 221 193 200 203 193 200 203 193 200 203 190 197 201
42005 +190 197 201 190 197 201 190 197 201 190 197 201 174 174 174 193 200 203
42006 +193 200 203 220 221 221 174 174 174 125 124 125 37 38 37 4 0 0
42007 +4 0 0 4 3 3 6 6 6 4 4 4 4 4 4 4 4 4
42008 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42009 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42010 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42011 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42012 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42013 +4 4 4 4 4 4
42014 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42015 +4 4 4 5 5 5 4 3 3 4 3 3 4 3 3 5 5 5
42016 +4 3 3 6 6 6 5 5 5 4 3 3 6 6 6 6 6 6
42017 +6 6 6 6 6 6 4 0 0 4 0 0 13 16 17 60 73 81
42018 +174 174 174 220 221 221 220 221 221 205 212 215 190 197 201 174 174 174
42019 +193 200 203 174 174 174 190 197 201 174 174 174 193 200 203 220 221 221
42020 +193 200 203 131 129 131 37 38 37 6 6 6 4 0 0 4 0 0
42021 +6 6 6 6 6 6 4 3 3 5 5 5 4 4 4 4 4 4
42022 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42023 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42024 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42025 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42026 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42027 +4 4 4 4 4 4
42028 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42029 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
42030 +5 5 5 4 3 3 4 3 3 5 5 5 4 3 3 4 3 3
42031 +5 5 5 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
42032 +6 6 6 125 124 125 174 174 174 220 221 221 220 221 221 193 200 203
42033 +193 200 203 193 200 203 193 200 203 193 200 203 220 221 221 158 157 158
42034 +60 73 81 6 6 6 4 0 0 4 0 0 5 5 5 6 6 6
42035 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
42036 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42037 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42038 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42039 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42040 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42041 +4 4 4 4 4 4
42042 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42043 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42044 +4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
42045 +5 5 5 5 5 5 6 6 6 6 6 6 4 0 0 4 0 0
42046 +4 0 0 4 0 0 26 28 28 125 124 125 174 174 174 193 200 203
42047 +193 200 203 174 174 174 193 200 203 167 166 167 125 124 125 6 6 6
42048 +6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 5 5 5
42049 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
42050 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42051 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42052 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42053 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42054 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42055 +4 4 4 4 4 4
42056 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42057 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42058 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
42059 +4 3 3 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
42060 +6 6 6 4 0 0 4 0 0 6 6 6 37 38 37 125 124 125
42061 +153 152 153 131 129 131 125 124 125 37 38 37 6 6 6 6 6 6
42062 +6 6 6 4 0 0 6 6 6 6 6 6 4 3 3 5 5 5
42063 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42064 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42065 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42066 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42067 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42068 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42069 +4 4 4 4 4 4
42070 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42071 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42072 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42073 +4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
42074 +6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
42075 +24 26 27 24 26 27 6 6 6 6 6 6 6 6 6 4 0 0
42076 +6 6 6 6 6 6 4 0 0 6 6 6 5 5 5 4 3 3
42077 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42078 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42079 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42080 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42081 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42082 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42083 +4 4 4 4 4 4
42084 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42085 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42086 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42087 +4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
42088 +4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
42089 +6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
42090 +4 0 0 6 6 6 6 6 6 4 3 3 5 5 5 4 4 4
42091 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42092 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42093 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42094 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42095 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42096 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42097 +4 4 4 4 4 4
42098 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42099 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42100 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42101 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 5 5 5
42102 +5 5 5 5 5 5 4 0 0 6 6 6 4 0 0 6 6 6
42103 +6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 4 0 0
42104 +6 6 6 4 3 3 5 5 5 4 3 3 5 5 5 4 4 4
42105 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42106 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42107 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42108 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42109 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42110 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42111 +4 4 4 4 4 4
42112 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42113 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42114 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42115 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
42116 +4 3 3 6 6 6 4 3 3 6 6 6 6 6 6 6 6 6
42117 +4 0 0 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
42118 +6 6 6 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
42119 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42120 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42121 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42122 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42123 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42124 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42125 +4 4 4 4 4 4
42126 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42127 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42128 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42129 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42130 +4 4 4 5 5 5 4 3 3 5 5 5 4 0 0 6 6 6
42131 +6 6 6 4 0 0 6 6 6 6 6 6 4 0 0 6 6 6
42132 +4 3 3 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
42133 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42134 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42135 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42136 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42137 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42138 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42139 +4 4 4 4 4 4
42140 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42141 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42142 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42143 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42144 +4 4 4 5 5 5 4 3 3 5 5 5 6 6 6 4 3 3
42145 +4 3 3 6 6 6 6 6 6 4 3 3 6 6 6 4 3 3
42146 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42147 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42148 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42149 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42150 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42151 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42152 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42153 +4 4 4 4 4 4
42154 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42155 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42156 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42157 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42158 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 6 6 6
42159 +5 5 5 4 3 3 4 3 3 4 3 3 5 5 5 5 5 5
42160 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42161 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42162 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42163 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42164 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42165 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42166 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42167 +4 4 4 4 4 4
42168 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42169 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42170 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42171 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42172 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
42173 +5 5 5 4 3 3 5 5 5 5 5 5 4 4 4 4 4 4
42174 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42175 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42176 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42177 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42178 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42179 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42180 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42181 +4 4 4 4 4 4
42182 diff -urNp linux-2.6.32.46/drivers/video/nvidia/nv_backlight.c linux-2.6.32.46/drivers/video/nvidia/nv_backlight.c
42183 --- linux-2.6.32.46/drivers/video/nvidia/nv_backlight.c 2011-03-27 14:31:47.000000000 -0400
42184 +++ linux-2.6.32.46/drivers/video/nvidia/nv_backlight.c 2011-04-17 15:56:46.000000000 -0400
42185 @@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(stru
42186 return bd->props.brightness;
42187 }
42188
42189 -static struct backlight_ops nvidia_bl_ops = {
42190 +static const struct backlight_ops nvidia_bl_ops = {
42191 .get_brightness = nvidia_bl_get_brightness,
42192 .update_status = nvidia_bl_update_status,
42193 };
42194 diff -urNp linux-2.6.32.46/drivers/video/riva/fbdev.c linux-2.6.32.46/drivers/video/riva/fbdev.c
42195 --- linux-2.6.32.46/drivers/video/riva/fbdev.c 2011-03-27 14:31:47.000000000 -0400
42196 +++ linux-2.6.32.46/drivers/video/riva/fbdev.c 2011-04-17 15:56:46.000000000 -0400
42197 @@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct
42198 return bd->props.brightness;
42199 }
42200
42201 -static struct backlight_ops riva_bl_ops = {
42202 +static const struct backlight_ops riva_bl_ops = {
42203 .get_brightness = riva_bl_get_brightness,
42204 .update_status = riva_bl_update_status,
42205 };
42206 diff -urNp linux-2.6.32.46/drivers/video/uvesafb.c linux-2.6.32.46/drivers/video/uvesafb.c
42207 --- linux-2.6.32.46/drivers/video/uvesafb.c 2011-03-27 14:31:47.000000000 -0400
42208 +++ linux-2.6.32.46/drivers/video/uvesafb.c 2011-04-17 15:56:46.000000000 -0400
42209 @@ -18,6 +18,7 @@
42210 #include <linux/fb.h>
42211 #include <linux/io.h>
42212 #include <linux/mutex.h>
42213 +#include <linux/moduleloader.h>
42214 #include <video/edid.h>
42215 #include <video/uvesafb.h>
42216 #ifdef CONFIG_X86
42217 @@ -120,7 +121,7 @@ static int uvesafb_helper_start(void)
42218 NULL,
42219 };
42220
42221 - return call_usermodehelper(v86d_path, argv, envp, 1);
42222 + return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
42223 }
42224
42225 /*
42226 @@ -568,10 +569,32 @@ static int __devinit uvesafb_vbe_getpmi(
42227 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
42228 par->pmi_setpal = par->ypan = 0;
42229 } else {
42230 +
42231 +#ifdef CONFIG_PAX_KERNEXEC
42232 +#ifdef CONFIG_MODULES
42233 + par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
42234 +#endif
42235 + if (!par->pmi_code) {
42236 + par->pmi_setpal = par->ypan = 0;
42237 + return 0;
42238 + }
42239 +#endif
42240 +
42241 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
42242 + task->t.regs.edi);
42243 +
42244 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
42245 + pax_open_kernel();
42246 + memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
42247 + pax_close_kernel();
42248 +
42249 + par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
42250 + par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
42251 +#else
42252 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
42253 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
42254 +#endif
42255 +
42256 printk(KERN_INFO "uvesafb: protected mode interface info at "
42257 "%04x:%04x\n",
42258 (u16)task->t.regs.es, (u16)task->t.regs.edi);
42259 @@ -1799,6 +1822,11 @@ out:
42260 if (par->vbe_modes)
42261 kfree(par->vbe_modes);
42262
42263 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
42264 + if (par->pmi_code)
42265 + module_free_exec(NULL, par->pmi_code);
42266 +#endif
42267 +
42268 framebuffer_release(info);
42269 return err;
42270 }
42271 @@ -1825,6 +1853,12 @@ static int uvesafb_remove(struct platfor
42272 kfree(par->vbe_state_orig);
42273 if (par->vbe_state_saved)
42274 kfree(par->vbe_state_saved);
42275 +
42276 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
42277 + if (par->pmi_code)
42278 + module_free_exec(NULL, par->pmi_code);
42279 +#endif
42280 +
42281 }
42282
42283 framebuffer_release(info);
42284 diff -urNp linux-2.6.32.46/drivers/video/vesafb.c linux-2.6.32.46/drivers/video/vesafb.c
42285 --- linux-2.6.32.46/drivers/video/vesafb.c 2011-03-27 14:31:47.000000000 -0400
42286 +++ linux-2.6.32.46/drivers/video/vesafb.c 2011-08-05 20:33:55.000000000 -0400
42287 @@ -9,6 +9,7 @@
42288 */
42289
42290 #include <linux/module.h>
42291 +#include <linux/moduleloader.h>
42292 #include <linux/kernel.h>
42293 #include <linux/errno.h>
42294 #include <linux/string.h>
42295 @@ -53,8 +54,8 @@ static int vram_remap __initdata; /*
42296 static int vram_total __initdata; /* Set total amount of memory */
42297 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
42298 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
42299 -static void (*pmi_start)(void) __read_mostly;
42300 -static void (*pmi_pal) (void) __read_mostly;
42301 +static void (*pmi_start)(void) __read_only;
42302 +static void (*pmi_pal) (void) __read_only;
42303 static int depth __read_mostly;
42304 static int vga_compat __read_mostly;
42305 /* --------------------------------------------------------------------- */
42306 @@ -233,6 +234,7 @@ static int __init vesafb_probe(struct pl
42307 unsigned int size_vmode;
42308 unsigned int size_remap;
42309 unsigned int size_total;
42310 + void *pmi_code = NULL;
42311
42312 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
42313 return -ENODEV;
42314 @@ -275,10 +277,6 @@ static int __init vesafb_probe(struct pl
42315 size_remap = size_total;
42316 vesafb_fix.smem_len = size_remap;
42317
42318 -#ifndef __i386__
42319 - screen_info.vesapm_seg = 0;
42320 -#endif
42321 -
42322 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
42323 printk(KERN_WARNING
42324 "vesafb: cannot reserve video memory at 0x%lx\n",
42325 @@ -315,9 +313,21 @@ static int __init vesafb_probe(struct pl
42326 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
42327 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
42328
42329 +#ifdef __i386__
42330 +
42331 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
42332 + pmi_code = module_alloc_exec(screen_info.vesapm_size);
42333 + if (!pmi_code)
42334 +#elif !defined(CONFIG_PAX_KERNEXEC)
42335 + if (0)
42336 +#endif
42337 +
42338 +#endif
42339 + screen_info.vesapm_seg = 0;
42340 +
42341 if (screen_info.vesapm_seg) {
42342 - printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
42343 - screen_info.vesapm_seg,screen_info.vesapm_off);
42344 + printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
42345 + screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
42346 }
42347
42348 if (screen_info.vesapm_seg < 0xc000)
42349 @@ -325,9 +335,25 @@ static int __init vesafb_probe(struct pl
42350
42351 if (ypan || pmi_setpal) {
42352 unsigned short *pmi_base;
42353 +
42354 pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
42355 - pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
42356 - pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
42357 +
42358 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
42359 + pax_open_kernel();
42360 + memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
42361 +#else
42362 + pmi_code = pmi_base;
42363 +#endif
42364 +
42365 + pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
42366 + pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
42367 +
42368 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
42369 + pmi_start = ktva_ktla(pmi_start);
42370 + pmi_pal = ktva_ktla(pmi_pal);
42371 + pax_close_kernel();
42372 +#endif
42373 +
42374 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
42375 if (pmi_base[3]) {
42376 printk(KERN_INFO "vesafb: pmi: ports = ");
42377 @@ -469,6 +495,11 @@ static int __init vesafb_probe(struct pl
42378 info->node, info->fix.id);
42379 return 0;
42380 err:
42381 +
42382 +#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
42383 + module_free_exec(NULL, pmi_code);
42384 +#endif
42385 +
42386 if (info->screen_base)
42387 iounmap(info->screen_base);
42388 framebuffer_release(info);
42389 diff -urNp linux-2.6.32.46/drivers/xen/sys-hypervisor.c linux-2.6.32.46/drivers/xen/sys-hypervisor.c
42390 --- linux-2.6.32.46/drivers/xen/sys-hypervisor.c 2011-03-27 14:31:47.000000000 -0400
42391 +++ linux-2.6.32.46/drivers/xen/sys-hypervisor.c 2011-04-17 15:56:46.000000000 -0400
42392 @@ -425,7 +425,7 @@ static ssize_t hyp_sysfs_store(struct ko
42393 return 0;
42394 }
42395
42396 -static struct sysfs_ops hyp_sysfs_ops = {
42397 +static const struct sysfs_ops hyp_sysfs_ops = {
42398 .show = hyp_sysfs_show,
42399 .store = hyp_sysfs_store,
42400 };
42401 diff -urNp linux-2.6.32.46/fs/9p/vfs_inode.c linux-2.6.32.46/fs/9p/vfs_inode.c
42402 --- linux-2.6.32.46/fs/9p/vfs_inode.c 2011-03-27 14:31:47.000000000 -0400
42403 +++ linux-2.6.32.46/fs/9p/vfs_inode.c 2011-04-17 15:56:46.000000000 -0400
42404 @@ -1079,7 +1079,7 @@ static void *v9fs_vfs_follow_link(struct
42405 static void
42406 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
42407 {
42408 - char *s = nd_get_link(nd);
42409 + const char *s = nd_get_link(nd);
42410
42411 P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
42412 IS_ERR(s) ? "<error>" : s);
42413 diff -urNp linux-2.6.32.46/fs/aio.c linux-2.6.32.46/fs/aio.c
42414 --- linux-2.6.32.46/fs/aio.c 2011-03-27 14:31:47.000000000 -0400
42415 +++ linux-2.6.32.46/fs/aio.c 2011-06-04 20:40:21.000000000 -0400
42416 @@ -115,7 +115,7 @@ static int aio_setup_ring(struct kioctx
42417 size += sizeof(struct io_event) * nr_events;
42418 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
42419
42420 - if (nr_pages < 0)
42421 + if (nr_pages <= 0)
42422 return -EINVAL;
42423
42424 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
42425 @@ -1089,6 +1089,8 @@ static int read_events(struct kioctx *ct
42426 struct aio_timeout to;
42427 int retry = 0;
42428
42429 + pax_track_stack();
42430 +
42431 /* needed to zero any padding within an entry (there shouldn't be
42432 * any, but C is fun!
42433 */
42434 @@ -1382,13 +1384,18 @@ static ssize_t aio_fsync(struct kiocb *i
42435 static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb)
42436 {
42437 ssize_t ret;
42438 + struct iovec iovstack;
42439
42440 ret = rw_copy_check_uvector(type, (struct iovec __user *)kiocb->ki_buf,
42441 kiocb->ki_nbytes, 1,
42442 - &kiocb->ki_inline_vec, &kiocb->ki_iovec);
42443 + &iovstack, &kiocb->ki_iovec);
42444 if (ret < 0)
42445 goto out;
42446
42447 + if (kiocb->ki_iovec == &iovstack) {
42448 + kiocb->ki_inline_vec = iovstack;
42449 + kiocb->ki_iovec = &kiocb->ki_inline_vec;
42450 + }
42451 kiocb->ki_nr_segs = kiocb->ki_nbytes;
42452 kiocb->ki_cur_seg = 0;
42453 /* ki_nbytes/left now reflect bytes instead of segs */
42454 diff -urNp linux-2.6.32.46/fs/attr.c linux-2.6.32.46/fs/attr.c
42455 --- linux-2.6.32.46/fs/attr.c 2011-03-27 14:31:47.000000000 -0400
42456 +++ linux-2.6.32.46/fs/attr.c 2011-04-17 15:56:46.000000000 -0400
42457 @@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode
42458 unsigned long limit;
42459
42460 limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
42461 + gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
42462 if (limit != RLIM_INFINITY && offset > limit)
42463 goto out_sig;
42464 if (offset > inode->i_sb->s_maxbytes)
42465 diff -urNp linux-2.6.32.46/fs/autofs/root.c linux-2.6.32.46/fs/autofs/root.c
42466 --- linux-2.6.32.46/fs/autofs/root.c 2011-03-27 14:31:47.000000000 -0400
42467 +++ linux-2.6.32.46/fs/autofs/root.c 2011-04-17 15:56:46.000000000 -0400
42468 @@ -299,7 +299,8 @@ static int autofs_root_symlink(struct in
42469 set_bit(n,sbi->symlink_bitmap);
42470 sl = &sbi->symlink[n];
42471 sl->len = strlen(symname);
42472 - sl->data = kmalloc(slsize = sl->len+1, GFP_KERNEL);
42473 + slsize = sl->len+1;
42474 + sl->data = kmalloc(slsize, GFP_KERNEL);
42475 if (!sl->data) {
42476 clear_bit(n,sbi->symlink_bitmap);
42477 unlock_kernel();
42478 diff -urNp linux-2.6.32.46/fs/autofs4/symlink.c linux-2.6.32.46/fs/autofs4/symlink.c
42479 --- linux-2.6.32.46/fs/autofs4/symlink.c 2011-03-27 14:31:47.000000000 -0400
42480 +++ linux-2.6.32.46/fs/autofs4/symlink.c 2011-04-17 15:56:46.000000000 -0400
42481 @@ -15,7 +15,7 @@
42482 static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
42483 {
42484 struct autofs_info *ino = autofs4_dentry_ino(dentry);
42485 - nd_set_link(nd, (char *)ino->u.symlink);
42486 + nd_set_link(nd, ino->u.symlink);
42487 return NULL;
42488 }
42489
42490 diff -urNp linux-2.6.32.46/fs/autofs4/waitq.c linux-2.6.32.46/fs/autofs4/waitq.c
42491 --- linux-2.6.32.46/fs/autofs4/waitq.c 2011-03-27 14:31:47.000000000 -0400
42492 +++ linux-2.6.32.46/fs/autofs4/waitq.c 2011-10-06 09:37:14.000000000 -0400
42493 @@ -60,7 +60,7 @@ static int autofs4_write(struct file *fi
42494 {
42495 unsigned long sigpipe, flags;
42496 mm_segment_t fs;
42497 - const char *data = (const char *)addr;
42498 + const char __user *data = (const char __force_user *)addr;
42499 ssize_t wr = 0;
42500
42501 /** WARNING: this is not safe for writing more than PIPE_BUF bytes! **/
42502 diff -urNp linux-2.6.32.46/fs/befs/linuxvfs.c linux-2.6.32.46/fs/befs/linuxvfs.c
42503 --- linux-2.6.32.46/fs/befs/linuxvfs.c 2011-08-29 22:24:44.000000000 -0400
42504 +++ linux-2.6.32.46/fs/befs/linuxvfs.c 2011-08-29 22:25:07.000000000 -0400
42505 @@ -498,7 +498,7 @@ static void befs_put_link(struct dentry
42506 {
42507 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
42508 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
42509 - char *link = nd_get_link(nd);
42510 + const char *link = nd_get_link(nd);
42511 if (!IS_ERR(link))
42512 kfree(link);
42513 }
42514 diff -urNp linux-2.6.32.46/fs/binfmt_aout.c linux-2.6.32.46/fs/binfmt_aout.c
42515 --- linux-2.6.32.46/fs/binfmt_aout.c 2011-03-27 14:31:47.000000000 -0400
42516 +++ linux-2.6.32.46/fs/binfmt_aout.c 2011-04-17 15:56:46.000000000 -0400
42517 @@ -16,6 +16,7 @@
42518 #include <linux/string.h>
42519 #include <linux/fs.h>
42520 #include <linux/file.h>
42521 +#include <linux/security.h>
42522 #include <linux/stat.h>
42523 #include <linux/fcntl.h>
42524 #include <linux/ptrace.h>
42525 @@ -102,6 +103,8 @@ static int aout_core_dump(long signr, st
42526 #endif
42527 # define START_STACK(u) (u.start_stack)
42528
42529 + memset(&dump, 0, sizeof(dump));
42530 +
42531 fs = get_fs();
42532 set_fs(KERNEL_DS);
42533 has_dumped = 1;
42534 @@ -113,10 +116,12 @@ static int aout_core_dump(long signr, st
42535
42536 /* If the size of the dump file exceeds the rlimit, then see what would happen
42537 if we wrote the stack, but not the data area. */
42538 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
42539 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
42540 dump.u_dsize = 0;
42541
42542 /* Make sure we have enough room to write the stack and data areas. */
42543 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
42544 if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
42545 dump.u_ssize = 0;
42546
42547 @@ -146,9 +151,7 @@ static int aout_core_dump(long signr, st
42548 dump_size = dump.u_ssize << PAGE_SHIFT;
42549 DUMP_WRITE(dump_start,dump_size);
42550 }
42551 -/* Finally dump the task struct. Not be used by gdb, but could be useful */
42552 - set_fs(KERNEL_DS);
42553 - DUMP_WRITE(current,sizeof(*current));
42554 +/* Finally, let's not dump the task struct. Not be used by gdb, but could be useful to an attacker */
42555 end_coredump:
42556 set_fs(fs);
42557 return has_dumped;
42558 @@ -249,6 +252,8 @@ static int load_aout_binary(struct linux
42559 rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
42560 if (rlim >= RLIM_INFINITY)
42561 rlim = ~0;
42562 +
42563 + gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
42564 if (ex.a_data + ex.a_bss > rlim)
42565 return -ENOMEM;
42566
42567 @@ -277,6 +282,27 @@ static int load_aout_binary(struct linux
42568 install_exec_creds(bprm);
42569 current->flags &= ~PF_FORKNOEXEC;
42570
42571 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
42572 + current->mm->pax_flags = 0UL;
42573 +#endif
42574 +
42575 +#ifdef CONFIG_PAX_PAGEEXEC
42576 + if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
42577 + current->mm->pax_flags |= MF_PAX_PAGEEXEC;
42578 +
42579 +#ifdef CONFIG_PAX_EMUTRAMP
42580 + if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
42581 + current->mm->pax_flags |= MF_PAX_EMUTRAMP;
42582 +#endif
42583 +
42584 +#ifdef CONFIG_PAX_MPROTECT
42585 + if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
42586 + current->mm->pax_flags |= MF_PAX_MPROTECT;
42587 +#endif
42588 +
42589 + }
42590 +#endif
42591 +
42592 if (N_MAGIC(ex) == OMAGIC) {
42593 unsigned long text_addr, map_size;
42594 loff_t pos;
42595 @@ -349,7 +375,7 @@ static int load_aout_binary(struct linux
42596
42597 down_write(&current->mm->mmap_sem);
42598 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
42599 - PROT_READ | PROT_WRITE | PROT_EXEC,
42600 + PROT_READ | PROT_WRITE,
42601 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
42602 fd_offset + ex.a_text);
42603 up_write(&current->mm->mmap_sem);
42604 diff -urNp linux-2.6.32.46/fs/binfmt_elf.c linux-2.6.32.46/fs/binfmt_elf.c
42605 --- linux-2.6.32.46/fs/binfmt_elf.c 2011-03-27 14:31:47.000000000 -0400
42606 +++ linux-2.6.32.46/fs/binfmt_elf.c 2011-05-16 21:46:57.000000000 -0400
42607 @@ -50,6 +50,10 @@ static int elf_core_dump(long signr, str
42608 #define elf_core_dump NULL
42609 #endif
42610
42611 +#ifdef CONFIG_PAX_MPROTECT
42612 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
42613 +#endif
42614 +
42615 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
42616 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
42617 #else
42618 @@ -69,6 +73,11 @@ static struct linux_binfmt elf_format =
42619 .load_binary = load_elf_binary,
42620 .load_shlib = load_elf_library,
42621 .core_dump = elf_core_dump,
42622 +
42623 +#ifdef CONFIG_PAX_MPROTECT
42624 + .handle_mprotect= elf_handle_mprotect,
42625 +#endif
42626 +
42627 .min_coredump = ELF_EXEC_PAGESIZE,
42628 .hasvdso = 1
42629 };
42630 @@ -77,6 +86,8 @@ static struct linux_binfmt elf_format =
42631
42632 static int set_brk(unsigned long start, unsigned long end)
42633 {
42634 + unsigned long e = end;
42635 +
42636 start = ELF_PAGEALIGN(start);
42637 end = ELF_PAGEALIGN(end);
42638 if (end > start) {
42639 @@ -87,7 +98,7 @@ static int set_brk(unsigned long start,
42640 if (BAD_ADDR(addr))
42641 return addr;
42642 }
42643 - current->mm->start_brk = current->mm->brk = end;
42644 + current->mm->start_brk = current->mm->brk = e;
42645 return 0;
42646 }
42647
42648 @@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *b
42649 elf_addr_t __user *u_rand_bytes;
42650 const char *k_platform = ELF_PLATFORM;
42651 const char *k_base_platform = ELF_BASE_PLATFORM;
42652 - unsigned char k_rand_bytes[16];
42653 + u32 k_rand_bytes[4];
42654 int items;
42655 elf_addr_t *elf_info;
42656 int ei_index = 0;
42657 const struct cred *cred = current_cred();
42658 struct vm_area_struct *vma;
42659 + unsigned long saved_auxv[AT_VECTOR_SIZE];
42660 +
42661 + pax_track_stack();
42662
42663 /*
42664 * In some cases (e.g. Hyper-Threading), we want to avoid L1
42665 @@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *b
42666 * Generate 16 random bytes for userspace PRNG seeding.
42667 */
42668 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
42669 - u_rand_bytes = (elf_addr_t __user *)
42670 - STACK_ALLOC(p, sizeof(k_rand_bytes));
42671 + srandom32(k_rand_bytes[0] ^ random32());
42672 + srandom32(k_rand_bytes[1] ^ random32());
42673 + srandom32(k_rand_bytes[2] ^ random32());
42674 + srandom32(k_rand_bytes[3] ^ random32());
42675 + p = STACK_ROUND(p, sizeof(k_rand_bytes));
42676 + u_rand_bytes = (elf_addr_t __user *) p;
42677 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
42678 return -EFAULT;
42679
42680 @@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *b
42681 return -EFAULT;
42682 current->mm->env_end = p;
42683
42684 + memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
42685 +
42686 /* Put the elf_info on the stack in the right place. */
42687 sp = (elf_addr_t __user *)envp + 1;
42688 - if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
42689 + if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
42690 return -EFAULT;
42691 return 0;
42692 }
42693 @@ -385,10 +405,10 @@ static unsigned long load_elf_interp(str
42694 {
42695 struct elf_phdr *elf_phdata;
42696 struct elf_phdr *eppnt;
42697 - unsigned long load_addr = 0;
42698 + unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
42699 int load_addr_set = 0;
42700 unsigned long last_bss = 0, elf_bss = 0;
42701 - unsigned long error = ~0UL;
42702 + unsigned long error = -EINVAL;
42703 unsigned long total_size;
42704 int retval, i, size;
42705
42706 @@ -434,6 +454,11 @@ static unsigned long load_elf_interp(str
42707 goto out_close;
42708 }
42709
42710 +#ifdef CONFIG_PAX_SEGMEXEC
42711 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
42712 + pax_task_size = SEGMEXEC_TASK_SIZE;
42713 +#endif
42714 +
42715 eppnt = elf_phdata;
42716 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
42717 if (eppnt->p_type == PT_LOAD) {
42718 @@ -477,8 +502,8 @@ static unsigned long load_elf_interp(str
42719 k = load_addr + eppnt->p_vaddr;
42720 if (BAD_ADDR(k) ||
42721 eppnt->p_filesz > eppnt->p_memsz ||
42722 - eppnt->p_memsz > TASK_SIZE ||
42723 - TASK_SIZE - eppnt->p_memsz < k) {
42724 + eppnt->p_memsz > pax_task_size ||
42725 + pax_task_size - eppnt->p_memsz < k) {
42726 error = -ENOMEM;
42727 goto out_close;
42728 }
42729 @@ -532,6 +557,194 @@ out:
42730 return error;
42731 }
42732
42733 +#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
42734 +static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
42735 +{
42736 + unsigned long pax_flags = 0UL;
42737 +
42738 +#ifdef CONFIG_PAX_PAGEEXEC
42739 + if (elf_phdata->p_flags & PF_PAGEEXEC)
42740 + pax_flags |= MF_PAX_PAGEEXEC;
42741 +#endif
42742 +
42743 +#ifdef CONFIG_PAX_SEGMEXEC
42744 + if (elf_phdata->p_flags & PF_SEGMEXEC)
42745 + pax_flags |= MF_PAX_SEGMEXEC;
42746 +#endif
42747 +
42748 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42749 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42750 + if (nx_enabled)
42751 + pax_flags &= ~MF_PAX_SEGMEXEC;
42752 + else
42753 + pax_flags &= ~MF_PAX_PAGEEXEC;
42754 + }
42755 +#endif
42756 +
42757 +#ifdef CONFIG_PAX_EMUTRAMP
42758 + if (elf_phdata->p_flags & PF_EMUTRAMP)
42759 + pax_flags |= MF_PAX_EMUTRAMP;
42760 +#endif
42761 +
42762 +#ifdef CONFIG_PAX_MPROTECT
42763 + if (elf_phdata->p_flags & PF_MPROTECT)
42764 + pax_flags |= MF_PAX_MPROTECT;
42765 +#endif
42766 +
42767 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42768 + if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
42769 + pax_flags |= MF_PAX_RANDMMAP;
42770 +#endif
42771 +
42772 + return pax_flags;
42773 +}
42774 +#endif
42775 +
42776 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
42777 +static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
42778 +{
42779 + unsigned long pax_flags = 0UL;
42780 +
42781 +#ifdef CONFIG_PAX_PAGEEXEC
42782 + if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
42783 + pax_flags |= MF_PAX_PAGEEXEC;
42784 +#endif
42785 +
42786 +#ifdef CONFIG_PAX_SEGMEXEC
42787 + if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
42788 + pax_flags |= MF_PAX_SEGMEXEC;
42789 +#endif
42790 +
42791 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42792 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42793 + if (nx_enabled)
42794 + pax_flags &= ~MF_PAX_SEGMEXEC;
42795 + else
42796 + pax_flags &= ~MF_PAX_PAGEEXEC;
42797 + }
42798 +#endif
42799 +
42800 +#ifdef CONFIG_PAX_EMUTRAMP
42801 + if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
42802 + pax_flags |= MF_PAX_EMUTRAMP;
42803 +#endif
42804 +
42805 +#ifdef CONFIG_PAX_MPROTECT
42806 + if (!(elf_phdata->p_flags & PF_NOMPROTECT))
42807 + pax_flags |= MF_PAX_MPROTECT;
42808 +#endif
42809 +
42810 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42811 + if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
42812 + pax_flags |= MF_PAX_RANDMMAP;
42813 +#endif
42814 +
42815 + return pax_flags;
42816 +}
42817 +#endif
42818 +
42819 +#ifdef CONFIG_PAX_EI_PAX
42820 +static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
42821 +{
42822 + unsigned long pax_flags = 0UL;
42823 +
42824 +#ifdef CONFIG_PAX_PAGEEXEC
42825 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
42826 + pax_flags |= MF_PAX_PAGEEXEC;
42827 +#endif
42828 +
42829 +#ifdef CONFIG_PAX_SEGMEXEC
42830 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
42831 + pax_flags |= MF_PAX_SEGMEXEC;
42832 +#endif
42833 +
42834 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42835 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42836 + if (nx_enabled)
42837 + pax_flags &= ~MF_PAX_SEGMEXEC;
42838 + else
42839 + pax_flags &= ~MF_PAX_PAGEEXEC;
42840 + }
42841 +#endif
42842 +
42843 +#ifdef CONFIG_PAX_EMUTRAMP
42844 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
42845 + pax_flags |= MF_PAX_EMUTRAMP;
42846 +#endif
42847 +
42848 +#ifdef CONFIG_PAX_MPROTECT
42849 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
42850 + pax_flags |= MF_PAX_MPROTECT;
42851 +#endif
42852 +
42853 +#ifdef CONFIG_PAX_ASLR
42854 + if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
42855 + pax_flags |= MF_PAX_RANDMMAP;
42856 +#endif
42857 +
42858 + return pax_flags;
42859 +}
42860 +#endif
42861 +
42862 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
42863 +static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
42864 +{
42865 + unsigned long pax_flags = 0UL;
42866 +
42867 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
42868 + unsigned long i;
42869 + int found_flags = 0;
42870 +#endif
42871 +
42872 +#ifdef CONFIG_PAX_EI_PAX
42873 + pax_flags = pax_parse_ei_pax(elf_ex);
42874 +#endif
42875 +
42876 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
42877 + for (i = 0UL; i < elf_ex->e_phnum; i++)
42878 + if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
42879 + if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
42880 + ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
42881 + ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
42882 + ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
42883 + ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
42884 + return -EINVAL;
42885 +
42886 +#ifdef CONFIG_PAX_SOFTMODE
42887 + if (pax_softmode)
42888 + pax_flags = pax_parse_softmode(&elf_phdata[i]);
42889 + else
42890 +#endif
42891 +
42892 + pax_flags = pax_parse_hardmode(&elf_phdata[i]);
42893 + found_flags = 1;
42894 + break;
42895 + }
42896 +#endif
42897 +
42898 +#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
42899 + if (found_flags == 0) {
42900 + struct elf_phdr phdr;
42901 + memset(&phdr, 0, sizeof(phdr));
42902 + phdr.p_flags = PF_NOEMUTRAMP;
42903 +#ifdef CONFIG_PAX_SOFTMODE
42904 + if (pax_softmode)
42905 + pax_flags = pax_parse_softmode(&phdr);
42906 + else
42907 +#endif
42908 + pax_flags = pax_parse_hardmode(&phdr);
42909 + }
42910 +#endif
42911 +
42912 +
42913 + if (0 > pax_check_flags(&pax_flags))
42914 + return -EINVAL;
42915 +
42916 + current->mm->pax_flags = pax_flags;
42917 + return 0;
42918 +}
42919 +#endif
42920 +
42921 /*
42922 * These are the functions used to load ELF style executables and shared
42923 * libraries. There is no binary dependent code anywhere else.
42924 @@ -548,6 +761,11 @@ static unsigned long randomize_stack_top
42925 {
42926 unsigned int random_variable = 0;
42927
42928 +#ifdef CONFIG_PAX_RANDUSTACK
42929 + if (randomize_va_space)
42930 + return stack_top - current->mm->delta_stack;
42931 +#endif
42932 +
42933 if ((current->flags & PF_RANDOMIZE) &&
42934 !(current->personality & ADDR_NO_RANDOMIZE)) {
42935 random_variable = get_random_int() & STACK_RND_MASK;
42936 @@ -566,7 +784,7 @@ static int load_elf_binary(struct linux_
42937 unsigned long load_addr = 0, load_bias = 0;
42938 int load_addr_set = 0;
42939 char * elf_interpreter = NULL;
42940 - unsigned long error;
42941 + unsigned long error = 0;
42942 struct elf_phdr *elf_ppnt, *elf_phdata;
42943 unsigned long elf_bss, elf_brk;
42944 int retval, i;
42945 @@ -576,11 +794,11 @@ static int load_elf_binary(struct linux_
42946 unsigned long start_code, end_code, start_data, end_data;
42947 unsigned long reloc_func_desc = 0;
42948 int executable_stack = EXSTACK_DEFAULT;
42949 - unsigned long def_flags = 0;
42950 struct {
42951 struct elfhdr elf_ex;
42952 struct elfhdr interp_elf_ex;
42953 } *loc;
42954 + unsigned long pax_task_size = TASK_SIZE;
42955
42956 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
42957 if (!loc) {
42958 @@ -718,11 +936,80 @@ static int load_elf_binary(struct linux_
42959
42960 /* OK, This is the point of no return */
42961 current->flags &= ~PF_FORKNOEXEC;
42962 - current->mm->def_flags = def_flags;
42963 +
42964 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
42965 + current->mm->pax_flags = 0UL;
42966 +#endif
42967 +
42968 +#ifdef CONFIG_PAX_DLRESOLVE
42969 + current->mm->call_dl_resolve = 0UL;
42970 +#endif
42971 +
42972 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
42973 + current->mm->call_syscall = 0UL;
42974 +#endif
42975 +
42976 +#ifdef CONFIG_PAX_ASLR
42977 + current->mm->delta_mmap = 0UL;
42978 + current->mm->delta_stack = 0UL;
42979 +#endif
42980 +
42981 + current->mm->def_flags = 0;
42982 +
42983 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
42984 + if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
42985 + send_sig(SIGKILL, current, 0);
42986 + goto out_free_dentry;
42987 + }
42988 +#endif
42989 +
42990 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
42991 + pax_set_initial_flags(bprm);
42992 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
42993 + if (pax_set_initial_flags_func)
42994 + (pax_set_initial_flags_func)(bprm);
42995 +#endif
42996 +
42997 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
42998 + if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !nx_enabled) {
42999 + current->mm->context.user_cs_limit = PAGE_SIZE;
43000 + current->mm->def_flags |= VM_PAGEEXEC;
43001 + }
43002 +#endif
43003 +
43004 +#ifdef CONFIG_PAX_SEGMEXEC
43005 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
43006 + current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
43007 + current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
43008 + pax_task_size = SEGMEXEC_TASK_SIZE;
43009 + }
43010 +#endif
43011 +
43012 +#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
43013 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43014 + set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
43015 + put_cpu();
43016 + }
43017 +#endif
43018
43019 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
43020 may depend on the personality. */
43021 SET_PERSONALITY(loc->elf_ex);
43022 +
43023 +#ifdef CONFIG_PAX_ASLR
43024 + if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
43025 + current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
43026 + current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
43027 + }
43028 +#endif
43029 +
43030 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
43031 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43032 + executable_stack = EXSTACK_DISABLE_X;
43033 + current->personality &= ~READ_IMPLIES_EXEC;
43034 + } else
43035 +#endif
43036 +
43037 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
43038 current->personality |= READ_IMPLIES_EXEC;
43039
43040 @@ -804,6 +1091,20 @@ static int load_elf_binary(struct linux_
43041 #else
43042 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
43043 #endif
43044 +
43045 +#ifdef CONFIG_PAX_RANDMMAP
43046 + /* PaX: randomize base address at the default exe base if requested */
43047 + if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
43048 +#ifdef CONFIG_SPARC64
43049 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
43050 +#else
43051 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
43052 +#endif
43053 + load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
43054 + elf_flags |= MAP_FIXED;
43055 + }
43056 +#endif
43057 +
43058 }
43059
43060 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
43061 @@ -836,9 +1137,9 @@ static int load_elf_binary(struct linux_
43062 * allowed task size. Note that p_filesz must always be
43063 * <= p_memsz so it is only necessary to check p_memsz.
43064 */
43065 - if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
43066 - elf_ppnt->p_memsz > TASK_SIZE ||
43067 - TASK_SIZE - elf_ppnt->p_memsz < k) {
43068 + if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
43069 + elf_ppnt->p_memsz > pax_task_size ||
43070 + pax_task_size - elf_ppnt->p_memsz < k) {
43071 /* set_brk can never work. Avoid overflows. */
43072 send_sig(SIGKILL, current, 0);
43073 retval = -EINVAL;
43074 @@ -866,6 +1167,11 @@ static int load_elf_binary(struct linux_
43075 start_data += load_bias;
43076 end_data += load_bias;
43077
43078 +#ifdef CONFIG_PAX_RANDMMAP
43079 + if (current->mm->pax_flags & MF_PAX_RANDMMAP)
43080 + elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
43081 +#endif
43082 +
43083 /* Calling set_brk effectively mmaps the pages that we need
43084 * for the bss and break sections. We must do this before
43085 * mapping in the interpreter, to make sure it doesn't wind
43086 @@ -877,9 +1183,11 @@ static int load_elf_binary(struct linux_
43087 goto out_free_dentry;
43088 }
43089 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
43090 - send_sig(SIGSEGV, current, 0);
43091 - retval = -EFAULT; /* Nobody gets to see this, but.. */
43092 - goto out_free_dentry;
43093 + /*
43094 + * This bss-zeroing can fail if the ELF
43095 + * file specifies odd protections. So
43096 + * we don't check the return value
43097 + */
43098 }
43099
43100 if (elf_interpreter) {
43101 @@ -1112,8 +1420,10 @@ static int dump_seek(struct file *file,
43102 unsigned long n = off;
43103 if (n > PAGE_SIZE)
43104 n = PAGE_SIZE;
43105 - if (!dump_write(file, buf, n))
43106 + if (!dump_write(file, buf, n)) {
43107 + free_page((unsigned long)buf);
43108 return 0;
43109 + }
43110 off -= n;
43111 }
43112 free_page((unsigned long)buf);
43113 @@ -1125,7 +1435,7 @@ static int dump_seek(struct file *file,
43114 * Decide what to dump of a segment, part, all or none.
43115 */
43116 static unsigned long vma_dump_size(struct vm_area_struct *vma,
43117 - unsigned long mm_flags)
43118 + unsigned long mm_flags, long signr)
43119 {
43120 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
43121
43122 @@ -1159,7 +1469,7 @@ static unsigned long vma_dump_size(struc
43123 if (vma->vm_file == NULL)
43124 return 0;
43125
43126 - if (FILTER(MAPPED_PRIVATE))
43127 + if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
43128 goto whole;
43129
43130 /*
43131 @@ -1255,8 +1565,11 @@ static int writenote(struct memelfnote *
43132 #undef DUMP_WRITE
43133
43134 #define DUMP_WRITE(addr, nr) \
43135 + do { \
43136 + gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
43137 if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
43138 - goto end_coredump;
43139 + goto end_coredump; \
43140 + } while (0);
43141
43142 static void fill_elf_header(struct elfhdr *elf, int segs,
43143 u16 machine, u32 flags, u8 osabi)
43144 @@ -1385,9 +1698,9 @@ static void fill_auxv_note(struct memelf
43145 {
43146 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
43147 int i = 0;
43148 - do
43149 + do {
43150 i += 2;
43151 - while (auxv[i - 2] != AT_NULL);
43152 + } while (auxv[i - 2] != AT_NULL);
43153 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
43154 }
43155
43156 @@ -1973,7 +2286,7 @@ static int elf_core_dump(long signr, str
43157 phdr.p_offset = offset;
43158 phdr.p_vaddr = vma->vm_start;
43159 phdr.p_paddr = 0;
43160 - phdr.p_filesz = vma_dump_size(vma, mm_flags);
43161 + phdr.p_filesz = vma_dump_size(vma, mm_flags, signr);
43162 phdr.p_memsz = vma->vm_end - vma->vm_start;
43163 offset += phdr.p_filesz;
43164 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
43165 @@ -2006,7 +2319,7 @@ static int elf_core_dump(long signr, str
43166 unsigned long addr;
43167 unsigned long end;
43168
43169 - end = vma->vm_start + vma_dump_size(vma, mm_flags);
43170 + end = vma->vm_start + vma_dump_size(vma, mm_flags, signr);
43171
43172 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
43173 struct page *page;
43174 @@ -2015,6 +2328,7 @@ static int elf_core_dump(long signr, str
43175 page = get_dump_page(addr);
43176 if (page) {
43177 void *kaddr = kmap(page);
43178 + gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
43179 stop = ((size += PAGE_SIZE) > limit) ||
43180 !dump_write(file, kaddr, PAGE_SIZE);
43181 kunmap(page);
43182 @@ -2042,6 +2356,97 @@ out:
43183
43184 #endif /* USE_ELF_CORE_DUMP */
43185
43186 +#ifdef CONFIG_PAX_MPROTECT
43187 +/* PaX: non-PIC ELF libraries need relocations on their executable segments
43188 + * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
43189 + * we'll remove VM_MAYWRITE for good on RELRO segments.
43190 + *
43191 + * The checks favour ld-linux.so behaviour which operates on a per ELF segment
43192 + * basis because we want to allow the common case and not the special ones.
43193 + */
43194 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
43195 +{
43196 + struct elfhdr elf_h;
43197 + struct elf_phdr elf_p;
43198 + unsigned long i;
43199 + unsigned long oldflags;
43200 + bool is_textrel_rw, is_textrel_rx, is_relro;
43201 +
43202 + if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
43203 + return;
43204 +
43205 + oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
43206 + newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
43207 +
43208 +#ifdef CONFIG_PAX_ELFRELOCS
43209 + /* possible TEXTREL */
43210 + is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
43211 + is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
43212 +#else
43213 + is_textrel_rw = false;
43214 + is_textrel_rx = false;
43215 +#endif
43216 +
43217 + /* possible RELRO */
43218 + is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
43219 +
43220 + if (!is_textrel_rw && !is_textrel_rx && !is_relro)
43221 + return;
43222 +
43223 + if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
43224 + memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
43225 +
43226 +#ifdef CONFIG_PAX_ETEXECRELOCS
43227 + ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
43228 +#else
43229 + ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
43230 +#endif
43231 +
43232 + (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
43233 + !elf_check_arch(&elf_h) ||
43234 + elf_h.e_phentsize != sizeof(struct elf_phdr) ||
43235 + elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
43236 + return;
43237 +
43238 + for (i = 0UL; i < elf_h.e_phnum; i++) {
43239 + if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
43240 + return;
43241 + switch (elf_p.p_type) {
43242 + case PT_DYNAMIC:
43243 + if (!is_textrel_rw && !is_textrel_rx)
43244 + continue;
43245 + i = 0UL;
43246 + while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
43247 + elf_dyn dyn;
43248 +
43249 + if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
43250 + return;
43251 + if (dyn.d_tag == DT_NULL)
43252 + return;
43253 + if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
43254 + gr_log_textrel(vma);
43255 + if (is_textrel_rw)
43256 + vma->vm_flags |= VM_MAYWRITE;
43257 + else
43258 + /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
43259 + vma->vm_flags &= ~VM_MAYWRITE;
43260 + return;
43261 + }
43262 + i++;
43263 + }
43264 + return;
43265 +
43266 + case PT_GNU_RELRO:
43267 + if (!is_relro)
43268 + continue;
43269 + if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
43270 + vma->vm_flags &= ~VM_MAYWRITE;
43271 + return;
43272 + }
43273 + }
43274 +}
43275 +#endif
43276 +
43277 static int __init init_elf_binfmt(void)
43278 {
43279 return register_binfmt(&elf_format);
43280 diff -urNp linux-2.6.32.46/fs/binfmt_flat.c linux-2.6.32.46/fs/binfmt_flat.c
43281 --- linux-2.6.32.46/fs/binfmt_flat.c 2011-03-27 14:31:47.000000000 -0400
43282 +++ linux-2.6.32.46/fs/binfmt_flat.c 2011-04-17 15:56:46.000000000 -0400
43283 @@ -564,7 +564,9 @@ static int load_flat_file(struct linux_b
43284 realdatastart = (unsigned long) -ENOMEM;
43285 printk("Unable to allocate RAM for process data, errno %d\n",
43286 (int)-realdatastart);
43287 + down_write(&current->mm->mmap_sem);
43288 do_munmap(current->mm, textpos, text_len);
43289 + up_write(&current->mm->mmap_sem);
43290 ret = realdatastart;
43291 goto err;
43292 }
43293 @@ -588,8 +590,10 @@ static int load_flat_file(struct linux_b
43294 }
43295 if (IS_ERR_VALUE(result)) {
43296 printk("Unable to read data+bss, errno %d\n", (int)-result);
43297 + down_write(&current->mm->mmap_sem);
43298 do_munmap(current->mm, textpos, text_len);
43299 do_munmap(current->mm, realdatastart, data_len + extra);
43300 + up_write(&current->mm->mmap_sem);
43301 ret = result;
43302 goto err;
43303 }
43304 @@ -658,8 +662,10 @@ static int load_flat_file(struct linux_b
43305 }
43306 if (IS_ERR_VALUE(result)) {
43307 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
43308 + down_write(&current->mm->mmap_sem);
43309 do_munmap(current->mm, textpos, text_len + data_len + extra +
43310 MAX_SHARED_LIBS * sizeof(unsigned long));
43311 + up_write(&current->mm->mmap_sem);
43312 ret = result;
43313 goto err;
43314 }
43315 diff -urNp linux-2.6.32.46/fs/bio.c linux-2.6.32.46/fs/bio.c
43316 --- linux-2.6.32.46/fs/bio.c 2011-03-27 14:31:47.000000000 -0400
43317 +++ linux-2.6.32.46/fs/bio.c 2011-10-06 09:37:14.000000000 -0400
43318 @@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_cr
43319
43320 i = 0;
43321 while (i < bio_slab_nr) {
43322 - struct bio_slab *bslab = &bio_slabs[i];
43323 + bslab = &bio_slabs[i];
43324
43325 if (!bslab->slab && entry == -1)
43326 entry = i;
43327 @@ -1236,7 +1236,7 @@ static void bio_copy_kern_endio(struct b
43328 const int read = bio_data_dir(bio) == READ;
43329 struct bio_map_data *bmd = bio->bi_private;
43330 int i;
43331 - char *p = bmd->sgvecs[0].iov_base;
43332 + char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base;
43333
43334 __bio_for_each_segment(bvec, bio, i, 0) {
43335 char *addr = page_address(bvec->bv_page);
43336 diff -urNp linux-2.6.32.46/fs/block_dev.c linux-2.6.32.46/fs/block_dev.c
43337 --- linux-2.6.32.46/fs/block_dev.c 2011-08-09 18:35:29.000000000 -0400
43338 +++ linux-2.6.32.46/fs/block_dev.c 2011-08-09 18:34:00.000000000 -0400
43339 @@ -664,7 +664,7 @@ int bd_claim(struct block_device *bdev,
43340 else if (bdev->bd_contains == bdev)
43341 res = 0; /* is a whole device which isn't held */
43342
43343 - else if (bdev->bd_contains->bd_holder == bd_claim)
43344 + else if (bdev->bd_contains->bd_holder == (void *)bd_claim)
43345 res = 0; /* is a partition of a device that is being partitioned */
43346 else if (bdev->bd_contains->bd_holder != NULL)
43347 res = -EBUSY; /* is a partition of a held device */
43348 diff -urNp linux-2.6.32.46/fs/btrfs/ctree.c linux-2.6.32.46/fs/btrfs/ctree.c
43349 --- linux-2.6.32.46/fs/btrfs/ctree.c 2011-03-27 14:31:47.000000000 -0400
43350 +++ linux-2.6.32.46/fs/btrfs/ctree.c 2011-04-17 15:56:46.000000000 -0400
43351 @@ -461,9 +461,12 @@ static noinline int __btrfs_cow_block(st
43352 free_extent_buffer(buf);
43353 add_root_to_dirty_list(root);
43354 } else {
43355 - if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
43356 - parent_start = parent->start;
43357 - else
43358 + if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
43359 + if (parent)
43360 + parent_start = parent->start;
43361 + else
43362 + parent_start = 0;
43363 + } else
43364 parent_start = 0;
43365
43366 WARN_ON(trans->transid != btrfs_header_generation(parent));
43367 @@ -3645,7 +3648,6 @@ setup_items_for_insert(struct btrfs_tran
43368
43369 ret = 0;
43370 if (slot == 0) {
43371 - struct btrfs_disk_key disk_key;
43372 btrfs_cpu_key_to_disk(&disk_key, cpu_key);
43373 ret = fixup_low_keys(trans, root, path, &disk_key, 1);
43374 }
43375 diff -urNp linux-2.6.32.46/fs/btrfs/disk-io.c linux-2.6.32.46/fs/btrfs/disk-io.c
43376 --- linux-2.6.32.46/fs/btrfs/disk-io.c 2011-04-17 17:00:52.000000000 -0400
43377 +++ linux-2.6.32.46/fs/btrfs/disk-io.c 2011-04-17 17:03:11.000000000 -0400
43378 @@ -39,7 +39,7 @@
43379 #include "tree-log.h"
43380 #include "free-space-cache.h"
43381
43382 -static struct extent_io_ops btree_extent_io_ops;
43383 +static const struct extent_io_ops btree_extent_io_ops;
43384 static void end_workqueue_fn(struct btrfs_work *work);
43385 static void free_fs_root(struct btrfs_root *root);
43386
43387 @@ -2607,7 +2607,7 @@ out:
43388 return 0;
43389 }
43390
43391 -static struct extent_io_ops btree_extent_io_ops = {
43392 +static const struct extent_io_ops btree_extent_io_ops = {
43393 .write_cache_pages_lock_hook = btree_lock_page_hook,
43394 .readpage_end_io_hook = btree_readpage_end_io_hook,
43395 .submit_bio_hook = btree_submit_bio_hook,
43396 diff -urNp linux-2.6.32.46/fs/btrfs/extent_io.h linux-2.6.32.46/fs/btrfs/extent_io.h
43397 --- linux-2.6.32.46/fs/btrfs/extent_io.h 2011-03-27 14:31:47.000000000 -0400
43398 +++ linux-2.6.32.46/fs/btrfs/extent_io.h 2011-04-17 15:56:46.000000000 -0400
43399 @@ -49,36 +49,36 @@ typedef int (extent_submit_bio_hook_t)(s
43400 struct bio *bio, int mirror_num,
43401 unsigned long bio_flags);
43402 struct extent_io_ops {
43403 - int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
43404 + int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
43405 u64 start, u64 end, int *page_started,
43406 unsigned long *nr_written);
43407 - int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
43408 - int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
43409 + int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
43410 + int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
43411 extent_submit_bio_hook_t *submit_bio_hook;
43412 - int (*merge_bio_hook)(struct page *page, unsigned long offset,
43413 + int (* const merge_bio_hook)(struct page *page, unsigned long offset,
43414 size_t size, struct bio *bio,
43415 unsigned long bio_flags);
43416 - int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
43417 - int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
43418 + int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
43419 + int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
43420 u64 start, u64 end,
43421 struct extent_state *state);
43422 - int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
43423 + int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
43424 u64 start, u64 end,
43425 struct extent_state *state);
43426 - int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
43427 + int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
43428 struct extent_state *state);
43429 - int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
43430 + int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
43431 struct extent_state *state, int uptodate);
43432 - int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
43433 + int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
43434 unsigned long old, unsigned long bits);
43435 - int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
43436 + int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
43437 unsigned long bits);
43438 - int (*merge_extent_hook)(struct inode *inode,
43439 + int (* const merge_extent_hook)(struct inode *inode,
43440 struct extent_state *new,
43441 struct extent_state *other);
43442 - int (*split_extent_hook)(struct inode *inode,
43443 + int (* const split_extent_hook)(struct inode *inode,
43444 struct extent_state *orig, u64 split);
43445 - int (*write_cache_pages_lock_hook)(struct page *page);
43446 + int (* const write_cache_pages_lock_hook)(struct page *page);
43447 };
43448
43449 struct extent_io_tree {
43450 @@ -88,7 +88,7 @@ struct extent_io_tree {
43451 u64 dirty_bytes;
43452 spinlock_t lock;
43453 spinlock_t buffer_lock;
43454 - struct extent_io_ops *ops;
43455 + const struct extent_io_ops *ops;
43456 };
43457
43458 struct extent_state {
43459 diff -urNp linux-2.6.32.46/fs/btrfs/extent-tree.c linux-2.6.32.46/fs/btrfs/extent-tree.c
43460 --- linux-2.6.32.46/fs/btrfs/extent-tree.c 2011-03-27 14:31:47.000000000 -0400
43461 +++ linux-2.6.32.46/fs/btrfs/extent-tree.c 2011-06-12 06:39:08.000000000 -0400
43462 @@ -7141,6 +7141,10 @@ static noinline int relocate_one_extent(
43463 u64 group_start = group->key.objectid;
43464 new_extents = kmalloc(sizeof(*new_extents),
43465 GFP_NOFS);
43466 + if (!new_extents) {
43467 + ret = -ENOMEM;
43468 + goto out;
43469 + }
43470 nr_extents = 1;
43471 ret = get_new_locations(reloc_inode,
43472 extent_key,
43473 diff -urNp linux-2.6.32.46/fs/btrfs/free-space-cache.c linux-2.6.32.46/fs/btrfs/free-space-cache.c
43474 --- linux-2.6.32.46/fs/btrfs/free-space-cache.c 2011-03-27 14:31:47.000000000 -0400
43475 +++ linux-2.6.32.46/fs/btrfs/free-space-cache.c 2011-04-17 15:56:46.000000000 -0400
43476 @@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
43477
43478 while(1) {
43479 if (entry->bytes < bytes || entry->offset < min_start) {
43480 - struct rb_node *node;
43481 -
43482 node = rb_next(&entry->offset_index);
43483 if (!node)
43484 break;
43485 @@ -1226,7 +1224,7 @@ again:
43486 */
43487 while (entry->bitmap || found_bitmap ||
43488 (!entry->bitmap && entry->bytes < min_bytes)) {
43489 - struct rb_node *node = rb_next(&entry->offset_index);
43490 + node = rb_next(&entry->offset_index);
43491
43492 if (entry->bitmap && entry->bytes > bytes + empty_size) {
43493 ret = btrfs_bitmap_cluster(block_group, entry, cluster,
43494 diff -urNp linux-2.6.32.46/fs/btrfs/inode.c linux-2.6.32.46/fs/btrfs/inode.c
43495 --- linux-2.6.32.46/fs/btrfs/inode.c 2011-03-27 14:31:47.000000000 -0400
43496 +++ linux-2.6.32.46/fs/btrfs/inode.c 2011-06-12 06:39:58.000000000 -0400
43497 @@ -63,7 +63,7 @@ static const struct inode_operations btr
43498 static const struct address_space_operations btrfs_aops;
43499 static const struct address_space_operations btrfs_symlink_aops;
43500 static const struct file_operations btrfs_dir_file_operations;
43501 -static struct extent_io_ops btrfs_extent_io_ops;
43502 +static const struct extent_io_ops btrfs_extent_io_ops;
43503
43504 static struct kmem_cache *btrfs_inode_cachep;
43505 struct kmem_cache *btrfs_trans_handle_cachep;
43506 @@ -925,6 +925,7 @@ static int cow_file_range_async(struct i
43507 1, 0, NULL, GFP_NOFS);
43508 while (start < end) {
43509 async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
43510 + BUG_ON(!async_cow);
43511 async_cow->inode = inode;
43512 async_cow->root = root;
43513 async_cow->locked_page = locked_page;
43514 @@ -4591,6 +4592,8 @@ static noinline int uncompress_inline(st
43515 inline_size = btrfs_file_extent_inline_item_len(leaf,
43516 btrfs_item_nr(leaf, path->slots[0]));
43517 tmp = kmalloc(inline_size, GFP_NOFS);
43518 + if (!tmp)
43519 + return -ENOMEM;
43520 ptr = btrfs_file_extent_inline_start(item);
43521
43522 read_extent_buffer(leaf, tmp, ptr, inline_size);
43523 @@ -5410,7 +5413,7 @@ fail:
43524 return -ENOMEM;
43525 }
43526
43527 -static int btrfs_getattr(struct vfsmount *mnt,
43528 +int btrfs_getattr(struct vfsmount *mnt,
43529 struct dentry *dentry, struct kstat *stat)
43530 {
43531 struct inode *inode = dentry->d_inode;
43532 @@ -5422,6 +5425,14 @@ static int btrfs_getattr(struct vfsmount
43533 return 0;
43534 }
43535
43536 +EXPORT_SYMBOL(btrfs_getattr);
43537 +
43538 +dev_t get_btrfs_dev_from_inode(struct inode *inode)
43539 +{
43540 + return BTRFS_I(inode)->root->anon_super.s_dev;
43541 +}
43542 +EXPORT_SYMBOL(get_btrfs_dev_from_inode);
43543 +
43544 static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
43545 struct inode *new_dir, struct dentry *new_dentry)
43546 {
43547 @@ -5972,7 +5983,7 @@ static const struct file_operations btrf
43548 .fsync = btrfs_sync_file,
43549 };
43550
43551 -static struct extent_io_ops btrfs_extent_io_ops = {
43552 +static const struct extent_io_ops btrfs_extent_io_ops = {
43553 .fill_delalloc = run_delalloc_range,
43554 .submit_bio_hook = btrfs_submit_bio_hook,
43555 .merge_bio_hook = btrfs_merge_bio_hook,
43556 diff -urNp linux-2.6.32.46/fs/btrfs/relocation.c linux-2.6.32.46/fs/btrfs/relocation.c
43557 --- linux-2.6.32.46/fs/btrfs/relocation.c 2011-03-27 14:31:47.000000000 -0400
43558 +++ linux-2.6.32.46/fs/btrfs/relocation.c 2011-04-17 15:56:46.000000000 -0400
43559 @@ -884,7 +884,7 @@ static int __update_reloc_root(struct bt
43560 }
43561 spin_unlock(&rc->reloc_root_tree.lock);
43562
43563 - BUG_ON((struct btrfs_root *)node->data != root);
43564 + BUG_ON(!node || (struct btrfs_root *)node->data != root);
43565
43566 if (!del) {
43567 spin_lock(&rc->reloc_root_tree.lock);
43568 diff -urNp linux-2.6.32.46/fs/btrfs/sysfs.c linux-2.6.32.46/fs/btrfs/sysfs.c
43569 --- linux-2.6.32.46/fs/btrfs/sysfs.c 2011-03-27 14:31:47.000000000 -0400
43570 +++ linux-2.6.32.46/fs/btrfs/sysfs.c 2011-04-17 15:56:46.000000000 -0400
43571 @@ -164,12 +164,12 @@ static void btrfs_root_release(struct ko
43572 complete(&root->kobj_unregister);
43573 }
43574
43575 -static struct sysfs_ops btrfs_super_attr_ops = {
43576 +static const struct sysfs_ops btrfs_super_attr_ops = {
43577 .show = btrfs_super_attr_show,
43578 .store = btrfs_super_attr_store,
43579 };
43580
43581 -static struct sysfs_ops btrfs_root_attr_ops = {
43582 +static const struct sysfs_ops btrfs_root_attr_ops = {
43583 .show = btrfs_root_attr_show,
43584 .store = btrfs_root_attr_store,
43585 };
43586 diff -urNp linux-2.6.32.46/fs/buffer.c linux-2.6.32.46/fs/buffer.c
43587 --- linux-2.6.32.46/fs/buffer.c 2011-03-27 14:31:47.000000000 -0400
43588 +++ linux-2.6.32.46/fs/buffer.c 2011-04-17 15:56:46.000000000 -0400
43589 @@ -25,6 +25,7 @@
43590 #include <linux/percpu.h>
43591 #include <linux/slab.h>
43592 #include <linux/capability.h>
43593 +#include <linux/security.h>
43594 #include <linux/blkdev.h>
43595 #include <linux/file.h>
43596 #include <linux/quotaops.h>
43597 diff -urNp linux-2.6.32.46/fs/cachefiles/bind.c linux-2.6.32.46/fs/cachefiles/bind.c
43598 --- linux-2.6.32.46/fs/cachefiles/bind.c 2011-03-27 14:31:47.000000000 -0400
43599 +++ linux-2.6.32.46/fs/cachefiles/bind.c 2011-04-17 15:56:46.000000000 -0400
43600 @@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
43601 args);
43602
43603 /* start by checking things over */
43604 - ASSERT(cache->fstop_percent >= 0 &&
43605 - cache->fstop_percent < cache->fcull_percent &&
43606 + ASSERT(cache->fstop_percent < cache->fcull_percent &&
43607 cache->fcull_percent < cache->frun_percent &&
43608 cache->frun_percent < 100);
43609
43610 - ASSERT(cache->bstop_percent >= 0 &&
43611 - cache->bstop_percent < cache->bcull_percent &&
43612 + ASSERT(cache->bstop_percent < cache->bcull_percent &&
43613 cache->bcull_percent < cache->brun_percent &&
43614 cache->brun_percent < 100);
43615
43616 diff -urNp linux-2.6.32.46/fs/cachefiles/daemon.c linux-2.6.32.46/fs/cachefiles/daemon.c
43617 --- linux-2.6.32.46/fs/cachefiles/daemon.c 2011-03-27 14:31:47.000000000 -0400
43618 +++ linux-2.6.32.46/fs/cachefiles/daemon.c 2011-04-17 15:56:46.000000000 -0400
43619 @@ -220,7 +220,7 @@ static ssize_t cachefiles_daemon_write(s
43620 if (test_bit(CACHEFILES_DEAD, &cache->flags))
43621 return -EIO;
43622
43623 - if (datalen < 0 || datalen > PAGE_SIZE - 1)
43624 + if (datalen > PAGE_SIZE - 1)
43625 return -EOPNOTSUPP;
43626
43627 /* drag the command string into the kernel so we can parse it */
43628 @@ -385,7 +385,7 @@ static int cachefiles_daemon_fstop(struc
43629 if (args[0] != '%' || args[1] != '\0')
43630 return -EINVAL;
43631
43632 - if (fstop < 0 || fstop >= cache->fcull_percent)
43633 + if (fstop >= cache->fcull_percent)
43634 return cachefiles_daemon_range_error(cache, args);
43635
43636 cache->fstop_percent = fstop;
43637 @@ -457,7 +457,7 @@ static int cachefiles_daemon_bstop(struc
43638 if (args[0] != '%' || args[1] != '\0')
43639 return -EINVAL;
43640
43641 - if (bstop < 0 || bstop >= cache->bcull_percent)
43642 + if (bstop >= cache->bcull_percent)
43643 return cachefiles_daemon_range_error(cache, args);
43644
43645 cache->bstop_percent = bstop;
43646 diff -urNp linux-2.6.32.46/fs/cachefiles/internal.h linux-2.6.32.46/fs/cachefiles/internal.h
43647 --- linux-2.6.32.46/fs/cachefiles/internal.h 2011-03-27 14:31:47.000000000 -0400
43648 +++ linux-2.6.32.46/fs/cachefiles/internal.h 2011-05-04 17:56:28.000000000 -0400
43649 @@ -56,7 +56,7 @@ struct cachefiles_cache {
43650 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
43651 struct rb_root active_nodes; /* active nodes (can't be culled) */
43652 rwlock_t active_lock; /* lock for active_nodes */
43653 - atomic_t gravecounter; /* graveyard uniquifier */
43654 + atomic_unchecked_t gravecounter; /* graveyard uniquifier */
43655 unsigned frun_percent; /* when to stop culling (% files) */
43656 unsigned fcull_percent; /* when to start culling (% files) */
43657 unsigned fstop_percent; /* when to stop allocating (% files) */
43658 @@ -168,19 +168,19 @@ extern int cachefiles_check_in_use(struc
43659 * proc.c
43660 */
43661 #ifdef CONFIG_CACHEFILES_HISTOGRAM
43662 -extern atomic_t cachefiles_lookup_histogram[HZ];
43663 -extern atomic_t cachefiles_mkdir_histogram[HZ];
43664 -extern atomic_t cachefiles_create_histogram[HZ];
43665 +extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
43666 +extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
43667 +extern atomic_unchecked_t cachefiles_create_histogram[HZ];
43668
43669 extern int __init cachefiles_proc_init(void);
43670 extern void cachefiles_proc_cleanup(void);
43671 static inline
43672 -void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
43673 +void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
43674 {
43675 unsigned long jif = jiffies - start_jif;
43676 if (jif >= HZ)
43677 jif = HZ - 1;
43678 - atomic_inc(&histogram[jif]);
43679 + atomic_inc_unchecked(&histogram[jif]);
43680 }
43681
43682 #else
43683 diff -urNp linux-2.6.32.46/fs/cachefiles/namei.c linux-2.6.32.46/fs/cachefiles/namei.c
43684 --- linux-2.6.32.46/fs/cachefiles/namei.c 2011-03-27 14:31:47.000000000 -0400
43685 +++ linux-2.6.32.46/fs/cachefiles/namei.c 2011-05-04 17:56:28.000000000 -0400
43686 @@ -250,7 +250,7 @@ try_again:
43687 /* first step is to make up a grave dentry in the graveyard */
43688 sprintf(nbuffer, "%08x%08x",
43689 (uint32_t) get_seconds(),
43690 - (uint32_t) atomic_inc_return(&cache->gravecounter));
43691 + (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
43692
43693 /* do the multiway lock magic */
43694 trap = lock_rename(cache->graveyard, dir);
43695 diff -urNp linux-2.6.32.46/fs/cachefiles/proc.c linux-2.6.32.46/fs/cachefiles/proc.c
43696 --- linux-2.6.32.46/fs/cachefiles/proc.c 2011-03-27 14:31:47.000000000 -0400
43697 +++ linux-2.6.32.46/fs/cachefiles/proc.c 2011-05-04 17:56:28.000000000 -0400
43698 @@ -14,9 +14,9 @@
43699 #include <linux/seq_file.h>
43700 #include "internal.h"
43701
43702 -atomic_t cachefiles_lookup_histogram[HZ];
43703 -atomic_t cachefiles_mkdir_histogram[HZ];
43704 -atomic_t cachefiles_create_histogram[HZ];
43705 +atomic_unchecked_t cachefiles_lookup_histogram[HZ];
43706 +atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
43707 +atomic_unchecked_t cachefiles_create_histogram[HZ];
43708
43709 /*
43710 * display the latency histogram
43711 @@ -35,9 +35,9 @@ static int cachefiles_histogram_show(str
43712 return 0;
43713 default:
43714 index = (unsigned long) v - 3;
43715 - x = atomic_read(&cachefiles_lookup_histogram[index]);
43716 - y = atomic_read(&cachefiles_mkdir_histogram[index]);
43717 - z = atomic_read(&cachefiles_create_histogram[index]);
43718 + x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
43719 + y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
43720 + z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
43721 if (x == 0 && y == 0 && z == 0)
43722 return 0;
43723
43724 diff -urNp linux-2.6.32.46/fs/cachefiles/rdwr.c linux-2.6.32.46/fs/cachefiles/rdwr.c
43725 --- linux-2.6.32.46/fs/cachefiles/rdwr.c 2011-03-27 14:31:47.000000000 -0400
43726 +++ linux-2.6.32.46/fs/cachefiles/rdwr.c 2011-10-06 09:37:14.000000000 -0400
43727 @@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache
43728 old_fs = get_fs();
43729 set_fs(KERNEL_DS);
43730 ret = file->f_op->write(
43731 - file, (const void __user *) data, len, &pos);
43732 + file, (const void __force_user *) data, len, &pos);
43733 set_fs(old_fs);
43734 kunmap(page);
43735 if (ret != len)
43736 diff -urNp linux-2.6.32.46/fs/cifs/cifs_debug.c linux-2.6.32.46/fs/cifs/cifs_debug.c
43737 --- linux-2.6.32.46/fs/cifs/cifs_debug.c 2011-03-27 14:31:47.000000000 -0400
43738 +++ linux-2.6.32.46/fs/cifs/cifs_debug.c 2011-05-04 17:56:28.000000000 -0400
43739 @@ -256,25 +256,25 @@ static ssize_t cifs_stats_proc_write(str
43740 tcon = list_entry(tmp3,
43741 struct cifsTconInfo,
43742 tcon_list);
43743 - atomic_set(&tcon->num_smbs_sent, 0);
43744 - atomic_set(&tcon->num_writes, 0);
43745 - atomic_set(&tcon->num_reads, 0);
43746 - atomic_set(&tcon->num_oplock_brks, 0);
43747 - atomic_set(&tcon->num_opens, 0);
43748 - atomic_set(&tcon->num_posixopens, 0);
43749 - atomic_set(&tcon->num_posixmkdirs, 0);
43750 - atomic_set(&tcon->num_closes, 0);
43751 - atomic_set(&tcon->num_deletes, 0);
43752 - atomic_set(&tcon->num_mkdirs, 0);
43753 - atomic_set(&tcon->num_rmdirs, 0);
43754 - atomic_set(&tcon->num_renames, 0);
43755 - atomic_set(&tcon->num_t2renames, 0);
43756 - atomic_set(&tcon->num_ffirst, 0);
43757 - atomic_set(&tcon->num_fnext, 0);
43758 - atomic_set(&tcon->num_fclose, 0);
43759 - atomic_set(&tcon->num_hardlinks, 0);
43760 - atomic_set(&tcon->num_symlinks, 0);
43761 - atomic_set(&tcon->num_locks, 0);
43762 + atomic_set_unchecked(&tcon->num_smbs_sent, 0);
43763 + atomic_set_unchecked(&tcon->num_writes, 0);
43764 + atomic_set_unchecked(&tcon->num_reads, 0);
43765 + atomic_set_unchecked(&tcon->num_oplock_brks, 0);
43766 + atomic_set_unchecked(&tcon->num_opens, 0);
43767 + atomic_set_unchecked(&tcon->num_posixopens, 0);
43768 + atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
43769 + atomic_set_unchecked(&tcon->num_closes, 0);
43770 + atomic_set_unchecked(&tcon->num_deletes, 0);
43771 + atomic_set_unchecked(&tcon->num_mkdirs, 0);
43772 + atomic_set_unchecked(&tcon->num_rmdirs, 0);
43773 + atomic_set_unchecked(&tcon->num_renames, 0);
43774 + atomic_set_unchecked(&tcon->num_t2renames, 0);
43775 + atomic_set_unchecked(&tcon->num_ffirst, 0);
43776 + atomic_set_unchecked(&tcon->num_fnext, 0);
43777 + atomic_set_unchecked(&tcon->num_fclose, 0);
43778 + atomic_set_unchecked(&tcon->num_hardlinks, 0);
43779 + atomic_set_unchecked(&tcon->num_symlinks, 0);
43780 + atomic_set_unchecked(&tcon->num_locks, 0);
43781 }
43782 }
43783 }
43784 @@ -334,41 +334,41 @@ static int cifs_stats_proc_show(struct s
43785 if (tcon->need_reconnect)
43786 seq_puts(m, "\tDISCONNECTED ");
43787 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
43788 - atomic_read(&tcon->num_smbs_sent),
43789 - atomic_read(&tcon->num_oplock_brks));
43790 + atomic_read_unchecked(&tcon->num_smbs_sent),
43791 + atomic_read_unchecked(&tcon->num_oplock_brks));
43792 seq_printf(m, "\nReads: %d Bytes: %lld",
43793 - atomic_read(&tcon->num_reads),
43794 + atomic_read_unchecked(&tcon->num_reads),
43795 (long long)(tcon->bytes_read));
43796 seq_printf(m, "\nWrites: %d Bytes: %lld",
43797 - atomic_read(&tcon->num_writes),
43798 + atomic_read_unchecked(&tcon->num_writes),
43799 (long long)(tcon->bytes_written));
43800 seq_printf(m, "\nFlushes: %d",
43801 - atomic_read(&tcon->num_flushes));
43802 + atomic_read_unchecked(&tcon->num_flushes));
43803 seq_printf(m, "\nLocks: %d HardLinks: %d "
43804 "Symlinks: %d",
43805 - atomic_read(&tcon->num_locks),
43806 - atomic_read(&tcon->num_hardlinks),
43807 - atomic_read(&tcon->num_symlinks));
43808 + atomic_read_unchecked(&tcon->num_locks),
43809 + atomic_read_unchecked(&tcon->num_hardlinks),
43810 + atomic_read_unchecked(&tcon->num_symlinks));
43811 seq_printf(m, "\nOpens: %d Closes: %d "
43812 "Deletes: %d",
43813 - atomic_read(&tcon->num_opens),
43814 - atomic_read(&tcon->num_closes),
43815 - atomic_read(&tcon->num_deletes));
43816 + atomic_read_unchecked(&tcon->num_opens),
43817 + atomic_read_unchecked(&tcon->num_closes),
43818 + atomic_read_unchecked(&tcon->num_deletes));
43819 seq_printf(m, "\nPosix Opens: %d "
43820 "Posix Mkdirs: %d",
43821 - atomic_read(&tcon->num_posixopens),
43822 - atomic_read(&tcon->num_posixmkdirs));
43823 + atomic_read_unchecked(&tcon->num_posixopens),
43824 + atomic_read_unchecked(&tcon->num_posixmkdirs));
43825 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
43826 - atomic_read(&tcon->num_mkdirs),
43827 - atomic_read(&tcon->num_rmdirs));
43828 + atomic_read_unchecked(&tcon->num_mkdirs),
43829 + atomic_read_unchecked(&tcon->num_rmdirs));
43830 seq_printf(m, "\nRenames: %d T2 Renames %d",
43831 - atomic_read(&tcon->num_renames),
43832 - atomic_read(&tcon->num_t2renames));
43833 + atomic_read_unchecked(&tcon->num_renames),
43834 + atomic_read_unchecked(&tcon->num_t2renames));
43835 seq_printf(m, "\nFindFirst: %d FNext %d "
43836 "FClose %d",
43837 - atomic_read(&tcon->num_ffirst),
43838 - atomic_read(&tcon->num_fnext),
43839 - atomic_read(&tcon->num_fclose));
43840 + atomic_read_unchecked(&tcon->num_ffirst),
43841 + atomic_read_unchecked(&tcon->num_fnext),
43842 + atomic_read_unchecked(&tcon->num_fclose));
43843 }
43844 }
43845 }
43846 diff -urNp linux-2.6.32.46/fs/cifs/cifsfs.c linux-2.6.32.46/fs/cifs/cifsfs.c
43847 --- linux-2.6.32.46/fs/cifs/cifsfs.c 2011-03-27 14:31:47.000000000 -0400
43848 +++ linux-2.6.32.46/fs/cifs/cifsfs.c 2011-08-25 17:17:57.000000000 -0400
43849 @@ -869,7 +869,7 @@ cifs_init_request_bufs(void)
43850 cifs_req_cachep = kmem_cache_create("cifs_request",
43851 CIFSMaxBufSize +
43852 MAX_CIFS_HDR_SIZE, 0,
43853 - SLAB_HWCACHE_ALIGN, NULL);
43854 + SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL);
43855 if (cifs_req_cachep == NULL)
43856 return -ENOMEM;
43857
43858 @@ -896,7 +896,7 @@ cifs_init_request_bufs(void)
43859 efficient to alloc 1 per page off the slab compared to 17K (5page)
43860 alloc of large cifs buffers even when page debugging is on */
43861 cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
43862 - MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
43863 + MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY,
43864 NULL);
43865 if (cifs_sm_req_cachep == NULL) {
43866 mempool_destroy(cifs_req_poolp);
43867 @@ -991,8 +991,8 @@ init_cifs(void)
43868 atomic_set(&bufAllocCount, 0);
43869 atomic_set(&smBufAllocCount, 0);
43870 #ifdef CONFIG_CIFS_STATS2
43871 - atomic_set(&totBufAllocCount, 0);
43872 - atomic_set(&totSmBufAllocCount, 0);
43873 + atomic_set_unchecked(&totBufAllocCount, 0);
43874 + atomic_set_unchecked(&totSmBufAllocCount, 0);
43875 #endif /* CONFIG_CIFS_STATS2 */
43876
43877 atomic_set(&midCount, 0);
43878 diff -urNp linux-2.6.32.46/fs/cifs/cifsglob.h linux-2.6.32.46/fs/cifs/cifsglob.h
43879 --- linux-2.6.32.46/fs/cifs/cifsglob.h 2011-08-09 18:35:29.000000000 -0400
43880 +++ linux-2.6.32.46/fs/cifs/cifsglob.h 2011-08-25 17:17:57.000000000 -0400
43881 @@ -252,28 +252,28 @@ struct cifsTconInfo {
43882 __u16 Flags; /* optional support bits */
43883 enum statusEnum tidStatus;
43884 #ifdef CONFIG_CIFS_STATS
43885 - atomic_t num_smbs_sent;
43886 - atomic_t num_writes;
43887 - atomic_t num_reads;
43888 - atomic_t num_flushes;
43889 - atomic_t num_oplock_brks;
43890 - atomic_t num_opens;
43891 - atomic_t num_closes;
43892 - atomic_t num_deletes;
43893 - atomic_t num_mkdirs;
43894 - atomic_t num_posixopens;
43895 - atomic_t num_posixmkdirs;
43896 - atomic_t num_rmdirs;
43897 - atomic_t num_renames;
43898 - atomic_t num_t2renames;
43899 - atomic_t num_ffirst;
43900 - atomic_t num_fnext;
43901 - atomic_t num_fclose;
43902 - atomic_t num_hardlinks;
43903 - atomic_t num_symlinks;
43904 - atomic_t num_locks;
43905 - atomic_t num_acl_get;
43906 - atomic_t num_acl_set;
43907 + atomic_unchecked_t num_smbs_sent;
43908 + atomic_unchecked_t num_writes;
43909 + atomic_unchecked_t num_reads;
43910 + atomic_unchecked_t num_flushes;
43911 + atomic_unchecked_t num_oplock_brks;
43912 + atomic_unchecked_t num_opens;
43913 + atomic_unchecked_t num_closes;
43914 + atomic_unchecked_t num_deletes;
43915 + atomic_unchecked_t num_mkdirs;
43916 + atomic_unchecked_t num_posixopens;
43917 + atomic_unchecked_t num_posixmkdirs;
43918 + atomic_unchecked_t num_rmdirs;
43919 + atomic_unchecked_t num_renames;
43920 + atomic_unchecked_t num_t2renames;
43921 + atomic_unchecked_t num_ffirst;
43922 + atomic_unchecked_t num_fnext;
43923 + atomic_unchecked_t num_fclose;
43924 + atomic_unchecked_t num_hardlinks;
43925 + atomic_unchecked_t num_symlinks;
43926 + atomic_unchecked_t num_locks;
43927 + atomic_unchecked_t num_acl_get;
43928 + atomic_unchecked_t num_acl_set;
43929 #ifdef CONFIG_CIFS_STATS2
43930 unsigned long long time_writes;
43931 unsigned long long time_reads;
43932 @@ -414,7 +414,7 @@ static inline char CIFS_DIR_SEP(const st
43933 }
43934
43935 #ifdef CONFIG_CIFS_STATS
43936 -#define cifs_stats_inc atomic_inc
43937 +#define cifs_stats_inc atomic_inc_unchecked
43938
43939 static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
43940 unsigned int bytes)
43941 @@ -701,8 +701,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnect
43942 /* Various Debug counters */
43943 GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
43944 #ifdef CONFIG_CIFS_STATS2
43945 -GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
43946 -GLOBAL_EXTERN atomic_t totSmBufAllocCount;
43947 +GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */
43948 +GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount;
43949 #endif
43950 GLOBAL_EXTERN atomic_t smBufAllocCount;
43951 GLOBAL_EXTERN atomic_t midCount;
43952 diff -urNp linux-2.6.32.46/fs/cifs/cifssmb.c linux-2.6.32.46/fs/cifs/cifssmb.c
43953 --- linux-2.6.32.46/fs/cifs/cifssmb.c 2011-03-27 14:31:47.000000000 -0400
43954 +++ linux-2.6.32.46/fs/cifs/cifssmb.c 2011-10-17 02:36:33.000000000 -0400
43955 @@ -3596,7 +3596,8 @@ int CIFSFindNext(const int xid, struct c
43956 T2_FNEXT_RSP_PARMS *parms;
43957 char *response_data;
43958 int rc = 0;
43959 - int bytes_returned, name_len;
43960 + int bytes_returned;
43961 + unsigned int name_len;
43962 __u16 params, byte_count;
43963
43964 cFYI(1, ("In FindNext"));
43965 diff -urNp linux-2.6.32.46/fs/cifs/link.c linux-2.6.32.46/fs/cifs/link.c
43966 --- linux-2.6.32.46/fs/cifs/link.c 2011-03-27 14:31:47.000000000 -0400
43967 +++ linux-2.6.32.46/fs/cifs/link.c 2011-04-17 15:56:46.000000000 -0400
43968 @@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct
43969
43970 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
43971 {
43972 - char *p = nd_get_link(nd);
43973 + const char *p = nd_get_link(nd);
43974 if (!IS_ERR(p))
43975 kfree(p);
43976 }
43977 diff -urNp linux-2.6.32.46/fs/cifs/misc.c linux-2.6.32.46/fs/cifs/misc.c
43978 --- linux-2.6.32.46/fs/cifs/misc.c 2011-03-27 14:31:47.000000000 -0400
43979 +++ linux-2.6.32.46/fs/cifs/misc.c 2011-08-25 17:17:57.000000000 -0400
43980 @@ -155,7 +155,7 @@ cifs_buf_get(void)
43981 memset(ret_buf, 0, sizeof(struct smb_hdr) + 3);
43982 atomic_inc(&bufAllocCount);
43983 #ifdef CONFIG_CIFS_STATS2
43984 - atomic_inc(&totBufAllocCount);
43985 + atomic_inc_unchecked(&totBufAllocCount);
43986 #endif /* CONFIG_CIFS_STATS2 */
43987 }
43988
43989 @@ -190,7 +190,7 @@ cifs_small_buf_get(void)
43990 /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
43991 atomic_inc(&smBufAllocCount);
43992 #ifdef CONFIG_CIFS_STATS2
43993 - atomic_inc(&totSmBufAllocCount);
43994 + atomic_inc_unchecked(&totSmBufAllocCount);
43995 #endif /* CONFIG_CIFS_STATS2 */
43996
43997 }
43998 diff -urNp linux-2.6.32.46/fs/coda/cache.c linux-2.6.32.46/fs/coda/cache.c
43999 --- linux-2.6.32.46/fs/coda/cache.c 2011-03-27 14:31:47.000000000 -0400
44000 +++ linux-2.6.32.46/fs/coda/cache.c 2011-05-04 17:56:28.000000000 -0400
44001 @@ -24,14 +24,14 @@
44002 #include <linux/coda_fs_i.h>
44003 #include <linux/coda_cache.h>
44004
44005 -static atomic_t permission_epoch = ATOMIC_INIT(0);
44006 +static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
44007
44008 /* replace or extend an acl cache hit */
44009 void coda_cache_enter(struct inode *inode, int mask)
44010 {
44011 struct coda_inode_info *cii = ITOC(inode);
44012
44013 - cii->c_cached_epoch = atomic_read(&permission_epoch);
44014 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
44015 if (cii->c_uid != current_fsuid()) {
44016 cii->c_uid = current_fsuid();
44017 cii->c_cached_perm = mask;
44018 @@ -43,13 +43,13 @@ void coda_cache_enter(struct inode *inod
44019 void coda_cache_clear_inode(struct inode *inode)
44020 {
44021 struct coda_inode_info *cii = ITOC(inode);
44022 - cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
44023 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
44024 }
44025
44026 /* remove all acl caches */
44027 void coda_cache_clear_all(struct super_block *sb)
44028 {
44029 - atomic_inc(&permission_epoch);
44030 + atomic_inc_unchecked(&permission_epoch);
44031 }
44032
44033
44034 @@ -61,7 +61,7 @@ int coda_cache_check(struct inode *inode
44035
44036 hit = (mask & cii->c_cached_perm) == mask &&
44037 cii->c_uid == current_fsuid() &&
44038 - cii->c_cached_epoch == atomic_read(&permission_epoch);
44039 + cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
44040
44041 return hit;
44042 }
44043 diff -urNp linux-2.6.32.46/fs/compat_binfmt_elf.c linux-2.6.32.46/fs/compat_binfmt_elf.c
44044 --- linux-2.6.32.46/fs/compat_binfmt_elf.c 2011-03-27 14:31:47.000000000 -0400
44045 +++ linux-2.6.32.46/fs/compat_binfmt_elf.c 2011-04-17 15:56:46.000000000 -0400
44046 @@ -29,10 +29,12 @@
44047 #undef elfhdr
44048 #undef elf_phdr
44049 #undef elf_note
44050 +#undef elf_dyn
44051 #undef elf_addr_t
44052 #define elfhdr elf32_hdr
44053 #define elf_phdr elf32_phdr
44054 #define elf_note elf32_note
44055 +#define elf_dyn Elf32_Dyn
44056 #define elf_addr_t Elf32_Addr
44057
44058 /*
44059 diff -urNp linux-2.6.32.46/fs/compat.c linux-2.6.32.46/fs/compat.c
44060 --- linux-2.6.32.46/fs/compat.c 2011-04-17 17:00:52.000000000 -0400
44061 +++ linux-2.6.32.46/fs/compat.c 2011-10-06 09:37:14.000000000 -0400
44062 @@ -133,8 +133,8 @@ asmlinkage long compat_sys_utimes(char _
44063 static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
44064 {
44065 compat_ino_t ino = stat->ino;
44066 - typeof(ubuf->st_uid) uid = 0;
44067 - typeof(ubuf->st_gid) gid = 0;
44068 + typeof(((struct compat_stat *)0)->st_uid) uid = 0;
44069 + typeof(((struct compat_stat *)0)->st_gid) gid = 0;
44070 int err;
44071
44072 SET_UID(uid, stat->uid);
44073 @@ -533,7 +533,7 @@ compat_sys_io_setup(unsigned nr_reqs, u3
44074
44075 set_fs(KERNEL_DS);
44076 /* The __user pointer cast is valid because of the set_fs() */
44077 - ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
44078 + ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64);
44079 set_fs(oldfs);
44080 /* truncating is ok because it's a user address */
44081 if (!ret)
44082 @@ -830,6 +830,7 @@ struct compat_old_linux_dirent {
44083
44084 struct compat_readdir_callback {
44085 struct compat_old_linux_dirent __user *dirent;
44086 + struct file * file;
44087 int result;
44088 };
44089
44090 @@ -847,6 +848,10 @@ static int compat_fillonedir(void *__buf
44091 buf->result = -EOVERFLOW;
44092 return -EOVERFLOW;
44093 }
44094 +
44095 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44096 + return 0;
44097 +
44098 buf->result++;
44099 dirent = buf->dirent;
44100 if (!access_ok(VERIFY_WRITE, dirent,
44101 @@ -879,6 +884,7 @@ asmlinkage long compat_sys_old_readdir(u
44102
44103 buf.result = 0;
44104 buf.dirent = dirent;
44105 + buf.file = file;
44106
44107 error = vfs_readdir(file, compat_fillonedir, &buf);
44108 if (buf.result)
44109 @@ -899,6 +905,7 @@ struct compat_linux_dirent {
44110 struct compat_getdents_callback {
44111 struct compat_linux_dirent __user *current_dir;
44112 struct compat_linux_dirent __user *previous;
44113 + struct file * file;
44114 int count;
44115 int error;
44116 };
44117 @@ -919,6 +926,10 @@ static int compat_filldir(void *__buf, c
44118 buf->error = -EOVERFLOW;
44119 return -EOVERFLOW;
44120 }
44121 +
44122 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44123 + return 0;
44124 +
44125 dirent = buf->previous;
44126 if (dirent) {
44127 if (__put_user(offset, &dirent->d_off))
44128 @@ -966,6 +977,7 @@ asmlinkage long compat_sys_getdents(unsi
44129 buf.previous = NULL;
44130 buf.count = count;
44131 buf.error = 0;
44132 + buf.file = file;
44133
44134 error = vfs_readdir(file, compat_filldir, &buf);
44135 if (error >= 0)
44136 @@ -987,6 +999,7 @@ out:
44137 struct compat_getdents_callback64 {
44138 struct linux_dirent64 __user *current_dir;
44139 struct linux_dirent64 __user *previous;
44140 + struct file * file;
44141 int count;
44142 int error;
44143 };
44144 @@ -1003,6 +1016,10 @@ static int compat_filldir64(void * __buf
44145 buf->error = -EINVAL; /* only used if we fail.. */
44146 if (reclen > buf->count)
44147 return -EINVAL;
44148 +
44149 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44150 + return 0;
44151 +
44152 dirent = buf->previous;
44153
44154 if (dirent) {
44155 @@ -1054,13 +1071,14 @@ asmlinkage long compat_sys_getdents64(un
44156 buf.previous = NULL;
44157 buf.count = count;
44158 buf.error = 0;
44159 + buf.file = file;
44160
44161 error = vfs_readdir(file, compat_filldir64, &buf);
44162 if (error >= 0)
44163 error = buf.error;
44164 lastdirent = buf.previous;
44165 if (lastdirent) {
44166 - typeof(lastdirent->d_off) d_off = file->f_pos;
44167 + typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
44168 if (__put_user_unaligned(d_off, &lastdirent->d_off))
44169 error = -EFAULT;
44170 else
44171 @@ -1098,7 +1116,7 @@ static ssize_t compat_do_readv_writev(in
44172 * verify all the pointers
44173 */
44174 ret = -EINVAL;
44175 - if ((nr_segs > UIO_MAXIOV) || (nr_segs <= 0))
44176 + if (nr_segs > UIO_MAXIOV)
44177 goto out;
44178 if (!file->f_op)
44179 goto out;
44180 @@ -1463,11 +1481,35 @@ int compat_do_execve(char * filename,
44181 compat_uptr_t __user *envp,
44182 struct pt_regs * regs)
44183 {
44184 +#ifdef CONFIG_GRKERNSEC
44185 + struct file *old_exec_file;
44186 + struct acl_subject_label *old_acl;
44187 + struct rlimit old_rlim[RLIM_NLIMITS];
44188 +#endif
44189 struct linux_binprm *bprm;
44190 struct file *file;
44191 struct files_struct *displaced;
44192 bool clear_in_exec;
44193 int retval;
44194 + const struct cred *cred = current_cred();
44195 +
44196 + /*
44197 + * We move the actual failure in case of RLIMIT_NPROC excess from
44198 + * set*uid() to execve() because too many poorly written programs
44199 + * don't check setuid() return code. Here we additionally recheck
44200 + * whether NPROC limit is still exceeded.
44201 + */
44202 + gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
44203 +
44204 + if ((current->flags & PF_NPROC_EXCEEDED) &&
44205 + atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
44206 + retval = -EAGAIN;
44207 + goto out_ret;
44208 + }
44209 +
44210 + /* We're below the limit (still or again), so we don't want to make
44211 + * further execve() calls fail. */
44212 + current->flags &= ~PF_NPROC_EXCEEDED;
44213
44214 retval = unshare_files(&displaced);
44215 if (retval)
44216 @@ -1499,6 +1541,15 @@ int compat_do_execve(char * filename,
44217 bprm->filename = filename;
44218 bprm->interp = filename;
44219
44220 + if (gr_process_user_ban()) {
44221 + retval = -EPERM;
44222 + goto out_file;
44223 + }
44224 +
44225 + retval = -EACCES;
44226 + if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
44227 + goto out_file;
44228 +
44229 retval = bprm_mm_init(bprm);
44230 if (retval)
44231 goto out_file;
44232 @@ -1528,9 +1579,40 @@ int compat_do_execve(char * filename,
44233 if (retval < 0)
44234 goto out;
44235
44236 + if (!gr_tpe_allow(file)) {
44237 + retval = -EACCES;
44238 + goto out;
44239 + }
44240 +
44241 + if (gr_check_crash_exec(file)) {
44242 + retval = -EACCES;
44243 + goto out;
44244 + }
44245 +
44246 + gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
44247 +
44248 + gr_handle_exec_args_compat(bprm, argv);
44249 +
44250 +#ifdef CONFIG_GRKERNSEC
44251 + old_acl = current->acl;
44252 + memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
44253 + old_exec_file = current->exec_file;
44254 + get_file(file);
44255 + current->exec_file = file;
44256 +#endif
44257 +
44258 + retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
44259 + bprm->unsafe & LSM_UNSAFE_SHARE);
44260 + if (retval < 0)
44261 + goto out_fail;
44262 +
44263 retval = search_binary_handler(bprm, regs);
44264 if (retval < 0)
44265 - goto out;
44266 + goto out_fail;
44267 +#ifdef CONFIG_GRKERNSEC
44268 + if (old_exec_file)
44269 + fput(old_exec_file);
44270 +#endif
44271
44272 /* execve succeeded */
44273 current->fs->in_exec = 0;
44274 @@ -1541,6 +1623,14 @@ int compat_do_execve(char * filename,
44275 put_files_struct(displaced);
44276 return retval;
44277
44278 +out_fail:
44279 +#ifdef CONFIG_GRKERNSEC
44280 + current->acl = old_acl;
44281 + memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
44282 + fput(current->exec_file);
44283 + current->exec_file = old_exec_file;
44284 +#endif
44285 +
44286 out:
44287 if (bprm->mm) {
44288 acct_arg_size(bprm, 0);
44289 @@ -1711,6 +1801,8 @@ int compat_core_sys_select(int n, compat
44290 struct fdtable *fdt;
44291 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
44292
44293 + pax_track_stack();
44294 +
44295 if (n < 0)
44296 goto out_nofds;
44297
44298 @@ -2151,7 +2243,7 @@ asmlinkage long compat_sys_nfsservctl(in
44299 oldfs = get_fs();
44300 set_fs(KERNEL_DS);
44301 /* The __user pointer casts are valid because of the set_fs() */
44302 - err = sys_nfsservctl(cmd, (void __user *) karg, (void __user *) kres);
44303 + err = sys_nfsservctl(cmd, (void __force_user *) karg, (void __force_user *) kres);
44304 set_fs(oldfs);
44305
44306 if (err)
44307 diff -urNp linux-2.6.32.46/fs/compat_ioctl.c linux-2.6.32.46/fs/compat_ioctl.c
44308 --- linux-2.6.32.46/fs/compat_ioctl.c 2011-03-27 14:31:47.000000000 -0400
44309 +++ linux-2.6.32.46/fs/compat_ioctl.c 2011-10-06 09:37:14.000000000 -0400
44310 @@ -234,6 +234,8 @@ static int do_video_set_spu_palette(unsi
44311 up = (struct compat_video_spu_palette __user *) arg;
44312 err = get_user(palp, &up->palette);
44313 err |= get_user(length, &up->length);
44314 + if (err)
44315 + return -EFAULT;
44316
44317 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
44318 err = put_user(compat_ptr(palp), &up_native->palette);
44319 @@ -1513,7 +1515,7 @@ static int serial_struct_ioctl(unsigned
44320 return -EFAULT;
44321 if (__get_user(udata, &ss32->iomem_base))
44322 return -EFAULT;
44323 - ss.iomem_base = compat_ptr(udata);
44324 + ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata);
44325 if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
44326 __get_user(ss.port_high, &ss32->port_high))
44327 return -EFAULT;
44328 @@ -1809,7 +1811,7 @@ static int compat_ioctl_preallocate(stru
44329 copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) ||
44330 copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) ||
44331 copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) ||
44332 - copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32)))
44333 + copy_in_user(p->l_pad, &p32->l_pad, 4*sizeof(u32)))
44334 return -EFAULT;
44335
44336 return ioctl_preallocate(file, p);
44337 diff -urNp linux-2.6.32.46/fs/configfs/dir.c linux-2.6.32.46/fs/configfs/dir.c
44338 --- linux-2.6.32.46/fs/configfs/dir.c 2011-03-27 14:31:47.000000000 -0400
44339 +++ linux-2.6.32.46/fs/configfs/dir.c 2011-05-11 18:25:15.000000000 -0400
44340 @@ -1572,7 +1572,8 @@ static int configfs_readdir(struct file
44341 }
44342 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
44343 struct configfs_dirent *next;
44344 - const char * name;
44345 + const unsigned char * name;
44346 + char d_name[sizeof(next->s_dentry->d_iname)];
44347 int len;
44348
44349 next = list_entry(p, struct configfs_dirent,
44350 @@ -1581,7 +1582,12 @@ static int configfs_readdir(struct file
44351 continue;
44352
44353 name = configfs_get_name(next);
44354 - len = strlen(name);
44355 + if (next->s_dentry && name == next->s_dentry->d_iname) {
44356 + len = next->s_dentry->d_name.len;
44357 + memcpy(d_name, name, len);
44358 + name = d_name;
44359 + } else
44360 + len = strlen(name);
44361 if (next->s_dentry)
44362 ino = next->s_dentry->d_inode->i_ino;
44363 else
44364 diff -urNp linux-2.6.32.46/fs/dcache.c linux-2.6.32.46/fs/dcache.c
44365 --- linux-2.6.32.46/fs/dcache.c 2011-03-27 14:31:47.000000000 -0400
44366 +++ linux-2.6.32.46/fs/dcache.c 2011-04-23 13:32:21.000000000 -0400
44367 @@ -45,8 +45,6 @@ EXPORT_SYMBOL(dcache_lock);
44368
44369 static struct kmem_cache *dentry_cache __read_mostly;
44370
44371 -#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
44372 -
44373 /*
44374 * This is the single most critical data structure when it comes
44375 * to the dcache: the hashtable for lookups. Somebody should try
44376 @@ -2319,7 +2317,7 @@ void __init vfs_caches_init(unsigned lon
44377 mempages -= reserve;
44378
44379 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
44380 - SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
44381 + SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
44382
44383 dcache_init();
44384 inode_init();
44385 diff -urNp linux-2.6.32.46/fs/dlm/lockspace.c linux-2.6.32.46/fs/dlm/lockspace.c
44386 --- linux-2.6.32.46/fs/dlm/lockspace.c 2011-03-27 14:31:47.000000000 -0400
44387 +++ linux-2.6.32.46/fs/dlm/lockspace.c 2011-04-17 15:56:46.000000000 -0400
44388 @@ -148,7 +148,7 @@ static void lockspace_kobj_release(struc
44389 kfree(ls);
44390 }
44391
44392 -static struct sysfs_ops dlm_attr_ops = {
44393 +static const struct sysfs_ops dlm_attr_ops = {
44394 .show = dlm_attr_show,
44395 .store = dlm_attr_store,
44396 };
44397 diff -urNp linux-2.6.32.46/fs/ecryptfs/inode.c linux-2.6.32.46/fs/ecryptfs/inode.c
44398 --- linux-2.6.32.46/fs/ecryptfs/inode.c 2011-03-27 14:31:47.000000000 -0400
44399 +++ linux-2.6.32.46/fs/ecryptfs/inode.c 2011-10-06 09:37:14.000000000 -0400
44400 @@ -660,7 +660,7 @@ static int ecryptfs_readlink_lower(struc
44401 old_fs = get_fs();
44402 set_fs(get_ds());
44403 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
44404 - (char __user *)lower_buf,
44405 + (char __force_user *)lower_buf,
44406 lower_bufsiz);
44407 set_fs(old_fs);
44408 if (rc < 0)
44409 @@ -706,7 +706,7 @@ static void *ecryptfs_follow_link(struct
44410 }
44411 old_fs = get_fs();
44412 set_fs(get_ds());
44413 - rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
44414 + rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
44415 set_fs(old_fs);
44416 if (rc < 0)
44417 goto out_free;
44418 diff -urNp linux-2.6.32.46/fs/exec.c linux-2.6.32.46/fs/exec.c
44419 --- linux-2.6.32.46/fs/exec.c 2011-06-25 12:55:34.000000000 -0400
44420 +++ linux-2.6.32.46/fs/exec.c 2011-10-06 09:37:14.000000000 -0400
44421 @@ -56,12 +56,24 @@
44422 #include <linux/fsnotify.h>
44423 #include <linux/fs_struct.h>
44424 #include <linux/pipe_fs_i.h>
44425 +#include <linux/random.h>
44426 +#include <linux/seq_file.h>
44427 +
44428 +#ifdef CONFIG_PAX_REFCOUNT
44429 +#include <linux/kallsyms.h>
44430 +#include <linux/kdebug.h>
44431 +#endif
44432
44433 #include <asm/uaccess.h>
44434 #include <asm/mmu_context.h>
44435 #include <asm/tlb.h>
44436 #include "internal.h"
44437
44438 +#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
44439 +void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
44440 +EXPORT_SYMBOL(pax_set_initial_flags_func);
44441 +#endif
44442 +
44443 int core_uses_pid;
44444 char core_pattern[CORENAME_MAX_SIZE] = "core";
44445 unsigned int core_pipe_limit;
44446 @@ -115,7 +127,7 @@ SYSCALL_DEFINE1(uselib, const char __use
44447 goto out;
44448
44449 file = do_filp_open(AT_FDCWD, tmp,
44450 - O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
44451 + O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
44452 MAY_READ | MAY_EXEC | MAY_OPEN);
44453 putname(tmp);
44454 error = PTR_ERR(file);
44455 @@ -178,18 +190,10 @@ struct page *get_arg_page(struct linux_b
44456 int write)
44457 {
44458 struct page *page;
44459 - int ret;
44460
44461 -#ifdef CONFIG_STACK_GROWSUP
44462 - if (write) {
44463 - ret = expand_stack_downwards(bprm->vma, pos);
44464 - if (ret < 0)
44465 - return NULL;
44466 - }
44467 -#endif
44468 - ret = get_user_pages(current, bprm->mm, pos,
44469 - 1, write, 1, &page, NULL);
44470 - if (ret <= 0)
44471 + if (0 > expand_stack_downwards(bprm->vma, pos))
44472 + return NULL;
44473 + if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
44474 return NULL;
44475
44476 if (write) {
44477 @@ -263,6 +267,11 @@ static int __bprm_mm_init(struct linux_b
44478 vma->vm_end = STACK_TOP_MAX;
44479 vma->vm_start = vma->vm_end - PAGE_SIZE;
44480 vma->vm_flags = VM_STACK_FLAGS;
44481 +
44482 +#ifdef CONFIG_PAX_SEGMEXEC
44483 + vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
44484 +#endif
44485 +
44486 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
44487
44488 err = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
44489 @@ -276,6 +285,12 @@ static int __bprm_mm_init(struct linux_b
44490 mm->stack_vm = mm->total_vm = 1;
44491 up_write(&mm->mmap_sem);
44492 bprm->p = vma->vm_end - sizeof(void *);
44493 +
44494 +#ifdef CONFIG_PAX_RANDUSTACK
44495 + if (randomize_va_space)
44496 + bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
44497 +#endif
44498 +
44499 return 0;
44500 err:
44501 up_write(&mm->mmap_sem);
44502 @@ -510,7 +525,7 @@ int copy_strings_kernel(int argc,char **
44503 int r;
44504 mm_segment_t oldfs = get_fs();
44505 set_fs(KERNEL_DS);
44506 - r = copy_strings(argc, (char __user * __user *)argv, bprm);
44507 + r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
44508 set_fs(oldfs);
44509 return r;
44510 }
44511 @@ -540,7 +555,8 @@ static int shift_arg_pages(struct vm_are
44512 unsigned long new_end = old_end - shift;
44513 struct mmu_gather *tlb;
44514
44515 - BUG_ON(new_start > new_end);
44516 + if (new_start >= new_end || new_start < mmap_min_addr)
44517 + return -ENOMEM;
44518
44519 /*
44520 * ensure there are no vmas between where we want to go
44521 @@ -549,6 +565,10 @@ static int shift_arg_pages(struct vm_are
44522 if (vma != find_vma(mm, new_start))
44523 return -EFAULT;
44524
44525 +#ifdef CONFIG_PAX_SEGMEXEC
44526 + BUG_ON(pax_find_mirror_vma(vma));
44527 +#endif
44528 +
44529 /*
44530 * cover the whole range: [new_start, old_end)
44531 */
44532 @@ -630,10 +650,6 @@ int setup_arg_pages(struct linux_binprm
44533 stack_top = arch_align_stack(stack_top);
44534 stack_top = PAGE_ALIGN(stack_top);
44535
44536 - if (unlikely(stack_top < mmap_min_addr) ||
44537 - unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
44538 - return -ENOMEM;
44539 -
44540 stack_shift = vma->vm_end - stack_top;
44541
44542 bprm->p -= stack_shift;
44543 @@ -645,6 +661,14 @@ int setup_arg_pages(struct linux_binprm
44544 bprm->exec -= stack_shift;
44545
44546 down_write(&mm->mmap_sem);
44547 +
44548 + /* Move stack pages down in memory. */
44549 + if (stack_shift) {
44550 + ret = shift_arg_pages(vma, stack_shift);
44551 + if (ret)
44552 + goto out_unlock;
44553 + }
44554 +
44555 vm_flags = VM_STACK_FLAGS;
44556
44557 /*
44558 @@ -658,19 +682,24 @@ int setup_arg_pages(struct linux_binprm
44559 vm_flags &= ~VM_EXEC;
44560 vm_flags |= mm->def_flags;
44561
44562 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
44563 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
44564 + vm_flags &= ~VM_EXEC;
44565 +
44566 +#ifdef CONFIG_PAX_MPROTECT
44567 + if (mm->pax_flags & MF_PAX_MPROTECT)
44568 + vm_flags &= ~VM_MAYEXEC;
44569 +#endif
44570 +
44571 + }
44572 +#endif
44573 +
44574 ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
44575 vm_flags);
44576 if (ret)
44577 goto out_unlock;
44578 BUG_ON(prev != vma);
44579
44580 - /* Move stack pages down in memory. */
44581 - if (stack_shift) {
44582 - ret = shift_arg_pages(vma, stack_shift);
44583 - if (ret)
44584 - goto out_unlock;
44585 - }
44586 -
44587 stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
44588 stack_size = vma->vm_end - vma->vm_start;
44589 /*
44590 @@ -707,7 +736,7 @@ struct file *open_exec(const char *name)
44591 int err;
44592
44593 file = do_filp_open(AT_FDCWD, name,
44594 - O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
44595 + O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
44596 MAY_EXEC | MAY_OPEN);
44597 if (IS_ERR(file))
44598 goto out;
44599 @@ -744,7 +773,7 @@ int kernel_read(struct file *file, loff_
44600 old_fs = get_fs();
44601 set_fs(get_ds());
44602 /* The cast to a user pointer is valid due to the set_fs() */
44603 - result = vfs_read(file, (void __user *)addr, count, &pos);
44604 + result = vfs_read(file, (void __force_user *)addr, count, &pos);
44605 set_fs(old_fs);
44606 return result;
44607 }
44608 @@ -1152,7 +1181,7 @@ int check_unsafe_exec(struct linux_binpr
44609 }
44610 rcu_read_unlock();
44611
44612 - if (p->fs->users > n_fs) {
44613 + if (atomic_read(&p->fs->users) > n_fs) {
44614 bprm->unsafe |= LSM_UNSAFE_SHARE;
44615 } else {
44616 res = -EAGAIN;
44617 @@ -1347,11 +1376,35 @@ int do_execve(char * filename,
44618 char __user *__user *envp,
44619 struct pt_regs * regs)
44620 {
44621 +#ifdef CONFIG_GRKERNSEC
44622 + struct file *old_exec_file;
44623 + struct acl_subject_label *old_acl;
44624 + struct rlimit old_rlim[RLIM_NLIMITS];
44625 +#endif
44626 struct linux_binprm *bprm;
44627 struct file *file;
44628 struct files_struct *displaced;
44629 bool clear_in_exec;
44630 int retval;
44631 + const struct cred *cred = current_cred();
44632 +
44633 + /*
44634 + * We move the actual failure in case of RLIMIT_NPROC excess from
44635 + * set*uid() to execve() because too many poorly written programs
44636 + * don't check setuid() return code. Here we additionally recheck
44637 + * whether NPROC limit is still exceeded.
44638 + */
44639 + gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
44640 +
44641 + if ((current->flags & PF_NPROC_EXCEEDED) &&
44642 + atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
44643 + retval = -EAGAIN;
44644 + goto out_ret;
44645 + }
44646 +
44647 + /* We're below the limit (still or again), so we don't want to make
44648 + * further execve() calls fail. */
44649 + current->flags &= ~PF_NPROC_EXCEEDED;
44650
44651 retval = unshare_files(&displaced);
44652 if (retval)
44653 @@ -1383,6 +1436,16 @@ int do_execve(char * filename,
44654 bprm->filename = filename;
44655 bprm->interp = filename;
44656
44657 + if (gr_process_user_ban()) {
44658 + retval = -EPERM;
44659 + goto out_file;
44660 + }
44661 +
44662 + if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
44663 + retval = -EACCES;
44664 + goto out_file;
44665 + }
44666 +
44667 retval = bprm_mm_init(bprm);
44668 if (retval)
44669 goto out_file;
44670 @@ -1412,10 +1475,41 @@ int do_execve(char * filename,
44671 if (retval < 0)
44672 goto out;
44673
44674 + if (!gr_tpe_allow(file)) {
44675 + retval = -EACCES;
44676 + goto out;
44677 + }
44678 +
44679 + if (gr_check_crash_exec(file)) {
44680 + retval = -EACCES;
44681 + goto out;
44682 + }
44683 +
44684 + gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
44685 +
44686 + gr_handle_exec_args(bprm, (const char __user *const __user *)argv);
44687 +
44688 +#ifdef CONFIG_GRKERNSEC
44689 + old_acl = current->acl;
44690 + memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
44691 + old_exec_file = current->exec_file;
44692 + get_file(file);
44693 + current->exec_file = file;
44694 +#endif
44695 +
44696 + retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
44697 + bprm->unsafe & LSM_UNSAFE_SHARE);
44698 + if (retval < 0)
44699 + goto out_fail;
44700 +
44701 current->flags &= ~PF_KTHREAD;
44702 retval = search_binary_handler(bprm,regs);
44703 if (retval < 0)
44704 - goto out;
44705 + goto out_fail;
44706 +#ifdef CONFIG_GRKERNSEC
44707 + if (old_exec_file)
44708 + fput(old_exec_file);
44709 +#endif
44710
44711 /* execve succeeded */
44712 current->fs->in_exec = 0;
44713 @@ -1426,6 +1520,14 @@ int do_execve(char * filename,
44714 put_files_struct(displaced);
44715 return retval;
44716
44717 +out_fail:
44718 +#ifdef CONFIG_GRKERNSEC
44719 + current->acl = old_acl;
44720 + memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
44721 + fput(current->exec_file);
44722 + current->exec_file = old_exec_file;
44723 +#endif
44724 +
44725 out:
44726 if (bprm->mm) {
44727 acct_arg_size(bprm, 0);
44728 @@ -1591,6 +1693,220 @@ out:
44729 return ispipe;
44730 }
44731
44732 +int pax_check_flags(unsigned long *flags)
44733 +{
44734 + int retval = 0;
44735 +
44736 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
44737 + if (*flags & MF_PAX_SEGMEXEC)
44738 + {
44739 + *flags &= ~MF_PAX_SEGMEXEC;
44740 + retval = -EINVAL;
44741 + }
44742 +#endif
44743 +
44744 + if ((*flags & MF_PAX_PAGEEXEC)
44745 +
44746 +#ifdef CONFIG_PAX_PAGEEXEC
44747 + && (*flags & MF_PAX_SEGMEXEC)
44748 +#endif
44749 +
44750 + )
44751 + {
44752 + *flags &= ~MF_PAX_PAGEEXEC;
44753 + retval = -EINVAL;
44754 + }
44755 +
44756 + if ((*flags & MF_PAX_MPROTECT)
44757 +
44758 +#ifdef CONFIG_PAX_MPROTECT
44759 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
44760 +#endif
44761 +
44762 + )
44763 + {
44764 + *flags &= ~MF_PAX_MPROTECT;
44765 + retval = -EINVAL;
44766 + }
44767 +
44768 + if ((*flags & MF_PAX_EMUTRAMP)
44769 +
44770 +#ifdef CONFIG_PAX_EMUTRAMP
44771 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
44772 +#endif
44773 +
44774 + )
44775 + {
44776 + *flags &= ~MF_PAX_EMUTRAMP;
44777 + retval = -EINVAL;
44778 + }
44779 +
44780 + return retval;
44781 +}
44782 +
44783 +EXPORT_SYMBOL(pax_check_flags);
44784 +
44785 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
44786 +void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
44787 +{
44788 + struct task_struct *tsk = current;
44789 + struct mm_struct *mm = current->mm;
44790 + char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
44791 + char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
44792 + char *path_exec = NULL;
44793 + char *path_fault = NULL;
44794 + unsigned long start = 0UL, end = 0UL, offset = 0UL;
44795 +
44796 + if (buffer_exec && buffer_fault) {
44797 + struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
44798 +
44799 + down_read(&mm->mmap_sem);
44800 + vma = mm->mmap;
44801 + while (vma && (!vma_exec || !vma_fault)) {
44802 + if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
44803 + vma_exec = vma;
44804 + if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
44805 + vma_fault = vma;
44806 + vma = vma->vm_next;
44807 + }
44808 + if (vma_exec) {
44809 + path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
44810 + if (IS_ERR(path_exec))
44811 + path_exec = "<path too long>";
44812 + else {
44813 + path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
44814 + if (path_exec) {
44815 + *path_exec = 0;
44816 + path_exec = buffer_exec;
44817 + } else
44818 + path_exec = "<path too long>";
44819 + }
44820 + }
44821 + if (vma_fault) {
44822 + start = vma_fault->vm_start;
44823 + end = vma_fault->vm_end;
44824 + offset = vma_fault->vm_pgoff << PAGE_SHIFT;
44825 + if (vma_fault->vm_file) {
44826 + path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
44827 + if (IS_ERR(path_fault))
44828 + path_fault = "<path too long>";
44829 + else {
44830 + path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
44831 + if (path_fault) {
44832 + *path_fault = 0;
44833 + path_fault = buffer_fault;
44834 + } else
44835 + path_fault = "<path too long>";
44836 + }
44837 + } else
44838 + path_fault = "<anonymous mapping>";
44839 + }
44840 + up_read(&mm->mmap_sem);
44841 + }
44842 + if (tsk->signal->curr_ip)
44843 + printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
44844 + else
44845 + printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
44846 + printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
44847 + "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
44848 + task_uid(tsk), task_euid(tsk), pc, sp);
44849 + free_page((unsigned long)buffer_exec);
44850 + free_page((unsigned long)buffer_fault);
44851 + pax_report_insns(pc, sp);
44852 + do_coredump(SIGKILL, SIGKILL, regs);
44853 +}
44854 +#endif
44855 +
44856 +#ifdef CONFIG_PAX_REFCOUNT
44857 +void pax_report_refcount_overflow(struct pt_regs *regs)
44858 +{
44859 + if (current->signal->curr_ip)
44860 + printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
44861 + &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
44862 + else
44863 + printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
44864 + current->comm, task_pid_nr(current), current_uid(), current_euid());
44865 + print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
44866 + show_regs(regs);
44867 + force_sig_specific(SIGKILL, current);
44868 +}
44869 +#endif
44870 +
44871 +#ifdef CONFIG_PAX_USERCOPY
44872 +/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
44873 +int object_is_on_stack(const void *obj, unsigned long len)
44874 +{
44875 + const void * const stack = task_stack_page(current);
44876 + const void * const stackend = stack + THREAD_SIZE;
44877 +
44878 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
44879 + const void *frame = NULL;
44880 + const void *oldframe;
44881 +#endif
44882 +
44883 + if (obj + len < obj)
44884 + return -1;
44885 +
44886 + if (obj + len <= stack || stackend <= obj)
44887 + return 0;
44888 +
44889 + if (obj < stack || stackend < obj + len)
44890 + return -1;
44891 +
44892 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
44893 + oldframe = __builtin_frame_address(1);
44894 + if (oldframe)
44895 + frame = __builtin_frame_address(2);
44896 + /*
44897 + low ----------------------------------------------> high
44898 + [saved bp][saved ip][args][local vars][saved bp][saved ip]
44899 + ^----------------^
44900 + allow copies only within here
44901 + */
44902 + while (stack <= frame && frame < stackend) {
44903 + /* if obj + len extends past the last frame, this
44904 + check won't pass and the next frame will be 0,
44905 + causing us to bail out and correctly report
44906 + the copy as invalid
44907 + */
44908 + if (obj + len <= frame)
44909 + return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
44910 + oldframe = frame;
44911 + frame = *(const void * const *)frame;
44912 + }
44913 + return -1;
44914 +#else
44915 + return 1;
44916 +#endif
44917 +}
44918 +
44919 +
44920 +NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
44921 +{
44922 + if (current->signal->curr_ip)
44923 + printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
44924 + &current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
44925 + else
44926 + printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
44927 + to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
44928 +
44929 + dump_stack();
44930 + gr_handle_kernel_exploit();
44931 + do_group_exit(SIGKILL);
44932 +}
44933 +#endif
44934 +
44935 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
44936 +void pax_track_stack(void)
44937 +{
44938 + unsigned long sp = (unsigned long)&sp;
44939 + if (sp < current_thread_info()->lowest_stack &&
44940 + sp > (unsigned long)task_stack_page(current))
44941 + current_thread_info()->lowest_stack = sp;
44942 +}
44943 +EXPORT_SYMBOL(pax_track_stack);
44944 +#endif
44945 +
44946 static int zap_process(struct task_struct *start)
44947 {
44948 struct task_struct *t;
44949 @@ -1793,17 +2109,17 @@ static void wait_for_dump_helpers(struct
44950 pipe = file->f_path.dentry->d_inode->i_pipe;
44951
44952 pipe_lock(pipe);
44953 - pipe->readers++;
44954 - pipe->writers--;
44955 + atomic_inc(&pipe->readers);
44956 + atomic_dec(&pipe->writers);
44957
44958 - while ((pipe->readers > 1) && (!signal_pending(current))) {
44959 + while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
44960 wake_up_interruptible_sync(&pipe->wait);
44961 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
44962 pipe_wait(pipe);
44963 }
44964
44965 - pipe->readers--;
44966 - pipe->writers++;
44967 + atomic_dec(&pipe->readers);
44968 + atomic_inc(&pipe->writers);
44969 pipe_unlock(pipe);
44970
44971 }
44972 @@ -1826,10 +2142,13 @@ void do_coredump(long signr, int exit_co
44973 char **helper_argv = NULL;
44974 int helper_argc = 0;
44975 int dump_count = 0;
44976 - static atomic_t core_dump_count = ATOMIC_INIT(0);
44977 + static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
44978
44979 audit_core_dumps(signr);
44980
44981 + if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
44982 + gr_handle_brute_attach(current, mm->flags);
44983 +
44984 binfmt = mm->binfmt;
44985 if (!binfmt || !binfmt->core_dump)
44986 goto fail;
44987 @@ -1874,6 +2193,8 @@ void do_coredump(long signr, int exit_co
44988 */
44989 clear_thread_flag(TIF_SIGPENDING);
44990
44991 + gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
44992 +
44993 /*
44994 * lock_kernel() because format_corename() is controlled by sysctl, which
44995 * uses lock_kernel()
44996 @@ -1908,7 +2229,7 @@ void do_coredump(long signr, int exit_co
44997 goto fail_unlock;
44998 }
44999
45000 - dump_count = atomic_inc_return(&core_dump_count);
45001 + dump_count = atomic_inc_return_unchecked(&core_dump_count);
45002 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
45003 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
45004 task_tgid_vnr(current), current->comm);
45005 @@ -1972,7 +2293,7 @@ close_fail:
45006 filp_close(file, NULL);
45007 fail_dropcount:
45008 if (dump_count)
45009 - atomic_dec(&core_dump_count);
45010 + atomic_dec_unchecked(&core_dump_count);
45011 fail_unlock:
45012 if (helper_argv)
45013 argv_free(helper_argv);
45014 diff -urNp linux-2.6.32.46/fs/ext2/balloc.c linux-2.6.32.46/fs/ext2/balloc.c
45015 --- linux-2.6.32.46/fs/ext2/balloc.c 2011-03-27 14:31:47.000000000 -0400
45016 +++ linux-2.6.32.46/fs/ext2/balloc.c 2011-04-17 15:56:46.000000000 -0400
45017 @@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
45018
45019 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
45020 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
45021 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
45022 + if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
45023 sbi->s_resuid != current_fsuid() &&
45024 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
45025 return 0;
45026 diff -urNp linux-2.6.32.46/fs/ext3/balloc.c linux-2.6.32.46/fs/ext3/balloc.c
45027 --- linux-2.6.32.46/fs/ext3/balloc.c 2011-03-27 14:31:47.000000000 -0400
45028 +++ linux-2.6.32.46/fs/ext3/balloc.c 2011-04-17 15:56:46.000000000 -0400
45029 @@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct e
45030
45031 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
45032 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
45033 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
45034 + if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
45035 sbi->s_resuid != current_fsuid() &&
45036 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
45037 return 0;
45038 diff -urNp linux-2.6.32.46/fs/ext4/balloc.c linux-2.6.32.46/fs/ext4/balloc.c
45039 --- linux-2.6.32.46/fs/ext4/balloc.c 2011-03-27 14:31:47.000000000 -0400
45040 +++ linux-2.6.32.46/fs/ext4/balloc.c 2011-04-17 15:56:46.000000000 -0400
45041 @@ -570,7 +570,7 @@ int ext4_has_free_blocks(struct ext4_sb_
45042 /* Hm, nope. Are (enough) root reserved blocks available? */
45043 if (sbi->s_resuid == current_fsuid() ||
45044 ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
45045 - capable(CAP_SYS_RESOURCE)) {
45046 + capable_nolog(CAP_SYS_RESOURCE)) {
45047 if (free_blocks >= (nblocks + dirty_blocks))
45048 return 1;
45049 }
45050 diff -urNp linux-2.6.32.46/fs/ext4/ext4.h linux-2.6.32.46/fs/ext4/ext4.h
45051 --- linux-2.6.32.46/fs/ext4/ext4.h 2011-03-27 14:31:47.000000000 -0400
45052 +++ linux-2.6.32.46/fs/ext4/ext4.h 2011-04-17 15:56:46.000000000 -0400
45053 @@ -1078,19 +1078,19 @@ struct ext4_sb_info {
45054
45055 /* stats for buddy allocator */
45056 spinlock_t s_mb_pa_lock;
45057 - atomic_t s_bal_reqs; /* number of reqs with len > 1 */
45058 - atomic_t s_bal_success; /* we found long enough chunks */
45059 - atomic_t s_bal_allocated; /* in blocks */
45060 - atomic_t s_bal_ex_scanned; /* total extents scanned */
45061 - atomic_t s_bal_goals; /* goal hits */
45062 - atomic_t s_bal_breaks; /* too long searches */
45063 - atomic_t s_bal_2orders; /* 2^order hits */
45064 + atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
45065 + atomic_unchecked_t s_bal_success; /* we found long enough chunks */
45066 + atomic_unchecked_t s_bal_allocated; /* in blocks */
45067 + atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
45068 + atomic_unchecked_t s_bal_goals; /* goal hits */
45069 + atomic_unchecked_t s_bal_breaks; /* too long searches */
45070 + atomic_unchecked_t s_bal_2orders; /* 2^order hits */
45071 spinlock_t s_bal_lock;
45072 unsigned long s_mb_buddies_generated;
45073 unsigned long long s_mb_generation_time;
45074 - atomic_t s_mb_lost_chunks;
45075 - atomic_t s_mb_preallocated;
45076 - atomic_t s_mb_discarded;
45077 + atomic_unchecked_t s_mb_lost_chunks;
45078 + atomic_unchecked_t s_mb_preallocated;
45079 + atomic_unchecked_t s_mb_discarded;
45080 atomic_t s_lock_busy;
45081
45082 /* locality groups */
45083 diff -urNp linux-2.6.32.46/fs/ext4/file.c linux-2.6.32.46/fs/ext4/file.c
45084 --- linux-2.6.32.46/fs/ext4/file.c 2011-03-27 14:31:47.000000000 -0400
45085 +++ linux-2.6.32.46/fs/ext4/file.c 2011-10-17 02:30:06.000000000 -0400
45086 @@ -122,8 +122,8 @@ static int ext4_file_open(struct inode *
45087 cp = d_path(&path, buf, sizeof(buf));
45088 path_put(&path);
45089 if (!IS_ERR(cp)) {
45090 - memcpy(sbi->s_es->s_last_mounted, cp,
45091 - sizeof(sbi->s_es->s_last_mounted));
45092 + strlcpy(sbi->s_es->s_last_mounted, cp,
45093 + sizeof(sbi->s_es->s_last_mounted));
45094 sb->s_dirt = 1;
45095 }
45096 }
45097 diff -urNp linux-2.6.32.46/fs/ext4/mballoc.c linux-2.6.32.46/fs/ext4/mballoc.c
45098 --- linux-2.6.32.46/fs/ext4/mballoc.c 2011-06-25 12:55:34.000000000 -0400
45099 +++ linux-2.6.32.46/fs/ext4/mballoc.c 2011-06-25 12:56:37.000000000 -0400
45100 @@ -1755,7 +1755,7 @@ void ext4_mb_simple_scan_group(struct ex
45101 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
45102
45103 if (EXT4_SB(sb)->s_mb_stats)
45104 - atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
45105 + atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
45106
45107 break;
45108 }
45109 @@ -2131,7 +2131,7 @@ repeat:
45110 ac->ac_status = AC_STATUS_CONTINUE;
45111 ac->ac_flags |= EXT4_MB_HINT_FIRST;
45112 cr = 3;
45113 - atomic_inc(&sbi->s_mb_lost_chunks);
45114 + atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
45115 goto repeat;
45116 }
45117 }
45118 @@ -2174,6 +2174,8 @@ static int ext4_mb_seq_groups_show(struc
45119 ext4_grpblk_t counters[16];
45120 } sg;
45121
45122 + pax_track_stack();
45123 +
45124 group--;
45125 if (group == 0)
45126 seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
45127 @@ -2534,25 +2536,25 @@ int ext4_mb_release(struct super_block *
45128 if (sbi->s_mb_stats) {
45129 printk(KERN_INFO
45130 "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
45131 - atomic_read(&sbi->s_bal_allocated),
45132 - atomic_read(&sbi->s_bal_reqs),
45133 - atomic_read(&sbi->s_bal_success));
45134 + atomic_read_unchecked(&sbi->s_bal_allocated),
45135 + atomic_read_unchecked(&sbi->s_bal_reqs),
45136 + atomic_read_unchecked(&sbi->s_bal_success));
45137 printk(KERN_INFO
45138 "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
45139 "%u 2^N hits, %u breaks, %u lost\n",
45140 - atomic_read(&sbi->s_bal_ex_scanned),
45141 - atomic_read(&sbi->s_bal_goals),
45142 - atomic_read(&sbi->s_bal_2orders),
45143 - atomic_read(&sbi->s_bal_breaks),
45144 - atomic_read(&sbi->s_mb_lost_chunks));
45145 + atomic_read_unchecked(&sbi->s_bal_ex_scanned),
45146 + atomic_read_unchecked(&sbi->s_bal_goals),
45147 + atomic_read_unchecked(&sbi->s_bal_2orders),
45148 + atomic_read_unchecked(&sbi->s_bal_breaks),
45149 + atomic_read_unchecked(&sbi->s_mb_lost_chunks));
45150 printk(KERN_INFO
45151 "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
45152 sbi->s_mb_buddies_generated++,
45153 sbi->s_mb_generation_time);
45154 printk(KERN_INFO
45155 "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
45156 - atomic_read(&sbi->s_mb_preallocated),
45157 - atomic_read(&sbi->s_mb_discarded));
45158 + atomic_read_unchecked(&sbi->s_mb_preallocated),
45159 + atomic_read_unchecked(&sbi->s_mb_discarded));
45160 }
45161
45162 free_percpu(sbi->s_locality_groups);
45163 @@ -3034,16 +3036,16 @@ static void ext4_mb_collect_stats(struct
45164 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
45165
45166 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
45167 - atomic_inc(&sbi->s_bal_reqs);
45168 - atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
45169 + atomic_inc_unchecked(&sbi->s_bal_reqs);
45170 + atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
45171 if (ac->ac_o_ex.fe_len >= ac->ac_g_ex.fe_len)
45172 - atomic_inc(&sbi->s_bal_success);
45173 - atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
45174 + atomic_inc_unchecked(&sbi->s_bal_success);
45175 + atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
45176 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
45177 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
45178 - atomic_inc(&sbi->s_bal_goals);
45179 + atomic_inc_unchecked(&sbi->s_bal_goals);
45180 if (ac->ac_found > sbi->s_mb_max_to_scan)
45181 - atomic_inc(&sbi->s_bal_breaks);
45182 + atomic_inc_unchecked(&sbi->s_bal_breaks);
45183 }
45184
45185 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
45186 @@ -3443,7 +3445,7 @@ ext4_mb_new_inode_pa(struct ext4_allocat
45187 trace_ext4_mb_new_inode_pa(ac, pa);
45188
45189 ext4_mb_use_inode_pa(ac, pa);
45190 - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45191 + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45192
45193 ei = EXT4_I(ac->ac_inode);
45194 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
45195 @@ -3503,7 +3505,7 @@ ext4_mb_new_group_pa(struct ext4_allocat
45196 trace_ext4_mb_new_group_pa(ac, pa);
45197
45198 ext4_mb_use_group_pa(ac, pa);
45199 - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45200 + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45201
45202 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
45203 lg = ac->ac_lg;
45204 @@ -3607,7 +3609,7 @@ ext4_mb_release_inode_pa(struct ext4_bud
45205 * from the bitmap and continue.
45206 */
45207 }
45208 - atomic_add(free, &sbi->s_mb_discarded);
45209 + atomic_add_unchecked(free, &sbi->s_mb_discarded);
45210
45211 return err;
45212 }
45213 @@ -3626,7 +3628,7 @@ ext4_mb_release_group_pa(struct ext4_bud
45214 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
45215 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
45216 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
45217 - atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
45218 + atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
45219
45220 if (ac) {
45221 ac->ac_sb = sb;
45222 diff -urNp linux-2.6.32.46/fs/ext4/super.c linux-2.6.32.46/fs/ext4/super.c
45223 --- linux-2.6.32.46/fs/ext4/super.c 2011-03-27 14:31:47.000000000 -0400
45224 +++ linux-2.6.32.46/fs/ext4/super.c 2011-04-17 15:56:46.000000000 -0400
45225 @@ -2287,7 +2287,7 @@ static void ext4_sb_release(struct kobje
45226 }
45227
45228
45229 -static struct sysfs_ops ext4_attr_ops = {
45230 +static const struct sysfs_ops ext4_attr_ops = {
45231 .show = ext4_attr_show,
45232 .store = ext4_attr_store,
45233 };
45234 diff -urNp linux-2.6.32.46/fs/fcntl.c linux-2.6.32.46/fs/fcntl.c
45235 --- linux-2.6.32.46/fs/fcntl.c 2011-03-27 14:31:47.000000000 -0400
45236 +++ linux-2.6.32.46/fs/fcntl.c 2011-10-06 09:37:14.000000000 -0400
45237 @@ -223,6 +223,11 @@ int __f_setown(struct file *filp, struct
45238 if (err)
45239 return err;
45240
45241 + if (gr_handle_chroot_fowner(pid, type))
45242 + return -ENOENT;
45243 + if (gr_check_protected_task_fowner(pid, type))
45244 + return -EACCES;
45245 +
45246 f_modown(filp, pid, type, force);
45247 return 0;
45248 }
45249 @@ -265,7 +270,7 @@ pid_t f_getown(struct file *filp)
45250
45251 static int f_setown_ex(struct file *filp, unsigned long arg)
45252 {
45253 - struct f_owner_ex * __user owner_p = (void * __user)arg;
45254 + struct f_owner_ex __user *owner_p = (void __user *)arg;
45255 struct f_owner_ex owner;
45256 struct pid *pid;
45257 int type;
45258 @@ -305,7 +310,7 @@ static int f_setown_ex(struct file *filp
45259
45260 static int f_getown_ex(struct file *filp, unsigned long arg)
45261 {
45262 - struct f_owner_ex * __user owner_p = (void * __user)arg;
45263 + struct f_owner_ex __user *owner_p = (void __user *)arg;
45264 struct f_owner_ex owner;
45265 int ret = 0;
45266
45267 @@ -344,6 +349,7 @@ static long do_fcntl(int fd, unsigned in
45268 switch (cmd) {
45269 case F_DUPFD:
45270 case F_DUPFD_CLOEXEC:
45271 + gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
45272 if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
45273 break;
45274 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
45275 diff -urNp linux-2.6.32.46/fs/fifo.c linux-2.6.32.46/fs/fifo.c
45276 --- linux-2.6.32.46/fs/fifo.c 2011-03-27 14:31:47.000000000 -0400
45277 +++ linux-2.6.32.46/fs/fifo.c 2011-04-17 15:56:46.000000000 -0400
45278 @@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode
45279 */
45280 filp->f_op = &read_pipefifo_fops;
45281 pipe->r_counter++;
45282 - if (pipe->readers++ == 0)
45283 + if (atomic_inc_return(&pipe->readers) == 1)
45284 wake_up_partner(inode);
45285
45286 - if (!pipe->writers) {
45287 + if (!atomic_read(&pipe->writers)) {
45288 if ((filp->f_flags & O_NONBLOCK)) {
45289 /* suppress POLLHUP until we have
45290 * seen a writer */
45291 @@ -83,15 +83,15 @@ static int fifo_open(struct inode *inode
45292 * errno=ENXIO when there is no process reading the FIFO.
45293 */
45294 ret = -ENXIO;
45295 - if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
45296 + if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
45297 goto err;
45298
45299 filp->f_op = &write_pipefifo_fops;
45300 pipe->w_counter++;
45301 - if (!pipe->writers++)
45302 + if (atomic_inc_return(&pipe->writers) == 1)
45303 wake_up_partner(inode);
45304
45305 - if (!pipe->readers) {
45306 + if (!atomic_read(&pipe->readers)) {
45307 wait_for_partner(inode, &pipe->r_counter);
45308 if (signal_pending(current))
45309 goto err_wr;
45310 @@ -107,11 +107,11 @@ static int fifo_open(struct inode *inode
45311 */
45312 filp->f_op = &rdwr_pipefifo_fops;
45313
45314 - pipe->readers++;
45315 - pipe->writers++;
45316 + atomic_inc(&pipe->readers);
45317 + atomic_inc(&pipe->writers);
45318 pipe->r_counter++;
45319 pipe->w_counter++;
45320 - if (pipe->readers == 1 || pipe->writers == 1)
45321 + if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
45322 wake_up_partner(inode);
45323 break;
45324
45325 @@ -125,19 +125,19 @@ static int fifo_open(struct inode *inode
45326 return 0;
45327
45328 err_rd:
45329 - if (!--pipe->readers)
45330 + if (atomic_dec_and_test(&pipe->readers))
45331 wake_up_interruptible(&pipe->wait);
45332 ret = -ERESTARTSYS;
45333 goto err;
45334
45335 err_wr:
45336 - if (!--pipe->writers)
45337 + if (atomic_dec_and_test(&pipe->writers))
45338 wake_up_interruptible(&pipe->wait);
45339 ret = -ERESTARTSYS;
45340 goto err;
45341
45342 err:
45343 - if (!pipe->readers && !pipe->writers)
45344 + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
45345 free_pipe_info(inode);
45346
45347 err_nocleanup:
45348 diff -urNp linux-2.6.32.46/fs/file.c linux-2.6.32.46/fs/file.c
45349 --- linux-2.6.32.46/fs/file.c 2011-03-27 14:31:47.000000000 -0400
45350 +++ linux-2.6.32.46/fs/file.c 2011-04-17 15:56:46.000000000 -0400
45351 @@ -14,6 +14,7 @@
45352 #include <linux/slab.h>
45353 #include <linux/vmalloc.h>
45354 #include <linux/file.h>
45355 +#include <linux/security.h>
45356 #include <linux/fdtable.h>
45357 #include <linux/bitops.h>
45358 #include <linux/interrupt.h>
45359 @@ -257,6 +258,8 @@ int expand_files(struct files_struct *fi
45360 * N.B. For clone tasks sharing a files structure, this test
45361 * will limit the total number of files that can be opened.
45362 */
45363 +
45364 + gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
45365 if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
45366 return -EMFILE;
45367
45368 diff -urNp linux-2.6.32.46/fs/filesystems.c linux-2.6.32.46/fs/filesystems.c
45369 --- linux-2.6.32.46/fs/filesystems.c 2011-03-27 14:31:47.000000000 -0400
45370 +++ linux-2.6.32.46/fs/filesystems.c 2011-04-17 15:56:46.000000000 -0400
45371 @@ -272,7 +272,12 @@ struct file_system_type *get_fs_type(con
45372 int len = dot ? dot - name : strlen(name);
45373
45374 fs = __get_fs_type(name, len);
45375 +
45376 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
45377 + if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
45378 +#else
45379 if (!fs && (request_module("%.*s", len, name) == 0))
45380 +#endif
45381 fs = __get_fs_type(name, len);
45382
45383 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
45384 diff -urNp linux-2.6.32.46/fs/fscache/cookie.c linux-2.6.32.46/fs/fscache/cookie.c
45385 --- linux-2.6.32.46/fs/fscache/cookie.c 2011-03-27 14:31:47.000000000 -0400
45386 +++ linux-2.6.32.46/fs/fscache/cookie.c 2011-05-04 17:56:28.000000000 -0400
45387 @@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire
45388 parent ? (char *) parent->def->name : "<no-parent>",
45389 def->name, netfs_data);
45390
45391 - fscache_stat(&fscache_n_acquires);
45392 + fscache_stat_unchecked(&fscache_n_acquires);
45393
45394 /* if there's no parent cookie, then we don't create one here either */
45395 if (!parent) {
45396 - fscache_stat(&fscache_n_acquires_null);
45397 + fscache_stat_unchecked(&fscache_n_acquires_null);
45398 _leave(" [no parent]");
45399 return NULL;
45400 }
45401 @@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire
45402 /* allocate and initialise a cookie */
45403 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
45404 if (!cookie) {
45405 - fscache_stat(&fscache_n_acquires_oom);
45406 + fscache_stat_unchecked(&fscache_n_acquires_oom);
45407 _leave(" [ENOMEM]");
45408 return NULL;
45409 }
45410 @@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire
45411
45412 switch (cookie->def->type) {
45413 case FSCACHE_COOKIE_TYPE_INDEX:
45414 - fscache_stat(&fscache_n_cookie_index);
45415 + fscache_stat_unchecked(&fscache_n_cookie_index);
45416 break;
45417 case FSCACHE_COOKIE_TYPE_DATAFILE:
45418 - fscache_stat(&fscache_n_cookie_data);
45419 + fscache_stat_unchecked(&fscache_n_cookie_data);
45420 break;
45421 default:
45422 - fscache_stat(&fscache_n_cookie_special);
45423 + fscache_stat_unchecked(&fscache_n_cookie_special);
45424 break;
45425 }
45426
45427 @@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire
45428 if (fscache_acquire_non_index_cookie(cookie) < 0) {
45429 atomic_dec(&parent->n_children);
45430 __fscache_cookie_put(cookie);
45431 - fscache_stat(&fscache_n_acquires_nobufs);
45432 + fscache_stat_unchecked(&fscache_n_acquires_nobufs);
45433 _leave(" = NULL");
45434 return NULL;
45435 }
45436 }
45437
45438 - fscache_stat(&fscache_n_acquires_ok);
45439 + fscache_stat_unchecked(&fscache_n_acquires_ok);
45440 _leave(" = %p", cookie);
45441 return cookie;
45442 }
45443 @@ -168,7 +168,7 @@ static int fscache_acquire_non_index_coo
45444 cache = fscache_select_cache_for_object(cookie->parent);
45445 if (!cache) {
45446 up_read(&fscache_addremove_sem);
45447 - fscache_stat(&fscache_n_acquires_no_cache);
45448 + fscache_stat_unchecked(&fscache_n_acquires_no_cache);
45449 _leave(" = -ENOMEDIUM [no cache]");
45450 return -ENOMEDIUM;
45451 }
45452 @@ -256,12 +256,12 @@ static int fscache_alloc_object(struct f
45453 object = cache->ops->alloc_object(cache, cookie);
45454 fscache_stat_d(&fscache_n_cop_alloc_object);
45455 if (IS_ERR(object)) {
45456 - fscache_stat(&fscache_n_object_no_alloc);
45457 + fscache_stat_unchecked(&fscache_n_object_no_alloc);
45458 ret = PTR_ERR(object);
45459 goto error;
45460 }
45461
45462 - fscache_stat(&fscache_n_object_alloc);
45463 + fscache_stat_unchecked(&fscache_n_object_alloc);
45464
45465 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
45466
45467 @@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fsca
45468 struct fscache_object *object;
45469 struct hlist_node *_p;
45470
45471 - fscache_stat(&fscache_n_updates);
45472 + fscache_stat_unchecked(&fscache_n_updates);
45473
45474 if (!cookie) {
45475 - fscache_stat(&fscache_n_updates_null);
45476 + fscache_stat_unchecked(&fscache_n_updates_null);
45477 _leave(" [no cookie]");
45478 return;
45479 }
45480 @@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct
45481 struct fscache_object *object;
45482 unsigned long event;
45483
45484 - fscache_stat(&fscache_n_relinquishes);
45485 + fscache_stat_unchecked(&fscache_n_relinquishes);
45486 if (retire)
45487 - fscache_stat(&fscache_n_relinquishes_retire);
45488 + fscache_stat_unchecked(&fscache_n_relinquishes_retire);
45489
45490 if (!cookie) {
45491 - fscache_stat(&fscache_n_relinquishes_null);
45492 + fscache_stat_unchecked(&fscache_n_relinquishes_null);
45493 _leave(" [no cookie]");
45494 return;
45495 }
45496 @@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct
45497
45498 /* wait for the cookie to finish being instantiated (or to fail) */
45499 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
45500 - fscache_stat(&fscache_n_relinquishes_waitcrt);
45501 + fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
45502 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
45503 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
45504 }
45505 diff -urNp linux-2.6.32.46/fs/fscache/internal.h linux-2.6.32.46/fs/fscache/internal.h
45506 --- linux-2.6.32.46/fs/fscache/internal.h 2011-03-27 14:31:47.000000000 -0400
45507 +++ linux-2.6.32.46/fs/fscache/internal.h 2011-05-04 17:56:28.000000000 -0400
45508 @@ -136,94 +136,94 @@ extern void fscache_proc_cleanup(void);
45509 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
45510 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
45511
45512 -extern atomic_t fscache_n_op_pend;
45513 -extern atomic_t fscache_n_op_run;
45514 -extern atomic_t fscache_n_op_enqueue;
45515 -extern atomic_t fscache_n_op_deferred_release;
45516 -extern atomic_t fscache_n_op_release;
45517 -extern atomic_t fscache_n_op_gc;
45518 -extern atomic_t fscache_n_op_cancelled;
45519 -extern atomic_t fscache_n_op_rejected;
45520 -
45521 -extern atomic_t fscache_n_attr_changed;
45522 -extern atomic_t fscache_n_attr_changed_ok;
45523 -extern atomic_t fscache_n_attr_changed_nobufs;
45524 -extern atomic_t fscache_n_attr_changed_nomem;
45525 -extern atomic_t fscache_n_attr_changed_calls;
45526 -
45527 -extern atomic_t fscache_n_allocs;
45528 -extern atomic_t fscache_n_allocs_ok;
45529 -extern atomic_t fscache_n_allocs_wait;
45530 -extern atomic_t fscache_n_allocs_nobufs;
45531 -extern atomic_t fscache_n_allocs_intr;
45532 -extern atomic_t fscache_n_allocs_object_dead;
45533 -extern atomic_t fscache_n_alloc_ops;
45534 -extern atomic_t fscache_n_alloc_op_waits;
45535 -
45536 -extern atomic_t fscache_n_retrievals;
45537 -extern atomic_t fscache_n_retrievals_ok;
45538 -extern atomic_t fscache_n_retrievals_wait;
45539 -extern atomic_t fscache_n_retrievals_nodata;
45540 -extern atomic_t fscache_n_retrievals_nobufs;
45541 -extern atomic_t fscache_n_retrievals_intr;
45542 -extern atomic_t fscache_n_retrievals_nomem;
45543 -extern atomic_t fscache_n_retrievals_object_dead;
45544 -extern atomic_t fscache_n_retrieval_ops;
45545 -extern atomic_t fscache_n_retrieval_op_waits;
45546 -
45547 -extern atomic_t fscache_n_stores;
45548 -extern atomic_t fscache_n_stores_ok;
45549 -extern atomic_t fscache_n_stores_again;
45550 -extern atomic_t fscache_n_stores_nobufs;
45551 -extern atomic_t fscache_n_stores_oom;
45552 -extern atomic_t fscache_n_store_ops;
45553 -extern atomic_t fscache_n_store_calls;
45554 -extern atomic_t fscache_n_store_pages;
45555 -extern atomic_t fscache_n_store_radix_deletes;
45556 -extern atomic_t fscache_n_store_pages_over_limit;
45557 -
45558 -extern atomic_t fscache_n_store_vmscan_not_storing;
45559 -extern atomic_t fscache_n_store_vmscan_gone;
45560 -extern atomic_t fscache_n_store_vmscan_busy;
45561 -extern atomic_t fscache_n_store_vmscan_cancelled;
45562 -
45563 -extern atomic_t fscache_n_marks;
45564 -extern atomic_t fscache_n_uncaches;
45565 -
45566 -extern atomic_t fscache_n_acquires;
45567 -extern atomic_t fscache_n_acquires_null;
45568 -extern atomic_t fscache_n_acquires_no_cache;
45569 -extern atomic_t fscache_n_acquires_ok;
45570 -extern atomic_t fscache_n_acquires_nobufs;
45571 -extern atomic_t fscache_n_acquires_oom;
45572 -
45573 -extern atomic_t fscache_n_updates;
45574 -extern atomic_t fscache_n_updates_null;
45575 -extern atomic_t fscache_n_updates_run;
45576 -
45577 -extern atomic_t fscache_n_relinquishes;
45578 -extern atomic_t fscache_n_relinquishes_null;
45579 -extern atomic_t fscache_n_relinquishes_waitcrt;
45580 -extern atomic_t fscache_n_relinquishes_retire;
45581 -
45582 -extern atomic_t fscache_n_cookie_index;
45583 -extern atomic_t fscache_n_cookie_data;
45584 -extern atomic_t fscache_n_cookie_special;
45585 -
45586 -extern atomic_t fscache_n_object_alloc;
45587 -extern atomic_t fscache_n_object_no_alloc;
45588 -extern atomic_t fscache_n_object_lookups;
45589 -extern atomic_t fscache_n_object_lookups_negative;
45590 -extern atomic_t fscache_n_object_lookups_positive;
45591 -extern atomic_t fscache_n_object_lookups_timed_out;
45592 -extern atomic_t fscache_n_object_created;
45593 -extern atomic_t fscache_n_object_avail;
45594 -extern atomic_t fscache_n_object_dead;
45595 -
45596 -extern atomic_t fscache_n_checkaux_none;
45597 -extern atomic_t fscache_n_checkaux_okay;
45598 -extern atomic_t fscache_n_checkaux_update;
45599 -extern atomic_t fscache_n_checkaux_obsolete;
45600 +extern atomic_unchecked_t fscache_n_op_pend;
45601 +extern atomic_unchecked_t fscache_n_op_run;
45602 +extern atomic_unchecked_t fscache_n_op_enqueue;
45603 +extern atomic_unchecked_t fscache_n_op_deferred_release;
45604 +extern atomic_unchecked_t fscache_n_op_release;
45605 +extern atomic_unchecked_t fscache_n_op_gc;
45606 +extern atomic_unchecked_t fscache_n_op_cancelled;
45607 +extern atomic_unchecked_t fscache_n_op_rejected;
45608 +
45609 +extern atomic_unchecked_t fscache_n_attr_changed;
45610 +extern atomic_unchecked_t fscache_n_attr_changed_ok;
45611 +extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
45612 +extern atomic_unchecked_t fscache_n_attr_changed_nomem;
45613 +extern atomic_unchecked_t fscache_n_attr_changed_calls;
45614 +
45615 +extern atomic_unchecked_t fscache_n_allocs;
45616 +extern atomic_unchecked_t fscache_n_allocs_ok;
45617 +extern atomic_unchecked_t fscache_n_allocs_wait;
45618 +extern atomic_unchecked_t fscache_n_allocs_nobufs;
45619 +extern atomic_unchecked_t fscache_n_allocs_intr;
45620 +extern atomic_unchecked_t fscache_n_allocs_object_dead;
45621 +extern atomic_unchecked_t fscache_n_alloc_ops;
45622 +extern atomic_unchecked_t fscache_n_alloc_op_waits;
45623 +
45624 +extern atomic_unchecked_t fscache_n_retrievals;
45625 +extern atomic_unchecked_t fscache_n_retrievals_ok;
45626 +extern atomic_unchecked_t fscache_n_retrievals_wait;
45627 +extern atomic_unchecked_t fscache_n_retrievals_nodata;
45628 +extern atomic_unchecked_t fscache_n_retrievals_nobufs;
45629 +extern atomic_unchecked_t fscache_n_retrievals_intr;
45630 +extern atomic_unchecked_t fscache_n_retrievals_nomem;
45631 +extern atomic_unchecked_t fscache_n_retrievals_object_dead;
45632 +extern atomic_unchecked_t fscache_n_retrieval_ops;
45633 +extern atomic_unchecked_t fscache_n_retrieval_op_waits;
45634 +
45635 +extern atomic_unchecked_t fscache_n_stores;
45636 +extern atomic_unchecked_t fscache_n_stores_ok;
45637 +extern atomic_unchecked_t fscache_n_stores_again;
45638 +extern atomic_unchecked_t fscache_n_stores_nobufs;
45639 +extern atomic_unchecked_t fscache_n_stores_oom;
45640 +extern atomic_unchecked_t fscache_n_store_ops;
45641 +extern atomic_unchecked_t fscache_n_store_calls;
45642 +extern atomic_unchecked_t fscache_n_store_pages;
45643 +extern atomic_unchecked_t fscache_n_store_radix_deletes;
45644 +extern atomic_unchecked_t fscache_n_store_pages_over_limit;
45645 +
45646 +extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
45647 +extern atomic_unchecked_t fscache_n_store_vmscan_gone;
45648 +extern atomic_unchecked_t fscache_n_store_vmscan_busy;
45649 +extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
45650 +
45651 +extern atomic_unchecked_t fscache_n_marks;
45652 +extern atomic_unchecked_t fscache_n_uncaches;
45653 +
45654 +extern atomic_unchecked_t fscache_n_acquires;
45655 +extern atomic_unchecked_t fscache_n_acquires_null;
45656 +extern atomic_unchecked_t fscache_n_acquires_no_cache;
45657 +extern atomic_unchecked_t fscache_n_acquires_ok;
45658 +extern atomic_unchecked_t fscache_n_acquires_nobufs;
45659 +extern atomic_unchecked_t fscache_n_acquires_oom;
45660 +
45661 +extern atomic_unchecked_t fscache_n_updates;
45662 +extern atomic_unchecked_t fscache_n_updates_null;
45663 +extern atomic_unchecked_t fscache_n_updates_run;
45664 +
45665 +extern atomic_unchecked_t fscache_n_relinquishes;
45666 +extern atomic_unchecked_t fscache_n_relinquishes_null;
45667 +extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
45668 +extern atomic_unchecked_t fscache_n_relinquishes_retire;
45669 +
45670 +extern atomic_unchecked_t fscache_n_cookie_index;
45671 +extern atomic_unchecked_t fscache_n_cookie_data;
45672 +extern atomic_unchecked_t fscache_n_cookie_special;
45673 +
45674 +extern atomic_unchecked_t fscache_n_object_alloc;
45675 +extern atomic_unchecked_t fscache_n_object_no_alloc;
45676 +extern atomic_unchecked_t fscache_n_object_lookups;
45677 +extern atomic_unchecked_t fscache_n_object_lookups_negative;
45678 +extern atomic_unchecked_t fscache_n_object_lookups_positive;
45679 +extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
45680 +extern atomic_unchecked_t fscache_n_object_created;
45681 +extern atomic_unchecked_t fscache_n_object_avail;
45682 +extern atomic_unchecked_t fscache_n_object_dead;
45683 +
45684 +extern atomic_unchecked_t fscache_n_checkaux_none;
45685 +extern atomic_unchecked_t fscache_n_checkaux_okay;
45686 +extern atomic_unchecked_t fscache_n_checkaux_update;
45687 +extern atomic_unchecked_t fscache_n_checkaux_obsolete;
45688
45689 extern atomic_t fscache_n_cop_alloc_object;
45690 extern atomic_t fscache_n_cop_lookup_object;
45691 @@ -247,6 +247,11 @@ static inline void fscache_stat(atomic_t
45692 atomic_inc(stat);
45693 }
45694
45695 +static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
45696 +{
45697 + atomic_inc_unchecked(stat);
45698 +}
45699 +
45700 static inline void fscache_stat_d(atomic_t *stat)
45701 {
45702 atomic_dec(stat);
45703 @@ -259,6 +264,7 @@ extern const struct file_operations fsca
45704
45705 #define __fscache_stat(stat) (NULL)
45706 #define fscache_stat(stat) do {} while (0)
45707 +#define fscache_stat_unchecked(stat) do {} while (0)
45708 #define fscache_stat_d(stat) do {} while (0)
45709 #endif
45710
45711 diff -urNp linux-2.6.32.46/fs/fscache/object.c linux-2.6.32.46/fs/fscache/object.c
45712 --- linux-2.6.32.46/fs/fscache/object.c 2011-03-27 14:31:47.000000000 -0400
45713 +++ linux-2.6.32.46/fs/fscache/object.c 2011-05-04 17:56:28.000000000 -0400
45714 @@ -144,7 +144,7 @@ static void fscache_object_state_machine
45715 /* update the object metadata on disk */
45716 case FSCACHE_OBJECT_UPDATING:
45717 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
45718 - fscache_stat(&fscache_n_updates_run);
45719 + fscache_stat_unchecked(&fscache_n_updates_run);
45720 fscache_stat(&fscache_n_cop_update_object);
45721 object->cache->ops->update_object(object);
45722 fscache_stat_d(&fscache_n_cop_update_object);
45723 @@ -233,7 +233,7 @@ static void fscache_object_state_machine
45724 spin_lock(&object->lock);
45725 object->state = FSCACHE_OBJECT_DEAD;
45726 spin_unlock(&object->lock);
45727 - fscache_stat(&fscache_n_object_dead);
45728 + fscache_stat_unchecked(&fscache_n_object_dead);
45729 goto terminal_transit;
45730
45731 /* handle the parent cache of this object being withdrawn from
45732 @@ -248,7 +248,7 @@ static void fscache_object_state_machine
45733 spin_lock(&object->lock);
45734 object->state = FSCACHE_OBJECT_DEAD;
45735 spin_unlock(&object->lock);
45736 - fscache_stat(&fscache_n_object_dead);
45737 + fscache_stat_unchecked(&fscache_n_object_dead);
45738 goto terminal_transit;
45739
45740 /* complain about the object being woken up once it is
45741 @@ -492,7 +492,7 @@ static void fscache_lookup_object(struct
45742 parent->cookie->def->name, cookie->def->name,
45743 object->cache->tag->name);
45744
45745 - fscache_stat(&fscache_n_object_lookups);
45746 + fscache_stat_unchecked(&fscache_n_object_lookups);
45747 fscache_stat(&fscache_n_cop_lookup_object);
45748 ret = object->cache->ops->lookup_object(object);
45749 fscache_stat_d(&fscache_n_cop_lookup_object);
45750 @@ -503,7 +503,7 @@ static void fscache_lookup_object(struct
45751 if (ret == -ETIMEDOUT) {
45752 /* probably stuck behind another object, so move this one to
45753 * the back of the queue */
45754 - fscache_stat(&fscache_n_object_lookups_timed_out);
45755 + fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
45756 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
45757 }
45758
45759 @@ -526,7 +526,7 @@ void fscache_object_lookup_negative(stru
45760
45761 spin_lock(&object->lock);
45762 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
45763 - fscache_stat(&fscache_n_object_lookups_negative);
45764 + fscache_stat_unchecked(&fscache_n_object_lookups_negative);
45765
45766 /* transit here to allow write requests to begin stacking up
45767 * and read requests to begin returning ENODATA */
45768 @@ -572,7 +572,7 @@ void fscache_obtained_object(struct fsca
45769 * result, in which case there may be data available */
45770 spin_lock(&object->lock);
45771 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
45772 - fscache_stat(&fscache_n_object_lookups_positive);
45773 + fscache_stat_unchecked(&fscache_n_object_lookups_positive);
45774
45775 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
45776
45777 @@ -586,7 +586,7 @@ void fscache_obtained_object(struct fsca
45778 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
45779 } else {
45780 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
45781 - fscache_stat(&fscache_n_object_created);
45782 + fscache_stat_unchecked(&fscache_n_object_created);
45783
45784 object->state = FSCACHE_OBJECT_AVAILABLE;
45785 spin_unlock(&object->lock);
45786 @@ -633,7 +633,7 @@ static void fscache_object_available(str
45787 fscache_enqueue_dependents(object);
45788
45789 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
45790 - fscache_stat(&fscache_n_object_avail);
45791 + fscache_stat_unchecked(&fscache_n_object_avail);
45792
45793 _leave("");
45794 }
45795 @@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(
45796 enum fscache_checkaux result;
45797
45798 if (!object->cookie->def->check_aux) {
45799 - fscache_stat(&fscache_n_checkaux_none);
45800 + fscache_stat_unchecked(&fscache_n_checkaux_none);
45801 return FSCACHE_CHECKAUX_OKAY;
45802 }
45803
45804 @@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(
45805 switch (result) {
45806 /* entry okay as is */
45807 case FSCACHE_CHECKAUX_OKAY:
45808 - fscache_stat(&fscache_n_checkaux_okay);
45809 + fscache_stat_unchecked(&fscache_n_checkaux_okay);
45810 break;
45811
45812 /* entry requires update */
45813 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
45814 - fscache_stat(&fscache_n_checkaux_update);
45815 + fscache_stat_unchecked(&fscache_n_checkaux_update);
45816 break;
45817
45818 /* entry requires deletion */
45819 case FSCACHE_CHECKAUX_OBSOLETE:
45820 - fscache_stat(&fscache_n_checkaux_obsolete);
45821 + fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
45822 break;
45823
45824 default:
45825 diff -urNp linux-2.6.32.46/fs/fscache/operation.c linux-2.6.32.46/fs/fscache/operation.c
45826 --- linux-2.6.32.46/fs/fscache/operation.c 2011-03-27 14:31:47.000000000 -0400
45827 +++ linux-2.6.32.46/fs/fscache/operation.c 2011-05-04 17:56:28.000000000 -0400
45828 @@ -16,7 +16,7 @@
45829 #include <linux/seq_file.h>
45830 #include "internal.h"
45831
45832 -atomic_t fscache_op_debug_id;
45833 +atomic_unchecked_t fscache_op_debug_id;
45834 EXPORT_SYMBOL(fscache_op_debug_id);
45835
45836 /**
45837 @@ -39,7 +39,7 @@ void fscache_enqueue_operation(struct fs
45838 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
45839 ASSERTCMP(atomic_read(&op->usage), >, 0);
45840
45841 - fscache_stat(&fscache_n_op_enqueue);
45842 + fscache_stat_unchecked(&fscache_n_op_enqueue);
45843 switch (op->flags & FSCACHE_OP_TYPE) {
45844 case FSCACHE_OP_FAST:
45845 _debug("queue fast");
45846 @@ -76,7 +76,7 @@ static void fscache_run_op(struct fscach
45847 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
45848 if (op->processor)
45849 fscache_enqueue_operation(op);
45850 - fscache_stat(&fscache_n_op_run);
45851 + fscache_stat_unchecked(&fscache_n_op_run);
45852 }
45853
45854 /*
45855 @@ -107,11 +107,11 @@ int fscache_submit_exclusive_op(struct f
45856 if (object->n_ops > 0) {
45857 atomic_inc(&op->usage);
45858 list_add_tail(&op->pend_link, &object->pending_ops);
45859 - fscache_stat(&fscache_n_op_pend);
45860 + fscache_stat_unchecked(&fscache_n_op_pend);
45861 } else if (!list_empty(&object->pending_ops)) {
45862 atomic_inc(&op->usage);
45863 list_add_tail(&op->pend_link, &object->pending_ops);
45864 - fscache_stat(&fscache_n_op_pend);
45865 + fscache_stat_unchecked(&fscache_n_op_pend);
45866 fscache_start_operations(object);
45867 } else {
45868 ASSERTCMP(object->n_in_progress, ==, 0);
45869 @@ -127,7 +127,7 @@ int fscache_submit_exclusive_op(struct f
45870 object->n_exclusive++; /* reads and writes must wait */
45871 atomic_inc(&op->usage);
45872 list_add_tail(&op->pend_link, &object->pending_ops);
45873 - fscache_stat(&fscache_n_op_pend);
45874 + fscache_stat_unchecked(&fscache_n_op_pend);
45875 ret = 0;
45876 } else {
45877 /* not allowed to submit ops in any other state */
45878 @@ -214,11 +214,11 @@ int fscache_submit_op(struct fscache_obj
45879 if (object->n_exclusive > 0) {
45880 atomic_inc(&op->usage);
45881 list_add_tail(&op->pend_link, &object->pending_ops);
45882 - fscache_stat(&fscache_n_op_pend);
45883 + fscache_stat_unchecked(&fscache_n_op_pend);
45884 } else if (!list_empty(&object->pending_ops)) {
45885 atomic_inc(&op->usage);
45886 list_add_tail(&op->pend_link, &object->pending_ops);
45887 - fscache_stat(&fscache_n_op_pend);
45888 + fscache_stat_unchecked(&fscache_n_op_pend);
45889 fscache_start_operations(object);
45890 } else {
45891 ASSERTCMP(object->n_exclusive, ==, 0);
45892 @@ -230,12 +230,12 @@ int fscache_submit_op(struct fscache_obj
45893 object->n_ops++;
45894 atomic_inc(&op->usage);
45895 list_add_tail(&op->pend_link, &object->pending_ops);
45896 - fscache_stat(&fscache_n_op_pend);
45897 + fscache_stat_unchecked(&fscache_n_op_pend);
45898 ret = 0;
45899 } else if (object->state == FSCACHE_OBJECT_DYING ||
45900 object->state == FSCACHE_OBJECT_LC_DYING ||
45901 object->state == FSCACHE_OBJECT_WITHDRAWING) {
45902 - fscache_stat(&fscache_n_op_rejected);
45903 + fscache_stat_unchecked(&fscache_n_op_rejected);
45904 ret = -ENOBUFS;
45905 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
45906 fscache_report_unexpected_submission(object, op, ostate);
45907 @@ -305,7 +305,7 @@ int fscache_cancel_op(struct fscache_ope
45908
45909 ret = -EBUSY;
45910 if (!list_empty(&op->pend_link)) {
45911 - fscache_stat(&fscache_n_op_cancelled);
45912 + fscache_stat_unchecked(&fscache_n_op_cancelled);
45913 list_del_init(&op->pend_link);
45914 object->n_ops--;
45915 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
45916 @@ -344,7 +344,7 @@ void fscache_put_operation(struct fscach
45917 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
45918 BUG();
45919
45920 - fscache_stat(&fscache_n_op_release);
45921 + fscache_stat_unchecked(&fscache_n_op_release);
45922
45923 if (op->release) {
45924 op->release(op);
45925 @@ -361,7 +361,7 @@ void fscache_put_operation(struct fscach
45926 * lock, and defer it otherwise */
45927 if (!spin_trylock(&object->lock)) {
45928 _debug("defer put");
45929 - fscache_stat(&fscache_n_op_deferred_release);
45930 + fscache_stat_unchecked(&fscache_n_op_deferred_release);
45931
45932 cache = object->cache;
45933 spin_lock(&cache->op_gc_list_lock);
45934 @@ -423,7 +423,7 @@ void fscache_operation_gc(struct work_st
45935
45936 _debug("GC DEFERRED REL OBJ%x OP%x",
45937 object->debug_id, op->debug_id);
45938 - fscache_stat(&fscache_n_op_gc);
45939 + fscache_stat_unchecked(&fscache_n_op_gc);
45940
45941 ASSERTCMP(atomic_read(&op->usage), ==, 0);
45942
45943 diff -urNp linux-2.6.32.46/fs/fscache/page.c linux-2.6.32.46/fs/fscache/page.c
45944 --- linux-2.6.32.46/fs/fscache/page.c 2011-03-27 14:31:47.000000000 -0400
45945 +++ linux-2.6.32.46/fs/fscache/page.c 2011-05-04 17:56:28.000000000 -0400
45946 @@ -59,7 +59,7 @@ bool __fscache_maybe_release_page(struct
45947 val = radix_tree_lookup(&cookie->stores, page->index);
45948 if (!val) {
45949 rcu_read_unlock();
45950 - fscache_stat(&fscache_n_store_vmscan_not_storing);
45951 + fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
45952 __fscache_uncache_page(cookie, page);
45953 return true;
45954 }
45955 @@ -89,11 +89,11 @@ bool __fscache_maybe_release_page(struct
45956 spin_unlock(&cookie->stores_lock);
45957
45958 if (xpage) {
45959 - fscache_stat(&fscache_n_store_vmscan_cancelled);
45960 - fscache_stat(&fscache_n_store_radix_deletes);
45961 + fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
45962 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
45963 ASSERTCMP(xpage, ==, page);
45964 } else {
45965 - fscache_stat(&fscache_n_store_vmscan_gone);
45966 + fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
45967 }
45968
45969 wake_up_bit(&cookie->flags, 0);
45970 @@ -106,7 +106,7 @@ page_busy:
45971 /* we might want to wait here, but that could deadlock the allocator as
45972 * the slow-work threads writing to the cache may all end up sleeping
45973 * on memory allocation */
45974 - fscache_stat(&fscache_n_store_vmscan_busy);
45975 + fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
45976 return false;
45977 }
45978 EXPORT_SYMBOL(__fscache_maybe_release_page);
45979 @@ -130,7 +130,7 @@ static void fscache_end_page_write(struc
45980 FSCACHE_COOKIE_STORING_TAG);
45981 if (!radix_tree_tag_get(&cookie->stores, page->index,
45982 FSCACHE_COOKIE_PENDING_TAG)) {
45983 - fscache_stat(&fscache_n_store_radix_deletes);
45984 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
45985 xpage = radix_tree_delete(&cookie->stores, page->index);
45986 }
45987 spin_unlock(&cookie->stores_lock);
45988 @@ -151,7 +151,7 @@ static void fscache_attr_changed_op(stru
45989
45990 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
45991
45992 - fscache_stat(&fscache_n_attr_changed_calls);
45993 + fscache_stat_unchecked(&fscache_n_attr_changed_calls);
45994
45995 if (fscache_object_is_active(object)) {
45996 fscache_set_op_state(op, "CallFS");
45997 @@ -178,11 +178,11 @@ int __fscache_attr_changed(struct fscach
45998
45999 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
46000
46001 - fscache_stat(&fscache_n_attr_changed);
46002 + fscache_stat_unchecked(&fscache_n_attr_changed);
46003
46004 op = kzalloc(sizeof(*op), GFP_KERNEL);
46005 if (!op) {
46006 - fscache_stat(&fscache_n_attr_changed_nomem);
46007 + fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
46008 _leave(" = -ENOMEM");
46009 return -ENOMEM;
46010 }
46011 @@ -202,7 +202,7 @@ int __fscache_attr_changed(struct fscach
46012 if (fscache_submit_exclusive_op(object, op) < 0)
46013 goto nobufs;
46014 spin_unlock(&cookie->lock);
46015 - fscache_stat(&fscache_n_attr_changed_ok);
46016 + fscache_stat_unchecked(&fscache_n_attr_changed_ok);
46017 fscache_put_operation(op);
46018 _leave(" = 0");
46019 return 0;
46020 @@ -210,7 +210,7 @@ int __fscache_attr_changed(struct fscach
46021 nobufs:
46022 spin_unlock(&cookie->lock);
46023 kfree(op);
46024 - fscache_stat(&fscache_n_attr_changed_nobufs);
46025 + fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
46026 _leave(" = %d", -ENOBUFS);
46027 return -ENOBUFS;
46028 }
46029 @@ -264,7 +264,7 @@ static struct fscache_retrieval *fscache
46030 /* allocate a retrieval operation and attempt to submit it */
46031 op = kzalloc(sizeof(*op), GFP_NOIO);
46032 if (!op) {
46033 - fscache_stat(&fscache_n_retrievals_nomem);
46034 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46035 return NULL;
46036 }
46037
46038 @@ -294,13 +294,13 @@ static int fscache_wait_for_deferred_loo
46039 return 0;
46040 }
46041
46042 - fscache_stat(&fscache_n_retrievals_wait);
46043 + fscache_stat_unchecked(&fscache_n_retrievals_wait);
46044
46045 jif = jiffies;
46046 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
46047 fscache_wait_bit_interruptible,
46048 TASK_INTERRUPTIBLE) != 0) {
46049 - fscache_stat(&fscache_n_retrievals_intr);
46050 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
46051 _leave(" = -ERESTARTSYS");
46052 return -ERESTARTSYS;
46053 }
46054 @@ -318,8 +318,8 @@ static int fscache_wait_for_deferred_loo
46055 */
46056 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
46057 struct fscache_retrieval *op,
46058 - atomic_t *stat_op_waits,
46059 - atomic_t *stat_object_dead)
46060 + atomic_unchecked_t *stat_op_waits,
46061 + atomic_unchecked_t *stat_object_dead)
46062 {
46063 int ret;
46064
46065 @@ -327,7 +327,7 @@ static int fscache_wait_for_retrieval_ac
46066 goto check_if_dead;
46067
46068 _debug(">>> WT");
46069 - fscache_stat(stat_op_waits);
46070 + fscache_stat_unchecked(stat_op_waits);
46071 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
46072 fscache_wait_bit_interruptible,
46073 TASK_INTERRUPTIBLE) < 0) {
46074 @@ -344,7 +344,7 @@ static int fscache_wait_for_retrieval_ac
46075
46076 check_if_dead:
46077 if (unlikely(fscache_object_is_dead(object))) {
46078 - fscache_stat(stat_object_dead);
46079 + fscache_stat_unchecked(stat_object_dead);
46080 return -ENOBUFS;
46081 }
46082 return 0;
46083 @@ -371,7 +371,7 @@ int __fscache_read_or_alloc_page(struct
46084
46085 _enter("%p,%p,,,", cookie, page);
46086
46087 - fscache_stat(&fscache_n_retrievals);
46088 + fscache_stat_unchecked(&fscache_n_retrievals);
46089
46090 if (hlist_empty(&cookie->backing_objects))
46091 goto nobufs;
46092 @@ -405,7 +405,7 @@ int __fscache_read_or_alloc_page(struct
46093 goto nobufs_unlock;
46094 spin_unlock(&cookie->lock);
46095
46096 - fscache_stat(&fscache_n_retrieval_ops);
46097 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
46098
46099 /* pin the netfs read context in case we need to do the actual netfs
46100 * read because we've encountered a cache read failure */
46101 @@ -435,15 +435,15 @@ int __fscache_read_or_alloc_page(struct
46102
46103 error:
46104 if (ret == -ENOMEM)
46105 - fscache_stat(&fscache_n_retrievals_nomem);
46106 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46107 else if (ret == -ERESTARTSYS)
46108 - fscache_stat(&fscache_n_retrievals_intr);
46109 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
46110 else if (ret == -ENODATA)
46111 - fscache_stat(&fscache_n_retrievals_nodata);
46112 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
46113 else if (ret < 0)
46114 - fscache_stat(&fscache_n_retrievals_nobufs);
46115 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46116 else
46117 - fscache_stat(&fscache_n_retrievals_ok);
46118 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
46119
46120 fscache_put_retrieval(op);
46121 _leave(" = %d", ret);
46122 @@ -453,7 +453,7 @@ nobufs_unlock:
46123 spin_unlock(&cookie->lock);
46124 kfree(op);
46125 nobufs:
46126 - fscache_stat(&fscache_n_retrievals_nobufs);
46127 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46128 _leave(" = -ENOBUFS");
46129 return -ENOBUFS;
46130 }
46131 @@ -491,7 +491,7 @@ int __fscache_read_or_alloc_pages(struct
46132
46133 _enter("%p,,%d,,,", cookie, *nr_pages);
46134
46135 - fscache_stat(&fscache_n_retrievals);
46136 + fscache_stat_unchecked(&fscache_n_retrievals);
46137
46138 if (hlist_empty(&cookie->backing_objects))
46139 goto nobufs;
46140 @@ -522,7 +522,7 @@ int __fscache_read_or_alloc_pages(struct
46141 goto nobufs_unlock;
46142 spin_unlock(&cookie->lock);
46143
46144 - fscache_stat(&fscache_n_retrieval_ops);
46145 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
46146
46147 /* pin the netfs read context in case we need to do the actual netfs
46148 * read because we've encountered a cache read failure */
46149 @@ -552,15 +552,15 @@ int __fscache_read_or_alloc_pages(struct
46150
46151 error:
46152 if (ret == -ENOMEM)
46153 - fscache_stat(&fscache_n_retrievals_nomem);
46154 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46155 else if (ret == -ERESTARTSYS)
46156 - fscache_stat(&fscache_n_retrievals_intr);
46157 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
46158 else if (ret == -ENODATA)
46159 - fscache_stat(&fscache_n_retrievals_nodata);
46160 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
46161 else if (ret < 0)
46162 - fscache_stat(&fscache_n_retrievals_nobufs);
46163 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46164 else
46165 - fscache_stat(&fscache_n_retrievals_ok);
46166 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
46167
46168 fscache_put_retrieval(op);
46169 _leave(" = %d", ret);
46170 @@ -570,7 +570,7 @@ nobufs_unlock:
46171 spin_unlock(&cookie->lock);
46172 kfree(op);
46173 nobufs:
46174 - fscache_stat(&fscache_n_retrievals_nobufs);
46175 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46176 _leave(" = -ENOBUFS");
46177 return -ENOBUFS;
46178 }
46179 @@ -594,7 +594,7 @@ int __fscache_alloc_page(struct fscache_
46180
46181 _enter("%p,%p,,,", cookie, page);
46182
46183 - fscache_stat(&fscache_n_allocs);
46184 + fscache_stat_unchecked(&fscache_n_allocs);
46185
46186 if (hlist_empty(&cookie->backing_objects))
46187 goto nobufs;
46188 @@ -621,7 +621,7 @@ int __fscache_alloc_page(struct fscache_
46189 goto nobufs_unlock;
46190 spin_unlock(&cookie->lock);
46191
46192 - fscache_stat(&fscache_n_alloc_ops);
46193 + fscache_stat_unchecked(&fscache_n_alloc_ops);
46194
46195 ret = fscache_wait_for_retrieval_activation(
46196 object, op,
46197 @@ -637,11 +637,11 @@ int __fscache_alloc_page(struct fscache_
46198
46199 error:
46200 if (ret == -ERESTARTSYS)
46201 - fscache_stat(&fscache_n_allocs_intr);
46202 + fscache_stat_unchecked(&fscache_n_allocs_intr);
46203 else if (ret < 0)
46204 - fscache_stat(&fscache_n_allocs_nobufs);
46205 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
46206 else
46207 - fscache_stat(&fscache_n_allocs_ok);
46208 + fscache_stat_unchecked(&fscache_n_allocs_ok);
46209
46210 fscache_put_retrieval(op);
46211 _leave(" = %d", ret);
46212 @@ -651,7 +651,7 @@ nobufs_unlock:
46213 spin_unlock(&cookie->lock);
46214 kfree(op);
46215 nobufs:
46216 - fscache_stat(&fscache_n_allocs_nobufs);
46217 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
46218 _leave(" = -ENOBUFS");
46219 return -ENOBUFS;
46220 }
46221 @@ -694,7 +694,7 @@ static void fscache_write_op(struct fsca
46222
46223 spin_lock(&cookie->stores_lock);
46224
46225 - fscache_stat(&fscache_n_store_calls);
46226 + fscache_stat_unchecked(&fscache_n_store_calls);
46227
46228 /* find a page to store */
46229 page = NULL;
46230 @@ -705,7 +705,7 @@ static void fscache_write_op(struct fsca
46231 page = results[0];
46232 _debug("gang %d [%lx]", n, page->index);
46233 if (page->index > op->store_limit) {
46234 - fscache_stat(&fscache_n_store_pages_over_limit);
46235 + fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
46236 goto superseded;
46237 }
46238
46239 @@ -721,7 +721,7 @@ static void fscache_write_op(struct fsca
46240
46241 if (page) {
46242 fscache_set_op_state(&op->op, "Store");
46243 - fscache_stat(&fscache_n_store_pages);
46244 + fscache_stat_unchecked(&fscache_n_store_pages);
46245 fscache_stat(&fscache_n_cop_write_page);
46246 ret = object->cache->ops->write_page(op, page);
46247 fscache_stat_d(&fscache_n_cop_write_page);
46248 @@ -792,7 +792,7 @@ int __fscache_write_page(struct fscache_
46249 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
46250 ASSERT(PageFsCache(page));
46251
46252 - fscache_stat(&fscache_n_stores);
46253 + fscache_stat_unchecked(&fscache_n_stores);
46254
46255 op = kzalloc(sizeof(*op), GFP_NOIO);
46256 if (!op)
46257 @@ -844,7 +844,7 @@ int __fscache_write_page(struct fscache_
46258 spin_unlock(&cookie->stores_lock);
46259 spin_unlock(&object->lock);
46260
46261 - op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
46262 + op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
46263 op->store_limit = object->store_limit;
46264
46265 if (fscache_submit_op(object, &op->op) < 0)
46266 @@ -852,8 +852,8 @@ int __fscache_write_page(struct fscache_
46267
46268 spin_unlock(&cookie->lock);
46269 radix_tree_preload_end();
46270 - fscache_stat(&fscache_n_store_ops);
46271 - fscache_stat(&fscache_n_stores_ok);
46272 + fscache_stat_unchecked(&fscache_n_store_ops);
46273 + fscache_stat_unchecked(&fscache_n_stores_ok);
46274
46275 /* the slow work queue now carries its own ref on the object */
46276 fscache_put_operation(&op->op);
46277 @@ -861,14 +861,14 @@ int __fscache_write_page(struct fscache_
46278 return 0;
46279
46280 already_queued:
46281 - fscache_stat(&fscache_n_stores_again);
46282 + fscache_stat_unchecked(&fscache_n_stores_again);
46283 already_pending:
46284 spin_unlock(&cookie->stores_lock);
46285 spin_unlock(&object->lock);
46286 spin_unlock(&cookie->lock);
46287 radix_tree_preload_end();
46288 kfree(op);
46289 - fscache_stat(&fscache_n_stores_ok);
46290 + fscache_stat_unchecked(&fscache_n_stores_ok);
46291 _leave(" = 0");
46292 return 0;
46293
46294 @@ -886,14 +886,14 @@ nobufs:
46295 spin_unlock(&cookie->lock);
46296 radix_tree_preload_end();
46297 kfree(op);
46298 - fscache_stat(&fscache_n_stores_nobufs);
46299 + fscache_stat_unchecked(&fscache_n_stores_nobufs);
46300 _leave(" = -ENOBUFS");
46301 return -ENOBUFS;
46302
46303 nomem_free:
46304 kfree(op);
46305 nomem:
46306 - fscache_stat(&fscache_n_stores_oom);
46307 + fscache_stat_unchecked(&fscache_n_stores_oom);
46308 _leave(" = -ENOMEM");
46309 return -ENOMEM;
46310 }
46311 @@ -911,7 +911,7 @@ void __fscache_uncache_page(struct fscac
46312 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
46313 ASSERTCMP(page, !=, NULL);
46314
46315 - fscache_stat(&fscache_n_uncaches);
46316 + fscache_stat_unchecked(&fscache_n_uncaches);
46317
46318 /* cache withdrawal may beat us to it */
46319 if (!PageFsCache(page))
46320 @@ -964,7 +964,7 @@ void fscache_mark_pages_cached(struct fs
46321 unsigned long loop;
46322
46323 #ifdef CONFIG_FSCACHE_STATS
46324 - atomic_add(pagevec->nr, &fscache_n_marks);
46325 + atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
46326 #endif
46327
46328 for (loop = 0; loop < pagevec->nr; loop++) {
46329 diff -urNp linux-2.6.32.46/fs/fscache/stats.c linux-2.6.32.46/fs/fscache/stats.c
46330 --- linux-2.6.32.46/fs/fscache/stats.c 2011-03-27 14:31:47.000000000 -0400
46331 +++ linux-2.6.32.46/fs/fscache/stats.c 2011-05-04 17:56:28.000000000 -0400
46332 @@ -18,95 +18,95 @@
46333 /*
46334 * operation counters
46335 */
46336 -atomic_t fscache_n_op_pend;
46337 -atomic_t fscache_n_op_run;
46338 -atomic_t fscache_n_op_enqueue;
46339 -atomic_t fscache_n_op_requeue;
46340 -atomic_t fscache_n_op_deferred_release;
46341 -atomic_t fscache_n_op_release;
46342 -atomic_t fscache_n_op_gc;
46343 -atomic_t fscache_n_op_cancelled;
46344 -atomic_t fscache_n_op_rejected;
46345 -
46346 -atomic_t fscache_n_attr_changed;
46347 -atomic_t fscache_n_attr_changed_ok;
46348 -atomic_t fscache_n_attr_changed_nobufs;
46349 -atomic_t fscache_n_attr_changed_nomem;
46350 -atomic_t fscache_n_attr_changed_calls;
46351 -
46352 -atomic_t fscache_n_allocs;
46353 -atomic_t fscache_n_allocs_ok;
46354 -atomic_t fscache_n_allocs_wait;
46355 -atomic_t fscache_n_allocs_nobufs;
46356 -atomic_t fscache_n_allocs_intr;
46357 -atomic_t fscache_n_allocs_object_dead;
46358 -atomic_t fscache_n_alloc_ops;
46359 -atomic_t fscache_n_alloc_op_waits;
46360 -
46361 -atomic_t fscache_n_retrievals;
46362 -atomic_t fscache_n_retrievals_ok;
46363 -atomic_t fscache_n_retrievals_wait;
46364 -atomic_t fscache_n_retrievals_nodata;
46365 -atomic_t fscache_n_retrievals_nobufs;
46366 -atomic_t fscache_n_retrievals_intr;
46367 -atomic_t fscache_n_retrievals_nomem;
46368 -atomic_t fscache_n_retrievals_object_dead;
46369 -atomic_t fscache_n_retrieval_ops;
46370 -atomic_t fscache_n_retrieval_op_waits;
46371 -
46372 -atomic_t fscache_n_stores;
46373 -atomic_t fscache_n_stores_ok;
46374 -atomic_t fscache_n_stores_again;
46375 -atomic_t fscache_n_stores_nobufs;
46376 -atomic_t fscache_n_stores_oom;
46377 -atomic_t fscache_n_store_ops;
46378 -atomic_t fscache_n_store_calls;
46379 -atomic_t fscache_n_store_pages;
46380 -atomic_t fscache_n_store_radix_deletes;
46381 -atomic_t fscache_n_store_pages_over_limit;
46382 -
46383 -atomic_t fscache_n_store_vmscan_not_storing;
46384 -atomic_t fscache_n_store_vmscan_gone;
46385 -atomic_t fscache_n_store_vmscan_busy;
46386 -atomic_t fscache_n_store_vmscan_cancelled;
46387 -
46388 -atomic_t fscache_n_marks;
46389 -atomic_t fscache_n_uncaches;
46390 -
46391 -atomic_t fscache_n_acquires;
46392 -atomic_t fscache_n_acquires_null;
46393 -atomic_t fscache_n_acquires_no_cache;
46394 -atomic_t fscache_n_acquires_ok;
46395 -atomic_t fscache_n_acquires_nobufs;
46396 -atomic_t fscache_n_acquires_oom;
46397 -
46398 -atomic_t fscache_n_updates;
46399 -atomic_t fscache_n_updates_null;
46400 -atomic_t fscache_n_updates_run;
46401 -
46402 -atomic_t fscache_n_relinquishes;
46403 -atomic_t fscache_n_relinquishes_null;
46404 -atomic_t fscache_n_relinquishes_waitcrt;
46405 -atomic_t fscache_n_relinquishes_retire;
46406 -
46407 -atomic_t fscache_n_cookie_index;
46408 -atomic_t fscache_n_cookie_data;
46409 -atomic_t fscache_n_cookie_special;
46410 -
46411 -atomic_t fscache_n_object_alloc;
46412 -atomic_t fscache_n_object_no_alloc;
46413 -atomic_t fscache_n_object_lookups;
46414 -atomic_t fscache_n_object_lookups_negative;
46415 -atomic_t fscache_n_object_lookups_positive;
46416 -atomic_t fscache_n_object_lookups_timed_out;
46417 -atomic_t fscache_n_object_created;
46418 -atomic_t fscache_n_object_avail;
46419 -atomic_t fscache_n_object_dead;
46420 -
46421 -atomic_t fscache_n_checkaux_none;
46422 -atomic_t fscache_n_checkaux_okay;
46423 -atomic_t fscache_n_checkaux_update;
46424 -atomic_t fscache_n_checkaux_obsolete;
46425 +atomic_unchecked_t fscache_n_op_pend;
46426 +atomic_unchecked_t fscache_n_op_run;
46427 +atomic_unchecked_t fscache_n_op_enqueue;
46428 +atomic_unchecked_t fscache_n_op_requeue;
46429 +atomic_unchecked_t fscache_n_op_deferred_release;
46430 +atomic_unchecked_t fscache_n_op_release;
46431 +atomic_unchecked_t fscache_n_op_gc;
46432 +atomic_unchecked_t fscache_n_op_cancelled;
46433 +atomic_unchecked_t fscache_n_op_rejected;
46434 +
46435 +atomic_unchecked_t fscache_n_attr_changed;
46436 +atomic_unchecked_t fscache_n_attr_changed_ok;
46437 +atomic_unchecked_t fscache_n_attr_changed_nobufs;
46438 +atomic_unchecked_t fscache_n_attr_changed_nomem;
46439 +atomic_unchecked_t fscache_n_attr_changed_calls;
46440 +
46441 +atomic_unchecked_t fscache_n_allocs;
46442 +atomic_unchecked_t fscache_n_allocs_ok;
46443 +atomic_unchecked_t fscache_n_allocs_wait;
46444 +atomic_unchecked_t fscache_n_allocs_nobufs;
46445 +atomic_unchecked_t fscache_n_allocs_intr;
46446 +atomic_unchecked_t fscache_n_allocs_object_dead;
46447 +atomic_unchecked_t fscache_n_alloc_ops;
46448 +atomic_unchecked_t fscache_n_alloc_op_waits;
46449 +
46450 +atomic_unchecked_t fscache_n_retrievals;
46451 +atomic_unchecked_t fscache_n_retrievals_ok;
46452 +atomic_unchecked_t fscache_n_retrievals_wait;
46453 +atomic_unchecked_t fscache_n_retrievals_nodata;
46454 +atomic_unchecked_t fscache_n_retrievals_nobufs;
46455 +atomic_unchecked_t fscache_n_retrievals_intr;
46456 +atomic_unchecked_t fscache_n_retrievals_nomem;
46457 +atomic_unchecked_t fscache_n_retrievals_object_dead;
46458 +atomic_unchecked_t fscache_n_retrieval_ops;
46459 +atomic_unchecked_t fscache_n_retrieval_op_waits;
46460 +
46461 +atomic_unchecked_t fscache_n_stores;
46462 +atomic_unchecked_t fscache_n_stores_ok;
46463 +atomic_unchecked_t fscache_n_stores_again;
46464 +atomic_unchecked_t fscache_n_stores_nobufs;
46465 +atomic_unchecked_t fscache_n_stores_oom;
46466 +atomic_unchecked_t fscache_n_store_ops;
46467 +atomic_unchecked_t fscache_n_store_calls;
46468 +atomic_unchecked_t fscache_n_store_pages;
46469 +atomic_unchecked_t fscache_n_store_radix_deletes;
46470 +atomic_unchecked_t fscache_n_store_pages_over_limit;
46471 +
46472 +atomic_unchecked_t fscache_n_store_vmscan_not_storing;
46473 +atomic_unchecked_t fscache_n_store_vmscan_gone;
46474 +atomic_unchecked_t fscache_n_store_vmscan_busy;
46475 +atomic_unchecked_t fscache_n_store_vmscan_cancelled;
46476 +
46477 +atomic_unchecked_t fscache_n_marks;
46478 +atomic_unchecked_t fscache_n_uncaches;
46479 +
46480 +atomic_unchecked_t fscache_n_acquires;
46481 +atomic_unchecked_t fscache_n_acquires_null;
46482 +atomic_unchecked_t fscache_n_acquires_no_cache;
46483 +atomic_unchecked_t fscache_n_acquires_ok;
46484 +atomic_unchecked_t fscache_n_acquires_nobufs;
46485 +atomic_unchecked_t fscache_n_acquires_oom;
46486 +
46487 +atomic_unchecked_t fscache_n_updates;
46488 +atomic_unchecked_t fscache_n_updates_null;
46489 +atomic_unchecked_t fscache_n_updates_run;
46490 +
46491 +atomic_unchecked_t fscache_n_relinquishes;
46492 +atomic_unchecked_t fscache_n_relinquishes_null;
46493 +atomic_unchecked_t fscache_n_relinquishes_waitcrt;
46494 +atomic_unchecked_t fscache_n_relinquishes_retire;
46495 +
46496 +atomic_unchecked_t fscache_n_cookie_index;
46497 +atomic_unchecked_t fscache_n_cookie_data;
46498 +atomic_unchecked_t fscache_n_cookie_special;
46499 +
46500 +atomic_unchecked_t fscache_n_object_alloc;
46501 +atomic_unchecked_t fscache_n_object_no_alloc;
46502 +atomic_unchecked_t fscache_n_object_lookups;
46503 +atomic_unchecked_t fscache_n_object_lookups_negative;
46504 +atomic_unchecked_t fscache_n_object_lookups_positive;
46505 +atomic_unchecked_t fscache_n_object_lookups_timed_out;
46506 +atomic_unchecked_t fscache_n_object_created;
46507 +atomic_unchecked_t fscache_n_object_avail;
46508 +atomic_unchecked_t fscache_n_object_dead;
46509 +
46510 +atomic_unchecked_t fscache_n_checkaux_none;
46511 +atomic_unchecked_t fscache_n_checkaux_okay;
46512 +atomic_unchecked_t fscache_n_checkaux_update;
46513 +atomic_unchecked_t fscache_n_checkaux_obsolete;
46514
46515 atomic_t fscache_n_cop_alloc_object;
46516 atomic_t fscache_n_cop_lookup_object;
46517 @@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq
46518 seq_puts(m, "FS-Cache statistics\n");
46519
46520 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
46521 - atomic_read(&fscache_n_cookie_index),
46522 - atomic_read(&fscache_n_cookie_data),
46523 - atomic_read(&fscache_n_cookie_special));
46524 + atomic_read_unchecked(&fscache_n_cookie_index),
46525 + atomic_read_unchecked(&fscache_n_cookie_data),
46526 + atomic_read_unchecked(&fscache_n_cookie_special));
46527
46528 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
46529 - atomic_read(&fscache_n_object_alloc),
46530 - atomic_read(&fscache_n_object_no_alloc),
46531 - atomic_read(&fscache_n_object_avail),
46532 - atomic_read(&fscache_n_object_dead));
46533 + atomic_read_unchecked(&fscache_n_object_alloc),
46534 + atomic_read_unchecked(&fscache_n_object_no_alloc),
46535 + atomic_read_unchecked(&fscache_n_object_avail),
46536 + atomic_read_unchecked(&fscache_n_object_dead));
46537 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
46538 - atomic_read(&fscache_n_checkaux_none),
46539 - atomic_read(&fscache_n_checkaux_okay),
46540 - atomic_read(&fscache_n_checkaux_update),
46541 - atomic_read(&fscache_n_checkaux_obsolete));
46542 + atomic_read_unchecked(&fscache_n_checkaux_none),
46543 + atomic_read_unchecked(&fscache_n_checkaux_okay),
46544 + atomic_read_unchecked(&fscache_n_checkaux_update),
46545 + atomic_read_unchecked(&fscache_n_checkaux_obsolete));
46546
46547 seq_printf(m, "Pages : mrk=%u unc=%u\n",
46548 - atomic_read(&fscache_n_marks),
46549 - atomic_read(&fscache_n_uncaches));
46550 + atomic_read_unchecked(&fscache_n_marks),
46551 + atomic_read_unchecked(&fscache_n_uncaches));
46552
46553 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
46554 " oom=%u\n",
46555 - atomic_read(&fscache_n_acquires),
46556 - atomic_read(&fscache_n_acquires_null),
46557 - atomic_read(&fscache_n_acquires_no_cache),
46558 - atomic_read(&fscache_n_acquires_ok),
46559 - atomic_read(&fscache_n_acquires_nobufs),
46560 - atomic_read(&fscache_n_acquires_oom));
46561 + atomic_read_unchecked(&fscache_n_acquires),
46562 + atomic_read_unchecked(&fscache_n_acquires_null),
46563 + atomic_read_unchecked(&fscache_n_acquires_no_cache),
46564 + atomic_read_unchecked(&fscache_n_acquires_ok),
46565 + atomic_read_unchecked(&fscache_n_acquires_nobufs),
46566 + atomic_read_unchecked(&fscache_n_acquires_oom));
46567
46568 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
46569 - atomic_read(&fscache_n_object_lookups),
46570 - atomic_read(&fscache_n_object_lookups_negative),
46571 - atomic_read(&fscache_n_object_lookups_positive),
46572 - atomic_read(&fscache_n_object_lookups_timed_out),
46573 - atomic_read(&fscache_n_object_created));
46574 + atomic_read_unchecked(&fscache_n_object_lookups),
46575 + atomic_read_unchecked(&fscache_n_object_lookups_negative),
46576 + atomic_read_unchecked(&fscache_n_object_lookups_positive),
46577 + atomic_read_unchecked(&fscache_n_object_lookups_timed_out),
46578 + atomic_read_unchecked(&fscache_n_object_created));
46579
46580 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
46581 - atomic_read(&fscache_n_updates),
46582 - atomic_read(&fscache_n_updates_null),
46583 - atomic_read(&fscache_n_updates_run));
46584 + atomic_read_unchecked(&fscache_n_updates),
46585 + atomic_read_unchecked(&fscache_n_updates_null),
46586 + atomic_read_unchecked(&fscache_n_updates_run));
46587
46588 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
46589 - atomic_read(&fscache_n_relinquishes),
46590 - atomic_read(&fscache_n_relinquishes_null),
46591 - atomic_read(&fscache_n_relinquishes_waitcrt),
46592 - atomic_read(&fscache_n_relinquishes_retire));
46593 + atomic_read_unchecked(&fscache_n_relinquishes),
46594 + atomic_read_unchecked(&fscache_n_relinquishes_null),
46595 + atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
46596 + atomic_read_unchecked(&fscache_n_relinquishes_retire));
46597
46598 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
46599 - atomic_read(&fscache_n_attr_changed),
46600 - atomic_read(&fscache_n_attr_changed_ok),
46601 - atomic_read(&fscache_n_attr_changed_nobufs),
46602 - atomic_read(&fscache_n_attr_changed_nomem),
46603 - atomic_read(&fscache_n_attr_changed_calls));
46604 + atomic_read_unchecked(&fscache_n_attr_changed),
46605 + atomic_read_unchecked(&fscache_n_attr_changed_ok),
46606 + atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
46607 + atomic_read_unchecked(&fscache_n_attr_changed_nomem),
46608 + atomic_read_unchecked(&fscache_n_attr_changed_calls));
46609
46610 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
46611 - atomic_read(&fscache_n_allocs),
46612 - atomic_read(&fscache_n_allocs_ok),
46613 - atomic_read(&fscache_n_allocs_wait),
46614 - atomic_read(&fscache_n_allocs_nobufs),
46615 - atomic_read(&fscache_n_allocs_intr));
46616 + atomic_read_unchecked(&fscache_n_allocs),
46617 + atomic_read_unchecked(&fscache_n_allocs_ok),
46618 + atomic_read_unchecked(&fscache_n_allocs_wait),
46619 + atomic_read_unchecked(&fscache_n_allocs_nobufs),
46620 + atomic_read_unchecked(&fscache_n_allocs_intr));
46621 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
46622 - atomic_read(&fscache_n_alloc_ops),
46623 - atomic_read(&fscache_n_alloc_op_waits),
46624 - atomic_read(&fscache_n_allocs_object_dead));
46625 + atomic_read_unchecked(&fscache_n_alloc_ops),
46626 + atomic_read_unchecked(&fscache_n_alloc_op_waits),
46627 + atomic_read_unchecked(&fscache_n_allocs_object_dead));
46628
46629 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
46630 " int=%u oom=%u\n",
46631 - atomic_read(&fscache_n_retrievals),
46632 - atomic_read(&fscache_n_retrievals_ok),
46633 - atomic_read(&fscache_n_retrievals_wait),
46634 - atomic_read(&fscache_n_retrievals_nodata),
46635 - atomic_read(&fscache_n_retrievals_nobufs),
46636 - atomic_read(&fscache_n_retrievals_intr),
46637 - atomic_read(&fscache_n_retrievals_nomem));
46638 + atomic_read_unchecked(&fscache_n_retrievals),
46639 + atomic_read_unchecked(&fscache_n_retrievals_ok),
46640 + atomic_read_unchecked(&fscache_n_retrievals_wait),
46641 + atomic_read_unchecked(&fscache_n_retrievals_nodata),
46642 + atomic_read_unchecked(&fscache_n_retrievals_nobufs),
46643 + atomic_read_unchecked(&fscache_n_retrievals_intr),
46644 + atomic_read_unchecked(&fscache_n_retrievals_nomem));
46645 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
46646 - atomic_read(&fscache_n_retrieval_ops),
46647 - atomic_read(&fscache_n_retrieval_op_waits),
46648 - atomic_read(&fscache_n_retrievals_object_dead));
46649 + atomic_read_unchecked(&fscache_n_retrieval_ops),
46650 + atomic_read_unchecked(&fscache_n_retrieval_op_waits),
46651 + atomic_read_unchecked(&fscache_n_retrievals_object_dead));
46652
46653 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
46654 - atomic_read(&fscache_n_stores),
46655 - atomic_read(&fscache_n_stores_ok),
46656 - atomic_read(&fscache_n_stores_again),
46657 - atomic_read(&fscache_n_stores_nobufs),
46658 - atomic_read(&fscache_n_stores_oom));
46659 + atomic_read_unchecked(&fscache_n_stores),
46660 + atomic_read_unchecked(&fscache_n_stores_ok),
46661 + atomic_read_unchecked(&fscache_n_stores_again),
46662 + atomic_read_unchecked(&fscache_n_stores_nobufs),
46663 + atomic_read_unchecked(&fscache_n_stores_oom));
46664 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
46665 - atomic_read(&fscache_n_store_ops),
46666 - atomic_read(&fscache_n_store_calls),
46667 - atomic_read(&fscache_n_store_pages),
46668 - atomic_read(&fscache_n_store_radix_deletes),
46669 - atomic_read(&fscache_n_store_pages_over_limit));
46670 + atomic_read_unchecked(&fscache_n_store_ops),
46671 + atomic_read_unchecked(&fscache_n_store_calls),
46672 + atomic_read_unchecked(&fscache_n_store_pages),
46673 + atomic_read_unchecked(&fscache_n_store_radix_deletes),
46674 + atomic_read_unchecked(&fscache_n_store_pages_over_limit));
46675
46676 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
46677 - atomic_read(&fscache_n_store_vmscan_not_storing),
46678 - atomic_read(&fscache_n_store_vmscan_gone),
46679 - atomic_read(&fscache_n_store_vmscan_busy),
46680 - atomic_read(&fscache_n_store_vmscan_cancelled));
46681 + atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
46682 + atomic_read_unchecked(&fscache_n_store_vmscan_gone),
46683 + atomic_read_unchecked(&fscache_n_store_vmscan_busy),
46684 + atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
46685
46686 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
46687 - atomic_read(&fscache_n_op_pend),
46688 - atomic_read(&fscache_n_op_run),
46689 - atomic_read(&fscache_n_op_enqueue),
46690 - atomic_read(&fscache_n_op_cancelled),
46691 - atomic_read(&fscache_n_op_rejected));
46692 + atomic_read_unchecked(&fscache_n_op_pend),
46693 + atomic_read_unchecked(&fscache_n_op_run),
46694 + atomic_read_unchecked(&fscache_n_op_enqueue),
46695 + atomic_read_unchecked(&fscache_n_op_cancelled),
46696 + atomic_read_unchecked(&fscache_n_op_rejected));
46697 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
46698 - atomic_read(&fscache_n_op_deferred_release),
46699 - atomic_read(&fscache_n_op_release),
46700 - atomic_read(&fscache_n_op_gc));
46701 + atomic_read_unchecked(&fscache_n_op_deferred_release),
46702 + atomic_read_unchecked(&fscache_n_op_release),
46703 + atomic_read_unchecked(&fscache_n_op_gc));
46704
46705 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
46706 atomic_read(&fscache_n_cop_alloc_object),
46707 diff -urNp linux-2.6.32.46/fs/fs_struct.c linux-2.6.32.46/fs/fs_struct.c
46708 --- linux-2.6.32.46/fs/fs_struct.c 2011-03-27 14:31:47.000000000 -0400
46709 +++ linux-2.6.32.46/fs/fs_struct.c 2011-04-17 15:56:46.000000000 -0400
46710 @@ -4,6 +4,7 @@
46711 #include <linux/path.h>
46712 #include <linux/slab.h>
46713 #include <linux/fs_struct.h>
46714 +#include <linux/grsecurity.h>
46715
46716 /*
46717 * Replace the fs->{rootmnt,root} with {mnt,dentry}. Put the old values.
46718 @@ -17,6 +18,7 @@ void set_fs_root(struct fs_struct *fs, s
46719 old_root = fs->root;
46720 fs->root = *path;
46721 path_get(path);
46722 + gr_set_chroot_entries(current, path);
46723 write_unlock(&fs->lock);
46724 if (old_root.dentry)
46725 path_put(&old_root);
46726 @@ -56,6 +58,7 @@ void chroot_fs_refs(struct path *old_roo
46727 && fs->root.mnt == old_root->mnt) {
46728 path_get(new_root);
46729 fs->root = *new_root;
46730 + gr_set_chroot_entries(p, new_root);
46731 count++;
46732 }
46733 if (fs->pwd.dentry == old_root->dentry
46734 @@ -89,7 +92,8 @@ void exit_fs(struct task_struct *tsk)
46735 task_lock(tsk);
46736 write_lock(&fs->lock);
46737 tsk->fs = NULL;
46738 - kill = !--fs->users;
46739 + gr_clear_chroot_entries(tsk);
46740 + kill = !atomic_dec_return(&fs->users);
46741 write_unlock(&fs->lock);
46742 task_unlock(tsk);
46743 if (kill)
46744 @@ -102,7 +106,7 @@ struct fs_struct *copy_fs_struct(struct
46745 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
46746 /* We don't need to lock fs - think why ;-) */
46747 if (fs) {
46748 - fs->users = 1;
46749 + atomic_set(&fs->users, 1);
46750 fs->in_exec = 0;
46751 rwlock_init(&fs->lock);
46752 fs->umask = old->umask;
46753 @@ -127,8 +131,9 @@ int unshare_fs_struct(void)
46754
46755 task_lock(current);
46756 write_lock(&fs->lock);
46757 - kill = !--fs->users;
46758 + kill = !atomic_dec_return(&fs->users);
46759 current->fs = new_fs;
46760 + gr_set_chroot_entries(current, &new_fs->root);
46761 write_unlock(&fs->lock);
46762 task_unlock(current);
46763
46764 @@ -147,7 +152,7 @@ EXPORT_SYMBOL(current_umask);
46765
46766 /* to be mentioned only in INIT_TASK */
46767 struct fs_struct init_fs = {
46768 - .users = 1,
46769 + .users = ATOMIC_INIT(1),
46770 .lock = __RW_LOCK_UNLOCKED(init_fs.lock),
46771 .umask = 0022,
46772 };
46773 @@ -162,12 +167,13 @@ void daemonize_fs_struct(void)
46774 task_lock(current);
46775
46776 write_lock(&init_fs.lock);
46777 - init_fs.users++;
46778 + atomic_inc(&init_fs.users);
46779 write_unlock(&init_fs.lock);
46780
46781 write_lock(&fs->lock);
46782 current->fs = &init_fs;
46783 - kill = !--fs->users;
46784 + gr_set_chroot_entries(current, &current->fs->root);
46785 + kill = !atomic_dec_return(&fs->users);
46786 write_unlock(&fs->lock);
46787
46788 task_unlock(current);
46789 diff -urNp linux-2.6.32.46/fs/fuse/cuse.c linux-2.6.32.46/fs/fuse/cuse.c
46790 --- linux-2.6.32.46/fs/fuse/cuse.c 2011-03-27 14:31:47.000000000 -0400
46791 +++ linux-2.6.32.46/fs/fuse/cuse.c 2011-08-05 20:33:55.000000000 -0400
46792 @@ -576,10 +576,12 @@ static int __init cuse_init(void)
46793 INIT_LIST_HEAD(&cuse_conntbl[i]);
46794
46795 /* inherit and extend fuse_dev_operations */
46796 - cuse_channel_fops = fuse_dev_operations;
46797 - cuse_channel_fops.owner = THIS_MODULE;
46798 - cuse_channel_fops.open = cuse_channel_open;
46799 - cuse_channel_fops.release = cuse_channel_release;
46800 + pax_open_kernel();
46801 + memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
46802 + *(void **)&cuse_channel_fops.owner = THIS_MODULE;
46803 + *(void **)&cuse_channel_fops.open = cuse_channel_open;
46804 + *(void **)&cuse_channel_fops.release = cuse_channel_release;
46805 + pax_close_kernel();
46806
46807 cuse_class = class_create(THIS_MODULE, "cuse");
46808 if (IS_ERR(cuse_class))
46809 diff -urNp linux-2.6.32.46/fs/fuse/dev.c linux-2.6.32.46/fs/fuse/dev.c
46810 --- linux-2.6.32.46/fs/fuse/dev.c 2011-08-29 22:24:44.000000000 -0400
46811 +++ linux-2.6.32.46/fs/fuse/dev.c 2011-08-29 22:25:07.000000000 -0400
46812 @@ -885,7 +885,7 @@ static int fuse_notify_inval_entry(struc
46813 {
46814 struct fuse_notify_inval_entry_out outarg;
46815 int err = -EINVAL;
46816 - char buf[FUSE_NAME_MAX+1];
46817 + char *buf = NULL;
46818 struct qstr name;
46819
46820 if (size < sizeof(outarg))
46821 @@ -899,6 +899,11 @@ static int fuse_notify_inval_entry(struc
46822 if (outarg.namelen > FUSE_NAME_MAX)
46823 goto err;
46824
46825 + err = -ENOMEM;
46826 + buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
46827 + if (!buf)
46828 + goto err;
46829 +
46830 err = -EINVAL;
46831 if (size != sizeof(outarg) + outarg.namelen + 1)
46832 goto err;
46833 @@ -914,17 +919,15 @@ static int fuse_notify_inval_entry(struc
46834
46835 down_read(&fc->killsb);
46836 err = -ENOENT;
46837 - if (!fc->sb)
46838 - goto err_unlock;
46839 -
46840 - err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
46841 -
46842 -err_unlock:
46843 + if (fc->sb)
46844 + err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
46845 up_read(&fc->killsb);
46846 + kfree(buf);
46847 return err;
46848
46849 err:
46850 fuse_copy_finish(cs);
46851 + kfree(buf);
46852 return err;
46853 }
46854
46855 diff -urNp linux-2.6.32.46/fs/fuse/dir.c linux-2.6.32.46/fs/fuse/dir.c
46856 --- linux-2.6.32.46/fs/fuse/dir.c 2011-03-27 14:31:47.000000000 -0400
46857 +++ linux-2.6.32.46/fs/fuse/dir.c 2011-04-17 15:56:46.000000000 -0400
46858 @@ -1127,7 +1127,7 @@ static char *read_link(struct dentry *de
46859 return link;
46860 }
46861
46862 -static void free_link(char *link)
46863 +static void free_link(const char *link)
46864 {
46865 if (!IS_ERR(link))
46866 free_page((unsigned long) link);
46867 diff -urNp linux-2.6.32.46/fs/gfs2/ops_inode.c linux-2.6.32.46/fs/gfs2/ops_inode.c
46868 --- linux-2.6.32.46/fs/gfs2/ops_inode.c 2011-03-27 14:31:47.000000000 -0400
46869 +++ linux-2.6.32.46/fs/gfs2/ops_inode.c 2011-05-16 21:46:57.000000000 -0400
46870 @@ -752,6 +752,8 @@ static int gfs2_rename(struct inode *odi
46871 unsigned int x;
46872 int error;
46873
46874 + pax_track_stack();
46875 +
46876 if (ndentry->d_inode) {
46877 nip = GFS2_I(ndentry->d_inode);
46878 if (ip == nip)
46879 diff -urNp linux-2.6.32.46/fs/gfs2/sys.c linux-2.6.32.46/fs/gfs2/sys.c
46880 --- linux-2.6.32.46/fs/gfs2/sys.c 2011-03-27 14:31:47.000000000 -0400
46881 +++ linux-2.6.32.46/fs/gfs2/sys.c 2011-04-17 15:56:46.000000000 -0400
46882 @@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct ko
46883 return a->store ? a->store(sdp, buf, len) : len;
46884 }
46885
46886 -static struct sysfs_ops gfs2_attr_ops = {
46887 +static const struct sysfs_ops gfs2_attr_ops = {
46888 .show = gfs2_attr_show,
46889 .store = gfs2_attr_store,
46890 };
46891 @@ -584,7 +584,7 @@ static int gfs2_uevent(struct kset *kset
46892 return 0;
46893 }
46894
46895 -static struct kset_uevent_ops gfs2_uevent_ops = {
46896 +static const struct kset_uevent_ops gfs2_uevent_ops = {
46897 .uevent = gfs2_uevent,
46898 };
46899
46900 diff -urNp linux-2.6.32.46/fs/hfsplus/catalog.c linux-2.6.32.46/fs/hfsplus/catalog.c
46901 --- linux-2.6.32.46/fs/hfsplus/catalog.c 2011-03-27 14:31:47.000000000 -0400
46902 +++ linux-2.6.32.46/fs/hfsplus/catalog.c 2011-05-16 21:46:57.000000000 -0400
46903 @@ -157,6 +157,8 @@ int hfsplus_find_cat(struct super_block
46904 int err;
46905 u16 type;
46906
46907 + pax_track_stack();
46908 +
46909 hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
46910 err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
46911 if (err)
46912 @@ -186,6 +188,8 @@ int hfsplus_create_cat(u32 cnid, struct
46913 int entry_size;
46914 int err;
46915
46916 + pax_track_stack();
46917 +
46918 dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n", str->name, cnid, inode->i_nlink);
46919 sb = dir->i_sb;
46920 hfs_find_init(HFSPLUS_SB(sb).cat_tree, &fd);
46921 @@ -318,6 +322,8 @@ int hfsplus_rename_cat(u32 cnid,
46922 int entry_size, type;
46923 int err = 0;
46924
46925 + pax_track_stack();
46926 +
46927 dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n", cnid, src_dir->i_ino, src_name->name,
46928 dst_dir->i_ino, dst_name->name);
46929 sb = src_dir->i_sb;
46930 diff -urNp linux-2.6.32.46/fs/hfsplus/dir.c linux-2.6.32.46/fs/hfsplus/dir.c
46931 --- linux-2.6.32.46/fs/hfsplus/dir.c 2011-03-27 14:31:47.000000000 -0400
46932 +++ linux-2.6.32.46/fs/hfsplus/dir.c 2011-05-16 21:46:57.000000000 -0400
46933 @@ -121,6 +121,8 @@ static int hfsplus_readdir(struct file *
46934 struct hfsplus_readdir_data *rd;
46935 u16 type;
46936
46937 + pax_track_stack();
46938 +
46939 if (filp->f_pos >= inode->i_size)
46940 return 0;
46941
46942 diff -urNp linux-2.6.32.46/fs/hfsplus/inode.c linux-2.6.32.46/fs/hfsplus/inode.c
46943 --- linux-2.6.32.46/fs/hfsplus/inode.c 2011-03-27 14:31:47.000000000 -0400
46944 +++ linux-2.6.32.46/fs/hfsplus/inode.c 2011-05-16 21:46:57.000000000 -0400
46945 @@ -399,6 +399,8 @@ int hfsplus_cat_read_inode(struct inode
46946 int res = 0;
46947 u16 type;
46948
46949 + pax_track_stack();
46950 +
46951 type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
46952
46953 HFSPLUS_I(inode).dev = 0;
46954 @@ -461,6 +463,8 @@ int hfsplus_cat_write_inode(struct inode
46955 struct hfs_find_data fd;
46956 hfsplus_cat_entry entry;
46957
46958 + pax_track_stack();
46959 +
46960 if (HFSPLUS_IS_RSRC(inode))
46961 main_inode = HFSPLUS_I(inode).rsrc_inode;
46962
46963 diff -urNp linux-2.6.32.46/fs/hfsplus/ioctl.c linux-2.6.32.46/fs/hfsplus/ioctl.c
46964 --- linux-2.6.32.46/fs/hfsplus/ioctl.c 2011-03-27 14:31:47.000000000 -0400
46965 +++ linux-2.6.32.46/fs/hfsplus/ioctl.c 2011-05-16 21:46:57.000000000 -0400
46966 @@ -101,6 +101,8 @@ int hfsplus_setxattr(struct dentry *dent
46967 struct hfsplus_cat_file *file;
46968 int res;
46969
46970 + pax_track_stack();
46971 +
46972 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
46973 return -EOPNOTSUPP;
46974
46975 @@ -143,6 +145,8 @@ ssize_t hfsplus_getxattr(struct dentry *
46976 struct hfsplus_cat_file *file;
46977 ssize_t res = 0;
46978
46979 + pax_track_stack();
46980 +
46981 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
46982 return -EOPNOTSUPP;
46983
46984 diff -urNp linux-2.6.32.46/fs/hfsplus/super.c linux-2.6.32.46/fs/hfsplus/super.c
46985 --- linux-2.6.32.46/fs/hfsplus/super.c 2011-03-27 14:31:47.000000000 -0400
46986 +++ linux-2.6.32.46/fs/hfsplus/super.c 2011-05-16 21:46:57.000000000 -0400
46987 @@ -312,6 +312,8 @@ static int hfsplus_fill_super(struct sup
46988 struct nls_table *nls = NULL;
46989 int err = -EINVAL;
46990
46991 + pax_track_stack();
46992 +
46993 sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
46994 if (!sbi)
46995 return -ENOMEM;
46996 diff -urNp linux-2.6.32.46/fs/hugetlbfs/inode.c linux-2.6.32.46/fs/hugetlbfs/inode.c
46997 --- linux-2.6.32.46/fs/hugetlbfs/inode.c 2011-03-27 14:31:47.000000000 -0400
46998 +++ linux-2.6.32.46/fs/hugetlbfs/inode.c 2011-04-17 15:56:46.000000000 -0400
46999 @@ -909,7 +909,7 @@ static struct file_system_type hugetlbfs
47000 .kill_sb = kill_litter_super,
47001 };
47002
47003 -static struct vfsmount *hugetlbfs_vfsmount;
47004 +struct vfsmount *hugetlbfs_vfsmount;
47005
47006 static int can_do_hugetlb_shm(void)
47007 {
47008 diff -urNp linux-2.6.32.46/fs/ioctl.c linux-2.6.32.46/fs/ioctl.c
47009 --- linux-2.6.32.46/fs/ioctl.c 2011-03-27 14:31:47.000000000 -0400
47010 +++ linux-2.6.32.46/fs/ioctl.c 2011-04-17 15:56:46.000000000 -0400
47011 @@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiema
47012 u64 phys, u64 len, u32 flags)
47013 {
47014 struct fiemap_extent extent;
47015 - struct fiemap_extent *dest = fieinfo->fi_extents_start;
47016 + struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
47017
47018 /* only count the extents */
47019 if (fieinfo->fi_extents_max == 0) {
47020 @@ -207,7 +207,7 @@ static int ioctl_fiemap(struct file *fil
47021
47022 fieinfo.fi_flags = fiemap.fm_flags;
47023 fieinfo.fi_extents_max = fiemap.fm_extent_count;
47024 - fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
47025 + fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
47026
47027 if (fiemap.fm_extent_count != 0 &&
47028 !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
47029 @@ -220,7 +220,7 @@ static int ioctl_fiemap(struct file *fil
47030 error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
47031 fiemap.fm_flags = fieinfo.fi_flags;
47032 fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
47033 - if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
47034 + if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
47035 error = -EFAULT;
47036
47037 return error;
47038 diff -urNp linux-2.6.32.46/fs/jbd/checkpoint.c linux-2.6.32.46/fs/jbd/checkpoint.c
47039 --- linux-2.6.32.46/fs/jbd/checkpoint.c 2011-03-27 14:31:47.000000000 -0400
47040 +++ linux-2.6.32.46/fs/jbd/checkpoint.c 2011-05-16 21:46:57.000000000 -0400
47041 @@ -348,6 +348,8 @@ int log_do_checkpoint(journal_t *journal
47042 tid_t this_tid;
47043 int result;
47044
47045 + pax_track_stack();
47046 +
47047 jbd_debug(1, "Start checkpoint\n");
47048
47049 /*
47050 diff -urNp linux-2.6.32.46/fs/jffs2/compr_rtime.c linux-2.6.32.46/fs/jffs2/compr_rtime.c
47051 --- linux-2.6.32.46/fs/jffs2/compr_rtime.c 2011-03-27 14:31:47.000000000 -0400
47052 +++ linux-2.6.32.46/fs/jffs2/compr_rtime.c 2011-05-16 21:46:57.000000000 -0400
47053 @@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned
47054 int outpos = 0;
47055 int pos=0;
47056
47057 + pax_track_stack();
47058 +
47059 memset(positions,0,sizeof(positions));
47060
47061 while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
47062 @@ -79,6 +81,8 @@ static int jffs2_rtime_decompress(unsign
47063 int outpos = 0;
47064 int pos=0;
47065
47066 + pax_track_stack();
47067 +
47068 memset(positions,0,sizeof(positions));
47069
47070 while (outpos<destlen) {
47071 diff -urNp linux-2.6.32.46/fs/jffs2/compr_rubin.c linux-2.6.32.46/fs/jffs2/compr_rubin.c
47072 --- linux-2.6.32.46/fs/jffs2/compr_rubin.c 2011-03-27 14:31:47.000000000 -0400
47073 +++ linux-2.6.32.46/fs/jffs2/compr_rubin.c 2011-05-16 21:46:57.000000000 -0400
47074 @@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsig
47075 int ret;
47076 uint32_t mysrclen, mydstlen;
47077
47078 + pax_track_stack();
47079 +
47080 mysrclen = *sourcelen;
47081 mydstlen = *dstlen - 8;
47082
47083 diff -urNp linux-2.6.32.46/fs/jffs2/erase.c linux-2.6.32.46/fs/jffs2/erase.c
47084 --- linux-2.6.32.46/fs/jffs2/erase.c 2011-03-27 14:31:47.000000000 -0400
47085 +++ linux-2.6.32.46/fs/jffs2/erase.c 2011-04-17 15:56:46.000000000 -0400
47086 @@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(stru
47087 struct jffs2_unknown_node marker = {
47088 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
47089 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
47090 - .totlen = cpu_to_je32(c->cleanmarker_size)
47091 + .totlen = cpu_to_je32(c->cleanmarker_size),
47092 + .hdr_crc = cpu_to_je32(0)
47093 };
47094
47095 jffs2_prealloc_raw_node_refs(c, jeb, 1);
47096 diff -urNp linux-2.6.32.46/fs/jffs2/wbuf.c linux-2.6.32.46/fs/jffs2/wbuf.c
47097 --- linux-2.6.32.46/fs/jffs2/wbuf.c 2011-03-27 14:31:47.000000000 -0400
47098 +++ linux-2.6.32.46/fs/jffs2/wbuf.c 2011-04-17 15:56:46.000000000 -0400
47099 @@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
47100 {
47101 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
47102 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
47103 - .totlen = constant_cpu_to_je32(8)
47104 + .totlen = constant_cpu_to_je32(8),
47105 + .hdr_crc = constant_cpu_to_je32(0)
47106 };
47107
47108 /*
47109 diff -urNp linux-2.6.32.46/fs/jffs2/xattr.c linux-2.6.32.46/fs/jffs2/xattr.c
47110 --- linux-2.6.32.46/fs/jffs2/xattr.c 2011-03-27 14:31:47.000000000 -0400
47111 +++ linux-2.6.32.46/fs/jffs2/xattr.c 2011-05-16 21:46:57.000000000 -0400
47112 @@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct
47113
47114 BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
47115
47116 + pax_track_stack();
47117 +
47118 /* Phase.1 : Merge same xref */
47119 for (i=0; i < XREF_TMPHASH_SIZE; i++)
47120 xref_tmphash[i] = NULL;
47121 diff -urNp linux-2.6.32.46/fs/jfs/super.c linux-2.6.32.46/fs/jfs/super.c
47122 --- linux-2.6.32.46/fs/jfs/super.c 2011-03-27 14:31:47.000000000 -0400
47123 +++ linux-2.6.32.46/fs/jfs/super.c 2011-06-07 18:06:04.000000000 -0400
47124 @@ -793,7 +793,7 @@ static int __init init_jfs_fs(void)
47125
47126 jfs_inode_cachep =
47127 kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
47128 - SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
47129 + SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
47130 init_once);
47131 if (jfs_inode_cachep == NULL)
47132 return -ENOMEM;
47133 diff -urNp linux-2.6.32.46/fs/Kconfig.binfmt linux-2.6.32.46/fs/Kconfig.binfmt
47134 --- linux-2.6.32.46/fs/Kconfig.binfmt 2011-03-27 14:31:47.000000000 -0400
47135 +++ linux-2.6.32.46/fs/Kconfig.binfmt 2011-04-17 15:56:46.000000000 -0400
47136 @@ -86,7 +86,7 @@ config HAVE_AOUT
47137
47138 config BINFMT_AOUT
47139 tristate "Kernel support for a.out and ECOFF binaries"
47140 - depends on HAVE_AOUT
47141 + depends on HAVE_AOUT && BROKEN
47142 ---help---
47143 A.out (Assembler.OUTput) is a set of formats for libraries and
47144 executables used in the earliest versions of UNIX. Linux used
47145 diff -urNp linux-2.6.32.46/fs/libfs.c linux-2.6.32.46/fs/libfs.c
47146 --- linux-2.6.32.46/fs/libfs.c 2011-03-27 14:31:47.000000000 -0400
47147 +++ linux-2.6.32.46/fs/libfs.c 2011-05-11 18:25:15.000000000 -0400
47148 @@ -157,12 +157,20 @@ int dcache_readdir(struct file * filp, v
47149
47150 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
47151 struct dentry *next;
47152 + char d_name[sizeof(next->d_iname)];
47153 + const unsigned char *name;
47154 +
47155 next = list_entry(p, struct dentry, d_u.d_child);
47156 if (d_unhashed(next) || !next->d_inode)
47157 continue;
47158
47159 spin_unlock(&dcache_lock);
47160 - if (filldir(dirent, next->d_name.name,
47161 + name = next->d_name.name;
47162 + if (name == next->d_iname) {
47163 + memcpy(d_name, name, next->d_name.len);
47164 + name = d_name;
47165 + }
47166 + if (filldir(dirent, name,
47167 next->d_name.len, filp->f_pos,
47168 next->d_inode->i_ino,
47169 dt_type(next->d_inode)) < 0)
47170 diff -urNp linux-2.6.32.46/fs/lockd/clntproc.c linux-2.6.32.46/fs/lockd/clntproc.c
47171 --- linux-2.6.32.46/fs/lockd/clntproc.c 2011-03-27 14:31:47.000000000 -0400
47172 +++ linux-2.6.32.46/fs/lockd/clntproc.c 2011-05-16 21:46:57.000000000 -0400
47173 @@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt
47174 /*
47175 * Cookie counter for NLM requests
47176 */
47177 -static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
47178 +static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
47179
47180 void nlmclnt_next_cookie(struct nlm_cookie *c)
47181 {
47182 - u32 cookie = atomic_inc_return(&nlm_cookie);
47183 + u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
47184
47185 memcpy(c->data, &cookie, 4);
47186 c->len=4;
47187 @@ -621,6 +621,8 @@ nlmclnt_reclaim(struct nlm_host *host, s
47188 struct nlm_rqst reqst, *req;
47189 int status;
47190
47191 + pax_track_stack();
47192 +
47193 req = &reqst;
47194 memset(req, 0, sizeof(*req));
47195 locks_init_lock(&req->a_args.lock.fl);
47196 diff -urNp linux-2.6.32.46/fs/lockd/svc.c linux-2.6.32.46/fs/lockd/svc.c
47197 --- linux-2.6.32.46/fs/lockd/svc.c 2011-03-27 14:31:47.000000000 -0400
47198 +++ linux-2.6.32.46/fs/lockd/svc.c 2011-04-17 15:56:46.000000000 -0400
47199 @@ -43,7 +43,7 @@
47200
47201 static struct svc_program nlmsvc_program;
47202
47203 -struct nlmsvc_binding * nlmsvc_ops;
47204 +const struct nlmsvc_binding * nlmsvc_ops;
47205 EXPORT_SYMBOL_GPL(nlmsvc_ops);
47206
47207 static DEFINE_MUTEX(nlmsvc_mutex);
47208 diff -urNp linux-2.6.32.46/fs/locks.c linux-2.6.32.46/fs/locks.c
47209 --- linux-2.6.32.46/fs/locks.c 2011-03-27 14:31:47.000000000 -0400
47210 +++ linux-2.6.32.46/fs/locks.c 2011-07-06 19:47:11.000000000 -0400
47211 @@ -145,10 +145,28 @@ static LIST_HEAD(blocked_list);
47212
47213 static struct kmem_cache *filelock_cache __read_mostly;
47214
47215 +static void locks_init_lock_always(struct file_lock *fl)
47216 +{
47217 + fl->fl_next = NULL;
47218 + fl->fl_fasync = NULL;
47219 + fl->fl_owner = NULL;
47220 + fl->fl_pid = 0;
47221 + fl->fl_nspid = NULL;
47222 + fl->fl_file = NULL;
47223 + fl->fl_flags = 0;
47224 + fl->fl_type = 0;
47225 + fl->fl_start = fl->fl_end = 0;
47226 +}
47227 +
47228 /* Allocate an empty lock structure. */
47229 static struct file_lock *locks_alloc_lock(void)
47230 {
47231 - return kmem_cache_alloc(filelock_cache, GFP_KERNEL);
47232 + struct file_lock *fl = kmem_cache_alloc(filelock_cache, GFP_KERNEL);
47233 +
47234 + if (fl)
47235 + locks_init_lock_always(fl);
47236 +
47237 + return fl;
47238 }
47239
47240 void locks_release_private(struct file_lock *fl)
47241 @@ -183,17 +201,9 @@ void locks_init_lock(struct file_lock *f
47242 INIT_LIST_HEAD(&fl->fl_link);
47243 INIT_LIST_HEAD(&fl->fl_block);
47244 init_waitqueue_head(&fl->fl_wait);
47245 - fl->fl_next = NULL;
47246 - fl->fl_fasync = NULL;
47247 - fl->fl_owner = NULL;
47248 - fl->fl_pid = 0;
47249 - fl->fl_nspid = NULL;
47250 - fl->fl_file = NULL;
47251 - fl->fl_flags = 0;
47252 - fl->fl_type = 0;
47253 - fl->fl_start = fl->fl_end = 0;
47254 fl->fl_ops = NULL;
47255 fl->fl_lmops = NULL;
47256 + locks_init_lock_always(fl);
47257 }
47258
47259 EXPORT_SYMBOL(locks_init_lock);
47260 @@ -2007,16 +2017,16 @@ void locks_remove_flock(struct file *fil
47261 return;
47262
47263 if (filp->f_op && filp->f_op->flock) {
47264 - struct file_lock fl = {
47265 + struct file_lock flock = {
47266 .fl_pid = current->tgid,
47267 .fl_file = filp,
47268 .fl_flags = FL_FLOCK,
47269 .fl_type = F_UNLCK,
47270 .fl_end = OFFSET_MAX,
47271 };
47272 - filp->f_op->flock(filp, F_SETLKW, &fl);
47273 - if (fl.fl_ops && fl.fl_ops->fl_release_private)
47274 - fl.fl_ops->fl_release_private(&fl);
47275 + filp->f_op->flock(filp, F_SETLKW, &flock);
47276 + if (flock.fl_ops && flock.fl_ops->fl_release_private)
47277 + flock.fl_ops->fl_release_private(&flock);
47278 }
47279
47280 lock_kernel();
47281 diff -urNp linux-2.6.32.46/fs/mbcache.c linux-2.6.32.46/fs/mbcache.c
47282 --- linux-2.6.32.46/fs/mbcache.c 2011-03-27 14:31:47.000000000 -0400
47283 +++ linux-2.6.32.46/fs/mbcache.c 2011-08-05 20:33:55.000000000 -0400
47284 @@ -266,9 +266,9 @@ mb_cache_create(const char *name, struct
47285 if (!cache)
47286 goto fail;
47287 cache->c_name = name;
47288 - cache->c_op.free = NULL;
47289 + *(void **)&cache->c_op.free = NULL;
47290 if (cache_op)
47291 - cache->c_op.free = cache_op->free;
47292 + *(void **)&cache->c_op.free = cache_op->free;
47293 atomic_set(&cache->c_entry_count, 0);
47294 cache->c_bucket_bits = bucket_bits;
47295 #ifdef MB_CACHE_INDEXES_COUNT
47296 diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c
47297 --- linux-2.6.32.46/fs/namei.c 2011-03-27 14:31:47.000000000 -0400
47298 +++ linux-2.6.32.46/fs/namei.c 2011-10-19 12:12:56.000000000 -0400
47299 @@ -224,14 +224,6 @@ int generic_permission(struct inode *ino
47300 return ret;
47301
47302 /*
47303 - * Read/write DACs are always overridable.
47304 - * Executable DACs are overridable if at least one exec bit is set.
47305 - */
47306 - if (!(mask & MAY_EXEC) || execute_ok(inode))
47307 - if (capable(CAP_DAC_OVERRIDE))
47308 - return 0;
47309 -
47310 - /*
47311 * Searching includes executable on directories, else just read.
47312 */
47313 mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
47314 @@ -239,6 +231,14 @@ int generic_permission(struct inode *ino
47315 if (capable(CAP_DAC_READ_SEARCH))
47316 return 0;
47317
47318 + /*
47319 + * Read/write DACs are always overridable.
47320 + * Executable DACs are overridable if at least one exec bit is set.
47321 + */
47322 + if (!(mask & MAY_EXEC) || execute_ok(inode))
47323 + if (capable(CAP_DAC_OVERRIDE))
47324 + return 0;
47325 +
47326 return -EACCES;
47327 }
47328
47329 @@ -458,7 +458,8 @@ static int exec_permission_lite(struct i
47330 if (!ret)
47331 goto ok;
47332
47333 - if (capable(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH))
47334 + if (capable_nolog(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH) ||
47335 + capable(CAP_DAC_OVERRIDE))
47336 goto ok;
47337
47338 return ret;
47339 @@ -638,7 +639,7 @@ static __always_inline int __do_follow_l
47340 cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
47341 error = PTR_ERR(cookie);
47342 if (!IS_ERR(cookie)) {
47343 - char *s = nd_get_link(nd);
47344 + const char *s = nd_get_link(nd);
47345 error = 0;
47346 if (s)
47347 error = __vfs_follow_link(nd, s);
47348 @@ -669,6 +670,13 @@ static inline int do_follow_link(struct
47349 err = security_inode_follow_link(path->dentry, nd);
47350 if (err)
47351 goto loop;
47352 +
47353 + if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
47354 + path->dentry->d_inode, path->dentry, nd->path.mnt)) {
47355 + err = -EACCES;
47356 + goto loop;
47357 + }
47358 +
47359 current->link_count++;
47360 current->total_link_count++;
47361 nd->depth++;
47362 @@ -1016,11 +1024,19 @@ return_reval:
47363 break;
47364 }
47365 return_base:
47366 + if (!(nd->flags & (LOOKUP_CONTINUE | LOOKUP_PARENT)) &&
47367 + !gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
47368 + path_put(&nd->path);
47369 + return -ENOENT;
47370 + }
47371 return 0;
47372 out_dput:
47373 path_put_conditional(&next, nd);
47374 break;
47375 }
47376 + if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
47377 + err = -ENOENT;
47378 +
47379 path_put(&nd->path);
47380 return_err:
47381 return err;
47382 @@ -1091,13 +1107,20 @@ static int do_path_lookup(int dfd, const
47383 int retval = path_init(dfd, name, flags, nd);
47384 if (!retval)
47385 retval = path_walk(name, nd);
47386 - if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
47387 - nd->path.dentry->d_inode))
47388 - audit_inode(name, nd->path.dentry);
47389 +
47390 + if (likely(!retval)) {
47391 + if (nd->path.dentry && nd->path.dentry->d_inode) {
47392 + if (*name != '/' && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
47393 + retval = -ENOENT;
47394 + if (!audit_dummy_context())
47395 + audit_inode(name, nd->path.dentry);
47396 + }
47397 + }
47398 if (nd->root.mnt) {
47399 path_put(&nd->root);
47400 nd->root.mnt = NULL;
47401 }
47402 +
47403 return retval;
47404 }
47405
47406 @@ -1576,6 +1599,20 @@ int may_open(struct path *path, int acc_
47407 if (error)
47408 goto err_out;
47409
47410 +
47411 + if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
47412 + error = -EPERM;
47413 + goto err_out;
47414 + }
47415 + if (gr_handle_rawio(inode)) {
47416 + error = -EPERM;
47417 + goto err_out;
47418 + }
47419 + if (!gr_acl_handle_open(dentry, path->mnt, flag)) {
47420 + error = -EACCES;
47421 + goto err_out;
47422 + }
47423 +
47424 if (flag & O_TRUNC) {
47425 error = get_write_access(inode);
47426 if (error)
47427 @@ -1621,12 +1658,19 @@ static int __open_namei_create(struct na
47428 int error;
47429 struct dentry *dir = nd->path.dentry;
47430
47431 + if (!gr_acl_handle_creat(path->dentry, dir, nd->path.mnt, flag, mode)) {
47432 + error = -EACCES;
47433 + goto out_unlock;
47434 + }
47435 +
47436 if (!IS_POSIXACL(dir->d_inode))
47437 mode &= ~current_umask();
47438 error = security_path_mknod(&nd->path, path->dentry, mode, 0);
47439 if (error)
47440 goto out_unlock;
47441 error = vfs_create(dir->d_inode, path->dentry, mode, nd);
47442 + if (!error)
47443 + gr_handle_create(path->dentry, nd->path.mnt);
47444 out_unlock:
47445 mutex_unlock(&dir->d_inode->i_mutex);
47446 dput(nd->path.dentry);
47447 @@ -1709,6 +1753,22 @@ struct file *do_filp_open(int dfd, const
47448 &nd, flag);
47449 if (error)
47450 return ERR_PTR(error);
47451 +
47452 + if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
47453 + error = -EPERM;
47454 + goto exit;
47455 + }
47456 +
47457 + if (gr_handle_rawio(nd.path.dentry->d_inode)) {
47458 + error = -EPERM;
47459 + goto exit;
47460 + }
47461 +
47462 + if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, flag)) {
47463 + error = -EACCES;
47464 + goto exit;
47465 + }
47466 +
47467 goto ok;
47468 }
47469
47470 @@ -1795,6 +1855,19 @@ do_last:
47471 /*
47472 * It already exists.
47473 */
47474 +
47475 + if (!gr_acl_handle_hidden_file(path.dentry, path.mnt)) {
47476 + error = -ENOENT;
47477 + goto exit_mutex_unlock;
47478 + }
47479 +
47480 + /* only check if O_CREAT is specified, all other checks need
47481 + to go into may_open */
47482 + if (gr_handle_fifo(path.dentry, path.mnt, dir, flag, acc_mode)) {
47483 + error = -EACCES;
47484 + goto exit_mutex_unlock;
47485 + }
47486 +
47487 mutex_unlock(&dir->d_inode->i_mutex);
47488 audit_inode(pathname, path.dentry);
47489
47490 @@ -1887,6 +1960,13 @@ do_link:
47491 error = security_inode_follow_link(path.dentry, &nd);
47492 if (error)
47493 goto exit_dput;
47494 +
47495 + if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
47496 + path.dentry, nd.path.mnt)) {
47497 + error = -EACCES;
47498 + goto exit_dput;
47499 + }
47500 +
47501 error = __do_follow_link(&path, &nd);
47502 if (error) {
47503 /* Does someone understand code flow here? Or it is only
47504 @@ -1984,6 +2064,10 @@ struct dentry *lookup_create(struct name
47505 }
47506 return dentry;
47507 eexist:
47508 + if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) {
47509 + dput(dentry);
47510 + return ERR_PTR(-ENOENT);
47511 + }
47512 dput(dentry);
47513 dentry = ERR_PTR(-EEXIST);
47514 fail:
47515 @@ -2061,6 +2145,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
47516 error = may_mknod(mode);
47517 if (error)
47518 goto out_dput;
47519 +
47520 + if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
47521 + error = -EPERM;
47522 + goto out_dput;
47523 + }
47524 +
47525 + if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
47526 + error = -EACCES;
47527 + goto out_dput;
47528 + }
47529 +
47530 error = mnt_want_write(nd.path.mnt);
47531 if (error)
47532 goto out_dput;
47533 @@ -2081,6 +2176,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
47534 }
47535 out_drop_write:
47536 mnt_drop_write(nd.path.mnt);
47537 +
47538 + if (!error)
47539 + gr_handle_create(dentry, nd.path.mnt);
47540 out_dput:
47541 dput(dentry);
47542 out_unlock:
47543 @@ -2134,6 +2232,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
47544 if (IS_ERR(dentry))
47545 goto out_unlock;
47546
47547 + if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
47548 + error = -EACCES;
47549 + goto out_dput;
47550 + }
47551 +
47552 if (!IS_POSIXACL(nd.path.dentry->d_inode))
47553 mode &= ~current_umask();
47554 error = mnt_want_write(nd.path.mnt);
47555 @@ -2145,6 +2248,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
47556 error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
47557 out_drop_write:
47558 mnt_drop_write(nd.path.mnt);
47559 +
47560 + if (!error)
47561 + gr_handle_create(dentry, nd.path.mnt);
47562 +
47563 out_dput:
47564 dput(dentry);
47565 out_unlock:
47566 @@ -2226,6 +2333,8 @@ static long do_rmdir(int dfd, const char
47567 char * name;
47568 struct dentry *dentry;
47569 struct nameidata nd;
47570 + ino_t saved_ino = 0;
47571 + dev_t saved_dev = 0;
47572
47573 error = user_path_parent(dfd, pathname, &nd, &name);
47574 if (error)
47575 @@ -2250,6 +2359,19 @@ static long do_rmdir(int dfd, const char
47576 error = PTR_ERR(dentry);
47577 if (IS_ERR(dentry))
47578 goto exit2;
47579 +
47580 + if (dentry->d_inode != NULL) {
47581 + if (dentry->d_inode->i_nlink <= 1) {
47582 + saved_ino = dentry->d_inode->i_ino;
47583 + saved_dev = gr_get_dev_from_dentry(dentry);
47584 + }
47585 +
47586 + if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
47587 + error = -EACCES;
47588 + goto exit3;
47589 + }
47590 + }
47591 +
47592 error = mnt_want_write(nd.path.mnt);
47593 if (error)
47594 goto exit3;
47595 @@ -2257,6 +2379,8 @@ static long do_rmdir(int dfd, const char
47596 if (error)
47597 goto exit4;
47598 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
47599 + if (!error && (saved_dev || saved_ino))
47600 + gr_handle_delete(saved_ino, saved_dev);
47601 exit4:
47602 mnt_drop_write(nd.path.mnt);
47603 exit3:
47604 @@ -2318,6 +2442,8 @@ static long do_unlinkat(int dfd, const c
47605 struct dentry *dentry;
47606 struct nameidata nd;
47607 struct inode *inode = NULL;
47608 + ino_t saved_ino = 0;
47609 + dev_t saved_dev = 0;
47610
47611 error = user_path_parent(dfd, pathname, &nd, &name);
47612 if (error)
47613 @@ -2337,8 +2463,19 @@ static long do_unlinkat(int dfd, const c
47614 if (nd.last.name[nd.last.len])
47615 goto slashes;
47616 inode = dentry->d_inode;
47617 - if (inode)
47618 + if (inode) {
47619 + if (inode->i_nlink <= 1) {
47620 + saved_ino = inode->i_ino;
47621 + saved_dev = gr_get_dev_from_dentry(dentry);
47622 + }
47623 +
47624 atomic_inc(&inode->i_count);
47625 +
47626 + if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
47627 + error = -EACCES;
47628 + goto exit2;
47629 + }
47630 + }
47631 error = mnt_want_write(nd.path.mnt);
47632 if (error)
47633 goto exit2;
47634 @@ -2346,6 +2483,8 @@ static long do_unlinkat(int dfd, const c
47635 if (error)
47636 goto exit3;
47637 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
47638 + if (!error && (saved_ino || saved_dev))
47639 + gr_handle_delete(saved_ino, saved_dev);
47640 exit3:
47641 mnt_drop_write(nd.path.mnt);
47642 exit2:
47643 @@ -2424,6 +2563,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
47644 if (IS_ERR(dentry))
47645 goto out_unlock;
47646
47647 + if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
47648 + error = -EACCES;
47649 + goto out_dput;
47650 + }
47651 +
47652 error = mnt_want_write(nd.path.mnt);
47653 if (error)
47654 goto out_dput;
47655 @@ -2431,6 +2575,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
47656 if (error)
47657 goto out_drop_write;
47658 error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
47659 + if (!error)
47660 + gr_handle_create(dentry, nd.path.mnt);
47661 out_drop_write:
47662 mnt_drop_write(nd.path.mnt);
47663 out_dput:
47664 @@ -2524,6 +2670,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
47665 error = PTR_ERR(new_dentry);
47666 if (IS_ERR(new_dentry))
47667 goto out_unlock;
47668 +
47669 + if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
47670 + old_path.dentry->d_inode,
47671 + old_path.dentry->d_inode->i_mode, to)) {
47672 + error = -EACCES;
47673 + goto out_dput;
47674 + }
47675 +
47676 + if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
47677 + old_path.dentry, old_path.mnt, to)) {
47678 + error = -EACCES;
47679 + goto out_dput;
47680 + }
47681 +
47682 error = mnt_want_write(nd.path.mnt);
47683 if (error)
47684 goto out_dput;
47685 @@ -2531,6 +2691,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
47686 if (error)
47687 goto out_drop_write;
47688 error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
47689 + if (!error)
47690 + gr_handle_create(new_dentry, nd.path.mnt);
47691 out_drop_write:
47692 mnt_drop_write(nd.path.mnt);
47693 out_dput:
47694 @@ -2708,6 +2870,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
47695 char *to;
47696 int error;
47697
47698 + pax_track_stack();
47699 +
47700 error = user_path_parent(olddfd, oldname, &oldnd, &from);
47701 if (error)
47702 goto exit;
47703 @@ -2764,6 +2928,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
47704 if (new_dentry == trap)
47705 goto exit5;
47706
47707 + error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
47708 + old_dentry, old_dir->d_inode, oldnd.path.mnt,
47709 + to);
47710 + if (error)
47711 + goto exit5;
47712 +
47713 error = mnt_want_write(oldnd.path.mnt);
47714 if (error)
47715 goto exit5;
47716 @@ -2773,6 +2943,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
47717 goto exit6;
47718 error = vfs_rename(old_dir->d_inode, old_dentry,
47719 new_dir->d_inode, new_dentry);
47720 + if (!error)
47721 + gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
47722 + new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
47723 exit6:
47724 mnt_drop_write(oldnd.path.mnt);
47725 exit5:
47726 @@ -2798,6 +2971,8 @@ SYSCALL_DEFINE2(rename, const char __use
47727
47728 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
47729 {
47730 + char tmpbuf[64];
47731 + const char *newlink;
47732 int len;
47733
47734 len = PTR_ERR(link);
47735 @@ -2807,7 +2982,14 @@ int vfs_readlink(struct dentry *dentry,
47736 len = strlen(link);
47737 if (len > (unsigned) buflen)
47738 len = buflen;
47739 - if (copy_to_user(buffer, link, len))
47740 +
47741 + if (len < sizeof(tmpbuf)) {
47742 + memcpy(tmpbuf, link, len);
47743 + newlink = tmpbuf;
47744 + } else
47745 + newlink = link;
47746 +
47747 + if (copy_to_user(buffer, newlink, len))
47748 len = -EFAULT;
47749 out:
47750 return len;
47751 diff -urNp linux-2.6.32.46/fs/namespace.c linux-2.6.32.46/fs/namespace.c
47752 --- linux-2.6.32.46/fs/namespace.c 2011-03-27 14:31:47.000000000 -0400
47753 +++ linux-2.6.32.46/fs/namespace.c 2011-04-17 15:56:46.000000000 -0400
47754 @@ -1083,6 +1083,9 @@ static int do_umount(struct vfsmount *mn
47755 if (!(sb->s_flags & MS_RDONLY))
47756 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
47757 up_write(&sb->s_umount);
47758 +
47759 + gr_log_remount(mnt->mnt_devname, retval);
47760 +
47761 return retval;
47762 }
47763
47764 @@ -1104,6 +1107,9 @@ static int do_umount(struct vfsmount *mn
47765 security_sb_umount_busy(mnt);
47766 up_write(&namespace_sem);
47767 release_mounts(&umount_list);
47768 +
47769 + gr_log_unmount(mnt->mnt_devname, retval);
47770 +
47771 return retval;
47772 }
47773
47774 @@ -1962,6 +1968,16 @@ long do_mount(char *dev_name, char *dir_
47775 if (retval)
47776 goto dput_out;
47777
47778 + if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
47779 + retval = -EPERM;
47780 + goto dput_out;
47781 + }
47782 +
47783 + if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
47784 + retval = -EPERM;
47785 + goto dput_out;
47786 + }
47787 +
47788 if (flags & MS_REMOUNT)
47789 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
47790 data_page);
47791 @@ -1976,6 +1992,9 @@ long do_mount(char *dev_name, char *dir_
47792 dev_name, data_page);
47793 dput_out:
47794 path_put(&path);
47795 +
47796 + gr_log_mount(dev_name, dir_name, retval);
47797 +
47798 return retval;
47799 }
47800
47801 @@ -2182,6 +2201,12 @@ SYSCALL_DEFINE2(pivot_root, const char _
47802 goto out1;
47803 }
47804
47805 + if (gr_handle_chroot_pivot()) {
47806 + error = -EPERM;
47807 + path_put(&old);
47808 + goto out1;
47809 + }
47810 +
47811 read_lock(&current->fs->lock);
47812 root = current->fs->root;
47813 path_get(&current->fs->root);
47814 diff -urNp linux-2.6.32.46/fs/ncpfs/dir.c linux-2.6.32.46/fs/ncpfs/dir.c
47815 --- linux-2.6.32.46/fs/ncpfs/dir.c 2011-03-27 14:31:47.000000000 -0400
47816 +++ linux-2.6.32.46/fs/ncpfs/dir.c 2011-05-16 21:46:57.000000000 -0400
47817 @@ -275,6 +275,8 @@ __ncp_lookup_validate(struct dentry *den
47818 int res, val = 0, len;
47819 __u8 __name[NCP_MAXPATHLEN + 1];
47820
47821 + pax_track_stack();
47822 +
47823 parent = dget_parent(dentry);
47824 dir = parent->d_inode;
47825
47826 @@ -799,6 +801,8 @@ static struct dentry *ncp_lookup(struct
47827 int error, res, len;
47828 __u8 __name[NCP_MAXPATHLEN + 1];
47829
47830 + pax_track_stack();
47831 +
47832 lock_kernel();
47833 error = -EIO;
47834 if (!ncp_conn_valid(server))
47835 @@ -883,10 +887,12 @@ int ncp_create_new(struct inode *dir, st
47836 int error, result, len;
47837 int opmode;
47838 __u8 __name[NCP_MAXPATHLEN + 1];
47839 -
47840 +
47841 PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
47842 dentry->d_parent->d_name.name, dentry->d_name.name, mode);
47843
47844 + pax_track_stack();
47845 +
47846 error = -EIO;
47847 lock_kernel();
47848 if (!ncp_conn_valid(server))
47849 @@ -952,6 +958,8 @@ static int ncp_mkdir(struct inode *dir,
47850 int error, len;
47851 __u8 __name[NCP_MAXPATHLEN + 1];
47852
47853 + pax_track_stack();
47854 +
47855 DPRINTK("ncp_mkdir: making %s/%s\n",
47856 dentry->d_parent->d_name.name, dentry->d_name.name);
47857
47858 @@ -960,6 +968,8 @@ static int ncp_mkdir(struct inode *dir,
47859 if (!ncp_conn_valid(server))
47860 goto out;
47861
47862 + pax_track_stack();
47863 +
47864 ncp_age_dentry(server, dentry);
47865 len = sizeof(__name);
47866 error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
47867 @@ -1114,6 +1124,8 @@ static int ncp_rename(struct inode *old_
47868 int old_len, new_len;
47869 __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
47870
47871 + pax_track_stack();
47872 +
47873 DPRINTK("ncp_rename: %s/%s to %s/%s\n",
47874 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
47875 new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
47876 diff -urNp linux-2.6.32.46/fs/ncpfs/inode.c linux-2.6.32.46/fs/ncpfs/inode.c
47877 --- linux-2.6.32.46/fs/ncpfs/inode.c 2011-03-27 14:31:47.000000000 -0400
47878 +++ linux-2.6.32.46/fs/ncpfs/inode.c 2011-05-16 21:46:57.000000000 -0400
47879 @@ -445,6 +445,8 @@ static int ncp_fill_super(struct super_b
47880 #endif
47881 struct ncp_entry_info finfo;
47882
47883 + pax_track_stack();
47884 +
47885 data.wdog_pid = NULL;
47886 server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
47887 if (!server)
47888 diff -urNp linux-2.6.32.46/fs/nfs/inode.c linux-2.6.32.46/fs/nfs/inode.c
47889 --- linux-2.6.32.46/fs/nfs/inode.c 2011-05-10 22:12:01.000000000 -0400
47890 +++ linux-2.6.32.46/fs/nfs/inode.c 2011-07-06 19:53:33.000000000 -0400
47891 @@ -156,7 +156,7 @@ static void nfs_zap_caches_locked(struct
47892 nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
47893 nfsi->attrtimeo_timestamp = jiffies;
47894
47895 - memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
47896 + memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
47897 if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
47898 nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
47899 else
47900 @@ -973,16 +973,16 @@ static int nfs_size_need_update(const st
47901 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
47902 }
47903
47904 -static atomic_long_t nfs_attr_generation_counter;
47905 +static atomic_long_unchecked_t nfs_attr_generation_counter;
47906
47907 static unsigned long nfs_read_attr_generation_counter(void)
47908 {
47909 - return atomic_long_read(&nfs_attr_generation_counter);
47910 + return atomic_long_read_unchecked(&nfs_attr_generation_counter);
47911 }
47912
47913 unsigned long nfs_inc_attr_generation_counter(void)
47914 {
47915 - return atomic_long_inc_return(&nfs_attr_generation_counter);
47916 + return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
47917 }
47918
47919 void nfs_fattr_init(struct nfs_fattr *fattr)
47920 diff -urNp linux-2.6.32.46/fs/nfsd/lockd.c linux-2.6.32.46/fs/nfsd/lockd.c
47921 --- linux-2.6.32.46/fs/nfsd/lockd.c 2011-04-17 17:00:52.000000000 -0400
47922 +++ linux-2.6.32.46/fs/nfsd/lockd.c 2011-04-17 17:03:15.000000000 -0400
47923 @@ -66,7 +66,7 @@ nlm_fclose(struct file *filp)
47924 fput(filp);
47925 }
47926
47927 -static struct nlmsvc_binding nfsd_nlm_ops = {
47928 +static const struct nlmsvc_binding nfsd_nlm_ops = {
47929 .fopen = nlm_fopen, /* open file for locking */
47930 .fclose = nlm_fclose, /* close file */
47931 };
47932 diff -urNp linux-2.6.32.46/fs/nfsd/nfs4state.c linux-2.6.32.46/fs/nfsd/nfs4state.c
47933 --- linux-2.6.32.46/fs/nfsd/nfs4state.c 2011-03-27 14:31:47.000000000 -0400
47934 +++ linux-2.6.32.46/fs/nfsd/nfs4state.c 2011-05-16 21:46:57.000000000 -0400
47935 @@ -3457,6 +3457,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
47936 unsigned int cmd;
47937 int err;
47938
47939 + pax_track_stack();
47940 +
47941 dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
47942 (long long) lock->lk_offset,
47943 (long long) lock->lk_length);
47944 diff -urNp linux-2.6.32.46/fs/nfsd/nfs4xdr.c linux-2.6.32.46/fs/nfsd/nfs4xdr.c
47945 --- linux-2.6.32.46/fs/nfsd/nfs4xdr.c 2011-03-27 14:31:47.000000000 -0400
47946 +++ linux-2.6.32.46/fs/nfsd/nfs4xdr.c 2011-05-16 21:46:57.000000000 -0400
47947 @@ -1751,6 +1751,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
47948 struct nfsd4_compoundres *resp = rqstp->rq_resp;
47949 u32 minorversion = resp->cstate.minorversion;
47950
47951 + pax_track_stack();
47952 +
47953 BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
47954 BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
47955 BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
47956 diff -urNp linux-2.6.32.46/fs/nfsd/vfs.c linux-2.6.32.46/fs/nfsd/vfs.c
47957 --- linux-2.6.32.46/fs/nfsd/vfs.c 2011-05-10 22:12:01.000000000 -0400
47958 +++ linux-2.6.32.46/fs/nfsd/vfs.c 2011-10-06 09:37:14.000000000 -0400
47959 @@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
47960 } else {
47961 oldfs = get_fs();
47962 set_fs(KERNEL_DS);
47963 - host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
47964 + host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset);
47965 set_fs(oldfs);
47966 }
47967
47968 @@ -1060,7 +1060,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
47969
47970 /* Write the data. */
47971 oldfs = get_fs(); set_fs(KERNEL_DS);
47972 - host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
47973 + host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &offset);
47974 set_fs(oldfs);
47975 if (host_err < 0)
47976 goto out_nfserr;
47977 @@ -1542,7 +1542,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
47978 */
47979
47980 oldfs = get_fs(); set_fs(KERNEL_DS);
47981 - host_err = inode->i_op->readlink(dentry, buf, *lenp);
47982 + host_err = inode->i_op->readlink(dentry, (char __force_user *)buf, *lenp);
47983 set_fs(oldfs);
47984
47985 if (host_err < 0)
47986 diff -urNp linux-2.6.32.46/fs/nilfs2/ioctl.c linux-2.6.32.46/fs/nilfs2/ioctl.c
47987 --- linux-2.6.32.46/fs/nilfs2/ioctl.c 2011-03-27 14:31:47.000000000 -0400
47988 +++ linux-2.6.32.46/fs/nilfs2/ioctl.c 2011-05-04 17:56:28.000000000 -0400
47989 @@ -480,7 +480,7 @@ static int nilfs_ioctl_clean_segments(st
47990 unsigned int cmd, void __user *argp)
47991 {
47992 struct nilfs_argv argv[5];
47993 - const static size_t argsz[5] = {
47994 + static const size_t argsz[5] = {
47995 sizeof(struct nilfs_vdesc),
47996 sizeof(struct nilfs_period),
47997 sizeof(__u64),
47998 diff -urNp linux-2.6.32.46/fs/notify/dnotify/dnotify.c linux-2.6.32.46/fs/notify/dnotify/dnotify.c
47999 --- linux-2.6.32.46/fs/notify/dnotify/dnotify.c 2011-03-27 14:31:47.000000000 -0400
48000 +++ linux-2.6.32.46/fs/notify/dnotify/dnotify.c 2011-04-17 15:56:46.000000000 -0400
48001 @@ -173,7 +173,7 @@ static void dnotify_free_mark(struct fsn
48002 kmem_cache_free(dnotify_mark_entry_cache, dnentry);
48003 }
48004
48005 -static struct fsnotify_ops dnotify_fsnotify_ops = {
48006 +static const struct fsnotify_ops dnotify_fsnotify_ops = {
48007 .handle_event = dnotify_handle_event,
48008 .should_send_event = dnotify_should_send_event,
48009 .free_group_priv = NULL,
48010 diff -urNp linux-2.6.32.46/fs/notify/notification.c linux-2.6.32.46/fs/notify/notification.c
48011 --- linux-2.6.32.46/fs/notify/notification.c 2011-03-27 14:31:47.000000000 -0400
48012 +++ linux-2.6.32.46/fs/notify/notification.c 2011-05-04 17:56:28.000000000 -0400
48013 @@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event
48014 * get set to 0 so it will never get 'freed'
48015 */
48016 static struct fsnotify_event q_overflow_event;
48017 -static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
48018 +static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
48019
48020 /**
48021 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
48022 @@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = A
48023 */
48024 u32 fsnotify_get_cookie(void)
48025 {
48026 - return atomic_inc_return(&fsnotify_sync_cookie);
48027 + return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
48028 }
48029 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
48030
48031 diff -urNp linux-2.6.32.46/fs/ntfs/dir.c linux-2.6.32.46/fs/ntfs/dir.c
48032 --- linux-2.6.32.46/fs/ntfs/dir.c 2011-03-27 14:31:47.000000000 -0400
48033 +++ linux-2.6.32.46/fs/ntfs/dir.c 2011-04-17 15:56:46.000000000 -0400
48034 @@ -1328,7 +1328,7 @@ find_next_index_buffer:
48035 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
48036 ~(s64)(ndir->itype.index.block_size - 1)));
48037 /* Bounds checks. */
48038 - if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
48039 + if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
48040 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
48041 "inode 0x%lx or driver bug.", vdir->i_ino);
48042 goto err_out;
48043 diff -urNp linux-2.6.32.46/fs/ntfs/file.c linux-2.6.32.46/fs/ntfs/file.c
48044 --- linux-2.6.32.46/fs/ntfs/file.c 2011-03-27 14:31:47.000000000 -0400
48045 +++ linux-2.6.32.46/fs/ntfs/file.c 2011-04-17 15:56:46.000000000 -0400
48046 @@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_
48047 #endif /* NTFS_RW */
48048 };
48049
48050 -const struct file_operations ntfs_empty_file_ops = {};
48051 +const struct file_operations ntfs_empty_file_ops __read_only;
48052
48053 -const struct inode_operations ntfs_empty_inode_ops = {};
48054 +const struct inode_operations ntfs_empty_inode_ops __read_only;
48055 diff -urNp linux-2.6.32.46/fs/ocfs2/cluster/masklog.c linux-2.6.32.46/fs/ocfs2/cluster/masklog.c
48056 --- linux-2.6.32.46/fs/ocfs2/cluster/masklog.c 2011-03-27 14:31:47.000000000 -0400
48057 +++ linux-2.6.32.46/fs/ocfs2/cluster/masklog.c 2011-04-17 15:56:46.000000000 -0400
48058 @@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject
48059 return mlog_mask_store(mlog_attr->mask, buf, count);
48060 }
48061
48062 -static struct sysfs_ops mlog_attr_ops = {
48063 +static const struct sysfs_ops mlog_attr_ops = {
48064 .show = mlog_show,
48065 .store = mlog_store,
48066 };
48067 diff -urNp linux-2.6.32.46/fs/ocfs2/localalloc.c linux-2.6.32.46/fs/ocfs2/localalloc.c
48068 --- linux-2.6.32.46/fs/ocfs2/localalloc.c 2011-03-27 14:31:47.000000000 -0400
48069 +++ linux-2.6.32.46/fs/ocfs2/localalloc.c 2011-04-17 15:56:46.000000000 -0400
48070 @@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_windo
48071 goto bail;
48072 }
48073
48074 - atomic_inc(&osb->alloc_stats.moves);
48075 + atomic_inc_unchecked(&osb->alloc_stats.moves);
48076
48077 status = 0;
48078 bail:
48079 diff -urNp linux-2.6.32.46/fs/ocfs2/namei.c linux-2.6.32.46/fs/ocfs2/namei.c
48080 --- linux-2.6.32.46/fs/ocfs2/namei.c 2011-03-27 14:31:47.000000000 -0400
48081 +++ linux-2.6.32.46/fs/ocfs2/namei.c 2011-05-16 21:46:57.000000000 -0400
48082 @@ -1043,6 +1043,8 @@ static int ocfs2_rename(struct inode *ol
48083 struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
48084 struct ocfs2_dir_lookup_result target_insert = { NULL, };
48085
48086 + pax_track_stack();
48087 +
48088 /* At some point it might be nice to break this function up a
48089 * bit. */
48090
48091 diff -urNp linux-2.6.32.46/fs/ocfs2/ocfs2.h linux-2.6.32.46/fs/ocfs2/ocfs2.h
48092 --- linux-2.6.32.46/fs/ocfs2/ocfs2.h 2011-03-27 14:31:47.000000000 -0400
48093 +++ linux-2.6.32.46/fs/ocfs2/ocfs2.h 2011-04-17 15:56:46.000000000 -0400
48094 @@ -217,11 +217,11 @@ enum ocfs2_vol_state
48095
48096 struct ocfs2_alloc_stats
48097 {
48098 - atomic_t moves;
48099 - atomic_t local_data;
48100 - atomic_t bitmap_data;
48101 - atomic_t bg_allocs;
48102 - atomic_t bg_extends;
48103 + atomic_unchecked_t moves;
48104 + atomic_unchecked_t local_data;
48105 + atomic_unchecked_t bitmap_data;
48106 + atomic_unchecked_t bg_allocs;
48107 + atomic_unchecked_t bg_extends;
48108 };
48109
48110 enum ocfs2_local_alloc_state
48111 diff -urNp linux-2.6.32.46/fs/ocfs2/suballoc.c linux-2.6.32.46/fs/ocfs2/suballoc.c
48112 --- linux-2.6.32.46/fs/ocfs2/suballoc.c 2011-03-27 14:31:47.000000000 -0400
48113 +++ linux-2.6.32.46/fs/ocfs2/suballoc.c 2011-04-17 15:56:46.000000000 -0400
48114 @@ -623,7 +623,7 @@ static int ocfs2_reserve_suballoc_bits(s
48115 mlog_errno(status);
48116 goto bail;
48117 }
48118 - atomic_inc(&osb->alloc_stats.bg_extends);
48119 + atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
48120
48121 /* You should never ask for this much metadata */
48122 BUG_ON(bits_wanted >
48123 @@ -1654,7 +1654,7 @@ int ocfs2_claim_metadata(struct ocfs2_su
48124 mlog_errno(status);
48125 goto bail;
48126 }
48127 - atomic_inc(&osb->alloc_stats.bg_allocs);
48128 + atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
48129
48130 *blkno_start = bg_blkno + (u64) *suballoc_bit_start;
48131 ac->ac_bits_given += (*num_bits);
48132 @@ -1728,7 +1728,7 @@ int ocfs2_claim_new_inode(struct ocfs2_s
48133 mlog_errno(status);
48134 goto bail;
48135 }
48136 - atomic_inc(&osb->alloc_stats.bg_allocs);
48137 + atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
48138
48139 BUG_ON(num_bits != 1);
48140
48141 @@ -1830,7 +1830,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
48142 cluster_start,
48143 num_clusters);
48144 if (!status)
48145 - atomic_inc(&osb->alloc_stats.local_data);
48146 + atomic_inc_unchecked(&osb->alloc_stats.local_data);
48147 } else {
48148 if (min_clusters > (osb->bitmap_cpg - 1)) {
48149 /* The only paths asking for contiguousness
48150 @@ -1858,7 +1858,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
48151 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
48152 bg_blkno,
48153 bg_bit_off);
48154 - atomic_inc(&osb->alloc_stats.bitmap_data);
48155 + atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
48156 }
48157 }
48158 if (status < 0) {
48159 diff -urNp linux-2.6.32.46/fs/ocfs2/super.c linux-2.6.32.46/fs/ocfs2/super.c
48160 --- linux-2.6.32.46/fs/ocfs2/super.c 2011-03-27 14:31:47.000000000 -0400
48161 +++ linux-2.6.32.46/fs/ocfs2/super.c 2011-04-17 15:56:46.000000000 -0400
48162 @@ -284,11 +284,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
48163 "%10s => GlobalAllocs: %d LocalAllocs: %d "
48164 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
48165 "Stats",
48166 - atomic_read(&osb->alloc_stats.bitmap_data),
48167 - atomic_read(&osb->alloc_stats.local_data),
48168 - atomic_read(&osb->alloc_stats.bg_allocs),
48169 - atomic_read(&osb->alloc_stats.moves),
48170 - atomic_read(&osb->alloc_stats.bg_extends));
48171 + atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
48172 + atomic_read_unchecked(&osb->alloc_stats.local_data),
48173 + atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
48174 + atomic_read_unchecked(&osb->alloc_stats.moves),
48175 + atomic_read_unchecked(&osb->alloc_stats.bg_extends));
48176
48177 out += snprintf(buf + out, len - out,
48178 "%10s => State: %u Descriptor: %llu Size: %u bits "
48179 @@ -2002,11 +2002,11 @@ static int ocfs2_initialize_super(struct
48180 spin_lock_init(&osb->osb_xattr_lock);
48181 ocfs2_init_inode_steal_slot(osb);
48182
48183 - atomic_set(&osb->alloc_stats.moves, 0);
48184 - atomic_set(&osb->alloc_stats.local_data, 0);
48185 - atomic_set(&osb->alloc_stats.bitmap_data, 0);
48186 - atomic_set(&osb->alloc_stats.bg_allocs, 0);
48187 - atomic_set(&osb->alloc_stats.bg_extends, 0);
48188 + atomic_set_unchecked(&osb->alloc_stats.moves, 0);
48189 + atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
48190 + atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
48191 + atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
48192 + atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
48193
48194 /* Copy the blockcheck stats from the superblock probe */
48195 osb->osb_ecc_stats = *stats;
48196 diff -urNp linux-2.6.32.46/fs/open.c linux-2.6.32.46/fs/open.c
48197 --- linux-2.6.32.46/fs/open.c 2011-03-27 14:31:47.000000000 -0400
48198 +++ linux-2.6.32.46/fs/open.c 2011-09-13 16:03:56.000000000 -0400
48199 @@ -275,6 +275,10 @@ static long do_sys_truncate(const char _
48200 error = locks_verify_truncate(inode, NULL, length);
48201 if (!error)
48202 error = security_path_truncate(&path, length, 0);
48203 +
48204 + if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
48205 + error = -EACCES;
48206 +
48207 if (!error) {
48208 vfs_dq_init(inode);
48209 error = do_truncate(path.dentry, length, 0, NULL);
48210 @@ -511,6 +515,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
48211 if (__mnt_is_readonly(path.mnt))
48212 res = -EROFS;
48213
48214 + if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
48215 + res = -EACCES;
48216 +
48217 out_path_release:
48218 path_put(&path);
48219 out:
48220 @@ -537,6 +544,8 @@ SYSCALL_DEFINE1(chdir, const char __user
48221 if (error)
48222 goto dput_and_out;
48223
48224 + gr_log_chdir(path.dentry, path.mnt);
48225 +
48226 set_fs_pwd(current->fs, &path);
48227
48228 dput_and_out:
48229 @@ -563,6 +572,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
48230 goto out_putf;
48231
48232 error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
48233 +
48234 + if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
48235 + error = -EPERM;
48236 +
48237 + if (!error)
48238 + gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
48239 +
48240 if (!error)
48241 set_fs_pwd(current->fs, &file->f_path);
48242 out_putf:
48243 @@ -588,7 +604,13 @@ SYSCALL_DEFINE1(chroot, const char __use
48244 if (!capable(CAP_SYS_CHROOT))
48245 goto dput_and_out;
48246
48247 + if (gr_handle_chroot_chroot(path.dentry, path.mnt))
48248 + goto dput_and_out;
48249 +
48250 set_fs_root(current->fs, &path);
48251 +
48252 + gr_handle_chroot_chdir(&path);
48253 +
48254 error = 0;
48255 dput_and_out:
48256 path_put(&path);
48257 @@ -616,12 +638,27 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
48258 err = mnt_want_write_file(file);
48259 if (err)
48260 goto out_putf;
48261 +
48262 mutex_lock(&inode->i_mutex);
48263 +
48264 + if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
48265 + err = -EACCES;
48266 + goto out_unlock;
48267 + }
48268 +
48269 if (mode == (mode_t) -1)
48270 mode = inode->i_mode;
48271 +
48272 + if (gr_handle_chroot_chmod(dentry, file->f_path.mnt, mode)) {
48273 + err = -EPERM;
48274 + goto out_unlock;
48275 + }
48276 +
48277 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
48278 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
48279 err = notify_change(dentry, &newattrs);
48280 +
48281 +out_unlock:
48282 mutex_unlock(&inode->i_mutex);
48283 mnt_drop_write(file->f_path.mnt);
48284 out_putf:
48285 @@ -645,12 +682,27 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
48286 error = mnt_want_write(path.mnt);
48287 if (error)
48288 goto dput_and_out;
48289 +
48290 mutex_lock(&inode->i_mutex);
48291 +
48292 + if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
48293 + error = -EACCES;
48294 + goto out_unlock;
48295 + }
48296 +
48297 if (mode == (mode_t) -1)
48298 mode = inode->i_mode;
48299 +
48300 + if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
48301 + error = -EACCES;
48302 + goto out_unlock;
48303 + }
48304 +
48305 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
48306 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
48307 error = notify_change(path.dentry, &newattrs);
48308 +
48309 +out_unlock:
48310 mutex_unlock(&inode->i_mutex);
48311 mnt_drop_write(path.mnt);
48312 dput_and_out:
48313 @@ -664,12 +716,15 @@ SYSCALL_DEFINE2(chmod, const char __user
48314 return sys_fchmodat(AT_FDCWD, filename, mode);
48315 }
48316
48317 -static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
48318 +static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
48319 {
48320 struct inode *inode = dentry->d_inode;
48321 int error;
48322 struct iattr newattrs;
48323
48324 + if (!gr_acl_handle_chown(dentry, mnt))
48325 + return -EACCES;
48326 +
48327 newattrs.ia_valid = ATTR_CTIME;
48328 if (user != (uid_t) -1) {
48329 newattrs.ia_valid |= ATTR_UID;
48330 @@ -700,7 +755,7 @@ SYSCALL_DEFINE3(chown, const char __user
48331 error = mnt_want_write(path.mnt);
48332 if (error)
48333 goto out_release;
48334 - error = chown_common(path.dentry, user, group);
48335 + error = chown_common(path.dentry, user, group, path.mnt);
48336 mnt_drop_write(path.mnt);
48337 out_release:
48338 path_put(&path);
48339 @@ -725,7 +780,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
48340 error = mnt_want_write(path.mnt);
48341 if (error)
48342 goto out_release;
48343 - error = chown_common(path.dentry, user, group);
48344 + error = chown_common(path.dentry, user, group, path.mnt);
48345 mnt_drop_write(path.mnt);
48346 out_release:
48347 path_put(&path);
48348 @@ -744,7 +799,7 @@ SYSCALL_DEFINE3(lchown, const char __use
48349 error = mnt_want_write(path.mnt);
48350 if (error)
48351 goto out_release;
48352 - error = chown_common(path.dentry, user, group);
48353 + error = chown_common(path.dentry, user, group, path.mnt);
48354 mnt_drop_write(path.mnt);
48355 out_release:
48356 path_put(&path);
48357 @@ -767,7 +822,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
48358 goto out_fput;
48359 dentry = file->f_path.dentry;
48360 audit_inode(NULL, dentry);
48361 - error = chown_common(dentry, user, group);
48362 + error = chown_common(dentry, user, group, file->f_path.mnt);
48363 mnt_drop_write(file->f_path.mnt);
48364 out_fput:
48365 fput(file);
48366 @@ -1036,7 +1091,10 @@ long do_sys_open(int dfd, const char __u
48367 if (!IS_ERR(tmp)) {
48368 fd = get_unused_fd_flags(flags);
48369 if (fd >= 0) {
48370 - struct file *f = do_filp_open(dfd, tmp, flags, mode, 0);
48371 + struct file *f;
48372 + /* don't allow to be set by userland */
48373 + flags &= ~FMODE_GREXEC;
48374 + f = do_filp_open(dfd, tmp, flags, mode, 0);
48375 if (IS_ERR(f)) {
48376 put_unused_fd(fd);
48377 fd = PTR_ERR(f);
48378 diff -urNp linux-2.6.32.46/fs/partitions/ldm.c linux-2.6.32.46/fs/partitions/ldm.c
48379 --- linux-2.6.32.46/fs/partitions/ldm.c 2011-06-25 12:55:34.000000000 -0400
48380 +++ linux-2.6.32.46/fs/partitions/ldm.c 2011-06-25 12:56:37.000000000 -0400
48381 @@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data
48382 ldm_error ("A VBLK claims to have %d parts.", num);
48383 return false;
48384 }
48385 +
48386 if (rec >= num) {
48387 ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
48388 return false;
48389 @@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data
48390 goto found;
48391 }
48392
48393 - f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
48394 + f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
48395 if (!f) {
48396 ldm_crit ("Out of memory.");
48397 return false;
48398 diff -urNp linux-2.6.32.46/fs/partitions/mac.c linux-2.6.32.46/fs/partitions/mac.c
48399 --- linux-2.6.32.46/fs/partitions/mac.c 2011-03-27 14:31:47.000000000 -0400
48400 +++ linux-2.6.32.46/fs/partitions/mac.c 2011-04-17 15:56:46.000000000 -0400
48401 @@ -59,11 +59,11 @@ int mac_partition(struct parsed_partitio
48402 return 0; /* not a MacOS disk */
48403 }
48404 blocks_in_map = be32_to_cpu(part->map_count);
48405 + printk(" [mac]");
48406 if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) {
48407 put_dev_sector(sect);
48408 return 0;
48409 }
48410 - printk(" [mac]");
48411 for (slot = 1; slot <= blocks_in_map; ++slot) {
48412 int pos = slot * secsize;
48413 put_dev_sector(sect);
48414 diff -urNp linux-2.6.32.46/fs/pipe.c linux-2.6.32.46/fs/pipe.c
48415 --- linux-2.6.32.46/fs/pipe.c 2011-03-27 14:31:47.000000000 -0400
48416 +++ linux-2.6.32.46/fs/pipe.c 2011-04-23 13:37:17.000000000 -0400
48417 @@ -401,9 +401,9 @@ redo:
48418 }
48419 if (bufs) /* More to do? */
48420 continue;
48421 - if (!pipe->writers)
48422 + if (!atomic_read(&pipe->writers))
48423 break;
48424 - if (!pipe->waiting_writers) {
48425 + if (!atomic_read(&pipe->waiting_writers)) {
48426 /* syscall merging: Usually we must not sleep
48427 * if O_NONBLOCK is set, or if we got some data.
48428 * But if a writer sleeps in kernel space, then
48429 @@ -462,7 +462,7 @@ pipe_write(struct kiocb *iocb, const str
48430 mutex_lock(&inode->i_mutex);
48431 pipe = inode->i_pipe;
48432
48433 - if (!pipe->readers) {
48434 + if (!atomic_read(&pipe->readers)) {
48435 send_sig(SIGPIPE, current, 0);
48436 ret = -EPIPE;
48437 goto out;
48438 @@ -511,7 +511,7 @@ redo1:
48439 for (;;) {
48440 int bufs;
48441
48442 - if (!pipe->readers) {
48443 + if (!atomic_read(&pipe->readers)) {
48444 send_sig(SIGPIPE, current, 0);
48445 if (!ret)
48446 ret = -EPIPE;
48447 @@ -597,9 +597,9 @@ redo2:
48448 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
48449 do_wakeup = 0;
48450 }
48451 - pipe->waiting_writers++;
48452 + atomic_inc(&pipe->waiting_writers);
48453 pipe_wait(pipe);
48454 - pipe->waiting_writers--;
48455 + atomic_dec(&pipe->waiting_writers);
48456 }
48457 out:
48458 mutex_unlock(&inode->i_mutex);
48459 @@ -666,7 +666,7 @@ pipe_poll(struct file *filp, poll_table
48460 mask = 0;
48461 if (filp->f_mode & FMODE_READ) {
48462 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
48463 - if (!pipe->writers && filp->f_version != pipe->w_counter)
48464 + if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
48465 mask |= POLLHUP;
48466 }
48467
48468 @@ -676,7 +676,7 @@ pipe_poll(struct file *filp, poll_table
48469 * Most Unices do not set POLLERR for FIFOs but on Linux they
48470 * behave exactly like pipes for poll().
48471 */
48472 - if (!pipe->readers)
48473 + if (!atomic_read(&pipe->readers))
48474 mask |= POLLERR;
48475 }
48476
48477 @@ -690,10 +690,10 @@ pipe_release(struct inode *inode, int de
48478
48479 mutex_lock(&inode->i_mutex);
48480 pipe = inode->i_pipe;
48481 - pipe->readers -= decr;
48482 - pipe->writers -= decw;
48483 + atomic_sub(decr, &pipe->readers);
48484 + atomic_sub(decw, &pipe->writers);
48485
48486 - if (!pipe->readers && !pipe->writers) {
48487 + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
48488 free_pipe_info(inode);
48489 } else {
48490 wake_up_interruptible_sync(&pipe->wait);
48491 @@ -783,7 +783,7 @@ pipe_read_open(struct inode *inode, stru
48492
48493 if (inode->i_pipe) {
48494 ret = 0;
48495 - inode->i_pipe->readers++;
48496 + atomic_inc(&inode->i_pipe->readers);
48497 }
48498
48499 mutex_unlock(&inode->i_mutex);
48500 @@ -800,7 +800,7 @@ pipe_write_open(struct inode *inode, str
48501
48502 if (inode->i_pipe) {
48503 ret = 0;
48504 - inode->i_pipe->writers++;
48505 + atomic_inc(&inode->i_pipe->writers);
48506 }
48507
48508 mutex_unlock(&inode->i_mutex);
48509 @@ -818,9 +818,9 @@ pipe_rdwr_open(struct inode *inode, stru
48510 if (inode->i_pipe) {
48511 ret = 0;
48512 if (filp->f_mode & FMODE_READ)
48513 - inode->i_pipe->readers++;
48514 + atomic_inc(&inode->i_pipe->readers);
48515 if (filp->f_mode & FMODE_WRITE)
48516 - inode->i_pipe->writers++;
48517 + atomic_inc(&inode->i_pipe->writers);
48518 }
48519
48520 mutex_unlock(&inode->i_mutex);
48521 @@ -905,7 +905,7 @@ void free_pipe_info(struct inode *inode)
48522 inode->i_pipe = NULL;
48523 }
48524
48525 -static struct vfsmount *pipe_mnt __read_mostly;
48526 +struct vfsmount *pipe_mnt __read_mostly;
48527 static int pipefs_delete_dentry(struct dentry *dentry)
48528 {
48529 /*
48530 @@ -945,7 +945,8 @@ static struct inode * get_pipe_inode(voi
48531 goto fail_iput;
48532 inode->i_pipe = pipe;
48533
48534 - pipe->readers = pipe->writers = 1;
48535 + atomic_set(&pipe->readers, 1);
48536 + atomic_set(&pipe->writers, 1);
48537 inode->i_fop = &rdwr_pipefifo_fops;
48538
48539 /*
48540 diff -urNp linux-2.6.32.46/fs/proc/array.c linux-2.6.32.46/fs/proc/array.c
48541 --- linux-2.6.32.46/fs/proc/array.c 2011-03-27 14:31:47.000000000 -0400
48542 +++ linux-2.6.32.46/fs/proc/array.c 2011-05-16 21:46:57.000000000 -0400
48543 @@ -60,6 +60,7 @@
48544 #include <linux/tty.h>
48545 #include <linux/string.h>
48546 #include <linux/mman.h>
48547 +#include <linux/grsecurity.h>
48548 #include <linux/proc_fs.h>
48549 #include <linux/ioport.h>
48550 #include <linux/uaccess.h>
48551 @@ -321,6 +322,21 @@ static inline void task_context_switch_c
48552 p->nivcsw);
48553 }
48554
48555 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
48556 +static inline void task_pax(struct seq_file *m, struct task_struct *p)
48557 +{
48558 + if (p->mm)
48559 + seq_printf(m, "PaX:\t%c%c%c%c%c\n",
48560 + p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
48561 + p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
48562 + p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
48563 + p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
48564 + p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
48565 + else
48566 + seq_printf(m, "PaX:\t-----\n");
48567 +}
48568 +#endif
48569 +
48570 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
48571 struct pid *pid, struct task_struct *task)
48572 {
48573 @@ -337,9 +353,24 @@ int proc_pid_status(struct seq_file *m,
48574 task_cap(m, task);
48575 cpuset_task_status_allowed(m, task);
48576 task_context_switch_counts(m, task);
48577 +
48578 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
48579 + task_pax(m, task);
48580 +#endif
48581 +
48582 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
48583 + task_grsec_rbac(m, task);
48584 +#endif
48585 +
48586 return 0;
48587 }
48588
48589 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48590 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
48591 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
48592 + _mm->pax_flags & MF_PAX_SEGMEXEC))
48593 +#endif
48594 +
48595 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
48596 struct pid *pid, struct task_struct *task, int whole)
48597 {
48598 @@ -358,9 +389,11 @@ static int do_task_stat(struct seq_file
48599 cputime_t cutime, cstime, utime, stime;
48600 cputime_t cgtime, gtime;
48601 unsigned long rsslim = 0;
48602 - char tcomm[sizeof(task->comm)];
48603 + char tcomm[sizeof(task->comm)] = { 0 };
48604 unsigned long flags;
48605
48606 + pax_track_stack();
48607 +
48608 state = *get_task_state(task);
48609 vsize = eip = esp = 0;
48610 permitted = ptrace_may_access(task, PTRACE_MODE_READ);
48611 @@ -433,6 +466,19 @@ static int do_task_stat(struct seq_file
48612 gtime = task_gtime(task);
48613 }
48614
48615 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48616 + if (PAX_RAND_FLAGS(mm)) {
48617 + eip = 0;
48618 + esp = 0;
48619 + wchan = 0;
48620 + }
48621 +#endif
48622 +#ifdef CONFIG_GRKERNSEC_HIDESYM
48623 + wchan = 0;
48624 + eip =0;
48625 + esp =0;
48626 +#endif
48627 +
48628 /* scale priority and nice values from timeslices to -20..20 */
48629 /* to make it look like a "normal" Unix priority/nice value */
48630 priority = task_prio(task);
48631 @@ -473,9 +519,15 @@ static int do_task_stat(struct seq_file
48632 vsize,
48633 mm ? get_mm_rss(mm) : 0,
48634 rsslim,
48635 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48636 + PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
48637 + PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
48638 + PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
48639 +#else
48640 mm ? (permitted ? mm->start_code : 1) : 0,
48641 mm ? (permitted ? mm->end_code : 1) : 0,
48642 (permitted && mm) ? mm->start_stack : 0,
48643 +#endif
48644 esp,
48645 eip,
48646 /* The signal information here is obsolete.
48647 @@ -528,3 +580,18 @@ int proc_pid_statm(struct seq_file *m, s
48648
48649 return 0;
48650 }
48651 +
48652 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
48653 +int proc_pid_ipaddr(struct task_struct *task, char *buffer)
48654 +{
48655 + u32 curr_ip = 0;
48656 + unsigned long flags;
48657 +
48658 + if (lock_task_sighand(task, &flags)) {
48659 + curr_ip = task->signal->curr_ip;
48660 + unlock_task_sighand(task, &flags);
48661 + }
48662 +
48663 + return sprintf(buffer, "%pI4\n", &curr_ip);
48664 +}
48665 +#endif
48666 diff -urNp linux-2.6.32.46/fs/proc/base.c linux-2.6.32.46/fs/proc/base.c
48667 --- linux-2.6.32.46/fs/proc/base.c 2011-08-09 18:35:30.000000000 -0400
48668 +++ linux-2.6.32.46/fs/proc/base.c 2011-10-19 04:05:03.000000000 -0400
48669 @@ -102,6 +102,22 @@ struct pid_entry {
48670 union proc_op op;
48671 };
48672
48673 +struct getdents_callback {
48674 + struct linux_dirent __user * current_dir;
48675 + struct linux_dirent __user * previous;
48676 + struct file * file;
48677 + int count;
48678 + int error;
48679 +};
48680 +
48681 +static int gr_fake_filldir(void * __buf, const char *name, int namlen,
48682 + loff_t offset, u64 ino, unsigned int d_type)
48683 +{
48684 + struct getdents_callback * buf = (struct getdents_callback *) __buf;
48685 + buf->error = -EINVAL;
48686 + return 0;
48687 +}
48688 +
48689 #define NOD(NAME, MODE, IOP, FOP, OP) { \
48690 .name = (NAME), \
48691 .len = sizeof(NAME) - 1, \
48692 @@ -213,6 +229,9 @@ static int check_mem_permission(struct t
48693 if (task == current)
48694 return 0;
48695
48696 + if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
48697 + return -EPERM;
48698 +
48699 /*
48700 * If current is actively ptrace'ing, and would also be
48701 * permitted to freshly attach with ptrace now, permit it.
48702 @@ -260,6 +279,9 @@ static int proc_pid_cmdline(struct task_
48703 if (!mm->arg_end)
48704 goto out_mm; /* Shh! No looking before we're done */
48705
48706 + if (gr_acl_handle_procpidmem(task))
48707 + goto out_mm;
48708 +
48709 len = mm->arg_end - mm->arg_start;
48710
48711 if (len > PAGE_SIZE)
48712 @@ -287,12 +309,28 @@ out:
48713 return res;
48714 }
48715
48716 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48717 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
48718 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
48719 + _mm->pax_flags & MF_PAX_SEGMEXEC))
48720 +#endif
48721 +
48722 static int proc_pid_auxv(struct task_struct *task, char *buffer)
48723 {
48724 int res = 0;
48725 struct mm_struct *mm = get_task_mm(task);
48726 if (mm) {
48727 unsigned int nwords = 0;
48728 +
48729 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48730 + /* allow if we're currently ptracing this task */
48731 + if (PAX_RAND_FLAGS(mm) &&
48732 + (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
48733 + mmput(mm);
48734 + return 0;
48735 + }
48736 +#endif
48737 +
48738 do {
48739 nwords += 2;
48740 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
48741 @@ -306,7 +344,7 @@ static int proc_pid_auxv(struct task_str
48742 }
48743
48744
48745 -#ifdef CONFIG_KALLSYMS
48746 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48747 /*
48748 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
48749 * Returns the resolved symbol. If that fails, simply return the address.
48750 @@ -328,7 +366,7 @@ static int proc_pid_wchan(struct task_st
48751 }
48752 #endif /* CONFIG_KALLSYMS */
48753
48754 -#ifdef CONFIG_STACKTRACE
48755 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48756
48757 #define MAX_STACK_TRACE_DEPTH 64
48758
48759 @@ -522,7 +560,7 @@ static int proc_pid_limits(struct task_s
48760 return count;
48761 }
48762
48763 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
48764 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
48765 static int proc_pid_syscall(struct task_struct *task, char *buffer)
48766 {
48767 long nr;
48768 @@ -547,7 +585,7 @@ static int proc_pid_syscall(struct task_
48769 /************************************************************************/
48770
48771 /* permission checks */
48772 -static int proc_fd_access_allowed(struct inode *inode)
48773 +static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
48774 {
48775 struct task_struct *task;
48776 int allowed = 0;
48777 @@ -557,7 +595,10 @@ static int proc_fd_access_allowed(struct
48778 */
48779 task = get_proc_task(inode);
48780 if (task) {
48781 - allowed = ptrace_may_access(task, PTRACE_MODE_READ);
48782 + if (log)
48783 + allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
48784 + else
48785 + allowed = ptrace_may_access(task, PTRACE_MODE_READ);
48786 put_task_struct(task);
48787 }
48788 return allowed;
48789 @@ -936,6 +977,9 @@ static ssize_t environ_read(struct file
48790 if (!task)
48791 goto out_no_task;
48792
48793 + if (gr_acl_handle_procpidmem(task))
48794 + goto out;
48795 +
48796 if (!ptrace_may_access(task, PTRACE_MODE_READ))
48797 goto out;
48798
48799 @@ -1350,7 +1394,7 @@ static void *proc_pid_follow_link(struct
48800 path_put(&nd->path);
48801
48802 /* Are we allowed to snoop on the tasks file descriptors? */
48803 - if (!proc_fd_access_allowed(inode))
48804 + if (!proc_fd_access_allowed(inode,0))
48805 goto out;
48806
48807 error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
48808 @@ -1390,8 +1434,18 @@ static int proc_pid_readlink(struct dent
48809 struct path path;
48810
48811 /* Are we allowed to snoop on the tasks file descriptors? */
48812 - if (!proc_fd_access_allowed(inode))
48813 - goto out;
48814 + /* logging this is needed for learning on chromium to work properly,
48815 + but we don't want to flood the logs from 'ps' which does a readlink
48816 + on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
48817 + CAP_SYS_PTRACE as it's not necessary for its basic functionality
48818 + */
48819 + if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
48820 + if (!proc_fd_access_allowed(inode,0))
48821 + goto out;
48822 + } else {
48823 + if (!proc_fd_access_allowed(inode,1))
48824 + goto out;
48825 + }
48826
48827 error = PROC_I(inode)->op.proc_get_link(inode, &path);
48828 if (error)
48829 @@ -1456,7 +1510,11 @@ static struct inode *proc_pid_make_inode
48830 rcu_read_lock();
48831 cred = __task_cred(task);
48832 inode->i_uid = cred->euid;
48833 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48834 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48835 +#else
48836 inode->i_gid = cred->egid;
48837 +#endif
48838 rcu_read_unlock();
48839 }
48840 security_task_to_inode(task, inode);
48841 @@ -1474,6 +1532,9 @@ static int pid_getattr(struct vfsmount *
48842 struct inode *inode = dentry->d_inode;
48843 struct task_struct *task;
48844 const struct cred *cred;
48845 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48846 + const struct cred *tmpcred = current_cred();
48847 +#endif
48848
48849 generic_fillattr(inode, stat);
48850
48851 @@ -1481,13 +1542,41 @@ static int pid_getattr(struct vfsmount *
48852 stat->uid = 0;
48853 stat->gid = 0;
48854 task = pid_task(proc_pid(inode), PIDTYPE_PID);
48855 +
48856 + if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
48857 + rcu_read_unlock();
48858 + return -ENOENT;
48859 + }
48860 +
48861 if (task) {
48862 + cred = __task_cred(task);
48863 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48864 + if (!tmpcred->uid || (tmpcred->uid == cred->uid)
48865 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48866 + || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
48867 +#endif
48868 + ) {
48869 +#endif
48870 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
48871 +#ifdef CONFIG_GRKERNSEC_PROC_USER
48872 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
48873 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48874 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
48875 +#endif
48876 task_dumpable(task)) {
48877 - cred = __task_cred(task);
48878 stat->uid = cred->euid;
48879 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48880 + stat->gid = CONFIG_GRKERNSEC_PROC_GID;
48881 +#else
48882 stat->gid = cred->egid;
48883 +#endif
48884 }
48885 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48886 + } else {
48887 + rcu_read_unlock();
48888 + return -ENOENT;
48889 + }
48890 +#endif
48891 }
48892 rcu_read_unlock();
48893 return 0;
48894 @@ -1518,11 +1607,20 @@ static int pid_revalidate(struct dentry
48895
48896 if (task) {
48897 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
48898 +#ifdef CONFIG_GRKERNSEC_PROC_USER
48899 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
48900 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48901 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
48902 +#endif
48903 task_dumpable(task)) {
48904 rcu_read_lock();
48905 cred = __task_cred(task);
48906 inode->i_uid = cred->euid;
48907 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48908 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48909 +#else
48910 inode->i_gid = cred->egid;
48911 +#endif
48912 rcu_read_unlock();
48913 } else {
48914 inode->i_uid = 0;
48915 @@ -1643,7 +1741,8 @@ static int proc_fd_info(struct inode *in
48916 int fd = proc_fd(inode);
48917
48918 if (task) {
48919 - files = get_files_struct(task);
48920 + if (!gr_acl_handle_procpidmem(task))
48921 + files = get_files_struct(task);
48922 put_task_struct(task);
48923 }
48924 if (files) {
48925 @@ -1895,12 +1994,22 @@ static const struct file_operations proc
48926 static int proc_fd_permission(struct inode *inode, int mask)
48927 {
48928 int rv;
48929 + struct task_struct *task;
48930
48931 rv = generic_permission(inode, mask, NULL);
48932 - if (rv == 0)
48933 - return 0;
48934 +
48935 if (task_pid(current) == proc_pid(inode))
48936 rv = 0;
48937 +
48938 + task = get_proc_task(inode);
48939 + if (task == NULL)
48940 + return rv;
48941 +
48942 + if (gr_acl_handle_procpidmem(task))
48943 + rv = -EACCES;
48944 +
48945 + put_task_struct(task);
48946 +
48947 return rv;
48948 }
48949
48950 @@ -2009,6 +2118,9 @@ static struct dentry *proc_pident_lookup
48951 if (!task)
48952 goto out_no_task;
48953
48954 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48955 + goto out;
48956 +
48957 /*
48958 * Yes, it does not scale. And it should not. Don't add
48959 * new entries into /proc/<tgid>/ without very good reasons.
48960 @@ -2053,6 +2165,9 @@ static int proc_pident_readdir(struct fi
48961 if (!task)
48962 goto out_no_task;
48963
48964 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48965 + goto out;
48966 +
48967 ret = 0;
48968 i = filp->f_pos;
48969 switch (i) {
48970 @@ -2320,7 +2435,7 @@ static void *proc_self_follow_link(struc
48971 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
48972 void *cookie)
48973 {
48974 - char *s = nd_get_link(nd);
48975 + const char *s = nd_get_link(nd);
48976 if (!IS_ERR(s))
48977 __putname(s);
48978 }
48979 @@ -2522,7 +2637,7 @@ static const struct pid_entry tgid_base_
48980 #ifdef CONFIG_SCHED_DEBUG
48981 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
48982 #endif
48983 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
48984 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
48985 INF("syscall", S_IRUSR, proc_pid_syscall),
48986 #endif
48987 INF("cmdline", S_IRUGO, proc_pid_cmdline),
48988 @@ -2547,10 +2662,10 @@ static const struct pid_entry tgid_base_
48989 #ifdef CONFIG_SECURITY
48990 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
48991 #endif
48992 -#ifdef CONFIG_KALLSYMS
48993 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48994 INF("wchan", S_IRUGO, proc_pid_wchan),
48995 #endif
48996 -#ifdef CONFIG_STACKTRACE
48997 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48998 ONE("stack", S_IRUSR, proc_pid_stack),
48999 #endif
49000 #ifdef CONFIG_SCHEDSTATS
49001 @@ -2580,6 +2695,9 @@ static const struct pid_entry tgid_base_
49002 #ifdef CONFIG_TASK_IO_ACCOUNTING
49003 INF("io", S_IRUSR, proc_tgid_io_accounting),
49004 #endif
49005 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49006 + INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
49007 +#endif
49008 };
49009
49010 static int proc_tgid_base_readdir(struct file * filp,
49011 @@ -2704,7 +2822,14 @@ static struct dentry *proc_pid_instantia
49012 if (!inode)
49013 goto out;
49014
49015 +#ifdef CONFIG_GRKERNSEC_PROC_USER
49016 + inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
49017 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49018 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49019 + inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
49020 +#else
49021 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
49022 +#endif
49023 inode->i_op = &proc_tgid_base_inode_operations;
49024 inode->i_fop = &proc_tgid_base_operations;
49025 inode->i_flags|=S_IMMUTABLE;
49026 @@ -2746,7 +2871,14 @@ struct dentry *proc_pid_lookup(struct in
49027 if (!task)
49028 goto out;
49029
49030 + if (!has_group_leader_pid(task))
49031 + goto out_put_task;
49032 +
49033 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
49034 + goto out_put_task;
49035 +
49036 result = proc_pid_instantiate(dir, dentry, task, NULL);
49037 +out_put_task:
49038 put_task_struct(task);
49039 out:
49040 return result;
49041 @@ -2811,6 +2943,11 @@ int proc_pid_readdir(struct file * filp,
49042 {
49043 unsigned int nr;
49044 struct task_struct *reaper;
49045 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49046 + const struct cred *tmpcred = current_cred();
49047 + const struct cred *itercred;
49048 +#endif
49049 + filldir_t __filldir = filldir;
49050 struct tgid_iter iter;
49051 struct pid_namespace *ns;
49052
49053 @@ -2834,8 +2971,27 @@ int proc_pid_readdir(struct file * filp,
49054 for (iter = next_tgid(ns, iter);
49055 iter.task;
49056 iter.tgid += 1, iter = next_tgid(ns, iter)) {
49057 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49058 + rcu_read_lock();
49059 + itercred = __task_cred(iter.task);
49060 +#endif
49061 + if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
49062 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49063 + || (tmpcred->uid && (itercred->uid != tmpcred->uid)
49064 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49065 + && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
49066 +#endif
49067 + )
49068 +#endif
49069 + )
49070 + __filldir = &gr_fake_filldir;
49071 + else
49072 + __filldir = filldir;
49073 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49074 + rcu_read_unlock();
49075 +#endif
49076 filp->f_pos = iter.tgid + TGID_OFFSET;
49077 - if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
49078 + if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
49079 put_task_struct(iter.task);
49080 goto out;
49081 }
49082 @@ -2861,7 +3017,7 @@ static const struct pid_entry tid_base_s
49083 #ifdef CONFIG_SCHED_DEBUG
49084 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
49085 #endif
49086 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
49087 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
49088 INF("syscall", S_IRUSR, proc_pid_syscall),
49089 #endif
49090 INF("cmdline", S_IRUGO, proc_pid_cmdline),
49091 @@ -2885,10 +3041,10 @@ static const struct pid_entry tid_base_s
49092 #ifdef CONFIG_SECURITY
49093 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
49094 #endif
49095 -#ifdef CONFIG_KALLSYMS
49096 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49097 INF("wchan", S_IRUGO, proc_pid_wchan),
49098 #endif
49099 -#ifdef CONFIG_STACKTRACE
49100 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49101 ONE("stack", S_IRUSR, proc_pid_stack),
49102 #endif
49103 #ifdef CONFIG_SCHEDSTATS
49104 diff -urNp linux-2.6.32.46/fs/proc/cmdline.c linux-2.6.32.46/fs/proc/cmdline.c
49105 --- linux-2.6.32.46/fs/proc/cmdline.c 2011-03-27 14:31:47.000000000 -0400
49106 +++ linux-2.6.32.46/fs/proc/cmdline.c 2011-04-17 15:56:46.000000000 -0400
49107 @@ -23,7 +23,11 @@ static const struct file_operations cmdl
49108
49109 static int __init proc_cmdline_init(void)
49110 {
49111 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
49112 + proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
49113 +#else
49114 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
49115 +#endif
49116 return 0;
49117 }
49118 module_init(proc_cmdline_init);
49119 diff -urNp linux-2.6.32.46/fs/proc/devices.c linux-2.6.32.46/fs/proc/devices.c
49120 --- linux-2.6.32.46/fs/proc/devices.c 2011-03-27 14:31:47.000000000 -0400
49121 +++ linux-2.6.32.46/fs/proc/devices.c 2011-04-17 15:56:46.000000000 -0400
49122 @@ -64,7 +64,11 @@ static const struct file_operations proc
49123
49124 static int __init proc_devices_init(void)
49125 {
49126 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
49127 + proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
49128 +#else
49129 proc_create("devices", 0, NULL, &proc_devinfo_operations);
49130 +#endif
49131 return 0;
49132 }
49133 module_init(proc_devices_init);
49134 diff -urNp linux-2.6.32.46/fs/proc/inode.c linux-2.6.32.46/fs/proc/inode.c
49135 --- linux-2.6.32.46/fs/proc/inode.c 2011-03-27 14:31:47.000000000 -0400
49136 +++ linux-2.6.32.46/fs/proc/inode.c 2011-10-19 04:08:02.000000000 -0400
49137 @@ -18,12 +18,19 @@
49138 #include <linux/module.h>
49139 #include <linux/smp_lock.h>
49140 #include <linux/sysctl.h>
49141 +#include <linux/grsecurity.h>
49142
49143 #include <asm/system.h>
49144 #include <asm/uaccess.h>
49145
49146 #include "internal.h"
49147
49148 +#ifdef CONFIG_PROC_SYSCTL
49149 +extern const struct inode_operations proc_sys_inode_operations;
49150 +extern const struct inode_operations proc_sys_dir_operations;
49151 +#endif
49152 +
49153 +
49154 struct proc_dir_entry *de_get(struct proc_dir_entry *de)
49155 {
49156 atomic_inc(&de->count);
49157 @@ -62,6 +69,13 @@ static void proc_delete_inode(struct ino
49158 de_put(de);
49159 if (PROC_I(inode)->sysctl)
49160 sysctl_head_put(PROC_I(inode)->sysctl);
49161 +
49162 +#ifdef CONFIG_PROC_SYSCTL
49163 + if (inode->i_op == &proc_sys_inode_operations ||
49164 + inode->i_op == &proc_sys_dir_operations)
49165 + gr_handle_delete(inode->i_ino, inode->i_sb->s_dev);
49166 +#endif
49167 +
49168 clear_inode(inode);
49169 }
49170
49171 @@ -457,7 +471,11 @@ struct inode *proc_get_inode(struct supe
49172 if (de->mode) {
49173 inode->i_mode = de->mode;
49174 inode->i_uid = de->uid;
49175 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49176 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49177 +#else
49178 inode->i_gid = de->gid;
49179 +#endif
49180 }
49181 if (de->size)
49182 inode->i_size = de->size;
49183 diff -urNp linux-2.6.32.46/fs/proc/internal.h linux-2.6.32.46/fs/proc/internal.h
49184 --- linux-2.6.32.46/fs/proc/internal.h 2011-03-27 14:31:47.000000000 -0400
49185 +++ linux-2.6.32.46/fs/proc/internal.h 2011-04-17 15:56:46.000000000 -0400
49186 @@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
49187 struct pid *pid, struct task_struct *task);
49188 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
49189 struct pid *pid, struct task_struct *task);
49190 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49191 +extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
49192 +#endif
49193 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
49194
49195 extern const struct file_operations proc_maps_operations;
49196 diff -urNp linux-2.6.32.46/fs/proc/Kconfig linux-2.6.32.46/fs/proc/Kconfig
49197 --- linux-2.6.32.46/fs/proc/Kconfig 2011-03-27 14:31:47.000000000 -0400
49198 +++ linux-2.6.32.46/fs/proc/Kconfig 2011-04-17 15:56:46.000000000 -0400
49199 @@ -30,12 +30,12 @@ config PROC_FS
49200
49201 config PROC_KCORE
49202 bool "/proc/kcore support" if !ARM
49203 - depends on PROC_FS && MMU
49204 + depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
49205
49206 config PROC_VMCORE
49207 bool "/proc/vmcore support (EXPERIMENTAL)"
49208 - depends on PROC_FS && CRASH_DUMP
49209 - default y
49210 + depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
49211 + default n
49212 help
49213 Exports the dump image of crashed kernel in ELF format.
49214
49215 @@ -59,8 +59,8 @@ config PROC_SYSCTL
49216 limited in memory.
49217
49218 config PROC_PAGE_MONITOR
49219 - default y
49220 - depends on PROC_FS && MMU
49221 + default n
49222 + depends on PROC_FS && MMU && !GRKERNSEC
49223 bool "Enable /proc page monitoring" if EMBEDDED
49224 help
49225 Various /proc files exist to monitor process memory utilization:
49226 diff -urNp linux-2.6.32.46/fs/proc/kcore.c linux-2.6.32.46/fs/proc/kcore.c
49227 --- linux-2.6.32.46/fs/proc/kcore.c 2011-03-27 14:31:47.000000000 -0400
49228 +++ linux-2.6.32.46/fs/proc/kcore.c 2011-05-16 21:46:57.000000000 -0400
49229 @@ -320,6 +320,8 @@ static void elf_kcore_store_hdr(char *bu
49230 off_t offset = 0;
49231 struct kcore_list *m;
49232
49233 + pax_track_stack();
49234 +
49235 /* setup ELF header */
49236 elf = (struct elfhdr *) bufp;
49237 bufp += sizeof(struct elfhdr);
49238 @@ -477,9 +479,10 @@ read_kcore(struct file *file, char __use
49239 * the addresses in the elf_phdr on our list.
49240 */
49241 start = kc_offset_to_vaddr(*fpos - elf_buflen);
49242 - if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
49243 + tsz = PAGE_SIZE - (start & ~PAGE_MASK);
49244 + if (tsz > buflen)
49245 tsz = buflen;
49246 -
49247 +
49248 while (buflen) {
49249 struct kcore_list *m;
49250
49251 @@ -508,20 +511,23 @@ read_kcore(struct file *file, char __use
49252 kfree(elf_buf);
49253 } else {
49254 if (kern_addr_valid(start)) {
49255 - unsigned long n;
49256 + char *elf_buf;
49257 + mm_segment_t oldfs;
49258
49259 - n = copy_to_user(buffer, (char *)start, tsz);
49260 - /*
49261 - * We cannot distingush between fault on source
49262 - * and fault on destination. When this happens
49263 - * we clear too and hope it will trigger the
49264 - * EFAULT again.
49265 - */
49266 - if (n) {
49267 - if (clear_user(buffer + tsz - n,
49268 - n))
49269 + elf_buf = kmalloc(tsz, GFP_KERNEL);
49270 + if (!elf_buf)
49271 + return -ENOMEM;
49272 + oldfs = get_fs();
49273 + set_fs(KERNEL_DS);
49274 + if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
49275 + set_fs(oldfs);
49276 + if (copy_to_user(buffer, elf_buf, tsz)) {
49277 + kfree(elf_buf);
49278 return -EFAULT;
49279 + }
49280 }
49281 + set_fs(oldfs);
49282 + kfree(elf_buf);
49283 } else {
49284 if (clear_user(buffer, tsz))
49285 return -EFAULT;
49286 @@ -541,6 +547,9 @@ read_kcore(struct file *file, char __use
49287
49288 static int open_kcore(struct inode *inode, struct file *filp)
49289 {
49290 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
49291 + return -EPERM;
49292 +#endif
49293 if (!capable(CAP_SYS_RAWIO))
49294 return -EPERM;
49295 if (kcore_need_update)
49296 diff -urNp linux-2.6.32.46/fs/proc/meminfo.c linux-2.6.32.46/fs/proc/meminfo.c
49297 --- linux-2.6.32.46/fs/proc/meminfo.c 2011-03-27 14:31:47.000000000 -0400
49298 +++ linux-2.6.32.46/fs/proc/meminfo.c 2011-05-16 21:46:57.000000000 -0400
49299 @@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_
49300 unsigned long pages[NR_LRU_LISTS];
49301 int lru;
49302
49303 + pax_track_stack();
49304 +
49305 /*
49306 * display in kilobytes.
49307 */
49308 @@ -149,7 +151,7 @@ static int meminfo_proc_show(struct seq_
49309 vmi.used >> 10,
49310 vmi.largest_chunk >> 10
49311 #ifdef CONFIG_MEMORY_FAILURE
49312 - ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
49313 + ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
49314 #endif
49315 );
49316
49317 diff -urNp linux-2.6.32.46/fs/proc/nommu.c linux-2.6.32.46/fs/proc/nommu.c
49318 --- linux-2.6.32.46/fs/proc/nommu.c 2011-03-27 14:31:47.000000000 -0400
49319 +++ linux-2.6.32.46/fs/proc/nommu.c 2011-04-17 15:56:46.000000000 -0400
49320 @@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_
49321 if (len < 1)
49322 len = 1;
49323 seq_printf(m, "%*c", len, ' ');
49324 - seq_path(m, &file->f_path, "");
49325 + seq_path(m, &file->f_path, "\n\\");
49326 }
49327
49328 seq_putc(m, '\n');
49329 diff -urNp linux-2.6.32.46/fs/proc/proc_net.c linux-2.6.32.46/fs/proc/proc_net.c
49330 --- linux-2.6.32.46/fs/proc/proc_net.c 2011-03-27 14:31:47.000000000 -0400
49331 +++ linux-2.6.32.46/fs/proc/proc_net.c 2011-04-17 15:56:46.000000000 -0400
49332 @@ -104,6 +104,17 @@ static struct net *get_proc_task_net(str
49333 struct task_struct *task;
49334 struct nsproxy *ns;
49335 struct net *net = NULL;
49336 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49337 + const struct cred *cred = current_cred();
49338 +#endif
49339 +
49340 +#ifdef CONFIG_GRKERNSEC_PROC_USER
49341 + if (cred->fsuid)
49342 + return net;
49343 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49344 + if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
49345 + return net;
49346 +#endif
49347
49348 rcu_read_lock();
49349 task = pid_task(proc_pid(dir), PIDTYPE_PID);
49350 diff -urNp linux-2.6.32.46/fs/proc/proc_sysctl.c linux-2.6.32.46/fs/proc/proc_sysctl.c
49351 --- linux-2.6.32.46/fs/proc/proc_sysctl.c 2011-03-27 14:31:47.000000000 -0400
49352 +++ linux-2.6.32.46/fs/proc/proc_sysctl.c 2011-10-19 04:08:51.000000000 -0400
49353 @@ -7,11 +7,13 @@
49354 #include <linux/security.h>
49355 #include "internal.h"
49356
49357 +extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
49358 +
49359 static const struct dentry_operations proc_sys_dentry_operations;
49360 static const struct file_operations proc_sys_file_operations;
49361 -static const struct inode_operations proc_sys_inode_operations;
49362 +const struct inode_operations proc_sys_inode_operations;
49363 static const struct file_operations proc_sys_dir_file_operations;
49364 -static const struct inode_operations proc_sys_dir_operations;
49365 +const struct inode_operations proc_sys_dir_operations;
49366
49367 static struct inode *proc_sys_make_inode(struct super_block *sb,
49368 struct ctl_table_header *head, struct ctl_table *table)
49369 @@ -109,6 +111,9 @@ static struct dentry *proc_sys_lookup(st
49370 if (!p)
49371 goto out;
49372
49373 + if (gr_handle_sysctl(p, MAY_EXEC))
49374 + goto out;
49375 +
49376 err = ERR_PTR(-ENOMEM);
49377 inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
49378 if (h)
49379 @@ -119,6 +124,9 @@ static struct dentry *proc_sys_lookup(st
49380
49381 err = NULL;
49382 dentry->d_op = &proc_sys_dentry_operations;
49383 +
49384 + gr_handle_proc_create(dentry, inode);
49385 +
49386 d_add(dentry, inode);
49387
49388 out:
49389 @@ -200,6 +208,9 @@ static int proc_sys_fill_cache(struct fi
49390 return -ENOMEM;
49391 } else {
49392 child->d_op = &proc_sys_dentry_operations;
49393 +
49394 + gr_handle_proc_create(child, inode);
49395 +
49396 d_add(child, inode);
49397 }
49398 } else {
49399 @@ -228,6 +239,9 @@ static int scan(struct ctl_table_header
49400 if (*pos < file->f_pos)
49401 continue;
49402
49403 + if (gr_handle_sysctl(table, 0))
49404 + continue;
49405 +
49406 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
49407 if (res)
49408 return res;
49409 @@ -344,6 +358,9 @@ static int proc_sys_getattr(struct vfsmo
49410 if (IS_ERR(head))
49411 return PTR_ERR(head);
49412
49413 + if (table && gr_handle_sysctl(table, MAY_EXEC))
49414 + return -ENOENT;
49415 +
49416 generic_fillattr(inode, stat);
49417 if (table)
49418 stat->mode = (stat->mode & S_IFMT) | table->mode;
49419 @@ -362,13 +379,13 @@ static const struct file_operations proc
49420 .llseek = generic_file_llseek,
49421 };
49422
49423 -static const struct inode_operations proc_sys_inode_operations = {
49424 +const struct inode_operations proc_sys_inode_operations = {
49425 .permission = proc_sys_permission,
49426 .setattr = proc_sys_setattr,
49427 .getattr = proc_sys_getattr,
49428 };
49429
49430 -static const struct inode_operations proc_sys_dir_operations = {
49431 +const struct inode_operations proc_sys_dir_operations = {
49432 .lookup = proc_sys_lookup,
49433 .permission = proc_sys_permission,
49434 .setattr = proc_sys_setattr,
49435 diff -urNp linux-2.6.32.46/fs/proc/root.c linux-2.6.32.46/fs/proc/root.c
49436 --- linux-2.6.32.46/fs/proc/root.c 2011-03-27 14:31:47.000000000 -0400
49437 +++ linux-2.6.32.46/fs/proc/root.c 2011-04-17 15:56:46.000000000 -0400
49438 @@ -134,7 +134,15 @@ void __init proc_root_init(void)
49439 #ifdef CONFIG_PROC_DEVICETREE
49440 proc_device_tree_init();
49441 #endif
49442 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
49443 +#ifdef CONFIG_GRKERNSEC_PROC_USER
49444 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
49445 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49446 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
49447 +#endif
49448 +#else
49449 proc_mkdir("bus", NULL);
49450 +#endif
49451 proc_sys_init();
49452 }
49453
49454 diff -urNp linux-2.6.32.46/fs/proc/task_mmu.c linux-2.6.32.46/fs/proc/task_mmu.c
49455 --- linux-2.6.32.46/fs/proc/task_mmu.c 2011-03-27 14:31:47.000000000 -0400
49456 +++ linux-2.6.32.46/fs/proc/task_mmu.c 2011-04-23 13:38:09.000000000 -0400
49457 @@ -46,15 +46,26 @@ void task_mem(struct seq_file *m, struct
49458 "VmStk:\t%8lu kB\n"
49459 "VmExe:\t%8lu kB\n"
49460 "VmLib:\t%8lu kB\n"
49461 - "VmPTE:\t%8lu kB\n",
49462 - hiwater_vm << (PAGE_SHIFT-10),
49463 + "VmPTE:\t%8lu kB\n"
49464 +
49465 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
49466 + "CsBase:\t%8lx\nCsLim:\t%8lx\n"
49467 +#endif
49468 +
49469 + ,hiwater_vm << (PAGE_SHIFT-10),
49470 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
49471 mm->locked_vm << (PAGE_SHIFT-10),
49472 hiwater_rss << (PAGE_SHIFT-10),
49473 total_rss << (PAGE_SHIFT-10),
49474 data << (PAGE_SHIFT-10),
49475 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
49476 - (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
49477 + (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
49478 +
49479 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
49480 + , mm->context.user_cs_base, mm->context.user_cs_limit
49481 +#endif
49482 +
49483 + );
49484 }
49485
49486 unsigned long task_vsize(struct mm_struct *mm)
49487 @@ -175,7 +186,8 @@ static void m_stop(struct seq_file *m, v
49488 struct proc_maps_private *priv = m->private;
49489 struct vm_area_struct *vma = v;
49490
49491 - vma_stop(priv, vma);
49492 + if (!IS_ERR(vma))
49493 + vma_stop(priv, vma);
49494 if (priv->task)
49495 put_task_struct(priv->task);
49496 }
49497 @@ -199,6 +211,12 @@ static int do_maps_open(struct inode *in
49498 return ret;
49499 }
49500
49501 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49502 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
49503 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
49504 + _mm->pax_flags & MF_PAX_SEGMEXEC))
49505 +#endif
49506 +
49507 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
49508 {
49509 struct mm_struct *mm = vma->vm_mm;
49510 @@ -206,7 +224,6 @@ static void show_map_vma(struct seq_file
49511 int flags = vma->vm_flags;
49512 unsigned long ino = 0;
49513 unsigned long long pgoff = 0;
49514 - unsigned long start;
49515 dev_t dev = 0;
49516 int len;
49517
49518 @@ -217,20 +234,23 @@ static void show_map_vma(struct seq_file
49519 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
49520 }
49521
49522 - /* We don't show the stack guard page in /proc/maps */
49523 - start = vma->vm_start;
49524 - if (vma->vm_flags & VM_GROWSDOWN)
49525 - if (!vma_stack_continue(vma->vm_prev, vma->vm_start))
49526 - start += PAGE_SIZE;
49527 -
49528 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
49529 - start,
49530 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49531 + PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
49532 + PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
49533 +#else
49534 + vma->vm_start,
49535 vma->vm_end,
49536 +#endif
49537 flags & VM_READ ? 'r' : '-',
49538 flags & VM_WRITE ? 'w' : '-',
49539 flags & VM_EXEC ? 'x' : '-',
49540 flags & VM_MAYSHARE ? 's' : 'p',
49541 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49542 + PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
49543 +#else
49544 pgoff,
49545 +#endif
49546 MAJOR(dev), MINOR(dev), ino, &len);
49547
49548 /*
49549 @@ -239,7 +259,7 @@ static void show_map_vma(struct seq_file
49550 */
49551 if (file) {
49552 pad_len_spaces(m, len);
49553 - seq_path(m, &file->f_path, "\n");
49554 + seq_path(m, &file->f_path, "\n\\");
49555 } else {
49556 const char *name = arch_vma_name(vma);
49557 if (!name) {
49558 @@ -247,8 +267,9 @@ static void show_map_vma(struct seq_file
49559 if (vma->vm_start <= mm->brk &&
49560 vma->vm_end >= mm->start_brk) {
49561 name = "[heap]";
49562 - } else if (vma->vm_start <= mm->start_stack &&
49563 - vma->vm_end >= mm->start_stack) {
49564 + } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
49565 + (vma->vm_start <= mm->start_stack &&
49566 + vma->vm_end >= mm->start_stack)) {
49567 name = "[stack]";
49568 }
49569 } else {
49570 @@ -391,9 +412,16 @@ static int show_smap(struct seq_file *m,
49571 };
49572
49573 memset(&mss, 0, sizeof mss);
49574 - mss.vma = vma;
49575 - if (vma->vm_mm && !is_vm_hugetlb_page(vma))
49576 - walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
49577 +
49578 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49579 + if (!PAX_RAND_FLAGS(vma->vm_mm)) {
49580 +#endif
49581 + mss.vma = vma;
49582 + if (vma->vm_mm && !is_vm_hugetlb_page(vma))
49583 + walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
49584 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49585 + }
49586 +#endif
49587
49588 show_map_vma(m, vma);
49589
49590 @@ -409,7 +437,11 @@ static int show_smap(struct seq_file *m,
49591 "Swap: %8lu kB\n"
49592 "KernelPageSize: %8lu kB\n"
49593 "MMUPageSize: %8lu kB\n",
49594 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49595 + PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
49596 +#else
49597 (vma->vm_end - vma->vm_start) >> 10,
49598 +#endif
49599 mss.resident >> 10,
49600 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
49601 mss.shared_clean >> 10,
49602 diff -urNp linux-2.6.32.46/fs/proc/task_nommu.c linux-2.6.32.46/fs/proc/task_nommu.c
49603 --- linux-2.6.32.46/fs/proc/task_nommu.c 2011-03-27 14:31:47.000000000 -0400
49604 +++ linux-2.6.32.46/fs/proc/task_nommu.c 2011-04-17 15:56:46.000000000 -0400
49605 @@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct
49606 else
49607 bytes += kobjsize(mm);
49608
49609 - if (current->fs && current->fs->users > 1)
49610 + if (current->fs && atomic_read(&current->fs->users) > 1)
49611 sbytes += kobjsize(current->fs);
49612 else
49613 bytes += kobjsize(current->fs);
49614 @@ -154,7 +154,7 @@ static int nommu_vma_show(struct seq_fil
49615 if (len < 1)
49616 len = 1;
49617 seq_printf(m, "%*c", len, ' ');
49618 - seq_path(m, &file->f_path, "");
49619 + seq_path(m, &file->f_path, "\n\\");
49620 }
49621
49622 seq_putc(m, '\n');
49623 diff -urNp linux-2.6.32.46/fs/readdir.c linux-2.6.32.46/fs/readdir.c
49624 --- linux-2.6.32.46/fs/readdir.c 2011-03-27 14:31:47.000000000 -0400
49625 +++ linux-2.6.32.46/fs/readdir.c 2011-10-06 09:37:14.000000000 -0400
49626 @@ -16,6 +16,7 @@
49627 #include <linux/security.h>
49628 #include <linux/syscalls.h>
49629 #include <linux/unistd.h>
49630 +#include <linux/namei.h>
49631
49632 #include <asm/uaccess.h>
49633
49634 @@ -67,6 +68,7 @@ struct old_linux_dirent {
49635
49636 struct readdir_callback {
49637 struct old_linux_dirent __user * dirent;
49638 + struct file * file;
49639 int result;
49640 };
49641
49642 @@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
49643 buf->result = -EOVERFLOW;
49644 return -EOVERFLOW;
49645 }
49646 +
49647 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
49648 + return 0;
49649 +
49650 buf->result++;
49651 dirent = buf->dirent;
49652 if (!access_ok(VERIFY_WRITE, dirent,
49653 @@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
49654
49655 buf.result = 0;
49656 buf.dirent = dirent;
49657 + buf.file = file;
49658
49659 error = vfs_readdir(file, fillonedir, &buf);
49660 if (buf.result)
49661 @@ -142,6 +149,7 @@ struct linux_dirent {
49662 struct getdents_callback {
49663 struct linux_dirent __user * current_dir;
49664 struct linux_dirent __user * previous;
49665 + struct file * file;
49666 int count;
49667 int error;
49668 };
49669 @@ -162,6 +170,10 @@ static int filldir(void * __buf, const c
49670 buf->error = -EOVERFLOW;
49671 return -EOVERFLOW;
49672 }
49673 +
49674 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
49675 + return 0;
49676 +
49677 dirent = buf->previous;
49678 if (dirent) {
49679 if (__put_user(offset, &dirent->d_off))
49680 @@ -209,6 +221,7 @@ SYSCALL_DEFINE3(getdents, unsigned int,
49681 buf.previous = NULL;
49682 buf.count = count;
49683 buf.error = 0;
49684 + buf.file = file;
49685
49686 error = vfs_readdir(file, filldir, &buf);
49687 if (error >= 0)
49688 @@ -228,6 +241,7 @@ out:
49689 struct getdents_callback64 {
49690 struct linux_dirent64 __user * current_dir;
49691 struct linux_dirent64 __user * previous;
49692 + struct file *file;
49693 int count;
49694 int error;
49695 };
49696 @@ -242,6 +256,10 @@ static int filldir64(void * __buf, const
49697 buf->error = -EINVAL; /* only used if we fail.. */
49698 if (reclen > buf->count)
49699 return -EINVAL;
49700 +
49701 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
49702 + return 0;
49703 +
49704 dirent = buf->previous;
49705 if (dirent) {
49706 if (__put_user(offset, &dirent->d_off))
49707 @@ -289,6 +307,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
49708
49709 buf.current_dir = dirent;
49710 buf.previous = NULL;
49711 + buf.file = file;
49712 buf.count = count;
49713 buf.error = 0;
49714
49715 @@ -297,7 +316,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
49716 error = buf.error;
49717 lastdirent = buf.previous;
49718 if (lastdirent) {
49719 - typeof(lastdirent->d_off) d_off = file->f_pos;
49720 + typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
49721 if (__put_user(d_off, &lastdirent->d_off))
49722 error = -EFAULT;
49723 else
49724 diff -urNp linux-2.6.32.46/fs/reiserfs/dir.c linux-2.6.32.46/fs/reiserfs/dir.c
49725 --- linux-2.6.32.46/fs/reiserfs/dir.c 2011-03-27 14:31:47.000000000 -0400
49726 +++ linux-2.6.32.46/fs/reiserfs/dir.c 2011-05-16 21:46:57.000000000 -0400
49727 @@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentr
49728 struct reiserfs_dir_entry de;
49729 int ret = 0;
49730
49731 + pax_track_stack();
49732 +
49733 reiserfs_write_lock(inode->i_sb);
49734
49735 reiserfs_check_lock_depth(inode->i_sb, "readdir");
49736 diff -urNp linux-2.6.32.46/fs/reiserfs/do_balan.c linux-2.6.32.46/fs/reiserfs/do_balan.c
49737 --- linux-2.6.32.46/fs/reiserfs/do_balan.c 2011-03-27 14:31:47.000000000 -0400
49738 +++ linux-2.6.32.46/fs/reiserfs/do_balan.c 2011-04-17 15:56:46.000000000 -0400
49739 @@ -2058,7 +2058,7 @@ void do_balance(struct tree_balance *tb,
49740 return;
49741 }
49742
49743 - atomic_inc(&(fs_generation(tb->tb_sb)));
49744 + atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
49745 do_balance_starts(tb);
49746
49747 /* balance leaf returns 0 except if combining L R and S into
49748 diff -urNp linux-2.6.32.46/fs/reiserfs/item_ops.c linux-2.6.32.46/fs/reiserfs/item_ops.c
49749 --- linux-2.6.32.46/fs/reiserfs/item_ops.c 2011-03-27 14:31:47.000000000 -0400
49750 +++ linux-2.6.32.46/fs/reiserfs/item_ops.c 2011-04-17 15:56:46.000000000 -0400
49751 @@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
49752 vi->vi_index, vi->vi_type, vi->vi_ih);
49753 }
49754
49755 -static struct item_operations stat_data_ops = {
49756 +static const struct item_operations stat_data_ops = {
49757 .bytes_number = sd_bytes_number,
49758 .decrement_key = sd_decrement_key,
49759 .is_left_mergeable = sd_is_left_mergeable,
49760 @@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
49761 vi->vi_index, vi->vi_type, vi->vi_ih);
49762 }
49763
49764 -static struct item_operations direct_ops = {
49765 +static const struct item_operations direct_ops = {
49766 .bytes_number = direct_bytes_number,
49767 .decrement_key = direct_decrement_key,
49768 .is_left_mergeable = direct_is_left_mergeable,
49769 @@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
49770 vi->vi_index, vi->vi_type, vi->vi_ih);
49771 }
49772
49773 -static struct item_operations indirect_ops = {
49774 +static const struct item_operations indirect_ops = {
49775 .bytes_number = indirect_bytes_number,
49776 .decrement_key = indirect_decrement_key,
49777 .is_left_mergeable = indirect_is_left_mergeable,
49778 @@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
49779 printk("\n");
49780 }
49781
49782 -static struct item_operations direntry_ops = {
49783 +static const struct item_operations direntry_ops = {
49784 .bytes_number = direntry_bytes_number,
49785 .decrement_key = direntry_decrement_key,
49786 .is_left_mergeable = direntry_is_left_mergeable,
49787 @@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
49788 "Invalid item type observed, run fsck ASAP");
49789 }
49790
49791 -static struct item_operations errcatch_ops = {
49792 +static const struct item_operations errcatch_ops = {
49793 errcatch_bytes_number,
49794 errcatch_decrement_key,
49795 errcatch_is_left_mergeable,
49796 @@ -746,7 +746,7 @@ static struct item_operations errcatch_o
49797 #error Item types must use disk-format assigned values.
49798 #endif
49799
49800 -struct item_operations *item_ops[TYPE_ANY + 1] = {
49801 +const struct item_operations * const item_ops[TYPE_ANY + 1] = {
49802 &stat_data_ops,
49803 &indirect_ops,
49804 &direct_ops,
49805 diff -urNp linux-2.6.32.46/fs/reiserfs/journal.c linux-2.6.32.46/fs/reiserfs/journal.c
49806 --- linux-2.6.32.46/fs/reiserfs/journal.c 2011-03-27 14:31:47.000000000 -0400
49807 +++ linux-2.6.32.46/fs/reiserfs/journal.c 2011-05-16 21:46:57.000000000 -0400
49808 @@ -2329,6 +2329,8 @@ static struct buffer_head *reiserfs_brea
49809 struct buffer_head *bh;
49810 int i, j;
49811
49812 + pax_track_stack();
49813 +
49814 bh = __getblk(dev, block, bufsize);
49815 if (buffer_uptodate(bh))
49816 return (bh);
49817 diff -urNp linux-2.6.32.46/fs/reiserfs/namei.c linux-2.6.32.46/fs/reiserfs/namei.c
49818 --- linux-2.6.32.46/fs/reiserfs/namei.c 2011-03-27 14:31:47.000000000 -0400
49819 +++ linux-2.6.32.46/fs/reiserfs/namei.c 2011-05-16 21:46:57.000000000 -0400
49820 @@ -1214,6 +1214,8 @@ static int reiserfs_rename(struct inode
49821 unsigned long savelink = 1;
49822 struct timespec ctime;
49823
49824 + pax_track_stack();
49825 +
49826 /* three balancings: (1) old name removal, (2) new name insertion
49827 and (3) maybe "save" link insertion
49828 stat data updates: (1) old directory,
49829 diff -urNp linux-2.6.32.46/fs/reiserfs/procfs.c linux-2.6.32.46/fs/reiserfs/procfs.c
49830 --- linux-2.6.32.46/fs/reiserfs/procfs.c 2011-03-27 14:31:47.000000000 -0400
49831 +++ linux-2.6.32.46/fs/reiserfs/procfs.c 2011-05-16 21:46:57.000000000 -0400
49832 @@ -123,7 +123,7 @@ static int show_super(struct seq_file *m
49833 "SMALL_TAILS " : "NO_TAILS ",
49834 replay_only(sb) ? "REPLAY_ONLY " : "",
49835 convert_reiserfs(sb) ? "CONV " : "",
49836 - atomic_read(&r->s_generation_counter),
49837 + atomic_read_unchecked(&r->s_generation_counter),
49838 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
49839 SF(s_do_balance), SF(s_unneeded_left_neighbor),
49840 SF(s_good_search_by_key_reada), SF(s_bmaps),
49841 @@ -309,6 +309,8 @@ static int show_journal(struct seq_file
49842 struct journal_params *jp = &rs->s_v1.s_journal;
49843 char b[BDEVNAME_SIZE];
49844
49845 + pax_track_stack();
49846 +
49847 seq_printf(m, /* on-disk fields */
49848 "jp_journal_1st_block: \t%i\n"
49849 "jp_journal_dev: \t%s[%x]\n"
49850 diff -urNp linux-2.6.32.46/fs/reiserfs/stree.c linux-2.6.32.46/fs/reiserfs/stree.c
49851 --- linux-2.6.32.46/fs/reiserfs/stree.c 2011-03-27 14:31:47.000000000 -0400
49852 +++ linux-2.6.32.46/fs/reiserfs/stree.c 2011-05-16 21:46:57.000000000 -0400
49853 @@ -1159,6 +1159,8 @@ int reiserfs_delete_item(struct reiserfs
49854 int iter = 0;
49855 #endif
49856
49857 + pax_track_stack();
49858 +
49859 BUG_ON(!th->t_trans_id);
49860
49861 init_tb_struct(th, &s_del_balance, sb, path,
49862 @@ -1296,6 +1298,8 @@ void reiserfs_delete_solid_item(struct r
49863 int retval;
49864 int quota_cut_bytes = 0;
49865
49866 + pax_track_stack();
49867 +
49868 BUG_ON(!th->t_trans_id);
49869
49870 le_key2cpu_key(&cpu_key, key);
49871 @@ -1525,6 +1529,8 @@ int reiserfs_cut_from_item(struct reiser
49872 int quota_cut_bytes;
49873 loff_t tail_pos = 0;
49874
49875 + pax_track_stack();
49876 +
49877 BUG_ON(!th->t_trans_id);
49878
49879 init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
49880 @@ -1920,6 +1926,8 @@ int reiserfs_paste_into_item(struct reis
49881 int retval;
49882 int fs_gen;
49883
49884 + pax_track_stack();
49885 +
49886 BUG_ON(!th->t_trans_id);
49887
49888 fs_gen = get_generation(inode->i_sb);
49889 @@ -2007,6 +2015,8 @@ int reiserfs_insert_item(struct reiserfs
49890 int fs_gen = 0;
49891 int quota_bytes = 0;
49892
49893 + pax_track_stack();
49894 +
49895 BUG_ON(!th->t_trans_id);
49896
49897 if (inode) { /* Do we count quotas for item? */
49898 diff -urNp linux-2.6.32.46/fs/reiserfs/super.c linux-2.6.32.46/fs/reiserfs/super.c
49899 --- linux-2.6.32.46/fs/reiserfs/super.c 2011-03-27 14:31:47.000000000 -0400
49900 +++ linux-2.6.32.46/fs/reiserfs/super.c 2011-05-16 21:46:57.000000000 -0400
49901 @@ -912,6 +912,8 @@ static int reiserfs_parse_options(struct
49902 {.option_name = NULL}
49903 };
49904
49905 + pax_track_stack();
49906 +
49907 *blocks = 0;
49908 if (!options || !*options)
49909 /* use default configuration: create tails, journaling on, no
49910 diff -urNp linux-2.6.32.46/fs/select.c linux-2.6.32.46/fs/select.c
49911 --- linux-2.6.32.46/fs/select.c 2011-03-27 14:31:47.000000000 -0400
49912 +++ linux-2.6.32.46/fs/select.c 2011-05-16 21:46:57.000000000 -0400
49913 @@ -20,6 +20,7 @@
49914 #include <linux/module.h>
49915 #include <linux/slab.h>
49916 #include <linux/poll.h>
49917 +#include <linux/security.h>
49918 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
49919 #include <linux/file.h>
49920 #include <linux/fdtable.h>
49921 @@ -401,6 +402,8 @@ int do_select(int n, fd_set_bits *fds, s
49922 int retval, i, timed_out = 0;
49923 unsigned long slack = 0;
49924
49925 + pax_track_stack();
49926 +
49927 rcu_read_lock();
49928 retval = max_select_fd(n, fds);
49929 rcu_read_unlock();
49930 @@ -529,6 +532,8 @@ int core_sys_select(int n, fd_set __user
49931 /* Allocate small arguments on the stack to save memory and be faster */
49932 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
49933
49934 + pax_track_stack();
49935 +
49936 ret = -EINVAL;
49937 if (n < 0)
49938 goto out_nofds;
49939 @@ -821,6 +826,9 @@ int do_sys_poll(struct pollfd __user *uf
49940 struct poll_list *walk = head;
49941 unsigned long todo = nfds;
49942
49943 + pax_track_stack();
49944 +
49945 + gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
49946 if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
49947 return -EINVAL;
49948
49949 diff -urNp linux-2.6.32.46/fs/seq_file.c linux-2.6.32.46/fs/seq_file.c
49950 --- linux-2.6.32.46/fs/seq_file.c 2011-03-27 14:31:47.000000000 -0400
49951 +++ linux-2.6.32.46/fs/seq_file.c 2011-08-23 21:22:32.000000000 -0400
49952 @@ -76,7 +76,8 @@ static int traverse(struct seq_file *m,
49953 return 0;
49954 }
49955 if (!m->buf) {
49956 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
49957 + m->size = PAGE_SIZE;
49958 + m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
49959 if (!m->buf)
49960 return -ENOMEM;
49961 }
49962 @@ -116,7 +117,8 @@ static int traverse(struct seq_file *m,
49963 Eoverflow:
49964 m->op->stop(m, p);
49965 kfree(m->buf);
49966 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
49967 + m->size <<= 1;
49968 + m->buf = kmalloc(m->size, GFP_KERNEL);
49969 return !m->buf ? -ENOMEM : -EAGAIN;
49970 }
49971
49972 @@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
49973 m->version = file->f_version;
49974 /* grab buffer if we didn't have one */
49975 if (!m->buf) {
49976 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
49977 + m->size = PAGE_SIZE;
49978 + m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
49979 if (!m->buf)
49980 goto Enomem;
49981 }
49982 @@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
49983 goto Fill;
49984 m->op->stop(m, p);
49985 kfree(m->buf);
49986 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
49987 + m->size <<= 1;
49988 + m->buf = kmalloc(m->size, GFP_KERNEL);
49989 if (!m->buf)
49990 goto Enomem;
49991 m->count = 0;
49992 @@ -551,7 +555,7 @@ static void single_stop(struct seq_file
49993 int single_open(struct file *file, int (*show)(struct seq_file *, void *),
49994 void *data)
49995 {
49996 - struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
49997 + seq_operations_no_const *op = kmalloc(sizeof(*op), GFP_KERNEL);
49998 int res = -ENOMEM;
49999
50000 if (op) {
50001 diff -urNp linux-2.6.32.46/fs/smbfs/proc.c linux-2.6.32.46/fs/smbfs/proc.c
50002 --- linux-2.6.32.46/fs/smbfs/proc.c 2011-03-27 14:31:47.000000000 -0400
50003 +++ linux-2.6.32.46/fs/smbfs/proc.c 2011-08-05 20:33:55.000000000 -0400
50004 @@ -266,9 +266,9 @@ int smb_setcodepage(struct smb_sb_info *
50005
50006 out:
50007 if (server->local_nls != NULL && server->remote_nls != NULL)
50008 - server->ops->convert = convert_cp;
50009 + *(void **)&server->ops->convert = convert_cp;
50010 else
50011 - server->ops->convert = convert_memcpy;
50012 + *(void **)&server->ops->convert = convert_memcpy;
50013
50014 smb_unlock_server(server);
50015 return n;
50016 @@ -933,9 +933,9 @@ smb_newconn(struct smb_sb_info *server,
50017
50018 /* FIXME: the win9x code wants to modify these ... (seek/trunc bug) */
50019 if (server->mnt->flags & SMB_MOUNT_OLDATTR) {
50020 - server->ops->getattr = smb_proc_getattr_core;
50021 + *(void **)&server->ops->getattr = smb_proc_getattr_core;
50022 } else if (server->mnt->flags & SMB_MOUNT_DIRATTR) {
50023 - server->ops->getattr = smb_proc_getattr_ff;
50024 + *(void **)&server->ops->getattr = smb_proc_getattr_ff;
50025 }
50026
50027 /* Decode server capabilities */
50028 @@ -3439,7 +3439,7 @@ out:
50029 static void
50030 install_ops(struct smb_ops *dst, struct smb_ops *src)
50031 {
50032 - memcpy(dst, src, sizeof(void *) * SMB_OPS_NUM_STATIC);
50033 + memcpy((void *)dst, src, sizeof(void *) * SMB_OPS_NUM_STATIC);
50034 }
50035
50036 /* < LANMAN2 */
50037 diff -urNp linux-2.6.32.46/fs/smbfs/symlink.c linux-2.6.32.46/fs/smbfs/symlink.c
50038 --- linux-2.6.32.46/fs/smbfs/symlink.c 2011-03-27 14:31:47.000000000 -0400
50039 +++ linux-2.6.32.46/fs/smbfs/symlink.c 2011-04-17 15:56:46.000000000 -0400
50040 @@ -55,7 +55,7 @@ static void *smb_follow_link(struct dent
50041
50042 static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
50043 {
50044 - char *s = nd_get_link(nd);
50045 + const char *s = nd_get_link(nd);
50046 if (!IS_ERR(s))
50047 __putname(s);
50048 }
50049 diff -urNp linux-2.6.32.46/fs/splice.c linux-2.6.32.46/fs/splice.c
50050 --- linux-2.6.32.46/fs/splice.c 2011-03-27 14:31:47.000000000 -0400
50051 +++ linux-2.6.32.46/fs/splice.c 2011-10-06 09:37:14.000000000 -0400
50052 @@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode
50053 pipe_lock(pipe);
50054
50055 for (;;) {
50056 - if (!pipe->readers) {
50057 + if (!atomic_read(&pipe->readers)) {
50058 send_sig(SIGPIPE, current, 0);
50059 if (!ret)
50060 ret = -EPIPE;
50061 @@ -239,9 +239,9 @@ ssize_t splice_to_pipe(struct pipe_inode
50062 do_wakeup = 0;
50063 }
50064
50065 - pipe->waiting_writers++;
50066 + atomic_inc(&pipe->waiting_writers);
50067 pipe_wait(pipe);
50068 - pipe->waiting_writers--;
50069 + atomic_dec(&pipe->waiting_writers);
50070 }
50071
50072 pipe_unlock(pipe);
50073 @@ -285,6 +285,8 @@ __generic_file_splice_read(struct file *
50074 .spd_release = spd_release_page,
50075 };
50076
50077 + pax_track_stack();
50078 +
50079 index = *ppos >> PAGE_CACHE_SHIFT;
50080 loff = *ppos & ~PAGE_CACHE_MASK;
50081 req_pages = (len + loff + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
50082 @@ -521,7 +523,7 @@ static ssize_t kernel_readv(struct file
50083 old_fs = get_fs();
50084 set_fs(get_ds());
50085 /* The cast to a user pointer is valid due to the set_fs() */
50086 - res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
50087 + res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos);
50088 set_fs(old_fs);
50089
50090 return res;
50091 @@ -536,7 +538,7 @@ static ssize_t kernel_write(struct file
50092 old_fs = get_fs();
50093 set_fs(get_ds());
50094 /* The cast to a user pointer is valid due to the set_fs() */
50095 - res = vfs_write(file, (const char __user *)buf, count, &pos);
50096 + res = vfs_write(file, (const char __force_user *)buf, count, &pos);
50097 set_fs(old_fs);
50098
50099 return res;
50100 @@ -565,6 +567,8 @@ ssize_t default_file_splice_read(struct
50101 .spd_release = spd_release_page,
50102 };
50103
50104 + pax_track_stack();
50105 +
50106 index = *ppos >> PAGE_CACHE_SHIFT;
50107 offset = *ppos & ~PAGE_CACHE_MASK;
50108 nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
50109 @@ -578,7 +582,7 @@ ssize_t default_file_splice_read(struct
50110 goto err;
50111
50112 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
50113 - vec[i].iov_base = (void __user *) page_address(page);
50114 + vec[i].iov_base = (__force void __user *) page_address(page);
50115 vec[i].iov_len = this_len;
50116 pages[i] = page;
50117 spd.nr_pages++;
50118 @@ -800,10 +804,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
50119 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
50120 {
50121 while (!pipe->nrbufs) {
50122 - if (!pipe->writers)
50123 + if (!atomic_read(&pipe->writers))
50124 return 0;
50125
50126 - if (!pipe->waiting_writers && sd->num_spliced)
50127 + if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
50128 return 0;
50129
50130 if (sd->flags & SPLICE_F_NONBLOCK)
50131 @@ -1140,7 +1144,7 @@ ssize_t splice_direct_to_actor(struct fi
50132 * out of the pipe right after the splice_to_pipe(). So set
50133 * PIPE_READERS appropriately.
50134 */
50135 - pipe->readers = 1;
50136 + atomic_set(&pipe->readers, 1);
50137
50138 current->splice_pipe = pipe;
50139 }
50140 @@ -1592,6 +1596,8 @@ static long vmsplice_to_pipe(struct file
50141 .spd_release = spd_release_page,
50142 };
50143
50144 + pax_track_stack();
50145 +
50146 pipe = pipe_info(file->f_path.dentry->d_inode);
50147 if (!pipe)
50148 return -EBADF;
50149 @@ -1700,9 +1706,9 @@ static int ipipe_prep(struct pipe_inode_
50150 ret = -ERESTARTSYS;
50151 break;
50152 }
50153 - if (!pipe->writers)
50154 + if (!atomic_read(&pipe->writers))
50155 break;
50156 - if (!pipe->waiting_writers) {
50157 + if (!atomic_read(&pipe->waiting_writers)) {
50158 if (flags & SPLICE_F_NONBLOCK) {
50159 ret = -EAGAIN;
50160 break;
50161 @@ -1734,7 +1740,7 @@ static int opipe_prep(struct pipe_inode_
50162 pipe_lock(pipe);
50163
50164 while (pipe->nrbufs >= PIPE_BUFFERS) {
50165 - if (!pipe->readers) {
50166 + if (!atomic_read(&pipe->readers)) {
50167 send_sig(SIGPIPE, current, 0);
50168 ret = -EPIPE;
50169 break;
50170 @@ -1747,9 +1753,9 @@ static int opipe_prep(struct pipe_inode_
50171 ret = -ERESTARTSYS;
50172 break;
50173 }
50174 - pipe->waiting_writers++;
50175 + atomic_inc(&pipe->waiting_writers);
50176 pipe_wait(pipe);
50177 - pipe->waiting_writers--;
50178 + atomic_dec(&pipe->waiting_writers);
50179 }
50180
50181 pipe_unlock(pipe);
50182 @@ -1785,14 +1791,14 @@ retry:
50183 pipe_double_lock(ipipe, opipe);
50184
50185 do {
50186 - if (!opipe->readers) {
50187 + if (!atomic_read(&opipe->readers)) {
50188 send_sig(SIGPIPE, current, 0);
50189 if (!ret)
50190 ret = -EPIPE;
50191 break;
50192 }
50193
50194 - if (!ipipe->nrbufs && !ipipe->writers)
50195 + if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
50196 break;
50197
50198 /*
50199 @@ -1892,7 +1898,7 @@ static int link_pipe(struct pipe_inode_i
50200 pipe_double_lock(ipipe, opipe);
50201
50202 do {
50203 - if (!opipe->readers) {
50204 + if (!atomic_read(&opipe->readers)) {
50205 send_sig(SIGPIPE, current, 0);
50206 if (!ret)
50207 ret = -EPIPE;
50208 @@ -1937,7 +1943,7 @@ static int link_pipe(struct pipe_inode_i
50209 * return EAGAIN if we have the potential of some data in the
50210 * future, otherwise just return 0
50211 */
50212 - if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
50213 + if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
50214 ret = -EAGAIN;
50215
50216 pipe_unlock(ipipe);
50217 diff -urNp linux-2.6.32.46/fs/sysfs/file.c linux-2.6.32.46/fs/sysfs/file.c
50218 --- linux-2.6.32.46/fs/sysfs/file.c 2011-03-27 14:31:47.000000000 -0400
50219 +++ linux-2.6.32.46/fs/sysfs/file.c 2011-05-04 17:56:20.000000000 -0400
50220 @@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent
50221
50222 struct sysfs_open_dirent {
50223 atomic_t refcnt;
50224 - atomic_t event;
50225 + atomic_unchecked_t event;
50226 wait_queue_head_t poll;
50227 struct list_head buffers; /* goes through sysfs_buffer.list */
50228 };
50229 @@ -53,7 +53,7 @@ struct sysfs_buffer {
50230 size_t count;
50231 loff_t pos;
50232 char * page;
50233 - struct sysfs_ops * ops;
50234 + const struct sysfs_ops * ops;
50235 struct mutex mutex;
50236 int needs_read_fill;
50237 int event;
50238 @@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentr
50239 {
50240 struct sysfs_dirent *attr_sd = dentry->d_fsdata;
50241 struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
50242 - struct sysfs_ops * ops = buffer->ops;
50243 + const struct sysfs_ops * ops = buffer->ops;
50244 int ret = 0;
50245 ssize_t count;
50246
50247 @@ -88,7 +88,7 @@ static int fill_read_buffer(struct dentr
50248 if (!sysfs_get_active_two(attr_sd))
50249 return -ENODEV;
50250
50251 - buffer->event = atomic_read(&attr_sd->s_attr.open->event);
50252 + buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
50253 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
50254
50255 sysfs_put_active_two(attr_sd);
50256 @@ -199,7 +199,7 @@ flush_write_buffer(struct dentry * dentr
50257 {
50258 struct sysfs_dirent *attr_sd = dentry->d_fsdata;
50259 struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
50260 - struct sysfs_ops * ops = buffer->ops;
50261 + const struct sysfs_ops * ops = buffer->ops;
50262 int rc;
50263
50264 /* need attr_sd for attr and ops, its parent for kobj */
50265 @@ -294,7 +294,7 @@ static int sysfs_get_open_dirent(struct
50266 return -ENOMEM;
50267
50268 atomic_set(&new_od->refcnt, 0);
50269 - atomic_set(&new_od->event, 1);
50270 + atomic_set_unchecked(&new_od->event, 1);
50271 init_waitqueue_head(&new_od->poll);
50272 INIT_LIST_HEAD(&new_od->buffers);
50273 goto retry;
50274 @@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode
50275 struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
50276 struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
50277 struct sysfs_buffer *buffer;
50278 - struct sysfs_ops *ops;
50279 + const struct sysfs_ops *ops;
50280 int error = -EACCES;
50281 char *p;
50282
50283 @@ -444,7 +444,7 @@ static unsigned int sysfs_poll(struct fi
50284
50285 sysfs_put_active_two(attr_sd);
50286
50287 - if (buffer->event != atomic_read(&od->event))
50288 + if (buffer->event != atomic_read_unchecked(&od->event))
50289 goto trigger;
50290
50291 return DEFAULT_POLLMASK;
50292 @@ -463,7 +463,7 @@ void sysfs_notify_dirent(struct sysfs_di
50293
50294 od = sd->s_attr.open;
50295 if (od) {
50296 - atomic_inc(&od->event);
50297 + atomic_inc_unchecked(&od->event);
50298 wake_up_interruptible(&od->poll);
50299 }
50300
50301 diff -urNp linux-2.6.32.46/fs/sysfs/mount.c linux-2.6.32.46/fs/sysfs/mount.c
50302 --- linux-2.6.32.46/fs/sysfs/mount.c 2011-03-27 14:31:47.000000000 -0400
50303 +++ linux-2.6.32.46/fs/sysfs/mount.c 2011-04-17 15:56:46.000000000 -0400
50304 @@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
50305 .s_name = "",
50306 .s_count = ATOMIC_INIT(1),
50307 .s_flags = SYSFS_DIR,
50308 +#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
50309 + .s_mode = S_IFDIR | S_IRWXU,
50310 +#else
50311 .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
50312 +#endif
50313 .s_ino = 1,
50314 };
50315
50316 diff -urNp linux-2.6.32.46/fs/sysfs/symlink.c linux-2.6.32.46/fs/sysfs/symlink.c
50317 --- linux-2.6.32.46/fs/sysfs/symlink.c 2011-03-27 14:31:47.000000000 -0400
50318 +++ linux-2.6.32.46/fs/sysfs/symlink.c 2011-04-17 15:56:46.000000000 -0400
50319 @@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct de
50320
50321 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
50322 {
50323 - char *page = nd_get_link(nd);
50324 + const char *page = nd_get_link(nd);
50325 if (!IS_ERR(page))
50326 free_page((unsigned long)page);
50327 }
50328 diff -urNp linux-2.6.32.46/fs/udf/balloc.c linux-2.6.32.46/fs/udf/balloc.c
50329 --- linux-2.6.32.46/fs/udf/balloc.c 2011-03-27 14:31:47.000000000 -0400
50330 +++ linux-2.6.32.46/fs/udf/balloc.c 2011-04-17 15:56:46.000000000 -0400
50331 @@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struc
50332
50333 mutex_lock(&sbi->s_alloc_mutex);
50334 partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
50335 - if (bloc->logicalBlockNum < 0 ||
50336 - (bloc->logicalBlockNum + count) >
50337 - partmap->s_partition_len) {
50338 + if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
50339 udf_debug("%d < %d || %d + %d > %d\n",
50340 bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
50341 count, partmap->s_partition_len);
50342 @@ -436,9 +434,7 @@ static void udf_table_free_blocks(struct
50343
50344 mutex_lock(&sbi->s_alloc_mutex);
50345 partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
50346 - if (bloc->logicalBlockNum < 0 ||
50347 - (bloc->logicalBlockNum + count) >
50348 - partmap->s_partition_len) {
50349 + if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
50350 udf_debug("%d < %d || %d + %d > %d\n",
50351 bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
50352 partmap->s_partition_len);
50353 diff -urNp linux-2.6.32.46/fs/udf/inode.c linux-2.6.32.46/fs/udf/inode.c
50354 --- linux-2.6.32.46/fs/udf/inode.c 2011-03-27 14:31:47.000000000 -0400
50355 +++ linux-2.6.32.46/fs/udf/inode.c 2011-05-16 21:46:57.000000000 -0400
50356 @@ -484,6 +484,8 @@ static struct buffer_head *inode_getblk(
50357 int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
50358 int lastblock = 0;
50359
50360 + pax_track_stack();
50361 +
50362 prev_epos.offset = udf_file_entry_alloc_offset(inode);
50363 prev_epos.block = iinfo->i_location;
50364 prev_epos.bh = NULL;
50365 diff -urNp linux-2.6.32.46/fs/udf/misc.c linux-2.6.32.46/fs/udf/misc.c
50366 --- linux-2.6.32.46/fs/udf/misc.c 2011-03-27 14:31:47.000000000 -0400
50367 +++ linux-2.6.32.46/fs/udf/misc.c 2011-04-23 12:56:11.000000000 -0400
50368 @@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t id
50369
50370 u8 udf_tag_checksum(const struct tag *t)
50371 {
50372 - u8 *data = (u8 *)t;
50373 + const u8 *data = (const u8 *)t;
50374 u8 checksum = 0;
50375 int i;
50376 for (i = 0; i < sizeof(struct tag); ++i)
50377 diff -urNp linux-2.6.32.46/fs/utimes.c linux-2.6.32.46/fs/utimes.c
50378 --- linux-2.6.32.46/fs/utimes.c 2011-03-27 14:31:47.000000000 -0400
50379 +++ linux-2.6.32.46/fs/utimes.c 2011-04-17 15:56:46.000000000 -0400
50380 @@ -1,6 +1,7 @@
50381 #include <linux/compiler.h>
50382 #include <linux/file.h>
50383 #include <linux/fs.h>
50384 +#include <linux/security.h>
50385 #include <linux/linkage.h>
50386 #include <linux/mount.h>
50387 #include <linux/namei.h>
50388 @@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
50389 goto mnt_drop_write_and_out;
50390 }
50391 }
50392 +
50393 + if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
50394 + error = -EACCES;
50395 + goto mnt_drop_write_and_out;
50396 + }
50397 +
50398 mutex_lock(&inode->i_mutex);
50399 error = notify_change(path->dentry, &newattrs);
50400 mutex_unlock(&inode->i_mutex);
50401 diff -urNp linux-2.6.32.46/fs/xattr_acl.c linux-2.6.32.46/fs/xattr_acl.c
50402 --- linux-2.6.32.46/fs/xattr_acl.c 2011-03-27 14:31:47.000000000 -0400
50403 +++ linux-2.6.32.46/fs/xattr_acl.c 2011-04-17 15:56:46.000000000 -0400
50404 @@ -17,8 +17,8 @@
50405 struct posix_acl *
50406 posix_acl_from_xattr(const void *value, size_t size)
50407 {
50408 - posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
50409 - posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
50410 + const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
50411 + const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
50412 int count;
50413 struct posix_acl *acl;
50414 struct posix_acl_entry *acl_e;
50415 diff -urNp linux-2.6.32.46/fs/xattr.c linux-2.6.32.46/fs/xattr.c
50416 --- linux-2.6.32.46/fs/xattr.c 2011-03-27 14:31:47.000000000 -0400
50417 +++ linux-2.6.32.46/fs/xattr.c 2011-04-17 15:56:46.000000000 -0400
50418 @@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
50419 * Extended attribute SET operations
50420 */
50421 static long
50422 -setxattr(struct dentry *d, const char __user *name, const void __user *value,
50423 +setxattr(struct path *path, const char __user *name, const void __user *value,
50424 size_t size, int flags)
50425 {
50426 int error;
50427 @@ -271,7 +271,13 @@ setxattr(struct dentry *d, const char __
50428 return PTR_ERR(kvalue);
50429 }
50430
50431 - error = vfs_setxattr(d, kname, kvalue, size, flags);
50432 + if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
50433 + error = -EACCES;
50434 + goto out;
50435 + }
50436 +
50437 + error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
50438 +out:
50439 kfree(kvalue);
50440 return error;
50441 }
50442 @@ -288,7 +294,7 @@ SYSCALL_DEFINE5(setxattr, const char __u
50443 return error;
50444 error = mnt_want_write(path.mnt);
50445 if (!error) {
50446 - error = setxattr(path.dentry, name, value, size, flags);
50447 + error = setxattr(&path, name, value, size, flags);
50448 mnt_drop_write(path.mnt);
50449 }
50450 path_put(&path);
50451 @@ -307,7 +313,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __
50452 return error;
50453 error = mnt_want_write(path.mnt);
50454 if (!error) {
50455 - error = setxattr(path.dentry, name, value, size, flags);
50456 + error = setxattr(&path, name, value, size, flags);
50457 mnt_drop_write(path.mnt);
50458 }
50459 path_put(&path);
50460 @@ -318,17 +324,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons
50461 const void __user *,value, size_t, size, int, flags)
50462 {
50463 struct file *f;
50464 - struct dentry *dentry;
50465 int error = -EBADF;
50466
50467 f = fget(fd);
50468 if (!f)
50469 return error;
50470 - dentry = f->f_path.dentry;
50471 - audit_inode(NULL, dentry);
50472 + audit_inode(NULL, f->f_path.dentry);
50473 error = mnt_want_write_file(f);
50474 if (!error) {
50475 - error = setxattr(dentry, name, value, size, flags);
50476 + error = setxattr(&f->f_path, name, value, size, flags);
50477 mnt_drop_write(f->f_path.mnt);
50478 }
50479 fput(f);
50480 diff -urNp linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl32.c
50481 --- linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-03-27 14:31:47.000000000 -0400
50482 +++ linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-04-17 15:56:46.000000000 -0400
50483 @@ -75,6 +75,7 @@ xfs_compat_ioc_fsgeometry_v1(
50484 xfs_fsop_geom_t fsgeo;
50485 int error;
50486
50487 + memset(&fsgeo, 0, sizeof(fsgeo));
50488 error = xfs_fs_geometry(mp, &fsgeo, 3);
50489 if (error)
50490 return -error;
50491 diff -urNp linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl.c
50492 --- linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl.c 2011-04-17 17:00:52.000000000 -0400
50493 +++ linux-2.6.32.46/fs/xfs/linux-2.6/xfs_ioctl.c 2011-04-17 20:07:09.000000000 -0400
50494 @@ -134,7 +134,7 @@ xfs_find_handle(
50495 }
50496
50497 error = -EFAULT;
50498 - if (copy_to_user(hreq->ohandle, &handle, hsize) ||
50499 + if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
50500 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
50501 goto out_put;
50502
50503 @@ -423,7 +423,7 @@ xfs_attrlist_by_handle(
50504 if (IS_ERR(dentry))
50505 return PTR_ERR(dentry);
50506
50507 - kbuf = kmalloc(al_hreq.buflen, GFP_KERNEL);
50508 + kbuf = kzalloc(al_hreq.buflen, GFP_KERNEL);
50509 if (!kbuf)
50510 goto out_dput;
50511
50512 @@ -697,7 +697,7 @@ xfs_ioc_fsgeometry_v1(
50513 xfs_mount_t *mp,
50514 void __user *arg)
50515 {
50516 - xfs_fsop_geom_t fsgeo;
50517 + xfs_fsop_geom_t fsgeo;
50518 int error;
50519
50520 error = xfs_fs_geometry(mp, &fsgeo, 3);
50521 diff -urNp linux-2.6.32.46/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.32.46/fs/xfs/linux-2.6/xfs_iops.c
50522 --- linux-2.6.32.46/fs/xfs/linux-2.6/xfs_iops.c 2011-03-27 14:31:47.000000000 -0400
50523 +++ linux-2.6.32.46/fs/xfs/linux-2.6/xfs_iops.c 2011-04-17 15:56:46.000000000 -0400
50524 @@ -468,7 +468,7 @@ xfs_vn_put_link(
50525 struct nameidata *nd,
50526 void *p)
50527 {
50528 - char *s = nd_get_link(nd);
50529 + const char *s = nd_get_link(nd);
50530
50531 if (!IS_ERR(s))
50532 kfree(s);
50533 diff -urNp linux-2.6.32.46/fs/xfs/xfs_bmap.c linux-2.6.32.46/fs/xfs/xfs_bmap.c
50534 --- linux-2.6.32.46/fs/xfs/xfs_bmap.c 2011-03-27 14:31:47.000000000 -0400
50535 +++ linux-2.6.32.46/fs/xfs/xfs_bmap.c 2011-04-17 15:56:46.000000000 -0400
50536 @@ -360,7 +360,7 @@ xfs_bmap_validate_ret(
50537 int nmap,
50538 int ret_nmap);
50539 #else
50540 -#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
50541 +#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
50542 #endif /* DEBUG */
50543
50544 #if defined(XFS_RW_TRACE)
50545 diff -urNp linux-2.6.32.46/fs/xfs/xfs_dir2_sf.c linux-2.6.32.46/fs/xfs/xfs_dir2_sf.c
50546 --- linux-2.6.32.46/fs/xfs/xfs_dir2_sf.c 2011-03-27 14:31:47.000000000 -0400
50547 +++ linux-2.6.32.46/fs/xfs/xfs_dir2_sf.c 2011-04-18 22:07:30.000000000 -0400
50548 @@ -779,7 +779,15 @@ xfs_dir2_sf_getdents(
50549 }
50550
50551 ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
50552 - if (filldir(dirent, sfep->name, sfep->namelen,
50553 + if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
50554 + char name[sfep->namelen];
50555 + memcpy(name, sfep->name, sfep->namelen);
50556 + if (filldir(dirent, name, sfep->namelen,
50557 + off & 0x7fffffff, ino, DT_UNKNOWN)) {
50558 + *offset = off & 0x7fffffff;
50559 + return 0;
50560 + }
50561 + } else if (filldir(dirent, sfep->name, sfep->namelen,
50562 off & 0x7fffffff, ino, DT_UNKNOWN)) {
50563 *offset = off & 0x7fffffff;
50564 return 0;
50565 diff -urNp linux-2.6.32.46/grsecurity/gracl_alloc.c linux-2.6.32.46/grsecurity/gracl_alloc.c
50566 --- linux-2.6.32.46/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500
50567 +++ linux-2.6.32.46/grsecurity/gracl_alloc.c 2011-04-17 15:56:46.000000000 -0400
50568 @@ -0,0 +1,105 @@
50569 +#include <linux/kernel.h>
50570 +#include <linux/mm.h>
50571 +#include <linux/slab.h>
50572 +#include <linux/vmalloc.h>
50573 +#include <linux/gracl.h>
50574 +#include <linux/grsecurity.h>
50575 +
50576 +static unsigned long alloc_stack_next = 1;
50577 +static unsigned long alloc_stack_size = 1;
50578 +static void **alloc_stack;
50579 +
50580 +static __inline__ int
50581 +alloc_pop(void)
50582 +{
50583 + if (alloc_stack_next == 1)
50584 + return 0;
50585 +
50586 + kfree(alloc_stack[alloc_stack_next - 2]);
50587 +
50588 + alloc_stack_next--;
50589 +
50590 + return 1;
50591 +}
50592 +
50593 +static __inline__ int
50594 +alloc_push(void *buf)
50595 +{
50596 + if (alloc_stack_next >= alloc_stack_size)
50597 + return 1;
50598 +
50599 + alloc_stack[alloc_stack_next - 1] = buf;
50600 +
50601 + alloc_stack_next++;
50602 +
50603 + return 0;
50604 +}
50605 +
50606 +void *
50607 +acl_alloc(unsigned long len)
50608 +{
50609 + void *ret = NULL;
50610 +
50611 + if (!len || len > PAGE_SIZE)
50612 + goto out;
50613 +
50614 + ret = kmalloc(len, GFP_KERNEL);
50615 +
50616 + if (ret) {
50617 + if (alloc_push(ret)) {
50618 + kfree(ret);
50619 + ret = NULL;
50620 + }
50621 + }
50622 +
50623 +out:
50624 + return ret;
50625 +}
50626 +
50627 +void *
50628 +acl_alloc_num(unsigned long num, unsigned long len)
50629 +{
50630 + if (!len || (num > (PAGE_SIZE / len)))
50631 + return NULL;
50632 +
50633 + return acl_alloc(num * len);
50634 +}
50635 +
50636 +void
50637 +acl_free_all(void)
50638 +{
50639 + if (gr_acl_is_enabled() || !alloc_stack)
50640 + return;
50641 +
50642 + while (alloc_pop()) ;
50643 +
50644 + if (alloc_stack) {
50645 + if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
50646 + kfree(alloc_stack);
50647 + else
50648 + vfree(alloc_stack);
50649 + }
50650 +
50651 + alloc_stack = NULL;
50652 + alloc_stack_size = 1;
50653 + alloc_stack_next = 1;
50654 +
50655 + return;
50656 +}
50657 +
50658 +int
50659 +acl_alloc_stack_init(unsigned long size)
50660 +{
50661 + if ((size * sizeof (void *)) <= PAGE_SIZE)
50662 + alloc_stack =
50663 + (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
50664 + else
50665 + alloc_stack = (void **) vmalloc(size * sizeof (void *));
50666 +
50667 + alloc_stack_size = size;
50668 +
50669 + if (!alloc_stack)
50670 + return 0;
50671 + else
50672 + return 1;
50673 +}
50674 diff -urNp linux-2.6.32.46/grsecurity/gracl.c linux-2.6.32.46/grsecurity/gracl.c
50675 --- linux-2.6.32.46/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500
50676 +++ linux-2.6.32.46/grsecurity/gracl.c 2011-10-17 07:04:31.000000000 -0400
50677 @@ -0,0 +1,4140 @@
50678 +#include <linux/kernel.h>
50679 +#include <linux/module.h>
50680 +#include <linux/sched.h>
50681 +#include <linux/mm.h>
50682 +#include <linux/file.h>
50683 +#include <linux/fs.h>
50684 +#include <linux/namei.h>
50685 +#include <linux/mount.h>
50686 +#include <linux/tty.h>
50687 +#include <linux/proc_fs.h>
50688 +#include <linux/smp_lock.h>
50689 +#include <linux/slab.h>
50690 +#include <linux/vmalloc.h>
50691 +#include <linux/types.h>
50692 +#include <linux/sysctl.h>
50693 +#include <linux/netdevice.h>
50694 +#include <linux/ptrace.h>
50695 +#include <linux/gracl.h>
50696 +#include <linux/gralloc.h>
50697 +#include <linux/grsecurity.h>
50698 +#include <linux/grinternal.h>
50699 +#include <linux/pid_namespace.h>
50700 +#include <linux/fdtable.h>
50701 +#include <linux/percpu.h>
50702 +
50703 +#include <asm/uaccess.h>
50704 +#include <asm/errno.h>
50705 +#include <asm/mman.h>
50706 +
50707 +static struct acl_role_db acl_role_set;
50708 +static struct name_db name_set;
50709 +static struct inodev_db inodev_set;
50710 +
50711 +/* for keeping track of userspace pointers used for subjects, so we
50712 + can share references in the kernel as well
50713 +*/
50714 +
50715 +static struct dentry *real_root;
50716 +static struct vfsmount *real_root_mnt;
50717 +
50718 +static struct acl_subj_map_db subj_map_set;
50719 +
50720 +static struct acl_role_label *default_role;
50721 +
50722 +static struct acl_role_label *role_list;
50723 +
50724 +static u16 acl_sp_role_value;
50725 +
50726 +extern char *gr_shared_page[4];
50727 +static DEFINE_MUTEX(gr_dev_mutex);
50728 +DEFINE_RWLOCK(gr_inode_lock);
50729 +
50730 +struct gr_arg *gr_usermode;
50731 +
50732 +static unsigned int gr_status __read_only = GR_STATUS_INIT;
50733 +
50734 +extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
50735 +extern void gr_clear_learn_entries(void);
50736 +
50737 +#ifdef CONFIG_GRKERNSEC_RESLOG
50738 +extern void gr_log_resource(const struct task_struct *task,
50739 + const int res, const unsigned long wanted, const int gt);
50740 +#endif
50741 +
50742 +unsigned char *gr_system_salt;
50743 +unsigned char *gr_system_sum;
50744 +
50745 +static struct sprole_pw **acl_special_roles = NULL;
50746 +static __u16 num_sprole_pws = 0;
50747 +
50748 +static struct acl_role_label *kernel_role = NULL;
50749 +
50750 +static unsigned int gr_auth_attempts = 0;
50751 +static unsigned long gr_auth_expires = 0UL;
50752 +
50753 +#ifdef CONFIG_NET
50754 +extern struct vfsmount *sock_mnt;
50755 +#endif
50756 +extern struct vfsmount *pipe_mnt;
50757 +extern struct vfsmount *shm_mnt;
50758 +#ifdef CONFIG_HUGETLBFS
50759 +extern struct vfsmount *hugetlbfs_vfsmount;
50760 +#endif
50761 +
50762 +static struct acl_object_label *fakefs_obj_rw;
50763 +static struct acl_object_label *fakefs_obj_rwx;
50764 +
50765 +extern int gr_init_uidset(void);
50766 +extern void gr_free_uidset(void);
50767 +extern void gr_remove_uid(uid_t uid);
50768 +extern int gr_find_uid(uid_t uid);
50769 +
50770 +__inline__ int
50771 +gr_acl_is_enabled(void)
50772 +{
50773 + return (gr_status & GR_READY);
50774 +}
50775 +
50776 +#ifdef CONFIG_BTRFS_FS
50777 +extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
50778 +extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
50779 +#endif
50780 +
50781 +static inline dev_t __get_dev(const struct dentry *dentry)
50782 +{
50783 +#ifdef CONFIG_BTRFS_FS
50784 + if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
50785 + return get_btrfs_dev_from_inode(dentry->d_inode);
50786 + else
50787 +#endif
50788 + return dentry->d_inode->i_sb->s_dev;
50789 +}
50790 +
50791 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
50792 +{
50793 + return __get_dev(dentry);
50794 +}
50795 +
50796 +static char gr_task_roletype_to_char(struct task_struct *task)
50797 +{
50798 + switch (task->role->roletype &
50799 + (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
50800 + GR_ROLE_SPECIAL)) {
50801 + case GR_ROLE_DEFAULT:
50802 + return 'D';
50803 + case GR_ROLE_USER:
50804 + return 'U';
50805 + case GR_ROLE_GROUP:
50806 + return 'G';
50807 + case GR_ROLE_SPECIAL:
50808 + return 'S';
50809 + }
50810 +
50811 + return 'X';
50812 +}
50813 +
50814 +char gr_roletype_to_char(void)
50815 +{
50816 + return gr_task_roletype_to_char(current);
50817 +}
50818 +
50819 +__inline__ int
50820 +gr_acl_tpe_check(void)
50821 +{
50822 + if (unlikely(!(gr_status & GR_READY)))
50823 + return 0;
50824 + if (current->role->roletype & GR_ROLE_TPE)
50825 + return 1;
50826 + else
50827 + return 0;
50828 +}
50829 +
50830 +int
50831 +gr_handle_rawio(const struct inode *inode)
50832 +{
50833 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
50834 + if (inode && S_ISBLK(inode->i_mode) &&
50835 + grsec_enable_chroot_caps && proc_is_chrooted(current) &&
50836 + !capable(CAP_SYS_RAWIO))
50837 + return 1;
50838 +#endif
50839 + return 0;
50840 +}
50841 +
50842 +static int
50843 +gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
50844 +{
50845 + if (likely(lena != lenb))
50846 + return 0;
50847 +
50848 + return !memcmp(a, b, lena);
50849 +}
50850 +
50851 +static int prepend(char **buffer, int *buflen, const char *str, int namelen)
50852 +{
50853 + *buflen -= namelen;
50854 + if (*buflen < 0)
50855 + return -ENAMETOOLONG;
50856 + *buffer -= namelen;
50857 + memcpy(*buffer, str, namelen);
50858 + return 0;
50859 +}
50860 +
50861 +/* this must be called with vfsmount_lock and dcache_lock held */
50862 +
50863 +static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
50864 + struct dentry *root, struct vfsmount *rootmnt,
50865 + char *buffer, int buflen)
50866 +{
50867 + char * end = buffer+buflen;
50868 + char * retval;
50869 + int namelen;
50870 +
50871 + *--end = '\0';
50872 + buflen--;
50873 +
50874 + if (buflen < 1)
50875 + goto Elong;
50876 + /* Get '/' right */
50877 + retval = end-1;
50878 + *retval = '/';
50879 +
50880 + for (;;) {
50881 + struct dentry * parent;
50882 +
50883 + if (dentry == root && vfsmnt == rootmnt)
50884 + break;
50885 + if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
50886 + /* Global root? */
50887 + if (vfsmnt->mnt_parent == vfsmnt)
50888 + goto global_root;
50889 + dentry = vfsmnt->mnt_mountpoint;
50890 + vfsmnt = vfsmnt->mnt_parent;
50891 + continue;
50892 + }
50893 + parent = dentry->d_parent;
50894 + prefetch(parent);
50895 + namelen = dentry->d_name.len;
50896 + buflen -= namelen + 1;
50897 + if (buflen < 0)
50898 + goto Elong;
50899 + end -= namelen;
50900 + memcpy(end, dentry->d_name.name, namelen);
50901 + *--end = '/';
50902 + retval = end;
50903 + dentry = parent;
50904 + }
50905 +
50906 +out:
50907 + return retval;
50908 +
50909 +global_root:
50910 + namelen = dentry->d_name.len;
50911 + buflen -= namelen;
50912 + if (buflen < 0)
50913 + goto Elong;
50914 + retval -= namelen-1; /* hit the slash */
50915 + memcpy(retval, dentry->d_name.name, namelen);
50916 + goto out;
50917 +Elong:
50918 + retval = ERR_PTR(-ENAMETOOLONG);
50919 + goto out;
50920 +}
50921 +
50922 +static char *
50923 +gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
50924 + struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
50925 +{
50926 + char *retval;
50927 +
50928 + retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
50929 + if (unlikely(IS_ERR(retval)))
50930 + retval = strcpy(buf, "<path too long>");
50931 + else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
50932 + retval[1] = '\0';
50933 +
50934 + return retval;
50935 +}
50936 +
50937 +static char *
50938 +__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
50939 + char *buf, int buflen)
50940 +{
50941 + char *res;
50942 +
50943 + /* we can use real_root, real_root_mnt, because this is only called
50944 + by the RBAC system */
50945 + res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
50946 +
50947 + return res;
50948 +}
50949 +
50950 +static char *
50951 +d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
50952 + char *buf, int buflen)
50953 +{
50954 + char *res;
50955 + struct dentry *root;
50956 + struct vfsmount *rootmnt;
50957 + struct task_struct *reaper = &init_task;
50958 +
50959 + /* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
50960 + read_lock(&reaper->fs->lock);
50961 + root = dget(reaper->fs->root.dentry);
50962 + rootmnt = mntget(reaper->fs->root.mnt);
50963 + read_unlock(&reaper->fs->lock);
50964 +
50965 + spin_lock(&dcache_lock);
50966 + spin_lock(&vfsmount_lock);
50967 + res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
50968 + spin_unlock(&vfsmount_lock);
50969 + spin_unlock(&dcache_lock);
50970 +
50971 + dput(root);
50972 + mntput(rootmnt);
50973 + return res;
50974 +}
50975 +
50976 +static char *
50977 +gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
50978 +{
50979 + char *ret;
50980 + spin_lock(&dcache_lock);
50981 + spin_lock(&vfsmount_lock);
50982 + ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
50983 + PAGE_SIZE);
50984 + spin_unlock(&vfsmount_lock);
50985 + spin_unlock(&dcache_lock);
50986 + return ret;
50987 +}
50988 +
50989 +static char *
50990 +gr_to_proc_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
50991 +{
50992 + char *ret;
50993 + char *buf;
50994 + int buflen;
50995 +
50996 + spin_lock(&dcache_lock);
50997 + spin_lock(&vfsmount_lock);
50998 + buf = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
50999 + ret = __d_real_path(dentry, mnt, buf, PAGE_SIZE - 6);
51000 + buflen = (int)(ret - buf);
51001 + if (buflen >= 5)
51002 + prepend(&ret, &buflen, "/proc", 5);
51003 + else
51004 + ret = strcpy(buf, "<path too long>");
51005 + spin_unlock(&vfsmount_lock);
51006 + spin_unlock(&dcache_lock);
51007 + return ret;
51008 +}
51009 +
51010 +char *
51011 +gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
51012 +{
51013 + return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51014 + PAGE_SIZE);
51015 +}
51016 +
51017 +char *
51018 +gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
51019 +{
51020 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
51021 + PAGE_SIZE);
51022 +}
51023 +
51024 +char *
51025 +gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
51026 +{
51027 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
51028 + PAGE_SIZE);
51029 +}
51030 +
51031 +char *
51032 +gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
51033 +{
51034 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
51035 + PAGE_SIZE);
51036 +}
51037 +
51038 +char *
51039 +gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
51040 +{
51041 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
51042 + PAGE_SIZE);
51043 +}
51044 +
51045 +__inline__ __u32
51046 +to_gr_audit(const __u32 reqmode)
51047 +{
51048 + /* masks off auditable permission flags, then shifts them to create
51049 + auditing flags, and adds the special case of append auditing if
51050 + we're requesting write */
51051 + return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
51052 +}
51053 +
51054 +struct acl_subject_label *
51055 +lookup_subject_map(const struct acl_subject_label *userp)
51056 +{
51057 + unsigned int index = shash(userp, subj_map_set.s_size);
51058 + struct subject_map *match;
51059 +
51060 + match = subj_map_set.s_hash[index];
51061 +
51062 + while (match && match->user != userp)
51063 + match = match->next;
51064 +
51065 + if (match != NULL)
51066 + return match->kernel;
51067 + else
51068 + return NULL;
51069 +}
51070 +
51071 +static void
51072 +insert_subj_map_entry(struct subject_map *subjmap)
51073 +{
51074 + unsigned int index = shash(subjmap->user, subj_map_set.s_size);
51075 + struct subject_map **curr;
51076 +
51077 + subjmap->prev = NULL;
51078 +
51079 + curr = &subj_map_set.s_hash[index];
51080 + if (*curr != NULL)
51081 + (*curr)->prev = subjmap;
51082 +
51083 + subjmap->next = *curr;
51084 + *curr = subjmap;
51085 +
51086 + return;
51087 +}
51088 +
51089 +static struct acl_role_label *
51090 +lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
51091 + const gid_t gid)
51092 +{
51093 + unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
51094 + struct acl_role_label *match;
51095 + struct role_allowed_ip *ipp;
51096 + unsigned int x;
51097 + u32 curr_ip = task->signal->curr_ip;
51098 +
51099 + task->signal->saved_ip = curr_ip;
51100 +
51101 + match = acl_role_set.r_hash[index];
51102 +
51103 + while (match) {
51104 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
51105 + for (x = 0; x < match->domain_child_num; x++) {
51106 + if (match->domain_children[x] == uid)
51107 + goto found;
51108 + }
51109 + } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
51110 + break;
51111 + match = match->next;
51112 + }
51113 +found:
51114 + if (match == NULL) {
51115 + try_group:
51116 + index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
51117 + match = acl_role_set.r_hash[index];
51118 +
51119 + while (match) {
51120 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
51121 + for (x = 0; x < match->domain_child_num; x++) {
51122 + if (match->domain_children[x] == gid)
51123 + goto found2;
51124 + }
51125 + } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
51126 + break;
51127 + match = match->next;
51128 + }
51129 +found2:
51130 + if (match == NULL)
51131 + match = default_role;
51132 + if (match->allowed_ips == NULL)
51133 + return match;
51134 + else {
51135 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51136 + if (likely
51137 + ((ntohl(curr_ip) & ipp->netmask) ==
51138 + (ntohl(ipp->addr) & ipp->netmask)))
51139 + return match;
51140 + }
51141 + match = default_role;
51142 + }
51143 + } else if (match->allowed_ips == NULL) {
51144 + return match;
51145 + } else {
51146 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51147 + if (likely
51148 + ((ntohl(curr_ip) & ipp->netmask) ==
51149 + (ntohl(ipp->addr) & ipp->netmask)))
51150 + return match;
51151 + }
51152 + goto try_group;
51153 + }
51154 +
51155 + return match;
51156 +}
51157 +
51158 +struct acl_subject_label *
51159 +lookup_acl_subj_label(const ino_t ino, const dev_t dev,
51160 + const struct acl_role_label *role)
51161 +{
51162 + unsigned int index = fhash(ino, dev, role->subj_hash_size);
51163 + struct acl_subject_label *match;
51164 +
51165 + match = role->subj_hash[index];
51166 +
51167 + while (match && (match->inode != ino || match->device != dev ||
51168 + (match->mode & GR_DELETED))) {
51169 + match = match->next;
51170 + }
51171 +
51172 + if (match && !(match->mode & GR_DELETED))
51173 + return match;
51174 + else
51175 + return NULL;
51176 +}
51177 +
51178 +struct acl_subject_label *
51179 +lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
51180 + const struct acl_role_label *role)
51181 +{
51182 + unsigned int index = fhash(ino, dev, role->subj_hash_size);
51183 + struct acl_subject_label *match;
51184 +
51185 + match = role->subj_hash[index];
51186 +
51187 + while (match && (match->inode != ino || match->device != dev ||
51188 + !(match->mode & GR_DELETED))) {
51189 + match = match->next;
51190 + }
51191 +
51192 + if (match && (match->mode & GR_DELETED))
51193 + return match;
51194 + else
51195 + return NULL;
51196 +}
51197 +
51198 +static struct acl_object_label *
51199 +lookup_acl_obj_label(const ino_t ino, const dev_t dev,
51200 + const struct acl_subject_label *subj)
51201 +{
51202 + unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51203 + struct acl_object_label *match;
51204 +
51205 + match = subj->obj_hash[index];
51206 +
51207 + while (match && (match->inode != ino || match->device != dev ||
51208 + (match->mode & GR_DELETED))) {
51209 + match = match->next;
51210 + }
51211 +
51212 + if (match && !(match->mode & GR_DELETED))
51213 + return match;
51214 + else
51215 + return NULL;
51216 +}
51217 +
51218 +static struct acl_object_label *
51219 +lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
51220 + const struct acl_subject_label *subj)
51221 +{
51222 + unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51223 + struct acl_object_label *match;
51224 +
51225 + match = subj->obj_hash[index];
51226 +
51227 + while (match && (match->inode != ino || match->device != dev ||
51228 + !(match->mode & GR_DELETED))) {
51229 + match = match->next;
51230 + }
51231 +
51232 + if (match && (match->mode & GR_DELETED))
51233 + return match;
51234 +
51235 + match = subj->obj_hash[index];
51236 +
51237 + while (match && (match->inode != ino || match->device != dev ||
51238 + (match->mode & GR_DELETED))) {
51239 + match = match->next;
51240 + }
51241 +
51242 + if (match && !(match->mode & GR_DELETED))
51243 + return match;
51244 + else
51245 + return NULL;
51246 +}
51247 +
51248 +static struct name_entry *
51249 +lookup_name_entry(const char *name)
51250 +{
51251 + unsigned int len = strlen(name);
51252 + unsigned int key = full_name_hash(name, len);
51253 + unsigned int index = key % name_set.n_size;
51254 + struct name_entry *match;
51255 +
51256 + match = name_set.n_hash[index];
51257 +
51258 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
51259 + match = match->next;
51260 +
51261 + return match;
51262 +}
51263 +
51264 +static struct name_entry *
51265 +lookup_name_entry_create(const char *name)
51266 +{
51267 + unsigned int len = strlen(name);
51268 + unsigned int key = full_name_hash(name, len);
51269 + unsigned int index = key % name_set.n_size;
51270 + struct name_entry *match;
51271 +
51272 + match = name_set.n_hash[index];
51273 +
51274 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51275 + !match->deleted))
51276 + match = match->next;
51277 +
51278 + if (match && match->deleted)
51279 + return match;
51280 +
51281 + match = name_set.n_hash[index];
51282 +
51283 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51284 + match->deleted))
51285 + match = match->next;
51286 +
51287 + if (match && !match->deleted)
51288 + return match;
51289 + else
51290 + return NULL;
51291 +}
51292 +
51293 +static struct inodev_entry *
51294 +lookup_inodev_entry(const ino_t ino, const dev_t dev)
51295 +{
51296 + unsigned int index = fhash(ino, dev, inodev_set.i_size);
51297 + struct inodev_entry *match;
51298 +
51299 + match = inodev_set.i_hash[index];
51300 +
51301 + while (match && (match->nentry->inode != ino || match->nentry->device != dev))
51302 + match = match->next;
51303 +
51304 + return match;
51305 +}
51306 +
51307 +static void
51308 +insert_inodev_entry(struct inodev_entry *entry)
51309 +{
51310 + unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
51311 + inodev_set.i_size);
51312 + struct inodev_entry **curr;
51313 +
51314 + entry->prev = NULL;
51315 +
51316 + curr = &inodev_set.i_hash[index];
51317 + if (*curr != NULL)
51318 + (*curr)->prev = entry;
51319 +
51320 + entry->next = *curr;
51321 + *curr = entry;
51322 +
51323 + return;
51324 +}
51325 +
51326 +static void
51327 +__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
51328 +{
51329 + unsigned int index =
51330 + rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
51331 + struct acl_role_label **curr;
51332 + struct acl_role_label *tmp;
51333 +
51334 + curr = &acl_role_set.r_hash[index];
51335 +
51336 + /* if role was already inserted due to domains and already has
51337 + a role in the same bucket as it attached, then we need to
51338 + combine these two buckets
51339 + */
51340 + if (role->next) {
51341 + tmp = role->next;
51342 + while (tmp->next)
51343 + tmp = tmp->next;
51344 + tmp->next = *curr;
51345 + } else
51346 + role->next = *curr;
51347 + *curr = role;
51348 +
51349 + return;
51350 +}
51351 +
51352 +static void
51353 +insert_acl_role_label(struct acl_role_label *role)
51354 +{
51355 + int i;
51356 +
51357 + if (role_list == NULL) {
51358 + role_list = role;
51359 + role->prev = NULL;
51360 + } else {
51361 + role->prev = role_list;
51362 + role_list = role;
51363 + }
51364 +
51365 + /* used for hash chains */
51366 + role->next = NULL;
51367 +
51368 + if (role->roletype & GR_ROLE_DOMAIN) {
51369 + for (i = 0; i < role->domain_child_num; i++)
51370 + __insert_acl_role_label(role, role->domain_children[i]);
51371 + } else
51372 + __insert_acl_role_label(role, role->uidgid);
51373 +}
51374 +
51375 +static int
51376 +insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
51377 +{
51378 + struct name_entry **curr, *nentry;
51379 + struct inodev_entry *ientry;
51380 + unsigned int len = strlen(name);
51381 + unsigned int key = full_name_hash(name, len);
51382 + unsigned int index = key % name_set.n_size;
51383 +
51384 + curr = &name_set.n_hash[index];
51385 +
51386 + while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
51387 + curr = &((*curr)->next);
51388 +
51389 + if (*curr != NULL)
51390 + return 1;
51391 +
51392 + nentry = acl_alloc(sizeof (struct name_entry));
51393 + if (nentry == NULL)
51394 + return 0;
51395 + ientry = acl_alloc(sizeof (struct inodev_entry));
51396 + if (ientry == NULL)
51397 + return 0;
51398 + ientry->nentry = nentry;
51399 +
51400 + nentry->key = key;
51401 + nentry->name = name;
51402 + nentry->inode = inode;
51403 + nentry->device = device;
51404 + nentry->len = len;
51405 + nentry->deleted = deleted;
51406 +
51407 + nentry->prev = NULL;
51408 + curr = &name_set.n_hash[index];
51409 + if (*curr != NULL)
51410 + (*curr)->prev = nentry;
51411 + nentry->next = *curr;
51412 + *curr = nentry;
51413 +
51414 + /* insert us into the table searchable by inode/dev */
51415 + insert_inodev_entry(ientry);
51416 +
51417 + return 1;
51418 +}
51419 +
51420 +static void
51421 +insert_acl_obj_label(struct acl_object_label *obj,
51422 + struct acl_subject_label *subj)
51423 +{
51424 + unsigned int index =
51425 + fhash(obj->inode, obj->device, subj->obj_hash_size);
51426 + struct acl_object_label **curr;
51427 +
51428 +
51429 + obj->prev = NULL;
51430 +
51431 + curr = &subj->obj_hash[index];
51432 + if (*curr != NULL)
51433 + (*curr)->prev = obj;
51434 +
51435 + obj->next = *curr;
51436 + *curr = obj;
51437 +
51438 + return;
51439 +}
51440 +
51441 +static void
51442 +insert_acl_subj_label(struct acl_subject_label *obj,
51443 + struct acl_role_label *role)
51444 +{
51445 + unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
51446 + struct acl_subject_label **curr;
51447 +
51448 + obj->prev = NULL;
51449 +
51450 + curr = &role->subj_hash[index];
51451 + if (*curr != NULL)
51452 + (*curr)->prev = obj;
51453 +
51454 + obj->next = *curr;
51455 + *curr = obj;
51456 +
51457 + return;
51458 +}
51459 +
51460 +/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
51461 +
51462 +static void *
51463 +create_table(__u32 * len, int elementsize)
51464 +{
51465 + unsigned int table_sizes[] = {
51466 + 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
51467 + 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
51468 + 4194301, 8388593, 16777213, 33554393, 67108859
51469 + };
51470 + void *newtable = NULL;
51471 + unsigned int pwr = 0;
51472 +
51473 + while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
51474 + table_sizes[pwr] <= *len)
51475 + pwr++;
51476 +
51477 + if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
51478 + return newtable;
51479 +
51480 + if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
51481 + newtable =
51482 + kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
51483 + else
51484 + newtable = vmalloc(table_sizes[pwr] * elementsize);
51485 +
51486 + *len = table_sizes[pwr];
51487 +
51488 + return newtable;
51489 +}
51490 +
51491 +static int
51492 +init_variables(const struct gr_arg *arg)
51493 +{
51494 + struct task_struct *reaper = &init_task;
51495 + unsigned int stacksize;
51496 +
51497 + subj_map_set.s_size = arg->role_db.num_subjects;
51498 + acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
51499 + name_set.n_size = arg->role_db.num_objects;
51500 + inodev_set.i_size = arg->role_db.num_objects;
51501 +
51502 + if (!subj_map_set.s_size || !acl_role_set.r_size ||
51503 + !name_set.n_size || !inodev_set.i_size)
51504 + return 1;
51505 +
51506 + if (!gr_init_uidset())
51507 + return 1;
51508 +
51509 + /* set up the stack that holds allocation info */
51510 +
51511 + stacksize = arg->role_db.num_pointers + 5;
51512 +
51513 + if (!acl_alloc_stack_init(stacksize))
51514 + return 1;
51515 +
51516 + /* grab reference for the real root dentry and vfsmount */
51517 + read_lock(&reaper->fs->lock);
51518 + real_root = dget(reaper->fs->root.dentry);
51519 + real_root_mnt = mntget(reaper->fs->root.mnt);
51520 + read_unlock(&reaper->fs->lock);
51521 +
51522 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
51523 + printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root), real_root->d_inode->i_ino);
51524 +#endif
51525 +
51526 + fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
51527 + if (fakefs_obj_rw == NULL)
51528 + return 1;
51529 + fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
51530 +
51531 + fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
51532 + if (fakefs_obj_rwx == NULL)
51533 + return 1;
51534 + fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
51535 +
51536 + subj_map_set.s_hash =
51537 + (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
51538 + acl_role_set.r_hash =
51539 + (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
51540 + name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
51541 + inodev_set.i_hash =
51542 + (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
51543 +
51544 + if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
51545 + !name_set.n_hash || !inodev_set.i_hash)
51546 + return 1;
51547 +
51548 + memset(subj_map_set.s_hash, 0,
51549 + sizeof(struct subject_map *) * subj_map_set.s_size);
51550 + memset(acl_role_set.r_hash, 0,
51551 + sizeof (struct acl_role_label *) * acl_role_set.r_size);
51552 + memset(name_set.n_hash, 0,
51553 + sizeof (struct name_entry *) * name_set.n_size);
51554 + memset(inodev_set.i_hash, 0,
51555 + sizeof (struct inodev_entry *) * inodev_set.i_size);
51556 +
51557 + return 0;
51558 +}
51559 +
51560 +/* free information not needed after startup
51561 + currently contains user->kernel pointer mappings for subjects
51562 +*/
51563 +
51564 +static void
51565 +free_init_variables(void)
51566 +{
51567 + __u32 i;
51568 +
51569 + if (subj_map_set.s_hash) {
51570 + for (i = 0; i < subj_map_set.s_size; i++) {
51571 + if (subj_map_set.s_hash[i]) {
51572 + kfree(subj_map_set.s_hash[i]);
51573 + subj_map_set.s_hash[i] = NULL;
51574 + }
51575 + }
51576 +
51577 + if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
51578 + PAGE_SIZE)
51579 + kfree(subj_map_set.s_hash);
51580 + else
51581 + vfree(subj_map_set.s_hash);
51582 + }
51583 +
51584 + return;
51585 +}
51586 +
51587 +static void
51588 +free_variables(void)
51589 +{
51590 + struct acl_subject_label *s;
51591 + struct acl_role_label *r;
51592 + struct task_struct *task, *task2;
51593 + unsigned int x;
51594 +
51595 + gr_clear_learn_entries();
51596 +
51597 + read_lock(&tasklist_lock);
51598 + do_each_thread(task2, task) {
51599 + task->acl_sp_role = 0;
51600 + task->acl_role_id = 0;
51601 + task->acl = NULL;
51602 + task->role = NULL;
51603 + } while_each_thread(task2, task);
51604 + read_unlock(&tasklist_lock);
51605 +
51606 + /* release the reference to the real root dentry and vfsmount */
51607 + if (real_root)
51608 + dput(real_root);
51609 + real_root = NULL;
51610 + if (real_root_mnt)
51611 + mntput(real_root_mnt);
51612 + real_root_mnt = NULL;
51613 +
51614 + /* free all object hash tables */
51615 +
51616 + FOR_EACH_ROLE_START(r)
51617 + if (r->subj_hash == NULL)
51618 + goto next_role;
51619 + FOR_EACH_SUBJECT_START(r, s, x)
51620 + if (s->obj_hash == NULL)
51621 + break;
51622 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
51623 + kfree(s->obj_hash);
51624 + else
51625 + vfree(s->obj_hash);
51626 + FOR_EACH_SUBJECT_END(s, x)
51627 + FOR_EACH_NESTED_SUBJECT_START(r, s)
51628 + if (s->obj_hash == NULL)
51629 + break;
51630 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
51631 + kfree(s->obj_hash);
51632 + else
51633 + vfree(s->obj_hash);
51634 + FOR_EACH_NESTED_SUBJECT_END(s)
51635 + if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
51636 + kfree(r->subj_hash);
51637 + else
51638 + vfree(r->subj_hash);
51639 + r->subj_hash = NULL;
51640 +next_role:
51641 + FOR_EACH_ROLE_END(r)
51642 +
51643 + acl_free_all();
51644 +
51645 + if (acl_role_set.r_hash) {
51646 + if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
51647 + PAGE_SIZE)
51648 + kfree(acl_role_set.r_hash);
51649 + else
51650 + vfree(acl_role_set.r_hash);
51651 + }
51652 + if (name_set.n_hash) {
51653 + if ((name_set.n_size * sizeof (struct name_entry *)) <=
51654 + PAGE_SIZE)
51655 + kfree(name_set.n_hash);
51656 + else
51657 + vfree(name_set.n_hash);
51658 + }
51659 +
51660 + if (inodev_set.i_hash) {
51661 + if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
51662 + PAGE_SIZE)
51663 + kfree(inodev_set.i_hash);
51664 + else
51665 + vfree(inodev_set.i_hash);
51666 + }
51667 +
51668 + gr_free_uidset();
51669 +
51670 + memset(&name_set, 0, sizeof (struct name_db));
51671 + memset(&inodev_set, 0, sizeof (struct inodev_db));
51672 + memset(&acl_role_set, 0, sizeof (struct acl_role_db));
51673 + memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
51674 +
51675 + default_role = NULL;
51676 + role_list = NULL;
51677 +
51678 + return;
51679 +}
51680 +
51681 +static __u32
51682 +count_user_objs(struct acl_object_label *userp)
51683 +{
51684 + struct acl_object_label o_tmp;
51685 + __u32 num = 0;
51686 +
51687 + while (userp) {
51688 + if (copy_from_user(&o_tmp, userp,
51689 + sizeof (struct acl_object_label)))
51690 + break;
51691 +
51692 + userp = o_tmp.prev;
51693 + num++;
51694 + }
51695 +
51696 + return num;
51697 +}
51698 +
51699 +static struct acl_subject_label *
51700 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
51701 +
51702 +static int
51703 +copy_user_glob(struct acl_object_label *obj)
51704 +{
51705 + struct acl_object_label *g_tmp, **guser;
51706 + unsigned int len;
51707 + char *tmp;
51708 +
51709 + if (obj->globbed == NULL)
51710 + return 0;
51711 +
51712 + guser = &obj->globbed;
51713 + while (*guser) {
51714 + g_tmp = (struct acl_object_label *)
51715 + acl_alloc(sizeof (struct acl_object_label));
51716 + if (g_tmp == NULL)
51717 + return -ENOMEM;
51718 +
51719 + if (copy_from_user(g_tmp, *guser,
51720 + sizeof (struct acl_object_label)))
51721 + return -EFAULT;
51722 +
51723 + len = strnlen_user(g_tmp->filename, PATH_MAX);
51724 +
51725 + if (!len || len >= PATH_MAX)
51726 + return -EINVAL;
51727 +
51728 + if ((tmp = (char *) acl_alloc(len)) == NULL)
51729 + return -ENOMEM;
51730 +
51731 + if (copy_from_user(tmp, g_tmp->filename, len))
51732 + return -EFAULT;
51733 + tmp[len-1] = '\0';
51734 + g_tmp->filename = tmp;
51735 +
51736 + *guser = g_tmp;
51737 + guser = &(g_tmp->next);
51738 + }
51739 +
51740 + return 0;
51741 +}
51742 +
51743 +static int
51744 +copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
51745 + struct acl_role_label *role)
51746 +{
51747 + struct acl_object_label *o_tmp;
51748 + unsigned int len;
51749 + int ret;
51750 + char *tmp;
51751 +
51752 + while (userp) {
51753 + if ((o_tmp = (struct acl_object_label *)
51754 + acl_alloc(sizeof (struct acl_object_label))) == NULL)
51755 + return -ENOMEM;
51756 +
51757 + if (copy_from_user(o_tmp, userp,
51758 + sizeof (struct acl_object_label)))
51759 + return -EFAULT;
51760 +
51761 + userp = o_tmp->prev;
51762 +
51763 + len = strnlen_user(o_tmp->filename, PATH_MAX);
51764 +
51765 + if (!len || len >= PATH_MAX)
51766 + return -EINVAL;
51767 +
51768 + if ((tmp = (char *) acl_alloc(len)) == NULL)
51769 + return -ENOMEM;
51770 +
51771 + if (copy_from_user(tmp, o_tmp->filename, len))
51772 + return -EFAULT;
51773 + tmp[len-1] = '\0';
51774 + o_tmp->filename = tmp;
51775 +
51776 + insert_acl_obj_label(o_tmp, subj);
51777 + if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
51778 + o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
51779 + return -ENOMEM;
51780 +
51781 + ret = copy_user_glob(o_tmp);
51782 + if (ret)
51783 + return ret;
51784 +
51785 + if (o_tmp->nested) {
51786 + o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
51787 + if (IS_ERR(o_tmp->nested))
51788 + return PTR_ERR(o_tmp->nested);
51789 +
51790 + /* insert into nested subject list */
51791 + o_tmp->nested->next = role->hash->first;
51792 + role->hash->first = o_tmp->nested;
51793 + }
51794 + }
51795 +
51796 + return 0;
51797 +}
51798 +
51799 +static __u32
51800 +count_user_subjs(struct acl_subject_label *userp)
51801 +{
51802 + struct acl_subject_label s_tmp;
51803 + __u32 num = 0;
51804 +
51805 + while (userp) {
51806 + if (copy_from_user(&s_tmp, userp,
51807 + sizeof (struct acl_subject_label)))
51808 + break;
51809 +
51810 + userp = s_tmp.prev;
51811 + /* do not count nested subjects against this count, since
51812 + they are not included in the hash table, but are
51813 + attached to objects. We have already counted
51814 + the subjects in userspace for the allocation
51815 + stack
51816 + */
51817 + if (!(s_tmp.mode & GR_NESTED))
51818 + num++;
51819 + }
51820 +
51821 + return num;
51822 +}
51823 +
51824 +static int
51825 +copy_user_allowedips(struct acl_role_label *rolep)
51826 +{
51827 + struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
51828 +
51829 + ruserip = rolep->allowed_ips;
51830 +
51831 + while (ruserip) {
51832 + rlast = rtmp;
51833 +
51834 + if ((rtmp = (struct role_allowed_ip *)
51835 + acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
51836 + return -ENOMEM;
51837 +
51838 + if (copy_from_user(rtmp, ruserip,
51839 + sizeof (struct role_allowed_ip)))
51840 + return -EFAULT;
51841 +
51842 + ruserip = rtmp->prev;
51843 +
51844 + if (!rlast) {
51845 + rtmp->prev = NULL;
51846 + rolep->allowed_ips = rtmp;
51847 + } else {
51848 + rlast->next = rtmp;
51849 + rtmp->prev = rlast;
51850 + }
51851 +
51852 + if (!ruserip)
51853 + rtmp->next = NULL;
51854 + }
51855 +
51856 + return 0;
51857 +}
51858 +
51859 +static int
51860 +copy_user_transitions(struct acl_role_label *rolep)
51861 +{
51862 + struct role_transition *rusertp, *rtmp = NULL, *rlast;
51863 +
51864 + unsigned int len;
51865 + char *tmp;
51866 +
51867 + rusertp = rolep->transitions;
51868 +
51869 + while (rusertp) {
51870 + rlast = rtmp;
51871 +
51872 + if ((rtmp = (struct role_transition *)
51873 + acl_alloc(sizeof (struct role_transition))) == NULL)
51874 + return -ENOMEM;
51875 +
51876 + if (copy_from_user(rtmp, rusertp,
51877 + sizeof (struct role_transition)))
51878 + return -EFAULT;
51879 +
51880 + rusertp = rtmp->prev;
51881 +
51882 + len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
51883 +
51884 + if (!len || len >= GR_SPROLE_LEN)
51885 + return -EINVAL;
51886 +
51887 + if ((tmp = (char *) acl_alloc(len)) == NULL)
51888 + return -ENOMEM;
51889 +
51890 + if (copy_from_user(tmp, rtmp->rolename, len))
51891 + return -EFAULT;
51892 + tmp[len-1] = '\0';
51893 + rtmp->rolename = tmp;
51894 +
51895 + if (!rlast) {
51896 + rtmp->prev = NULL;
51897 + rolep->transitions = rtmp;
51898 + } else {
51899 + rlast->next = rtmp;
51900 + rtmp->prev = rlast;
51901 + }
51902 +
51903 + if (!rusertp)
51904 + rtmp->next = NULL;
51905 + }
51906 +
51907 + return 0;
51908 +}
51909 +
51910 +static struct acl_subject_label *
51911 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
51912 +{
51913 + struct acl_subject_label *s_tmp = NULL, *s_tmp2;
51914 + unsigned int len;
51915 + char *tmp;
51916 + __u32 num_objs;
51917 + struct acl_ip_label **i_tmp, *i_utmp2;
51918 + struct gr_hash_struct ghash;
51919 + struct subject_map *subjmap;
51920 + unsigned int i_num;
51921 + int err;
51922 +
51923 + s_tmp = lookup_subject_map(userp);
51924 +
51925 + /* we've already copied this subject into the kernel, just return
51926 + the reference to it, and don't copy it over again
51927 + */
51928 + if (s_tmp)
51929 + return(s_tmp);
51930 +
51931 + if ((s_tmp = (struct acl_subject_label *)
51932 + acl_alloc(sizeof (struct acl_subject_label))) == NULL)
51933 + return ERR_PTR(-ENOMEM);
51934 +
51935 + subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
51936 + if (subjmap == NULL)
51937 + return ERR_PTR(-ENOMEM);
51938 +
51939 + subjmap->user = userp;
51940 + subjmap->kernel = s_tmp;
51941 + insert_subj_map_entry(subjmap);
51942 +
51943 + if (copy_from_user(s_tmp, userp,
51944 + sizeof (struct acl_subject_label)))
51945 + return ERR_PTR(-EFAULT);
51946 +
51947 + len = strnlen_user(s_tmp->filename, PATH_MAX);
51948 +
51949 + if (!len || len >= PATH_MAX)
51950 + return ERR_PTR(-EINVAL);
51951 +
51952 + if ((tmp = (char *) acl_alloc(len)) == NULL)
51953 + return ERR_PTR(-ENOMEM);
51954 +
51955 + if (copy_from_user(tmp, s_tmp->filename, len))
51956 + return ERR_PTR(-EFAULT);
51957 + tmp[len-1] = '\0';
51958 + s_tmp->filename = tmp;
51959 +
51960 + if (!strcmp(s_tmp->filename, "/"))
51961 + role->root_label = s_tmp;
51962 +
51963 + if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
51964 + return ERR_PTR(-EFAULT);
51965 +
51966 + /* copy user and group transition tables */
51967 +
51968 + if (s_tmp->user_trans_num) {
51969 + uid_t *uidlist;
51970 +
51971 + uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
51972 + if (uidlist == NULL)
51973 + return ERR_PTR(-ENOMEM);
51974 + if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
51975 + return ERR_PTR(-EFAULT);
51976 +
51977 + s_tmp->user_transitions = uidlist;
51978 + }
51979 +
51980 + if (s_tmp->group_trans_num) {
51981 + gid_t *gidlist;
51982 +
51983 + gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
51984 + if (gidlist == NULL)
51985 + return ERR_PTR(-ENOMEM);
51986 + if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
51987 + return ERR_PTR(-EFAULT);
51988 +
51989 + s_tmp->group_transitions = gidlist;
51990 + }
51991 +
51992 + /* set up object hash table */
51993 + num_objs = count_user_objs(ghash.first);
51994 +
51995 + s_tmp->obj_hash_size = num_objs;
51996 + s_tmp->obj_hash =
51997 + (struct acl_object_label **)
51998 + create_table(&(s_tmp->obj_hash_size), sizeof(void *));
51999 +
52000 + if (!s_tmp->obj_hash)
52001 + return ERR_PTR(-ENOMEM);
52002 +
52003 + memset(s_tmp->obj_hash, 0,
52004 + s_tmp->obj_hash_size *
52005 + sizeof (struct acl_object_label *));
52006 +
52007 + /* add in objects */
52008 + err = copy_user_objs(ghash.first, s_tmp, role);
52009 +
52010 + if (err)
52011 + return ERR_PTR(err);
52012 +
52013 + /* set pointer for parent subject */
52014 + if (s_tmp->parent_subject) {
52015 + s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
52016 +
52017 + if (IS_ERR(s_tmp2))
52018 + return s_tmp2;
52019 +
52020 + s_tmp->parent_subject = s_tmp2;
52021 + }
52022 +
52023 + /* add in ip acls */
52024 +
52025 + if (!s_tmp->ip_num) {
52026 + s_tmp->ips = NULL;
52027 + goto insert;
52028 + }
52029 +
52030 + i_tmp =
52031 + (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
52032 + sizeof (struct acl_ip_label *));
52033 +
52034 + if (!i_tmp)
52035 + return ERR_PTR(-ENOMEM);
52036 +
52037 + for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
52038 + *(i_tmp + i_num) =
52039 + (struct acl_ip_label *)
52040 + acl_alloc(sizeof (struct acl_ip_label));
52041 + if (!*(i_tmp + i_num))
52042 + return ERR_PTR(-ENOMEM);
52043 +
52044 + if (copy_from_user
52045 + (&i_utmp2, s_tmp->ips + i_num,
52046 + sizeof (struct acl_ip_label *)))
52047 + return ERR_PTR(-EFAULT);
52048 +
52049 + if (copy_from_user
52050 + (*(i_tmp + i_num), i_utmp2,
52051 + sizeof (struct acl_ip_label)))
52052 + return ERR_PTR(-EFAULT);
52053 +
52054 + if ((*(i_tmp + i_num))->iface == NULL)
52055 + continue;
52056 +
52057 + len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
52058 + if (!len || len >= IFNAMSIZ)
52059 + return ERR_PTR(-EINVAL);
52060 + tmp = acl_alloc(len);
52061 + if (tmp == NULL)
52062 + return ERR_PTR(-ENOMEM);
52063 + if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
52064 + return ERR_PTR(-EFAULT);
52065 + (*(i_tmp + i_num))->iface = tmp;
52066 + }
52067 +
52068 + s_tmp->ips = i_tmp;
52069 +
52070 +insert:
52071 + if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
52072 + s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
52073 + return ERR_PTR(-ENOMEM);
52074 +
52075 + return s_tmp;
52076 +}
52077 +
52078 +static int
52079 +copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
52080 +{
52081 + struct acl_subject_label s_pre;
52082 + struct acl_subject_label * ret;
52083 + int err;
52084 +
52085 + while (userp) {
52086 + if (copy_from_user(&s_pre, userp,
52087 + sizeof (struct acl_subject_label)))
52088 + return -EFAULT;
52089 +
52090 + /* do not add nested subjects here, add
52091 + while parsing objects
52092 + */
52093 +
52094 + if (s_pre.mode & GR_NESTED) {
52095 + userp = s_pre.prev;
52096 + continue;
52097 + }
52098 +
52099 + ret = do_copy_user_subj(userp, role);
52100 +
52101 + err = PTR_ERR(ret);
52102 + if (IS_ERR(ret))
52103 + return err;
52104 +
52105 + insert_acl_subj_label(ret, role);
52106 +
52107 + userp = s_pre.prev;
52108 + }
52109 +
52110 + return 0;
52111 +}
52112 +
52113 +static int
52114 +copy_user_acl(struct gr_arg *arg)
52115 +{
52116 + struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
52117 + struct sprole_pw *sptmp;
52118 + struct gr_hash_struct *ghash;
52119 + uid_t *domainlist;
52120 + unsigned int r_num;
52121 + unsigned int len;
52122 + char *tmp;
52123 + int err = 0;
52124 + __u16 i;
52125 + __u32 num_subjs;
52126 +
52127 + /* we need a default and kernel role */
52128 + if (arg->role_db.num_roles < 2)
52129 + return -EINVAL;
52130 +
52131 + /* copy special role authentication info from userspace */
52132 +
52133 + num_sprole_pws = arg->num_sprole_pws;
52134 + acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
52135 +
52136 + if (!acl_special_roles) {
52137 + err = -ENOMEM;
52138 + goto cleanup;
52139 + }
52140 +
52141 + for (i = 0; i < num_sprole_pws; i++) {
52142 + sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
52143 + if (!sptmp) {
52144 + err = -ENOMEM;
52145 + goto cleanup;
52146 + }
52147 + if (copy_from_user(sptmp, arg->sprole_pws + i,
52148 + sizeof (struct sprole_pw))) {
52149 + err = -EFAULT;
52150 + goto cleanup;
52151 + }
52152 +
52153 + len =
52154 + strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
52155 +
52156 + if (!len || len >= GR_SPROLE_LEN) {
52157 + err = -EINVAL;
52158 + goto cleanup;
52159 + }
52160 +
52161 + if ((tmp = (char *) acl_alloc(len)) == NULL) {
52162 + err = -ENOMEM;
52163 + goto cleanup;
52164 + }
52165 +
52166 + if (copy_from_user(tmp, sptmp->rolename, len)) {
52167 + err = -EFAULT;
52168 + goto cleanup;
52169 + }
52170 + tmp[len-1] = '\0';
52171 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52172 + printk(KERN_ALERT "Copying special role %s\n", tmp);
52173 +#endif
52174 + sptmp->rolename = tmp;
52175 + acl_special_roles[i] = sptmp;
52176 + }
52177 +
52178 + r_utmp = (struct acl_role_label **) arg->role_db.r_table;
52179 +
52180 + for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
52181 + r_tmp = acl_alloc(sizeof (struct acl_role_label));
52182 +
52183 + if (!r_tmp) {
52184 + err = -ENOMEM;
52185 + goto cleanup;
52186 + }
52187 +
52188 + if (copy_from_user(&r_utmp2, r_utmp + r_num,
52189 + sizeof (struct acl_role_label *))) {
52190 + err = -EFAULT;
52191 + goto cleanup;
52192 + }
52193 +
52194 + if (copy_from_user(r_tmp, r_utmp2,
52195 + sizeof (struct acl_role_label))) {
52196 + err = -EFAULT;
52197 + goto cleanup;
52198 + }
52199 +
52200 + len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
52201 +
52202 + if (!len || len >= PATH_MAX) {
52203 + err = -EINVAL;
52204 + goto cleanup;
52205 + }
52206 +
52207 + if ((tmp = (char *) acl_alloc(len)) == NULL) {
52208 + err = -ENOMEM;
52209 + goto cleanup;
52210 + }
52211 + if (copy_from_user(tmp, r_tmp->rolename, len)) {
52212 + err = -EFAULT;
52213 + goto cleanup;
52214 + }
52215 + tmp[len-1] = '\0';
52216 + r_tmp->rolename = tmp;
52217 +
52218 + if (!strcmp(r_tmp->rolename, "default")
52219 + && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
52220 + default_role = r_tmp;
52221 + } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
52222 + kernel_role = r_tmp;
52223 + }
52224 +
52225 + if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
52226 + err = -ENOMEM;
52227 + goto cleanup;
52228 + }
52229 + if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
52230 + err = -EFAULT;
52231 + goto cleanup;
52232 + }
52233 +
52234 + r_tmp->hash = ghash;
52235 +
52236 + num_subjs = count_user_subjs(r_tmp->hash->first);
52237 +
52238 + r_tmp->subj_hash_size = num_subjs;
52239 + r_tmp->subj_hash =
52240 + (struct acl_subject_label **)
52241 + create_table(&(r_tmp->subj_hash_size), sizeof(void *));
52242 +
52243 + if (!r_tmp->subj_hash) {
52244 + err = -ENOMEM;
52245 + goto cleanup;
52246 + }
52247 +
52248 + err = copy_user_allowedips(r_tmp);
52249 + if (err)
52250 + goto cleanup;
52251 +
52252 + /* copy domain info */
52253 + if (r_tmp->domain_children != NULL) {
52254 + domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
52255 + if (domainlist == NULL) {
52256 + err = -ENOMEM;
52257 + goto cleanup;
52258 + }
52259 + if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
52260 + err = -EFAULT;
52261 + goto cleanup;
52262 + }
52263 + r_tmp->domain_children = domainlist;
52264 + }
52265 +
52266 + err = copy_user_transitions(r_tmp);
52267 + if (err)
52268 + goto cleanup;
52269 +
52270 + memset(r_tmp->subj_hash, 0,
52271 + r_tmp->subj_hash_size *
52272 + sizeof (struct acl_subject_label *));
52273 +
52274 + err = copy_user_subjs(r_tmp->hash->first, r_tmp);
52275 +
52276 + if (err)
52277 + goto cleanup;
52278 +
52279 + /* set nested subject list to null */
52280 + r_tmp->hash->first = NULL;
52281 +
52282 + insert_acl_role_label(r_tmp);
52283 + }
52284 +
52285 + goto return_err;
52286 + cleanup:
52287 + free_variables();
52288 + return_err:
52289 + return err;
52290 +
52291 +}
52292 +
52293 +static int
52294 +gracl_init(struct gr_arg *args)
52295 +{
52296 + int error = 0;
52297 +
52298 + memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
52299 + memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
52300 +
52301 + if (init_variables(args)) {
52302 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
52303 + error = -ENOMEM;
52304 + free_variables();
52305 + goto out;
52306 + }
52307 +
52308 + error = copy_user_acl(args);
52309 + free_init_variables();
52310 + if (error) {
52311 + free_variables();
52312 + goto out;
52313 + }
52314 +
52315 + if ((error = gr_set_acls(0))) {
52316 + free_variables();
52317 + goto out;
52318 + }
52319 +
52320 + pax_open_kernel();
52321 + gr_status |= GR_READY;
52322 + pax_close_kernel();
52323 +
52324 + out:
52325 + return error;
52326 +}
52327 +
52328 +/* derived from glibc fnmatch() 0: match, 1: no match*/
52329 +
52330 +static int
52331 +glob_match(const char *p, const char *n)
52332 +{
52333 + char c;
52334 +
52335 + while ((c = *p++) != '\0') {
52336 + switch (c) {
52337 + case '?':
52338 + if (*n == '\0')
52339 + return 1;
52340 + else if (*n == '/')
52341 + return 1;
52342 + break;
52343 + case '\\':
52344 + if (*n != c)
52345 + return 1;
52346 + break;
52347 + case '*':
52348 + for (c = *p++; c == '?' || c == '*'; c = *p++) {
52349 + if (*n == '/')
52350 + return 1;
52351 + else if (c == '?') {
52352 + if (*n == '\0')
52353 + return 1;
52354 + else
52355 + ++n;
52356 + }
52357 + }
52358 + if (c == '\0') {
52359 + return 0;
52360 + } else {
52361 + const char *endp;
52362 +
52363 + if ((endp = strchr(n, '/')) == NULL)
52364 + endp = n + strlen(n);
52365 +
52366 + if (c == '[') {
52367 + for (--p; n < endp; ++n)
52368 + if (!glob_match(p, n))
52369 + return 0;
52370 + } else if (c == '/') {
52371 + while (*n != '\0' && *n != '/')
52372 + ++n;
52373 + if (*n == '/' && !glob_match(p, n + 1))
52374 + return 0;
52375 + } else {
52376 + for (--p; n < endp; ++n)
52377 + if (*n == c && !glob_match(p, n))
52378 + return 0;
52379 + }
52380 +
52381 + return 1;
52382 + }
52383 + case '[':
52384 + {
52385 + int not;
52386 + char cold;
52387 +
52388 + if (*n == '\0' || *n == '/')
52389 + return 1;
52390 +
52391 + not = (*p == '!' || *p == '^');
52392 + if (not)
52393 + ++p;
52394 +
52395 + c = *p++;
52396 + for (;;) {
52397 + unsigned char fn = (unsigned char)*n;
52398 +
52399 + if (c == '\0')
52400 + return 1;
52401 + else {
52402 + if (c == fn)
52403 + goto matched;
52404 + cold = c;
52405 + c = *p++;
52406 +
52407 + if (c == '-' && *p != ']') {
52408 + unsigned char cend = *p++;
52409 +
52410 + if (cend == '\0')
52411 + return 1;
52412 +
52413 + if (cold <= fn && fn <= cend)
52414 + goto matched;
52415 +
52416 + c = *p++;
52417 + }
52418 + }
52419 +
52420 + if (c == ']')
52421 + break;
52422 + }
52423 + if (!not)
52424 + return 1;
52425 + break;
52426 + matched:
52427 + while (c != ']') {
52428 + if (c == '\0')
52429 + return 1;
52430 +
52431 + c = *p++;
52432 + }
52433 + if (not)
52434 + return 1;
52435 + }
52436 + break;
52437 + default:
52438 + if (c != *n)
52439 + return 1;
52440 + }
52441 +
52442 + ++n;
52443 + }
52444 +
52445 + if (*n == '\0')
52446 + return 0;
52447 +
52448 + if (*n == '/')
52449 + return 0;
52450 +
52451 + return 1;
52452 +}
52453 +
52454 +static struct acl_object_label *
52455 +chk_glob_label(struct acl_object_label *globbed,
52456 + struct dentry *dentry, struct vfsmount *mnt, char **path)
52457 +{
52458 + struct acl_object_label *tmp;
52459 +
52460 + if (*path == NULL)
52461 + *path = gr_to_filename_nolock(dentry, mnt);
52462 +
52463 + tmp = globbed;
52464 +
52465 + while (tmp) {
52466 + if (!glob_match(tmp->filename, *path))
52467 + return tmp;
52468 + tmp = tmp->next;
52469 + }
52470 +
52471 + return NULL;
52472 +}
52473 +
52474 +static struct acl_object_label *
52475 +__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
52476 + const ino_t curr_ino, const dev_t curr_dev,
52477 + const struct acl_subject_label *subj, char **path, const int checkglob)
52478 +{
52479 + struct acl_subject_label *tmpsubj;
52480 + struct acl_object_label *retval;
52481 + struct acl_object_label *retval2;
52482 +
52483 + tmpsubj = (struct acl_subject_label *) subj;
52484 + read_lock(&gr_inode_lock);
52485 + do {
52486 + retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
52487 + if (retval) {
52488 + if (checkglob && retval->globbed) {
52489 + retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
52490 + (struct vfsmount *)orig_mnt, path);
52491 + if (retval2)
52492 + retval = retval2;
52493 + }
52494 + break;
52495 + }
52496 + } while ((tmpsubj = tmpsubj->parent_subject));
52497 + read_unlock(&gr_inode_lock);
52498 +
52499 + return retval;
52500 +}
52501 +
52502 +static __inline__ struct acl_object_label *
52503 +full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
52504 + const struct dentry *curr_dentry,
52505 + const struct acl_subject_label *subj, char **path, const int checkglob)
52506 +{
52507 + int newglob = checkglob;
52508 +
52509 + /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
52510 + as we don't want a / * rule to match instead of the / object
52511 + don't do this for create lookups that call this function though, since they're looking up
52512 + on the parent and thus need globbing checks on all paths
52513 + */
52514 + if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
52515 + newglob = GR_NO_GLOB;
52516 +
52517 + return __full_lookup(orig_dentry, orig_mnt,
52518 + curr_dentry->d_inode->i_ino,
52519 + __get_dev(curr_dentry), subj, path, newglob);
52520 +}
52521 +
52522 +static struct acl_object_label *
52523 +__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52524 + const struct acl_subject_label *subj, char *path, const int checkglob)
52525 +{
52526 + struct dentry *dentry = (struct dentry *) l_dentry;
52527 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
52528 + struct acl_object_label *retval;
52529 +
52530 + spin_lock(&dcache_lock);
52531 + spin_lock(&vfsmount_lock);
52532 +
52533 + if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
52534 +#ifdef CONFIG_NET
52535 + mnt == sock_mnt ||
52536 +#endif
52537 +#ifdef CONFIG_HUGETLBFS
52538 + (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
52539 +#endif
52540 + /* ignore Eric Biederman */
52541 + IS_PRIVATE(l_dentry->d_inode))) {
52542 + retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
52543 + goto out;
52544 + }
52545 +
52546 + for (;;) {
52547 + if (dentry == real_root && mnt == real_root_mnt)
52548 + break;
52549 +
52550 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
52551 + if (mnt->mnt_parent == mnt)
52552 + break;
52553 +
52554 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
52555 + if (retval != NULL)
52556 + goto out;
52557 +
52558 + dentry = mnt->mnt_mountpoint;
52559 + mnt = mnt->mnt_parent;
52560 + continue;
52561 + }
52562 +
52563 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
52564 + if (retval != NULL)
52565 + goto out;
52566 +
52567 + dentry = dentry->d_parent;
52568 + }
52569 +
52570 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
52571 +
52572 + if (retval == NULL)
52573 + retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
52574 +out:
52575 + spin_unlock(&vfsmount_lock);
52576 + spin_unlock(&dcache_lock);
52577 +
52578 + BUG_ON(retval == NULL);
52579 +
52580 + return retval;
52581 +}
52582 +
52583 +static __inline__ struct acl_object_label *
52584 +chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52585 + const struct acl_subject_label *subj)
52586 +{
52587 + char *path = NULL;
52588 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
52589 +}
52590 +
52591 +static __inline__ struct acl_object_label *
52592 +chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52593 + const struct acl_subject_label *subj)
52594 +{
52595 + char *path = NULL;
52596 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
52597 +}
52598 +
52599 +static __inline__ struct acl_object_label *
52600 +chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52601 + const struct acl_subject_label *subj, char *path)
52602 +{
52603 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
52604 +}
52605 +
52606 +static struct acl_subject_label *
52607 +chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
52608 + const struct acl_role_label *role)
52609 +{
52610 + struct dentry *dentry = (struct dentry *) l_dentry;
52611 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
52612 + struct acl_subject_label *retval;
52613 +
52614 + spin_lock(&dcache_lock);
52615 + spin_lock(&vfsmount_lock);
52616 +
52617 + for (;;) {
52618 + if (dentry == real_root && mnt == real_root_mnt)
52619 + break;
52620 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
52621 + if (mnt->mnt_parent == mnt)
52622 + break;
52623 +
52624 + read_lock(&gr_inode_lock);
52625 + retval =
52626 + lookup_acl_subj_label(dentry->d_inode->i_ino,
52627 + __get_dev(dentry), role);
52628 + read_unlock(&gr_inode_lock);
52629 + if (retval != NULL)
52630 + goto out;
52631 +
52632 + dentry = mnt->mnt_mountpoint;
52633 + mnt = mnt->mnt_parent;
52634 + continue;
52635 + }
52636 +
52637 + read_lock(&gr_inode_lock);
52638 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
52639 + __get_dev(dentry), role);
52640 + read_unlock(&gr_inode_lock);
52641 + if (retval != NULL)
52642 + goto out;
52643 +
52644 + dentry = dentry->d_parent;
52645 + }
52646 +
52647 + read_lock(&gr_inode_lock);
52648 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
52649 + __get_dev(dentry), role);
52650 + read_unlock(&gr_inode_lock);
52651 +
52652 + if (unlikely(retval == NULL)) {
52653 + read_lock(&gr_inode_lock);
52654 + retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
52655 + __get_dev(real_root), role);
52656 + read_unlock(&gr_inode_lock);
52657 + }
52658 +out:
52659 + spin_unlock(&vfsmount_lock);
52660 + spin_unlock(&dcache_lock);
52661 +
52662 + BUG_ON(retval == NULL);
52663 +
52664 + return retval;
52665 +}
52666 +
52667 +static void
52668 +gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
52669 +{
52670 + struct task_struct *task = current;
52671 + const struct cred *cred = current_cred();
52672 +
52673 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
52674 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
52675 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
52676 + 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
52677 +
52678 + return;
52679 +}
52680 +
52681 +static void
52682 +gr_log_learn_sysctl(const char *path, const __u32 mode)
52683 +{
52684 + struct task_struct *task = current;
52685 + const struct cred *cred = current_cred();
52686 +
52687 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
52688 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
52689 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
52690 + 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
52691 +
52692 + return;
52693 +}
52694 +
52695 +static void
52696 +gr_log_learn_id_change(const char type, const unsigned int real,
52697 + const unsigned int effective, const unsigned int fs)
52698 +{
52699 + struct task_struct *task = current;
52700 + const struct cred *cred = current_cred();
52701 +
52702 + security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
52703 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
52704 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
52705 + type, real, effective, fs, &task->signal->saved_ip);
52706 +
52707 + return;
52708 +}
52709 +
52710 +__u32
52711 +gr_search_file(const struct dentry * dentry, const __u32 mode,
52712 + const struct vfsmount * mnt)
52713 +{
52714 + __u32 retval = mode;
52715 + struct acl_subject_label *curracl;
52716 + struct acl_object_label *currobj;
52717 +
52718 + if (unlikely(!(gr_status & GR_READY)))
52719 + return (mode & ~GR_AUDITS);
52720 +
52721 + curracl = current->acl;
52722 +
52723 + currobj = chk_obj_label(dentry, mnt, curracl);
52724 + retval = currobj->mode & mode;
52725 +
52726 + /* if we're opening a specified transfer file for writing
52727 + (e.g. /dev/initctl), then transfer our role to init
52728 + */
52729 + if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
52730 + current->role->roletype & GR_ROLE_PERSIST)) {
52731 + struct task_struct *task = init_pid_ns.child_reaper;
52732 +
52733 + if (task->role != current->role) {
52734 + task->acl_sp_role = 0;
52735 + task->acl_role_id = current->acl_role_id;
52736 + task->role = current->role;
52737 + rcu_read_lock();
52738 + read_lock(&grsec_exec_file_lock);
52739 + gr_apply_subject_to_task(task);
52740 + read_unlock(&grsec_exec_file_lock);
52741 + rcu_read_unlock();
52742 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
52743 + }
52744 + }
52745 +
52746 + if (unlikely
52747 + ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
52748 + && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
52749 + __u32 new_mode = mode;
52750 +
52751 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
52752 +
52753 + retval = new_mode;
52754 +
52755 + if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
52756 + new_mode |= GR_INHERIT;
52757 +
52758 + if (!(mode & GR_NOLEARN))
52759 + gr_log_learn(dentry, mnt, new_mode);
52760 + }
52761 +
52762 + return retval;
52763 +}
52764 +
52765 +struct acl_object_label *gr_get_create_object(const struct dentry *new_dentry,
52766 + const struct dentry *parent,
52767 + const struct vfsmount *mnt)
52768 +{
52769 + struct name_entry *match;
52770 + struct acl_object_label *matchpo;
52771 + struct acl_subject_label *curracl;
52772 + char *path;
52773 +
52774 + if (unlikely(!(gr_status & GR_READY)))
52775 + return NULL;
52776 +
52777 + preempt_disable();
52778 + path = gr_to_filename_rbac(new_dentry, mnt);
52779 + match = lookup_name_entry_create(path);
52780 +
52781 + curracl = current->acl;
52782 +
52783 + if (match) {
52784 + read_lock(&gr_inode_lock);
52785 + matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
52786 + read_unlock(&gr_inode_lock);
52787 +
52788 + if (matchpo) {
52789 + preempt_enable();
52790 + return matchpo;
52791 + }
52792 + }
52793 +
52794 + // lookup parent
52795 +
52796 + matchpo = chk_obj_create_label(parent, mnt, curracl, path);
52797 +
52798 + preempt_enable();
52799 + return matchpo;
52800 +}
52801 +
52802 +__u32
52803 +gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
52804 + const struct vfsmount * mnt, const __u32 mode)
52805 +{
52806 + struct acl_object_label *matchpo;
52807 + __u32 retval;
52808 +
52809 + if (unlikely(!(gr_status & GR_READY)))
52810 + return (mode & ~GR_AUDITS);
52811 +
52812 + matchpo = gr_get_create_object(new_dentry, parent, mnt);
52813 +
52814 + retval = matchpo->mode & mode;
52815 +
52816 + if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
52817 + && (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
52818 + __u32 new_mode = mode;
52819 +
52820 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
52821 +
52822 + gr_log_learn(new_dentry, mnt, new_mode);
52823 + return new_mode;
52824 + }
52825 +
52826 + return retval;
52827 +}
52828 +
52829 +__u32
52830 +gr_check_link(const struct dentry * new_dentry,
52831 + const struct dentry * parent_dentry,
52832 + const struct vfsmount * parent_mnt,
52833 + const struct dentry * old_dentry, const struct vfsmount * old_mnt)
52834 +{
52835 + struct acl_object_label *obj;
52836 + __u32 oldmode, newmode;
52837 + __u32 needmode;
52838 + __u32 checkmodes = GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC | GR_SETID | GR_READ |
52839 + GR_DELETE | GR_INHERIT;
52840 +
52841 + if (unlikely(!(gr_status & GR_READY)))
52842 + return (GR_CREATE | GR_LINK);
52843 +
52844 + obj = chk_obj_label(old_dentry, old_mnt, current->acl);
52845 + oldmode = obj->mode;
52846 +
52847 + obj = gr_get_create_object(new_dentry, parent_dentry, parent_mnt);
52848 + newmode = obj->mode;
52849 +
52850 + needmode = newmode & checkmodes;
52851 +
52852 + // old name for hardlink must have at least the permissions of the new name
52853 + if ((oldmode & needmode) != needmode)
52854 + goto bad;
52855 +
52856 + // if old name had restrictions/auditing, make sure the new name does as well
52857 + needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
52858 +
52859 + // don't allow hardlinking of suid/sgid files without permission
52860 + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
52861 + needmode |= GR_SETID;
52862 +
52863 + if ((newmode & needmode) != needmode)
52864 + goto bad;
52865 +
52866 + // enforce minimum permissions
52867 + if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
52868 + return newmode;
52869 +bad:
52870 + needmode = oldmode;
52871 + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
52872 + needmode |= GR_SETID;
52873 +
52874 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
52875 + gr_log_learn(old_dentry, old_mnt, needmode | GR_CREATE | GR_LINK);
52876 + return (GR_CREATE | GR_LINK);
52877 + } else if (newmode & GR_SUPPRESS)
52878 + return GR_SUPPRESS;
52879 + else
52880 + return 0;
52881 +}
52882 +
52883 +int
52884 +gr_check_hidden_task(const struct task_struct *task)
52885 +{
52886 + if (unlikely(!(gr_status & GR_READY)))
52887 + return 0;
52888 +
52889 + if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
52890 + return 1;
52891 +
52892 + return 0;
52893 +}
52894 +
52895 +int
52896 +gr_check_protected_task(const struct task_struct *task)
52897 +{
52898 + if (unlikely(!(gr_status & GR_READY) || !task))
52899 + return 0;
52900 +
52901 + if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
52902 + task->acl != current->acl)
52903 + return 1;
52904 +
52905 + return 0;
52906 +}
52907 +
52908 +int
52909 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
52910 +{
52911 + struct task_struct *p;
52912 + int ret = 0;
52913 +
52914 + if (unlikely(!(gr_status & GR_READY) || !pid))
52915 + return ret;
52916 +
52917 + read_lock(&tasklist_lock);
52918 + do_each_pid_task(pid, type, p) {
52919 + if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
52920 + p->acl != current->acl) {
52921 + ret = 1;
52922 + goto out;
52923 + }
52924 + } while_each_pid_task(pid, type, p);
52925 +out:
52926 + read_unlock(&tasklist_lock);
52927 +
52928 + return ret;
52929 +}
52930 +
52931 +void
52932 +gr_copy_label(struct task_struct *tsk)
52933 +{
52934 + tsk->signal->used_accept = 0;
52935 + tsk->acl_sp_role = 0;
52936 + tsk->acl_role_id = current->acl_role_id;
52937 + tsk->acl = current->acl;
52938 + tsk->role = current->role;
52939 + tsk->signal->curr_ip = current->signal->curr_ip;
52940 + tsk->signal->saved_ip = current->signal->saved_ip;
52941 + if (current->exec_file)
52942 + get_file(current->exec_file);
52943 + tsk->exec_file = current->exec_file;
52944 + tsk->is_writable = current->is_writable;
52945 + if (unlikely(current->signal->used_accept)) {
52946 + current->signal->curr_ip = 0;
52947 + current->signal->saved_ip = 0;
52948 + }
52949 +
52950 + return;
52951 +}
52952 +
52953 +static void
52954 +gr_set_proc_res(struct task_struct *task)
52955 +{
52956 + struct acl_subject_label *proc;
52957 + unsigned short i;
52958 +
52959 + proc = task->acl;
52960 +
52961 + if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
52962 + return;
52963 +
52964 + for (i = 0; i < RLIM_NLIMITS; i++) {
52965 + if (!(proc->resmask & (1 << i)))
52966 + continue;
52967 +
52968 + task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
52969 + task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
52970 + }
52971 +
52972 + return;
52973 +}
52974 +
52975 +extern int __gr_process_user_ban(struct user_struct *user);
52976 +
52977 +int
52978 +gr_check_user_change(int real, int effective, int fs)
52979 +{
52980 + unsigned int i;
52981 + __u16 num;
52982 + uid_t *uidlist;
52983 + int curuid;
52984 + int realok = 0;
52985 + int effectiveok = 0;
52986 + int fsok = 0;
52987 +
52988 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
52989 + struct user_struct *user;
52990 +
52991 + if (real == -1)
52992 + goto skipit;
52993 +
52994 + user = find_user(real);
52995 + if (user == NULL)
52996 + goto skipit;
52997 +
52998 + if (__gr_process_user_ban(user)) {
52999 + /* for find_user */
53000 + free_uid(user);
53001 + return 1;
53002 + }
53003 +
53004 + /* for find_user */
53005 + free_uid(user);
53006 +
53007 +skipit:
53008 +#endif
53009 +
53010 + if (unlikely(!(gr_status & GR_READY)))
53011 + return 0;
53012 +
53013 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53014 + gr_log_learn_id_change('u', real, effective, fs);
53015 +
53016 + num = current->acl->user_trans_num;
53017 + uidlist = current->acl->user_transitions;
53018 +
53019 + if (uidlist == NULL)
53020 + return 0;
53021 +
53022 + if (real == -1)
53023 + realok = 1;
53024 + if (effective == -1)
53025 + effectiveok = 1;
53026 + if (fs == -1)
53027 + fsok = 1;
53028 +
53029 + if (current->acl->user_trans_type & GR_ID_ALLOW) {
53030 + for (i = 0; i < num; i++) {
53031 + curuid = (int)uidlist[i];
53032 + if (real == curuid)
53033 + realok = 1;
53034 + if (effective == curuid)
53035 + effectiveok = 1;
53036 + if (fs == curuid)
53037 + fsok = 1;
53038 + }
53039 + } else if (current->acl->user_trans_type & GR_ID_DENY) {
53040 + for (i = 0; i < num; i++) {
53041 + curuid = (int)uidlist[i];
53042 + if (real == curuid)
53043 + break;
53044 + if (effective == curuid)
53045 + break;
53046 + if (fs == curuid)
53047 + break;
53048 + }
53049 + /* not in deny list */
53050 + if (i == num) {
53051 + realok = 1;
53052 + effectiveok = 1;
53053 + fsok = 1;
53054 + }
53055 + }
53056 +
53057 + if (realok && effectiveok && fsok)
53058 + return 0;
53059 + else {
53060 + gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53061 + return 1;
53062 + }
53063 +}
53064 +
53065 +int
53066 +gr_check_group_change(int real, int effective, int fs)
53067 +{
53068 + unsigned int i;
53069 + __u16 num;
53070 + gid_t *gidlist;
53071 + int curgid;
53072 + int realok = 0;
53073 + int effectiveok = 0;
53074 + int fsok = 0;
53075 +
53076 + if (unlikely(!(gr_status & GR_READY)))
53077 + return 0;
53078 +
53079 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53080 + gr_log_learn_id_change('g', real, effective, fs);
53081 +
53082 + num = current->acl->group_trans_num;
53083 + gidlist = current->acl->group_transitions;
53084 +
53085 + if (gidlist == NULL)
53086 + return 0;
53087 +
53088 + if (real == -1)
53089 + realok = 1;
53090 + if (effective == -1)
53091 + effectiveok = 1;
53092 + if (fs == -1)
53093 + fsok = 1;
53094 +
53095 + if (current->acl->group_trans_type & GR_ID_ALLOW) {
53096 + for (i = 0; i < num; i++) {
53097 + curgid = (int)gidlist[i];
53098 + if (real == curgid)
53099 + realok = 1;
53100 + if (effective == curgid)
53101 + effectiveok = 1;
53102 + if (fs == curgid)
53103 + fsok = 1;
53104 + }
53105 + } else if (current->acl->group_trans_type & GR_ID_DENY) {
53106 + for (i = 0; i < num; i++) {
53107 + curgid = (int)gidlist[i];
53108 + if (real == curgid)
53109 + break;
53110 + if (effective == curgid)
53111 + break;
53112 + if (fs == curgid)
53113 + break;
53114 + }
53115 + /* not in deny list */
53116 + if (i == num) {
53117 + realok = 1;
53118 + effectiveok = 1;
53119 + fsok = 1;
53120 + }
53121 + }
53122 +
53123 + if (realok && effectiveok && fsok)
53124 + return 0;
53125 + else {
53126 + gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53127 + return 1;
53128 + }
53129 +}
53130 +
53131 +void
53132 +gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
53133 +{
53134 + struct acl_role_label *role = task->role;
53135 + struct acl_subject_label *subj = NULL;
53136 + struct acl_object_label *obj;
53137 + struct file *filp;
53138 +
53139 + if (unlikely(!(gr_status & GR_READY)))
53140 + return;
53141 +
53142 + filp = task->exec_file;
53143 +
53144 + /* kernel process, we'll give them the kernel role */
53145 + if (unlikely(!filp)) {
53146 + task->role = kernel_role;
53147 + task->acl = kernel_role->root_label;
53148 + return;
53149 + } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
53150 + role = lookup_acl_role_label(task, uid, gid);
53151 +
53152 + /* perform subject lookup in possibly new role
53153 + we can use this result below in the case where role == task->role
53154 + */
53155 + subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
53156 +
53157 + /* if we changed uid/gid, but result in the same role
53158 + and are using inheritance, don't lose the inherited subject
53159 + if current subject is other than what normal lookup
53160 + would result in, we arrived via inheritance, don't
53161 + lose subject
53162 + */
53163 + if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
53164 + (subj == task->acl)))
53165 + task->acl = subj;
53166 +
53167 + task->role = role;
53168 +
53169 + task->is_writable = 0;
53170 +
53171 + /* ignore additional mmap checks for processes that are writable
53172 + by the default ACL */
53173 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53174 + if (unlikely(obj->mode & GR_WRITE))
53175 + task->is_writable = 1;
53176 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
53177 + if (unlikely(obj->mode & GR_WRITE))
53178 + task->is_writable = 1;
53179 +
53180 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53181 + printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53182 +#endif
53183 +
53184 + gr_set_proc_res(task);
53185 +
53186 + return;
53187 +}
53188 +
53189 +int
53190 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
53191 + const int unsafe_share)
53192 +{
53193 + struct task_struct *task = current;
53194 + struct acl_subject_label *newacl;
53195 + struct acl_object_label *obj;
53196 + __u32 retmode;
53197 +
53198 + if (unlikely(!(gr_status & GR_READY)))
53199 + return 0;
53200 +
53201 + newacl = chk_subj_label(dentry, mnt, task->role);
53202 +
53203 + task_lock(task);
53204 + if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
53205 + !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
53206 + !(task->role->roletype & GR_ROLE_GOD) &&
53207 + !gr_search_file(dentry, GR_PTRACERD, mnt) &&
53208 + !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
53209 + task_unlock(task);
53210 + if (unsafe_share)
53211 + gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
53212 + else
53213 + gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
53214 + return -EACCES;
53215 + }
53216 + task_unlock(task);
53217 +
53218 + obj = chk_obj_label(dentry, mnt, task->acl);
53219 + retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
53220 +
53221 + if (!(task->acl->mode & GR_INHERITLEARN) &&
53222 + ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
53223 + if (obj->nested)
53224 + task->acl = obj->nested;
53225 + else
53226 + task->acl = newacl;
53227 + } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
53228 + gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
53229 +
53230 + task->is_writable = 0;
53231 +
53232 + /* ignore additional mmap checks for processes that are writable
53233 + by the default ACL */
53234 + obj = chk_obj_label(dentry, mnt, default_role->root_label);
53235 + if (unlikely(obj->mode & GR_WRITE))
53236 + task->is_writable = 1;
53237 + obj = chk_obj_label(dentry, mnt, task->role->root_label);
53238 + if (unlikely(obj->mode & GR_WRITE))
53239 + task->is_writable = 1;
53240 +
53241 + gr_set_proc_res(task);
53242 +
53243 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53244 + printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53245 +#endif
53246 + return 0;
53247 +}
53248 +
53249 +/* always called with valid inodev ptr */
53250 +static void
53251 +do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
53252 +{
53253 + struct acl_object_label *matchpo;
53254 + struct acl_subject_label *matchps;
53255 + struct acl_subject_label *subj;
53256 + struct acl_role_label *role;
53257 + unsigned int x;
53258 +
53259 + FOR_EACH_ROLE_START(role)
53260 + FOR_EACH_SUBJECT_START(role, subj, x)
53261 + if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
53262 + matchpo->mode |= GR_DELETED;
53263 + FOR_EACH_SUBJECT_END(subj,x)
53264 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
53265 + if (subj->inode == ino && subj->device == dev)
53266 + subj->mode |= GR_DELETED;
53267 + FOR_EACH_NESTED_SUBJECT_END(subj)
53268 + if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
53269 + matchps->mode |= GR_DELETED;
53270 + FOR_EACH_ROLE_END(role)
53271 +
53272 + inodev->nentry->deleted = 1;
53273 +
53274 + return;
53275 +}
53276 +
53277 +void
53278 +gr_handle_delete(const ino_t ino, const dev_t dev)
53279 +{
53280 + struct inodev_entry *inodev;
53281 +
53282 + if (unlikely(!(gr_status & GR_READY)))
53283 + return;
53284 +
53285 + write_lock(&gr_inode_lock);
53286 + inodev = lookup_inodev_entry(ino, dev);
53287 + if (inodev != NULL)
53288 + do_handle_delete(inodev, ino, dev);
53289 + write_unlock(&gr_inode_lock);
53290 +
53291 + return;
53292 +}
53293 +
53294 +static void
53295 +update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
53296 + const ino_t newinode, const dev_t newdevice,
53297 + struct acl_subject_label *subj)
53298 +{
53299 + unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
53300 + struct acl_object_label *match;
53301 +
53302 + match = subj->obj_hash[index];
53303 +
53304 + while (match && (match->inode != oldinode ||
53305 + match->device != olddevice ||
53306 + !(match->mode & GR_DELETED)))
53307 + match = match->next;
53308 +
53309 + if (match && (match->inode == oldinode)
53310 + && (match->device == olddevice)
53311 + && (match->mode & GR_DELETED)) {
53312 + if (match->prev == NULL) {
53313 + subj->obj_hash[index] = match->next;
53314 + if (match->next != NULL)
53315 + match->next->prev = NULL;
53316 + } else {
53317 + match->prev->next = match->next;
53318 + if (match->next != NULL)
53319 + match->next->prev = match->prev;
53320 + }
53321 + match->prev = NULL;
53322 + match->next = NULL;
53323 + match->inode = newinode;
53324 + match->device = newdevice;
53325 + match->mode &= ~GR_DELETED;
53326 +
53327 + insert_acl_obj_label(match, subj);
53328 + }
53329 +
53330 + return;
53331 +}
53332 +
53333 +static void
53334 +update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
53335 + const ino_t newinode, const dev_t newdevice,
53336 + struct acl_role_label *role)
53337 +{
53338 + unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
53339 + struct acl_subject_label *match;
53340 +
53341 + match = role->subj_hash[index];
53342 +
53343 + while (match && (match->inode != oldinode ||
53344 + match->device != olddevice ||
53345 + !(match->mode & GR_DELETED)))
53346 + match = match->next;
53347 +
53348 + if (match && (match->inode == oldinode)
53349 + && (match->device == olddevice)
53350 + && (match->mode & GR_DELETED)) {
53351 + if (match->prev == NULL) {
53352 + role->subj_hash[index] = match->next;
53353 + if (match->next != NULL)
53354 + match->next->prev = NULL;
53355 + } else {
53356 + match->prev->next = match->next;
53357 + if (match->next != NULL)
53358 + match->next->prev = match->prev;
53359 + }
53360 + match->prev = NULL;
53361 + match->next = NULL;
53362 + match->inode = newinode;
53363 + match->device = newdevice;
53364 + match->mode &= ~GR_DELETED;
53365 +
53366 + insert_acl_subj_label(match, role);
53367 + }
53368 +
53369 + return;
53370 +}
53371 +
53372 +static void
53373 +update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
53374 + const ino_t newinode, const dev_t newdevice)
53375 +{
53376 + unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
53377 + struct inodev_entry *match;
53378 +
53379 + match = inodev_set.i_hash[index];
53380 +
53381 + while (match && (match->nentry->inode != oldinode ||
53382 + match->nentry->device != olddevice || !match->nentry->deleted))
53383 + match = match->next;
53384 +
53385 + if (match && (match->nentry->inode == oldinode)
53386 + && (match->nentry->device == olddevice) &&
53387 + match->nentry->deleted) {
53388 + if (match->prev == NULL) {
53389 + inodev_set.i_hash[index] = match->next;
53390 + if (match->next != NULL)
53391 + match->next->prev = NULL;
53392 + } else {
53393 + match->prev->next = match->next;
53394 + if (match->next != NULL)
53395 + match->next->prev = match->prev;
53396 + }
53397 + match->prev = NULL;
53398 + match->next = NULL;
53399 + match->nentry->inode = newinode;
53400 + match->nentry->device = newdevice;
53401 + match->nentry->deleted = 0;
53402 +
53403 + insert_inodev_entry(match);
53404 + }
53405 +
53406 + return;
53407 +}
53408 +
53409 +static void
53410 +__do_handle_create(const struct name_entry *matchn, ino_t inode, dev_t dev)
53411 +{
53412 + struct acl_subject_label *subj;
53413 + struct acl_role_label *role;
53414 + unsigned int x;
53415 +
53416 + FOR_EACH_ROLE_START(role)
53417 + update_acl_subj_label(matchn->inode, matchn->device,
53418 + inode, dev, role);
53419 +
53420 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
53421 + if ((subj->inode == inode) && (subj->device == dev)) {
53422 + subj->inode = inode;
53423 + subj->device = dev;
53424 + }
53425 + FOR_EACH_NESTED_SUBJECT_END(subj)
53426 + FOR_EACH_SUBJECT_START(role, subj, x)
53427 + update_acl_obj_label(matchn->inode, matchn->device,
53428 + inode, dev, subj);
53429 + FOR_EACH_SUBJECT_END(subj,x)
53430 + FOR_EACH_ROLE_END(role)
53431 +
53432 + update_inodev_entry(matchn->inode, matchn->device, inode, dev);
53433 +
53434 + return;
53435 +}
53436 +
53437 +static void
53438 +do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
53439 + const struct vfsmount *mnt)
53440 +{
53441 + ino_t ino = dentry->d_inode->i_ino;
53442 + dev_t dev = __get_dev(dentry);
53443 +
53444 + __do_handle_create(matchn, ino, dev);
53445 +
53446 + return;
53447 +}
53448 +
53449 +void
53450 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
53451 +{
53452 + struct name_entry *matchn;
53453 +
53454 + if (unlikely(!(gr_status & GR_READY)))
53455 + return;
53456 +
53457 + preempt_disable();
53458 + matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
53459 +
53460 + if (unlikely((unsigned long)matchn)) {
53461 + write_lock(&gr_inode_lock);
53462 + do_handle_create(matchn, dentry, mnt);
53463 + write_unlock(&gr_inode_lock);
53464 + }
53465 + preempt_enable();
53466 +
53467 + return;
53468 +}
53469 +
53470 +void
53471 +gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
53472 +{
53473 + struct name_entry *matchn;
53474 +
53475 + if (unlikely(!(gr_status & GR_READY)))
53476 + return;
53477 +
53478 + preempt_disable();
53479 + matchn = lookup_name_entry(gr_to_proc_filename_rbac(dentry, init_pid_ns.proc_mnt));
53480 +
53481 + if (unlikely((unsigned long)matchn)) {
53482 + write_lock(&gr_inode_lock);
53483 + __do_handle_create(matchn, inode->i_ino, inode->i_sb->s_dev);
53484 + write_unlock(&gr_inode_lock);
53485 + }
53486 + preempt_enable();
53487 +
53488 + return;
53489 +}
53490 +
53491 +void
53492 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
53493 + struct dentry *old_dentry,
53494 + struct dentry *new_dentry,
53495 + struct vfsmount *mnt, const __u8 replace)
53496 +{
53497 + struct name_entry *matchn;
53498 + struct inodev_entry *inodev;
53499 + ino_t oldinode = old_dentry->d_inode->i_ino;
53500 + dev_t olddev = __get_dev(old_dentry);
53501 +
53502 + /* vfs_rename swaps the name and parent link for old_dentry and
53503 + new_dentry
53504 + at this point, old_dentry has the new name, parent link, and inode
53505 + for the renamed file
53506 + if a file is being replaced by a rename, new_dentry has the inode
53507 + and name for the replaced file
53508 + */
53509 +
53510 + if (unlikely(!(gr_status & GR_READY)))
53511 + return;
53512 +
53513 + preempt_disable();
53514 + matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
53515 +
53516 + /* we wouldn't have to check d_inode if it weren't for
53517 + NFS silly-renaming
53518 + */
53519 +
53520 + write_lock(&gr_inode_lock);
53521 + if (unlikely(replace && new_dentry->d_inode)) {
53522 + ino_t newinode = new_dentry->d_inode->i_ino;
53523 + dev_t newdev = __get_dev(new_dentry);
53524 + inodev = lookup_inodev_entry(newinode, newdev);
53525 + if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
53526 + do_handle_delete(inodev, newinode, newdev);
53527 + }
53528 +
53529 + inodev = lookup_inodev_entry(oldinode, olddev);
53530 + if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
53531 + do_handle_delete(inodev, oldinode, olddev);
53532 +
53533 + if (unlikely((unsigned long)matchn))
53534 + do_handle_create(matchn, old_dentry, mnt);
53535 +
53536 + write_unlock(&gr_inode_lock);
53537 + preempt_enable();
53538 +
53539 + return;
53540 +}
53541 +
53542 +static int
53543 +lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
53544 + unsigned char **sum)
53545 +{
53546 + struct acl_role_label *r;
53547 + struct role_allowed_ip *ipp;
53548 + struct role_transition *trans;
53549 + unsigned int i;
53550 + int found = 0;
53551 + u32 curr_ip = current->signal->curr_ip;
53552 +
53553 + current->signal->saved_ip = curr_ip;
53554 +
53555 + /* check transition table */
53556 +
53557 + for (trans = current->role->transitions; trans; trans = trans->next) {
53558 + if (!strcmp(rolename, trans->rolename)) {
53559 + found = 1;
53560 + break;
53561 + }
53562 + }
53563 +
53564 + if (!found)
53565 + return 0;
53566 +
53567 + /* handle special roles that do not require authentication
53568 + and check ip */
53569 +
53570 + FOR_EACH_ROLE_START(r)
53571 + if (!strcmp(rolename, r->rolename) &&
53572 + (r->roletype & GR_ROLE_SPECIAL)) {
53573 + found = 0;
53574 + if (r->allowed_ips != NULL) {
53575 + for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
53576 + if ((ntohl(curr_ip) & ipp->netmask) ==
53577 + (ntohl(ipp->addr) & ipp->netmask))
53578 + found = 1;
53579 + }
53580 + } else
53581 + found = 2;
53582 + if (!found)
53583 + return 0;
53584 +
53585 + if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
53586 + ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
53587 + *salt = NULL;
53588 + *sum = NULL;
53589 + return 1;
53590 + }
53591 + }
53592 + FOR_EACH_ROLE_END(r)
53593 +
53594 + for (i = 0; i < num_sprole_pws; i++) {
53595 + if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
53596 + *salt = acl_special_roles[i]->salt;
53597 + *sum = acl_special_roles[i]->sum;
53598 + return 1;
53599 + }
53600 + }
53601 +
53602 + return 0;
53603 +}
53604 +
53605 +static void
53606 +assign_special_role(char *rolename)
53607 +{
53608 + struct acl_object_label *obj;
53609 + struct acl_role_label *r;
53610 + struct acl_role_label *assigned = NULL;
53611 + struct task_struct *tsk;
53612 + struct file *filp;
53613 +
53614 + FOR_EACH_ROLE_START(r)
53615 + if (!strcmp(rolename, r->rolename) &&
53616 + (r->roletype & GR_ROLE_SPECIAL)) {
53617 + assigned = r;
53618 + break;
53619 + }
53620 + FOR_EACH_ROLE_END(r)
53621 +
53622 + if (!assigned)
53623 + return;
53624 +
53625 + read_lock(&tasklist_lock);
53626 + read_lock(&grsec_exec_file_lock);
53627 +
53628 + tsk = current->real_parent;
53629 + if (tsk == NULL)
53630 + goto out_unlock;
53631 +
53632 + filp = tsk->exec_file;
53633 + if (filp == NULL)
53634 + goto out_unlock;
53635 +
53636 + tsk->is_writable = 0;
53637 +
53638 + tsk->acl_sp_role = 1;
53639 + tsk->acl_role_id = ++acl_sp_role_value;
53640 + tsk->role = assigned;
53641 + tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
53642 +
53643 + /* ignore additional mmap checks for processes that are writable
53644 + by the default ACL */
53645 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53646 + if (unlikely(obj->mode & GR_WRITE))
53647 + tsk->is_writable = 1;
53648 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
53649 + if (unlikely(obj->mode & GR_WRITE))
53650 + tsk->is_writable = 1;
53651 +
53652 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53653 + printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
53654 +#endif
53655 +
53656 +out_unlock:
53657 + read_unlock(&grsec_exec_file_lock);
53658 + read_unlock(&tasklist_lock);
53659 + return;
53660 +}
53661 +
53662 +int gr_check_secure_terminal(struct task_struct *task)
53663 +{
53664 + struct task_struct *p, *p2, *p3;
53665 + struct files_struct *files;
53666 + struct fdtable *fdt;
53667 + struct file *our_file = NULL, *file;
53668 + int i;
53669 +
53670 + if (task->signal->tty == NULL)
53671 + return 1;
53672 +
53673 + files = get_files_struct(task);
53674 + if (files != NULL) {
53675 + rcu_read_lock();
53676 + fdt = files_fdtable(files);
53677 + for (i=0; i < fdt->max_fds; i++) {
53678 + file = fcheck_files(files, i);
53679 + if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
53680 + get_file(file);
53681 + our_file = file;
53682 + }
53683 + }
53684 + rcu_read_unlock();
53685 + put_files_struct(files);
53686 + }
53687 +
53688 + if (our_file == NULL)
53689 + return 1;
53690 +
53691 + read_lock(&tasklist_lock);
53692 + do_each_thread(p2, p) {
53693 + files = get_files_struct(p);
53694 + if (files == NULL ||
53695 + (p->signal && p->signal->tty == task->signal->tty)) {
53696 + if (files != NULL)
53697 + put_files_struct(files);
53698 + continue;
53699 + }
53700 + rcu_read_lock();
53701 + fdt = files_fdtable(files);
53702 + for (i=0; i < fdt->max_fds; i++) {
53703 + file = fcheck_files(files, i);
53704 + if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
53705 + file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
53706 + p3 = task;
53707 + while (p3->pid > 0) {
53708 + if (p3 == p)
53709 + break;
53710 + p3 = p3->real_parent;
53711 + }
53712 + if (p3 == p)
53713 + break;
53714 + gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
53715 + gr_handle_alertkill(p);
53716 + rcu_read_unlock();
53717 + put_files_struct(files);
53718 + read_unlock(&tasklist_lock);
53719 + fput(our_file);
53720 + return 0;
53721 + }
53722 + }
53723 + rcu_read_unlock();
53724 + put_files_struct(files);
53725 + } while_each_thread(p2, p);
53726 + read_unlock(&tasklist_lock);
53727 +
53728 + fput(our_file);
53729 + return 1;
53730 +}
53731 +
53732 +ssize_t
53733 +write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
53734 +{
53735 + struct gr_arg_wrapper uwrap;
53736 + unsigned char *sprole_salt = NULL;
53737 + unsigned char *sprole_sum = NULL;
53738 + int error = sizeof (struct gr_arg_wrapper);
53739 + int error2 = 0;
53740 +
53741 + mutex_lock(&gr_dev_mutex);
53742 +
53743 + if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
53744 + error = -EPERM;
53745 + goto out;
53746 + }
53747 +
53748 + if (count != sizeof (struct gr_arg_wrapper)) {
53749 + gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
53750 + error = -EINVAL;
53751 + goto out;
53752 + }
53753 +
53754 +
53755 + if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
53756 + gr_auth_expires = 0;
53757 + gr_auth_attempts = 0;
53758 + }
53759 +
53760 + if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
53761 + error = -EFAULT;
53762 + goto out;
53763 + }
53764 +
53765 + if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
53766 + error = -EINVAL;
53767 + goto out;
53768 + }
53769 +
53770 + if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
53771 + error = -EFAULT;
53772 + goto out;
53773 + }
53774 +
53775 + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
53776 + gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
53777 + time_after(gr_auth_expires, get_seconds())) {
53778 + error = -EBUSY;
53779 + goto out;
53780 + }
53781 +
53782 + /* if non-root trying to do anything other than use a special role,
53783 + do not attempt authentication, do not count towards authentication
53784 + locking
53785 + */
53786 +
53787 + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
53788 + gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
53789 + current_uid()) {
53790 + error = -EPERM;
53791 + goto out;
53792 + }
53793 +
53794 + /* ensure pw and special role name are null terminated */
53795 +
53796 + gr_usermode->pw[GR_PW_LEN - 1] = '\0';
53797 + gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
53798 +
53799 + /* Okay.
53800 + * We have our enough of the argument structure..(we have yet
53801 + * to copy_from_user the tables themselves) . Copy the tables
53802 + * only if we need them, i.e. for loading operations. */
53803 +
53804 + switch (gr_usermode->mode) {
53805 + case GR_STATUS:
53806 + if (gr_status & GR_READY) {
53807 + error = 1;
53808 + if (!gr_check_secure_terminal(current))
53809 + error = 3;
53810 + } else
53811 + error = 2;
53812 + goto out;
53813 + case GR_SHUTDOWN:
53814 + if ((gr_status & GR_READY)
53815 + && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
53816 + pax_open_kernel();
53817 + gr_status &= ~GR_READY;
53818 + pax_close_kernel();
53819 +
53820 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
53821 + free_variables();
53822 + memset(gr_usermode, 0, sizeof (struct gr_arg));
53823 + memset(gr_system_salt, 0, GR_SALT_LEN);
53824 + memset(gr_system_sum, 0, GR_SHA_LEN);
53825 + } else if (gr_status & GR_READY) {
53826 + gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
53827 + error = -EPERM;
53828 + } else {
53829 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
53830 + error = -EAGAIN;
53831 + }
53832 + break;
53833 + case GR_ENABLE:
53834 + if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
53835 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
53836 + else {
53837 + if (gr_status & GR_READY)
53838 + error = -EAGAIN;
53839 + else
53840 + error = error2;
53841 + gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
53842 + }
53843 + break;
53844 + case GR_RELOAD:
53845 + if (!(gr_status & GR_READY)) {
53846 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
53847 + error = -EAGAIN;
53848 + } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
53849 + lock_kernel();
53850 +
53851 + pax_open_kernel();
53852 + gr_status &= ~GR_READY;
53853 + pax_close_kernel();
53854 +
53855 + free_variables();
53856 + if (!(error2 = gracl_init(gr_usermode))) {
53857 + unlock_kernel();
53858 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
53859 + } else {
53860 + unlock_kernel();
53861 + error = error2;
53862 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
53863 + }
53864 + } else {
53865 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
53866 + error = -EPERM;
53867 + }
53868 + break;
53869 + case GR_SEGVMOD:
53870 + if (unlikely(!(gr_status & GR_READY))) {
53871 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
53872 + error = -EAGAIN;
53873 + break;
53874 + }
53875 +
53876 + if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
53877 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
53878 + if (gr_usermode->segv_device && gr_usermode->segv_inode) {
53879 + struct acl_subject_label *segvacl;
53880 + segvacl =
53881 + lookup_acl_subj_label(gr_usermode->segv_inode,
53882 + gr_usermode->segv_device,
53883 + current->role);
53884 + if (segvacl) {
53885 + segvacl->crashes = 0;
53886 + segvacl->expires = 0;
53887 + }
53888 + } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
53889 + gr_remove_uid(gr_usermode->segv_uid);
53890 + }
53891 + } else {
53892 + gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
53893 + error = -EPERM;
53894 + }
53895 + break;
53896 + case GR_SPROLE:
53897 + case GR_SPROLEPAM:
53898 + if (unlikely(!(gr_status & GR_READY))) {
53899 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
53900 + error = -EAGAIN;
53901 + break;
53902 + }
53903 +
53904 + if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
53905 + current->role->expires = 0;
53906 + current->role->auth_attempts = 0;
53907 + }
53908 +
53909 + if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
53910 + time_after(current->role->expires, get_seconds())) {
53911 + error = -EBUSY;
53912 + goto out;
53913 + }
53914 +
53915 + if (lookup_special_role_auth
53916 + (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
53917 + && ((!sprole_salt && !sprole_sum)
53918 + || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
53919 + char *p = "";
53920 + assign_special_role(gr_usermode->sp_role);
53921 + read_lock(&tasklist_lock);
53922 + if (current->real_parent)
53923 + p = current->real_parent->role->rolename;
53924 + read_unlock(&tasklist_lock);
53925 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
53926 + p, acl_sp_role_value);
53927 + } else {
53928 + gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
53929 + error = -EPERM;
53930 + if(!(current->role->auth_attempts++))
53931 + current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
53932 +
53933 + goto out;
53934 + }
53935 + break;
53936 + case GR_UNSPROLE:
53937 + if (unlikely(!(gr_status & GR_READY))) {
53938 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
53939 + error = -EAGAIN;
53940 + break;
53941 + }
53942 +
53943 + if (current->role->roletype & GR_ROLE_SPECIAL) {
53944 + char *p = "";
53945 + int i = 0;
53946 +
53947 + read_lock(&tasklist_lock);
53948 + if (current->real_parent) {
53949 + p = current->real_parent->role->rolename;
53950 + i = current->real_parent->acl_role_id;
53951 + }
53952 + read_unlock(&tasklist_lock);
53953 +
53954 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
53955 + gr_set_acls(1);
53956 + } else {
53957 + error = -EPERM;
53958 + goto out;
53959 + }
53960 + break;
53961 + default:
53962 + gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
53963 + error = -EINVAL;
53964 + break;
53965 + }
53966 +
53967 + if (error != -EPERM)
53968 + goto out;
53969 +
53970 + if(!(gr_auth_attempts++))
53971 + gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
53972 +
53973 + out:
53974 + mutex_unlock(&gr_dev_mutex);
53975 + return error;
53976 +}
53977 +
53978 +/* must be called with
53979 + rcu_read_lock();
53980 + read_lock(&tasklist_lock);
53981 + read_lock(&grsec_exec_file_lock);
53982 +*/
53983 +int gr_apply_subject_to_task(struct task_struct *task)
53984 +{
53985 + struct acl_object_label *obj;
53986 + char *tmpname;
53987 + struct acl_subject_label *tmpsubj;
53988 + struct file *filp;
53989 + struct name_entry *nmatch;
53990 +
53991 + filp = task->exec_file;
53992 + if (filp == NULL)
53993 + return 0;
53994 +
53995 + /* the following is to apply the correct subject
53996 + on binaries running when the RBAC system
53997 + is enabled, when the binaries have been
53998 + replaced or deleted since their execution
53999 + -----
54000 + when the RBAC system starts, the inode/dev
54001 + from exec_file will be one the RBAC system
54002 + is unaware of. It only knows the inode/dev
54003 + of the present file on disk, or the absence
54004 + of it.
54005 + */
54006 + preempt_disable();
54007 + tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
54008 +
54009 + nmatch = lookup_name_entry(tmpname);
54010 + preempt_enable();
54011 + tmpsubj = NULL;
54012 + if (nmatch) {
54013 + if (nmatch->deleted)
54014 + tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
54015 + else
54016 + tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
54017 + if (tmpsubj != NULL)
54018 + task->acl = tmpsubj;
54019 + }
54020 + if (tmpsubj == NULL)
54021 + task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
54022 + task->role);
54023 + if (task->acl) {
54024 + task->is_writable = 0;
54025 + /* ignore additional mmap checks for processes that are writable
54026 + by the default ACL */
54027 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54028 + if (unlikely(obj->mode & GR_WRITE))
54029 + task->is_writable = 1;
54030 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
54031 + if (unlikely(obj->mode & GR_WRITE))
54032 + task->is_writable = 1;
54033 +
54034 + gr_set_proc_res(task);
54035 +
54036 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54037 + printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54038 +#endif
54039 + } else {
54040 + return 1;
54041 + }
54042 +
54043 + return 0;
54044 +}
54045 +
54046 +int
54047 +gr_set_acls(const int type)
54048 +{
54049 + struct task_struct *task, *task2;
54050 + struct acl_role_label *role = current->role;
54051 + __u16 acl_role_id = current->acl_role_id;
54052 + const struct cred *cred;
54053 + int ret;
54054 +
54055 + rcu_read_lock();
54056 + read_lock(&tasklist_lock);
54057 + read_lock(&grsec_exec_file_lock);
54058 + do_each_thread(task2, task) {
54059 + /* check to see if we're called from the exit handler,
54060 + if so, only replace ACLs that have inherited the admin
54061 + ACL */
54062 +
54063 + if (type && (task->role != role ||
54064 + task->acl_role_id != acl_role_id))
54065 + continue;
54066 +
54067 + task->acl_role_id = 0;
54068 + task->acl_sp_role = 0;
54069 +
54070 + if (task->exec_file) {
54071 + cred = __task_cred(task);
54072 + task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
54073 +
54074 + ret = gr_apply_subject_to_task(task);
54075 + if (ret) {
54076 + read_unlock(&grsec_exec_file_lock);
54077 + read_unlock(&tasklist_lock);
54078 + rcu_read_unlock();
54079 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
54080 + return ret;
54081 + }
54082 + } else {
54083 + // it's a kernel process
54084 + task->role = kernel_role;
54085 + task->acl = kernel_role->root_label;
54086 +#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
54087 + task->acl->mode &= ~GR_PROCFIND;
54088 +#endif
54089 + }
54090 + } while_each_thread(task2, task);
54091 + read_unlock(&grsec_exec_file_lock);
54092 + read_unlock(&tasklist_lock);
54093 + rcu_read_unlock();
54094 +
54095 + return 0;
54096 +}
54097 +
54098 +void
54099 +gr_learn_resource(const struct task_struct *task,
54100 + const int res, const unsigned long wanted, const int gt)
54101 +{
54102 + struct acl_subject_label *acl;
54103 + const struct cred *cred;
54104 +
54105 + if (unlikely((gr_status & GR_READY) &&
54106 + task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
54107 + goto skip_reslog;
54108 +
54109 +#ifdef CONFIG_GRKERNSEC_RESLOG
54110 + gr_log_resource(task, res, wanted, gt);
54111 +#endif
54112 + skip_reslog:
54113 +
54114 + if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
54115 + return;
54116 +
54117 + acl = task->acl;
54118 +
54119 + if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
54120 + !(acl->resmask & (1 << (unsigned short) res))))
54121 + return;
54122 +
54123 + if (wanted >= acl->res[res].rlim_cur) {
54124 + unsigned long res_add;
54125 +
54126 + res_add = wanted;
54127 + switch (res) {
54128 + case RLIMIT_CPU:
54129 + res_add += GR_RLIM_CPU_BUMP;
54130 + break;
54131 + case RLIMIT_FSIZE:
54132 + res_add += GR_RLIM_FSIZE_BUMP;
54133 + break;
54134 + case RLIMIT_DATA:
54135 + res_add += GR_RLIM_DATA_BUMP;
54136 + break;
54137 + case RLIMIT_STACK:
54138 + res_add += GR_RLIM_STACK_BUMP;
54139 + break;
54140 + case RLIMIT_CORE:
54141 + res_add += GR_RLIM_CORE_BUMP;
54142 + break;
54143 + case RLIMIT_RSS:
54144 + res_add += GR_RLIM_RSS_BUMP;
54145 + break;
54146 + case RLIMIT_NPROC:
54147 + res_add += GR_RLIM_NPROC_BUMP;
54148 + break;
54149 + case RLIMIT_NOFILE:
54150 + res_add += GR_RLIM_NOFILE_BUMP;
54151 + break;
54152 + case RLIMIT_MEMLOCK:
54153 + res_add += GR_RLIM_MEMLOCK_BUMP;
54154 + break;
54155 + case RLIMIT_AS:
54156 + res_add += GR_RLIM_AS_BUMP;
54157 + break;
54158 + case RLIMIT_LOCKS:
54159 + res_add += GR_RLIM_LOCKS_BUMP;
54160 + break;
54161 + case RLIMIT_SIGPENDING:
54162 + res_add += GR_RLIM_SIGPENDING_BUMP;
54163 + break;
54164 + case RLIMIT_MSGQUEUE:
54165 + res_add += GR_RLIM_MSGQUEUE_BUMP;
54166 + break;
54167 + case RLIMIT_NICE:
54168 + res_add += GR_RLIM_NICE_BUMP;
54169 + break;
54170 + case RLIMIT_RTPRIO:
54171 + res_add += GR_RLIM_RTPRIO_BUMP;
54172 + break;
54173 + case RLIMIT_RTTIME:
54174 + res_add += GR_RLIM_RTTIME_BUMP;
54175 + break;
54176 + }
54177 +
54178 + acl->res[res].rlim_cur = res_add;
54179 +
54180 + if (wanted > acl->res[res].rlim_max)
54181 + acl->res[res].rlim_max = res_add;
54182 +
54183 + /* only log the subject filename, since resource logging is supported for
54184 + single-subject learning only */
54185 + rcu_read_lock();
54186 + cred = __task_cred(task);
54187 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
54188 + task->role->roletype, cred->uid, cred->gid, acl->filename,
54189 + acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
54190 + "", (unsigned long) res, &task->signal->saved_ip);
54191 + rcu_read_unlock();
54192 + }
54193 +
54194 + return;
54195 +}
54196 +
54197 +#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
54198 +void
54199 +pax_set_initial_flags(struct linux_binprm *bprm)
54200 +{
54201 + struct task_struct *task = current;
54202 + struct acl_subject_label *proc;
54203 + unsigned long flags;
54204 +
54205 + if (unlikely(!(gr_status & GR_READY)))
54206 + return;
54207 +
54208 + flags = pax_get_flags(task);
54209 +
54210 + proc = task->acl;
54211 +
54212 + if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
54213 + flags &= ~MF_PAX_PAGEEXEC;
54214 + if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
54215 + flags &= ~MF_PAX_SEGMEXEC;
54216 + if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
54217 + flags &= ~MF_PAX_RANDMMAP;
54218 + if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
54219 + flags &= ~MF_PAX_EMUTRAMP;
54220 + if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
54221 + flags &= ~MF_PAX_MPROTECT;
54222 +
54223 + if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
54224 + flags |= MF_PAX_PAGEEXEC;
54225 + if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
54226 + flags |= MF_PAX_SEGMEXEC;
54227 + if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
54228 + flags |= MF_PAX_RANDMMAP;
54229 + if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
54230 + flags |= MF_PAX_EMUTRAMP;
54231 + if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
54232 + flags |= MF_PAX_MPROTECT;
54233 +
54234 + pax_set_flags(task, flags);
54235 +
54236 + return;
54237 +}
54238 +#endif
54239 +
54240 +#ifdef CONFIG_SYSCTL
54241 +/* Eric Biederman likes breaking userland ABI and every inode-based security
54242 + system to save 35kb of memory */
54243 +
54244 +/* we modify the passed in filename, but adjust it back before returning */
54245 +static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
54246 +{
54247 + struct name_entry *nmatch;
54248 + char *p, *lastp = NULL;
54249 + struct acl_object_label *obj = NULL, *tmp;
54250 + struct acl_subject_label *tmpsubj;
54251 + char c = '\0';
54252 +
54253 + read_lock(&gr_inode_lock);
54254 +
54255 + p = name + len - 1;
54256 + do {
54257 + nmatch = lookup_name_entry(name);
54258 + if (lastp != NULL)
54259 + *lastp = c;
54260 +
54261 + if (nmatch == NULL)
54262 + goto next_component;
54263 + tmpsubj = current->acl;
54264 + do {
54265 + obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
54266 + if (obj != NULL) {
54267 + tmp = obj->globbed;
54268 + while (tmp) {
54269 + if (!glob_match(tmp->filename, name)) {
54270 + obj = tmp;
54271 + goto found_obj;
54272 + }
54273 + tmp = tmp->next;
54274 + }
54275 + goto found_obj;
54276 + }
54277 + } while ((tmpsubj = tmpsubj->parent_subject));
54278 +next_component:
54279 + /* end case */
54280 + if (p == name)
54281 + break;
54282 +
54283 + while (*p != '/')
54284 + p--;
54285 + if (p == name)
54286 + lastp = p + 1;
54287 + else {
54288 + lastp = p;
54289 + p--;
54290 + }
54291 + c = *lastp;
54292 + *lastp = '\0';
54293 + } while (1);
54294 +found_obj:
54295 + read_unlock(&gr_inode_lock);
54296 + /* obj returned will always be non-null */
54297 + return obj;
54298 +}
54299 +
54300 +/* returns 0 when allowing, non-zero on error
54301 + op of 0 is used for readdir, so we don't log the names of hidden files
54302 +*/
54303 +__u32
54304 +gr_handle_sysctl(const struct ctl_table *table, const int op)
54305 +{
54306 + ctl_table *tmp;
54307 + const char *proc_sys = "/proc/sys";
54308 + char *path;
54309 + struct acl_object_label *obj;
54310 + unsigned short len = 0, pos = 0, depth = 0, i;
54311 + __u32 err = 0;
54312 + __u32 mode = 0;
54313 +
54314 + if (unlikely(!(gr_status & GR_READY)))
54315 + return 0;
54316 +
54317 + /* for now, ignore operations on non-sysctl entries if it's not a
54318 + readdir*/
54319 + if (table->child != NULL && op != 0)
54320 + return 0;
54321 +
54322 + mode |= GR_FIND;
54323 + /* it's only a read if it's an entry, read on dirs is for readdir */
54324 + if (op & MAY_READ)
54325 + mode |= GR_READ;
54326 + if (op & MAY_WRITE)
54327 + mode |= GR_WRITE;
54328 +
54329 + preempt_disable();
54330 +
54331 + path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
54332 +
54333 + /* it's only a read/write if it's an actual entry, not a dir
54334 + (which are opened for readdir)
54335 + */
54336 +
54337 + /* convert the requested sysctl entry into a pathname */
54338 +
54339 + for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
54340 + len += strlen(tmp->procname);
54341 + len++;
54342 + depth++;
54343 + }
54344 +
54345 + if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
54346 + /* deny */
54347 + goto out;
54348 + }
54349 +
54350 + memset(path, 0, PAGE_SIZE);
54351 +
54352 + memcpy(path, proc_sys, strlen(proc_sys));
54353 +
54354 + pos += strlen(proc_sys);
54355 +
54356 + for (; depth > 0; depth--) {
54357 + path[pos] = '/';
54358 + pos++;
54359 + for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
54360 + if (depth == i) {
54361 + memcpy(path + pos, tmp->procname,
54362 + strlen(tmp->procname));
54363 + pos += strlen(tmp->procname);
54364 + }
54365 + i++;
54366 + }
54367 + }
54368 +
54369 + obj = gr_lookup_by_name(path, pos);
54370 + err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
54371 +
54372 + if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
54373 + ((err & mode) != mode))) {
54374 + __u32 new_mode = mode;
54375 +
54376 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
54377 +
54378 + err = 0;
54379 + gr_log_learn_sysctl(path, new_mode);
54380 + } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
54381 + gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
54382 + err = -ENOENT;
54383 + } else if (!(err & GR_FIND)) {
54384 + err = -ENOENT;
54385 + } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
54386 + gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
54387 + path, (mode & GR_READ) ? " reading" : "",
54388 + (mode & GR_WRITE) ? " writing" : "");
54389 + err = -EACCES;
54390 + } else if ((err & mode) != mode) {
54391 + err = -EACCES;
54392 + } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
54393 + gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
54394 + path, (mode & GR_READ) ? " reading" : "",
54395 + (mode & GR_WRITE) ? " writing" : "");
54396 + err = 0;
54397 + } else
54398 + err = 0;
54399 +
54400 + out:
54401 + preempt_enable();
54402 +
54403 + return err;
54404 +}
54405 +#endif
54406 +
54407 +int
54408 +gr_handle_proc_ptrace(struct task_struct *task)
54409 +{
54410 + struct file *filp;
54411 + struct task_struct *tmp = task;
54412 + struct task_struct *curtemp = current;
54413 + __u32 retmode;
54414 +
54415 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
54416 + if (unlikely(!(gr_status & GR_READY)))
54417 + return 0;
54418 +#endif
54419 +
54420 + read_lock(&tasklist_lock);
54421 + read_lock(&grsec_exec_file_lock);
54422 + filp = task->exec_file;
54423 +
54424 + while (tmp->pid > 0) {
54425 + if (tmp == curtemp)
54426 + break;
54427 + tmp = tmp->real_parent;
54428 + }
54429 +
54430 + if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
54431 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
54432 + read_unlock(&grsec_exec_file_lock);
54433 + read_unlock(&tasklist_lock);
54434 + return 1;
54435 + }
54436 +
54437 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
54438 + if (!(gr_status & GR_READY)) {
54439 + read_unlock(&grsec_exec_file_lock);
54440 + read_unlock(&tasklist_lock);
54441 + return 0;
54442 + }
54443 +#endif
54444 +
54445 + retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
54446 + read_unlock(&grsec_exec_file_lock);
54447 + read_unlock(&tasklist_lock);
54448 +
54449 + if (retmode & GR_NOPTRACE)
54450 + return 1;
54451 +
54452 + if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
54453 + && (current->acl != task->acl || (current->acl != current->role->root_label
54454 + && current->pid != task->pid)))
54455 + return 1;
54456 +
54457 + return 0;
54458 +}
54459 +
54460 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
54461 +{
54462 + if (unlikely(!(gr_status & GR_READY)))
54463 + return;
54464 +
54465 + if (!(current->role->roletype & GR_ROLE_GOD))
54466 + return;
54467 +
54468 + seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
54469 + p->role->rolename, gr_task_roletype_to_char(p),
54470 + p->acl->filename);
54471 +}
54472 +
54473 +int
54474 +gr_handle_ptrace(struct task_struct *task, const long request)
54475 +{
54476 + struct task_struct *tmp = task;
54477 + struct task_struct *curtemp = current;
54478 + __u32 retmode;
54479 +
54480 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
54481 + if (unlikely(!(gr_status & GR_READY)))
54482 + return 0;
54483 +#endif
54484 +
54485 + read_lock(&tasklist_lock);
54486 + while (tmp->pid > 0) {
54487 + if (tmp == curtemp)
54488 + break;
54489 + tmp = tmp->real_parent;
54490 + }
54491 +
54492 + if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
54493 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
54494 + read_unlock(&tasklist_lock);
54495 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54496 + return 1;
54497 + }
54498 + read_unlock(&tasklist_lock);
54499 +
54500 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
54501 + if (!(gr_status & GR_READY))
54502 + return 0;
54503 +#endif
54504 +
54505 + read_lock(&grsec_exec_file_lock);
54506 + if (unlikely(!task->exec_file)) {
54507 + read_unlock(&grsec_exec_file_lock);
54508 + return 0;
54509 + }
54510 +
54511 + retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
54512 + read_unlock(&grsec_exec_file_lock);
54513 +
54514 + if (retmode & GR_NOPTRACE) {
54515 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54516 + return 1;
54517 + }
54518 +
54519 + if (retmode & GR_PTRACERD) {
54520 + switch (request) {
54521 + case PTRACE_POKETEXT:
54522 + case PTRACE_POKEDATA:
54523 + case PTRACE_POKEUSR:
54524 +#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
54525 + case PTRACE_SETREGS:
54526 + case PTRACE_SETFPREGS:
54527 +#endif
54528 +#ifdef CONFIG_X86
54529 + case PTRACE_SETFPXREGS:
54530 +#endif
54531 +#ifdef CONFIG_ALTIVEC
54532 + case PTRACE_SETVRREGS:
54533 +#endif
54534 + return 1;
54535 + default:
54536 + return 0;
54537 + }
54538 + } else if (!(current->acl->mode & GR_POVERRIDE) &&
54539 + !(current->role->roletype & GR_ROLE_GOD) &&
54540 + (current->acl != task->acl)) {
54541 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54542 + return 1;
54543 + }
54544 +
54545 + return 0;
54546 +}
54547 +
54548 +static int is_writable_mmap(const struct file *filp)
54549 +{
54550 + struct task_struct *task = current;
54551 + struct acl_object_label *obj, *obj2;
54552 +
54553 + if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
54554 + !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
54555 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54556 + obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
54557 + task->role->root_label);
54558 + if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
54559 + gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
54560 + return 1;
54561 + }
54562 + }
54563 + return 0;
54564 +}
54565 +
54566 +int
54567 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
54568 +{
54569 + __u32 mode;
54570 +
54571 + if (unlikely(!file || !(prot & PROT_EXEC)))
54572 + return 1;
54573 +
54574 + if (is_writable_mmap(file))
54575 + return 0;
54576 +
54577 + mode =
54578 + gr_search_file(file->f_path.dentry,
54579 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
54580 + file->f_path.mnt);
54581 +
54582 + if (!gr_tpe_allow(file))
54583 + return 0;
54584 +
54585 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
54586 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54587 + return 0;
54588 + } else if (unlikely(!(mode & GR_EXEC))) {
54589 + return 0;
54590 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
54591 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54592 + return 1;
54593 + }
54594 +
54595 + return 1;
54596 +}
54597 +
54598 +int
54599 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
54600 +{
54601 + __u32 mode;
54602 +
54603 + if (unlikely(!file || !(prot & PROT_EXEC)))
54604 + return 1;
54605 +
54606 + if (is_writable_mmap(file))
54607 + return 0;
54608 +
54609 + mode =
54610 + gr_search_file(file->f_path.dentry,
54611 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
54612 + file->f_path.mnt);
54613 +
54614 + if (!gr_tpe_allow(file))
54615 + return 0;
54616 +
54617 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
54618 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54619 + return 0;
54620 + } else if (unlikely(!(mode & GR_EXEC))) {
54621 + return 0;
54622 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
54623 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
54624 + return 1;
54625 + }
54626 +
54627 + return 1;
54628 +}
54629 +
54630 +void
54631 +gr_acl_handle_psacct(struct task_struct *task, const long code)
54632 +{
54633 + unsigned long runtime;
54634 + unsigned long cputime;
54635 + unsigned int wday, cday;
54636 + __u8 whr, chr;
54637 + __u8 wmin, cmin;
54638 + __u8 wsec, csec;
54639 + struct timespec timeval;
54640 +
54641 + if (unlikely(!(gr_status & GR_READY) || !task->acl ||
54642 + !(task->acl->mode & GR_PROCACCT)))
54643 + return;
54644 +
54645 + do_posix_clock_monotonic_gettime(&timeval);
54646 + runtime = timeval.tv_sec - task->start_time.tv_sec;
54647 + wday = runtime / (3600 * 24);
54648 + runtime -= wday * (3600 * 24);
54649 + whr = runtime / 3600;
54650 + runtime -= whr * 3600;
54651 + wmin = runtime / 60;
54652 + runtime -= wmin * 60;
54653 + wsec = runtime;
54654 +
54655 + cputime = (task->utime + task->stime) / HZ;
54656 + cday = cputime / (3600 * 24);
54657 + cputime -= cday * (3600 * 24);
54658 + chr = cputime / 3600;
54659 + cputime -= chr * 3600;
54660 + cmin = cputime / 60;
54661 + cputime -= cmin * 60;
54662 + csec = cputime;
54663 +
54664 + gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
54665 +
54666 + return;
54667 +}
54668 +
54669 +void gr_set_kernel_label(struct task_struct *task)
54670 +{
54671 + if (gr_status & GR_READY) {
54672 + task->role = kernel_role;
54673 + task->acl = kernel_role->root_label;
54674 + }
54675 + return;
54676 +}
54677 +
54678 +#ifdef CONFIG_TASKSTATS
54679 +int gr_is_taskstats_denied(int pid)
54680 +{
54681 + struct task_struct *task;
54682 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
54683 + const struct cred *cred;
54684 +#endif
54685 + int ret = 0;
54686 +
54687 + /* restrict taskstats viewing to un-chrooted root users
54688 + who have the 'view' subject flag if the RBAC system is enabled
54689 + */
54690 +
54691 + rcu_read_lock();
54692 + read_lock(&tasklist_lock);
54693 + task = find_task_by_vpid(pid);
54694 + if (task) {
54695 +#ifdef CONFIG_GRKERNSEC_CHROOT
54696 + if (proc_is_chrooted(task))
54697 + ret = -EACCES;
54698 +#endif
54699 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
54700 + cred = __task_cred(task);
54701 +#ifdef CONFIG_GRKERNSEC_PROC_USER
54702 + if (cred->uid != 0)
54703 + ret = -EACCES;
54704 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
54705 + if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
54706 + ret = -EACCES;
54707 +#endif
54708 +#endif
54709 + if (gr_status & GR_READY) {
54710 + if (!(task->acl->mode & GR_VIEW))
54711 + ret = -EACCES;
54712 + }
54713 + } else
54714 + ret = -ENOENT;
54715 +
54716 + read_unlock(&tasklist_lock);
54717 + rcu_read_unlock();
54718 +
54719 + return ret;
54720 +}
54721 +#endif
54722 +
54723 +/* AUXV entries are filled via a descendant of search_binary_handler
54724 + after we've already applied the subject for the target
54725 +*/
54726 +int gr_acl_enable_at_secure(void)
54727 +{
54728 + if (unlikely(!(gr_status & GR_READY)))
54729 + return 0;
54730 +
54731 + if (current->acl->mode & GR_ATSECURE)
54732 + return 1;
54733 +
54734 + return 0;
54735 +}
54736 +
54737 +int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
54738 +{
54739 + struct task_struct *task = current;
54740 + struct dentry *dentry = file->f_path.dentry;
54741 + struct vfsmount *mnt = file->f_path.mnt;
54742 + struct acl_object_label *obj, *tmp;
54743 + struct acl_subject_label *subj;
54744 + unsigned int bufsize;
54745 + int is_not_root;
54746 + char *path;
54747 + dev_t dev = __get_dev(dentry);
54748 +
54749 + if (unlikely(!(gr_status & GR_READY)))
54750 + return 1;
54751 +
54752 + if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
54753 + return 1;
54754 +
54755 + /* ignore Eric Biederman */
54756 + if (IS_PRIVATE(dentry->d_inode))
54757 + return 1;
54758 +
54759 + subj = task->acl;
54760 + do {
54761 + obj = lookup_acl_obj_label(ino, dev, subj);
54762 + if (obj != NULL)
54763 + return (obj->mode & GR_FIND) ? 1 : 0;
54764 + } while ((subj = subj->parent_subject));
54765 +
54766 + /* this is purely an optimization since we're looking for an object
54767 + for the directory we're doing a readdir on
54768 + if it's possible for any globbed object to match the entry we're
54769 + filling into the directory, then the object we find here will be
54770 + an anchor point with attached globbed objects
54771 + */
54772 + obj = chk_obj_label_noglob(dentry, mnt, task->acl);
54773 + if (obj->globbed == NULL)
54774 + return (obj->mode & GR_FIND) ? 1 : 0;
54775 +
54776 + is_not_root = ((obj->filename[0] == '/') &&
54777 + (obj->filename[1] == '\0')) ? 0 : 1;
54778 + bufsize = PAGE_SIZE - namelen - is_not_root;
54779 +
54780 + /* check bufsize > PAGE_SIZE || bufsize == 0 */
54781 + if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
54782 + return 1;
54783 +
54784 + preempt_disable();
54785 + path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
54786 + bufsize);
54787 +
54788 + bufsize = strlen(path);
54789 +
54790 + /* if base is "/", don't append an additional slash */
54791 + if (is_not_root)
54792 + *(path + bufsize) = '/';
54793 + memcpy(path + bufsize + is_not_root, name, namelen);
54794 + *(path + bufsize + namelen + is_not_root) = '\0';
54795 +
54796 + tmp = obj->globbed;
54797 + while (tmp) {
54798 + if (!glob_match(tmp->filename, path)) {
54799 + preempt_enable();
54800 + return (tmp->mode & GR_FIND) ? 1 : 0;
54801 + }
54802 + tmp = tmp->next;
54803 + }
54804 + preempt_enable();
54805 + return (obj->mode & GR_FIND) ? 1 : 0;
54806 +}
54807 +
54808 +#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
54809 +EXPORT_SYMBOL(gr_acl_is_enabled);
54810 +#endif
54811 +EXPORT_SYMBOL(gr_learn_resource);
54812 +EXPORT_SYMBOL(gr_set_kernel_label);
54813 +#ifdef CONFIG_SECURITY
54814 +EXPORT_SYMBOL(gr_check_user_change);
54815 +EXPORT_SYMBOL(gr_check_group_change);
54816 +#endif
54817 +
54818 diff -urNp linux-2.6.32.46/grsecurity/gracl_cap.c linux-2.6.32.46/grsecurity/gracl_cap.c
54819 --- linux-2.6.32.46/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
54820 +++ linux-2.6.32.46/grsecurity/gracl_cap.c 2011-09-14 08:53:50.000000000 -0400
54821 @@ -0,0 +1,101 @@
54822 +#include <linux/kernel.h>
54823 +#include <linux/module.h>
54824 +#include <linux/sched.h>
54825 +#include <linux/gracl.h>
54826 +#include <linux/grsecurity.h>
54827 +#include <linux/grinternal.h>
54828 +
54829 +extern const char *captab_log[];
54830 +extern int captab_log_entries;
54831 +
54832 +int
54833 +gr_acl_is_capable(const int cap)
54834 +{
54835 + struct task_struct *task = current;
54836 + const struct cred *cred = current_cred();
54837 + struct acl_subject_label *curracl;
54838 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
54839 + kernel_cap_t cap_audit = __cap_empty_set;
54840 +
54841 + if (!gr_acl_is_enabled())
54842 + return 1;
54843 +
54844 + curracl = task->acl;
54845 +
54846 + cap_drop = curracl->cap_lower;
54847 + cap_mask = curracl->cap_mask;
54848 + cap_audit = curracl->cap_invert_audit;
54849 +
54850 + while ((curracl = curracl->parent_subject)) {
54851 + /* if the cap isn't specified in the current computed mask but is specified in the
54852 + current level subject, and is lowered in the current level subject, then add
54853 + it to the set of dropped capabilities
54854 + otherwise, add the current level subject's mask to the current computed mask
54855 + */
54856 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
54857 + cap_raise(cap_mask, cap);
54858 + if (cap_raised(curracl->cap_lower, cap))
54859 + cap_raise(cap_drop, cap);
54860 + if (cap_raised(curracl->cap_invert_audit, cap))
54861 + cap_raise(cap_audit, cap);
54862 + }
54863 + }
54864 +
54865 + if (!cap_raised(cap_drop, cap)) {
54866 + if (cap_raised(cap_audit, cap))
54867 + gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
54868 + return 1;
54869 + }
54870 +
54871 + curracl = task->acl;
54872 +
54873 + if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
54874 + && cap_raised(cred->cap_effective, cap)) {
54875 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
54876 + task->role->roletype, cred->uid,
54877 + cred->gid, task->exec_file ?
54878 + gr_to_filename(task->exec_file->f_path.dentry,
54879 + task->exec_file->f_path.mnt) : curracl->filename,
54880 + curracl->filename, 0UL,
54881 + 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
54882 + return 1;
54883 + }
54884 +
54885 + if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
54886 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
54887 + return 0;
54888 +}
54889 +
54890 +int
54891 +gr_acl_is_capable_nolog(const int cap)
54892 +{
54893 + struct acl_subject_label *curracl;
54894 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
54895 +
54896 + if (!gr_acl_is_enabled())
54897 + return 1;
54898 +
54899 + curracl = current->acl;
54900 +
54901 + cap_drop = curracl->cap_lower;
54902 + cap_mask = curracl->cap_mask;
54903 +
54904 + while ((curracl = curracl->parent_subject)) {
54905 + /* if the cap isn't specified in the current computed mask but is specified in the
54906 + current level subject, and is lowered in the current level subject, then add
54907 + it to the set of dropped capabilities
54908 + otherwise, add the current level subject's mask to the current computed mask
54909 + */
54910 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
54911 + cap_raise(cap_mask, cap);
54912 + if (cap_raised(curracl->cap_lower, cap))
54913 + cap_raise(cap_drop, cap);
54914 + }
54915 + }
54916 +
54917 + if (!cap_raised(cap_drop, cap))
54918 + return 1;
54919 +
54920 + return 0;
54921 +}
54922 +
54923 diff -urNp linux-2.6.32.46/grsecurity/gracl_fs.c linux-2.6.32.46/grsecurity/gracl_fs.c
54924 --- linux-2.6.32.46/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500
54925 +++ linux-2.6.32.46/grsecurity/gracl_fs.c 2011-10-17 02:16:34.000000000 -0400
54926 @@ -0,0 +1,431 @@
54927 +#include <linux/kernel.h>
54928 +#include <linux/sched.h>
54929 +#include <linux/types.h>
54930 +#include <linux/fs.h>
54931 +#include <linux/file.h>
54932 +#include <linux/stat.h>
54933 +#include <linux/grsecurity.h>
54934 +#include <linux/grinternal.h>
54935 +#include <linux/gracl.h>
54936 +
54937 +__u32
54938 +gr_acl_handle_hidden_file(const struct dentry * dentry,
54939 + const struct vfsmount * mnt)
54940 +{
54941 + __u32 mode;
54942 +
54943 + if (unlikely(!dentry->d_inode))
54944 + return GR_FIND;
54945 +
54946 + mode =
54947 + gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
54948 +
54949 + if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
54950 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
54951 + return mode;
54952 + } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
54953 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
54954 + return 0;
54955 + } else if (unlikely(!(mode & GR_FIND)))
54956 + return 0;
54957 +
54958 + return GR_FIND;
54959 +}
54960 +
54961 +__u32
54962 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
54963 + const int fmode)
54964 +{
54965 + __u32 reqmode = GR_FIND;
54966 + __u32 mode;
54967 +
54968 + if (unlikely(!dentry->d_inode))
54969 + return reqmode;
54970 +
54971 + if (unlikely(fmode & O_APPEND))
54972 + reqmode |= GR_APPEND;
54973 + else if (unlikely(fmode & FMODE_WRITE))
54974 + reqmode |= GR_WRITE;
54975 + if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
54976 + reqmode |= GR_READ;
54977 + if ((fmode & FMODE_GREXEC) && (fmode & FMODE_EXEC))
54978 + reqmode &= ~GR_READ;
54979 + mode =
54980 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
54981 + mnt);
54982 +
54983 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
54984 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
54985 + reqmode & GR_READ ? " reading" : "",
54986 + reqmode & GR_WRITE ? " writing" : reqmode &
54987 + GR_APPEND ? " appending" : "");
54988 + return reqmode;
54989 + } else
54990 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
54991 + {
54992 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
54993 + reqmode & GR_READ ? " reading" : "",
54994 + reqmode & GR_WRITE ? " writing" : reqmode &
54995 + GR_APPEND ? " appending" : "");
54996 + return 0;
54997 + } else if (unlikely((mode & reqmode) != reqmode))
54998 + return 0;
54999 +
55000 + return reqmode;
55001 +}
55002 +
55003 +__u32
55004 +gr_acl_handle_creat(const struct dentry * dentry,
55005 + const struct dentry * p_dentry,
55006 + const struct vfsmount * p_mnt, const int fmode,
55007 + const int imode)
55008 +{
55009 + __u32 reqmode = GR_WRITE | GR_CREATE;
55010 + __u32 mode;
55011 +
55012 + if (unlikely(fmode & O_APPEND))
55013 + reqmode |= GR_APPEND;
55014 + if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
55015 + reqmode |= GR_READ;
55016 + if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
55017 + reqmode |= GR_SETID;
55018 +
55019 + mode =
55020 + gr_check_create(dentry, p_dentry, p_mnt,
55021 + reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55022 +
55023 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55024 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55025 + reqmode & GR_READ ? " reading" : "",
55026 + reqmode & GR_WRITE ? " writing" : reqmode &
55027 + GR_APPEND ? " appending" : "");
55028 + return reqmode;
55029 + } else
55030 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55031 + {
55032 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55033 + reqmode & GR_READ ? " reading" : "",
55034 + reqmode & GR_WRITE ? " writing" : reqmode &
55035 + GR_APPEND ? " appending" : "");
55036 + return 0;
55037 + } else if (unlikely((mode & reqmode) != reqmode))
55038 + return 0;
55039 +
55040 + return reqmode;
55041 +}
55042 +
55043 +__u32
55044 +gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
55045 + const int fmode)
55046 +{
55047 + __u32 mode, reqmode = GR_FIND;
55048 +
55049 + if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
55050 + reqmode |= GR_EXEC;
55051 + if (fmode & S_IWOTH)
55052 + reqmode |= GR_WRITE;
55053 + if (fmode & S_IROTH)
55054 + reqmode |= GR_READ;
55055 +
55056 + mode =
55057 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55058 + mnt);
55059 +
55060 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55061 + gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55062 + reqmode & GR_READ ? " reading" : "",
55063 + reqmode & GR_WRITE ? " writing" : "",
55064 + reqmode & GR_EXEC ? " executing" : "");
55065 + return reqmode;
55066 + } else
55067 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55068 + {
55069 + gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55070 + reqmode & GR_READ ? " reading" : "",
55071 + reqmode & GR_WRITE ? " writing" : "",
55072 + reqmode & GR_EXEC ? " executing" : "");
55073 + return 0;
55074 + } else if (unlikely((mode & reqmode) != reqmode))
55075 + return 0;
55076 +
55077 + return reqmode;
55078 +}
55079 +
55080 +static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
55081 +{
55082 + __u32 mode;
55083 +
55084 + mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
55085 +
55086 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55087 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
55088 + return mode;
55089 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55090 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
55091 + return 0;
55092 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
55093 + return 0;
55094 +
55095 + return (reqmode);
55096 +}
55097 +
55098 +__u32
55099 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
55100 +{
55101 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
55102 +}
55103 +
55104 +__u32
55105 +gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
55106 +{
55107 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
55108 +}
55109 +
55110 +__u32
55111 +gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
55112 +{
55113 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
55114 +}
55115 +
55116 +__u32
55117 +gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
55118 +{
55119 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
55120 +}
55121 +
55122 +__u32
55123 +gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
55124 + mode_t mode)
55125 +{
55126 + if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
55127 + return 1;
55128 +
55129 + if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55130 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55131 + GR_FCHMOD_ACL_MSG);
55132 + } else {
55133 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
55134 + }
55135 +}
55136 +
55137 +__u32
55138 +gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
55139 + mode_t mode)
55140 +{
55141 + if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55142 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55143 + GR_CHMOD_ACL_MSG);
55144 + } else {
55145 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
55146 + }
55147 +}
55148 +
55149 +__u32
55150 +gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
55151 +{
55152 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
55153 +}
55154 +
55155 +__u32
55156 +gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
55157 +{
55158 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
55159 +}
55160 +
55161 +__u32
55162 +gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
55163 +{
55164 + return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
55165 +}
55166 +
55167 +__u32
55168 +gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
55169 +{
55170 + return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
55171 + GR_UNIXCONNECT_ACL_MSG);
55172 +}
55173 +
55174 +/* hardlinks require at minimum create and link permission,
55175 + any additional privilege required is based on the
55176 + privilege of the file being linked to
55177 +*/
55178 +__u32
55179 +gr_acl_handle_link(const struct dentry * new_dentry,
55180 + const struct dentry * parent_dentry,
55181 + const struct vfsmount * parent_mnt,
55182 + const struct dentry * old_dentry,
55183 + const struct vfsmount * old_mnt, const char *to)
55184 +{
55185 + __u32 mode;
55186 + __u32 needmode = GR_CREATE | GR_LINK;
55187 + __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
55188 +
55189 + mode =
55190 + gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
55191 + old_mnt);
55192 +
55193 + if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
55194 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55195 + return mode;
55196 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55197 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55198 + return 0;
55199 + } else if (unlikely((mode & needmode) != needmode))
55200 + return 0;
55201 +
55202 + return 1;
55203 +}
55204 +
55205 +__u32
55206 +gr_acl_handle_symlink(const struct dentry * new_dentry,
55207 + const struct dentry * parent_dentry,
55208 + const struct vfsmount * parent_mnt, const char *from)
55209 +{
55210 + __u32 needmode = GR_WRITE | GR_CREATE;
55211 + __u32 mode;
55212 +
55213 + mode =
55214 + gr_check_create(new_dentry, parent_dentry, parent_mnt,
55215 + GR_CREATE | GR_AUDIT_CREATE |
55216 + GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
55217 +
55218 + if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
55219 + gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55220 + return mode;
55221 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55222 + gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55223 + return 0;
55224 + } else if (unlikely((mode & needmode) != needmode))
55225 + return 0;
55226 +
55227 + return (GR_WRITE | GR_CREATE);
55228 +}
55229 +
55230 +static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
55231 +{
55232 + __u32 mode;
55233 +
55234 + mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55235 +
55236 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55237 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
55238 + return mode;
55239 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55240 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
55241 + return 0;
55242 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
55243 + return 0;
55244 +
55245 + return (reqmode);
55246 +}
55247 +
55248 +__u32
55249 +gr_acl_handle_mknod(const struct dentry * new_dentry,
55250 + const struct dentry * parent_dentry,
55251 + const struct vfsmount * parent_mnt,
55252 + const int mode)
55253 +{
55254 + __u32 reqmode = GR_WRITE | GR_CREATE;
55255 + if (unlikely(mode & (S_ISUID | S_ISGID)))
55256 + reqmode |= GR_SETID;
55257 +
55258 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55259 + reqmode, GR_MKNOD_ACL_MSG);
55260 +}
55261 +
55262 +__u32
55263 +gr_acl_handle_mkdir(const struct dentry *new_dentry,
55264 + const struct dentry *parent_dentry,
55265 + const struct vfsmount *parent_mnt)
55266 +{
55267 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55268 + GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
55269 +}
55270 +
55271 +#define RENAME_CHECK_SUCCESS(old, new) \
55272 + (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
55273 + ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
55274 +
55275 +int
55276 +gr_acl_handle_rename(struct dentry *new_dentry,
55277 + struct dentry *parent_dentry,
55278 + const struct vfsmount *parent_mnt,
55279 + struct dentry *old_dentry,
55280 + struct inode *old_parent_inode,
55281 + struct vfsmount *old_mnt, const char *newname)
55282 +{
55283 + __u32 comp1, comp2;
55284 + int error = 0;
55285 +
55286 + if (unlikely(!gr_acl_is_enabled()))
55287 + return 0;
55288 +
55289 + if (!new_dentry->d_inode) {
55290 + comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
55291 + GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
55292 + GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
55293 + comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
55294 + GR_DELETE | GR_AUDIT_DELETE |
55295 + GR_AUDIT_READ | GR_AUDIT_WRITE |
55296 + GR_SUPPRESS, old_mnt);
55297 + } else {
55298 + comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
55299 + GR_CREATE | GR_DELETE |
55300 + GR_AUDIT_CREATE | GR_AUDIT_DELETE |
55301 + GR_AUDIT_READ | GR_AUDIT_WRITE |
55302 + GR_SUPPRESS, parent_mnt);
55303 + comp2 =
55304 + gr_search_file(old_dentry,
55305 + GR_READ | GR_WRITE | GR_AUDIT_READ |
55306 + GR_DELETE | GR_AUDIT_DELETE |
55307 + GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
55308 + }
55309 +
55310 + if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
55311 + ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
55312 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55313 + else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
55314 + && !(comp2 & GR_SUPPRESS)) {
55315 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55316 + error = -EACCES;
55317 + } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
55318 + error = -EACCES;
55319 +
55320 + return error;
55321 +}
55322 +
55323 +void
55324 +gr_acl_handle_exit(void)
55325 +{
55326 + u16 id;
55327 + char *rolename;
55328 + struct file *exec_file;
55329 +
55330 + if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
55331 + !(current->role->roletype & GR_ROLE_PERSIST))) {
55332 + id = current->acl_role_id;
55333 + rolename = current->role->rolename;
55334 + gr_set_acls(1);
55335 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
55336 + }
55337 +
55338 + write_lock(&grsec_exec_file_lock);
55339 + exec_file = current->exec_file;
55340 + current->exec_file = NULL;
55341 + write_unlock(&grsec_exec_file_lock);
55342 +
55343 + if (exec_file)
55344 + fput(exec_file);
55345 +}
55346 +
55347 +int
55348 +gr_acl_handle_procpidmem(const struct task_struct *task)
55349 +{
55350 + if (unlikely(!gr_acl_is_enabled()))
55351 + return 0;
55352 +
55353 + if (task != current && task->acl->mode & GR_PROTPROCFD)
55354 + return -EACCES;
55355 +
55356 + return 0;
55357 +}
55358 diff -urNp linux-2.6.32.46/grsecurity/gracl_ip.c linux-2.6.32.46/grsecurity/gracl_ip.c
55359 --- linux-2.6.32.46/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500
55360 +++ linux-2.6.32.46/grsecurity/gracl_ip.c 2011-04-17 15:56:46.000000000 -0400
55361 @@ -0,0 +1,382 @@
55362 +#include <linux/kernel.h>
55363 +#include <asm/uaccess.h>
55364 +#include <asm/errno.h>
55365 +#include <net/sock.h>
55366 +#include <linux/file.h>
55367 +#include <linux/fs.h>
55368 +#include <linux/net.h>
55369 +#include <linux/in.h>
55370 +#include <linux/skbuff.h>
55371 +#include <linux/ip.h>
55372 +#include <linux/udp.h>
55373 +#include <linux/smp_lock.h>
55374 +#include <linux/types.h>
55375 +#include <linux/sched.h>
55376 +#include <linux/netdevice.h>
55377 +#include <linux/inetdevice.h>
55378 +#include <linux/gracl.h>
55379 +#include <linux/grsecurity.h>
55380 +#include <linux/grinternal.h>
55381 +
55382 +#define GR_BIND 0x01
55383 +#define GR_CONNECT 0x02
55384 +#define GR_INVERT 0x04
55385 +#define GR_BINDOVERRIDE 0x08
55386 +#define GR_CONNECTOVERRIDE 0x10
55387 +#define GR_SOCK_FAMILY 0x20
55388 +
55389 +static const char * gr_protocols[IPPROTO_MAX] = {
55390 + "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
55391 + "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
55392 + "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
55393 + "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
55394 + "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
55395 + "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
55396 + "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
55397 + "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
55398 + "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
55399 + "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
55400 + "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
55401 + "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
55402 + "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
55403 + "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
55404 + "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
55405 + "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
55406 + "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
55407 + "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
55408 + "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
55409 + "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
55410 + "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
55411 + "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
55412 + "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
55413 + "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
55414 + "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
55415 + "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
55416 + "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
55417 + "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
55418 + "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
55419 + "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
55420 + "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
55421 + "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
55422 + };
55423 +
55424 +static const char * gr_socktypes[SOCK_MAX] = {
55425 + "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
55426 + "unknown:7", "unknown:8", "unknown:9", "packet"
55427 + };
55428 +
55429 +static const char * gr_sockfamilies[AF_MAX+1] = {
55430 + "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
55431 + "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
55432 + "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
55433 + "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154"
55434 + };
55435 +
55436 +const char *
55437 +gr_proto_to_name(unsigned char proto)
55438 +{
55439 + return gr_protocols[proto];
55440 +}
55441 +
55442 +const char *
55443 +gr_socktype_to_name(unsigned char type)
55444 +{
55445 + return gr_socktypes[type];
55446 +}
55447 +
55448 +const char *
55449 +gr_sockfamily_to_name(unsigned char family)
55450 +{
55451 + return gr_sockfamilies[family];
55452 +}
55453 +
55454 +int
55455 +gr_search_socket(const int domain, const int type, const int protocol)
55456 +{
55457 + struct acl_subject_label *curr;
55458 + const struct cred *cred = current_cred();
55459 +
55460 + if (unlikely(!gr_acl_is_enabled()))
55461 + goto exit;
55462 +
55463 + if ((domain < 0) || (type < 0) || (protocol < 0) ||
55464 + (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
55465 + goto exit; // let the kernel handle it
55466 +
55467 + curr = current->acl;
55468 +
55469 + if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
55470 + /* the family is allowed, if this is PF_INET allow it only if
55471 + the extra sock type/protocol checks pass */
55472 + if (domain == PF_INET)
55473 + goto inet_check;
55474 + goto exit;
55475 + } else {
55476 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
55477 + __u32 fakeip = 0;
55478 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55479 + current->role->roletype, cred->uid,
55480 + cred->gid, current->exec_file ?
55481 + gr_to_filename(current->exec_file->f_path.dentry,
55482 + current->exec_file->f_path.mnt) :
55483 + curr->filename, curr->filename,
55484 + &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
55485 + &current->signal->saved_ip);
55486 + goto exit;
55487 + }
55488 + goto exit_fail;
55489 + }
55490 +
55491 +inet_check:
55492 + /* the rest of this checking is for IPv4 only */
55493 + if (!curr->ips)
55494 + goto exit;
55495 +
55496 + if ((curr->ip_type & (1 << type)) &&
55497 + (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
55498 + goto exit;
55499 +
55500 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
55501 + /* we don't place acls on raw sockets , and sometimes
55502 + dgram/ip sockets are opened for ioctl and not
55503 + bind/connect, so we'll fake a bind learn log */
55504 + if (type == SOCK_RAW || type == SOCK_PACKET) {
55505 + __u32 fakeip = 0;
55506 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55507 + current->role->roletype, cred->uid,
55508 + cred->gid, current->exec_file ?
55509 + gr_to_filename(current->exec_file->f_path.dentry,
55510 + current->exec_file->f_path.mnt) :
55511 + curr->filename, curr->filename,
55512 + &fakeip, 0, type,
55513 + protocol, GR_CONNECT, &current->signal->saved_ip);
55514 + } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
55515 + __u32 fakeip = 0;
55516 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55517 + current->role->roletype, cred->uid,
55518 + cred->gid, current->exec_file ?
55519 + gr_to_filename(current->exec_file->f_path.dentry,
55520 + current->exec_file->f_path.mnt) :
55521 + curr->filename, curr->filename,
55522 + &fakeip, 0, type,
55523 + protocol, GR_BIND, &current->signal->saved_ip);
55524 + }
55525 + /* we'll log when they use connect or bind */
55526 + goto exit;
55527 + }
55528 +
55529 +exit_fail:
55530 + if (domain == PF_INET)
55531 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
55532 + gr_socktype_to_name(type), gr_proto_to_name(protocol));
55533 + else
55534 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
55535 + gr_socktype_to_name(type), protocol);
55536 +
55537 + return 0;
55538 +exit:
55539 + return 1;
55540 +}
55541 +
55542 +int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
55543 +{
55544 + if ((ip->mode & mode) &&
55545 + (ip_port >= ip->low) &&
55546 + (ip_port <= ip->high) &&
55547 + ((ntohl(ip_addr) & our_netmask) ==
55548 + (ntohl(our_addr) & our_netmask))
55549 + && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
55550 + && (ip->type & (1 << type))) {
55551 + if (ip->mode & GR_INVERT)
55552 + return 2; // specifically denied
55553 + else
55554 + return 1; // allowed
55555 + }
55556 +
55557 + return 0; // not specifically allowed, may continue parsing
55558 +}
55559 +
55560 +static int
55561 +gr_search_connectbind(const int full_mode, struct sock *sk,
55562 + struct sockaddr_in *addr, const int type)
55563 +{
55564 + char iface[IFNAMSIZ] = {0};
55565 + struct acl_subject_label *curr;
55566 + struct acl_ip_label *ip;
55567 + struct inet_sock *isk;
55568 + struct net_device *dev;
55569 + struct in_device *idev;
55570 + unsigned long i;
55571 + int ret;
55572 + int mode = full_mode & (GR_BIND | GR_CONNECT);
55573 + __u32 ip_addr = 0;
55574 + __u32 our_addr;
55575 + __u32 our_netmask;
55576 + char *p;
55577 + __u16 ip_port = 0;
55578 + const struct cred *cred = current_cred();
55579 +
55580 + if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
55581 + return 0;
55582 +
55583 + curr = current->acl;
55584 + isk = inet_sk(sk);
55585 +
55586 + /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
55587 + if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
55588 + addr->sin_addr.s_addr = curr->inaddr_any_override;
55589 + if ((full_mode & GR_CONNECT) && isk->saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
55590 + struct sockaddr_in saddr;
55591 + int err;
55592 +
55593 + saddr.sin_family = AF_INET;
55594 + saddr.sin_addr.s_addr = curr->inaddr_any_override;
55595 + saddr.sin_port = isk->sport;
55596 +
55597 + err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
55598 + if (err)
55599 + return err;
55600 +
55601 + err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
55602 + if (err)
55603 + return err;
55604 + }
55605 +
55606 + if (!curr->ips)
55607 + return 0;
55608 +
55609 + ip_addr = addr->sin_addr.s_addr;
55610 + ip_port = ntohs(addr->sin_port);
55611 +
55612 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
55613 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
55614 + current->role->roletype, cred->uid,
55615 + cred->gid, current->exec_file ?
55616 + gr_to_filename(current->exec_file->f_path.dentry,
55617 + current->exec_file->f_path.mnt) :
55618 + curr->filename, curr->filename,
55619 + &ip_addr, ip_port, type,
55620 + sk->sk_protocol, mode, &current->signal->saved_ip);
55621 + return 0;
55622 + }
55623 +
55624 + for (i = 0; i < curr->ip_num; i++) {
55625 + ip = *(curr->ips + i);
55626 + if (ip->iface != NULL) {
55627 + strncpy(iface, ip->iface, IFNAMSIZ - 1);
55628 + p = strchr(iface, ':');
55629 + if (p != NULL)
55630 + *p = '\0';
55631 + dev = dev_get_by_name(sock_net(sk), iface);
55632 + if (dev == NULL)
55633 + continue;
55634 + idev = in_dev_get(dev);
55635 + if (idev == NULL) {
55636 + dev_put(dev);
55637 + continue;
55638 + }
55639 + rcu_read_lock();
55640 + for_ifa(idev) {
55641 + if (!strcmp(ip->iface, ifa->ifa_label)) {
55642 + our_addr = ifa->ifa_address;
55643 + our_netmask = 0xffffffff;
55644 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
55645 + if (ret == 1) {
55646 + rcu_read_unlock();
55647 + in_dev_put(idev);
55648 + dev_put(dev);
55649 + return 0;
55650 + } else if (ret == 2) {
55651 + rcu_read_unlock();
55652 + in_dev_put(idev);
55653 + dev_put(dev);
55654 + goto denied;
55655 + }
55656 + }
55657 + } endfor_ifa(idev);
55658 + rcu_read_unlock();
55659 + in_dev_put(idev);
55660 + dev_put(dev);
55661 + } else {
55662 + our_addr = ip->addr;
55663 + our_netmask = ip->netmask;
55664 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
55665 + if (ret == 1)
55666 + return 0;
55667 + else if (ret == 2)
55668 + goto denied;
55669 + }
55670 + }
55671 +
55672 +denied:
55673 + if (mode == GR_BIND)
55674 + gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
55675 + else if (mode == GR_CONNECT)
55676 + gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
55677 +
55678 + return -EACCES;
55679 +}
55680 +
55681 +int
55682 +gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
55683 +{
55684 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
55685 +}
55686 +
55687 +int
55688 +gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
55689 +{
55690 + return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
55691 +}
55692 +
55693 +int gr_search_listen(struct socket *sock)
55694 +{
55695 + struct sock *sk = sock->sk;
55696 + struct sockaddr_in addr;
55697 +
55698 + addr.sin_addr.s_addr = inet_sk(sk)->saddr;
55699 + addr.sin_port = inet_sk(sk)->sport;
55700 +
55701 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
55702 +}
55703 +
55704 +int gr_search_accept(struct socket *sock)
55705 +{
55706 + struct sock *sk = sock->sk;
55707 + struct sockaddr_in addr;
55708 +
55709 + addr.sin_addr.s_addr = inet_sk(sk)->saddr;
55710 + addr.sin_port = inet_sk(sk)->sport;
55711 +
55712 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
55713 +}
55714 +
55715 +int
55716 +gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
55717 +{
55718 + if (addr)
55719 + return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
55720 + else {
55721 + struct sockaddr_in sin;
55722 + const struct inet_sock *inet = inet_sk(sk);
55723 +
55724 + sin.sin_addr.s_addr = inet->daddr;
55725 + sin.sin_port = inet->dport;
55726 +
55727 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
55728 + }
55729 +}
55730 +
55731 +int
55732 +gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
55733 +{
55734 + struct sockaddr_in sin;
55735 +
55736 + if (unlikely(skb->len < sizeof (struct udphdr)))
55737 + return 0; // skip this packet
55738 +
55739 + sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
55740 + sin.sin_port = udp_hdr(skb)->source;
55741 +
55742 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
55743 +}
55744 diff -urNp linux-2.6.32.46/grsecurity/gracl_learn.c linux-2.6.32.46/grsecurity/gracl_learn.c
55745 --- linux-2.6.32.46/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500
55746 +++ linux-2.6.32.46/grsecurity/gracl_learn.c 2011-07-14 21:02:03.000000000 -0400
55747 @@ -0,0 +1,208 @@
55748 +#include <linux/kernel.h>
55749 +#include <linux/mm.h>
55750 +#include <linux/sched.h>
55751 +#include <linux/poll.h>
55752 +#include <linux/smp_lock.h>
55753 +#include <linux/string.h>
55754 +#include <linux/file.h>
55755 +#include <linux/types.h>
55756 +#include <linux/vmalloc.h>
55757 +#include <linux/grinternal.h>
55758 +
55759 +extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
55760 + size_t count, loff_t *ppos);
55761 +extern int gr_acl_is_enabled(void);
55762 +
55763 +static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
55764 +static int gr_learn_attached;
55765 +
55766 +/* use a 512k buffer */
55767 +#define LEARN_BUFFER_SIZE (512 * 1024)
55768 +
55769 +static DEFINE_SPINLOCK(gr_learn_lock);
55770 +static DEFINE_MUTEX(gr_learn_user_mutex);
55771 +
55772 +/* we need to maintain two buffers, so that the kernel context of grlearn
55773 + uses a semaphore around the userspace copying, and the other kernel contexts
55774 + use a spinlock when copying into the buffer, since they cannot sleep
55775 +*/
55776 +static char *learn_buffer;
55777 +static char *learn_buffer_user;
55778 +static int learn_buffer_len;
55779 +static int learn_buffer_user_len;
55780 +
55781 +static ssize_t
55782 +read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
55783 +{
55784 + DECLARE_WAITQUEUE(wait, current);
55785 + ssize_t retval = 0;
55786 +
55787 + add_wait_queue(&learn_wait, &wait);
55788 + set_current_state(TASK_INTERRUPTIBLE);
55789 + do {
55790 + mutex_lock(&gr_learn_user_mutex);
55791 + spin_lock(&gr_learn_lock);
55792 + if (learn_buffer_len)
55793 + break;
55794 + spin_unlock(&gr_learn_lock);
55795 + mutex_unlock(&gr_learn_user_mutex);
55796 + if (file->f_flags & O_NONBLOCK) {
55797 + retval = -EAGAIN;
55798 + goto out;
55799 + }
55800 + if (signal_pending(current)) {
55801 + retval = -ERESTARTSYS;
55802 + goto out;
55803 + }
55804 +
55805 + schedule();
55806 + } while (1);
55807 +
55808 + memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
55809 + learn_buffer_user_len = learn_buffer_len;
55810 + retval = learn_buffer_len;
55811 + learn_buffer_len = 0;
55812 +
55813 + spin_unlock(&gr_learn_lock);
55814 +
55815 + if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
55816 + retval = -EFAULT;
55817 +
55818 + mutex_unlock(&gr_learn_user_mutex);
55819 +out:
55820 + set_current_state(TASK_RUNNING);
55821 + remove_wait_queue(&learn_wait, &wait);
55822 + return retval;
55823 +}
55824 +
55825 +static unsigned int
55826 +poll_learn(struct file * file, poll_table * wait)
55827 +{
55828 + poll_wait(file, &learn_wait, wait);
55829 +
55830 + if (learn_buffer_len)
55831 + return (POLLIN | POLLRDNORM);
55832 +
55833 + return 0;
55834 +}
55835 +
55836 +void
55837 +gr_clear_learn_entries(void)
55838 +{
55839 + char *tmp;
55840 +
55841 + mutex_lock(&gr_learn_user_mutex);
55842 + spin_lock(&gr_learn_lock);
55843 + tmp = learn_buffer;
55844 + learn_buffer = NULL;
55845 + spin_unlock(&gr_learn_lock);
55846 + if (tmp)
55847 + vfree(tmp);
55848 + if (learn_buffer_user != NULL) {
55849 + vfree(learn_buffer_user);
55850 + learn_buffer_user = NULL;
55851 + }
55852 + learn_buffer_len = 0;
55853 + mutex_unlock(&gr_learn_user_mutex);
55854 +
55855 + return;
55856 +}
55857 +
55858 +void
55859 +gr_add_learn_entry(const char *fmt, ...)
55860 +{
55861 + va_list args;
55862 + unsigned int len;
55863 +
55864 + if (!gr_learn_attached)
55865 + return;
55866 +
55867 + spin_lock(&gr_learn_lock);
55868 +
55869 + /* leave a gap at the end so we know when it's "full" but don't have to
55870 + compute the exact length of the string we're trying to append
55871 + */
55872 + if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
55873 + spin_unlock(&gr_learn_lock);
55874 + wake_up_interruptible(&learn_wait);
55875 + return;
55876 + }
55877 + if (learn_buffer == NULL) {
55878 + spin_unlock(&gr_learn_lock);
55879 + return;
55880 + }
55881 +
55882 + va_start(args, fmt);
55883 + len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
55884 + va_end(args);
55885 +
55886 + learn_buffer_len += len + 1;
55887 +
55888 + spin_unlock(&gr_learn_lock);
55889 + wake_up_interruptible(&learn_wait);
55890 +
55891 + return;
55892 +}
55893 +
55894 +static int
55895 +open_learn(struct inode *inode, struct file *file)
55896 +{
55897 + if (file->f_mode & FMODE_READ && gr_learn_attached)
55898 + return -EBUSY;
55899 + if (file->f_mode & FMODE_READ) {
55900 + int retval = 0;
55901 + mutex_lock(&gr_learn_user_mutex);
55902 + if (learn_buffer == NULL)
55903 + learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
55904 + if (learn_buffer_user == NULL)
55905 + learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
55906 + if (learn_buffer == NULL) {
55907 + retval = -ENOMEM;
55908 + goto out_error;
55909 + }
55910 + if (learn_buffer_user == NULL) {
55911 + retval = -ENOMEM;
55912 + goto out_error;
55913 + }
55914 + learn_buffer_len = 0;
55915 + learn_buffer_user_len = 0;
55916 + gr_learn_attached = 1;
55917 +out_error:
55918 + mutex_unlock(&gr_learn_user_mutex);
55919 + return retval;
55920 + }
55921 + return 0;
55922 +}
55923 +
55924 +static int
55925 +close_learn(struct inode *inode, struct file *file)
55926 +{
55927 + if (file->f_mode & FMODE_READ) {
55928 + char *tmp = NULL;
55929 + mutex_lock(&gr_learn_user_mutex);
55930 + spin_lock(&gr_learn_lock);
55931 + tmp = learn_buffer;
55932 + learn_buffer = NULL;
55933 + spin_unlock(&gr_learn_lock);
55934 + if (tmp)
55935 + vfree(tmp);
55936 + if (learn_buffer_user != NULL) {
55937 + vfree(learn_buffer_user);
55938 + learn_buffer_user = NULL;
55939 + }
55940 + learn_buffer_len = 0;
55941 + learn_buffer_user_len = 0;
55942 + gr_learn_attached = 0;
55943 + mutex_unlock(&gr_learn_user_mutex);
55944 + }
55945 +
55946 + return 0;
55947 +}
55948 +
55949 +const struct file_operations grsec_fops = {
55950 + .read = read_learn,
55951 + .write = write_grsec_handler,
55952 + .open = open_learn,
55953 + .release = close_learn,
55954 + .poll = poll_learn,
55955 +};
55956 diff -urNp linux-2.6.32.46/grsecurity/gracl_res.c linux-2.6.32.46/grsecurity/gracl_res.c
55957 --- linux-2.6.32.46/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
55958 +++ linux-2.6.32.46/grsecurity/gracl_res.c 2011-04-17 15:56:46.000000000 -0400
55959 @@ -0,0 +1,67 @@
55960 +#include <linux/kernel.h>
55961 +#include <linux/sched.h>
55962 +#include <linux/gracl.h>
55963 +#include <linux/grinternal.h>
55964 +
55965 +static const char *restab_log[] = {
55966 + [RLIMIT_CPU] = "RLIMIT_CPU",
55967 + [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
55968 + [RLIMIT_DATA] = "RLIMIT_DATA",
55969 + [RLIMIT_STACK] = "RLIMIT_STACK",
55970 + [RLIMIT_CORE] = "RLIMIT_CORE",
55971 + [RLIMIT_RSS] = "RLIMIT_RSS",
55972 + [RLIMIT_NPROC] = "RLIMIT_NPROC",
55973 + [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
55974 + [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
55975 + [RLIMIT_AS] = "RLIMIT_AS",
55976 + [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
55977 + [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
55978 + [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
55979 + [RLIMIT_NICE] = "RLIMIT_NICE",
55980 + [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
55981 + [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
55982 + [GR_CRASH_RES] = "RLIMIT_CRASH"
55983 +};
55984 +
55985 +void
55986 +gr_log_resource(const struct task_struct *task,
55987 + const int res, const unsigned long wanted, const int gt)
55988 +{
55989 + const struct cred *cred;
55990 + unsigned long rlim;
55991 +
55992 + if (!gr_acl_is_enabled() && !grsec_resource_logging)
55993 + return;
55994 +
55995 + // not yet supported resource
55996 + if (unlikely(!restab_log[res]))
55997 + return;
55998 +
55999 + if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
56000 + rlim = task->signal->rlim[res].rlim_max;
56001 + else
56002 + rlim = task->signal->rlim[res].rlim_cur;
56003 + if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
56004 + return;
56005 +
56006 + rcu_read_lock();
56007 + cred = __task_cred(task);
56008 +
56009 + if (res == RLIMIT_NPROC &&
56010 + (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
56011 + cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
56012 + goto out_rcu_unlock;
56013 + else if (res == RLIMIT_MEMLOCK &&
56014 + cap_raised(cred->cap_effective, CAP_IPC_LOCK))
56015 + goto out_rcu_unlock;
56016 + else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
56017 + goto out_rcu_unlock;
56018 + rcu_read_unlock();
56019 +
56020 + gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
56021 +
56022 + return;
56023 +out_rcu_unlock:
56024 + rcu_read_unlock();
56025 + return;
56026 +}
56027 diff -urNp linux-2.6.32.46/grsecurity/gracl_segv.c linux-2.6.32.46/grsecurity/gracl_segv.c
56028 --- linux-2.6.32.46/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500
56029 +++ linux-2.6.32.46/grsecurity/gracl_segv.c 2011-04-17 15:56:46.000000000 -0400
56030 @@ -0,0 +1,284 @@
56031 +#include <linux/kernel.h>
56032 +#include <linux/mm.h>
56033 +#include <asm/uaccess.h>
56034 +#include <asm/errno.h>
56035 +#include <asm/mman.h>
56036 +#include <net/sock.h>
56037 +#include <linux/file.h>
56038 +#include <linux/fs.h>
56039 +#include <linux/net.h>
56040 +#include <linux/in.h>
56041 +#include <linux/smp_lock.h>
56042 +#include <linux/slab.h>
56043 +#include <linux/types.h>
56044 +#include <linux/sched.h>
56045 +#include <linux/timer.h>
56046 +#include <linux/gracl.h>
56047 +#include <linux/grsecurity.h>
56048 +#include <linux/grinternal.h>
56049 +
56050 +static struct crash_uid *uid_set;
56051 +static unsigned short uid_used;
56052 +static DEFINE_SPINLOCK(gr_uid_lock);
56053 +extern rwlock_t gr_inode_lock;
56054 +extern struct acl_subject_label *
56055 + lookup_acl_subj_label(const ino_t inode, const dev_t dev,
56056 + struct acl_role_label *role);
56057 +extern int gr_fake_force_sig(int sig, struct task_struct *t);
56058 +
56059 +int
56060 +gr_init_uidset(void)
56061 +{
56062 + uid_set =
56063 + kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
56064 + uid_used = 0;
56065 +
56066 + return uid_set ? 1 : 0;
56067 +}
56068 +
56069 +void
56070 +gr_free_uidset(void)
56071 +{
56072 + if (uid_set)
56073 + kfree(uid_set);
56074 +
56075 + return;
56076 +}
56077 +
56078 +int
56079 +gr_find_uid(const uid_t uid)
56080 +{
56081 + struct crash_uid *tmp = uid_set;
56082 + uid_t buid;
56083 + int low = 0, high = uid_used - 1, mid;
56084 +
56085 + while (high >= low) {
56086 + mid = (low + high) >> 1;
56087 + buid = tmp[mid].uid;
56088 + if (buid == uid)
56089 + return mid;
56090 + if (buid > uid)
56091 + high = mid - 1;
56092 + if (buid < uid)
56093 + low = mid + 1;
56094 + }
56095 +
56096 + return -1;
56097 +}
56098 +
56099 +static __inline__ void
56100 +gr_insertsort(void)
56101 +{
56102 + unsigned short i, j;
56103 + struct crash_uid index;
56104 +
56105 + for (i = 1; i < uid_used; i++) {
56106 + index = uid_set[i];
56107 + j = i;
56108 + while ((j > 0) && uid_set[j - 1].uid > index.uid) {
56109 + uid_set[j] = uid_set[j - 1];
56110 + j--;
56111 + }
56112 + uid_set[j] = index;
56113 + }
56114 +
56115 + return;
56116 +}
56117 +
56118 +static __inline__ void
56119 +gr_insert_uid(const uid_t uid, const unsigned long expires)
56120 +{
56121 + int loc;
56122 +
56123 + if (uid_used == GR_UIDTABLE_MAX)
56124 + return;
56125 +
56126 + loc = gr_find_uid(uid);
56127 +
56128 + if (loc >= 0) {
56129 + uid_set[loc].expires = expires;
56130 + return;
56131 + }
56132 +
56133 + uid_set[uid_used].uid = uid;
56134 + uid_set[uid_used].expires = expires;
56135 + uid_used++;
56136 +
56137 + gr_insertsort();
56138 +
56139 + return;
56140 +}
56141 +
56142 +void
56143 +gr_remove_uid(const unsigned short loc)
56144 +{
56145 + unsigned short i;
56146 +
56147 + for (i = loc + 1; i < uid_used; i++)
56148 + uid_set[i - 1] = uid_set[i];
56149 +
56150 + uid_used--;
56151 +
56152 + return;
56153 +}
56154 +
56155 +int
56156 +gr_check_crash_uid(const uid_t uid)
56157 +{
56158 + int loc;
56159 + int ret = 0;
56160 +
56161 + if (unlikely(!gr_acl_is_enabled()))
56162 + return 0;
56163 +
56164 + spin_lock(&gr_uid_lock);
56165 + loc = gr_find_uid(uid);
56166 +
56167 + if (loc < 0)
56168 + goto out_unlock;
56169 +
56170 + if (time_before_eq(uid_set[loc].expires, get_seconds()))
56171 + gr_remove_uid(loc);
56172 + else
56173 + ret = 1;
56174 +
56175 +out_unlock:
56176 + spin_unlock(&gr_uid_lock);
56177 + return ret;
56178 +}
56179 +
56180 +static __inline__ int
56181 +proc_is_setxid(const struct cred *cred)
56182 +{
56183 + if (cred->uid != cred->euid || cred->uid != cred->suid ||
56184 + cred->uid != cred->fsuid)
56185 + return 1;
56186 + if (cred->gid != cred->egid || cred->gid != cred->sgid ||
56187 + cred->gid != cred->fsgid)
56188 + return 1;
56189 +
56190 + return 0;
56191 +}
56192 +
56193 +void
56194 +gr_handle_crash(struct task_struct *task, const int sig)
56195 +{
56196 + struct acl_subject_label *curr;
56197 + struct acl_subject_label *curr2;
56198 + struct task_struct *tsk, *tsk2;
56199 + const struct cred *cred;
56200 + const struct cred *cred2;
56201 +
56202 + if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
56203 + return;
56204 +
56205 + if (unlikely(!gr_acl_is_enabled()))
56206 + return;
56207 +
56208 + curr = task->acl;
56209 +
56210 + if (!(curr->resmask & (1 << GR_CRASH_RES)))
56211 + return;
56212 +
56213 + if (time_before_eq(curr->expires, get_seconds())) {
56214 + curr->expires = 0;
56215 + curr->crashes = 0;
56216 + }
56217 +
56218 + curr->crashes++;
56219 +
56220 + if (!curr->expires)
56221 + curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
56222 +
56223 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56224 + time_after(curr->expires, get_seconds())) {
56225 + rcu_read_lock();
56226 + cred = __task_cred(task);
56227 + if (cred->uid && proc_is_setxid(cred)) {
56228 + gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56229 + spin_lock(&gr_uid_lock);
56230 + gr_insert_uid(cred->uid, curr->expires);
56231 + spin_unlock(&gr_uid_lock);
56232 + curr->expires = 0;
56233 + curr->crashes = 0;
56234 + read_lock(&tasklist_lock);
56235 + do_each_thread(tsk2, tsk) {
56236 + cred2 = __task_cred(tsk);
56237 + if (tsk != task && cred2->uid == cred->uid)
56238 + gr_fake_force_sig(SIGKILL, tsk);
56239 + } while_each_thread(tsk2, tsk);
56240 + read_unlock(&tasklist_lock);
56241 + } else {
56242 + gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56243 + read_lock(&tasklist_lock);
56244 + do_each_thread(tsk2, tsk) {
56245 + if (likely(tsk != task)) {
56246 + curr2 = tsk->acl;
56247 +
56248 + if (curr2->device == curr->device &&
56249 + curr2->inode == curr->inode)
56250 + gr_fake_force_sig(SIGKILL, tsk);
56251 + }
56252 + } while_each_thread(tsk2, tsk);
56253 + read_unlock(&tasklist_lock);
56254 + }
56255 + rcu_read_unlock();
56256 + }
56257 +
56258 + return;
56259 +}
56260 +
56261 +int
56262 +gr_check_crash_exec(const struct file *filp)
56263 +{
56264 + struct acl_subject_label *curr;
56265 +
56266 + if (unlikely(!gr_acl_is_enabled()))
56267 + return 0;
56268 +
56269 + read_lock(&gr_inode_lock);
56270 + curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
56271 + filp->f_path.dentry->d_inode->i_sb->s_dev,
56272 + current->role);
56273 + read_unlock(&gr_inode_lock);
56274 +
56275 + if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
56276 + (!curr->crashes && !curr->expires))
56277 + return 0;
56278 +
56279 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56280 + time_after(curr->expires, get_seconds()))
56281 + return 1;
56282 + else if (time_before_eq(curr->expires, get_seconds())) {
56283 + curr->crashes = 0;
56284 + curr->expires = 0;
56285 + }
56286 +
56287 + return 0;
56288 +}
56289 +
56290 +void
56291 +gr_handle_alertkill(struct task_struct *task)
56292 +{
56293 + struct acl_subject_label *curracl;
56294 + __u32 curr_ip;
56295 + struct task_struct *p, *p2;
56296 +
56297 + if (unlikely(!gr_acl_is_enabled()))
56298 + return;
56299 +
56300 + curracl = task->acl;
56301 + curr_ip = task->signal->curr_ip;
56302 +
56303 + if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
56304 + read_lock(&tasklist_lock);
56305 + do_each_thread(p2, p) {
56306 + if (p->signal->curr_ip == curr_ip)
56307 + gr_fake_force_sig(SIGKILL, p);
56308 + } while_each_thread(p2, p);
56309 + read_unlock(&tasklist_lock);
56310 + } else if (curracl->mode & GR_KILLPROC)
56311 + gr_fake_force_sig(SIGKILL, task);
56312 +
56313 + return;
56314 +}
56315 diff -urNp linux-2.6.32.46/grsecurity/gracl_shm.c linux-2.6.32.46/grsecurity/gracl_shm.c
56316 --- linux-2.6.32.46/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
56317 +++ linux-2.6.32.46/grsecurity/gracl_shm.c 2011-04-17 15:56:46.000000000 -0400
56318 @@ -0,0 +1,40 @@
56319 +#include <linux/kernel.h>
56320 +#include <linux/mm.h>
56321 +#include <linux/sched.h>
56322 +#include <linux/file.h>
56323 +#include <linux/ipc.h>
56324 +#include <linux/gracl.h>
56325 +#include <linux/grsecurity.h>
56326 +#include <linux/grinternal.h>
56327 +
56328 +int
56329 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
56330 + const time_t shm_createtime, const uid_t cuid, const int shmid)
56331 +{
56332 + struct task_struct *task;
56333 +
56334 + if (!gr_acl_is_enabled())
56335 + return 1;
56336 +
56337 + rcu_read_lock();
56338 + read_lock(&tasklist_lock);
56339 +
56340 + task = find_task_by_vpid(shm_cprid);
56341 +
56342 + if (unlikely(!task))
56343 + task = find_task_by_vpid(shm_lapid);
56344 +
56345 + if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
56346 + (task->pid == shm_lapid)) &&
56347 + (task->acl->mode & GR_PROTSHM) &&
56348 + (task->acl != current->acl))) {
56349 + read_unlock(&tasklist_lock);
56350 + rcu_read_unlock();
56351 + gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
56352 + return 0;
56353 + }
56354 + read_unlock(&tasklist_lock);
56355 + rcu_read_unlock();
56356 +
56357 + return 1;
56358 +}
56359 diff -urNp linux-2.6.32.46/grsecurity/grsec_chdir.c linux-2.6.32.46/grsecurity/grsec_chdir.c
56360 --- linux-2.6.32.46/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500
56361 +++ linux-2.6.32.46/grsecurity/grsec_chdir.c 2011-04-17 15:56:46.000000000 -0400
56362 @@ -0,0 +1,19 @@
56363 +#include <linux/kernel.h>
56364 +#include <linux/sched.h>
56365 +#include <linux/fs.h>
56366 +#include <linux/file.h>
56367 +#include <linux/grsecurity.h>
56368 +#include <linux/grinternal.h>
56369 +
56370 +void
56371 +gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
56372 +{
56373 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
56374 + if ((grsec_enable_chdir && grsec_enable_group &&
56375 + in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
56376 + !grsec_enable_group)) {
56377 + gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
56378 + }
56379 +#endif
56380 + return;
56381 +}
56382 diff -urNp linux-2.6.32.46/grsecurity/grsec_chroot.c linux-2.6.32.46/grsecurity/grsec_chroot.c
56383 --- linux-2.6.32.46/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500
56384 +++ linux-2.6.32.46/grsecurity/grsec_chroot.c 2011-09-15 06:48:16.000000000 -0400
56385 @@ -0,0 +1,386 @@
56386 +#include <linux/kernel.h>
56387 +#include <linux/module.h>
56388 +#include <linux/sched.h>
56389 +#include <linux/file.h>
56390 +#include <linux/fs.h>
56391 +#include <linux/mount.h>
56392 +#include <linux/types.h>
56393 +#include <linux/pid_namespace.h>
56394 +#include <linux/grsecurity.h>
56395 +#include <linux/grinternal.h>
56396 +
56397 +void gr_set_chroot_entries(struct task_struct *task, struct path *path)
56398 +{
56399 +#ifdef CONFIG_GRKERNSEC
56400 + if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
56401 + path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
56402 + task->gr_is_chrooted = 1;
56403 + else
56404 + task->gr_is_chrooted = 0;
56405 +
56406 + task->gr_chroot_dentry = path->dentry;
56407 +#endif
56408 + return;
56409 +}
56410 +
56411 +void gr_clear_chroot_entries(struct task_struct *task)
56412 +{
56413 +#ifdef CONFIG_GRKERNSEC
56414 + task->gr_is_chrooted = 0;
56415 + task->gr_chroot_dentry = NULL;
56416 +#endif
56417 + return;
56418 +}
56419 +
56420 +int
56421 +gr_handle_chroot_unix(const pid_t pid)
56422 +{
56423 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
56424 + struct task_struct *p;
56425 +
56426 + if (unlikely(!grsec_enable_chroot_unix))
56427 + return 1;
56428 +
56429 + if (likely(!proc_is_chrooted(current)))
56430 + return 1;
56431 +
56432 + rcu_read_lock();
56433 + read_lock(&tasklist_lock);
56434 +
56435 + p = find_task_by_vpid_unrestricted(pid);
56436 + if (unlikely(p && !have_same_root(current, p))) {
56437 + read_unlock(&tasklist_lock);
56438 + rcu_read_unlock();
56439 + gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
56440 + return 0;
56441 + }
56442 + read_unlock(&tasklist_lock);
56443 + rcu_read_unlock();
56444 +#endif
56445 + return 1;
56446 +}
56447 +
56448 +int
56449 +gr_handle_chroot_nice(void)
56450 +{
56451 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
56452 + if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
56453 + gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
56454 + return -EPERM;
56455 + }
56456 +#endif
56457 + return 0;
56458 +}
56459 +
56460 +int
56461 +gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
56462 +{
56463 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
56464 + if (grsec_enable_chroot_nice && (niceval < task_nice(p))
56465 + && proc_is_chrooted(current)) {
56466 + gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
56467 + return -EACCES;
56468 + }
56469 +#endif
56470 + return 0;
56471 +}
56472 +
56473 +int
56474 +gr_handle_chroot_rawio(const struct inode *inode)
56475 +{
56476 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
56477 + if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
56478 + inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
56479 + return 1;
56480 +#endif
56481 + return 0;
56482 +}
56483 +
56484 +int
56485 +gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
56486 +{
56487 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
56488 + struct task_struct *p;
56489 + int ret = 0;
56490 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
56491 + return ret;
56492 +
56493 + read_lock(&tasklist_lock);
56494 + do_each_pid_task(pid, type, p) {
56495 + if (!have_same_root(current, p)) {
56496 + ret = 1;
56497 + goto out;
56498 + }
56499 + } while_each_pid_task(pid, type, p);
56500 +out:
56501 + read_unlock(&tasklist_lock);
56502 + return ret;
56503 +#endif
56504 + return 0;
56505 +}
56506 +
56507 +int
56508 +gr_pid_is_chrooted(struct task_struct *p)
56509 +{
56510 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
56511 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
56512 + return 0;
56513 +
56514 + if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
56515 + !have_same_root(current, p)) {
56516 + return 1;
56517 + }
56518 +#endif
56519 + return 0;
56520 +}
56521 +
56522 +EXPORT_SYMBOL(gr_pid_is_chrooted);
56523 +
56524 +#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
56525 +int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
56526 +{
56527 + struct dentry *dentry = (struct dentry *)u_dentry;
56528 + struct vfsmount *mnt = (struct vfsmount *)u_mnt;
56529 + struct dentry *realroot;
56530 + struct vfsmount *realrootmnt;
56531 + struct dentry *currentroot;
56532 + struct vfsmount *currentmnt;
56533 + struct task_struct *reaper = &init_task;
56534 + int ret = 1;
56535 +
56536 + read_lock(&reaper->fs->lock);
56537 + realrootmnt = mntget(reaper->fs->root.mnt);
56538 + realroot = dget(reaper->fs->root.dentry);
56539 + read_unlock(&reaper->fs->lock);
56540 +
56541 + read_lock(&current->fs->lock);
56542 + currentmnt = mntget(current->fs->root.mnt);
56543 + currentroot = dget(current->fs->root.dentry);
56544 + read_unlock(&current->fs->lock);
56545 +
56546 + spin_lock(&dcache_lock);
56547 + for (;;) {
56548 + if (unlikely((dentry == realroot && mnt == realrootmnt)
56549 + || (dentry == currentroot && mnt == currentmnt)))
56550 + break;
56551 + if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
56552 + if (mnt->mnt_parent == mnt)
56553 + break;
56554 + dentry = mnt->mnt_mountpoint;
56555 + mnt = mnt->mnt_parent;
56556 + continue;
56557 + }
56558 + dentry = dentry->d_parent;
56559 + }
56560 + spin_unlock(&dcache_lock);
56561 +
56562 + dput(currentroot);
56563 + mntput(currentmnt);
56564 +
56565 + /* access is outside of chroot */
56566 + if (dentry == realroot && mnt == realrootmnt)
56567 + ret = 0;
56568 +
56569 + dput(realroot);
56570 + mntput(realrootmnt);
56571 + return ret;
56572 +}
56573 +#endif
56574 +
56575 +int
56576 +gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
56577 +{
56578 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
56579 + if (!grsec_enable_chroot_fchdir)
56580 + return 1;
56581 +
56582 + if (!proc_is_chrooted(current))
56583 + return 1;
56584 + else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
56585 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
56586 + return 0;
56587 + }
56588 +#endif
56589 + return 1;
56590 +}
56591 +
56592 +int
56593 +gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
56594 + const time_t shm_createtime)
56595 +{
56596 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
56597 + struct task_struct *p;
56598 + time_t starttime;
56599 +
56600 + if (unlikely(!grsec_enable_chroot_shmat))
56601 + return 1;
56602 +
56603 + if (likely(!proc_is_chrooted(current)))
56604 + return 1;
56605 +
56606 + rcu_read_lock();
56607 + read_lock(&tasklist_lock);
56608 +
56609 + if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
56610 + starttime = p->start_time.tv_sec;
56611 + if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
56612 + if (have_same_root(current, p)) {
56613 + goto allow;
56614 + } else {
56615 + read_unlock(&tasklist_lock);
56616 + rcu_read_unlock();
56617 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
56618 + return 0;
56619 + }
56620 + }
56621 + /* creator exited, pid reuse, fall through to next check */
56622 + }
56623 + if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
56624 + if (unlikely(!have_same_root(current, p))) {
56625 + read_unlock(&tasklist_lock);
56626 + rcu_read_unlock();
56627 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
56628 + return 0;
56629 + }
56630 + }
56631 +
56632 +allow:
56633 + read_unlock(&tasklist_lock);
56634 + rcu_read_unlock();
56635 +#endif
56636 + return 1;
56637 +}
56638 +
56639 +void
56640 +gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
56641 +{
56642 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
56643 + if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
56644 + gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
56645 +#endif
56646 + return;
56647 +}
56648 +
56649 +int
56650 +gr_handle_chroot_mknod(const struct dentry *dentry,
56651 + const struct vfsmount *mnt, const int mode)
56652 +{
56653 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
56654 + if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
56655 + proc_is_chrooted(current)) {
56656 + gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
56657 + return -EPERM;
56658 + }
56659 +#endif
56660 + return 0;
56661 +}
56662 +
56663 +int
56664 +gr_handle_chroot_mount(const struct dentry *dentry,
56665 + const struct vfsmount *mnt, const char *dev_name)
56666 +{
56667 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
56668 + if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
56669 + gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none" , dentry, mnt);
56670 + return -EPERM;
56671 + }
56672 +#endif
56673 + return 0;
56674 +}
56675 +
56676 +int
56677 +gr_handle_chroot_pivot(void)
56678 +{
56679 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
56680 + if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
56681 + gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
56682 + return -EPERM;
56683 + }
56684 +#endif
56685 + return 0;
56686 +}
56687 +
56688 +int
56689 +gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
56690 +{
56691 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
56692 + if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
56693 + !gr_is_outside_chroot(dentry, mnt)) {
56694 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
56695 + return -EPERM;
56696 + }
56697 +#endif
56698 + return 0;
56699 +}
56700 +
56701 +extern const char *captab_log[];
56702 +extern int captab_log_entries;
56703 +
56704 +int
56705 +gr_chroot_is_capable(const int cap)
56706 +{
56707 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
56708 + if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
56709 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
56710 + if (cap_raised(chroot_caps, cap)) {
56711 + const struct cred *creds = current_cred();
56712 + if (cap_raised(creds->cap_effective, cap) && cap < captab_log_entries) {
56713 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, current, captab_log[cap]);
56714 + }
56715 + return 0;
56716 + }
56717 + }
56718 +#endif
56719 + return 1;
56720 +}
56721 +
56722 +int
56723 +gr_chroot_is_capable_nolog(const int cap)
56724 +{
56725 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
56726 + if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
56727 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
56728 + if (cap_raised(chroot_caps, cap)) {
56729 + return 0;
56730 + }
56731 + }
56732 +#endif
56733 + return 1;
56734 +}
56735 +
56736 +int
56737 +gr_handle_chroot_sysctl(const int op)
56738 +{
56739 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
56740 + if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
56741 + && (op & MAY_WRITE))
56742 + return -EACCES;
56743 +#endif
56744 + return 0;
56745 +}
56746 +
56747 +void
56748 +gr_handle_chroot_chdir(struct path *path)
56749 +{
56750 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
56751 + if (grsec_enable_chroot_chdir)
56752 + set_fs_pwd(current->fs, path);
56753 +#endif
56754 + return;
56755 +}
56756 +
56757 +int
56758 +gr_handle_chroot_chmod(const struct dentry *dentry,
56759 + const struct vfsmount *mnt, const int mode)
56760 +{
56761 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
56762 + /* allow chmod +s on directories, but not on files */
56763 + if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
56764 + ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
56765 + proc_is_chrooted(current)) {
56766 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
56767 + return -EPERM;
56768 + }
56769 +#endif
56770 + return 0;
56771 +}
56772 diff -urNp linux-2.6.32.46/grsecurity/grsec_disabled.c linux-2.6.32.46/grsecurity/grsec_disabled.c
56773 --- linux-2.6.32.46/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500
56774 +++ linux-2.6.32.46/grsecurity/grsec_disabled.c 2011-10-25 09:16:40.000000000 -0400
56775 @@ -0,0 +1,439 @@
56776 +#include <linux/kernel.h>
56777 +#include <linux/module.h>
56778 +#include <linux/sched.h>
56779 +#include <linux/file.h>
56780 +#include <linux/fs.h>
56781 +#include <linux/kdev_t.h>
56782 +#include <linux/net.h>
56783 +#include <linux/in.h>
56784 +#include <linux/ip.h>
56785 +#include <linux/skbuff.h>
56786 +#include <linux/sysctl.h>
56787 +
56788 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
56789 +void
56790 +pax_set_initial_flags(struct linux_binprm *bprm)
56791 +{
56792 + return;
56793 +}
56794 +#endif
56795 +
56796 +#ifdef CONFIG_SYSCTL
56797 +__u32
56798 +gr_handle_sysctl(const struct ctl_table * table, const int op)
56799 +{
56800 + return 0;
56801 +}
56802 +#endif
56803 +
56804 +#ifdef CONFIG_TASKSTATS
56805 +int gr_is_taskstats_denied(int pid)
56806 +{
56807 + return 0;
56808 +}
56809 +#endif
56810 +
56811 +int
56812 +gr_acl_is_enabled(void)
56813 +{
56814 + return 0;
56815 +}
56816 +
56817 +void
56818 +gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
56819 +{
56820 + return;
56821 +}
56822 +
56823 +int
56824 +gr_handle_rawio(const struct inode *inode)
56825 +{
56826 + return 0;
56827 +}
56828 +
56829 +void
56830 +gr_acl_handle_psacct(struct task_struct *task, const long code)
56831 +{
56832 + return;
56833 +}
56834 +
56835 +int
56836 +gr_handle_ptrace(struct task_struct *task, const long request)
56837 +{
56838 + return 0;
56839 +}
56840 +
56841 +int
56842 +gr_handle_proc_ptrace(struct task_struct *task)
56843 +{
56844 + return 0;
56845 +}
56846 +
56847 +void
56848 +gr_learn_resource(const struct task_struct *task,
56849 + const int res, const unsigned long wanted, const int gt)
56850 +{
56851 + return;
56852 +}
56853 +
56854 +int
56855 +gr_set_acls(const int type)
56856 +{
56857 + return 0;
56858 +}
56859 +
56860 +int
56861 +gr_check_hidden_task(const struct task_struct *tsk)
56862 +{
56863 + return 0;
56864 +}
56865 +
56866 +int
56867 +gr_check_protected_task(const struct task_struct *task)
56868 +{
56869 + return 0;
56870 +}
56871 +
56872 +int
56873 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
56874 +{
56875 + return 0;
56876 +}
56877 +
56878 +void
56879 +gr_copy_label(struct task_struct *tsk)
56880 +{
56881 + return;
56882 +}
56883 +
56884 +void
56885 +gr_set_pax_flags(struct task_struct *task)
56886 +{
56887 + return;
56888 +}
56889 +
56890 +int
56891 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
56892 + const int unsafe_share)
56893 +{
56894 + return 0;
56895 +}
56896 +
56897 +void
56898 +gr_handle_delete(const ino_t ino, const dev_t dev)
56899 +{
56900 + return;
56901 +}
56902 +
56903 +void
56904 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
56905 +{
56906 + return;
56907 +}
56908 +
56909 +void
56910 +gr_handle_crash(struct task_struct *task, const int sig)
56911 +{
56912 + return;
56913 +}
56914 +
56915 +int
56916 +gr_check_crash_exec(const struct file *filp)
56917 +{
56918 + return 0;
56919 +}
56920 +
56921 +int
56922 +gr_check_crash_uid(const uid_t uid)
56923 +{
56924 + return 0;
56925 +}
56926 +
56927 +void
56928 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
56929 + struct dentry *old_dentry,
56930 + struct dentry *new_dentry,
56931 + struct vfsmount *mnt, const __u8 replace)
56932 +{
56933 + return;
56934 +}
56935 +
56936 +int
56937 +gr_search_socket(const int family, const int type, const int protocol)
56938 +{
56939 + return 1;
56940 +}
56941 +
56942 +int
56943 +gr_search_connectbind(const int mode, const struct socket *sock,
56944 + const struct sockaddr_in *addr)
56945 +{
56946 + return 0;
56947 +}
56948 +
56949 +void
56950 +gr_handle_alertkill(struct task_struct *task)
56951 +{
56952 + return;
56953 +}
56954 +
56955 +__u32
56956 +gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
56957 +{
56958 + return 1;
56959 +}
56960 +
56961 +__u32
56962 +gr_acl_handle_hidden_file(const struct dentry * dentry,
56963 + const struct vfsmount * mnt)
56964 +{
56965 + return 1;
56966 +}
56967 +
56968 +__u32
56969 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
56970 + const int fmode)
56971 +{
56972 + return 1;
56973 +}
56974 +
56975 +__u32
56976 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
56977 +{
56978 + return 1;
56979 +}
56980 +
56981 +__u32
56982 +gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
56983 +{
56984 + return 1;
56985 +}
56986 +
56987 +int
56988 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
56989 + unsigned int *vm_flags)
56990 +{
56991 + return 1;
56992 +}
56993 +
56994 +__u32
56995 +gr_acl_handle_truncate(const struct dentry * dentry,
56996 + const struct vfsmount * mnt)
56997 +{
56998 + return 1;
56999 +}
57000 +
57001 +__u32
57002 +gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
57003 +{
57004 + return 1;
57005 +}
57006 +
57007 +__u32
57008 +gr_acl_handle_access(const struct dentry * dentry,
57009 + const struct vfsmount * mnt, const int fmode)
57010 +{
57011 + return 1;
57012 +}
57013 +
57014 +__u32
57015 +gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
57016 + mode_t mode)
57017 +{
57018 + return 1;
57019 +}
57020 +
57021 +__u32
57022 +gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
57023 + mode_t mode)
57024 +{
57025 + return 1;
57026 +}
57027 +
57028 +__u32
57029 +gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
57030 +{
57031 + return 1;
57032 +}
57033 +
57034 +__u32
57035 +gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
57036 +{
57037 + return 1;
57038 +}
57039 +
57040 +void
57041 +grsecurity_init(void)
57042 +{
57043 + return;
57044 +}
57045 +
57046 +__u32
57047 +gr_acl_handle_mknod(const struct dentry * new_dentry,
57048 + const struct dentry * parent_dentry,
57049 + const struct vfsmount * parent_mnt,
57050 + const int mode)
57051 +{
57052 + return 1;
57053 +}
57054 +
57055 +__u32
57056 +gr_acl_handle_mkdir(const struct dentry * new_dentry,
57057 + const struct dentry * parent_dentry,
57058 + const struct vfsmount * parent_mnt)
57059 +{
57060 + return 1;
57061 +}
57062 +
57063 +__u32
57064 +gr_acl_handle_symlink(const struct dentry * new_dentry,
57065 + const struct dentry * parent_dentry,
57066 + const struct vfsmount * parent_mnt, const char *from)
57067 +{
57068 + return 1;
57069 +}
57070 +
57071 +__u32
57072 +gr_acl_handle_link(const struct dentry * new_dentry,
57073 + const struct dentry * parent_dentry,
57074 + const struct vfsmount * parent_mnt,
57075 + const struct dentry * old_dentry,
57076 + const struct vfsmount * old_mnt, const char *to)
57077 +{
57078 + return 1;
57079 +}
57080 +
57081 +int
57082 +gr_acl_handle_rename(const struct dentry *new_dentry,
57083 + const struct dentry *parent_dentry,
57084 + const struct vfsmount *parent_mnt,
57085 + const struct dentry *old_dentry,
57086 + const struct inode *old_parent_inode,
57087 + const struct vfsmount *old_mnt, const char *newname)
57088 +{
57089 + return 0;
57090 +}
57091 +
57092 +int
57093 +gr_acl_handle_filldir(const struct file *file, const char *name,
57094 + const int namelen, const ino_t ino)
57095 +{
57096 + return 1;
57097 +}
57098 +
57099 +int
57100 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57101 + const time_t shm_createtime, const uid_t cuid, const int shmid)
57102 +{
57103 + return 1;
57104 +}
57105 +
57106 +int
57107 +gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
57108 +{
57109 + return 0;
57110 +}
57111 +
57112 +int
57113 +gr_search_accept(const struct socket *sock)
57114 +{
57115 + return 0;
57116 +}
57117 +
57118 +int
57119 +gr_search_listen(const struct socket *sock)
57120 +{
57121 + return 0;
57122 +}
57123 +
57124 +int
57125 +gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
57126 +{
57127 + return 0;
57128 +}
57129 +
57130 +__u32
57131 +gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
57132 +{
57133 + return 1;
57134 +}
57135 +
57136 +__u32
57137 +gr_acl_handle_creat(const struct dentry * dentry,
57138 + const struct dentry * p_dentry,
57139 + const struct vfsmount * p_mnt, const int fmode,
57140 + const int imode)
57141 +{
57142 + return 1;
57143 +}
57144 +
57145 +void
57146 +gr_acl_handle_exit(void)
57147 +{
57148 + return;
57149 +}
57150 +
57151 +int
57152 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
57153 +{
57154 + return 1;
57155 +}
57156 +
57157 +void
57158 +gr_set_role_label(const uid_t uid, const gid_t gid)
57159 +{
57160 + return;
57161 +}
57162 +
57163 +int
57164 +gr_acl_handle_procpidmem(const struct task_struct *task)
57165 +{
57166 + return 0;
57167 +}
57168 +
57169 +int
57170 +gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
57171 +{
57172 + return 0;
57173 +}
57174 +
57175 +int
57176 +gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
57177 +{
57178 + return 0;
57179 +}
57180 +
57181 +void
57182 +gr_set_kernel_label(struct task_struct *task)
57183 +{
57184 + return;
57185 +}
57186 +
57187 +int
57188 +gr_check_user_change(int real, int effective, int fs)
57189 +{
57190 + return 0;
57191 +}
57192 +
57193 +int
57194 +gr_check_group_change(int real, int effective, int fs)
57195 +{
57196 + return 0;
57197 +}
57198 +
57199 +int gr_acl_enable_at_secure(void)
57200 +{
57201 + return 0;
57202 +}
57203 +
57204 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
57205 +{
57206 + return dentry->d_inode->i_sb->s_dev;
57207 +}
57208 +
57209 +EXPORT_SYMBOL(gr_learn_resource);
57210 +EXPORT_SYMBOL(gr_set_kernel_label);
57211 +#ifdef CONFIG_SECURITY
57212 +EXPORT_SYMBOL(gr_check_user_change);
57213 +EXPORT_SYMBOL(gr_check_group_change);
57214 +#endif
57215 diff -urNp linux-2.6.32.46/grsecurity/grsec_exec.c linux-2.6.32.46/grsecurity/grsec_exec.c
57216 --- linux-2.6.32.46/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500
57217 +++ linux-2.6.32.46/grsecurity/grsec_exec.c 2011-09-13 22:54:27.000000000 -0400
57218 @@ -0,0 +1,204 @@
57219 +#include <linux/kernel.h>
57220 +#include <linux/sched.h>
57221 +#include <linux/file.h>
57222 +#include <linux/binfmts.h>
57223 +#include <linux/smp_lock.h>
57224 +#include <linux/fs.h>
57225 +#include <linux/types.h>
57226 +#include <linux/grdefs.h>
57227 +#include <linux/grinternal.h>
57228 +#include <linux/capability.h>
57229 +#include <linux/compat.h>
57230 +#include <linux/module.h>
57231 +
57232 +#include <asm/uaccess.h>
57233 +
57234 +#ifdef CONFIG_GRKERNSEC_EXECLOG
57235 +static char gr_exec_arg_buf[132];
57236 +static DEFINE_MUTEX(gr_exec_arg_mutex);
57237 +#endif
57238 +
57239 +void
57240 +gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv)
57241 +{
57242 +#ifdef CONFIG_GRKERNSEC_EXECLOG
57243 + char *grarg = gr_exec_arg_buf;
57244 + unsigned int i, x, execlen = 0;
57245 + char c;
57246 +
57247 + if (!((grsec_enable_execlog && grsec_enable_group &&
57248 + in_group_p(grsec_audit_gid))
57249 + || (grsec_enable_execlog && !grsec_enable_group)))
57250 + return;
57251 +
57252 + mutex_lock(&gr_exec_arg_mutex);
57253 + memset(grarg, 0, sizeof(gr_exec_arg_buf));
57254 +
57255 + if (unlikely(argv == NULL))
57256 + goto log;
57257 +
57258 + for (i = 0; i < bprm->argc && execlen < 128; i++) {
57259 + const char __user *p;
57260 + unsigned int len;
57261 +
57262 + if (copy_from_user(&p, argv + i, sizeof(p)))
57263 + goto log;
57264 + if (!p)
57265 + goto log;
57266 + len = strnlen_user(p, 128 - execlen);
57267 + if (len > 128 - execlen)
57268 + len = 128 - execlen;
57269 + else if (len > 0)
57270 + len--;
57271 + if (copy_from_user(grarg + execlen, p, len))
57272 + goto log;
57273 +
57274 + /* rewrite unprintable characters */
57275 + for (x = 0; x < len; x++) {
57276 + c = *(grarg + execlen + x);
57277 + if (c < 32 || c > 126)
57278 + *(grarg + execlen + x) = ' ';
57279 + }
57280 +
57281 + execlen += len;
57282 + *(grarg + execlen) = ' ';
57283 + *(grarg + execlen + 1) = '\0';
57284 + execlen++;
57285 + }
57286 +
57287 + log:
57288 + gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
57289 + bprm->file->f_path.mnt, grarg);
57290 + mutex_unlock(&gr_exec_arg_mutex);
57291 +#endif
57292 + return;
57293 +}
57294 +
57295 +#ifdef CONFIG_COMPAT
57296 +void
57297 +gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv)
57298 +{
57299 +#ifdef CONFIG_GRKERNSEC_EXECLOG
57300 + char *grarg = gr_exec_arg_buf;
57301 + unsigned int i, x, execlen = 0;
57302 + char c;
57303 +
57304 + if (!((grsec_enable_execlog && grsec_enable_group &&
57305 + in_group_p(grsec_audit_gid))
57306 + || (grsec_enable_execlog && !grsec_enable_group)))
57307 + return;
57308 +
57309 + mutex_lock(&gr_exec_arg_mutex);
57310 + memset(grarg, 0, sizeof(gr_exec_arg_buf));
57311 +
57312 + if (unlikely(argv == NULL))
57313 + goto log;
57314 +
57315 + for (i = 0; i < bprm->argc && execlen < 128; i++) {
57316 + compat_uptr_t p;
57317 + unsigned int len;
57318 +
57319 + if (get_user(p, argv + i))
57320 + goto log;
57321 + len = strnlen_user(compat_ptr(p), 128 - execlen);
57322 + if (len > 128 - execlen)
57323 + len = 128 - execlen;
57324 + else if (len > 0)
57325 + len--;
57326 + else
57327 + goto log;
57328 + if (copy_from_user(grarg + execlen, compat_ptr(p), len))
57329 + goto log;
57330 +
57331 + /* rewrite unprintable characters */
57332 + for (x = 0; x < len; x++) {
57333 + c = *(grarg + execlen + x);
57334 + if (c < 32 || c > 126)
57335 + *(grarg + execlen + x) = ' ';
57336 + }
57337 +
57338 + execlen += len;
57339 + *(grarg + execlen) = ' ';
57340 + *(grarg + execlen + 1) = '\0';
57341 + execlen++;
57342 + }
57343 +
57344 + log:
57345 + gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
57346 + bprm->file->f_path.mnt, grarg);
57347 + mutex_unlock(&gr_exec_arg_mutex);
57348 +#endif
57349 + return;
57350 +}
57351 +#endif
57352 +
57353 +#ifdef CONFIG_GRKERNSEC
57354 +extern int gr_acl_is_capable(const int cap);
57355 +extern int gr_acl_is_capable_nolog(const int cap);
57356 +extern int gr_chroot_is_capable(const int cap);
57357 +extern int gr_chroot_is_capable_nolog(const int cap);
57358 +#endif
57359 +
57360 +const char *captab_log[] = {
57361 + "CAP_CHOWN",
57362 + "CAP_DAC_OVERRIDE",
57363 + "CAP_DAC_READ_SEARCH",
57364 + "CAP_FOWNER",
57365 + "CAP_FSETID",
57366 + "CAP_KILL",
57367 + "CAP_SETGID",
57368 + "CAP_SETUID",
57369 + "CAP_SETPCAP",
57370 + "CAP_LINUX_IMMUTABLE",
57371 + "CAP_NET_BIND_SERVICE",
57372 + "CAP_NET_BROADCAST",
57373 + "CAP_NET_ADMIN",
57374 + "CAP_NET_RAW",
57375 + "CAP_IPC_LOCK",
57376 + "CAP_IPC_OWNER",
57377 + "CAP_SYS_MODULE",
57378 + "CAP_SYS_RAWIO",
57379 + "CAP_SYS_CHROOT",
57380 + "CAP_SYS_PTRACE",
57381 + "CAP_SYS_PACCT",
57382 + "CAP_SYS_ADMIN",
57383 + "CAP_SYS_BOOT",
57384 + "CAP_SYS_NICE",
57385 + "CAP_SYS_RESOURCE",
57386 + "CAP_SYS_TIME",
57387 + "CAP_SYS_TTY_CONFIG",
57388 + "CAP_MKNOD",
57389 + "CAP_LEASE",
57390 + "CAP_AUDIT_WRITE",
57391 + "CAP_AUDIT_CONTROL",
57392 + "CAP_SETFCAP",
57393 + "CAP_MAC_OVERRIDE",
57394 + "CAP_MAC_ADMIN"
57395 +};
57396 +
57397 +int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
57398 +
57399 +int gr_is_capable(const int cap)
57400 +{
57401 +#ifdef CONFIG_GRKERNSEC
57402 + if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap))
57403 + return 1;
57404 + return 0;
57405 +#else
57406 + return 1;
57407 +#endif
57408 +}
57409 +
57410 +int gr_is_capable_nolog(const int cap)
57411 +{
57412 +#ifdef CONFIG_GRKERNSEC
57413 + if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap))
57414 + return 1;
57415 + return 0;
57416 +#else
57417 + return 1;
57418 +#endif
57419 +}
57420 +
57421 +EXPORT_SYMBOL(gr_is_capable);
57422 +EXPORT_SYMBOL(gr_is_capable_nolog);
57423 diff -urNp linux-2.6.32.46/grsecurity/grsec_fifo.c linux-2.6.32.46/grsecurity/grsec_fifo.c
57424 --- linux-2.6.32.46/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500
57425 +++ linux-2.6.32.46/grsecurity/grsec_fifo.c 2011-04-17 15:56:46.000000000 -0400
57426 @@ -0,0 +1,24 @@
57427 +#include <linux/kernel.h>
57428 +#include <linux/sched.h>
57429 +#include <linux/fs.h>
57430 +#include <linux/file.h>
57431 +#include <linux/grinternal.h>
57432 +
57433 +int
57434 +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
57435 + const struct dentry *dir, const int flag, const int acc_mode)
57436 +{
57437 +#ifdef CONFIG_GRKERNSEC_FIFO
57438 + const struct cred *cred = current_cred();
57439 +
57440 + if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
57441 + !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
57442 + (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
57443 + (cred->fsuid != dentry->d_inode->i_uid)) {
57444 + if (!inode_permission(dentry->d_inode, acc_mode))
57445 + gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
57446 + return -EACCES;
57447 + }
57448 +#endif
57449 + return 0;
57450 +}
57451 diff -urNp linux-2.6.32.46/grsecurity/grsec_fork.c linux-2.6.32.46/grsecurity/grsec_fork.c
57452 --- linux-2.6.32.46/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500
57453 +++ linux-2.6.32.46/grsecurity/grsec_fork.c 2011-04-17 15:56:46.000000000 -0400
57454 @@ -0,0 +1,23 @@
57455 +#include <linux/kernel.h>
57456 +#include <linux/sched.h>
57457 +#include <linux/grsecurity.h>
57458 +#include <linux/grinternal.h>
57459 +#include <linux/errno.h>
57460 +
57461 +void
57462 +gr_log_forkfail(const int retval)
57463 +{
57464 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
57465 + if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
57466 + switch (retval) {
57467 + case -EAGAIN:
57468 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
57469 + break;
57470 + case -ENOMEM:
57471 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
57472 + break;
57473 + }
57474 + }
57475 +#endif
57476 + return;
57477 +}
57478 diff -urNp linux-2.6.32.46/grsecurity/grsec_init.c linux-2.6.32.46/grsecurity/grsec_init.c
57479 --- linux-2.6.32.46/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500
57480 +++ linux-2.6.32.46/grsecurity/grsec_init.c 2011-08-11 19:57:42.000000000 -0400
57481 @@ -0,0 +1,270 @@
57482 +#include <linux/kernel.h>
57483 +#include <linux/sched.h>
57484 +#include <linux/mm.h>
57485 +#include <linux/smp_lock.h>
57486 +#include <linux/gracl.h>
57487 +#include <linux/slab.h>
57488 +#include <linux/vmalloc.h>
57489 +#include <linux/percpu.h>
57490 +#include <linux/module.h>
57491 +
57492 +int grsec_enable_brute;
57493 +int grsec_enable_link;
57494 +int grsec_enable_dmesg;
57495 +int grsec_enable_harden_ptrace;
57496 +int grsec_enable_fifo;
57497 +int grsec_enable_execlog;
57498 +int grsec_enable_signal;
57499 +int grsec_enable_forkfail;
57500 +int grsec_enable_audit_ptrace;
57501 +int grsec_enable_time;
57502 +int grsec_enable_audit_textrel;
57503 +int grsec_enable_group;
57504 +int grsec_audit_gid;
57505 +int grsec_enable_chdir;
57506 +int grsec_enable_mount;
57507 +int grsec_enable_rofs;
57508 +int grsec_enable_chroot_findtask;
57509 +int grsec_enable_chroot_mount;
57510 +int grsec_enable_chroot_shmat;
57511 +int grsec_enable_chroot_fchdir;
57512 +int grsec_enable_chroot_double;
57513 +int grsec_enable_chroot_pivot;
57514 +int grsec_enable_chroot_chdir;
57515 +int grsec_enable_chroot_chmod;
57516 +int grsec_enable_chroot_mknod;
57517 +int grsec_enable_chroot_nice;
57518 +int grsec_enable_chroot_execlog;
57519 +int grsec_enable_chroot_caps;
57520 +int grsec_enable_chroot_sysctl;
57521 +int grsec_enable_chroot_unix;
57522 +int grsec_enable_tpe;
57523 +int grsec_tpe_gid;
57524 +int grsec_enable_blackhole;
57525 +#ifdef CONFIG_IPV6_MODULE
57526 +EXPORT_SYMBOL(grsec_enable_blackhole);
57527 +#endif
57528 +int grsec_lastack_retries;
57529 +int grsec_enable_tpe_all;
57530 +int grsec_enable_tpe_invert;
57531 +int grsec_enable_socket_all;
57532 +int grsec_socket_all_gid;
57533 +int grsec_enable_socket_client;
57534 +int grsec_socket_client_gid;
57535 +int grsec_enable_socket_server;
57536 +int grsec_socket_server_gid;
57537 +int grsec_resource_logging;
57538 +int grsec_disable_privio;
57539 +int grsec_enable_log_rwxmaps;
57540 +int grsec_lock;
57541 +
57542 +DEFINE_SPINLOCK(grsec_alert_lock);
57543 +unsigned long grsec_alert_wtime = 0;
57544 +unsigned long grsec_alert_fyet = 0;
57545 +
57546 +DEFINE_SPINLOCK(grsec_audit_lock);
57547 +
57548 +DEFINE_RWLOCK(grsec_exec_file_lock);
57549 +
57550 +char *gr_shared_page[4];
57551 +
57552 +char *gr_alert_log_fmt;
57553 +char *gr_audit_log_fmt;
57554 +char *gr_alert_log_buf;
57555 +char *gr_audit_log_buf;
57556 +
57557 +extern struct gr_arg *gr_usermode;
57558 +extern unsigned char *gr_system_salt;
57559 +extern unsigned char *gr_system_sum;
57560 +
57561 +void __init
57562 +grsecurity_init(void)
57563 +{
57564 + int j;
57565 + /* create the per-cpu shared pages */
57566 +
57567 +#ifdef CONFIG_X86
57568 + memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
57569 +#endif
57570 +
57571 + for (j = 0; j < 4; j++) {
57572 + gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
57573 + if (gr_shared_page[j] == NULL) {
57574 + panic("Unable to allocate grsecurity shared page");
57575 + return;
57576 + }
57577 + }
57578 +
57579 + /* allocate log buffers */
57580 + gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
57581 + if (!gr_alert_log_fmt) {
57582 + panic("Unable to allocate grsecurity alert log format buffer");
57583 + return;
57584 + }
57585 + gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
57586 + if (!gr_audit_log_fmt) {
57587 + panic("Unable to allocate grsecurity audit log format buffer");
57588 + return;
57589 + }
57590 + gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
57591 + if (!gr_alert_log_buf) {
57592 + panic("Unable to allocate grsecurity alert log buffer");
57593 + return;
57594 + }
57595 + gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
57596 + if (!gr_audit_log_buf) {
57597 + panic("Unable to allocate grsecurity audit log buffer");
57598 + return;
57599 + }
57600 +
57601 + /* allocate memory for authentication structure */
57602 + gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
57603 + gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
57604 + gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
57605 +
57606 + if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
57607 + panic("Unable to allocate grsecurity authentication structure");
57608 + return;
57609 + }
57610 +
57611 +
57612 +#ifdef CONFIG_GRKERNSEC_IO
57613 +#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
57614 + grsec_disable_privio = 1;
57615 +#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
57616 + grsec_disable_privio = 1;
57617 +#else
57618 + grsec_disable_privio = 0;
57619 +#endif
57620 +#endif
57621 +
57622 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
57623 + /* for backward compatibility, tpe_invert always defaults to on if
57624 + enabled in the kernel
57625 + */
57626 + grsec_enable_tpe_invert = 1;
57627 +#endif
57628 +
57629 +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
57630 +#ifndef CONFIG_GRKERNSEC_SYSCTL
57631 + grsec_lock = 1;
57632 +#endif
57633 +
57634 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
57635 + grsec_enable_audit_textrel = 1;
57636 +#endif
57637 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
57638 + grsec_enable_log_rwxmaps = 1;
57639 +#endif
57640 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
57641 + grsec_enable_group = 1;
57642 + grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
57643 +#endif
57644 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
57645 + grsec_enable_chdir = 1;
57646 +#endif
57647 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
57648 + grsec_enable_harden_ptrace = 1;
57649 +#endif
57650 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
57651 + grsec_enable_mount = 1;
57652 +#endif
57653 +#ifdef CONFIG_GRKERNSEC_LINK
57654 + grsec_enable_link = 1;
57655 +#endif
57656 +#ifdef CONFIG_GRKERNSEC_BRUTE
57657 + grsec_enable_brute = 1;
57658 +#endif
57659 +#ifdef CONFIG_GRKERNSEC_DMESG
57660 + grsec_enable_dmesg = 1;
57661 +#endif
57662 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
57663 + grsec_enable_blackhole = 1;
57664 + grsec_lastack_retries = 4;
57665 +#endif
57666 +#ifdef CONFIG_GRKERNSEC_FIFO
57667 + grsec_enable_fifo = 1;
57668 +#endif
57669 +#ifdef CONFIG_GRKERNSEC_EXECLOG
57670 + grsec_enable_execlog = 1;
57671 +#endif
57672 +#ifdef CONFIG_GRKERNSEC_SIGNAL
57673 + grsec_enable_signal = 1;
57674 +#endif
57675 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
57676 + grsec_enable_forkfail = 1;
57677 +#endif
57678 +#ifdef CONFIG_GRKERNSEC_TIME
57679 + grsec_enable_time = 1;
57680 +#endif
57681 +#ifdef CONFIG_GRKERNSEC_RESLOG
57682 + grsec_resource_logging = 1;
57683 +#endif
57684 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57685 + grsec_enable_chroot_findtask = 1;
57686 +#endif
57687 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
57688 + grsec_enable_chroot_unix = 1;
57689 +#endif
57690 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
57691 + grsec_enable_chroot_mount = 1;
57692 +#endif
57693 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
57694 + grsec_enable_chroot_fchdir = 1;
57695 +#endif
57696 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
57697 + grsec_enable_chroot_shmat = 1;
57698 +#endif
57699 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
57700 + grsec_enable_audit_ptrace = 1;
57701 +#endif
57702 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
57703 + grsec_enable_chroot_double = 1;
57704 +#endif
57705 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
57706 + grsec_enable_chroot_pivot = 1;
57707 +#endif
57708 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
57709 + grsec_enable_chroot_chdir = 1;
57710 +#endif
57711 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
57712 + grsec_enable_chroot_chmod = 1;
57713 +#endif
57714 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
57715 + grsec_enable_chroot_mknod = 1;
57716 +#endif
57717 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57718 + grsec_enable_chroot_nice = 1;
57719 +#endif
57720 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
57721 + grsec_enable_chroot_execlog = 1;
57722 +#endif
57723 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57724 + grsec_enable_chroot_caps = 1;
57725 +#endif
57726 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
57727 + grsec_enable_chroot_sysctl = 1;
57728 +#endif
57729 +#ifdef CONFIG_GRKERNSEC_TPE
57730 + grsec_enable_tpe = 1;
57731 + grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
57732 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
57733 + grsec_enable_tpe_all = 1;
57734 +#endif
57735 +#endif
57736 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
57737 + grsec_enable_socket_all = 1;
57738 + grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
57739 +#endif
57740 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
57741 + grsec_enable_socket_client = 1;
57742 + grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
57743 +#endif
57744 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
57745 + grsec_enable_socket_server = 1;
57746 + grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
57747 +#endif
57748 +#endif
57749 +
57750 + return;
57751 +}
57752 diff -urNp linux-2.6.32.46/grsecurity/grsec_link.c linux-2.6.32.46/grsecurity/grsec_link.c
57753 --- linux-2.6.32.46/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500
57754 +++ linux-2.6.32.46/grsecurity/grsec_link.c 2011-04-17 15:56:46.000000000 -0400
57755 @@ -0,0 +1,43 @@
57756 +#include <linux/kernel.h>
57757 +#include <linux/sched.h>
57758 +#include <linux/fs.h>
57759 +#include <linux/file.h>
57760 +#include <linux/grinternal.h>
57761 +
57762 +int
57763 +gr_handle_follow_link(const struct inode *parent,
57764 + const struct inode *inode,
57765 + const struct dentry *dentry, const struct vfsmount *mnt)
57766 +{
57767 +#ifdef CONFIG_GRKERNSEC_LINK
57768 + const struct cred *cred = current_cred();
57769 +
57770 + if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
57771 + (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
57772 + (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
57773 + gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
57774 + return -EACCES;
57775 + }
57776 +#endif
57777 + return 0;
57778 +}
57779 +
57780 +int
57781 +gr_handle_hardlink(const struct dentry *dentry,
57782 + const struct vfsmount *mnt,
57783 + struct inode *inode, const int mode, const char *to)
57784 +{
57785 +#ifdef CONFIG_GRKERNSEC_LINK
57786 + const struct cred *cred = current_cred();
57787 +
57788 + if (grsec_enable_link && cred->fsuid != inode->i_uid &&
57789 + (!S_ISREG(mode) || (mode & S_ISUID) ||
57790 + ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
57791 + (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
57792 + !capable(CAP_FOWNER) && cred->uid) {
57793 + gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
57794 + return -EPERM;
57795 + }
57796 +#endif
57797 + return 0;
57798 +}
57799 diff -urNp linux-2.6.32.46/grsecurity/grsec_log.c linux-2.6.32.46/grsecurity/grsec_log.c
57800 --- linux-2.6.32.46/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
57801 +++ linux-2.6.32.46/grsecurity/grsec_log.c 2011-09-26 10:44:49.000000000 -0400
57802 @@ -0,0 +1,315 @@
57803 +#include <linux/kernel.h>
57804 +#include <linux/sched.h>
57805 +#include <linux/file.h>
57806 +#include <linux/tty.h>
57807 +#include <linux/fs.h>
57808 +#include <linux/grinternal.h>
57809 +
57810 +#ifdef CONFIG_TREE_PREEMPT_RCU
57811 +#define DISABLE_PREEMPT() preempt_disable()
57812 +#define ENABLE_PREEMPT() preempt_enable()
57813 +#else
57814 +#define DISABLE_PREEMPT()
57815 +#define ENABLE_PREEMPT()
57816 +#endif
57817 +
57818 +#define BEGIN_LOCKS(x) \
57819 + DISABLE_PREEMPT(); \
57820 + rcu_read_lock(); \
57821 + read_lock(&tasklist_lock); \
57822 + read_lock(&grsec_exec_file_lock); \
57823 + if (x != GR_DO_AUDIT) \
57824 + spin_lock(&grsec_alert_lock); \
57825 + else \
57826 + spin_lock(&grsec_audit_lock)
57827 +
57828 +#define END_LOCKS(x) \
57829 + if (x != GR_DO_AUDIT) \
57830 + spin_unlock(&grsec_alert_lock); \
57831 + else \
57832 + spin_unlock(&grsec_audit_lock); \
57833 + read_unlock(&grsec_exec_file_lock); \
57834 + read_unlock(&tasklist_lock); \
57835 + rcu_read_unlock(); \
57836 + ENABLE_PREEMPT(); \
57837 + if (x == GR_DONT_AUDIT) \
57838 + gr_handle_alertkill(current)
57839 +
57840 +enum {
57841 + FLOODING,
57842 + NO_FLOODING
57843 +};
57844 +
57845 +extern char *gr_alert_log_fmt;
57846 +extern char *gr_audit_log_fmt;
57847 +extern char *gr_alert_log_buf;
57848 +extern char *gr_audit_log_buf;
57849 +
57850 +static int gr_log_start(int audit)
57851 +{
57852 + char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
57853 + char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
57854 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
57855 +#if (CONFIG_GRKERNSEC_FLOODTIME > 0 && CONFIG_GRKERNSEC_FLOODBURST > 0)
57856 + unsigned long curr_secs = get_seconds();
57857 +
57858 + if (audit == GR_DO_AUDIT)
57859 + goto set_fmt;
57860 +
57861 + if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
57862 + grsec_alert_wtime = curr_secs;
57863 + grsec_alert_fyet = 0;
57864 + } else if (time_before_eq(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)
57865 + && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
57866 + grsec_alert_fyet++;
57867 + } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
57868 + grsec_alert_wtime = curr_secs;
57869 + grsec_alert_fyet++;
57870 + printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
57871 + return FLOODING;
57872 + }
57873 + else return FLOODING;
57874 +
57875 +set_fmt:
57876 +#endif
57877 + memset(buf, 0, PAGE_SIZE);
57878 + if (current->signal->curr_ip && gr_acl_is_enabled()) {
57879 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
57880 + snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
57881 + } else if (current->signal->curr_ip) {
57882 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
57883 + snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
57884 + } else if (gr_acl_is_enabled()) {
57885 + sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
57886 + snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
57887 + } else {
57888 + sprintf(fmt, "%s%s", loglevel, "grsec: ");
57889 + strcpy(buf, fmt);
57890 + }
57891 +
57892 + return NO_FLOODING;
57893 +}
57894 +
57895 +static void gr_log_middle(int audit, const char *msg, va_list ap)
57896 + __attribute__ ((format (printf, 2, 0)));
57897 +
57898 +static void gr_log_middle(int audit, const char *msg, va_list ap)
57899 +{
57900 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
57901 + unsigned int len = strlen(buf);
57902 +
57903 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
57904 +
57905 + return;
57906 +}
57907 +
57908 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
57909 + __attribute__ ((format (printf, 2, 3)));
57910 +
57911 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
57912 +{
57913 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
57914 + unsigned int len = strlen(buf);
57915 + va_list ap;
57916 +
57917 + va_start(ap, msg);
57918 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
57919 + va_end(ap);
57920 +
57921 + return;
57922 +}
57923 +
57924 +static void gr_log_end(int audit)
57925 +{
57926 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
57927 + unsigned int len = strlen(buf);
57928 +
57929 + snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
57930 + printk("%s\n", buf);
57931 +
57932 + return;
57933 +}
57934 +
57935 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
57936 +{
57937 + int logtype;
57938 + char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
57939 + char *str1 = NULL, *str2 = NULL, *str3 = NULL;
57940 + void *voidptr = NULL;
57941 + int num1 = 0, num2 = 0;
57942 + unsigned long ulong1 = 0, ulong2 = 0;
57943 + struct dentry *dentry = NULL;
57944 + struct vfsmount *mnt = NULL;
57945 + struct file *file = NULL;
57946 + struct task_struct *task = NULL;
57947 + const struct cred *cred, *pcred;
57948 + va_list ap;
57949 +
57950 + BEGIN_LOCKS(audit);
57951 + logtype = gr_log_start(audit);
57952 + if (logtype == FLOODING) {
57953 + END_LOCKS(audit);
57954 + return;
57955 + }
57956 + va_start(ap, argtypes);
57957 + switch (argtypes) {
57958 + case GR_TTYSNIFF:
57959 + task = va_arg(ap, struct task_struct *);
57960 + gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
57961 + break;
57962 + case GR_SYSCTL_HIDDEN:
57963 + str1 = va_arg(ap, char *);
57964 + gr_log_middle_varargs(audit, msg, result, str1);
57965 + break;
57966 + case GR_RBAC:
57967 + dentry = va_arg(ap, struct dentry *);
57968 + mnt = va_arg(ap, struct vfsmount *);
57969 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
57970 + break;
57971 + case GR_RBAC_STR:
57972 + dentry = va_arg(ap, struct dentry *);
57973 + mnt = va_arg(ap, struct vfsmount *);
57974 + str1 = va_arg(ap, char *);
57975 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
57976 + break;
57977 + case GR_STR_RBAC:
57978 + str1 = va_arg(ap, char *);
57979 + dentry = va_arg(ap, struct dentry *);
57980 + mnt = va_arg(ap, struct vfsmount *);
57981 + gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
57982 + break;
57983 + case GR_RBAC_MODE2:
57984 + dentry = va_arg(ap, struct dentry *);
57985 + mnt = va_arg(ap, struct vfsmount *);
57986 + str1 = va_arg(ap, char *);
57987 + str2 = va_arg(ap, char *);
57988 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
57989 + break;
57990 + case GR_RBAC_MODE3:
57991 + dentry = va_arg(ap, struct dentry *);
57992 + mnt = va_arg(ap, struct vfsmount *);
57993 + str1 = va_arg(ap, char *);
57994 + str2 = va_arg(ap, char *);
57995 + str3 = va_arg(ap, char *);
57996 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
57997 + break;
57998 + case GR_FILENAME:
57999 + dentry = va_arg(ap, struct dentry *);
58000 + mnt = va_arg(ap, struct vfsmount *);
58001 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
58002 + break;
58003 + case GR_STR_FILENAME:
58004 + str1 = va_arg(ap, char *);
58005 + dentry = va_arg(ap, struct dentry *);
58006 + mnt = va_arg(ap, struct vfsmount *);
58007 + gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
58008 + break;
58009 + case GR_FILENAME_STR:
58010 + dentry = va_arg(ap, struct dentry *);
58011 + mnt = va_arg(ap, struct vfsmount *);
58012 + str1 = va_arg(ap, char *);
58013 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
58014 + break;
58015 + case GR_FILENAME_TWO_INT:
58016 + dentry = va_arg(ap, struct dentry *);
58017 + mnt = va_arg(ap, struct vfsmount *);
58018 + num1 = va_arg(ap, int);
58019 + num2 = va_arg(ap, int);
58020 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
58021 + break;
58022 + case GR_FILENAME_TWO_INT_STR:
58023 + dentry = va_arg(ap, struct dentry *);
58024 + mnt = va_arg(ap, struct vfsmount *);
58025 + num1 = va_arg(ap, int);
58026 + num2 = va_arg(ap, int);
58027 + str1 = va_arg(ap, char *);
58028 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
58029 + break;
58030 + case GR_TEXTREL:
58031 + file = va_arg(ap, struct file *);
58032 + ulong1 = va_arg(ap, unsigned long);
58033 + ulong2 = va_arg(ap, unsigned long);
58034 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
58035 + break;
58036 + case GR_PTRACE:
58037 + task = va_arg(ap, struct task_struct *);
58038 + gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
58039 + break;
58040 + case GR_RESOURCE:
58041 + task = va_arg(ap, struct task_struct *);
58042 + cred = __task_cred(task);
58043 + pcred = __task_cred(task->real_parent);
58044 + ulong1 = va_arg(ap, unsigned long);
58045 + str1 = va_arg(ap, char *);
58046 + ulong2 = va_arg(ap, unsigned long);
58047 + gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58048 + break;
58049 + case GR_CAP:
58050 + task = va_arg(ap, struct task_struct *);
58051 + cred = __task_cred(task);
58052 + pcred = __task_cred(task->real_parent);
58053 + str1 = va_arg(ap, char *);
58054 + gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58055 + break;
58056 + case GR_SIG:
58057 + str1 = va_arg(ap, char *);
58058 + voidptr = va_arg(ap, void *);
58059 + gr_log_middle_varargs(audit, msg, str1, voidptr);
58060 + break;
58061 + case GR_SIG2:
58062 + task = va_arg(ap, struct task_struct *);
58063 + cred = __task_cred(task);
58064 + pcred = __task_cred(task->real_parent);
58065 + num1 = va_arg(ap, int);
58066 + gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58067 + break;
58068 + case GR_CRASH1:
58069 + task = va_arg(ap, struct task_struct *);
58070 + cred = __task_cred(task);
58071 + pcred = __task_cred(task->real_parent);
58072 + ulong1 = va_arg(ap, unsigned long);
58073 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
58074 + break;
58075 + case GR_CRASH2:
58076 + task = va_arg(ap, struct task_struct *);
58077 + cred = __task_cred(task);
58078 + pcred = __task_cred(task->real_parent);
58079 + ulong1 = va_arg(ap, unsigned long);
58080 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
58081 + break;
58082 + case GR_RWXMAP:
58083 + file = va_arg(ap, struct file *);
58084 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
58085 + break;
58086 + case GR_PSACCT:
58087 + {
58088 + unsigned int wday, cday;
58089 + __u8 whr, chr;
58090 + __u8 wmin, cmin;
58091 + __u8 wsec, csec;
58092 + char cur_tty[64] = { 0 };
58093 + char parent_tty[64] = { 0 };
58094 +
58095 + task = va_arg(ap, struct task_struct *);
58096 + wday = va_arg(ap, unsigned int);
58097 + cday = va_arg(ap, unsigned int);
58098 + whr = va_arg(ap, int);
58099 + chr = va_arg(ap, int);
58100 + wmin = va_arg(ap, int);
58101 + cmin = va_arg(ap, int);
58102 + wsec = va_arg(ap, int);
58103 + csec = va_arg(ap, int);
58104 + ulong1 = va_arg(ap, unsigned long);
58105 + cred = __task_cred(task);
58106 + pcred = __task_cred(task->real_parent);
58107 +
58108 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58109 + }
58110 + break;
58111 + default:
58112 + gr_log_middle(audit, msg, ap);
58113 + }
58114 + va_end(ap);
58115 + gr_log_end(audit);
58116 + END_LOCKS(audit);
58117 +}
58118 diff -urNp linux-2.6.32.46/grsecurity/grsec_mem.c linux-2.6.32.46/grsecurity/grsec_mem.c
58119 --- linux-2.6.32.46/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
58120 +++ linux-2.6.32.46/grsecurity/grsec_mem.c 2011-04-17 15:56:46.000000000 -0400
58121 @@ -0,0 +1,33 @@
58122 +#include <linux/kernel.h>
58123 +#include <linux/sched.h>
58124 +#include <linux/mm.h>
58125 +#include <linux/mman.h>
58126 +#include <linux/grinternal.h>
58127 +
58128 +void
58129 +gr_handle_ioperm(void)
58130 +{
58131 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
58132 + return;
58133 +}
58134 +
58135 +void
58136 +gr_handle_iopl(void)
58137 +{
58138 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
58139 + return;
58140 +}
58141 +
58142 +void
58143 +gr_handle_mem_readwrite(u64 from, u64 to)
58144 +{
58145 + gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
58146 + return;
58147 +}
58148 +
58149 +void
58150 +gr_handle_vm86(void)
58151 +{
58152 + gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
58153 + return;
58154 +}
58155 diff -urNp linux-2.6.32.46/grsecurity/grsec_mount.c linux-2.6.32.46/grsecurity/grsec_mount.c
58156 --- linux-2.6.32.46/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500
58157 +++ linux-2.6.32.46/grsecurity/grsec_mount.c 2011-06-20 19:47:03.000000000 -0400
58158 @@ -0,0 +1,62 @@
58159 +#include <linux/kernel.h>
58160 +#include <linux/sched.h>
58161 +#include <linux/mount.h>
58162 +#include <linux/grsecurity.h>
58163 +#include <linux/grinternal.h>
58164 +
58165 +void
58166 +gr_log_remount(const char *devname, const int retval)
58167 +{
58168 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58169 + if (grsec_enable_mount && (retval >= 0))
58170 + gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
58171 +#endif
58172 + return;
58173 +}
58174 +
58175 +void
58176 +gr_log_unmount(const char *devname, const int retval)
58177 +{
58178 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58179 + if (grsec_enable_mount && (retval >= 0))
58180 + gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
58181 +#endif
58182 + return;
58183 +}
58184 +
58185 +void
58186 +gr_log_mount(const char *from, const char *to, const int retval)
58187 +{
58188 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58189 + if (grsec_enable_mount && (retval >= 0))
58190 + gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
58191 +#endif
58192 + return;
58193 +}
58194 +
58195 +int
58196 +gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
58197 +{
58198 +#ifdef CONFIG_GRKERNSEC_ROFS
58199 + if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
58200 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
58201 + return -EPERM;
58202 + } else
58203 + return 0;
58204 +#endif
58205 + return 0;
58206 +}
58207 +
58208 +int
58209 +gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
58210 +{
58211 +#ifdef CONFIG_GRKERNSEC_ROFS
58212 + if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
58213 + dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
58214 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
58215 + return -EPERM;
58216 + } else
58217 + return 0;
58218 +#endif
58219 + return 0;
58220 +}
58221 diff -urNp linux-2.6.32.46/grsecurity/grsec_pax.c linux-2.6.32.46/grsecurity/grsec_pax.c
58222 --- linux-2.6.32.46/grsecurity/grsec_pax.c 1969-12-31 19:00:00.000000000 -0500
58223 +++ linux-2.6.32.46/grsecurity/grsec_pax.c 2011-04-17 15:56:46.000000000 -0400
58224 @@ -0,0 +1,36 @@
58225 +#include <linux/kernel.h>
58226 +#include <linux/sched.h>
58227 +#include <linux/mm.h>
58228 +#include <linux/file.h>
58229 +#include <linux/grinternal.h>
58230 +#include <linux/grsecurity.h>
58231 +
58232 +void
58233 +gr_log_textrel(struct vm_area_struct * vma)
58234 +{
58235 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58236 + if (grsec_enable_audit_textrel)
58237 + gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
58238 +#endif
58239 + return;
58240 +}
58241 +
58242 +void
58243 +gr_log_rwxmmap(struct file *file)
58244 +{
58245 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58246 + if (grsec_enable_log_rwxmaps)
58247 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
58248 +#endif
58249 + return;
58250 +}
58251 +
58252 +void
58253 +gr_log_rwxmprotect(struct file *file)
58254 +{
58255 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58256 + if (grsec_enable_log_rwxmaps)
58257 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
58258 +#endif
58259 + return;
58260 +}
58261 diff -urNp linux-2.6.32.46/grsecurity/grsec_ptrace.c linux-2.6.32.46/grsecurity/grsec_ptrace.c
58262 --- linux-2.6.32.46/grsecurity/grsec_ptrace.c 1969-12-31 19:00:00.000000000 -0500
58263 +++ linux-2.6.32.46/grsecurity/grsec_ptrace.c 2011-04-17 15:56:46.000000000 -0400
58264 @@ -0,0 +1,14 @@
58265 +#include <linux/kernel.h>
58266 +#include <linux/sched.h>
58267 +#include <linux/grinternal.h>
58268 +#include <linux/grsecurity.h>
58269 +
58270 +void
58271 +gr_audit_ptrace(struct task_struct *task)
58272 +{
58273 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58274 + if (grsec_enable_audit_ptrace)
58275 + gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
58276 +#endif
58277 + return;
58278 +}
58279 diff -urNp linux-2.6.32.46/grsecurity/grsec_sig.c linux-2.6.32.46/grsecurity/grsec_sig.c
58280 --- linux-2.6.32.46/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
58281 +++ linux-2.6.32.46/grsecurity/grsec_sig.c 2011-06-29 19:40:31.000000000 -0400
58282 @@ -0,0 +1,205 @@
58283 +#include <linux/kernel.h>
58284 +#include <linux/sched.h>
58285 +#include <linux/delay.h>
58286 +#include <linux/grsecurity.h>
58287 +#include <linux/grinternal.h>
58288 +#include <linux/hardirq.h>
58289 +
58290 +char *signames[] = {
58291 + [SIGSEGV] = "Segmentation fault",
58292 + [SIGILL] = "Illegal instruction",
58293 + [SIGABRT] = "Abort",
58294 + [SIGBUS] = "Invalid alignment/Bus error"
58295 +};
58296 +
58297 +void
58298 +gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
58299 +{
58300 +#ifdef CONFIG_GRKERNSEC_SIGNAL
58301 + if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
58302 + (sig == SIGABRT) || (sig == SIGBUS))) {
58303 + if (t->pid == current->pid) {
58304 + gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
58305 + } else {
58306 + gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
58307 + }
58308 + }
58309 +#endif
58310 + return;
58311 +}
58312 +
58313 +int
58314 +gr_handle_signal(const struct task_struct *p, const int sig)
58315 +{
58316 +#ifdef CONFIG_GRKERNSEC
58317 + if (current->pid > 1 && gr_check_protected_task(p)) {
58318 + gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
58319 + return -EPERM;
58320 + } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
58321 + return -EPERM;
58322 + }
58323 +#endif
58324 + return 0;
58325 +}
58326 +
58327 +#ifdef CONFIG_GRKERNSEC
58328 +extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
58329 +
58330 +int gr_fake_force_sig(int sig, struct task_struct *t)
58331 +{
58332 + unsigned long int flags;
58333 + int ret, blocked, ignored;
58334 + struct k_sigaction *action;
58335 +
58336 + spin_lock_irqsave(&t->sighand->siglock, flags);
58337 + action = &t->sighand->action[sig-1];
58338 + ignored = action->sa.sa_handler == SIG_IGN;
58339 + blocked = sigismember(&t->blocked, sig);
58340 + if (blocked || ignored) {
58341 + action->sa.sa_handler = SIG_DFL;
58342 + if (blocked) {
58343 + sigdelset(&t->blocked, sig);
58344 + recalc_sigpending_and_wake(t);
58345 + }
58346 + }
58347 + if (action->sa.sa_handler == SIG_DFL)
58348 + t->signal->flags &= ~SIGNAL_UNKILLABLE;
58349 + ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
58350 +
58351 + spin_unlock_irqrestore(&t->sighand->siglock, flags);
58352 +
58353 + return ret;
58354 +}
58355 +#endif
58356 +
58357 +#ifdef CONFIG_GRKERNSEC_BRUTE
58358 +#define GR_USER_BAN_TIME (15 * 60)
58359 +
58360 +static int __get_dumpable(unsigned long mm_flags)
58361 +{
58362 + int ret;
58363 +
58364 + ret = mm_flags & MMF_DUMPABLE_MASK;
58365 + return (ret >= 2) ? 2 : ret;
58366 +}
58367 +#endif
58368 +
58369 +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
58370 +{
58371 +#ifdef CONFIG_GRKERNSEC_BRUTE
58372 + uid_t uid = 0;
58373 +
58374 + if (!grsec_enable_brute)
58375 + return;
58376 +
58377 + rcu_read_lock();
58378 + read_lock(&tasklist_lock);
58379 + read_lock(&grsec_exec_file_lock);
58380 + if (p->real_parent && p->real_parent->exec_file == p->exec_file)
58381 + p->real_parent->brute = 1;
58382 + else {
58383 + const struct cred *cred = __task_cred(p), *cred2;
58384 + struct task_struct *tsk, *tsk2;
58385 +
58386 + if (!__get_dumpable(mm_flags) && cred->uid) {
58387 + struct user_struct *user;
58388 +
58389 + uid = cred->uid;
58390 +
58391 + /* this is put upon execution past expiration */
58392 + user = find_user(uid);
58393 + if (user == NULL)
58394 + goto unlock;
58395 + user->banned = 1;
58396 + user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
58397 + if (user->ban_expires == ~0UL)
58398 + user->ban_expires--;
58399 +
58400 + do_each_thread(tsk2, tsk) {
58401 + cred2 = __task_cred(tsk);
58402 + if (tsk != p && cred2->uid == uid)
58403 + gr_fake_force_sig(SIGKILL, tsk);
58404 + } while_each_thread(tsk2, tsk);
58405 + }
58406 + }
58407 +unlock:
58408 + read_unlock(&grsec_exec_file_lock);
58409 + read_unlock(&tasklist_lock);
58410 + rcu_read_unlock();
58411 +
58412 + if (uid)
58413 + printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
58414 +#endif
58415 + return;
58416 +}
58417 +
58418 +void gr_handle_brute_check(void)
58419 +{
58420 +#ifdef CONFIG_GRKERNSEC_BRUTE
58421 + if (current->brute)
58422 + msleep(30 * 1000);
58423 +#endif
58424 + return;
58425 +}
58426 +
58427 +void gr_handle_kernel_exploit(void)
58428 +{
58429 +#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
58430 + const struct cred *cred;
58431 + struct task_struct *tsk, *tsk2;
58432 + struct user_struct *user;
58433 + uid_t uid;
58434 +
58435 + if (in_irq() || in_serving_softirq() || in_nmi())
58436 + panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
58437 +
58438 + uid = current_uid();
58439 +
58440 + if (uid == 0)
58441 + panic("grsec: halting the system due to suspicious kernel crash caused by root");
58442 + else {
58443 + /* kill all the processes of this user, hold a reference
58444 + to their creds struct, and prevent them from creating
58445 + another process until system reset
58446 + */
58447 + printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
58448 + /* we intentionally leak this ref */
58449 + user = get_uid(current->cred->user);
58450 + if (user) {
58451 + user->banned = 1;
58452 + user->ban_expires = ~0UL;
58453 + }
58454 +
58455 + read_lock(&tasklist_lock);
58456 + do_each_thread(tsk2, tsk) {
58457 + cred = __task_cred(tsk);
58458 + if (cred->uid == uid)
58459 + gr_fake_force_sig(SIGKILL, tsk);
58460 + } while_each_thread(tsk2, tsk);
58461 + read_unlock(&tasklist_lock);
58462 + }
58463 +#endif
58464 +}
58465 +
58466 +int __gr_process_user_ban(struct user_struct *user)
58467 +{
58468 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
58469 + if (unlikely(user->banned)) {
58470 + if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
58471 + user->banned = 0;
58472 + user->ban_expires = 0;
58473 + free_uid(user);
58474 + } else
58475 + return -EPERM;
58476 + }
58477 +#endif
58478 + return 0;
58479 +}
58480 +
58481 +int gr_process_user_ban(void)
58482 +{
58483 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
58484 + return __gr_process_user_ban(current->cred->user);
58485 +#endif
58486 + return 0;
58487 +}
58488 diff -urNp linux-2.6.32.46/grsecurity/grsec_sock.c linux-2.6.32.46/grsecurity/grsec_sock.c
58489 --- linux-2.6.32.46/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500
58490 +++ linux-2.6.32.46/grsecurity/grsec_sock.c 2011-04-17 15:56:46.000000000 -0400
58491 @@ -0,0 +1,275 @@
58492 +#include <linux/kernel.h>
58493 +#include <linux/module.h>
58494 +#include <linux/sched.h>
58495 +#include <linux/file.h>
58496 +#include <linux/net.h>
58497 +#include <linux/in.h>
58498 +#include <linux/ip.h>
58499 +#include <net/sock.h>
58500 +#include <net/inet_sock.h>
58501 +#include <linux/grsecurity.h>
58502 +#include <linux/grinternal.h>
58503 +#include <linux/gracl.h>
58504 +
58505 +kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
58506 +EXPORT_SYMBOL(gr_cap_rtnetlink);
58507 +
58508 +extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
58509 +extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
58510 +
58511 +EXPORT_SYMBOL(gr_search_udp_recvmsg);
58512 +EXPORT_SYMBOL(gr_search_udp_sendmsg);
58513 +
58514 +#ifdef CONFIG_UNIX_MODULE
58515 +EXPORT_SYMBOL(gr_acl_handle_unix);
58516 +EXPORT_SYMBOL(gr_acl_handle_mknod);
58517 +EXPORT_SYMBOL(gr_handle_chroot_unix);
58518 +EXPORT_SYMBOL(gr_handle_create);
58519 +#endif
58520 +
58521 +#ifdef CONFIG_GRKERNSEC
58522 +#define gr_conn_table_size 32749
58523 +struct conn_table_entry {
58524 + struct conn_table_entry *next;
58525 + struct signal_struct *sig;
58526 +};
58527 +
58528 +struct conn_table_entry *gr_conn_table[gr_conn_table_size];
58529 +DEFINE_SPINLOCK(gr_conn_table_lock);
58530 +
58531 +extern const char * gr_socktype_to_name(unsigned char type);
58532 +extern const char * gr_proto_to_name(unsigned char proto);
58533 +extern const char * gr_sockfamily_to_name(unsigned char family);
58534 +
58535 +static __inline__ int
58536 +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
58537 +{
58538 + return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
58539 +}
58540 +
58541 +static __inline__ int
58542 +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
58543 + __u16 sport, __u16 dport)
58544 +{
58545 + if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
58546 + sig->gr_sport == sport && sig->gr_dport == dport))
58547 + return 1;
58548 + else
58549 + return 0;
58550 +}
58551 +
58552 +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
58553 +{
58554 + struct conn_table_entry **match;
58555 + unsigned int index;
58556 +
58557 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
58558 + sig->gr_sport, sig->gr_dport,
58559 + gr_conn_table_size);
58560 +
58561 + newent->sig = sig;
58562 +
58563 + match = &gr_conn_table[index];
58564 + newent->next = *match;
58565 + *match = newent;
58566 +
58567 + return;
58568 +}
58569 +
58570 +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
58571 +{
58572 + struct conn_table_entry *match, *last = NULL;
58573 + unsigned int index;
58574 +
58575 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
58576 + sig->gr_sport, sig->gr_dport,
58577 + gr_conn_table_size);
58578 +
58579 + match = gr_conn_table[index];
58580 + while (match && !conn_match(match->sig,
58581 + sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
58582 + sig->gr_dport)) {
58583 + last = match;
58584 + match = match->next;
58585 + }
58586 +
58587 + if (match) {
58588 + if (last)
58589 + last->next = match->next;
58590 + else
58591 + gr_conn_table[index] = NULL;
58592 + kfree(match);
58593 + }
58594 +
58595 + return;
58596 +}
58597 +
58598 +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
58599 + __u16 sport, __u16 dport)
58600 +{
58601 + struct conn_table_entry *match;
58602 + unsigned int index;
58603 +
58604 + index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
58605 +
58606 + match = gr_conn_table[index];
58607 + while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
58608 + match = match->next;
58609 +
58610 + if (match)
58611 + return match->sig;
58612 + else
58613 + return NULL;
58614 +}
58615 +
58616 +#endif
58617 +
58618 +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
58619 +{
58620 +#ifdef CONFIG_GRKERNSEC
58621 + struct signal_struct *sig = task->signal;
58622 + struct conn_table_entry *newent;
58623 +
58624 + newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
58625 + if (newent == NULL)
58626 + return;
58627 + /* no bh lock needed since we are called with bh disabled */
58628 + spin_lock(&gr_conn_table_lock);
58629 + gr_del_task_from_ip_table_nolock(sig);
58630 + sig->gr_saddr = inet->rcv_saddr;
58631 + sig->gr_daddr = inet->daddr;
58632 + sig->gr_sport = inet->sport;
58633 + sig->gr_dport = inet->dport;
58634 + gr_add_to_task_ip_table_nolock(sig, newent);
58635 + spin_unlock(&gr_conn_table_lock);
58636 +#endif
58637 + return;
58638 +}
58639 +
58640 +void gr_del_task_from_ip_table(struct task_struct *task)
58641 +{
58642 +#ifdef CONFIG_GRKERNSEC
58643 + spin_lock_bh(&gr_conn_table_lock);
58644 + gr_del_task_from_ip_table_nolock(task->signal);
58645 + spin_unlock_bh(&gr_conn_table_lock);
58646 +#endif
58647 + return;
58648 +}
58649 +
58650 +void
58651 +gr_attach_curr_ip(const struct sock *sk)
58652 +{
58653 +#ifdef CONFIG_GRKERNSEC
58654 + struct signal_struct *p, *set;
58655 + const struct inet_sock *inet = inet_sk(sk);
58656 +
58657 + if (unlikely(sk->sk_protocol != IPPROTO_TCP))
58658 + return;
58659 +
58660 + set = current->signal;
58661 +
58662 + spin_lock_bh(&gr_conn_table_lock);
58663 + p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
58664 + inet->dport, inet->sport);
58665 + if (unlikely(p != NULL)) {
58666 + set->curr_ip = p->curr_ip;
58667 + set->used_accept = 1;
58668 + gr_del_task_from_ip_table_nolock(p);
58669 + spin_unlock_bh(&gr_conn_table_lock);
58670 + return;
58671 + }
58672 + spin_unlock_bh(&gr_conn_table_lock);
58673 +
58674 + set->curr_ip = inet->daddr;
58675 + set->used_accept = 1;
58676 +#endif
58677 + return;
58678 +}
58679 +
58680 +int
58681 +gr_handle_sock_all(const int family, const int type, const int protocol)
58682 +{
58683 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
58684 + if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
58685 + (family != AF_UNIX)) {
58686 + if (family == AF_INET)
58687 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
58688 + else
58689 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
58690 + return -EACCES;
58691 + }
58692 +#endif
58693 + return 0;
58694 +}
58695 +
58696 +int
58697 +gr_handle_sock_server(const struct sockaddr *sck)
58698 +{
58699 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58700 + if (grsec_enable_socket_server &&
58701 + in_group_p(grsec_socket_server_gid) &&
58702 + sck && (sck->sa_family != AF_UNIX) &&
58703 + (sck->sa_family != AF_LOCAL)) {
58704 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
58705 + return -EACCES;
58706 + }
58707 +#endif
58708 + return 0;
58709 +}
58710 +
58711 +int
58712 +gr_handle_sock_server_other(const struct sock *sck)
58713 +{
58714 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58715 + if (grsec_enable_socket_server &&
58716 + in_group_p(grsec_socket_server_gid) &&
58717 + sck && (sck->sk_family != AF_UNIX) &&
58718 + (sck->sk_family != AF_LOCAL)) {
58719 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
58720 + return -EACCES;
58721 + }
58722 +#endif
58723 + return 0;
58724 +}
58725 +
58726 +int
58727 +gr_handle_sock_client(const struct sockaddr *sck)
58728 +{
58729 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
58730 + if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
58731 + sck && (sck->sa_family != AF_UNIX) &&
58732 + (sck->sa_family != AF_LOCAL)) {
58733 + gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
58734 + return -EACCES;
58735 + }
58736 +#endif
58737 + return 0;
58738 +}
58739 +
58740 +kernel_cap_t
58741 +gr_cap_rtnetlink(struct sock *sock)
58742 +{
58743 +#ifdef CONFIG_GRKERNSEC
58744 + if (!gr_acl_is_enabled())
58745 + return current_cap();
58746 + else if (sock->sk_protocol == NETLINK_ISCSI &&
58747 + cap_raised(current_cap(), CAP_SYS_ADMIN) &&
58748 + gr_is_capable(CAP_SYS_ADMIN))
58749 + return current_cap();
58750 + else if (sock->sk_protocol == NETLINK_AUDIT &&
58751 + cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
58752 + gr_is_capable(CAP_AUDIT_WRITE) &&
58753 + cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
58754 + gr_is_capable(CAP_AUDIT_CONTROL))
58755 + return current_cap();
58756 + else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
58757 + ((sock->sk_protocol == NETLINK_ROUTE) ?
58758 + gr_is_capable_nolog(CAP_NET_ADMIN) :
58759 + gr_is_capable(CAP_NET_ADMIN)))
58760 + return current_cap();
58761 + else
58762 + return __cap_empty_set;
58763 +#else
58764 + return current_cap();
58765 +#endif
58766 +}
58767 diff -urNp linux-2.6.32.46/grsecurity/grsec_sysctl.c linux-2.6.32.46/grsecurity/grsec_sysctl.c
58768 --- linux-2.6.32.46/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500
58769 +++ linux-2.6.32.46/grsecurity/grsec_sysctl.c 2011-08-11 19:57:54.000000000 -0400
58770 @@ -0,0 +1,479 @@
58771 +#include <linux/kernel.h>
58772 +#include <linux/sched.h>
58773 +#include <linux/sysctl.h>
58774 +#include <linux/grsecurity.h>
58775 +#include <linux/grinternal.h>
58776 +
58777 +int
58778 +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
58779 +{
58780 +#ifdef CONFIG_GRKERNSEC_SYSCTL
58781 + if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
58782 + gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
58783 + return -EACCES;
58784 + }
58785 +#endif
58786 + return 0;
58787 +}
58788 +
58789 +#ifdef CONFIG_GRKERNSEC_ROFS
58790 +static int __maybe_unused one = 1;
58791 +#endif
58792 +
58793 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
58794 +ctl_table grsecurity_table[] = {
58795 +#ifdef CONFIG_GRKERNSEC_SYSCTL
58796 +#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
58797 +#ifdef CONFIG_GRKERNSEC_IO
58798 + {
58799 + .ctl_name = CTL_UNNUMBERED,
58800 + .procname = "disable_priv_io",
58801 + .data = &grsec_disable_privio,
58802 + .maxlen = sizeof(int),
58803 + .mode = 0600,
58804 + .proc_handler = &proc_dointvec,
58805 + },
58806 +#endif
58807 +#endif
58808 +#ifdef CONFIG_GRKERNSEC_LINK
58809 + {
58810 + .ctl_name = CTL_UNNUMBERED,
58811 + .procname = "linking_restrictions",
58812 + .data = &grsec_enable_link,
58813 + .maxlen = sizeof(int),
58814 + .mode = 0600,
58815 + .proc_handler = &proc_dointvec,
58816 + },
58817 +#endif
58818 +#ifdef CONFIG_GRKERNSEC_BRUTE
58819 + {
58820 + .ctl_name = CTL_UNNUMBERED,
58821 + .procname = "deter_bruteforce",
58822 + .data = &grsec_enable_brute,
58823 + .maxlen = sizeof(int),
58824 + .mode = 0600,
58825 + .proc_handler = &proc_dointvec,
58826 + },
58827 +#endif
58828 +#ifdef CONFIG_GRKERNSEC_FIFO
58829 + {
58830 + .ctl_name = CTL_UNNUMBERED,
58831 + .procname = "fifo_restrictions",
58832 + .data = &grsec_enable_fifo,
58833 + .maxlen = sizeof(int),
58834 + .mode = 0600,
58835 + .proc_handler = &proc_dointvec,
58836 + },
58837 +#endif
58838 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
58839 + {
58840 + .ctl_name = CTL_UNNUMBERED,
58841 + .procname = "ip_blackhole",
58842 + .data = &grsec_enable_blackhole,
58843 + .maxlen = sizeof(int),
58844 + .mode = 0600,
58845 + .proc_handler = &proc_dointvec,
58846 + },
58847 + {
58848 + .ctl_name = CTL_UNNUMBERED,
58849 + .procname = "lastack_retries",
58850 + .data = &grsec_lastack_retries,
58851 + .maxlen = sizeof(int),
58852 + .mode = 0600,
58853 + .proc_handler = &proc_dointvec,
58854 + },
58855 +#endif
58856 +#ifdef CONFIG_GRKERNSEC_EXECLOG
58857 + {
58858 + .ctl_name = CTL_UNNUMBERED,
58859 + .procname = "exec_logging",
58860 + .data = &grsec_enable_execlog,
58861 + .maxlen = sizeof(int),
58862 + .mode = 0600,
58863 + .proc_handler = &proc_dointvec,
58864 + },
58865 +#endif
58866 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58867 + {
58868 + .ctl_name = CTL_UNNUMBERED,
58869 + .procname = "rwxmap_logging",
58870 + .data = &grsec_enable_log_rwxmaps,
58871 + .maxlen = sizeof(int),
58872 + .mode = 0600,
58873 + .proc_handler = &proc_dointvec,
58874 + },
58875 +#endif
58876 +#ifdef CONFIG_GRKERNSEC_SIGNAL
58877 + {
58878 + .ctl_name = CTL_UNNUMBERED,
58879 + .procname = "signal_logging",
58880 + .data = &grsec_enable_signal,
58881 + .maxlen = sizeof(int),
58882 + .mode = 0600,
58883 + .proc_handler = &proc_dointvec,
58884 + },
58885 +#endif
58886 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
58887 + {
58888 + .ctl_name = CTL_UNNUMBERED,
58889 + .procname = "forkfail_logging",
58890 + .data = &grsec_enable_forkfail,
58891 + .maxlen = sizeof(int),
58892 + .mode = 0600,
58893 + .proc_handler = &proc_dointvec,
58894 + },
58895 +#endif
58896 +#ifdef CONFIG_GRKERNSEC_TIME
58897 + {
58898 + .ctl_name = CTL_UNNUMBERED,
58899 + .procname = "timechange_logging",
58900 + .data = &grsec_enable_time,
58901 + .maxlen = sizeof(int),
58902 + .mode = 0600,
58903 + .proc_handler = &proc_dointvec,
58904 + },
58905 +#endif
58906 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
58907 + {
58908 + .ctl_name = CTL_UNNUMBERED,
58909 + .procname = "chroot_deny_shmat",
58910 + .data = &grsec_enable_chroot_shmat,
58911 + .maxlen = sizeof(int),
58912 + .mode = 0600,
58913 + .proc_handler = &proc_dointvec,
58914 + },
58915 +#endif
58916 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
58917 + {
58918 + .ctl_name = CTL_UNNUMBERED,
58919 + .procname = "chroot_deny_unix",
58920 + .data = &grsec_enable_chroot_unix,
58921 + .maxlen = sizeof(int),
58922 + .mode = 0600,
58923 + .proc_handler = &proc_dointvec,
58924 + },
58925 +#endif
58926 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
58927 + {
58928 + .ctl_name = CTL_UNNUMBERED,
58929 + .procname = "chroot_deny_mount",
58930 + .data = &grsec_enable_chroot_mount,
58931 + .maxlen = sizeof(int),
58932 + .mode = 0600,
58933 + .proc_handler = &proc_dointvec,
58934 + },
58935 +#endif
58936 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
58937 + {
58938 + .ctl_name = CTL_UNNUMBERED,
58939 + .procname = "chroot_deny_fchdir",
58940 + .data = &grsec_enable_chroot_fchdir,
58941 + .maxlen = sizeof(int),
58942 + .mode = 0600,
58943 + .proc_handler = &proc_dointvec,
58944 + },
58945 +#endif
58946 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
58947 + {
58948 + .ctl_name = CTL_UNNUMBERED,
58949 + .procname = "chroot_deny_chroot",
58950 + .data = &grsec_enable_chroot_double,
58951 + .maxlen = sizeof(int),
58952 + .mode = 0600,
58953 + .proc_handler = &proc_dointvec,
58954 + },
58955 +#endif
58956 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
58957 + {
58958 + .ctl_name = CTL_UNNUMBERED,
58959 + .procname = "chroot_deny_pivot",
58960 + .data = &grsec_enable_chroot_pivot,
58961 + .maxlen = sizeof(int),
58962 + .mode = 0600,
58963 + .proc_handler = &proc_dointvec,
58964 + },
58965 +#endif
58966 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
58967 + {
58968 + .ctl_name = CTL_UNNUMBERED,
58969 + .procname = "chroot_enforce_chdir",
58970 + .data = &grsec_enable_chroot_chdir,
58971 + .maxlen = sizeof(int),
58972 + .mode = 0600,
58973 + .proc_handler = &proc_dointvec,
58974 + },
58975 +#endif
58976 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
58977 + {
58978 + .ctl_name = CTL_UNNUMBERED,
58979 + .procname = "chroot_deny_chmod",
58980 + .data = &grsec_enable_chroot_chmod,
58981 + .maxlen = sizeof(int),
58982 + .mode = 0600,
58983 + .proc_handler = &proc_dointvec,
58984 + },
58985 +#endif
58986 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
58987 + {
58988 + .ctl_name = CTL_UNNUMBERED,
58989 + .procname = "chroot_deny_mknod",
58990 + .data = &grsec_enable_chroot_mknod,
58991 + .maxlen = sizeof(int),
58992 + .mode = 0600,
58993 + .proc_handler = &proc_dointvec,
58994 + },
58995 +#endif
58996 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
58997 + {
58998 + .ctl_name = CTL_UNNUMBERED,
58999 + .procname = "chroot_restrict_nice",
59000 + .data = &grsec_enable_chroot_nice,
59001 + .maxlen = sizeof(int),
59002 + .mode = 0600,
59003 + .proc_handler = &proc_dointvec,
59004 + },
59005 +#endif
59006 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
59007 + {
59008 + .ctl_name = CTL_UNNUMBERED,
59009 + .procname = "chroot_execlog",
59010 + .data = &grsec_enable_chroot_execlog,
59011 + .maxlen = sizeof(int),
59012 + .mode = 0600,
59013 + .proc_handler = &proc_dointvec,
59014 + },
59015 +#endif
59016 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
59017 + {
59018 + .ctl_name = CTL_UNNUMBERED,
59019 + .procname = "chroot_caps",
59020 + .data = &grsec_enable_chroot_caps,
59021 + .maxlen = sizeof(int),
59022 + .mode = 0600,
59023 + .proc_handler = &proc_dointvec,
59024 + },
59025 +#endif
59026 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
59027 + {
59028 + .ctl_name = CTL_UNNUMBERED,
59029 + .procname = "chroot_deny_sysctl",
59030 + .data = &grsec_enable_chroot_sysctl,
59031 + .maxlen = sizeof(int),
59032 + .mode = 0600,
59033 + .proc_handler = &proc_dointvec,
59034 + },
59035 +#endif
59036 +#ifdef CONFIG_GRKERNSEC_TPE
59037 + {
59038 + .ctl_name = CTL_UNNUMBERED,
59039 + .procname = "tpe",
59040 + .data = &grsec_enable_tpe,
59041 + .maxlen = sizeof(int),
59042 + .mode = 0600,
59043 + .proc_handler = &proc_dointvec,
59044 + },
59045 + {
59046 + .ctl_name = CTL_UNNUMBERED,
59047 + .procname = "tpe_gid",
59048 + .data = &grsec_tpe_gid,
59049 + .maxlen = sizeof(int),
59050 + .mode = 0600,
59051 + .proc_handler = &proc_dointvec,
59052 + },
59053 +#endif
59054 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59055 + {
59056 + .ctl_name = CTL_UNNUMBERED,
59057 + .procname = "tpe_invert",
59058 + .data = &grsec_enable_tpe_invert,
59059 + .maxlen = sizeof(int),
59060 + .mode = 0600,
59061 + .proc_handler = &proc_dointvec,
59062 + },
59063 +#endif
59064 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
59065 + {
59066 + .ctl_name = CTL_UNNUMBERED,
59067 + .procname = "tpe_restrict_all",
59068 + .data = &grsec_enable_tpe_all,
59069 + .maxlen = sizeof(int),
59070 + .mode = 0600,
59071 + .proc_handler = &proc_dointvec,
59072 + },
59073 +#endif
59074 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59075 + {
59076 + .ctl_name = CTL_UNNUMBERED,
59077 + .procname = "socket_all",
59078 + .data = &grsec_enable_socket_all,
59079 + .maxlen = sizeof(int),
59080 + .mode = 0600,
59081 + .proc_handler = &proc_dointvec,
59082 + },
59083 + {
59084 + .ctl_name = CTL_UNNUMBERED,
59085 + .procname = "socket_all_gid",
59086 + .data = &grsec_socket_all_gid,
59087 + .maxlen = sizeof(int),
59088 + .mode = 0600,
59089 + .proc_handler = &proc_dointvec,
59090 + },
59091 +#endif
59092 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59093 + {
59094 + .ctl_name = CTL_UNNUMBERED,
59095 + .procname = "socket_client",
59096 + .data = &grsec_enable_socket_client,
59097 + .maxlen = sizeof(int),
59098 + .mode = 0600,
59099 + .proc_handler = &proc_dointvec,
59100 + },
59101 + {
59102 + .ctl_name = CTL_UNNUMBERED,
59103 + .procname = "socket_client_gid",
59104 + .data = &grsec_socket_client_gid,
59105 + .maxlen = sizeof(int),
59106 + .mode = 0600,
59107 + .proc_handler = &proc_dointvec,
59108 + },
59109 +#endif
59110 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59111 + {
59112 + .ctl_name = CTL_UNNUMBERED,
59113 + .procname = "socket_server",
59114 + .data = &grsec_enable_socket_server,
59115 + .maxlen = sizeof(int),
59116 + .mode = 0600,
59117 + .proc_handler = &proc_dointvec,
59118 + },
59119 + {
59120 + .ctl_name = CTL_UNNUMBERED,
59121 + .procname = "socket_server_gid",
59122 + .data = &grsec_socket_server_gid,
59123 + .maxlen = sizeof(int),
59124 + .mode = 0600,
59125 + .proc_handler = &proc_dointvec,
59126 + },
59127 +#endif
59128 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
59129 + {
59130 + .ctl_name = CTL_UNNUMBERED,
59131 + .procname = "audit_group",
59132 + .data = &grsec_enable_group,
59133 + .maxlen = sizeof(int),
59134 + .mode = 0600,
59135 + .proc_handler = &proc_dointvec,
59136 + },
59137 + {
59138 + .ctl_name = CTL_UNNUMBERED,
59139 + .procname = "audit_gid",
59140 + .data = &grsec_audit_gid,
59141 + .maxlen = sizeof(int),
59142 + .mode = 0600,
59143 + .proc_handler = &proc_dointvec,
59144 + },
59145 +#endif
59146 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
59147 + {
59148 + .ctl_name = CTL_UNNUMBERED,
59149 + .procname = "audit_chdir",
59150 + .data = &grsec_enable_chdir,
59151 + .maxlen = sizeof(int),
59152 + .mode = 0600,
59153 + .proc_handler = &proc_dointvec,
59154 + },
59155 +#endif
59156 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59157 + {
59158 + .ctl_name = CTL_UNNUMBERED,
59159 + .procname = "audit_mount",
59160 + .data = &grsec_enable_mount,
59161 + .maxlen = sizeof(int),
59162 + .mode = 0600,
59163 + .proc_handler = &proc_dointvec,
59164 + },
59165 +#endif
59166 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59167 + {
59168 + .ctl_name = CTL_UNNUMBERED,
59169 + .procname = "audit_textrel",
59170 + .data = &grsec_enable_audit_textrel,
59171 + .maxlen = sizeof(int),
59172 + .mode = 0600,
59173 + .proc_handler = &proc_dointvec,
59174 + },
59175 +#endif
59176 +#ifdef CONFIG_GRKERNSEC_DMESG
59177 + {
59178 + .ctl_name = CTL_UNNUMBERED,
59179 + .procname = "dmesg",
59180 + .data = &grsec_enable_dmesg,
59181 + .maxlen = sizeof(int),
59182 + .mode = 0600,
59183 + .proc_handler = &proc_dointvec,
59184 + },
59185 +#endif
59186 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
59187 + {
59188 + .ctl_name = CTL_UNNUMBERED,
59189 + .procname = "chroot_findtask",
59190 + .data = &grsec_enable_chroot_findtask,
59191 + .maxlen = sizeof(int),
59192 + .mode = 0600,
59193 + .proc_handler = &proc_dointvec,
59194 + },
59195 +#endif
59196 +#ifdef CONFIG_GRKERNSEC_RESLOG
59197 + {
59198 + .ctl_name = CTL_UNNUMBERED,
59199 + .procname = "resource_logging",
59200 + .data = &grsec_resource_logging,
59201 + .maxlen = sizeof(int),
59202 + .mode = 0600,
59203 + .proc_handler = &proc_dointvec,
59204 + },
59205 +#endif
59206 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
59207 + {
59208 + .ctl_name = CTL_UNNUMBERED,
59209 + .procname = "audit_ptrace",
59210 + .data = &grsec_enable_audit_ptrace,
59211 + .maxlen = sizeof(int),
59212 + .mode = 0600,
59213 + .proc_handler = &proc_dointvec,
59214 + },
59215 +#endif
59216 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
59217 + {
59218 + .ctl_name = CTL_UNNUMBERED,
59219 + .procname = "harden_ptrace",
59220 + .data = &grsec_enable_harden_ptrace,
59221 + .maxlen = sizeof(int),
59222 + .mode = 0600,
59223 + .proc_handler = &proc_dointvec,
59224 + },
59225 +#endif
59226 + {
59227 + .ctl_name = CTL_UNNUMBERED,
59228 + .procname = "grsec_lock",
59229 + .data = &grsec_lock,
59230 + .maxlen = sizeof(int),
59231 + .mode = 0600,
59232 + .proc_handler = &proc_dointvec,
59233 + },
59234 +#endif
59235 +#ifdef CONFIG_GRKERNSEC_ROFS
59236 + {
59237 + .ctl_name = CTL_UNNUMBERED,
59238 + .procname = "romount_protect",
59239 + .data = &grsec_enable_rofs,
59240 + .maxlen = sizeof(int),
59241 + .mode = 0600,
59242 + .proc_handler = &proc_dointvec_minmax,
59243 + .extra1 = &one,
59244 + .extra2 = &one,
59245 + },
59246 +#endif
59247 + { .ctl_name = 0 }
59248 +};
59249 +#endif
59250 diff -urNp linux-2.6.32.46/grsecurity/grsec_time.c linux-2.6.32.46/grsecurity/grsec_time.c
59251 --- linux-2.6.32.46/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500
59252 +++ linux-2.6.32.46/grsecurity/grsec_time.c 2011-04-17 15:56:46.000000000 -0400
59253 @@ -0,0 +1,16 @@
59254 +#include <linux/kernel.h>
59255 +#include <linux/sched.h>
59256 +#include <linux/grinternal.h>
59257 +#include <linux/module.h>
59258 +
59259 +void
59260 +gr_log_timechange(void)
59261 +{
59262 +#ifdef CONFIG_GRKERNSEC_TIME
59263 + if (grsec_enable_time)
59264 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
59265 +#endif
59266 + return;
59267 +}
59268 +
59269 +EXPORT_SYMBOL(gr_log_timechange);
59270 diff -urNp linux-2.6.32.46/grsecurity/grsec_tpe.c linux-2.6.32.46/grsecurity/grsec_tpe.c
59271 --- linux-2.6.32.46/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
59272 +++ linux-2.6.32.46/grsecurity/grsec_tpe.c 2011-04-17 15:56:46.000000000 -0400
59273 @@ -0,0 +1,39 @@
59274 +#include <linux/kernel.h>
59275 +#include <linux/sched.h>
59276 +#include <linux/file.h>
59277 +#include <linux/fs.h>
59278 +#include <linux/grinternal.h>
59279 +
59280 +extern int gr_acl_tpe_check(void);
59281 +
59282 +int
59283 +gr_tpe_allow(const struct file *file)
59284 +{
59285 +#ifdef CONFIG_GRKERNSEC
59286 + struct inode *inode = file->f_path.dentry->d_parent->d_inode;
59287 + const struct cred *cred = current_cred();
59288 +
59289 + if (cred->uid && ((grsec_enable_tpe &&
59290 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59291 + ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
59292 + (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
59293 +#else
59294 + in_group_p(grsec_tpe_gid)
59295 +#endif
59296 + ) || gr_acl_tpe_check()) &&
59297 + (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
59298 + (inode->i_mode & S_IWOTH))))) {
59299 + gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59300 + return 0;
59301 + }
59302 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
59303 + if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
59304 + ((inode->i_uid && (inode->i_uid != cred->uid)) ||
59305 + (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
59306 + gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59307 + return 0;
59308 + }
59309 +#endif
59310 +#endif
59311 + return 1;
59312 +}
59313 diff -urNp linux-2.6.32.46/grsecurity/grsum.c linux-2.6.32.46/grsecurity/grsum.c
59314 --- linux-2.6.32.46/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500
59315 +++ linux-2.6.32.46/grsecurity/grsum.c 2011-04-17 15:56:46.000000000 -0400
59316 @@ -0,0 +1,61 @@
59317 +#include <linux/err.h>
59318 +#include <linux/kernel.h>
59319 +#include <linux/sched.h>
59320 +#include <linux/mm.h>
59321 +#include <linux/scatterlist.h>
59322 +#include <linux/crypto.h>
59323 +#include <linux/gracl.h>
59324 +
59325 +
59326 +#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
59327 +#error "crypto and sha256 must be built into the kernel"
59328 +#endif
59329 +
59330 +int
59331 +chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
59332 +{
59333 + char *p;
59334 + struct crypto_hash *tfm;
59335 + struct hash_desc desc;
59336 + struct scatterlist sg;
59337 + unsigned char temp_sum[GR_SHA_LEN];
59338 + volatile int retval = 0;
59339 + volatile int dummy = 0;
59340 + unsigned int i;
59341 +
59342 + sg_init_table(&sg, 1);
59343 +
59344 + tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
59345 + if (IS_ERR(tfm)) {
59346 + /* should never happen, since sha256 should be built in */
59347 + return 1;
59348 + }
59349 +
59350 + desc.tfm = tfm;
59351 + desc.flags = 0;
59352 +
59353 + crypto_hash_init(&desc);
59354 +
59355 + p = salt;
59356 + sg_set_buf(&sg, p, GR_SALT_LEN);
59357 + crypto_hash_update(&desc, &sg, sg.length);
59358 +
59359 + p = entry->pw;
59360 + sg_set_buf(&sg, p, strlen(p));
59361 +
59362 + crypto_hash_update(&desc, &sg, sg.length);
59363 +
59364 + crypto_hash_final(&desc, temp_sum);
59365 +
59366 + memset(entry->pw, 0, GR_PW_LEN);
59367 +
59368 + for (i = 0; i < GR_SHA_LEN; i++)
59369 + if (sum[i] != temp_sum[i])
59370 + retval = 1;
59371 + else
59372 + dummy = 1; // waste a cycle
59373 +
59374 + crypto_free_hash(tfm);
59375 +
59376 + return retval;
59377 +}
59378 diff -urNp linux-2.6.32.46/grsecurity/Kconfig linux-2.6.32.46/grsecurity/Kconfig
59379 --- linux-2.6.32.46/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500
59380 +++ linux-2.6.32.46/grsecurity/Kconfig 2011-09-15 00:00:38.000000000 -0400
59381 @@ -0,0 +1,1037 @@
59382 +#
59383 +# grecurity configuration
59384 +#
59385 +
59386 +menu "Grsecurity"
59387 +
59388 +config GRKERNSEC
59389 + bool "Grsecurity"
59390 + select CRYPTO
59391 + select CRYPTO_SHA256
59392 + help
59393 + If you say Y here, you will be able to configure many features
59394 + that will enhance the security of your system. It is highly
59395 + recommended that you say Y here and read through the help
59396 + for each option so that you fully understand the features and
59397 + can evaluate their usefulness for your machine.
59398 +
59399 +choice
59400 + prompt "Security Level"
59401 + depends on GRKERNSEC
59402 + default GRKERNSEC_CUSTOM
59403 +
59404 +config GRKERNSEC_LOW
59405 + bool "Low"
59406 + select GRKERNSEC_LINK
59407 + select GRKERNSEC_FIFO
59408 + select GRKERNSEC_RANDNET
59409 + select GRKERNSEC_DMESG
59410 + select GRKERNSEC_CHROOT
59411 + select GRKERNSEC_CHROOT_CHDIR
59412 +
59413 + help
59414 + If you choose this option, several of the grsecurity options will
59415 + be enabled that will give you greater protection against a number
59416 + of attacks, while assuring that none of your software will have any
59417 + conflicts with the additional security measures. If you run a lot
59418 + of unusual software, or you are having problems with the higher
59419 + security levels, you should say Y here. With this option, the
59420 + following features are enabled:
59421 +
59422 + - Linking restrictions
59423 + - FIFO restrictions
59424 + - Restricted dmesg
59425 + - Enforced chdir("/") on chroot
59426 + - Runtime module disabling
59427 +
59428 +config GRKERNSEC_MEDIUM
59429 + bool "Medium"
59430 + select PAX
59431 + select PAX_EI_PAX
59432 + select PAX_PT_PAX_FLAGS
59433 + select PAX_HAVE_ACL_FLAGS
59434 + select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
59435 + select GRKERNSEC_CHROOT
59436 + select GRKERNSEC_CHROOT_SYSCTL
59437 + select GRKERNSEC_LINK
59438 + select GRKERNSEC_FIFO
59439 + select GRKERNSEC_DMESG
59440 + select GRKERNSEC_RANDNET
59441 + select GRKERNSEC_FORKFAIL
59442 + select GRKERNSEC_TIME
59443 + select GRKERNSEC_SIGNAL
59444 + select GRKERNSEC_CHROOT
59445 + select GRKERNSEC_CHROOT_UNIX
59446 + select GRKERNSEC_CHROOT_MOUNT
59447 + select GRKERNSEC_CHROOT_PIVOT
59448 + select GRKERNSEC_CHROOT_DOUBLE
59449 + select GRKERNSEC_CHROOT_CHDIR
59450 + select GRKERNSEC_CHROOT_MKNOD
59451 + select GRKERNSEC_PROC
59452 + select GRKERNSEC_PROC_USERGROUP
59453 + select PAX_RANDUSTACK
59454 + select PAX_ASLR
59455 + select PAX_RANDMMAP
59456 + select PAX_REFCOUNT if (X86 || SPARC64)
59457 + select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
59458 +
59459 + help
59460 + If you say Y here, several features in addition to those included
59461 + in the low additional security level will be enabled. These
59462 + features provide even more security to your system, though in rare
59463 + cases they may be incompatible with very old or poorly written
59464 + software. If you enable this option, make sure that your auth
59465 + service (identd) is running as gid 1001. With this option,
59466 + the following features (in addition to those provided in the
59467 + low additional security level) will be enabled:
59468 +
59469 + - Failed fork logging
59470 + - Time change logging
59471 + - Signal logging
59472 + - Deny mounts in chroot
59473 + - Deny double chrooting
59474 + - Deny sysctl writes in chroot
59475 + - Deny mknod in chroot
59476 + - Deny access to abstract AF_UNIX sockets out of chroot
59477 + - Deny pivot_root in chroot
59478 + - Denied writes of /dev/kmem, /dev/mem, and /dev/port
59479 + - /proc restrictions with special GID set to 10 (usually wheel)
59480 + - Address Space Layout Randomization (ASLR)
59481 + - Prevent exploitation of most refcount overflows
59482 + - Bounds checking of copying between the kernel and userland
59483 +
59484 +config GRKERNSEC_HIGH
59485 + bool "High"
59486 + select GRKERNSEC_LINK
59487 + select GRKERNSEC_FIFO
59488 + select GRKERNSEC_DMESG
59489 + select GRKERNSEC_FORKFAIL
59490 + select GRKERNSEC_TIME
59491 + select GRKERNSEC_SIGNAL
59492 + select GRKERNSEC_CHROOT
59493 + select GRKERNSEC_CHROOT_SHMAT
59494 + select GRKERNSEC_CHROOT_UNIX
59495 + select GRKERNSEC_CHROOT_MOUNT
59496 + select GRKERNSEC_CHROOT_FCHDIR
59497 + select GRKERNSEC_CHROOT_PIVOT
59498 + select GRKERNSEC_CHROOT_DOUBLE
59499 + select GRKERNSEC_CHROOT_CHDIR
59500 + select GRKERNSEC_CHROOT_MKNOD
59501 + select GRKERNSEC_CHROOT_CAPS
59502 + select GRKERNSEC_CHROOT_SYSCTL
59503 + select GRKERNSEC_CHROOT_FINDTASK
59504 + select GRKERNSEC_SYSFS_RESTRICT
59505 + select GRKERNSEC_PROC
59506 + select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
59507 + select GRKERNSEC_HIDESYM
59508 + select GRKERNSEC_BRUTE
59509 + select GRKERNSEC_PROC_USERGROUP
59510 + select GRKERNSEC_KMEM
59511 + select GRKERNSEC_RESLOG
59512 + select GRKERNSEC_RANDNET
59513 + select GRKERNSEC_PROC_ADD
59514 + select GRKERNSEC_CHROOT_CHMOD
59515 + select GRKERNSEC_CHROOT_NICE
59516 + select GRKERNSEC_AUDIT_MOUNT
59517 + select GRKERNSEC_MODHARDEN if (MODULES)
59518 + select GRKERNSEC_HARDEN_PTRACE
59519 + select GRKERNSEC_VM86 if (X86_32)
59520 + select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC)
59521 + select PAX
59522 + select PAX_RANDUSTACK
59523 + select PAX_ASLR
59524 + select PAX_RANDMMAP
59525 + select PAX_NOEXEC
59526 + select PAX_MPROTECT
59527 + select PAX_EI_PAX
59528 + select PAX_PT_PAX_FLAGS
59529 + select PAX_HAVE_ACL_FLAGS
59530 + select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
59531 + select PAX_MEMORY_UDEREF if (X86 && !XEN)
59532 + select PAX_RANDKSTACK if (X86_TSC && X86)
59533 + select PAX_SEGMEXEC if (X86_32)
59534 + select PAX_PAGEEXEC
59535 + select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
59536 + select PAX_EMUTRAMP if (PARISC)
59537 + select PAX_EMUSIGRT if (PARISC)
59538 + select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
59539 + select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
59540 + select PAX_REFCOUNT if (X86 || SPARC64)
59541 + select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
59542 + help
59543 + If you say Y here, many of the features of grsecurity will be
59544 + enabled, which will protect you against many kinds of attacks
59545 + against your system. The heightened security comes at a cost
59546 + of an increased chance of incompatibilities with rare software
59547 + on your machine. Since this security level enables PaX, you should
59548 + view <http://pax.grsecurity.net> and read about the PaX
59549 + project. While you are there, download chpax and run it on
59550 + binaries that cause problems with PaX. Also remember that
59551 + since the /proc restrictions are enabled, you must run your
59552 + identd as gid 1001. This security level enables the following
59553 + features in addition to those listed in the low and medium
59554 + security levels:
59555 +
59556 + - Additional /proc restrictions
59557 + - Chmod restrictions in chroot
59558 + - No signals, ptrace, or viewing of processes outside of chroot
59559 + - Capability restrictions in chroot
59560 + - Deny fchdir out of chroot
59561 + - Priority restrictions in chroot
59562 + - Segmentation-based implementation of PaX
59563 + - Mprotect restrictions
59564 + - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
59565 + - Kernel stack randomization
59566 + - Mount/unmount/remount logging
59567 + - Kernel symbol hiding
59568 + - Prevention of memory exhaustion-based exploits
59569 + - Hardening of module auto-loading
59570 + - Ptrace restrictions
59571 + - Restricted vm86 mode
59572 + - Restricted sysfs/debugfs
59573 + - Active kernel exploit response
59574 +
59575 +config GRKERNSEC_CUSTOM
59576 + bool "Custom"
59577 + help
59578 + If you say Y here, you will be able to configure every grsecurity
59579 + option, which allows you to enable many more features that aren't
59580 + covered in the basic security levels. These additional features
59581 + include TPE, socket restrictions, and the sysctl system for
59582 + grsecurity. It is advised that you read through the help for
59583 + each option to determine its usefulness in your situation.
59584 +
59585 +endchoice
59586 +
59587 +menu "Address Space Protection"
59588 +depends on GRKERNSEC
59589 +
59590 +config GRKERNSEC_KMEM
59591 + bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
59592 + select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
59593 + help
59594 + If you say Y here, /dev/kmem and /dev/mem won't be allowed to
59595 + be written to via mmap or otherwise to modify the running kernel.
59596 + /dev/port will also not be allowed to be opened. If you have module
59597 + support disabled, enabling this will close up four ways that are
59598 + currently used to insert malicious code into the running kernel.
59599 + Even with all these features enabled, we still highly recommend that
59600 + you use the RBAC system, as it is still possible for an attacker to
59601 + modify the running kernel through privileged I/O granted by ioperm/iopl.
59602 + If you are not using XFree86, you may be able to stop this additional
59603 + case by enabling the 'Disable privileged I/O' option. Though nothing
59604 + legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
59605 + but only to video memory, which is the only writing we allow in this
59606 + case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
59607 + not be allowed to mprotect it with PROT_WRITE later.
59608 + It is highly recommended that you say Y here if you meet all the
59609 + conditions above.
59610 +
59611 +config GRKERNSEC_VM86
59612 + bool "Restrict VM86 mode"
59613 + depends on X86_32
59614 +
59615 + help
59616 + If you say Y here, only processes with CAP_SYS_RAWIO will be able to
59617 + make use of a special execution mode on 32bit x86 processors called
59618 + Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
59619 + video cards and will still work with this option enabled. The purpose
59620 + of the option is to prevent exploitation of emulation errors in
59621 + virtualization of vm86 mode like the one discovered in VMWare in 2009.
59622 + Nearly all users should be able to enable this option.
59623 +
59624 +config GRKERNSEC_IO
59625 + bool "Disable privileged I/O"
59626 + depends on X86
59627 + select RTC_CLASS
59628 + select RTC_INTF_DEV
59629 + select RTC_DRV_CMOS
59630 +
59631 + help
59632 + If you say Y here, all ioperm and iopl calls will return an error.
59633 + Ioperm and iopl can be used to modify the running kernel.
59634 + Unfortunately, some programs need this access to operate properly,
59635 + the most notable of which are XFree86 and hwclock. hwclock can be
59636 + remedied by having RTC support in the kernel, so real-time
59637 + clock support is enabled if this option is enabled, to ensure
59638 + that hwclock operates correctly. XFree86 still will not
59639 + operate correctly with this option enabled, so DO NOT CHOOSE Y
59640 + IF YOU USE XFree86. If you use XFree86 and you still want to
59641 + protect your kernel against modification, use the RBAC system.
59642 +
59643 +config GRKERNSEC_PROC_MEMMAP
59644 + bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
59645 + default y if (PAX_NOEXEC || PAX_ASLR)
59646 + depends on PAX_NOEXEC || PAX_ASLR
59647 + help
59648 + If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
59649 + give no information about the addresses of its mappings if
59650 + PaX features that rely on random addresses are enabled on the task.
59651 + If you use PaX it is greatly recommended that you say Y here as it
59652 + closes up a hole that makes the full ASLR useless for suid
59653 + binaries.
59654 +
59655 +config GRKERNSEC_BRUTE
59656 + bool "Deter exploit bruteforcing"
59657 + help
59658 + If you say Y here, attempts to bruteforce exploits against forking
59659 + daemons such as apache or sshd, as well as against suid/sgid binaries
59660 + will be deterred. When a child of a forking daemon is killed by PaX
59661 + or crashes due to an illegal instruction or other suspicious signal,
59662 + the parent process will be delayed 30 seconds upon every subsequent
59663 + fork until the administrator is able to assess the situation and
59664 + restart the daemon.
59665 + In the suid/sgid case, the attempt is logged, the user has all their
59666 + processes terminated, and they are prevented from executing any further
59667 + processes for 15 minutes.
59668 + It is recommended that you also enable signal logging in the auditing
59669 + section so that logs are generated when a process triggers a suspicious
59670 + signal.
59671 + If the sysctl option is enabled, a sysctl option with name
59672 + "deter_bruteforce" is created.
59673 +
59674 +config GRKERNSEC_MODHARDEN
59675 + bool "Harden module auto-loading"
59676 + depends on MODULES
59677 + help
59678 + If you say Y here, module auto-loading in response to use of some
59679 + feature implemented by an unloaded module will be restricted to
59680 + root users. Enabling this option helps defend against attacks
59681 + by unprivileged users who abuse the auto-loading behavior to
59682 + cause a vulnerable module to load that is then exploited.
59683 +
59684 + If this option prevents a legitimate use of auto-loading for a
59685 + non-root user, the administrator can execute modprobe manually
59686 + with the exact name of the module mentioned in the alert log.
59687 + Alternatively, the administrator can add the module to the list
59688 + of modules loaded at boot by modifying init scripts.
59689 +
59690 + Modification of init scripts will most likely be needed on
59691 + Ubuntu servers with encrypted home directory support enabled,
59692 + as the first non-root user logging in will cause the ecb(aes),
59693 + ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
59694 +
59695 +config GRKERNSEC_HIDESYM
59696 + bool "Hide kernel symbols"
59697 + help
59698 + If you say Y here, getting information on loaded modules, and
59699 + displaying all kernel symbols through a syscall will be restricted
59700 + to users with CAP_SYS_MODULE. For software compatibility reasons,
59701 + /proc/kallsyms will be restricted to the root user. The RBAC
59702 + system can hide that entry even from root.
59703 +
59704 + This option also prevents leaking of kernel addresses through
59705 + several /proc entries.
59706 +
59707 + Note that this option is only effective provided the following
59708 + conditions are met:
59709 + 1) The kernel using grsecurity is not precompiled by some distribution
59710 + 2) You have also enabled GRKERNSEC_DMESG
59711 + 3) You are using the RBAC system and hiding other files such as your
59712 + kernel image and System.map. Alternatively, enabling this option
59713 + causes the permissions on /boot, /lib/modules, and the kernel
59714 + source directory to change at compile time to prevent
59715 + reading by non-root users.
59716 + If the above conditions are met, this option will aid in providing a
59717 + useful protection against local kernel exploitation of overflows
59718 + and arbitrary read/write vulnerabilities.
59719 +
59720 +config GRKERNSEC_KERN_LOCKOUT
59721 + bool "Active kernel exploit response"
59722 + depends on X86 || ARM || PPC || SPARC
59723 + help
59724 + If you say Y here, when a PaX alert is triggered due to suspicious
59725 + activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
59726 + or an OOPs occurs due to bad memory accesses, instead of just
59727 + terminating the offending process (and potentially allowing
59728 + a subsequent exploit from the same user), we will take one of two
59729 + actions:
59730 + If the user was root, we will panic the system
59731 + If the user was non-root, we will log the attempt, terminate
59732 + all processes owned by the user, then prevent them from creating
59733 + any new processes until the system is restarted
59734 + This deters repeated kernel exploitation/bruteforcing attempts
59735 + and is useful for later forensics.
59736 +
59737 +endmenu
59738 +menu "Role Based Access Control Options"
59739 +depends on GRKERNSEC
59740 +
59741 +config GRKERNSEC_RBAC_DEBUG
59742 + bool
59743 +
59744 +config GRKERNSEC_NO_RBAC
59745 + bool "Disable RBAC system"
59746 + help
59747 + If you say Y here, the /dev/grsec device will be removed from the kernel,
59748 + preventing the RBAC system from being enabled. You should only say Y
59749 + here if you have no intention of using the RBAC system, so as to prevent
59750 + an attacker with root access from misusing the RBAC system to hide files
59751 + and processes when loadable module support and /dev/[k]mem have been
59752 + locked down.
59753 +
59754 +config GRKERNSEC_ACL_HIDEKERN
59755 + bool "Hide kernel processes"
59756 + help
59757 + If you say Y here, all kernel threads will be hidden to all
59758 + processes but those whose subject has the "view hidden processes"
59759 + flag.
59760 +
59761 +config GRKERNSEC_ACL_MAXTRIES
59762 + int "Maximum tries before password lockout"
59763 + default 3
59764 + help
59765 + This option enforces the maximum number of times a user can attempt
59766 + to authorize themselves with the grsecurity RBAC system before being
59767 + denied the ability to attempt authorization again for a specified time.
59768 + The lower the number, the harder it will be to brute-force a password.
59769 +
59770 +config GRKERNSEC_ACL_TIMEOUT
59771 + int "Time to wait after max password tries, in seconds"
59772 + default 30
59773 + help
59774 + This option specifies the time the user must wait after attempting to
59775 + authorize to the RBAC system with the maximum number of invalid
59776 + passwords. The higher the number, the harder it will be to brute-force
59777 + a password.
59778 +
59779 +endmenu
59780 +menu "Filesystem Protections"
59781 +depends on GRKERNSEC
59782 +
59783 +config GRKERNSEC_PROC
59784 + bool "Proc restrictions"
59785 + help
59786 + If you say Y here, the permissions of the /proc filesystem
59787 + will be altered to enhance system security and privacy. You MUST
59788 + choose either a user only restriction or a user and group restriction.
59789 + Depending upon the option you choose, you can either restrict users to
59790 + see only the processes they themselves run, or choose a group that can
59791 + view all processes and files normally restricted to root if you choose
59792 + the "restrict to user only" option. NOTE: If you're running identd as
59793 + a non-root user, you will have to run it as the group you specify here.
59794 +
59795 +config GRKERNSEC_PROC_USER
59796 + bool "Restrict /proc to user only"
59797 + depends on GRKERNSEC_PROC
59798 + help
59799 + If you say Y here, non-root users will only be able to view their own
59800 + processes, and restricts them from viewing network-related information,
59801 + and viewing kernel symbol and module information.
59802 +
59803 +config GRKERNSEC_PROC_USERGROUP
59804 + bool "Allow special group"
59805 + depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
59806 + help
59807 + If you say Y here, you will be able to select a group that will be
59808 + able to view all processes and network-related information. If you've
59809 + enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
59810 + remain hidden. This option is useful if you want to run identd as
59811 + a non-root user.
59812 +
59813 +config GRKERNSEC_PROC_GID
59814 + int "GID for special group"
59815 + depends on GRKERNSEC_PROC_USERGROUP
59816 + default 1001
59817 +
59818 +config GRKERNSEC_PROC_ADD
59819 + bool "Additional restrictions"
59820 + depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
59821 + help
59822 + If you say Y here, additional restrictions will be placed on
59823 + /proc that keep normal users from viewing device information and
59824 + slabinfo information that could be useful for exploits.
59825 +
59826 +config GRKERNSEC_LINK
59827 + bool "Linking restrictions"
59828 + help
59829 + If you say Y here, /tmp race exploits will be prevented, since users
59830 + will no longer be able to follow symlinks owned by other users in
59831 + world-writable +t directories (e.g. /tmp), unless the owner of the
59832 + symlink is the owner of the directory. users will also not be
59833 + able to hardlink to files they do not own. If the sysctl option is
59834 + enabled, a sysctl option with name "linking_restrictions" is created.
59835 +
59836 +config GRKERNSEC_FIFO
59837 + bool "FIFO restrictions"
59838 + help
59839 + If you say Y here, users will not be able to write to FIFOs they don't
59840 + own in world-writable +t directories (e.g. /tmp), unless the owner of
59841 + the FIFO is the same owner of the directory it's held in. If the sysctl
59842 + option is enabled, a sysctl option with name "fifo_restrictions" is
59843 + created.
59844 +
59845 +config GRKERNSEC_SYSFS_RESTRICT
59846 + bool "Sysfs/debugfs restriction"
59847 + depends on SYSFS
59848 + help
59849 + If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
59850 + any filesystem normally mounted under it (e.g. debugfs) will only
59851 + be accessible by root. These filesystems generally provide access
59852 + to hardware and debug information that isn't appropriate for unprivileged
59853 + users of the system. Sysfs and debugfs have also become a large source
59854 + of new vulnerabilities, ranging from infoleaks to local compromise.
59855 + There has been very little oversight with an eye toward security involved
59856 + in adding new exporters of information to these filesystems, so their
59857 + use is discouraged.
59858 + This option is equivalent to a chmod 0700 of the mount paths.
59859 +
59860 +config GRKERNSEC_ROFS
59861 + bool "Runtime read-only mount protection"
59862 + help
59863 + If you say Y here, a sysctl option with name "romount_protect" will
59864 + be created. By setting this option to 1 at runtime, filesystems
59865 + will be protected in the following ways:
59866 + * No new writable mounts will be allowed
59867 + * Existing read-only mounts won't be able to be remounted read/write
59868 + * Write operations will be denied on all block devices
59869 + This option acts independently of grsec_lock: once it is set to 1,
59870 + it cannot be turned off. Therefore, please be mindful of the resulting
59871 + behavior if this option is enabled in an init script on a read-only
59872 + filesystem. This feature is mainly intended for secure embedded systems.
59873 +
59874 +config GRKERNSEC_CHROOT
59875 + bool "Chroot jail restrictions"
59876 + help
59877 + If you say Y here, you will be able to choose several options that will
59878 + make breaking out of a chrooted jail much more difficult. If you
59879 + encounter no software incompatibilities with the following options, it
59880 + is recommended that you enable each one.
59881 +
59882 +config GRKERNSEC_CHROOT_MOUNT
59883 + bool "Deny mounts"
59884 + depends on GRKERNSEC_CHROOT
59885 + help
59886 + If you say Y here, processes inside a chroot will not be able to
59887 + mount or remount filesystems. If the sysctl option is enabled, a
59888 + sysctl option with name "chroot_deny_mount" is created.
59889 +
59890 +config GRKERNSEC_CHROOT_DOUBLE
59891 + bool "Deny double-chroots"
59892 + depends on GRKERNSEC_CHROOT
59893 + help
59894 + If you say Y here, processes inside a chroot will not be able to chroot
59895 + again outside the chroot. This is a widely used method of breaking
59896 + out of a chroot jail and should not be allowed. If the sysctl
59897 + option is enabled, a sysctl option with name
59898 + "chroot_deny_chroot" is created.
59899 +
59900 +config GRKERNSEC_CHROOT_PIVOT
59901 + bool "Deny pivot_root in chroot"
59902 + depends on GRKERNSEC_CHROOT
59903 + help
59904 + If you say Y here, processes inside a chroot will not be able to use
59905 + a function called pivot_root() that was introduced in Linux 2.3.41. It
59906 + works similar to chroot in that it changes the root filesystem. This
59907 + function could be misused in a chrooted process to attempt to break out
59908 + of the chroot, and therefore should not be allowed. If the sysctl
59909 + option is enabled, a sysctl option with name "chroot_deny_pivot" is
59910 + created.
59911 +
59912 +config GRKERNSEC_CHROOT_CHDIR
59913 + bool "Enforce chdir(\"/\") on all chroots"
59914 + depends on GRKERNSEC_CHROOT
59915 + help
59916 + If you say Y here, the current working directory of all newly-chrooted
59917 + applications will be set to the the root directory of the chroot.
59918 + The man page on chroot(2) states:
59919 + Note that this call does not change the current working
59920 + directory, so that `.' can be outside the tree rooted at
59921 + `/'. In particular, the super-user can escape from a
59922 + `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
59923 +
59924 + It is recommended that you say Y here, since it's not known to break
59925 + any software. If the sysctl option is enabled, a sysctl option with
59926 + name "chroot_enforce_chdir" is created.
59927 +
59928 +config GRKERNSEC_CHROOT_CHMOD
59929 + bool "Deny (f)chmod +s"
59930 + depends on GRKERNSEC_CHROOT
59931 + help
59932 + If you say Y here, processes inside a chroot will not be able to chmod
59933 + or fchmod files to make them have suid or sgid bits. This protects
59934 + against another published method of breaking a chroot. If the sysctl
59935 + option is enabled, a sysctl option with name "chroot_deny_chmod" is
59936 + created.
59937 +
59938 +config GRKERNSEC_CHROOT_FCHDIR
59939 + bool "Deny fchdir out of chroot"
59940 + depends on GRKERNSEC_CHROOT
59941 + help
59942 + If you say Y here, a well-known method of breaking chroots by fchdir'ing
59943 + to a file descriptor of the chrooting process that points to a directory
59944 + outside the filesystem will be stopped. If the sysctl option
59945 + is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
59946 +
59947 +config GRKERNSEC_CHROOT_MKNOD
59948 + bool "Deny mknod"
59949 + depends on GRKERNSEC_CHROOT
59950 + help
59951 + If you say Y here, processes inside a chroot will not be allowed to
59952 + mknod. The problem with using mknod inside a chroot is that it
59953 + would allow an attacker to create a device entry that is the same
59954 + as one on the physical root of your system, which could range from
59955 + anything from the console device to a device for your harddrive (which
59956 + they could then use to wipe the drive or steal data). It is recommended
59957 + that you say Y here, unless you run into software incompatibilities.
59958 + If the sysctl option is enabled, a sysctl option with name
59959 + "chroot_deny_mknod" is created.
59960 +
59961 +config GRKERNSEC_CHROOT_SHMAT
59962 + bool "Deny shmat() out of chroot"
59963 + depends on GRKERNSEC_CHROOT
59964 + help
59965 + If you say Y here, processes inside a chroot will not be able to attach
59966 + to shared memory segments that were created outside of the chroot jail.
59967 + It is recommended that you say Y here. If the sysctl option is enabled,
59968 + a sysctl option with name "chroot_deny_shmat" is created.
59969 +
59970 +config GRKERNSEC_CHROOT_UNIX
59971 + bool "Deny access to abstract AF_UNIX sockets out of chroot"
59972 + depends on GRKERNSEC_CHROOT
59973 + help
59974 + If you say Y here, processes inside a chroot will not be able to
59975 + connect to abstract (meaning not belonging to a filesystem) Unix
59976 + domain sockets that were bound outside of a chroot. It is recommended
59977 + that you say Y here. If the sysctl option is enabled, a sysctl option
59978 + with name "chroot_deny_unix" is created.
59979 +
59980 +config GRKERNSEC_CHROOT_FINDTASK
59981 + bool "Protect outside processes"
59982 + depends on GRKERNSEC_CHROOT
59983 + help
59984 + If you say Y here, processes inside a chroot will not be able to
59985 + kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
59986 + getsid, or view any process outside of the chroot. If the sysctl
59987 + option is enabled, a sysctl option with name "chroot_findtask" is
59988 + created.
59989 +
59990 +config GRKERNSEC_CHROOT_NICE
59991 + bool "Restrict priority changes"
59992 + depends on GRKERNSEC_CHROOT
59993 + help
59994 + If you say Y here, processes inside a chroot will not be able to raise
59995 + the priority of processes in the chroot, or alter the priority of
59996 + processes outside the chroot. This provides more security than simply
59997 + removing CAP_SYS_NICE from the process' capability set. If the
59998 + sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
59999 + is created.
60000 +
60001 +config GRKERNSEC_CHROOT_SYSCTL
60002 + bool "Deny sysctl writes"
60003 + depends on GRKERNSEC_CHROOT
60004 + help
60005 + If you say Y here, an attacker in a chroot will not be able to
60006 + write to sysctl entries, either by sysctl(2) or through a /proc
60007 + interface. It is strongly recommended that you say Y here. If the
60008 + sysctl option is enabled, a sysctl option with name
60009 + "chroot_deny_sysctl" is created.
60010 +
60011 +config GRKERNSEC_CHROOT_CAPS
60012 + bool "Capability restrictions"
60013 + depends on GRKERNSEC_CHROOT
60014 + help
60015 + If you say Y here, the capabilities on all processes within a
60016 + chroot jail will be lowered to stop module insertion, raw i/o,
60017 + system and net admin tasks, rebooting the system, modifying immutable
60018 + files, modifying IPC owned by another, and changing the system time.
60019 + This is left an option because it can break some apps. Disable this
60020 + if your chrooted apps are having problems performing those kinds of
60021 + tasks. If the sysctl option is enabled, a sysctl option with
60022 + name "chroot_caps" is created.
60023 +
60024 +endmenu
60025 +menu "Kernel Auditing"
60026 +depends on GRKERNSEC
60027 +
60028 +config GRKERNSEC_AUDIT_GROUP
60029 + bool "Single group for auditing"
60030 + help
60031 + If you say Y here, the exec, chdir, and (un)mount logging features
60032 + will only operate on a group you specify. This option is recommended
60033 + if you only want to watch certain users instead of having a large
60034 + amount of logs from the entire system. If the sysctl option is enabled,
60035 + a sysctl option with name "audit_group" is created.
60036 +
60037 +config GRKERNSEC_AUDIT_GID
60038 + int "GID for auditing"
60039 + depends on GRKERNSEC_AUDIT_GROUP
60040 + default 1007
60041 +
60042 +config GRKERNSEC_EXECLOG
60043 + bool "Exec logging"
60044 + help
60045 + If you say Y here, all execve() calls will be logged (since the
60046 + other exec*() calls are frontends to execve(), all execution
60047 + will be logged). Useful for shell-servers that like to keep track
60048 + of their users. If the sysctl option is enabled, a sysctl option with
60049 + name "exec_logging" is created.
60050 + WARNING: This option when enabled will produce a LOT of logs, especially
60051 + on an active system.
60052 +
60053 +config GRKERNSEC_RESLOG
60054 + bool "Resource logging"
60055 + help
60056 + If you say Y here, all attempts to overstep resource limits will
60057 + be logged with the resource name, the requested size, and the current
60058 + limit. It is highly recommended that you say Y here. If the sysctl
60059 + option is enabled, a sysctl option with name "resource_logging" is
60060 + created. If the RBAC system is enabled, the sysctl value is ignored.
60061 +
60062 +config GRKERNSEC_CHROOT_EXECLOG
60063 + bool "Log execs within chroot"
60064 + help
60065 + If you say Y here, all executions inside a chroot jail will be logged
60066 + to syslog. This can cause a large amount of logs if certain
60067 + applications (eg. djb's daemontools) are installed on the system, and
60068 + is therefore left as an option. If the sysctl option is enabled, a
60069 + sysctl option with name "chroot_execlog" is created.
60070 +
60071 +config GRKERNSEC_AUDIT_PTRACE
60072 + bool "Ptrace logging"
60073 + help
60074 + If you say Y here, all attempts to attach to a process via ptrace
60075 + will be logged. If the sysctl option is enabled, a sysctl option
60076 + with name "audit_ptrace" is created.
60077 +
60078 +config GRKERNSEC_AUDIT_CHDIR
60079 + bool "Chdir logging"
60080 + help
60081 + If you say Y here, all chdir() calls will be logged. If the sysctl
60082 + option is enabled, a sysctl option with name "audit_chdir" is created.
60083 +
60084 +config GRKERNSEC_AUDIT_MOUNT
60085 + bool "(Un)Mount logging"
60086 + help
60087 + If you say Y here, all mounts and unmounts will be logged. If the
60088 + sysctl option is enabled, a sysctl option with name "audit_mount" is
60089 + created.
60090 +
60091 +config GRKERNSEC_SIGNAL
60092 + bool "Signal logging"
60093 + help
60094 + If you say Y here, certain important signals will be logged, such as
60095 + SIGSEGV, which will as a result inform you of when a error in a program
60096 + occurred, which in some cases could mean a possible exploit attempt.
60097 + If the sysctl option is enabled, a sysctl option with name
60098 + "signal_logging" is created.
60099 +
60100 +config GRKERNSEC_FORKFAIL
60101 + bool "Fork failure logging"
60102 + help
60103 + If you say Y here, all failed fork() attempts will be logged.
60104 + This could suggest a fork bomb, or someone attempting to overstep
60105 + their process limit. If the sysctl option is enabled, a sysctl option
60106 + with name "forkfail_logging" is created.
60107 +
60108 +config GRKERNSEC_TIME
60109 + bool "Time change logging"
60110 + help
60111 + If you say Y here, any changes of the system clock will be logged.
60112 + If the sysctl option is enabled, a sysctl option with name
60113 + "timechange_logging" is created.
60114 +
60115 +config GRKERNSEC_PROC_IPADDR
60116 + bool "/proc/<pid>/ipaddr support"
60117 + help
60118 + If you say Y here, a new entry will be added to each /proc/<pid>
60119 + directory that contains the IP address of the person using the task.
60120 + The IP is carried across local TCP and AF_UNIX stream sockets.
60121 + This information can be useful for IDS/IPSes to perform remote response
60122 + to a local attack. The entry is readable by only the owner of the
60123 + process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
60124 + the RBAC system), and thus does not create privacy concerns.
60125 +
60126 +config GRKERNSEC_RWXMAP_LOG
60127 + bool 'Denied RWX mmap/mprotect logging'
60128 + depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
60129 + help
60130 + If you say Y here, calls to mmap() and mprotect() with explicit
60131 + usage of PROT_WRITE and PROT_EXEC together will be logged when
60132 + denied by the PAX_MPROTECT feature. If the sysctl option is
60133 + enabled, a sysctl option with name "rwxmap_logging" is created.
60134 +
60135 +config GRKERNSEC_AUDIT_TEXTREL
60136 + bool 'ELF text relocations logging (READ HELP)'
60137 + depends on PAX_MPROTECT
60138 + help
60139 + If you say Y here, text relocations will be logged with the filename
60140 + of the offending library or binary. The purpose of the feature is
60141 + to help Linux distribution developers get rid of libraries and
60142 + binaries that need text relocations which hinder the future progress
60143 + of PaX. Only Linux distribution developers should say Y here, and
60144 + never on a production machine, as this option creates an information
60145 + leak that could aid an attacker in defeating the randomization of
60146 + a single memory region. If the sysctl option is enabled, a sysctl
60147 + option with name "audit_textrel" is created.
60148 +
60149 +endmenu
60150 +
60151 +menu "Executable Protections"
60152 +depends on GRKERNSEC
60153 +
60154 +config GRKERNSEC_DMESG
60155 + bool "Dmesg(8) restriction"
60156 + help
60157 + If you say Y here, non-root users will not be able to use dmesg(8)
60158 + to view up to the last 4kb of messages in the kernel's log buffer.
60159 + The kernel's log buffer often contains kernel addresses and other
60160 + identifying information useful to an attacker in fingerprinting a
60161 + system for a targeted exploit.
60162 + If the sysctl option is enabled, a sysctl option with name "dmesg" is
60163 + created.
60164 +
60165 +config GRKERNSEC_HARDEN_PTRACE
60166 + bool "Deter ptrace-based process snooping"
60167 + help
60168 + If you say Y here, TTY sniffers and other malicious monitoring
60169 + programs implemented through ptrace will be defeated. If you
60170 + have been using the RBAC system, this option has already been
60171 + enabled for several years for all users, with the ability to make
60172 + fine-grained exceptions.
60173 +
60174 + This option only affects the ability of non-root users to ptrace
60175 + processes that are not a descendent of the ptracing process.
60176 + This means that strace ./binary and gdb ./binary will still work,
60177 + but attaching to arbitrary processes will not. If the sysctl
60178 + option is enabled, a sysctl option with name "harden_ptrace" is
60179 + created.
60180 +
60181 +config GRKERNSEC_TPE
60182 + bool "Trusted Path Execution (TPE)"
60183 + help
60184 + If you say Y here, you will be able to choose a gid to add to the
60185 + supplementary groups of users you want to mark as "untrusted."
60186 + These users will not be able to execute any files that are not in
60187 + root-owned directories writable only by root. If the sysctl option
60188 + is enabled, a sysctl option with name "tpe" is created.
60189 +
60190 +config GRKERNSEC_TPE_ALL
60191 + bool "Partially restrict all non-root users"
60192 + depends on GRKERNSEC_TPE
60193 + help
60194 + If you say Y here, all non-root users will be covered under
60195 + a weaker TPE restriction. This is separate from, and in addition to,
60196 + the main TPE options that you have selected elsewhere. Thus, if a
60197 + "trusted" GID is chosen, this restriction applies to even that GID.
60198 + Under this restriction, all non-root users will only be allowed to
60199 + execute files in directories they own that are not group or
60200 + world-writable, or in directories owned by root and writable only by
60201 + root. If the sysctl option is enabled, a sysctl option with name
60202 + "tpe_restrict_all" is created.
60203 +
60204 +config GRKERNSEC_TPE_INVERT
60205 + bool "Invert GID option"
60206 + depends on GRKERNSEC_TPE
60207 + help
60208 + If you say Y here, the group you specify in the TPE configuration will
60209 + decide what group TPE restrictions will be *disabled* for. This
60210 + option is useful if you want TPE restrictions to be applied to most
60211 + users on the system. If the sysctl option is enabled, a sysctl option
60212 + with name "tpe_invert" is created. Unlike other sysctl options, this
60213 + entry will default to on for backward-compatibility.
60214 +
60215 +config GRKERNSEC_TPE_GID
60216 + int "GID for untrusted users"
60217 + depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
60218 + default 1005
60219 + help
60220 + Setting this GID determines what group TPE restrictions will be
60221 + *enabled* for. If the sysctl option is enabled, a sysctl option
60222 + with name "tpe_gid" is created.
60223 +
60224 +config GRKERNSEC_TPE_GID
60225 + int "GID for trusted users"
60226 + depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
60227 + default 1005
60228 + help
60229 + Setting this GID determines what group TPE restrictions will be
60230 + *disabled* for. If the sysctl option is enabled, a sysctl option
60231 + with name "tpe_gid" is created.
60232 +
60233 +endmenu
60234 +menu "Network Protections"
60235 +depends on GRKERNSEC
60236 +
60237 +config GRKERNSEC_RANDNET
60238 + bool "Larger entropy pools"
60239 + help
60240 + If you say Y here, the entropy pools used for many features of Linux
60241 + and grsecurity will be doubled in size. Since several grsecurity
60242 + features use additional randomness, it is recommended that you say Y
60243 + here. Saying Y here has a similar effect as modifying
60244 + /proc/sys/kernel/random/poolsize.
60245 +
60246 +config GRKERNSEC_BLACKHOLE
60247 + bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
60248 + depends on NET
60249 + help
60250 + If you say Y here, neither TCP resets nor ICMP
60251 + destination-unreachable packets will be sent in response to packets
60252 + sent to ports for which no associated listening process exists.
60253 + This feature supports both IPV4 and IPV6 and exempts the
60254 + loopback interface from blackholing. Enabling this feature
60255 + makes a host more resilient to DoS attacks and reduces network
60256 + visibility against scanners.
60257 +
60258 + The blackhole feature as-implemented is equivalent to the FreeBSD
60259 + blackhole feature, as it prevents RST responses to all packets, not
60260 + just SYNs. Under most application behavior this causes no
60261 + problems, but applications (like haproxy) may not close certain
60262 + connections in a way that cleanly terminates them on the remote
60263 + end, leaving the remote host in LAST_ACK state. Because of this
60264 + side-effect and to prevent intentional LAST_ACK DoSes, this
60265 + feature also adds automatic mitigation against such attacks.
60266 + The mitigation drastically reduces the amount of time a socket
60267 + can spend in LAST_ACK state. If you're using haproxy and not
60268 + all servers it connects to have this option enabled, consider
60269 + disabling this feature on the haproxy host.
60270 +
60271 + If the sysctl option is enabled, two sysctl options with names
60272 + "ip_blackhole" and "lastack_retries" will be created.
60273 + While "ip_blackhole" takes the standard zero/non-zero on/off
60274 + toggle, "lastack_retries" uses the same kinds of values as
60275 + "tcp_retries1" and "tcp_retries2". The default value of 4
60276 + prevents a socket from lasting more than 45 seconds in LAST_ACK
60277 + state.
60278 +
60279 +config GRKERNSEC_SOCKET
60280 + bool "Socket restrictions"
60281 + depends on NET
60282 + help
60283 + If you say Y here, you will be able to choose from several options.
60284 + If you assign a GID on your system and add it to the supplementary
60285 + groups of users you want to restrict socket access to, this patch
60286 + will perform up to three things, based on the option(s) you choose.
60287 +
60288 +config GRKERNSEC_SOCKET_ALL
60289 + bool "Deny any sockets to group"
60290 + depends on GRKERNSEC_SOCKET
60291 + help
60292 + If you say Y here, you will be able to choose a GID of whose users will
60293 + be unable to connect to other hosts from your machine or run server
60294 + applications from your machine. If the sysctl option is enabled, a
60295 + sysctl option with name "socket_all" is created.
60296 +
60297 +config GRKERNSEC_SOCKET_ALL_GID
60298 + int "GID to deny all sockets for"
60299 + depends on GRKERNSEC_SOCKET_ALL
60300 + default 1004
60301 + help
60302 + Here you can choose the GID to disable socket access for. Remember to
60303 + add the users you want socket access disabled for to the GID
60304 + specified here. If the sysctl option is enabled, a sysctl option
60305 + with name "socket_all_gid" is created.
60306 +
60307 +config GRKERNSEC_SOCKET_CLIENT
60308 + bool "Deny client sockets to group"
60309 + depends on GRKERNSEC_SOCKET
60310 + help
60311 + If you say Y here, you will be able to choose a GID of whose users will
60312 + be unable to connect to other hosts from your machine, but will be
60313 + able to run servers. If this option is enabled, all users in the group
60314 + you specify will have to use passive mode when initiating ftp transfers
60315 + from the shell on your machine. If the sysctl option is enabled, a
60316 + sysctl option with name "socket_client" is created.
60317 +
60318 +config GRKERNSEC_SOCKET_CLIENT_GID
60319 + int "GID to deny client sockets for"
60320 + depends on GRKERNSEC_SOCKET_CLIENT
60321 + default 1003
60322 + help
60323 + Here you can choose the GID to disable client socket access for.
60324 + Remember to add the users you want client socket access disabled for to
60325 + the GID specified here. If the sysctl option is enabled, a sysctl
60326 + option with name "socket_client_gid" is created.
60327 +
60328 +config GRKERNSEC_SOCKET_SERVER
60329 + bool "Deny server sockets to group"
60330 + depends on GRKERNSEC_SOCKET
60331 + help
60332 + If you say Y here, you will be able to choose a GID of whose users will
60333 + be unable to run server applications from your machine. If the sysctl
60334 + option is enabled, a sysctl option with name "socket_server" is created.
60335 +
60336 +config GRKERNSEC_SOCKET_SERVER_GID
60337 + int "GID to deny server sockets for"
60338 + depends on GRKERNSEC_SOCKET_SERVER
60339 + default 1002
60340 + help
60341 + Here you can choose the GID to disable server socket access for.
60342 + Remember to add the users you want server socket access disabled for to
60343 + the GID specified here. If the sysctl option is enabled, a sysctl
60344 + option with name "socket_server_gid" is created.
60345 +
60346 +endmenu
60347 +menu "Sysctl support"
60348 +depends on GRKERNSEC && SYSCTL
60349 +
60350 +config GRKERNSEC_SYSCTL
60351 + bool "Sysctl support"
60352 + help
60353 + If you say Y here, you will be able to change the options that
60354 + grsecurity runs with at bootup, without having to recompile your
60355 + kernel. You can echo values to files in /proc/sys/kernel/grsecurity
60356 + to enable (1) or disable (0) various features. All the sysctl entries
60357 + are mutable until the "grsec_lock" entry is set to a non-zero value.
60358 + All features enabled in the kernel configuration are disabled at boot
60359 + if you do not say Y to the "Turn on features by default" option.
60360 + All options should be set at startup, and the grsec_lock entry should
60361 + be set to a non-zero value after all the options are set.
60362 + *THIS IS EXTREMELY IMPORTANT*
60363 +
60364 +config GRKERNSEC_SYSCTL_DISTRO
60365 + bool "Extra sysctl support for distro makers (READ HELP)"
60366 + depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
60367 + help
60368 + If you say Y here, additional sysctl options will be created
60369 + for features that affect processes running as root. Therefore,
60370 + it is critical when using this option that the grsec_lock entry be
60371 + enabled after boot. Only distros with prebuilt kernel packages
60372 + with this option enabled that can ensure grsec_lock is enabled
60373 + after boot should use this option.
60374 + *Failure to set grsec_lock after boot makes all grsec features
60375 + this option covers useless*
60376 +
60377 + Currently this option creates the following sysctl entries:
60378 + "Disable Privileged I/O": "disable_priv_io"
60379 +
60380 +config GRKERNSEC_SYSCTL_ON
60381 + bool "Turn on features by default"
60382 + depends on GRKERNSEC_SYSCTL
60383 + help
60384 + If you say Y here, instead of having all features enabled in the
60385 + kernel configuration disabled at boot time, the features will be
60386 + enabled at boot time. It is recommended you say Y here unless
60387 + there is some reason you would want all sysctl-tunable features to
60388 + be disabled by default. As mentioned elsewhere, it is important
60389 + to enable the grsec_lock entry once you have finished modifying
60390 + the sysctl entries.
60391 +
60392 +endmenu
60393 +menu "Logging Options"
60394 +depends on GRKERNSEC
60395 +
60396 +config GRKERNSEC_FLOODTIME
60397 + int "Seconds in between log messages (minimum)"
60398 + default 10
60399 + help
60400 + This option allows you to enforce the number of seconds between
60401 + grsecurity log messages. The default should be suitable for most
60402 + people, however, if you choose to change it, choose a value small enough
60403 + to allow informative logs to be produced, but large enough to
60404 + prevent flooding.
60405 +
60406 +config GRKERNSEC_FLOODBURST
60407 + int "Number of messages in a burst (maximum)"
60408 + default 6
60409 + help
60410 + This option allows you to choose the maximum number of messages allowed
60411 + within the flood time interval you chose in a separate option. The
60412 + default should be suitable for most people, however if you find that
60413 + many of your logs are being interpreted as flooding, you may want to
60414 + raise this value.
60415 +
60416 +endmenu
60417 +
60418 +endmenu
60419 diff -urNp linux-2.6.32.46/grsecurity/Makefile linux-2.6.32.46/grsecurity/Makefile
60420 --- linux-2.6.32.46/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500
60421 +++ linux-2.6.32.46/grsecurity/Makefile 2011-10-17 06:48:36.000000000 -0400
60422 @@ -0,0 +1,36 @@
60423 +# grsecurity's ACL system was originally written in 2001 by Michael Dalton
60424 +# during 2001-2009 it has been completely redesigned by Brad Spengler
60425 +# into an RBAC system
60426 +#
60427 +# All code in this directory and various hooks inserted throughout the kernel
60428 +# are copyright Brad Spengler - Open Source Security, Inc., and released
60429 +# under the GPL v2 or higher
60430 +
60431 +obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
60432 + grsec_mount.o grsec_sig.o grsec_sysctl.o \
60433 + grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
60434 +
60435 +obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
60436 + gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
60437 + gracl_learn.o grsec_log.o
60438 +obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
60439 +
60440 +ifdef CONFIG_NET
60441 +obj-y += grsec_sock.o
60442 +obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
60443 +endif
60444 +
60445 +ifndef CONFIG_GRKERNSEC
60446 +obj-y += grsec_disabled.o
60447 +endif
60448 +
60449 +ifdef CONFIG_GRKERNSEC_HIDESYM
60450 +extra-y := grsec_hidesym.o
60451 +$(obj)/grsec_hidesym.o:
60452 + @-chmod -f 500 /boot
60453 + @-chmod -f 500 /lib/modules
60454 + @-chmod -f 500 /lib64/modules
60455 + @-chmod -f 500 /lib32/modules
60456 + @-chmod -f 700 .
60457 + @echo ' grsec: protected kernel image paths'
60458 +endif
60459 diff -urNp linux-2.6.32.46/include/acpi/acpi_bus.h linux-2.6.32.46/include/acpi/acpi_bus.h
60460 --- linux-2.6.32.46/include/acpi/acpi_bus.h 2011-03-27 14:31:47.000000000 -0400
60461 +++ linux-2.6.32.46/include/acpi/acpi_bus.h 2011-08-05 20:33:55.000000000 -0400
60462 @@ -107,7 +107,7 @@ struct acpi_device_ops {
60463 acpi_op_bind bind;
60464 acpi_op_unbind unbind;
60465 acpi_op_notify notify;
60466 -};
60467 +} __no_const;
60468
60469 #define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */
60470
60471 diff -urNp linux-2.6.32.46/include/acpi/acpi_drivers.h linux-2.6.32.46/include/acpi/acpi_drivers.h
60472 --- linux-2.6.32.46/include/acpi/acpi_drivers.h 2011-03-27 14:31:47.000000000 -0400
60473 +++ linux-2.6.32.46/include/acpi/acpi_drivers.h 2011-04-17 15:56:46.000000000 -0400
60474 @@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acp
60475 Dock Station
60476 -------------------------------------------------------------------------- */
60477 struct acpi_dock_ops {
60478 - acpi_notify_handler handler;
60479 - acpi_notify_handler uevent;
60480 + const acpi_notify_handler handler;
60481 + const acpi_notify_handler uevent;
60482 };
60483
60484 #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
60485 @@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
60486 extern int register_dock_notifier(struct notifier_block *nb);
60487 extern void unregister_dock_notifier(struct notifier_block *nb);
60488 extern int register_hotplug_dock_device(acpi_handle handle,
60489 - struct acpi_dock_ops *ops,
60490 + const struct acpi_dock_ops *ops,
60491 void *context);
60492 extern void unregister_hotplug_dock_device(acpi_handle handle);
60493 #else
60494 @@ -144,7 +144,7 @@ static inline void unregister_dock_notif
60495 {
60496 }
60497 static inline int register_hotplug_dock_device(acpi_handle handle,
60498 - struct acpi_dock_ops *ops,
60499 + const struct acpi_dock_ops *ops,
60500 void *context)
60501 {
60502 return -ENODEV;
60503 diff -urNp linux-2.6.32.46/include/asm-generic/atomic-long.h linux-2.6.32.46/include/asm-generic/atomic-long.h
60504 --- linux-2.6.32.46/include/asm-generic/atomic-long.h 2011-03-27 14:31:47.000000000 -0400
60505 +++ linux-2.6.32.46/include/asm-generic/atomic-long.h 2011-07-13 22:21:25.000000000 -0400
60506 @@ -22,6 +22,12 @@
60507
60508 typedef atomic64_t atomic_long_t;
60509
60510 +#ifdef CONFIG_PAX_REFCOUNT
60511 +typedef atomic64_unchecked_t atomic_long_unchecked_t;
60512 +#else
60513 +typedef atomic64_t atomic_long_unchecked_t;
60514 +#endif
60515 +
60516 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
60517
60518 static inline long atomic_long_read(atomic_long_t *l)
60519 @@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
60520 return (long)atomic64_read(v);
60521 }
60522
60523 +#ifdef CONFIG_PAX_REFCOUNT
60524 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
60525 +{
60526 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60527 +
60528 + return (long)atomic64_read_unchecked(v);
60529 +}
60530 +#endif
60531 +
60532 static inline void atomic_long_set(atomic_long_t *l, long i)
60533 {
60534 atomic64_t *v = (atomic64_t *)l;
60535 @@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
60536 atomic64_set(v, i);
60537 }
60538
60539 +#ifdef CONFIG_PAX_REFCOUNT
60540 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
60541 +{
60542 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60543 +
60544 + atomic64_set_unchecked(v, i);
60545 +}
60546 +#endif
60547 +
60548 static inline void atomic_long_inc(atomic_long_t *l)
60549 {
60550 atomic64_t *v = (atomic64_t *)l;
60551 @@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
60552 atomic64_inc(v);
60553 }
60554
60555 +#ifdef CONFIG_PAX_REFCOUNT
60556 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
60557 +{
60558 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60559 +
60560 + atomic64_inc_unchecked(v);
60561 +}
60562 +#endif
60563 +
60564 static inline void atomic_long_dec(atomic_long_t *l)
60565 {
60566 atomic64_t *v = (atomic64_t *)l;
60567 @@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomi
60568 atomic64_dec(v);
60569 }
60570
60571 +#ifdef CONFIG_PAX_REFCOUNT
60572 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
60573 +{
60574 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60575 +
60576 + atomic64_dec_unchecked(v);
60577 +}
60578 +#endif
60579 +
60580 static inline void atomic_long_add(long i, atomic_long_t *l)
60581 {
60582 atomic64_t *v = (atomic64_t *)l;
60583 @@ -59,6 +101,15 @@ static inline void atomic_long_add(long
60584 atomic64_add(i, v);
60585 }
60586
60587 +#ifdef CONFIG_PAX_REFCOUNT
60588 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
60589 +{
60590 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60591 +
60592 + atomic64_add_unchecked(i, v);
60593 +}
60594 +#endif
60595 +
60596 static inline void atomic_long_sub(long i, atomic_long_t *l)
60597 {
60598 atomic64_t *v = (atomic64_t *)l;
60599 @@ -115,6 +166,15 @@ static inline long atomic_long_inc_retur
60600 return (long)atomic64_inc_return(v);
60601 }
60602
60603 +#ifdef CONFIG_PAX_REFCOUNT
60604 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
60605 +{
60606 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60607 +
60608 + return (long)atomic64_inc_return_unchecked(v);
60609 +}
60610 +#endif
60611 +
60612 static inline long atomic_long_dec_return(atomic_long_t *l)
60613 {
60614 atomic64_t *v = (atomic64_t *)l;
60615 @@ -140,6 +200,12 @@ static inline long atomic_long_add_unles
60616
60617 typedef atomic_t atomic_long_t;
60618
60619 +#ifdef CONFIG_PAX_REFCOUNT
60620 +typedef atomic_unchecked_t atomic_long_unchecked_t;
60621 +#else
60622 +typedef atomic_t atomic_long_unchecked_t;
60623 +#endif
60624 +
60625 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
60626 static inline long atomic_long_read(atomic_long_t *l)
60627 {
60628 @@ -148,6 +214,15 @@ static inline long atomic_long_read(atom
60629 return (long)atomic_read(v);
60630 }
60631
60632 +#ifdef CONFIG_PAX_REFCOUNT
60633 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
60634 +{
60635 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60636 +
60637 + return (long)atomic_read_unchecked(v);
60638 +}
60639 +#endif
60640 +
60641 static inline void atomic_long_set(atomic_long_t *l, long i)
60642 {
60643 atomic_t *v = (atomic_t *)l;
60644 @@ -155,6 +230,15 @@ static inline void atomic_long_set(atomi
60645 atomic_set(v, i);
60646 }
60647
60648 +#ifdef CONFIG_PAX_REFCOUNT
60649 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
60650 +{
60651 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60652 +
60653 + atomic_set_unchecked(v, i);
60654 +}
60655 +#endif
60656 +
60657 static inline void atomic_long_inc(atomic_long_t *l)
60658 {
60659 atomic_t *v = (atomic_t *)l;
60660 @@ -162,6 +246,15 @@ static inline void atomic_long_inc(atomi
60661 atomic_inc(v);
60662 }
60663
60664 +#ifdef CONFIG_PAX_REFCOUNT
60665 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
60666 +{
60667 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60668 +
60669 + atomic_inc_unchecked(v);
60670 +}
60671 +#endif
60672 +
60673 static inline void atomic_long_dec(atomic_long_t *l)
60674 {
60675 atomic_t *v = (atomic_t *)l;
60676 @@ -169,6 +262,15 @@ static inline void atomic_long_dec(atomi
60677 atomic_dec(v);
60678 }
60679
60680 +#ifdef CONFIG_PAX_REFCOUNT
60681 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
60682 +{
60683 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60684 +
60685 + atomic_dec_unchecked(v);
60686 +}
60687 +#endif
60688 +
60689 static inline void atomic_long_add(long i, atomic_long_t *l)
60690 {
60691 atomic_t *v = (atomic_t *)l;
60692 @@ -176,6 +278,15 @@ static inline void atomic_long_add(long
60693 atomic_add(i, v);
60694 }
60695
60696 +#ifdef CONFIG_PAX_REFCOUNT
60697 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
60698 +{
60699 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60700 +
60701 + atomic_add_unchecked(i, v);
60702 +}
60703 +#endif
60704 +
60705 static inline void atomic_long_sub(long i, atomic_long_t *l)
60706 {
60707 atomic_t *v = (atomic_t *)l;
60708 @@ -232,6 +343,15 @@ static inline long atomic_long_inc_retur
60709 return (long)atomic_inc_return(v);
60710 }
60711
60712 +#ifdef CONFIG_PAX_REFCOUNT
60713 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
60714 +{
60715 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60716 +
60717 + return (long)atomic_inc_return_unchecked(v);
60718 +}
60719 +#endif
60720 +
60721 static inline long atomic_long_dec_return(atomic_long_t *l)
60722 {
60723 atomic_t *v = (atomic_t *)l;
60724 @@ -255,4 +375,47 @@ static inline long atomic_long_add_unles
60725
60726 #endif /* BITS_PER_LONG == 64 */
60727
60728 +#ifdef CONFIG_PAX_REFCOUNT
60729 +static inline void pax_refcount_needs_these_functions(void)
60730 +{
60731 + atomic_read_unchecked((atomic_unchecked_t *)NULL);
60732 + atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
60733 + atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
60734 + atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
60735 + atomic_inc_unchecked((atomic_unchecked_t *)NULL);
60736 + (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
60737 + atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
60738 + atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
60739 + atomic_dec_unchecked((atomic_unchecked_t *)NULL);
60740 + atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
60741 + (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
60742 +
60743 + atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
60744 + atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
60745 + atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
60746 + atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
60747 + atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
60748 + atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
60749 +}
60750 +#else
60751 +#define atomic_read_unchecked(v) atomic_read(v)
60752 +#define atomic_set_unchecked(v, i) atomic_set((v), (i))
60753 +#define atomic_add_unchecked(i, v) atomic_add((i), (v))
60754 +#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
60755 +#define atomic_inc_unchecked(v) atomic_inc(v)
60756 +#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
60757 +#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
60758 +#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
60759 +#define atomic_dec_unchecked(v) atomic_dec(v)
60760 +#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
60761 +#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
60762 +
60763 +#define atomic_long_read_unchecked(v) atomic_long_read(v)
60764 +#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
60765 +#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
60766 +#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
60767 +#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
60768 +#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
60769 +#endif
60770 +
60771 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
60772 diff -urNp linux-2.6.32.46/include/asm-generic/bug.h linux-2.6.32.46/include/asm-generic/bug.h
60773 --- linux-2.6.32.46/include/asm-generic/bug.h 2011-07-13 17:23:04.000000000 -0400
60774 +++ linux-2.6.32.46/include/asm-generic/bug.h 2011-08-21 17:56:07.000000000 -0400
60775 @@ -105,11 +105,11 @@ extern void warn_slowpath_null(const cha
60776
60777 #else /* !CONFIG_BUG */
60778 #ifndef HAVE_ARCH_BUG
60779 -#define BUG() do {} while(0)
60780 +#define BUG() do { for (;;) ; } while(0)
60781 #endif
60782
60783 #ifndef HAVE_ARCH_BUG_ON
60784 -#define BUG_ON(condition) do { if (condition) ; } while(0)
60785 +#define BUG_ON(condition) do { if (condition) for (;;) ; } while(0)
60786 #endif
60787
60788 #ifndef HAVE_ARCH_WARN_ON
60789 diff -urNp linux-2.6.32.46/include/asm-generic/cache.h linux-2.6.32.46/include/asm-generic/cache.h
60790 --- linux-2.6.32.46/include/asm-generic/cache.h 2011-03-27 14:31:47.000000000 -0400
60791 +++ linux-2.6.32.46/include/asm-generic/cache.h 2011-07-06 19:53:33.000000000 -0400
60792 @@ -6,7 +6,7 @@
60793 * cache lines need to provide their own cache.h.
60794 */
60795
60796 -#define L1_CACHE_SHIFT 5
60797 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
60798 +#define L1_CACHE_SHIFT 5UL
60799 +#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
60800
60801 #endif /* __ASM_GENERIC_CACHE_H */
60802 diff -urNp linux-2.6.32.46/include/asm-generic/dma-mapping-common.h linux-2.6.32.46/include/asm-generic/dma-mapping-common.h
60803 --- linux-2.6.32.46/include/asm-generic/dma-mapping-common.h 2011-03-27 14:31:47.000000000 -0400
60804 +++ linux-2.6.32.46/include/asm-generic/dma-mapping-common.h 2011-04-17 15:56:46.000000000 -0400
60805 @@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
60806 enum dma_data_direction dir,
60807 struct dma_attrs *attrs)
60808 {
60809 - struct dma_map_ops *ops = get_dma_ops(dev);
60810 + const struct dma_map_ops *ops = get_dma_ops(dev);
60811 dma_addr_t addr;
60812
60813 kmemcheck_mark_initialized(ptr, size);
60814 @@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
60815 enum dma_data_direction dir,
60816 struct dma_attrs *attrs)
60817 {
60818 - struct dma_map_ops *ops = get_dma_ops(dev);
60819 + const struct dma_map_ops *ops = get_dma_ops(dev);
60820
60821 BUG_ON(!valid_dma_direction(dir));
60822 if (ops->unmap_page)
60823 @@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
60824 int nents, enum dma_data_direction dir,
60825 struct dma_attrs *attrs)
60826 {
60827 - struct dma_map_ops *ops = get_dma_ops(dev);
60828 + const struct dma_map_ops *ops = get_dma_ops(dev);
60829 int i, ents;
60830 struct scatterlist *s;
60831
60832 @@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
60833 int nents, enum dma_data_direction dir,
60834 struct dma_attrs *attrs)
60835 {
60836 - struct dma_map_ops *ops = get_dma_ops(dev);
60837 + const struct dma_map_ops *ops = get_dma_ops(dev);
60838
60839 BUG_ON(!valid_dma_direction(dir));
60840 debug_dma_unmap_sg(dev, sg, nents, dir);
60841 @@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
60842 size_t offset, size_t size,
60843 enum dma_data_direction dir)
60844 {
60845 - struct dma_map_ops *ops = get_dma_ops(dev);
60846 + const struct dma_map_ops *ops = get_dma_ops(dev);
60847 dma_addr_t addr;
60848
60849 kmemcheck_mark_initialized(page_address(page) + offset, size);
60850 @@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
60851 static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
60852 size_t size, enum dma_data_direction dir)
60853 {
60854 - struct dma_map_ops *ops = get_dma_ops(dev);
60855 + const struct dma_map_ops *ops = get_dma_ops(dev);
60856
60857 BUG_ON(!valid_dma_direction(dir));
60858 if (ops->unmap_page)
60859 @@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
60860 size_t size,
60861 enum dma_data_direction dir)
60862 {
60863 - struct dma_map_ops *ops = get_dma_ops(dev);
60864 + const struct dma_map_ops *ops = get_dma_ops(dev);
60865
60866 BUG_ON(!valid_dma_direction(dir));
60867 if (ops->sync_single_for_cpu)
60868 @@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
60869 dma_addr_t addr, size_t size,
60870 enum dma_data_direction dir)
60871 {
60872 - struct dma_map_ops *ops = get_dma_ops(dev);
60873 + const struct dma_map_ops *ops = get_dma_ops(dev);
60874
60875 BUG_ON(!valid_dma_direction(dir));
60876 if (ops->sync_single_for_device)
60877 @@ -123,7 +123,7 @@ static inline void dma_sync_single_range
60878 size_t size,
60879 enum dma_data_direction dir)
60880 {
60881 - struct dma_map_ops *ops = get_dma_ops(dev);
60882 + const struct dma_map_ops *ops = get_dma_ops(dev);
60883
60884 BUG_ON(!valid_dma_direction(dir));
60885 if (ops->sync_single_range_for_cpu) {
60886 @@ -140,7 +140,7 @@ static inline void dma_sync_single_range
60887 size_t size,
60888 enum dma_data_direction dir)
60889 {
60890 - struct dma_map_ops *ops = get_dma_ops(dev);
60891 + const struct dma_map_ops *ops = get_dma_ops(dev);
60892
60893 BUG_ON(!valid_dma_direction(dir));
60894 if (ops->sync_single_range_for_device) {
60895 @@ -155,7 +155,7 @@ static inline void
60896 dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
60897 int nelems, enum dma_data_direction dir)
60898 {
60899 - struct dma_map_ops *ops = get_dma_ops(dev);
60900 + const struct dma_map_ops *ops = get_dma_ops(dev);
60901
60902 BUG_ON(!valid_dma_direction(dir));
60903 if (ops->sync_sg_for_cpu)
60904 @@ -167,7 +167,7 @@ static inline void
60905 dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
60906 int nelems, enum dma_data_direction dir)
60907 {
60908 - struct dma_map_ops *ops = get_dma_ops(dev);
60909 + const struct dma_map_ops *ops = get_dma_ops(dev);
60910
60911 BUG_ON(!valid_dma_direction(dir));
60912 if (ops->sync_sg_for_device)
60913 diff -urNp linux-2.6.32.46/include/asm-generic/emergency-restart.h linux-2.6.32.46/include/asm-generic/emergency-restart.h
60914 --- linux-2.6.32.46/include/asm-generic/emergency-restart.h 2011-03-27 14:31:47.000000000 -0400
60915 +++ linux-2.6.32.46/include/asm-generic/emergency-restart.h 2011-08-21 19:17:17.000000000 -0400
60916 @@ -1,7 +1,7 @@
60917 #ifndef _ASM_GENERIC_EMERGENCY_RESTART_H
60918 #define _ASM_GENERIC_EMERGENCY_RESTART_H
60919
60920 -static inline void machine_emergency_restart(void)
60921 +static inline __noreturn void machine_emergency_restart(void)
60922 {
60923 machine_restart(NULL);
60924 }
60925 diff -urNp linux-2.6.32.46/include/asm-generic/futex.h linux-2.6.32.46/include/asm-generic/futex.h
60926 --- linux-2.6.32.46/include/asm-generic/futex.h 2011-03-27 14:31:47.000000000 -0400
60927 +++ linux-2.6.32.46/include/asm-generic/futex.h 2011-04-17 15:56:46.000000000 -0400
60928 @@ -6,7 +6,7 @@
60929 #include <asm/errno.h>
60930
60931 static inline int
60932 -futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
60933 +futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
60934 {
60935 int op = (encoded_op >> 28) & 7;
60936 int cmp = (encoded_op >> 24) & 15;
60937 @@ -48,7 +48,7 @@ futex_atomic_op_inuser (int encoded_op,
60938 }
60939
60940 static inline int
60941 -futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
60942 +futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
60943 {
60944 return -ENOSYS;
60945 }
60946 diff -urNp linux-2.6.32.46/include/asm-generic/int-l64.h linux-2.6.32.46/include/asm-generic/int-l64.h
60947 --- linux-2.6.32.46/include/asm-generic/int-l64.h 2011-03-27 14:31:47.000000000 -0400
60948 +++ linux-2.6.32.46/include/asm-generic/int-l64.h 2011-04-17 15:56:46.000000000 -0400
60949 @@ -46,6 +46,8 @@ typedef unsigned int u32;
60950 typedef signed long s64;
60951 typedef unsigned long u64;
60952
60953 +typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
60954 +
60955 #define S8_C(x) x
60956 #define U8_C(x) x ## U
60957 #define S16_C(x) x
60958 diff -urNp linux-2.6.32.46/include/asm-generic/int-ll64.h linux-2.6.32.46/include/asm-generic/int-ll64.h
60959 --- linux-2.6.32.46/include/asm-generic/int-ll64.h 2011-03-27 14:31:47.000000000 -0400
60960 +++ linux-2.6.32.46/include/asm-generic/int-ll64.h 2011-04-17 15:56:46.000000000 -0400
60961 @@ -51,6 +51,8 @@ typedef unsigned int u32;
60962 typedef signed long long s64;
60963 typedef unsigned long long u64;
60964
60965 +typedef unsigned long long intoverflow_t;
60966 +
60967 #define S8_C(x) x
60968 #define U8_C(x) x ## U
60969 #define S16_C(x) x
60970 diff -urNp linux-2.6.32.46/include/asm-generic/kmap_types.h linux-2.6.32.46/include/asm-generic/kmap_types.h
60971 --- linux-2.6.32.46/include/asm-generic/kmap_types.h 2011-03-27 14:31:47.000000000 -0400
60972 +++ linux-2.6.32.46/include/asm-generic/kmap_types.h 2011-04-17 15:56:46.000000000 -0400
60973 @@ -28,7 +28,8 @@ KMAP_D(15) KM_UML_USERCOPY,
60974 KMAP_D(16) KM_IRQ_PTE,
60975 KMAP_D(17) KM_NMI,
60976 KMAP_D(18) KM_NMI_PTE,
60977 -KMAP_D(19) KM_TYPE_NR
60978 +KMAP_D(19) KM_CLEARPAGE,
60979 +KMAP_D(20) KM_TYPE_NR
60980 };
60981
60982 #undef KMAP_D
60983 diff -urNp linux-2.6.32.46/include/asm-generic/pgtable.h linux-2.6.32.46/include/asm-generic/pgtable.h
60984 --- linux-2.6.32.46/include/asm-generic/pgtable.h 2011-03-27 14:31:47.000000000 -0400
60985 +++ linux-2.6.32.46/include/asm-generic/pgtable.h 2011-04-17 15:56:46.000000000 -0400
60986 @@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_ar
60987 unsigned long size);
60988 #endif
60989
60990 +#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
60991 +static inline unsigned long pax_open_kernel(void) { return 0; }
60992 +#endif
60993 +
60994 +#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
60995 +static inline unsigned long pax_close_kernel(void) { return 0; }
60996 +#endif
60997 +
60998 #endif /* !__ASSEMBLY__ */
60999
61000 #endif /* _ASM_GENERIC_PGTABLE_H */
61001 diff -urNp linux-2.6.32.46/include/asm-generic/pgtable-nopmd.h linux-2.6.32.46/include/asm-generic/pgtable-nopmd.h
61002 --- linux-2.6.32.46/include/asm-generic/pgtable-nopmd.h 2011-03-27 14:31:47.000000000 -0400
61003 +++ linux-2.6.32.46/include/asm-generic/pgtable-nopmd.h 2011-04-17 15:56:46.000000000 -0400
61004 @@ -1,14 +1,19 @@
61005 #ifndef _PGTABLE_NOPMD_H
61006 #define _PGTABLE_NOPMD_H
61007
61008 -#ifndef __ASSEMBLY__
61009 -
61010 #include <asm-generic/pgtable-nopud.h>
61011
61012 -struct mm_struct;
61013 -
61014 #define __PAGETABLE_PMD_FOLDED
61015
61016 +#define PMD_SHIFT PUD_SHIFT
61017 +#define PTRS_PER_PMD 1
61018 +#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
61019 +#define PMD_MASK (~(PMD_SIZE-1))
61020 +
61021 +#ifndef __ASSEMBLY__
61022 +
61023 +struct mm_struct;
61024 +
61025 /*
61026 * Having the pmd type consist of a pud gets the size right, and allows
61027 * us to conceptually access the pud entry that this pmd is folded into
61028 @@ -16,11 +21,6 @@ struct mm_struct;
61029 */
61030 typedef struct { pud_t pud; } pmd_t;
61031
61032 -#define PMD_SHIFT PUD_SHIFT
61033 -#define PTRS_PER_PMD 1
61034 -#define PMD_SIZE (1UL << PMD_SHIFT)
61035 -#define PMD_MASK (~(PMD_SIZE-1))
61036 -
61037 /*
61038 * The "pud_xxx()" functions here are trivial for a folded two-level
61039 * setup: the pmd is never bad, and a pmd always exists (as it's folded
61040 diff -urNp linux-2.6.32.46/include/asm-generic/pgtable-nopud.h linux-2.6.32.46/include/asm-generic/pgtable-nopud.h
61041 --- linux-2.6.32.46/include/asm-generic/pgtable-nopud.h 2011-03-27 14:31:47.000000000 -0400
61042 +++ linux-2.6.32.46/include/asm-generic/pgtable-nopud.h 2011-04-17 15:56:46.000000000 -0400
61043 @@ -1,10 +1,15 @@
61044 #ifndef _PGTABLE_NOPUD_H
61045 #define _PGTABLE_NOPUD_H
61046
61047 -#ifndef __ASSEMBLY__
61048 -
61049 #define __PAGETABLE_PUD_FOLDED
61050
61051 +#define PUD_SHIFT PGDIR_SHIFT
61052 +#define PTRS_PER_PUD 1
61053 +#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
61054 +#define PUD_MASK (~(PUD_SIZE-1))
61055 +
61056 +#ifndef __ASSEMBLY__
61057 +
61058 /*
61059 * Having the pud type consist of a pgd gets the size right, and allows
61060 * us to conceptually access the pgd entry that this pud is folded into
61061 @@ -12,11 +17,6 @@
61062 */
61063 typedef struct { pgd_t pgd; } pud_t;
61064
61065 -#define PUD_SHIFT PGDIR_SHIFT
61066 -#define PTRS_PER_PUD 1
61067 -#define PUD_SIZE (1UL << PUD_SHIFT)
61068 -#define PUD_MASK (~(PUD_SIZE-1))
61069 -
61070 /*
61071 * The "pgd_xxx()" functions here are trivial for a folded two-level
61072 * setup: the pud is never bad, and a pud always exists (as it's folded
61073 diff -urNp linux-2.6.32.46/include/asm-generic/vmlinux.lds.h linux-2.6.32.46/include/asm-generic/vmlinux.lds.h
61074 --- linux-2.6.32.46/include/asm-generic/vmlinux.lds.h 2011-03-27 14:31:47.000000000 -0400
61075 +++ linux-2.6.32.46/include/asm-generic/vmlinux.lds.h 2011-04-17 15:56:46.000000000 -0400
61076 @@ -199,6 +199,7 @@
61077 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
61078 VMLINUX_SYMBOL(__start_rodata) = .; \
61079 *(.rodata) *(.rodata.*) \
61080 + *(.data.read_only) \
61081 *(__vermagic) /* Kernel version magic */ \
61082 *(__markers_strings) /* Markers: strings */ \
61083 *(__tracepoints_strings)/* Tracepoints: strings */ \
61084 @@ -656,22 +657,24 @@
61085 * section in the linker script will go there too. @phdr should have
61086 * a leading colon.
61087 *
61088 - * Note that this macros defines __per_cpu_load as an absolute symbol.
61089 + * Note that this macros defines per_cpu_load as an absolute symbol.
61090 * If there is no need to put the percpu section at a predetermined
61091 * address, use PERCPU().
61092 */
61093 #define PERCPU_VADDR(vaddr, phdr) \
61094 - VMLINUX_SYMBOL(__per_cpu_load) = .; \
61095 - .data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
61096 + per_cpu_load = .; \
61097 + .data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
61098 - LOAD_OFFSET) { \
61099 + VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
61100 VMLINUX_SYMBOL(__per_cpu_start) = .; \
61101 *(.data.percpu.first) \
61102 - *(.data.percpu.page_aligned) \
61103 *(.data.percpu) \
61104 + . = ALIGN(PAGE_SIZE); \
61105 + *(.data.percpu.page_aligned) \
61106 *(.data.percpu.shared_aligned) \
61107 VMLINUX_SYMBOL(__per_cpu_end) = .; \
61108 } phdr \
61109 - . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
61110 + . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
61111
61112 /**
61113 * PERCPU - define output section for percpu area, simple version
61114 diff -urNp linux-2.6.32.46/include/drm/drm_crtc_helper.h linux-2.6.32.46/include/drm/drm_crtc_helper.h
61115 --- linux-2.6.32.46/include/drm/drm_crtc_helper.h 2011-03-27 14:31:47.000000000 -0400
61116 +++ linux-2.6.32.46/include/drm/drm_crtc_helper.h 2011-08-05 20:33:55.000000000 -0400
61117 @@ -64,7 +64,7 @@ struct drm_crtc_helper_funcs {
61118
61119 /* reload the current crtc LUT */
61120 void (*load_lut)(struct drm_crtc *crtc);
61121 -};
61122 +} __no_const;
61123
61124 struct drm_encoder_helper_funcs {
61125 void (*dpms)(struct drm_encoder *encoder, int mode);
61126 @@ -85,7 +85,7 @@ struct drm_encoder_helper_funcs {
61127 struct drm_connector *connector);
61128 /* disable encoder when not in use - more explicit than dpms off */
61129 void (*disable)(struct drm_encoder *encoder);
61130 -};
61131 +} __no_const;
61132
61133 struct drm_connector_helper_funcs {
61134 int (*get_modes)(struct drm_connector *connector);
61135 diff -urNp linux-2.6.32.46/include/drm/drmP.h linux-2.6.32.46/include/drm/drmP.h
61136 --- linux-2.6.32.46/include/drm/drmP.h 2011-03-27 14:31:47.000000000 -0400
61137 +++ linux-2.6.32.46/include/drm/drmP.h 2011-04-17 15:56:46.000000000 -0400
61138 @@ -71,6 +71,7 @@
61139 #include <linux/workqueue.h>
61140 #include <linux/poll.h>
61141 #include <asm/pgalloc.h>
61142 +#include <asm/local.h>
61143 #include "drm.h"
61144
61145 #include <linux/idr.h>
61146 @@ -814,7 +815,7 @@ struct drm_driver {
61147 void (*vgaarb_irq)(struct drm_device *dev, bool state);
61148
61149 /* Driver private ops for this object */
61150 - struct vm_operations_struct *gem_vm_ops;
61151 + const struct vm_operations_struct *gem_vm_ops;
61152
61153 int major;
61154 int minor;
61155 @@ -917,7 +918,7 @@ struct drm_device {
61156
61157 /** \name Usage Counters */
61158 /*@{ */
61159 - int open_count; /**< Outstanding files open */
61160 + local_t open_count; /**< Outstanding files open */
61161 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
61162 atomic_t vma_count; /**< Outstanding vma areas open */
61163 int buf_use; /**< Buffers in use -- cannot alloc */
61164 @@ -928,7 +929,7 @@ struct drm_device {
61165 /*@{ */
61166 unsigned long counters;
61167 enum drm_stat_type types[15];
61168 - atomic_t counts[15];
61169 + atomic_unchecked_t counts[15];
61170 /*@} */
61171
61172 struct list_head filelist;
61173 @@ -1016,7 +1017,7 @@ struct drm_device {
61174 struct pci_controller *hose;
61175 #endif
61176 struct drm_sg_mem *sg; /**< Scatter gather memory */
61177 - unsigned int num_crtcs; /**< Number of CRTCs on this device */
61178 + unsigned int num_crtcs; /**< Number of CRTCs on this device */
61179 void *dev_private; /**< device private data */
61180 void *mm_private;
61181 struct address_space *dev_mapping;
61182 @@ -1042,11 +1043,11 @@ struct drm_device {
61183 spinlock_t object_name_lock;
61184 struct idr object_name_idr;
61185 atomic_t object_count;
61186 - atomic_t object_memory;
61187 + atomic_unchecked_t object_memory;
61188 atomic_t pin_count;
61189 - atomic_t pin_memory;
61190 + atomic_unchecked_t pin_memory;
61191 atomic_t gtt_count;
61192 - atomic_t gtt_memory;
61193 + atomic_unchecked_t gtt_memory;
61194 uint32_t gtt_total;
61195 uint32_t invalidate_domains; /* domains pending invalidation */
61196 uint32_t flush_domains; /* domains pending flush */
61197 diff -urNp linux-2.6.32.46/include/drm/ttm/ttm_memory.h linux-2.6.32.46/include/drm/ttm/ttm_memory.h
61198 --- linux-2.6.32.46/include/drm/ttm/ttm_memory.h 2011-03-27 14:31:47.000000000 -0400
61199 +++ linux-2.6.32.46/include/drm/ttm/ttm_memory.h 2011-08-05 20:33:55.000000000 -0400
61200 @@ -47,7 +47,7 @@
61201
61202 struct ttm_mem_shrink {
61203 int (*do_shrink) (struct ttm_mem_shrink *);
61204 -};
61205 +} __no_const;
61206
61207 /**
61208 * struct ttm_mem_global - Global memory accounting structure.
61209 diff -urNp linux-2.6.32.46/include/linux/a.out.h linux-2.6.32.46/include/linux/a.out.h
61210 --- linux-2.6.32.46/include/linux/a.out.h 2011-03-27 14:31:47.000000000 -0400
61211 +++ linux-2.6.32.46/include/linux/a.out.h 2011-04-17 15:56:46.000000000 -0400
61212 @@ -39,6 +39,14 @@ enum machine_type {
61213 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
61214 };
61215
61216 +/* Constants for the N_FLAGS field */
61217 +#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
61218 +#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
61219 +#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
61220 +#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
61221 +/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
61222 +#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
61223 +
61224 #if !defined (N_MAGIC)
61225 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
61226 #endif
61227 diff -urNp linux-2.6.32.46/include/linux/atmdev.h linux-2.6.32.46/include/linux/atmdev.h
61228 --- linux-2.6.32.46/include/linux/atmdev.h 2011-03-27 14:31:47.000000000 -0400
61229 +++ linux-2.6.32.46/include/linux/atmdev.h 2011-04-17 15:56:46.000000000 -0400
61230 @@ -237,7 +237,7 @@ struct compat_atm_iobuf {
61231 #endif
61232
61233 struct k_atm_aal_stats {
61234 -#define __HANDLE_ITEM(i) atomic_t i
61235 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
61236 __AAL_STAT_ITEMS
61237 #undef __HANDLE_ITEM
61238 };
61239 diff -urNp linux-2.6.32.46/include/linux/backlight.h linux-2.6.32.46/include/linux/backlight.h
61240 --- linux-2.6.32.46/include/linux/backlight.h 2011-03-27 14:31:47.000000000 -0400
61241 +++ linux-2.6.32.46/include/linux/backlight.h 2011-04-17 15:56:46.000000000 -0400
61242 @@ -36,18 +36,18 @@ struct backlight_device;
61243 struct fb_info;
61244
61245 struct backlight_ops {
61246 - unsigned int options;
61247 + const unsigned int options;
61248
61249 #define BL_CORE_SUSPENDRESUME (1 << 0)
61250
61251 /* Notify the backlight driver some property has changed */
61252 - int (*update_status)(struct backlight_device *);
61253 + int (* const update_status)(struct backlight_device *);
61254 /* Return the current backlight brightness (accounting for power,
61255 fb_blank etc.) */
61256 - int (*get_brightness)(struct backlight_device *);
61257 + int (* const get_brightness)(struct backlight_device *);
61258 /* Check if given framebuffer device is the one bound to this backlight;
61259 return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
61260 - int (*check_fb)(struct fb_info *);
61261 + int (* const check_fb)(struct fb_info *);
61262 };
61263
61264 /* This structure defines all the properties of a backlight */
61265 @@ -86,7 +86,7 @@ struct backlight_device {
61266 registered this device has been unloaded, and if class_get_devdata()
61267 points to something in the body of that driver, it is also invalid. */
61268 struct mutex ops_lock;
61269 - struct backlight_ops *ops;
61270 + const struct backlight_ops *ops;
61271
61272 /* The framebuffer notifier block */
61273 struct notifier_block fb_notif;
61274 @@ -103,7 +103,7 @@ static inline void backlight_update_stat
61275 }
61276
61277 extern struct backlight_device *backlight_device_register(const char *name,
61278 - struct device *dev, void *devdata, struct backlight_ops *ops);
61279 + struct device *dev, void *devdata, const struct backlight_ops *ops);
61280 extern void backlight_device_unregister(struct backlight_device *bd);
61281 extern void backlight_force_update(struct backlight_device *bd,
61282 enum backlight_update_reason reason);
61283 diff -urNp linux-2.6.32.46/include/linux/binfmts.h linux-2.6.32.46/include/linux/binfmts.h
61284 --- linux-2.6.32.46/include/linux/binfmts.h 2011-04-17 17:00:52.000000000 -0400
61285 +++ linux-2.6.32.46/include/linux/binfmts.h 2011-04-17 15:56:46.000000000 -0400
61286 @@ -83,6 +83,7 @@ struct linux_binfmt {
61287 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
61288 int (*load_shlib)(struct file *);
61289 int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
61290 + void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
61291 unsigned long min_coredump; /* minimal dump size */
61292 int hasvdso;
61293 };
61294 diff -urNp linux-2.6.32.46/include/linux/blkdev.h linux-2.6.32.46/include/linux/blkdev.h
61295 --- linux-2.6.32.46/include/linux/blkdev.h 2011-03-27 14:31:47.000000000 -0400
61296 +++ linux-2.6.32.46/include/linux/blkdev.h 2011-08-26 20:27:21.000000000 -0400
61297 @@ -1278,7 +1278,7 @@ struct block_device_operations {
61298 int (*revalidate_disk) (struct gendisk *);
61299 int (*getgeo)(struct block_device *, struct hd_geometry *);
61300 struct module *owner;
61301 -};
61302 +} __do_const;
61303
61304 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
61305 unsigned long);
61306 diff -urNp linux-2.6.32.46/include/linux/blktrace_api.h linux-2.6.32.46/include/linux/blktrace_api.h
61307 --- linux-2.6.32.46/include/linux/blktrace_api.h 2011-03-27 14:31:47.000000000 -0400
61308 +++ linux-2.6.32.46/include/linux/blktrace_api.h 2011-05-04 17:56:28.000000000 -0400
61309 @@ -160,7 +160,7 @@ struct blk_trace {
61310 struct dentry *dir;
61311 struct dentry *dropped_file;
61312 struct dentry *msg_file;
61313 - atomic_t dropped;
61314 + atomic_unchecked_t dropped;
61315 };
61316
61317 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
61318 diff -urNp linux-2.6.32.46/include/linux/byteorder/little_endian.h linux-2.6.32.46/include/linux/byteorder/little_endian.h
61319 --- linux-2.6.32.46/include/linux/byteorder/little_endian.h 2011-03-27 14:31:47.000000000 -0400
61320 +++ linux-2.6.32.46/include/linux/byteorder/little_endian.h 2011-04-17 15:56:46.000000000 -0400
61321 @@ -42,51 +42,51 @@
61322
61323 static inline __le64 __cpu_to_le64p(const __u64 *p)
61324 {
61325 - return (__force __le64)*p;
61326 + return (__force const __le64)*p;
61327 }
61328 static inline __u64 __le64_to_cpup(const __le64 *p)
61329 {
61330 - return (__force __u64)*p;
61331 + return (__force const __u64)*p;
61332 }
61333 static inline __le32 __cpu_to_le32p(const __u32 *p)
61334 {
61335 - return (__force __le32)*p;
61336 + return (__force const __le32)*p;
61337 }
61338 static inline __u32 __le32_to_cpup(const __le32 *p)
61339 {
61340 - return (__force __u32)*p;
61341 + return (__force const __u32)*p;
61342 }
61343 static inline __le16 __cpu_to_le16p(const __u16 *p)
61344 {
61345 - return (__force __le16)*p;
61346 + return (__force const __le16)*p;
61347 }
61348 static inline __u16 __le16_to_cpup(const __le16 *p)
61349 {
61350 - return (__force __u16)*p;
61351 + return (__force const __u16)*p;
61352 }
61353 static inline __be64 __cpu_to_be64p(const __u64 *p)
61354 {
61355 - return (__force __be64)__swab64p(p);
61356 + return (__force const __be64)__swab64p(p);
61357 }
61358 static inline __u64 __be64_to_cpup(const __be64 *p)
61359 {
61360 - return __swab64p((__u64 *)p);
61361 + return __swab64p((const __u64 *)p);
61362 }
61363 static inline __be32 __cpu_to_be32p(const __u32 *p)
61364 {
61365 - return (__force __be32)__swab32p(p);
61366 + return (__force const __be32)__swab32p(p);
61367 }
61368 static inline __u32 __be32_to_cpup(const __be32 *p)
61369 {
61370 - return __swab32p((__u32 *)p);
61371 + return __swab32p((const __u32 *)p);
61372 }
61373 static inline __be16 __cpu_to_be16p(const __u16 *p)
61374 {
61375 - return (__force __be16)__swab16p(p);
61376 + return (__force const __be16)__swab16p(p);
61377 }
61378 static inline __u16 __be16_to_cpup(const __be16 *p)
61379 {
61380 - return __swab16p((__u16 *)p);
61381 + return __swab16p((const __u16 *)p);
61382 }
61383 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
61384 #define __le64_to_cpus(x) do { (void)(x); } while (0)
61385 diff -urNp linux-2.6.32.46/include/linux/cache.h linux-2.6.32.46/include/linux/cache.h
61386 --- linux-2.6.32.46/include/linux/cache.h 2011-03-27 14:31:47.000000000 -0400
61387 +++ linux-2.6.32.46/include/linux/cache.h 2011-04-17 15:56:46.000000000 -0400
61388 @@ -16,6 +16,10 @@
61389 #define __read_mostly
61390 #endif
61391
61392 +#ifndef __read_only
61393 +#define __read_only __read_mostly
61394 +#endif
61395 +
61396 #ifndef ____cacheline_aligned
61397 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
61398 #endif
61399 diff -urNp linux-2.6.32.46/include/linux/capability.h linux-2.6.32.46/include/linux/capability.h
61400 --- linux-2.6.32.46/include/linux/capability.h 2011-03-27 14:31:47.000000000 -0400
61401 +++ linux-2.6.32.46/include/linux/capability.h 2011-04-17 15:56:46.000000000 -0400
61402 @@ -563,6 +563,7 @@ extern const kernel_cap_t __cap_init_eff
61403 (security_real_capable_noaudit((t), (cap)) == 0)
61404
61405 extern int capable(int cap);
61406 +int capable_nolog(int cap);
61407
61408 /* audit system wants to get cap info from files as well */
61409 struct dentry;
61410 diff -urNp linux-2.6.32.46/include/linux/compiler-gcc4.h linux-2.6.32.46/include/linux/compiler-gcc4.h
61411 --- linux-2.6.32.46/include/linux/compiler-gcc4.h 2011-03-27 14:31:47.000000000 -0400
61412 +++ linux-2.6.32.46/include/linux/compiler-gcc4.h 2011-08-26 20:19:09.000000000 -0400
61413 @@ -36,4 +36,16 @@
61414 the kernel context */
61415 #define __cold __attribute__((__cold__))
61416
61417 +#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
61418 +#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
61419 +#define __bos0(ptr) __bos((ptr), 0)
61420 +#define __bos1(ptr) __bos((ptr), 1)
61421 +
61422 +#if __GNUC_MINOR__ >= 5
61423 +#ifdef CONSTIFY_PLUGIN
61424 +#define __no_const __attribute__((no_const))
61425 +#define __do_const __attribute__((do_const))
61426 +#endif
61427 +#endif
61428 +
61429 #endif
61430 diff -urNp linux-2.6.32.46/include/linux/compiler.h linux-2.6.32.46/include/linux/compiler.h
61431 --- linux-2.6.32.46/include/linux/compiler.h 2011-03-27 14:31:47.000000000 -0400
61432 +++ linux-2.6.32.46/include/linux/compiler.h 2011-10-06 09:37:14.000000000 -0400
61433 @@ -5,11 +5,14 @@
61434
61435 #ifdef __CHECKER__
61436 # define __user __attribute__((noderef, address_space(1)))
61437 +# define __force_user __force __user
61438 # define __kernel /* default address space */
61439 +# define __force_kernel __force __kernel
61440 # define __safe __attribute__((safe))
61441 # define __force __attribute__((force))
61442 # define __nocast __attribute__((nocast))
61443 # define __iomem __attribute__((noderef, address_space(2)))
61444 +# define __force_iomem __force __iomem
61445 # define __acquires(x) __attribute__((context(x,0,1)))
61446 # define __releases(x) __attribute__((context(x,1,0)))
61447 # define __acquire(x) __context__(x,1)
61448 @@ -17,13 +20,34 @@
61449 # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0)
61450 extern void __chk_user_ptr(const volatile void __user *);
61451 extern void __chk_io_ptr(const volatile void __iomem *);
61452 +#elif defined(CHECKER_PLUGIN)
61453 +//# define __user
61454 +//# define __force_user
61455 +//# define __kernel
61456 +//# define __force_kernel
61457 +# define __safe
61458 +# define __force
61459 +# define __nocast
61460 +# define __iomem
61461 +# define __force_iomem
61462 +# define __chk_user_ptr(x) (void)0
61463 +# define __chk_io_ptr(x) (void)0
61464 +# define __builtin_warning(x, y...) (1)
61465 +# define __acquires(x)
61466 +# define __releases(x)
61467 +# define __acquire(x) (void)0
61468 +# define __release(x) (void)0
61469 +# define __cond_lock(x,c) (c)
61470 #else
61471 # define __user
61472 +# define __force_user
61473 # define __kernel
61474 +# define __force_kernel
61475 # define __safe
61476 # define __force
61477 # define __nocast
61478 # define __iomem
61479 +# define __force_iomem
61480 # define __chk_user_ptr(x) (void)0
61481 # define __chk_io_ptr(x) (void)0
61482 # define __builtin_warning(x, y...) (1)
61483 @@ -247,6 +271,14 @@ void ftrace_likely_update(struct ftrace_
61484 # define __attribute_const__ /* unimplemented */
61485 #endif
61486
61487 +#ifndef __no_const
61488 +# define __no_const
61489 +#endif
61490 +
61491 +#ifndef __do_const
61492 +# define __do_const
61493 +#endif
61494 +
61495 /*
61496 * Tell gcc if a function is cold. The compiler will assume any path
61497 * directly leading to the call is unlikely.
61498 @@ -256,6 +288,22 @@ void ftrace_likely_update(struct ftrace_
61499 #define __cold
61500 #endif
61501
61502 +#ifndef __alloc_size
61503 +#define __alloc_size(...)
61504 +#endif
61505 +
61506 +#ifndef __bos
61507 +#define __bos(ptr, arg)
61508 +#endif
61509 +
61510 +#ifndef __bos0
61511 +#define __bos0(ptr)
61512 +#endif
61513 +
61514 +#ifndef __bos1
61515 +#define __bos1(ptr)
61516 +#endif
61517 +
61518 /* Simple shorthand for a section definition */
61519 #ifndef __section
61520 # define __section(S) __attribute__ ((__section__(#S)))
61521 @@ -278,6 +326,7 @@ void ftrace_likely_update(struct ftrace_
61522 * use is to mediate communication between process-level code and irq/NMI
61523 * handlers, all running on the same CPU.
61524 */
61525 -#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
61526 +#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
61527 +#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
61528
61529 #endif /* __LINUX_COMPILER_H */
61530 diff -urNp linux-2.6.32.46/include/linux/crypto.h linux-2.6.32.46/include/linux/crypto.h
61531 --- linux-2.6.32.46/include/linux/crypto.h 2011-03-27 14:31:47.000000000 -0400
61532 +++ linux-2.6.32.46/include/linux/crypto.h 2011-08-05 20:33:55.000000000 -0400
61533 @@ -394,7 +394,7 @@ struct cipher_tfm {
61534 const u8 *key, unsigned int keylen);
61535 void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
61536 void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
61537 -};
61538 +} __no_const;
61539
61540 struct hash_tfm {
61541 int (*init)(struct hash_desc *desc);
61542 @@ -415,13 +415,13 @@ struct compress_tfm {
61543 int (*cot_decompress)(struct crypto_tfm *tfm,
61544 const u8 *src, unsigned int slen,
61545 u8 *dst, unsigned int *dlen);
61546 -};
61547 +} __no_const;
61548
61549 struct rng_tfm {
61550 int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
61551 unsigned int dlen);
61552 int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
61553 -};
61554 +} __no_const;
61555
61556 #define crt_ablkcipher crt_u.ablkcipher
61557 #define crt_aead crt_u.aead
61558 diff -urNp linux-2.6.32.46/include/linux/dcache.h linux-2.6.32.46/include/linux/dcache.h
61559 --- linux-2.6.32.46/include/linux/dcache.h 2011-03-27 14:31:47.000000000 -0400
61560 +++ linux-2.6.32.46/include/linux/dcache.h 2011-04-23 13:34:46.000000000 -0400
61561 @@ -119,6 +119,8 @@ struct dentry {
61562 unsigned char d_iname[DNAME_INLINE_LEN_MIN]; /* small names */
61563 };
61564
61565 +#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
61566 +
61567 /*
61568 * dentry->d_lock spinlock nesting subclasses:
61569 *
61570 diff -urNp linux-2.6.32.46/include/linux/decompress/mm.h linux-2.6.32.46/include/linux/decompress/mm.h
61571 --- linux-2.6.32.46/include/linux/decompress/mm.h 2011-03-27 14:31:47.000000000 -0400
61572 +++ linux-2.6.32.46/include/linux/decompress/mm.h 2011-04-17 15:56:46.000000000 -0400
61573 @@ -78,7 +78,7 @@ static void free(void *where)
61574 * warnings when not needed (indeed large_malloc / large_free are not
61575 * needed by inflate */
61576
61577 -#define malloc(a) kmalloc(a, GFP_KERNEL)
61578 +#define malloc(a) kmalloc((a), GFP_KERNEL)
61579 #define free(a) kfree(a)
61580
61581 #define large_malloc(a) vmalloc(a)
61582 diff -urNp linux-2.6.32.46/include/linux/dma-mapping.h linux-2.6.32.46/include/linux/dma-mapping.h
61583 --- linux-2.6.32.46/include/linux/dma-mapping.h 2011-03-27 14:31:47.000000000 -0400
61584 +++ linux-2.6.32.46/include/linux/dma-mapping.h 2011-08-26 20:19:09.000000000 -0400
61585 @@ -16,51 +16,51 @@ enum dma_data_direction {
61586 };
61587
61588 struct dma_map_ops {
61589 - void* (*alloc_coherent)(struct device *dev, size_t size,
61590 + void* (* const alloc_coherent)(struct device *dev, size_t size,
61591 dma_addr_t *dma_handle, gfp_t gfp);
61592 - void (*free_coherent)(struct device *dev, size_t size,
61593 + void (* const free_coherent)(struct device *dev, size_t size,
61594 void *vaddr, dma_addr_t dma_handle);
61595 - dma_addr_t (*map_page)(struct device *dev, struct page *page,
61596 + dma_addr_t (* const map_page)(struct device *dev, struct page *page,
61597 unsigned long offset, size_t size,
61598 enum dma_data_direction dir,
61599 struct dma_attrs *attrs);
61600 - void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
61601 + void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
61602 size_t size, enum dma_data_direction dir,
61603 struct dma_attrs *attrs);
61604 - int (*map_sg)(struct device *dev, struct scatterlist *sg,
61605 + int (* const map_sg)(struct device *dev, struct scatterlist *sg,
61606 int nents, enum dma_data_direction dir,
61607 struct dma_attrs *attrs);
61608 - void (*unmap_sg)(struct device *dev,
61609 + void (* const unmap_sg)(struct device *dev,
61610 struct scatterlist *sg, int nents,
61611 enum dma_data_direction dir,
61612 struct dma_attrs *attrs);
61613 - void (*sync_single_for_cpu)(struct device *dev,
61614 + void (* const sync_single_for_cpu)(struct device *dev,
61615 dma_addr_t dma_handle, size_t size,
61616 enum dma_data_direction dir);
61617 - void (*sync_single_for_device)(struct device *dev,
61618 + void (* const sync_single_for_device)(struct device *dev,
61619 dma_addr_t dma_handle, size_t size,
61620 enum dma_data_direction dir);
61621 - void (*sync_single_range_for_cpu)(struct device *dev,
61622 + void (* const sync_single_range_for_cpu)(struct device *dev,
61623 dma_addr_t dma_handle,
61624 unsigned long offset,
61625 size_t size,
61626 enum dma_data_direction dir);
61627 - void (*sync_single_range_for_device)(struct device *dev,
61628 + void (* const sync_single_range_for_device)(struct device *dev,
61629 dma_addr_t dma_handle,
61630 unsigned long offset,
61631 size_t size,
61632 enum dma_data_direction dir);
61633 - void (*sync_sg_for_cpu)(struct device *dev,
61634 + void (* const sync_sg_for_cpu)(struct device *dev,
61635 struct scatterlist *sg, int nents,
61636 enum dma_data_direction dir);
61637 - void (*sync_sg_for_device)(struct device *dev,
61638 + void (* const sync_sg_for_device)(struct device *dev,
61639 struct scatterlist *sg, int nents,
61640 enum dma_data_direction dir);
61641 - int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
61642 - int (*dma_supported)(struct device *dev, u64 mask);
61643 + int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
61644 + int (* const dma_supported)(struct device *dev, u64 mask);
61645 int (*set_dma_mask)(struct device *dev, u64 mask);
61646 int is_phys;
61647 -};
61648 +} __do_const;
61649
61650 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
61651
61652 diff -urNp linux-2.6.32.46/include/linux/dst.h linux-2.6.32.46/include/linux/dst.h
61653 --- linux-2.6.32.46/include/linux/dst.h 2011-03-27 14:31:47.000000000 -0400
61654 +++ linux-2.6.32.46/include/linux/dst.h 2011-04-17 15:56:46.000000000 -0400
61655 @@ -380,7 +380,7 @@ struct dst_node
61656 struct thread_pool *pool;
61657
61658 /* Transaction IDs live here */
61659 - atomic_long_t gen;
61660 + atomic_long_unchecked_t gen;
61661
61662 /*
61663 * How frequently and how many times transaction
61664 diff -urNp linux-2.6.32.46/include/linux/elf.h linux-2.6.32.46/include/linux/elf.h
61665 --- linux-2.6.32.46/include/linux/elf.h 2011-03-27 14:31:47.000000000 -0400
61666 +++ linux-2.6.32.46/include/linux/elf.h 2011-04-17 15:56:46.000000000 -0400
61667 @@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
61668 #define PT_GNU_EH_FRAME 0x6474e550
61669
61670 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
61671 +#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
61672 +
61673 +#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
61674 +
61675 +/* Constants for the e_flags field */
61676 +#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
61677 +#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
61678 +#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
61679 +#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
61680 +/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
61681 +#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
61682
61683 /* These constants define the different elf file types */
61684 #define ET_NONE 0
61685 @@ -84,6 +95,8 @@ typedef __s64 Elf64_Sxword;
61686 #define DT_DEBUG 21
61687 #define DT_TEXTREL 22
61688 #define DT_JMPREL 23
61689 +#define DT_FLAGS 30
61690 + #define DF_TEXTREL 0x00000004
61691 #define DT_ENCODING 32
61692 #define OLD_DT_LOOS 0x60000000
61693 #define DT_LOOS 0x6000000d
61694 @@ -230,6 +243,19 @@ typedef struct elf64_hdr {
61695 #define PF_W 0x2
61696 #define PF_X 0x1
61697
61698 +#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
61699 +#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
61700 +#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
61701 +#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
61702 +#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
61703 +#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
61704 +/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
61705 +/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
61706 +#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
61707 +#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
61708 +#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
61709 +#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
61710 +
61711 typedef struct elf32_phdr{
61712 Elf32_Word p_type;
61713 Elf32_Off p_offset;
61714 @@ -322,6 +348,8 @@ typedef struct elf64_shdr {
61715 #define EI_OSABI 7
61716 #define EI_PAD 8
61717
61718 +#define EI_PAX 14
61719 +
61720 #define ELFMAG0 0x7f /* EI_MAG */
61721 #define ELFMAG1 'E'
61722 #define ELFMAG2 'L'
61723 @@ -386,6 +414,7 @@ extern Elf32_Dyn _DYNAMIC [];
61724 #define elf_phdr elf32_phdr
61725 #define elf_note elf32_note
61726 #define elf_addr_t Elf32_Off
61727 +#define elf_dyn Elf32_Dyn
61728
61729 #else
61730
61731 @@ -394,6 +423,7 @@ extern Elf64_Dyn _DYNAMIC [];
61732 #define elf_phdr elf64_phdr
61733 #define elf_note elf64_note
61734 #define elf_addr_t Elf64_Off
61735 +#define elf_dyn Elf64_Dyn
61736
61737 #endif
61738
61739 diff -urNp linux-2.6.32.46/include/linux/fscache-cache.h linux-2.6.32.46/include/linux/fscache-cache.h
61740 --- linux-2.6.32.46/include/linux/fscache-cache.h 2011-03-27 14:31:47.000000000 -0400
61741 +++ linux-2.6.32.46/include/linux/fscache-cache.h 2011-05-04 17:56:28.000000000 -0400
61742 @@ -116,7 +116,7 @@ struct fscache_operation {
61743 #endif
61744 };
61745
61746 -extern atomic_t fscache_op_debug_id;
61747 +extern atomic_unchecked_t fscache_op_debug_id;
61748 extern const struct slow_work_ops fscache_op_slow_work_ops;
61749
61750 extern void fscache_enqueue_operation(struct fscache_operation *);
61751 @@ -134,7 +134,7 @@ static inline void fscache_operation_ini
61752 fscache_operation_release_t release)
61753 {
61754 atomic_set(&op->usage, 1);
61755 - op->debug_id = atomic_inc_return(&fscache_op_debug_id);
61756 + op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
61757 op->release = release;
61758 INIT_LIST_HEAD(&op->pend_link);
61759 fscache_set_op_state(op, "Init");
61760 diff -urNp linux-2.6.32.46/include/linux/fs.h linux-2.6.32.46/include/linux/fs.h
61761 --- linux-2.6.32.46/include/linux/fs.h 2011-07-13 17:23:04.000000000 -0400
61762 +++ linux-2.6.32.46/include/linux/fs.h 2011-08-26 20:19:09.000000000 -0400
61763 @@ -90,6 +90,11 @@ struct inodes_stat_t {
61764 /* Expect random access pattern */
61765 #define FMODE_RANDOM ((__force fmode_t)4096)
61766
61767 +/* Hack for grsec so as not to require read permission simply to execute
61768 + * a binary
61769 + */
61770 +#define FMODE_GREXEC ((__force fmode_t)0x2000000)
61771 +
61772 /*
61773 * The below are the various read and write types that we support. Some of
61774 * them include behavioral modifiers that send information down to the
61775 @@ -568,41 +573,41 @@ typedef int (*read_actor_t)(read_descrip
61776 unsigned long, unsigned long);
61777
61778 struct address_space_operations {
61779 - int (*writepage)(struct page *page, struct writeback_control *wbc);
61780 - int (*readpage)(struct file *, struct page *);
61781 - void (*sync_page)(struct page *);
61782 + int (* const writepage)(struct page *page, struct writeback_control *wbc);
61783 + int (* const readpage)(struct file *, struct page *);
61784 + void (* const sync_page)(struct page *);
61785
61786 /* Write back some dirty pages from this mapping. */
61787 - int (*writepages)(struct address_space *, struct writeback_control *);
61788 + int (* const writepages)(struct address_space *, struct writeback_control *);
61789
61790 /* Set a page dirty. Return true if this dirtied it */
61791 - int (*set_page_dirty)(struct page *page);
61792 + int (* const set_page_dirty)(struct page *page);
61793
61794 - int (*readpages)(struct file *filp, struct address_space *mapping,
61795 + int (* const readpages)(struct file *filp, struct address_space *mapping,
61796 struct list_head *pages, unsigned nr_pages);
61797
61798 - int (*write_begin)(struct file *, struct address_space *mapping,
61799 + int (* const write_begin)(struct file *, struct address_space *mapping,
61800 loff_t pos, unsigned len, unsigned flags,
61801 struct page **pagep, void **fsdata);
61802 - int (*write_end)(struct file *, struct address_space *mapping,
61803 + int (* const write_end)(struct file *, struct address_space *mapping,
61804 loff_t pos, unsigned len, unsigned copied,
61805 struct page *page, void *fsdata);
61806
61807 /* Unfortunately this kludge is needed for FIBMAP. Don't use it */
61808 - sector_t (*bmap)(struct address_space *, sector_t);
61809 - void (*invalidatepage) (struct page *, unsigned long);
61810 - int (*releasepage) (struct page *, gfp_t);
61811 - ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
61812 + sector_t (* const bmap)(struct address_space *, sector_t);
61813 + void (* const invalidatepage) (struct page *, unsigned long);
61814 + int (* const releasepage) (struct page *, gfp_t);
61815 + ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
61816 loff_t offset, unsigned long nr_segs);
61817 - int (*get_xip_mem)(struct address_space *, pgoff_t, int,
61818 + int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
61819 void **, unsigned long *);
61820 /* migrate the contents of a page to the specified target */
61821 - int (*migratepage) (struct address_space *,
61822 + int (* const migratepage) (struct address_space *,
61823 struct page *, struct page *);
61824 - int (*launder_page) (struct page *);
61825 - int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
61826 + int (* const launder_page) (struct page *);
61827 + int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
61828 unsigned long);
61829 - int (*error_remove_page)(struct address_space *, struct page *);
61830 + int (* const error_remove_page)(struct address_space *, struct page *);
61831 };
61832
61833 /*
61834 @@ -1031,19 +1036,19 @@ static inline int file_check_writeable(s
61835 typedef struct files_struct *fl_owner_t;
61836
61837 struct file_lock_operations {
61838 - void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
61839 - void (*fl_release_private)(struct file_lock *);
61840 + void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
61841 + void (* const fl_release_private)(struct file_lock *);
61842 };
61843
61844 struct lock_manager_operations {
61845 - int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
61846 - void (*fl_notify)(struct file_lock *); /* unblock callback */
61847 - int (*fl_grant)(struct file_lock *, struct file_lock *, int);
61848 - void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
61849 - void (*fl_release_private)(struct file_lock *);
61850 - void (*fl_break)(struct file_lock *);
61851 - int (*fl_mylease)(struct file_lock *, struct file_lock *);
61852 - int (*fl_change)(struct file_lock **, int);
61853 + int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
61854 + void (* const fl_notify)(struct file_lock *); /* unblock callback */
61855 + int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
61856 + void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
61857 + void (* const fl_release_private)(struct file_lock *);
61858 + void (* const fl_break)(struct file_lock *);
61859 + int (* const fl_mylease)(struct file_lock *, struct file_lock *);
61860 + int (* const fl_change)(struct file_lock **, int);
61861 };
61862
61863 struct lock_manager {
61864 @@ -1442,7 +1447,7 @@ struct fiemap_extent_info {
61865 unsigned int fi_flags; /* Flags as passed from user */
61866 unsigned int fi_extents_mapped; /* Number of mapped extents */
61867 unsigned int fi_extents_max; /* Size of fiemap_extent array */
61868 - struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
61869 + struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
61870 * array */
61871 };
61872 int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
61873 @@ -1512,7 +1517,8 @@ struct file_operations {
61874 ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int);
61875 ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int);
61876 int (*setlease)(struct file *, long, struct file_lock **);
61877 -};
61878 +} __do_const;
61879 +typedef struct file_operations __no_const file_operations_no_const;
61880
61881 struct inode_operations {
61882 int (*create) (struct inode *,struct dentry *,int, struct nameidata *);
61883 @@ -1559,30 +1565,30 @@ extern ssize_t vfs_writev(struct file *,
61884 unsigned long, loff_t *);
61885
61886 struct super_operations {
61887 - struct inode *(*alloc_inode)(struct super_block *sb);
61888 - void (*destroy_inode)(struct inode *);
61889 + struct inode *(* const alloc_inode)(struct super_block *sb);
61890 + void (* const destroy_inode)(struct inode *);
61891
61892 - void (*dirty_inode) (struct inode *);
61893 - int (*write_inode) (struct inode *, int);
61894 - void (*drop_inode) (struct inode *);
61895 - void (*delete_inode) (struct inode *);
61896 - void (*put_super) (struct super_block *);
61897 - void (*write_super) (struct super_block *);
61898 - int (*sync_fs)(struct super_block *sb, int wait);
61899 - int (*freeze_fs) (struct super_block *);
61900 - int (*unfreeze_fs) (struct super_block *);
61901 - int (*statfs) (struct dentry *, struct kstatfs *);
61902 - int (*remount_fs) (struct super_block *, int *, char *);
61903 - void (*clear_inode) (struct inode *);
61904 - void (*umount_begin) (struct super_block *);
61905 + void (* const dirty_inode) (struct inode *);
61906 + int (* const write_inode) (struct inode *, int);
61907 + void (* const drop_inode) (struct inode *);
61908 + void (* const delete_inode) (struct inode *);
61909 + void (* const put_super) (struct super_block *);
61910 + void (* const write_super) (struct super_block *);
61911 + int (* const sync_fs)(struct super_block *sb, int wait);
61912 + int (* const freeze_fs) (struct super_block *);
61913 + int (* const unfreeze_fs) (struct super_block *);
61914 + int (* const statfs) (struct dentry *, struct kstatfs *);
61915 + int (* const remount_fs) (struct super_block *, int *, char *);
61916 + void (* const clear_inode) (struct inode *);
61917 + void (* const umount_begin) (struct super_block *);
61918
61919 - int (*show_options)(struct seq_file *, struct vfsmount *);
61920 - int (*show_stats)(struct seq_file *, struct vfsmount *);
61921 + int (* const show_options)(struct seq_file *, struct vfsmount *);
61922 + int (* const show_stats)(struct seq_file *, struct vfsmount *);
61923 #ifdef CONFIG_QUOTA
61924 - ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
61925 - ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
61926 + ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
61927 + ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
61928 #endif
61929 - int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
61930 + int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
61931 };
61932
61933 /*
61934 diff -urNp linux-2.6.32.46/include/linux/fs_struct.h linux-2.6.32.46/include/linux/fs_struct.h
61935 --- linux-2.6.32.46/include/linux/fs_struct.h 2011-03-27 14:31:47.000000000 -0400
61936 +++ linux-2.6.32.46/include/linux/fs_struct.h 2011-04-17 15:56:46.000000000 -0400
61937 @@ -4,7 +4,7 @@
61938 #include <linux/path.h>
61939
61940 struct fs_struct {
61941 - int users;
61942 + atomic_t users;
61943 rwlock_t lock;
61944 int umask;
61945 int in_exec;
61946 diff -urNp linux-2.6.32.46/include/linux/ftrace_event.h linux-2.6.32.46/include/linux/ftrace_event.h
61947 --- linux-2.6.32.46/include/linux/ftrace_event.h 2011-03-27 14:31:47.000000000 -0400
61948 +++ linux-2.6.32.46/include/linux/ftrace_event.h 2011-05-04 17:56:28.000000000 -0400
61949 @@ -163,7 +163,7 @@ extern int trace_define_field(struct ftr
61950 int filter_type);
61951 extern int trace_define_common_fields(struct ftrace_event_call *call);
61952
61953 -#define is_signed_type(type) (((type)(-1)) < 0)
61954 +#define is_signed_type(type) (((type)(-1)) < (type)1)
61955
61956 int trace_set_clr_event(const char *system, const char *event, int set);
61957
61958 diff -urNp linux-2.6.32.46/include/linux/genhd.h linux-2.6.32.46/include/linux/genhd.h
61959 --- linux-2.6.32.46/include/linux/genhd.h 2011-03-27 14:31:47.000000000 -0400
61960 +++ linux-2.6.32.46/include/linux/genhd.h 2011-04-17 15:56:46.000000000 -0400
61961 @@ -161,7 +161,7 @@ struct gendisk {
61962
61963 struct timer_rand_state *random;
61964
61965 - atomic_t sync_io; /* RAID */
61966 + atomic_unchecked_t sync_io; /* RAID */
61967 struct work_struct async_notify;
61968 #ifdef CONFIG_BLK_DEV_INTEGRITY
61969 struct blk_integrity *integrity;
61970 diff -urNp linux-2.6.32.46/include/linux/gracl.h linux-2.6.32.46/include/linux/gracl.h
61971 --- linux-2.6.32.46/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500
61972 +++ linux-2.6.32.46/include/linux/gracl.h 2011-04-17 15:56:46.000000000 -0400
61973 @@ -0,0 +1,317 @@
61974 +#ifndef GR_ACL_H
61975 +#define GR_ACL_H
61976 +
61977 +#include <linux/grdefs.h>
61978 +#include <linux/resource.h>
61979 +#include <linux/capability.h>
61980 +#include <linux/dcache.h>
61981 +#include <asm/resource.h>
61982 +
61983 +/* Major status information */
61984 +
61985 +#define GR_VERSION "grsecurity 2.2.2"
61986 +#define GRSECURITY_VERSION 0x2202
61987 +
61988 +enum {
61989 + GR_SHUTDOWN = 0,
61990 + GR_ENABLE = 1,
61991 + GR_SPROLE = 2,
61992 + GR_RELOAD = 3,
61993 + GR_SEGVMOD = 4,
61994 + GR_STATUS = 5,
61995 + GR_UNSPROLE = 6,
61996 + GR_PASSSET = 7,
61997 + GR_SPROLEPAM = 8,
61998 +};
61999 +
62000 +/* Password setup definitions
62001 + * kernel/grhash.c */
62002 +enum {
62003 + GR_PW_LEN = 128,
62004 + GR_SALT_LEN = 16,
62005 + GR_SHA_LEN = 32,
62006 +};
62007 +
62008 +enum {
62009 + GR_SPROLE_LEN = 64,
62010 +};
62011 +
62012 +enum {
62013 + GR_NO_GLOB = 0,
62014 + GR_REG_GLOB,
62015 + GR_CREATE_GLOB
62016 +};
62017 +
62018 +#define GR_NLIMITS 32
62019 +
62020 +/* Begin Data Structures */
62021 +
62022 +struct sprole_pw {
62023 + unsigned char *rolename;
62024 + unsigned char salt[GR_SALT_LEN];
62025 + unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
62026 +};
62027 +
62028 +struct name_entry {
62029 + __u32 key;
62030 + ino_t inode;
62031 + dev_t device;
62032 + char *name;
62033 + __u16 len;
62034 + __u8 deleted;
62035 + struct name_entry *prev;
62036 + struct name_entry *next;
62037 +};
62038 +
62039 +struct inodev_entry {
62040 + struct name_entry *nentry;
62041 + struct inodev_entry *prev;
62042 + struct inodev_entry *next;
62043 +};
62044 +
62045 +struct acl_role_db {
62046 + struct acl_role_label **r_hash;
62047 + __u32 r_size;
62048 +};
62049 +
62050 +struct inodev_db {
62051 + struct inodev_entry **i_hash;
62052 + __u32 i_size;
62053 +};
62054 +
62055 +struct name_db {
62056 + struct name_entry **n_hash;
62057 + __u32 n_size;
62058 +};
62059 +
62060 +struct crash_uid {
62061 + uid_t uid;
62062 + unsigned long expires;
62063 +};
62064 +
62065 +struct gr_hash_struct {
62066 + void **table;
62067 + void **nametable;
62068 + void *first;
62069 + __u32 table_size;
62070 + __u32 used_size;
62071 + int type;
62072 +};
62073 +
62074 +/* Userspace Grsecurity ACL data structures */
62075 +
62076 +struct acl_subject_label {
62077 + char *filename;
62078 + ino_t inode;
62079 + dev_t device;
62080 + __u32 mode;
62081 + kernel_cap_t cap_mask;
62082 + kernel_cap_t cap_lower;
62083 + kernel_cap_t cap_invert_audit;
62084 +
62085 + struct rlimit res[GR_NLIMITS];
62086 + __u32 resmask;
62087 +
62088 + __u8 user_trans_type;
62089 + __u8 group_trans_type;
62090 + uid_t *user_transitions;
62091 + gid_t *group_transitions;
62092 + __u16 user_trans_num;
62093 + __u16 group_trans_num;
62094 +
62095 + __u32 sock_families[2];
62096 + __u32 ip_proto[8];
62097 + __u32 ip_type;
62098 + struct acl_ip_label **ips;
62099 + __u32 ip_num;
62100 + __u32 inaddr_any_override;
62101 +
62102 + __u32 crashes;
62103 + unsigned long expires;
62104 +
62105 + struct acl_subject_label *parent_subject;
62106 + struct gr_hash_struct *hash;
62107 + struct acl_subject_label *prev;
62108 + struct acl_subject_label *next;
62109 +
62110 + struct acl_object_label **obj_hash;
62111 + __u32 obj_hash_size;
62112 + __u16 pax_flags;
62113 +};
62114 +
62115 +struct role_allowed_ip {
62116 + __u32 addr;
62117 + __u32 netmask;
62118 +
62119 + struct role_allowed_ip *prev;
62120 + struct role_allowed_ip *next;
62121 +};
62122 +
62123 +struct role_transition {
62124 + char *rolename;
62125 +
62126 + struct role_transition *prev;
62127 + struct role_transition *next;
62128 +};
62129 +
62130 +struct acl_role_label {
62131 + char *rolename;
62132 + uid_t uidgid;
62133 + __u16 roletype;
62134 +
62135 + __u16 auth_attempts;
62136 + unsigned long expires;
62137 +
62138 + struct acl_subject_label *root_label;
62139 + struct gr_hash_struct *hash;
62140 +
62141 + struct acl_role_label *prev;
62142 + struct acl_role_label *next;
62143 +
62144 + struct role_transition *transitions;
62145 + struct role_allowed_ip *allowed_ips;
62146 + uid_t *domain_children;
62147 + __u16 domain_child_num;
62148 +
62149 + struct acl_subject_label **subj_hash;
62150 + __u32 subj_hash_size;
62151 +};
62152 +
62153 +struct user_acl_role_db {
62154 + struct acl_role_label **r_table;
62155 + __u32 num_pointers; /* Number of allocations to track */
62156 + __u32 num_roles; /* Number of roles */
62157 + __u32 num_domain_children; /* Number of domain children */
62158 + __u32 num_subjects; /* Number of subjects */
62159 + __u32 num_objects; /* Number of objects */
62160 +};
62161 +
62162 +struct acl_object_label {
62163 + char *filename;
62164 + ino_t inode;
62165 + dev_t device;
62166 + __u32 mode;
62167 +
62168 + struct acl_subject_label *nested;
62169 + struct acl_object_label *globbed;
62170 +
62171 + /* next two structures not used */
62172 +
62173 + struct acl_object_label *prev;
62174 + struct acl_object_label *next;
62175 +};
62176 +
62177 +struct acl_ip_label {
62178 + char *iface;
62179 + __u32 addr;
62180 + __u32 netmask;
62181 + __u16 low, high;
62182 + __u8 mode;
62183 + __u32 type;
62184 + __u32 proto[8];
62185 +
62186 + /* next two structures not used */
62187 +
62188 + struct acl_ip_label *prev;
62189 + struct acl_ip_label *next;
62190 +};
62191 +
62192 +struct gr_arg {
62193 + struct user_acl_role_db role_db;
62194 + unsigned char pw[GR_PW_LEN];
62195 + unsigned char salt[GR_SALT_LEN];
62196 + unsigned char sum[GR_SHA_LEN];
62197 + unsigned char sp_role[GR_SPROLE_LEN];
62198 + struct sprole_pw *sprole_pws;
62199 + dev_t segv_device;
62200 + ino_t segv_inode;
62201 + uid_t segv_uid;
62202 + __u16 num_sprole_pws;
62203 + __u16 mode;
62204 +};
62205 +
62206 +struct gr_arg_wrapper {
62207 + struct gr_arg *arg;
62208 + __u32 version;
62209 + __u32 size;
62210 +};
62211 +
62212 +struct subject_map {
62213 + struct acl_subject_label *user;
62214 + struct acl_subject_label *kernel;
62215 + struct subject_map *prev;
62216 + struct subject_map *next;
62217 +};
62218 +
62219 +struct acl_subj_map_db {
62220 + struct subject_map **s_hash;
62221 + __u32 s_size;
62222 +};
62223 +
62224 +/* End Data Structures Section */
62225 +
62226 +/* Hash functions generated by empirical testing by Brad Spengler
62227 + Makes good use of the low bits of the inode. Generally 0-1 times
62228 + in loop for successful match. 0-3 for unsuccessful match.
62229 + Shift/add algorithm with modulus of table size and an XOR*/
62230 +
62231 +static __inline__ unsigned int
62232 +rhash(const uid_t uid, const __u16 type, const unsigned int sz)
62233 +{
62234 + return ((((uid + type) << (16 + type)) ^ uid) % sz);
62235 +}
62236 +
62237 + static __inline__ unsigned int
62238 +shash(const struct acl_subject_label *userp, const unsigned int sz)
62239 +{
62240 + return ((const unsigned long)userp % sz);
62241 +}
62242 +
62243 +static __inline__ unsigned int
62244 +fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
62245 +{
62246 + return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
62247 +}
62248 +
62249 +static __inline__ unsigned int
62250 +nhash(const char *name, const __u16 len, const unsigned int sz)
62251 +{
62252 + return full_name_hash((const unsigned char *)name, len) % sz;
62253 +}
62254 +
62255 +#define FOR_EACH_ROLE_START(role) \
62256 + role = role_list; \
62257 + while (role) {
62258 +
62259 +#define FOR_EACH_ROLE_END(role) \
62260 + role = role->prev; \
62261 + }
62262 +
62263 +#define FOR_EACH_SUBJECT_START(role,subj,iter) \
62264 + subj = NULL; \
62265 + iter = 0; \
62266 + while (iter < role->subj_hash_size) { \
62267 + if (subj == NULL) \
62268 + subj = role->subj_hash[iter]; \
62269 + if (subj == NULL) { \
62270 + iter++; \
62271 + continue; \
62272 + }
62273 +
62274 +#define FOR_EACH_SUBJECT_END(subj,iter) \
62275 + subj = subj->next; \
62276 + if (subj == NULL) \
62277 + iter++; \
62278 + }
62279 +
62280 +
62281 +#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
62282 + subj = role->hash->first; \
62283 + while (subj != NULL) {
62284 +
62285 +#define FOR_EACH_NESTED_SUBJECT_END(subj) \
62286 + subj = subj->next; \
62287 + }
62288 +
62289 +#endif
62290 +
62291 diff -urNp linux-2.6.32.46/include/linux/gralloc.h linux-2.6.32.46/include/linux/gralloc.h
62292 --- linux-2.6.32.46/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500
62293 +++ linux-2.6.32.46/include/linux/gralloc.h 2011-04-17 15:56:46.000000000 -0400
62294 @@ -0,0 +1,9 @@
62295 +#ifndef __GRALLOC_H
62296 +#define __GRALLOC_H
62297 +
62298 +void acl_free_all(void);
62299 +int acl_alloc_stack_init(unsigned long size);
62300 +void *acl_alloc(unsigned long len);
62301 +void *acl_alloc_num(unsigned long num, unsigned long len);
62302 +
62303 +#endif
62304 diff -urNp linux-2.6.32.46/include/linux/grdefs.h linux-2.6.32.46/include/linux/grdefs.h
62305 --- linux-2.6.32.46/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
62306 +++ linux-2.6.32.46/include/linux/grdefs.h 2011-06-11 16:20:26.000000000 -0400
62307 @@ -0,0 +1,140 @@
62308 +#ifndef GRDEFS_H
62309 +#define GRDEFS_H
62310 +
62311 +/* Begin grsecurity status declarations */
62312 +
62313 +enum {
62314 + GR_READY = 0x01,
62315 + GR_STATUS_INIT = 0x00 // disabled state
62316 +};
62317 +
62318 +/* Begin ACL declarations */
62319 +
62320 +/* Role flags */
62321 +
62322 +enum {
62323 + GR_ROLE_USER = 0x0001,
62324 + GR_ROLE_GROUP = 0x0002,
62325 + GR_ROLE_DEFAULT = 0x0004,
62326 + GR_ROLE_SPECIAL = 0x0008,
62327 + GR_ROLE_AUTH = 0x0010,
62328 + GR_ROLE_NOPW = 0x0020,
62329 + GR_ROLE_GOD = 0x0040,
62330 + GR_ROLE_LEARN = 0x0080,
62331 + GR_ROLE_TPE = 0x0100,
62332 + GR_ROLE_DOMAIN = 0x0200,
62333 + GR_ROLE_PAM = 0x0400,
62334 + GR_ROLE_PERSIST = 0x800
62335 +};
62336 +
62337 +/* ACL Subject and Object mode flags */
62338 +enum {
62339 + GR_DELETED = 0x80000000
62340 +};
62341 +
62342 +/* ACL Object-only mode flags */
62343 +enum {
62344 + GR_READ = 0x00000001,
62345 + GR_APPEND = 0x00000002,
62346 + GR_WRITE = 0x00000004,
62347 + GR_EXEC = 0x00000008,
62348 + GR_FIND = 0x00000010,
62349 + GR_INHERIT = 0x00000020,
62350 + GR_SETID = 0x00000040,
62351 + GR_CREATE = 0x00000080,
62352 + GR_DELETE = 0x00000100,
62353 + GR_LINK = 0x00000200,
62354 + GR_AUDIT_READ = 0x00000400,
62355 + GR_AUDIT_APPEND = 0x00000800,
62356 + GR_AUDIT_WRITE = 0x00001000,
62357 + GR_AUDIT_EXEC = 0x00002000,
62358 + GR_AUDIT_FIND = 0x00004000,
62359 + GR_AUDIT_INHERIT= 0x00008000,
62360 + GR_AUDIT_SETID = 0x00010000,
62361 + GR_AUDIT_CREATE = 0x00020000,
62362 + GR_AUDIT_DELETE = 0x00040000,
62363 + GR_AUDIT_LINK = 0x00080000,
62364 + GR_PTRACERD = 0x00100000,
62365 + GR_NOPTRACE = 0x00200000,
62366 + GR_SUPPRESS = 0x00400000,
62367 + GR_NOLEARN = 0x00800000,
62368 + GR_INIT_TRANSFER= 0x01000000
62369 +};
62370 +
62371 +#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
62372 + GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
62373 + GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
62374 +
62375 +/* ACL subject-only mode flags */
62376 +enum {
62377 + GR_KILL = 0x00000001,
62378 + GR_VIEW = 0x00000002,
62379 + GR_PROTECTED = 0x00000004,
62380 + GR_LEARN = 0x00000008,
62381 + GR_OVERRIDE = 0x00000010,
62382 + /* just a placeholder, this mode is only used in userspace */
62383 + GR_DUMMY = 0x00000020,
62384 + GR_PROTSHM = 0x00000040,
62385 + GR_KILLPROC = 0x00000080,
62386 + GR_KILLIPPROC = 0x00000100,
62387 + /* just a placeholder, this mode is only used in userspace */
62388 + GR_NOTROJAN = 0x00000200,
62389 + GR_PROTPROCFD = 0x00000400,
62390 + GR_PROCACCT = 0x00000800,
62391 + GR_RELAXPTRACE = 0x00001000,
62392 + GR_NESTED = 0x00002000,
62393 + GR_INHERITLEARN = 0x00004000,
62394 + GR_PROCFIND = 0x00008000,
62395 + GR_POVERRIDE = 0x00010000,
62396 + GR_KERNELAUTH = 0x00020000,
62397 + GR_ATSECURE = 0x00040000,
62398 + GR_SHMEXEC = 0x00080000
62399 +};
62400 +
62401 +enum {
62402 + GR_PAX_ENABLE_SEGMEXEC = 0x0001,
62403 + GR_PAX_ENABLE_PAGEEXEC = 0x0002,
62404 + GR_PAX_ENABLE_MPROTECT = 0x0004,
62405 + GR_PAX_ENABLE_RANDMMAP = 0x0008,
62406 + GR_PAX_ENABLE_EMUTRAMP = 0x0010,
62407 + GR_PAX_DISABLE_SEGMEXEC = 0x0100,
62408 + GR_PAX_DISABLE_PAGEEXEC = 0x0200,
62409 + GR_PAX_DISABLE_MPROTECT = 0x0400,
62410 + GR_PAX_DISABLE_RANDMMAP = 0x0800,
62411 + GR_PAX_DISABLE_EMUTRAMP = 0x1000,
62412 +};
62413 +
62414 +enum {
62415 + GR_ID_USER = 0x01,
62416 + GR_ID_GROUP = 0x02,
62417 +};
62418 +
62419 +enum {
62420 + GR_ID_ALLOW = 0x01,
62421 + GR_ID_DENY = 0x02,
62422 +};
62423 +
62424 +#define GR_CRASH_RES 31
62425 +#define GR_UIDTABLE_MAX 500
62426 +
62427 +/* begin resource learning section */
62428 +enum {
62429 + GR_RLIM_CPU_BUMP = 60,
62430 + GR_RLIM_FSIZE_BUMP = 50000,
62431 + GR_RLIM_DATA_BUMP = 10000,
62432 + GR_RLIM_STACK_BUMP = 1000,
62433 + GR_RLIM_CORE_BUMP = 10000,
62434 + GR_RLIM_RSS_BUMP = 500000,
62435 + GR_RLIM_NPROC_BUMP = 1,
62436 + GR_RLIM_NOFILE_BUMP = 5,
62437 + GR_RLIM_MEMLOCK_BUMP = 50000,
62438 + GR_RLIM_AS_BUMP = 500000,
62439 + GR_RLIM_LOCKS_BUMP = 2,
62440 + GR_RLIM_SIGPENDING_BUMP = 5,
62441 + GR_RLIM_MSGQUEUE_BUMP = 10000,
62442 + GR_RLIM_NICE_BUMP = 1,
62443 + GR_RLIM_RTPRIO_BUMP = 1,
62444 + GR_RLIM_RTTIME_BUMP = 1000000
62445 +};
62446 +
62447 +#endif
62448 diff -urNp linux-2.6.32.46/include/linux/grinternal.h linux-2.6.32.46/include/linux/grinternal.h
62449 --- linux-2.6.32.46/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500
62450 +++ linux-2.6.32.46/include/linux/grinternal.h 2011-10-20 00:48:45.000000000 -0400
62451 @@ -0,0 +1,218 @@
62452 +#ifndef __GRINTERNAL_H
62453 +#define __GRINTERNAL_H
62454 +
62455 +#ifdef CONFIG_GRKERNSEC
62456 +
62457 +#include <linux/fs.h>
62458 +#include <linux/mnt_namespace.h>
62459 +#include <linux/nsproxy.h>
62460 +#include <linux/gracl.h>
62461 +#include <linux/grdefs.h>
62462 +#include <linux/grmsg.h>
62463 +
62464 +void gr_add_learn_entry(const char *fmt, ...)
62465 + __attribute__ ((format (printf, 1, 2)));
62466 +__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
62467 + const struct vfsmount *mnt);
62468 +__u32 gr_check_create(const struct dentry *new_dentry,
62469 + const struct dentry *parent,
62470 + const struct vfsmount *mnt, const __u32 mode);
62471 +int gr_check_protected_task(const struct task_struct *task);
62472 +__u32 to_gr_audit(const __u32 reqmode);
62473 +int gr_set_acls(const int type);
62474 +int gr_apply_subject_to_task(struct task_struct *task);
62475 +int gr_acl_is_enabled(void);
62476 +char gr_roletype_to_char(void);
62477 +
62478 +void gr_handle_alertkill(struct task_struct *task);
62479 +char *gr_to_filename(const struct dentry *dentry,
62480 + const struct vfsmount *mnt);
62481 +char *gr_to_filename1(const struct dentry *dentry,
62482 + const struct vfsmount *mnt);
62483 +char *gr_to_filename2(const struct dentry *dentry,
62484 + const struct vfsmount *mnt);
62485 +char *gr_to_filename3(const struct dentry *dentry,
62486 + const struct vfsmount *mnt);
62487 +
62488 +extern int grsec_enable_harden_ptrace;
62489 +extern int grsec_enable_link;
62490 +extern int grsec_enable_fifo;
62491 +extern int grsec_enable_shm;
62492 +extern int grsec_enable_execlog;
62493 +extern int grsec_enable_signal;
62494 +extern int grsec_enable_audit_ptrace;
62495 +extern int grsec_enable_forkfail;
62496 +extern int grsec_enable_time;
62497 +extern int grsec_enable_rofs;
62498 +extern int grsec_enable_chroot_shmat;
62499 +extern int grsec_enable_chroot_mount;
62500 +extern int grsec_enable_chroot_double;
62501 +extern int grsec_enable_chroot_pivot;
62502 +extern int grsec_enable_chroot_chdir;
62503 +extern int grsec_enable_chroot_chmod;
62504 +extern int grsec_enable_chroot_mknod;
62505 +extern int grsec_enable_chroot_fchdir;
62506 +extern int grsec_enable_chroot_nice;
62507 +extern int grsec_enable_chroot_execlog;
62508 +extern int grsec_enable_chroot_caps;
62509 +extern int grsec_enable_chroot_sysctl;
62510 +extern int grsec_enable_chroot_unix;
62511 +extern int grsec_enable_tpe;
62512 +extern int grsec_tpe_gid;
62513 +extern int grsec_enable_tpe_all;
62514 +extern int grsec_enable_tpe_invert;
62515 +extern int grsec_enable_socket_all;
62516 +extern int grsec_socket_all_gid;
62517 +extern int grsec_enable_socket_client;
62518 +extern int grsec_socket_client_gid;
62519 +extern int grsec_enable_socket_server;
62520 +extern int grsec_socket_server_gid;
62521 +extern int grsec_audit_gid;
62522 +extern int grsec_enable_group;
62523 +extern int grsec_enable_audit_textrel;
62524 +extern int grsec_enable_log_rwxmaps;
62525 +extern int grsec_enable_mount;
62526 +extern int grsec_enable_chdir;
62527 +extern int grsec_resource_logging;
62528 +extern int grsec_enable_blackhole;
62529 +extern int grsec_lastack_retries;
62530 +extern int grsec_enable_brute;
62531 +extern int grsec_lock;
62532 +
62533 +extern spinlock_t grsec_alert_lock;
62534 +extern unsigned long grsec_alert_wtime;
62535 +extern unsigned long grsec_alert_fyet;
62536 +
62537 +extern spinlock_t grsec_audit_lock;
62538 +
62539 +extern rwlock_t grsec_exec_file_lock;
62540 +
62541 +#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
62542 + gr_to_filename2((tsk)->exec_file->f_path.dentry, \
62543 + (tsk)->exec_file->f_vfsmnt) : "/")
62544 +
62545 +#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
62546 + gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
62547 + (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
62548 +
62549 +#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
62550 + gr_to_filename((tsk)->exec_file->f_path.dentry, \
62551 + (tsk)->exec_file->f_vfsmnt) : "/")
62552 +
62553 +#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
62554 + gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
62555 + (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
62556 +
62557 +#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
62558 +
62559 +#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
62560 +
62561 +#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
62562 + (task)->pid, (cred)->uid, \
62563 + (cred)->euid, (cred)->gid, (cred)->egid, \
62564 + gr_parent_task_fullpath(task), \
62565 + (task)->real_parent->comm, (task)->real_parent->pid, \
62566 + (pcred)->uid, (pcred)->euid, \
62567 + (pcred)->gid, (pcred)->egid
62568 +
62569 +#define GR_CHROOT_CAPS {{ \
62570 + CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
62571 + CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
62572 + CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
62573 + CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
62574 + CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
62575 + CAP_TO_MASK(CAP_IPC_OWNER) | CAP_TO_MASK(CAP_SETFCAP), \
62576 + CAP_TO_MASK(CAP_MAC_ADMIN) }}
62577 +
62578 +#define security_learn(normal_msg,args...) \
62579 +({ \
62580 + read_lock(&grsec_exec_file_lock); \
62581 + gr_add_learn_entry(normal_msg "\n", ## args); \
62582 + read_unlock(&grsec_exec_file_lock); \
62583 +})
62584 +
62585 +enum {
62586 + GR_DO_AUDIT,
62587 + GR_DONT_AUDIT,
62588 + GR_DONT_AUDIT_GOOD
62589 +};
62590 +
62591 +enum {
62592 + GR_TTYSNIFF,
62593 + GR_RBAC,
62594 + GR_RBAC_STR,
62595 + GR_STR_RBAC,
62596 + GR_RBAC_MODE2,
62597 + GR_RBAC_MODE3,
62598 + GR_FILENAME,
62599 + GR_SYSCTL_HIDDEN,
62600 + GR_NOARGS,
62601 + GR_ONE_INT,
62602 + GR_ONE_INT_TWO_STR,
62603 + GR_ONE_STR,
62604 + GR_STR_INT,
62605 + GR_TWO_STR_INT,
62606 + GR_TWO_INT,
62607 + GR_TWO_U64,
62608 + GR_THREE_INT,
62609 + GR_FIVE_INT_TWO_STR,
62610 + GR_TWO_STR,
62611 + GR_THREE_STR,
62612 + GR_FOUR_STR,
62613 + GR_STR_FILENAME,
62614 + GR_FILENAME_STR,
62615 + GR_FILENAME_TWO_INT,
62616 + GR_FILENAME_TWO_INT_STR,
62617 + GR_TEXTREL,
62618 + GR_PTRACE,
62619 + GR_RESOURCE,
62620 + GR_CAP,
62621 + GR_SIG,
62622 + GR_SIG2,
62623 + GR_CRASH1,
62624 + GR_CRASH2,
62625 + GR_PSACCT,
62626 + GR_RWXMAP
62627 +};
62628 +
62629 +#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
62630 +#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
62631 +#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
62632 +#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
62633 +#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
62634 +#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
62635 +#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
62636 +#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
62637 +#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
62638 +#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
62639 +#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
62640 +#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
62641 +#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
62642 +#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
62643 +#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
62644 +#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
62645 +#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
62646 +#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
62647 +#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
62648 +#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
62649 +#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
62650 +#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
62651 +#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
62652 +#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
62653 +#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
62654 +#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
62655 +#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
62656 +#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
62657 +#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
62658 +#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
62659 +#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
62660 +#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
62661 +#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
62662 +#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
62663 +#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
62664 +
62665 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
62666 +
62667 +#endif
62668 +
62669 +#endif
62670 diff -urNp linux-2.6.32.46/include/linux/grmsg.h linux-2.6.32.46/include/linux/grmsg.h
62671 --- linux-2.6.32.46/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500
62672 +++ linux-2.6.32.46/include/linux/grmsg.h 2011-09-13 15:44:53.000000000 -0400
62673 @@ -0,0 +1,108 @@
62674 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
62675 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
62676 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
62677 +#define GR_STOPMOD_MSG "denied modification of module state by "
62678 +#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
62679 +#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
62680 +#define GR_IOPERM_MSG "denied use of ioperm() by "
62681 +#define GR_IOPL_MSG "denied use of iopl() by "
62682 +#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
62683 +#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
62684 +#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
62685 +#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
62686 +#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
62687 +#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
62688 +#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
62689 +#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
62690 +#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
62691 +#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
62692 +#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
62693 +#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
62694 +#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
62695 +#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
62696 +#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
62697 +#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
62698 +#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
62699 +#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
62700 +#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
62701 +#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
62702 +#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
62703 +#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
62704 +#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
62705 +#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
62706 +#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
62707 +#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
62708 +#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
62709 +#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
62710 +#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
62711 +#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
62712 +#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
62713 +#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
62714 +#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
62715 +#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
62716 +#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
62717 +#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
62718 +#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
62719 +#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
62720 +#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
62721 +#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
62722 +#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
62723 +#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
62724 +#define GR_INITF_ACL_MSG "init_variables() failed %s by "
62725 +#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
62726 +#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
62727 +#define GR_SHUTS_ACL_MSG "shutdown auth success for "
62728 +#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
62729 +#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
62730 +#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
62731 +#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
62732 +#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
62733 +#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
62734 +#define GR_ENABLEF_ACL_MSG "unable to load %s for "
62735 +#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
62736 +#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
62737 +#define GR_RELOADF_ACL_MSG "failed reload of %s for "
62738 +#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
62739 +#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
62740 +#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
62741 +#define GR_SPROLEF_ACL_MSG "special role %s failure for "
62742 +#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
62743 +#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
62744 +#define GR_INVMODE_ACL_MSG "invalid mode %d by "
62745 +#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
62746 +#define GR_FAILFORK_MSG "failed fork with errno %s by "
62747 +#define GR_NICE_CHROOT_MSG "denied priority change by "
62748 +#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
62749 +#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
62750 +#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
62751 +#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
62752 +#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
62753 +#define GR_TIME_MSG "time set by "
62754 +#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
62755 +#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
62756 +#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
62757 +#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
62758 +#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
62759 +#define GR_BIND_MSG "denied bind() by "
62760 +#define GR_CONNECT_MSG "denied connect() by "
62761 +#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
62762 +#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
62763 +#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
62764 +#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
62765 +#define GR_CAP_ACL_MSG "use of %s denied for "
62766 +#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for "
62767 +#define GR_CAP_ACL_MSG2 "use of %s permitted for "
62768 +#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
62769 +#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
62770 +#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
62771 +#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
62772 +#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
62773 +#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
62774 +#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
62775 +#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
62776 +#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
62777 +#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
62778 +#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
62779 +#define GR_VM86_MSG "denied use of vm86 by "
62780 +#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
62781 +#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
62782 diff -urNp linux-2.6.32.46/include/linux/grsecurity.h linux-2.6.32.46/include/linux/grsecurity.h
62783 --- linux-2.6.32.46/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500
62784 +++ linux-2.6.32.46/include/linux/grsecurity.h 2011-10-17 06:48:36.000000000 -0400
62785 @@ -0,0 +1,218 @@
62786 +#ifndef GR_SECURITY_H
62787 +#define GR_SECURITY_H
62788 +#include <linux/fs.h>
62789 +#include <linux/fs_struct.h>
62790 +#include <linux/binfmts.h>
62791 +#include <linux/gracl.h>
62792 +#include <linux/compat.h>
62793 +
62794 +/* notify of brain-dead configs */
62795 +#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
62796 +#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
62797 +#endif
62798 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
62799 +#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
62800 +#endif
62801 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
62802 +#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
62803 +#endif
62804 +#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
62805 +#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
62806 +#endif
62807 +#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
62808 +#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
62809 +#endif
62810 +#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
62811 +#error "CONFIG_PAX enabled, but no PaX options are enabled."
62812 +#endif
62813 +
62814 +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
62815 +void gr_handle_brute_check(void);
62816 +void gr_handle_kernel_exploit(void);
62817 +int gr_process_user_ban(void);
62818 +
62819 +char gr_roletype_to_char(void);
62820 +
62821 +int gr_acl_enable_at_secure(void);
62822 +
62823 +int gr_check_user_change(int real, int effective, int fs);
62824 +int gr_check_group_change(int real, int effective, int fs);
62825 +
62826 +void gr_del_task_from_ip_table(struct task_struct *p);
62827 +
62828 +int gr_pid_is_chrooted(struct task_struct *p);
62829 +int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
62830 +int gr_handle_chroot_nice(void);
62831 +int gr_handle_chroot_sysctl(const int op);
62832 +int gr_handle_chroot_setpriority(struct task_struct *p,
62833 + const int niceval);
62834 +int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
62835 +int gr_handle_chroot_chroot(const struct dentry *dentry,
62836 + const struct vfsmount *mnt);
62837 +void gr_handle_chroot_chdir(struct path *path);
62838 +int gr_handle_chroot_chmod(const struct dentry *dentry,
62839 + const struct vfsmount *mnt, const int mode);
62840 +int gr_handle_chroot_mknod(const struct dentry *dentry,
62841 + const struct vfsmount *mnt, const int mode);
62842 +int gr_handle_chroot_mount(const struct dentry *dentry,
62843 + const struct vfsmount *mnt,
62844 + const char *dev_name);
62845 +int gr_handle_chroot_pivot(void);
62846 +int gr_handle_chroot_unix(const pid_t pid);
62847 +
62848 +int gr_handle_rawio(const struct inode *inode);
62849 +
62850 +void gr_handle_ioperm(void);
62851 +void gr_handle_iopl(void);
62852 +
62853 +int gr_tpe_allow(const struct file *file);
62854 +
62855 +void gr_set_chroot_entries(struct task_struct *task, struct path *path);
62856 +void gr_clear_chroot_entries(struct task_struct *task);
62857 +
62858 +void gr_log_forkfail(const int retval);
62859 +void gr_log_timechange(void);
62860 +void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
62861 +void gr_log_chdir(const struct dentry *dentry,
62862 + const struct vfsmount *mnt);
62863 +void gr_log_chroot_exec(const struct dentry *dentry,
62864 + const struct vfsmount *mnt);
62865 +void gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv);
62866 +#ifdef CONFIG_COMPAT
62867 +void gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv);
62868 +#endif
62869 +void gr_log_remount(const char *devname, const int retval);
62870 +void gr_log_unmount(const char *devname, const int retval);
62871 +void gr_log_mount(const char *from, const char *to, const int retval);
62872 +void gr_log_textrel(struct vm_area_struct *vma);
62873 +void gr_log_rwxmmap(struct file *file);
62874 +void gr_log_rwxmprotect(struct file *file);
62875 +
62876 +int gr_handle_follow_link(const struct inode *parent,
62877 + const struct inode *inode,
62878 + const struct dentry *dentry,
62879 + const struct vfsmount *mnt);
62880 +int gr_handle_fifo(const struct dentry *dentry,
62881 + const struct vfsmount *mnt,
62882 + const struct dentry *dir, const int flag,
62883 + const int acc_mode);
62884 +int gr_handle_hardlink(const struct dentry *dentry,
62885 + const struct vfsmount *mnt,
62886 + struct inode *inode,
62887 + const int mode, const char *to);
62888 +
62889 +int gr_is_capable(const int cap);
62890 +int gr_is_capable_nolog(const int cap);
62891 +void gr_learn_resource(const struct task_struct *task, const int limit,
62892 + const unsigned long wanted, const int gt);
62893 +void gr_copy_label(struct task_struct *tsk);
62894 +void gr_handle_crash(struct task_struct *task, const int sig);
62895 +int gr_handle_signal(const struct task_struct *p, const int sig);
62896 +int gr_check_crash_uid(const uid_t uid);
62897 +int gr_check_protected_task(const struct task_struct *task);
62898 +int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
62899 +int gr_acl_handle_mmap(const struct file *file,
62900 + const unsigned long prot);
62901 +int gr_acl_handle_mprotect(const struct file *file,
62902 + const unsigned long prot);
62903 +int gr_check_hidden_task(const struct task_struct *tsk);
62904 +__u32 gr_acl_handle_truncate(const struct dentry *dentry,
62905 + const struct vfsmount *mnt);
62906 +__u32 gr_acl_handle_utime(const struct dentry *dentry,
62907 + const struct vfsmount *mnt);
62908 +__u32 gr_acl_handle_access(const struct dentry *dentry,
62909 + const struct vfsmount *mnt, const int fmode);
62910 +__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
62911 + const struct vfsmount *mnt, mode_t mode);
62912 +__u32 gr_acl_handle_chmod(const struct dentry *dentry,
62913 + const struct vfsmount *mnt, mode_t mode);
62914 +__u32 gr_acl_handle_chown(const struct dentry *dentry,
62915 + const struct vfsmount *mnt);
62916 +__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
62917 + const struct vfsmount *mnt);
62918 +int gr_handle_ptrace(struct task_struct *task, const long request);
62919 +int gr_handle_proc_ptrace(struct task_struct *task);
62920 +__u32 gr_acl_handle_execve(const struct dentry *dentry,
62921 + const struct vfsmount *mnt);
62922 +int gr_check_crash_exec(const struct file *filp);
62923 +int gr_acl_is_enabled(void);
62924 +void gr_set_kernel_label(struct task_struct *task);
62925 +void gr_set_role_label(struct task_struct *task, const uid_t uid,
62926 + const gid_t gid);
62927 +int gr_set_proc_label(const struct dentry *dentry,
62928 + const struct vfsmount *mnt,
62929 + const int unsafe_share);
62930 +__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
62931 + const struct vfsmount *mnt);
62932 +__u32 gr_acl_handle_open(const struct dentry *dentry,
62933 + const struct vfsmount *mnt, const int fmode);
62934 +__u32 gr_acl_handle_creat(const struct dentry *dentry,
62935 + const struct dentry *p_dentry,
62936 + const struct vfsmount *p_mnt, const int fmode,
62937 + const int imode);
62938 +void gr_handle_create(const struct dentry *dentry,
62939 + const struct vfsmount *mnt);
62940 +void gr_handle_proc_create(const struct dentry *dentry,
62941 + const struct inode *inode);
62942 +__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
62943 + const struct dentry *parent_dentry,
62944 + const struct vfsmount *parent_mnt,
62945 + const int mode);
62946 +__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
62947 + const struct dentry *parent_dentry,
62948 + const struct vfsmount *parent_mnt);
62949 +__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
62950 + const struct vfsmount *mnt);
62951 +void gr_handle_delete(const ino_t ino, const dev_t dev);
62952 +__u32 gr_acl_handle_unlink(const struct dentry *dentry,
62953 + const struct vfsmount *mnt);
62954 +__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
62955 + const struct dentry *parent_dentry,
62956 + const struct vfsmount *parent_mnt,
62957 + const char *from);
62958 +__u32 gr_acl_handle_link(const struct dentry *new_dentry,
62959 + const struct dentry *parent_dentry,
62960 + const struct vfsmount *parent_mnt,
62961 + const struct dentry *old_dentry,
62962 + const struct vfsmount *old_mnt, const char *to);
62963 +int gr_acl_handle_rename(struct dentry *new_dentry,
62964 + struct dentry *parent_dentry,
62965 + const struct vfsmount *parent_mnt,
62966 + struct dentry *old_dentry,
62967 + struct inode *old_parent_inode,
62968 + struct vfsmount *old_mnt, const char *newname);
62969 +void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
62970 + struct dentry *old_dentry,
62971 + struct dentry *new_dentry,
62972 + struct vfsmount *mnt, const __u8 replace);
62973 +__u32 gr_check_link(const struct dentry *new_dentry,
62974 + const struct dentry *parent_dentry,
62975 + const struct vfsmount *parent_mnt,
62976 + const struct dentry *old_dentry,
62977 + const struct vfsmount *old_mnt);
62978 +int gr_acl_handle_filldir(const struct file *file, const char *name,
62979 + const unsigned int namelen, const ino_t ino);
62980 +
62981 +__u32 gr_acl_handle_unix(const struct dentry *dentry,
62982 + const struct vfsmount *mnt);
62983 +void gr_acl_handle_exit(void);
62984 +void gr_acl_handle_psacct(struct task_struct *task, const long code);
62985 +int gr_acl_handle_procpidmem(const struct task_struct *task);
62986 +int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
62987 +int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
62988 +void gr_audit_ptrace(struct task_struct *task);
62989 +dev_t gr_get_dev_from_dentry(struct dentry *dentry);
62990 +
62991 +#ifdef CONFIG_GRKERNSEC
62992 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
62993 +void gr_handle_vm86(void);
62994 +void gr_handle_mem_readwrite(u64 from, u64 to);
62995 +
62996 +extern int grsec_enable_dmesg;
62997 +extern int grsec_disable_privio;
62998 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
62999 +extern int grsec_enable_chroot_findtask;
63000 +#endif
63001 +#endif
63002 +
63003 +#endif
63004 diff -urNp linux-2.6.32.46/include/linux/hdpu_features.h linux-2.6.32.46/include/linux/hdpu_features.h
63005 --- linux-2.6.32.46/include/linux/hdpu_features.h 2011-03-27 14:31:47.000000000 -0400
63006 +++ linux-2.6.32.46/include/linux/hdpu_features.h 2011-04-17 15:56:46.000000000 -0400
63007 @@ -3,7 +3,7 @@
63008 struct cpustate_t {
63009 spinlock_t lock;
63010 int excl;
63011 - int open_count;
63012 + atomic_t open_count;
63013 unsigned char cached_val;
63014 int inited;
63015 unsigned long *set_addr;
63016 diff -urNp linux-2.6.32.46/include/linux/highmem.h linux-2.6.32.46/include/linux/highmem.h
63017 --- linux-2.6.32.46/include/linux/highmem.h 2011-03-27 14:31:47.000000000 -0400
63018 +++ linux-2.6.32.46/include/linux/highmem.h 2011-04-17 15:56:46.000000000 -0400
63019 @@ -137,6 +137,18 @@ static inline void clear_highpage(struct
63020 kunmap_atomic(kaddr, KM_USER0);
63021 }
63022
63023 +static inline void sanitize_highpage(struct page *page)
63024 +{
63025 + void *kaddr;
63026 + unsigned long flags;
63027 +
63028 + local_irq_save(flags);
63029 + kaddr = kmap_atomic(page, KM_CLEARPAGE);
63030 + clear_page(kaddr);
63031 + kunmap_atomic(kaddr, KM_CLEARPAGE);
63032 + local_irq_restore(flags);
63033 +}
63034 +
63035 static inline void zero_user_segments(struct page *page,
63036 unsigned start1, unsigned end1,
63037 unsigned start2, unsigned end2)
63038 diff -urNp linux-2.6.32.46/include/linux/i2c.h linux-2.6.32.46/include/linux/i2c.h
63039 --- linux-2.6.32.46/include/linux/i2c.h 2011-03-27 14:31:47.000000000 -0400
63040 +++ linux-2.6.32.46/include/linux/i2c.h 2011-08-23 21:22:38.000000000 -0400
63041 @@ -325,6 +325,7 @@ struct i2c_algorithm {
63042 /* To determine what the adapter supports */
63043 u32 (*functionality) (struct i2c_adapter *);
63044 };
63045 +typedef struct i2c_algorithm __no_const i2c_algorithm_no_const;
63046
63047 /*
63048 * i2c_adapter is the structure used to identify a physical i2c bus along
63049 diff -urNp linux-2.6.32.46/include/linux/i2o.h linux-2.6.32.46/include/linux/i2o.h
63050 --- linux-2.6.32.46/include/linux/i2o.h 2011-03-27 14:31:47.000000000 -0400
63051 +++ linux-2.6.32.46/include/linux/i2o.h 2011-05-04 17:56:28.000000000 -0400
63052 @@ -564,7 +564,7 @@ struct i2o_controller {
63053 struct i2o_device *exec; /* Executive */
63054 #if BITS_PER_LONG == 64
63055 spinlock_t context_list_lock; /* lock for context_list */
63056 - atomic_t context_list_counter; /* needed for unique contexts */
63057 + atomic_unchecked_t context_list_counter; /* needed for unique contexts */
63058 struct list_head context_list; /* list of context id's
63059 and pointers */
63060 #endif
63061 diff -urNp linux-2.6.32.46/include/linux/init_task.h linux-2.6.32.46/include/linux/init_task.h
63062 --- linux-2.6.32.46/include/linux/init_task.h 2011-03-27 14:31:47.000000000 -0400
63063 +++ linux-2.6.32.46/include/linux/init_task.h 2011-05-18 20:44:59.000000000 -0400
63064 @@ -83,6 +83,12 @@ extern struct group_info init_groups;
63065 #define INIT_IDS
63066 #endif
63067
63068 +#ifdef CONFIG_X86
63069 +#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
63070 +#else
63071 +#define INIT_TASK_THREAD_INFO
63072 +#endif
63073 +
63074 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
63075 /*
63076 * Because of the reduced scope of CAP_SETPCAP when filesystem
63077 @@ -156,6 +162,7 @@ extern struct cred init_cred;
63078 __MUTEX_INITIALIZER(tsk.cred_guard_mutex), \
63079 .comm = "swapper", \
63080 .thread = INIT_THREAD, \
63081 + INIT_TASK_THREAD_INFO \
63082 .fs = &init_fs, \
63083 .files = &init_files, \
63084 .signal = &init_signals, \
63085 diff -urNp linux-2.6.32.46/include/linux/intel-iommu.h linux-2.6.32.46/include/linux/intel-iommu.h
63086 --- linux-2.6.32.46/include/linux/intel-iommu.h 2011-03-27 14:31:47.000000000 -0400
63087 +++ linux-2.6.32.46/include/linux/intel-iommu.h 2011-08-05 20:33:55.000000000 -0400
63088 @@ -296,7 +296,7 @@ struct iommu_flush {
63089 u8 fm, u64 type);
63090 void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
63091 unsigned int size_order, u64 type);
63092 -};
63093 +} __no_const;
63094
63095 enum {
63096 SR_DMAR_FECTL_REG,
63097 diff -urNp linux-2.6.32.46/include/linux/interrupt.h linux-2.6.32.46/include/linux/interrupt.h
63098 --- linux-2.6.32.46/include/linux/interrupt.h 2011-06-25 12:55:35.000000000 -0400
63099 +++ linux-2.6.32.46/include/linux/interrupt.h 2011-06-25 12:56:37.000000000 -0400
63100 @@ -363,7 +363,7 @@ enum
63101 /* map softirq index to softirq name. update 'softirq_to_name' in
63102 * kernel/softirq.c when adding a new softirq.
63103 */
63104 -extern char *softirq_to_name[NR_SOFTIRQS];
63105 +extern const char * const softirq_to_name[NR_SOFTIRQS];
63106
63107 /* softirq mask and active fields moved to irq_cpustat_t in
63108 * asm/hardirq.h to get better cache usage. KAO
63109 @@ -371,12 +371,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
63110
63111 struct softirq_action
63112 {
63113 - void (*action)(struct softirq_action *);
63114 + void (*action)(void);
63115 };
63116
63117 asmlinkage void do_softirq(void);
63118 asmlinkage void __do_softirq(void);
63119 -extern void open_softirq(int nr, void (*action)(struct softirq_action *));
63120 +extern void open_softirq(int nr, void (*action)(void));
63121 extern void softirq_init(void);
63122 #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
63123 extern void raise_softirq_irqoff(unsigned int nr);
63124 diff -urNp linux-2.6.32.46/include/linux/irq.h linux-2.6.32.46/include/linux/irq.h
63125 --- linux-2.6.32.46/include/linux/irq.h 2011-03-27 14:31:47.000000000 -0400
63126 +++ linux-2.6.32.46/include/linux/irq.h 2011-04-17 15:56:46.000000000 -0400
63127 @@ -438,12 +438,12 @@ extern int set_irq_msi(unsigned int irq,
63128 static inline bool alloc_desc_masks(struct irq_desc *desc, int node,
63129 bool boot)
63130 {
63131 +#ifdef CONFIG_CPUMASK_OFFSTACK
63132 gfp_t gfp = GFP_ATOMIC;
63133
63134 if (boot)
63135 gfp = GFP_NOWAIT;
63136
63137 -#ifdef CONFIG_CPUMASK_OFFSTACK
63138 if (!alloc_cpumask_var_node(&desc->affinity, gfp, node))
63139 return false;
63140
63141 diff -urNp linux-2.6.32.46/include/linux/kallsyms.h linux-2.6.32.46/include/linux/kallsyms.h
63142 --- linux-2.6.32.46/include/linux/kallsyms.h 2011-03-27 14:31:47.000000000 -0400
63143 +++ linux-2.6.32.46/include/linux/kallsyms.h 2011-04-17 15:56:46.000000000 -0400
63144 @@ -15,7 +15,8 @@
63145
63146 struct module;
63147
63148 -#ifdef CONFIG_KALLSYMS
63149 +#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
63150 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
63151 /* Lookup the address for a symbol. Returns 0 if not found. */
63152 unsigned long kallsyms_lookup_name(const char *name);
63153
63154 @@ -92,6 +93,15 @@ static inline int lookup_symbol_attrs(un
63155 /* Stupid that this does nothing, but I didn't create this mess. */
63156 #define __print_symbol(fmt, addr)
63157 #endif /*CONFIG_KALLSYMS*/
63158 +#else /* when included by kallsyms.c, vsnprintf.c, or
63159 + arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
63160 +extern void __print_symbol(const char *fmt, unsigned long address);
63161 +extern int sprint_symbol(char *buffer, unsigned long address);
63162 +const char *kallsyms_lookup(unsigned long addr,
63163 + unsigned long *symbolsize,
63164 + unsigned long *offset,
63165 + char **modname, char *namebuf);
63166 +#endif
63167
63168 /* This macro allows us to keep printk typechecking */
63169 static void __check_printsym_format(const char *fmt, ...)
63170 diff -urNp linux-2.6.32.46/include/linux/kgdb.h linux-2.6.32.46/include/linux/kgdb.h
63171 --- linux-2.6.32.46/include/linux/kgdb.h 2011-03-27 14:31:47.000000000 -0400
63172 +++ linux-2.6.32.46/include/linux/kgdb.h 2011-08-26 20:25:20.000000000 -0400
63173 @@ -74,8 +74,8 @@ void kgdb_breakpoint(void);
63174
63175 extern int kgdb_connected;
63176
63177 -extern atomic_t kgdb_setting_breakpoint;
63178 -extern atomic_t kgdb_cpu_doing_single_step;
63179 +extern atomic_unchecked_t kgdb_setting_breakpoint;
63180 +extern atomic_unchecked_t kgdb_cpu_doing_single_step;
63181
63182 extern struct task_struct *kgdb_usethread;
63183 extern struct task_struct *kgdb_contthread;
63184 @@ -235,7 +235,7 @@ struct kgdb_arch {
63185 int (*remove_hw_breakpoint)(unsigned long, int, enum kgdb_bptype);
63186 void (*remove_all_hw_break)(void);
63187 void (*correct_hw_break)(void);
63188 -};
63189 +} __do_const;
63190
63191 /**
63192 * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB.
63193 @@ -257,14 +257,14 @@ struct kgdb_io {
63194 int (*init) (void);
63195 void (*pre_exception) (void);
63196 void (*post_exception) (void);
63197 -};
63198 +} __do_const;
63199
63200 -extern struct kgdb_arch arch_kgdb_ops;
63201 +extern const struct kgdb_arch arch_kgdb_ops;
63202
63203 extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
63204
63205 -extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
63206 -extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
63207 +extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
63208 +extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
63209
63210 extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
63211 extern int kgdb_mem2hex(char *mem, char *buf, int count);
63212 diff -urNp linux-2.6.32.46/include/linux/kmod.h linux-2.6.32.46/include/linux/kmod.h
63213 --- linux-2.6.32.46/include/linux/kmod.h 2011-03-27 14:31:47.000000000 -0400
63214 +++ linux-2.6.32.46/include/linux/kmod.h 2011-04-17 15:56:46.000000000 -0400
63215 @@ -31,6 +31,8 @@
63216 * usually useless though. */
63217 extern int __request_module(bool wait, const char *name, ...) \
63218 __attribute__((format(printf, 2, 3)));
63219 +extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
63220 + __attribute__((format(printf, 3, 4)));
63221 #define request_module(mod...) __request_module(true, mod)
63222 #define request_module_nowait(mod...) __request_module(false, mod)
63223 #define try_then_request_module(x, mod...) \
63224 diff -urNp linux-2.6.32.46/include/linux/kobject.h linux-2.6.32.46/include/linux/kobject.h
63225 --- linux-2.6.32.46/include/linux/kobject.h 2011-03-27 14:31:47.000000000 -0400
63226 +++ linux-2.6.32.46/include/linux/kobject.h 2011-04-17 15:56:46.000000000 -0400
63227 @@ -106,7 +106,7 @@ extern char *kobject_get_path(struct kob
63228
63229 struct kobj_type {
63230 void (*release)(struct kobject *kobj);
63231 - struct sysfs_ops *sysfs_ops;
63232 + const struct sysfs_ops *sysfs_ops;
63233 struct attribute **default_attrs;
63234 };
63235
63236 @@ -118,9 +118,9 @@ struct kobj_uevent_env {
63237 };
63238
63239 struct kset_uevent_ops {
63240 - int (*filter)(struct kset *kset, struct kobject *kobj);
63241 - const char *(*name)(struct kset *kset, struct kobject *kobj);
63242 - int (*uevent)(struct kset *kset, struct kobject *kobj,
63243 + int (* const filter)(struct kset *kset, struct kobject *kobj);
63244 + const char *(* const name)(struct kset *kset, struct kobject *kobj);
63245 + int (* const uevent)(struct kset *kset, struct kobject *kobj,
63246 struct kobj_uevent_env *env);
63247 };
63248
63249 @@ -132,7 +132,7 @@ struct kobj_attribute {
63250 const char *buf, size_t count);
63251 };
63252
63253 -extern struct sysfs_ops kobj_sysfs_ops;
63254 +extern const struct sysfs_ops kobj_sysfs_ops;
63255
63256 /**
63257 * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
63258 @@ -155,14 +155,14 @@ struct kset {
63259 struct list_head list;
63260 spinlock_t list_lock;
63261 struct kobject kobj;
63262 - struct kset_uevent_ops *uevent_ops;
63263 + const struct kset_uevent_ops *uevent_ops;
63264 };
63265
63266 extern void kset_init(struct kset *kset);
63267 extern int __must_check kset_register(struct kset *kset);
63268 extern void kset_unregister(struct kset *kset);
63269 extern struct kset * __must_check kset_create_and_add(const char *name,
63270 - struct kset_uevent_ops *u,
63271 + const struct kset_uevent_ops *u,
63272 struct kobject *parent_kobj);
63273
63274 static inline struct kset *to_kset(struct kobject *kobj)
63275 diff -urNp linux-2.6.32.46/include/linux/kvm_host.h linux-2.6.32.46/include/linux/kvm_host.h
63276 --- linux-2.6.32.46/include/linux/kvm_host.h 2011-03-27 14:31:47.000000000 -0400
63277 +++ linux-2.6.32.46/include/linux/kvm_host.h 2011-04-17 15:56:46.000000000 -0400
63278 @@ -210,7 +210,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
63279 void vcpu_load(struct kvm_vcpu *vcpu);
63280 void vcpu_put(struct kvm_vcpu *vcpu);
63281
63282 -int kvm_init(void *opaque, unsigned int vcpu_size,
63283 +int kvm_init(const void *opaque, unsigned int vcpu_size,
63284 struct module *module);
63285 void kvm_exit(void);
63286
63287 @@ -316,7 +316,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
63288 struct kvm_guest_debug *dbg);
63289 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
63290
63291 -int kvm_arch_init(void *opaque);
63292 +int kvm_arch_init(const void *opaque);
63293 void kvm_arch_exit(void);
63294
63295 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
63296 diff -urNp linux-2.6.32.46/include/linux/libata.h linux-2.6.32.46/include/linux/libata.h
63297 --- linux-2.6.32.46/include/linux/libata.h 2011-03-27 14:31:47.000000000 -0400
63298 +++ linux-2.6.32.46/include/linux/libata.h 2011-08-26 20:19:09.000000000 -0400
63299 @@ -525,11 +525,11 @@ struct ata_ioports {
63300
63301 struct ata_host {
63302 spinlock_t lock;
63303 - struct device *dev;
63304 + struct device *dev;
63305 void __iomem * const *iomap;
63306 unsigned int n_ports;
63307 void *private_data;
63308 - struct ata_port_operations *ops;
63309 + const struct ata_port_operations *ops;
63310 unsigned long flags;
63311 #ifdef CONFIG_ATA_ACPI
63312 acpi_handle acpi_handle;
63313 @@ -710,7 +710,7 @@ struct ata_link {
63314
63315 struct ata_port {
63316 struct Scsi_Host *scsi_host; /* our co-allocated scsi host */
63317 - struct ata_port_operations *ops;
63318 + const struct ata_port_operations *ops;
63319 spinlock_t *lock;
63320 /* Flags owned by the EH context. Only EH should touch these once the
63321 port is active */
63322 @@ -884,7 +884,7 @@ struct ata_port_operations {
63323 * fields must be pointers.
63324 */
63325 const struct ata_port_operations *inherits;
63326 -};
63327 +} __do_const;
63328
63329 struct ata_port_info {
63330 unsigned long flags;
63331 @@ -892,7 +892,7 @@ struct ata_port_info {
63332 unsigned long pio_mask;
63333 unsigned long mwdma_mask;
63334 unsigned long udma_mask;
63335 - struct ata_port_operations *port_ops;
63336 + const struct ata_port_operations *port_ops;
63337 void *private_data;
63338 };
63339
63340 @@ -916,7 +916,7 @@ extern const unsigned long sata_deb_timi
63341 extern const unsigned long sata_deb_timing_hotplug[];
63342 extern const unsigned long sata_deb_timing_long[];
63343
63344 -extern struct ata_port_operations ata_dummy_port_ops;
63345 +extern const struct ata_port_operations ata_dummy_port_ops;
63346 extern const struct ata_port_info ata_dummy_port_info;
63347
63348 static inline const unsigned long *
63349 @@ -962,7 +962,7 @@ extern int ata_host_activate(struct ata_
63350 struct scsi_host_template *sht);
63351 extern void ata_host_detach(struct ata_host *host);
63352 extern void ata_host_init(struct ata_host *, struct device *,
63353 - unsigned long, struct ata_port_operations *);
63354 + unsigned long, const struct ata_port_operations *);
63355 extern int ata_scsi_detect(struct scsi_host_template *sht);
63356 extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
63357 extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
63358 diff -urNp linux-2.6.32.46/include/linux/lockd/bind.h linux-2.6.32.46/include/linux/lockd/bind.h
63359 --- linux-2.6.32.46/include/linux/lockd/bind.h 2011-03-27 14:31:47.000000000 -0400
63360 +++ linux-2.6.32.46/include/linux/lockd/bind.h 2011-04-17 15:56:46.000000000 -0400
63361 @@ -23,13 +23,13 @@ struct svc_rqst;
63362 * This is the set of functions for lockd->nfsd communication
63363 */
63364 struct nlmsvc_binding {
63365 - __be32 (*fopen)(struct svc_rqst *,
63366 + __be32 (* const fopen)(struct svc_rqst *,
63367 struct nfs_fh *,
63368 struct file **);
63369 - void (*fclose)(struct file *);
63370 + void (* const fclose)(struct file *);
63371 };
63372
63373 -extern struct nlmsvc_binding * nlmsvc_ops;
63374 +extern const struct nlmsvc_binding * nlmsvc_ops;
63375
63376 /*
63377 * Similar to nfs_client_initdata, but without the NFS-specific
63378 diff -urNp linux-2.6.32.46/include/linux/mca.h linux-2.6.32.46/include/linux/mca.h
63379 --- linux-2.6.32.46/include/linux/mca.h 2011-03-27 14:31:47.000000000 -0400
63380 +++ linux-2.6.32.46/include/linux/mca.h 2011-08-05 20:33:55.000000000 -0400
63381 @@ -80,7 +80,7 @@ struct mca_bus_accessor_functions {
63382 int region);
63383 void * (*mca_transform_memory)(struct mca_device *,
63384 void *memory);
63385 -};
63386 +} __no_const;
63387
63388 struct mca_bus {
63389 u64 default_dma_mask;
63390 diff -urNp linux-2.6.32.46/include/linux/memory.h linux-2.6.32.46/include/linux/memory.h
63391 --- linux-2.6.32.46/include/linux/memory.h 2011-03-27 14:31:47.000000000 -0400
63392 +++ linux-2.6.32.46/include/linux/memory.h 2011-08-05 20:33:55.000000000 -0400
63393 @@ -108,7 +108,7 @@ struct memory_accessor {
63394 size_t count);
63395 ssize_t (*write)(struct memory_accessor *, const char *buf,
63396 off_t offset, size_t count);
63397 -};
63398 +} __no_const;
63399
63400 /*
63401 * Kernel text modification mutex, used for code patching. Users of this lock
63402 diff -urNp linux-2.6.32.46/include/linux/mm.h linux-2.6.32.46/include/linux/mm.h
63403 --- linux-2.6.32.46/include/linux/mm.h 2011-03-27 14:31:47.000000000 -0400
63404 +++ linux-2.6.32.46/include/linux/mm.h 2011-04-17 15:56:46.000000000 -0400
63405 @@ -106,7 +106,14 @@ extern unsigned int kobjsize(const void
63406
63407 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
63408 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
63409 +
63410 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
63411 +#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
63412 +#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
63413 +#else
63414 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
63415 +#endif
63416 +
63417 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
63418 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
63419
63420 @@ -841,12 +848,6 @@ int set_page_dirty(struct page *page);
63421 int set_page_dirty_lock(struct page *page);
63422 int clear_page_dirty_for_io(struct page *page);
63423
63424 -/* Is the vma a continuation of the stack vma above it? */
63425 -static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr)
63426 -{
63427 - return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
63428 -}
63429 -
63430 extern unsigned long move_page_tables(struct vm_area_struct *vma,
63431 unsigned long old_addr, struct vm_area_struct *new_vma,
63432 unsigned long new_addr, unsigned long len);
63433 @@ -890,6 +891,8 @@ struct shrinker {
63434 extern void register_shrinker(struct shrinker *);
63435 extern void unregister_shrinker(struct shrinker *);
63436
63437 +pgprot_t vm_get_page_prot(unsigned long vm_flags);
63438 +
63439 int vma_wants_writenotify(struct vm_area_struct *vma);
63440
63441 extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
63442 @@ -1162,6 +1165,7 @@ out:
63443 }
63444
63445 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
63446 +extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
63447
63448 extern unsigned long do_brk(unsigned long, unsigned long);
63449
63450 @@ -1218,6 +1222,10 @@ extern struct vm_area_struct * find_vma(
63451 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
63452 struct vm_area_struct **pprev);
63453
63454 +extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
63455 +extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
63456 +extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
63457 +
63458 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
63459 NULL if none. Assume start_addr < end_addr. */
63460 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
63461 @@ -1234,7 +1242,6 @@ static inline unsigned long vma_pages(st
63462 return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
63463 }
63464
63465 -pgprot_t vm_get_page_prot(unsigned long vm_flags);
63466 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
63467 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
63468 unsigned long pfn, unsigned long size, pgprot_t);
63469 @@ -1332,7 +1339,13 @@ extern void memory_failure(unsigned long
63470 extern int __memory_failure(unsigned long pfn, int trapno, int ref);
63471 extern int sysctl_memory_failure_early_kill;
63472 extern int sysctl_memory_failure_recovery;
63473 -extern atomic_long_t mce_bad_pages;
63474 +extern atomic_long_unchecked_t mce_bad_pages;
63475 +
63476 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
63477 +extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
63478 +#else
63479 +static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
63480 +#endif
63481
63482 #endif /* __KERNEL__ */
63483 #endif /* _LINUX_MM_H */
63484 diff -urNp linux-2.6.32.46/include/linux/mm_types.h linux-2.6.32.46/include/linux/mm_types.h
63485 --- linux-2.6.32.46/include/linux/mm_types.h 2011-03-27 14:31:47.000000000 -0400
63486 +++ linux-2.6.32.46/include/linux/mm_types.h 2011-04-17 15:56:46.000000000 -0400
63487 @@ -186,6 +186,8 @@ struct vm_area_struct {
63488 #ifdef CONFIG_NUMA
63489 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
63490 #endif
63491 +
63492 + struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
63493 };
63494
63495 struct core_thread {
63496 @@ -287,6 +289,24 @@ struct mm_struct {
63497 #ifdef CONFIG_MMU_NOTIFIER
63498 struct mmu_notifier_mm *mmu_notifier_mm;
63499 #endif
63500 +
63501 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
63502 + unsigned long pax_flags;
63503 +#endif
63504 +
63505 +#ifdef CONFIG_PAX_DLRESOLVE
63506 + unsigned long call_dl_resolve;
63507 +#endif
63508 +
63509 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
63510 + unsigned long call_syscall;
63511 +#endif
63512 +
63513 +#ifdef CONFIG_PAX_ASLR
63514 + unsigned long delta_mmap; /* randomized offset */
63515 + unsigned long delta_stack; /* randomized offset */
63516 +#endif
63517 +
63518 };
63519
63520 /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
63521 diff -urNp linux-2.6.32.46/include/linux/mmu_notifier.h linux-2.6.32.46/include/linux/mmu_notifier.h
63522 --- linux-2.6.32.46/include/linux/mmu_notifier.h 2011-03-27 14:31:47.000000000 -0400
63523 +++ linux-2.6.32.46/include/linux/mmu_notifier.h 2011-04-17 15:56:46.000000000 -0400
63524 @@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destr
63525 */
63526 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
63527 ({ \
63528 - pte_t __pte; \
63529 + pte_t ___pte; \
63530 struct vm_area_struct *___vma = __vma; \
63531 unsigned long ___address = __address; \
63532 - __pte = ptep_clear_flush(___vma, ___address, __ptep); \
63533 + ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
63534 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
63535 - __pte; \
63536 + ___pte; \
63537 })
63538
63539 #define ptep_clear_flush_young_notify(__vma, __address, __ptep) \
63540 diff -urNp linux-2.6.32.46/include/linux/mmzone.h linux-2.6.32.46/include/linux/mmzone.h
63541 --- linux-2.6.32.46/include/linux/mmzone.h 2011-03-27 14:31:47.000000000 -0400
63542 +++ linux-2.6.32.46/include/linux/mmzone.h 2011-04-17 15:56:46.000000000 -0400
63543 @@ -350,7 +350,7 @@ struct zone {
63544 unsigned long flags; /* zone flags, see below */
63545
63546 /* Zone statistics */
63547 - atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63548 + atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63549
63550 /*
63551 * prev_priority holds the scanning priority for this zone. It is
63552 diff -urNp linux-2.6.32.46/include/linux/mod_devicetable.h linux-2.6.32.46/include/linux/mod_devicetable.h
63553 --- linux-2.6.32.46/include/linux/mod_devicetable.h 2011-03-27 14:31:47.000000000 -0400
63554 +++ linux-2.6.32.46/include/linux/mod_devicetable.h 2011-04-17 15:56:46.000000000 -0400
63555 @@ -12,7 +12,7 @@
63556 typedef unsigned long kernel_ulong_t;
63557 #endif
63558
63559 -#define PCI_ANY_ID (~0)
63560 +#define PCI_ANY_ID ((__u16)~0)
63561
63562 struct pci_device_id {
63563 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
63564 @@ -131,7 +131,7 @@ struct usb_device_id {
63565 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
63566 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
63567
63568 -#define HID_ANY_ID (~0)
63569 +#define HID_ANY_ID (~0U)
63570
63571 struct hid_device_id {
63572 __u16 bus;
63573 diff -urNp linux-2.6.32.46/include/linux/module.h linux-2.6.32.46/include/linux/module.h
63574 --- linux-2.6.32.46/include/linux/module.h 2011-03-27 14:31:47.000000000 -0400
63575 +++ linux-2.6.32.46/include/linux/module.h 2011-08-05 20:33:55.000000000 -0400
63576 @@ -16,6 +16,7 @@
63577 #include <linux/kobject.h>
63578 #include <linux/moduleparam.h>
63579 #include <linux/tracepoint.h>
63580 +#include <linux/fs.h>
63581
63582 #include <asm/local.h>
63583 #include <asm/module.h>
63584 @@ -287,16 +288,16 @@ struct module
63585 int (*init)(void);
63586
63587 /* If this is non-NULL, vfree after init() returns */
63588 - void *module_init;
63589 + void *module_init_rx, *module_init_rw;
63590
63591 /* Here is the actual code + data, vfree'd on unload. */
63592 - void *module_core;
63593 + void *module_core_rx, *module_core_rw;
63594
63595 /* Here are the sizes of the init and core sections */
63596 - unsigned int init_size, core_size;
63597 + unsigned int init_size_rw, core_size_rw;
63598
63599 /* The size of the executable code in each section. */
63600 - unsigned int init_text_size, core_text_size;
63601 + unsigned int init_size_rx, core_size_rx;
63602
63603 /* Arch-specific module values */
63604 struct mod_arch_specific arch;
63605 @@ -345,6 +346,10 @@ struct module
63606 #ifdef CONFIG_EVENT_TRACING
63607 struct ftrace_event_call *trace_events;
63608 unsigned int num_trace_events;
63609 + struct file_operations trace_id;
63610 + struct file_operations trace_enable;
63611 + struct file_operations trace_format;
63612 + struct file_operations trace_filter;
63613 #endif
63614 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
63615 unsigned long *ftrace_callsites;
63616 @@ -393,16 +398,46 @@ struct module *__module_address(unsigned
63617 bool is_module_address(unsigned long addr);
63618 bool is_module_text_address(unsigned long addr);
63619
63620 +static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
63621 +{
63622 +
63623 +#ifdef CONFIG_PAX_KERNEXEC
63624 + if (ktla_ktva(addr) >= (unsigned long)start &&
63625 + ktla_ktva(addr) < (unsigned long)start + size)
63626 + return 1;
63627 +#endif
63628 +
63629 + return ((void *)addr >= start && (void *)addr < start + size);
63630 +}
63631 +
63632 +static inline int within_module_core_rx(unsigned long addr, struct module *mod)
63633 +{
63634 + return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
63635 +}
63636 +
63637 +static inline int within_module_core_rw(unsigned long addr, struct module *mod)
63638 +{
63639 + return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
63640 +}
63641 +
63642 +static inline int within_module_init_rx(unsigned long addr, struct module *mod)
63643 +{
63644 + return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
63645 +}
63646 +
63647 +static inline int within_module_init_rw(unsigned long addr, struct module *mod)
63648 +{
63649 + return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
63650 +}
63651 +
63652 static inline int within_module_core(unsigned long addr, struct module *mod)
63653 {
63654 - return (unsigned long)mod->module_core <= addr &&
63655 - addr < (unsigned long)mod->module_core + mod->core_size;
63656 + return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
63657 }
63658
63659 static inline int within_module_init(unsigned long addr, struct module *mod)
63660 {
63661 - return (unsigned long)mod->module_init <= addr &&
63662 - addr < (unsigned long)mod->module_init + mod->init_size;
63663 + return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
63664 }
63665
63666 /* Search for module by name: must hold module_mutex. */
63667 diff -urNp linux-2.6.32.46/include/linux/moduleloader.h linux-2.6.32.46/include/linux/moduleloader.h
63668 --- linux-2.6.32.46/include/linux/moduleloader.h 2011-03-27 14:31:47.000000000 -0400
63669 +++ linux-2.6.32.46/include/linux/moduleloader.h 2011-04-17 15:56:46.000000000 -0400
63670 @@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
63671 sections. Returns NULL on failure. */
63672 void *module_alloc(unsigned long size);
63673
63674 +#ifdef CONFIG_PAX_KERNEXEC
63675 +void *module_alloc_exec(unsigned long size);
63676 +#else
63677 +#define module_alloc_exec(x) module_alloc(x)
63678 +#endif
63679 +
63680 /* Free memory returned from module_alloc. */
63681 void module_free(struct module *mod, void *module_region);
63682
63683 +#ifdef CONFIG_PAX_KERNEXEC
63684 +void module_free_exec(struct module *mod, void *module_region);
63685 +#else
63686 +#define module_free_exec(x, y) module_free((x), (y))
63687 +#endif
63688 +
63689 /* Apply the given relocation to the (simplified) ELF. Return -error
63690 or 0. */
63691 int apply_relocate(Elf_Shdr *sechdrs,
63692 diff -urNp linux-2.6.32.46/include/linux/moduleparam.h linux-2.6.32.46/include/linux/moduleparam.h
63693 --- linux-2.6.32.46/include/linux/moduleparam.h 2011-03-27 14:31:47.000000000 -0400
63694 +++ linux-2.6.32.46/include/linux/moduleparam.h 2011-04-17 15:56:46.000000000 -0400
63695 @@ -132,7 +132,7 @@ struct kparam_array
63696
63697 /* Actually copy string: maxlen param is usually sizeof(string). */
63698 #define module_param_string(name, string, len, perm) \
63699 - static const struct kparam_string __param_string_##name \
63700 + static const struct kparam_string __param_string_##name __used \
63701 = { len, string }; \
63702 __module_param_call(MODULE_PARAM_PREFIX, name, \
63703 param_set_copystring, param_get_string, \
63704 @@ -211,7 +211,7 @@ extern int param_get_invbool(char *buffe
63705
63706 /* Comma-separated array: *nump is set to number they actually specified. */
63707 #define module_param_array_named(name, array, type, nump, perm) \
63708 - static const struct kparam_array __param_arr_##name \
63709 + static const struct kparam_array __param_arr_##name __used \
63710 = { ARRAY_SIZE(array), nump, param_set_##type, param_get_##type,\
63711 sizeof(array[0]), array }; \
63712 __module_param_call(MODULE_PARAM_PREFIX, name, \
63713 diff -urNp linux-2.6.32.46/include/linux/mutex.h linux-2.6.32.46/include/linux/mutex.h
63714 --- linux-2.6.32.46/include/linux/mutex.h 2011-03-27 14:31:47.000000000 -0400
63715 +++ linux-2.6.32.46/include/linux/mutex.h 2011-04-17 15:56:46.000000000 -0400
63716 @@ -51,7 +51,7 @@ struct mutex {
63717 spinlock_t wait_lock;
63718 struct list_head wait_list;
63719 #if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP)
63720 - struct thread_info *owner;
63721 + struct task_struct *owner;
63722 #endif
63723 #ifdef CONFIG_DEBUG_MUTEXES
63724 const char *name;
63725 diff -urNp linux-2.6.32.46/include/linux/namei.h linux-2.6.32.46/include/linux/namei.h
63726 --- linux-2.6.32.46/include/linux/namei.h 2011-03-27 14:31:47.000000000 -0400
63727 +++ linux-2.6.32.46/include/linux/namei.h 2011-04-17 15:56:46.000000000 -0400
63728 @@ -22,7 +22,7 @@ struct nameidata {
63729 unsigned int flags;
63730 int last_type;
63731 unsigned depth;
63732 - char *saved_names[MAX_NESTED_LINKS + 1];
63733 + const char *saved_names[MAX_NESTED_LINKS + 1];
63734
63735 /* Intent data */
63736 union {
63737 @@ -84,12 +84,12 @@ extern int follow_up(struct path *);
63738 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
63739 extern void unlock_rename(struct dentry *, struct dentry *);
63740
63741 -static inline void nd_set_link(struct nameidata *nd, char *path)
63742 +static inline void nd_set_link(struct nameidata *nd, const char *path)
63743 {
63744 nd->saved_names[nd->depth] = path;
63745 }
63746
63747 -static inline char *nd_get_link(struct nameidata *nd)
63748 +static inline const char *nd_get_link(const struct nameidata *nd)
63749 {
63750 return nd->saved_names[nd->depth];
63751 }
63752 diff -urNp linux-2.6.32.46/include/linux/netdevice.h linux-2.6.32.46/include/linux/netdevice.h
63753 --- linux-2.6.32.46/include/linux/netdevice.h 2011-08-09 18:35:30.000000000 -0400
63754 +++ linux-2.6.32.46/include/linux/netdevice.h 2011-08-23 21:22:38.000000000 -0400
63755 @@ -637,6 +637,7 @@ struct net_device_ops {
63756 u16 xid);
63757 #endif
63758 };
63759 +typedef struct net_device_ops __no_const net_device_ops_no_const;
63760
63761 /*
63762 * The DEVICE structure.
63763 diff -urNp linux-2.6.32.46/include/linux/netfilter/xt_gradm.h linux-2.6.32.46/include/linux/netfilter/xt_gradm.h
63764 --- linux-2.6.32.46/include/linux/netfilter/xt_gradm.h 1969-12-31 19:00:00.000000000 -0500
63765 +++ linux-2.6.32.46/include/linux/netfilter/xt_gradm.h 2011-04-17 15:56:46.000000000 -0400
63766 @@ -0,0 +1,9 @@
63767 +#ifndef _LINUX_NETFILTER_XT_GRADM_H
63768 +#define _LINUX_NETFILTER_XT_GRADM_H 1
63769 +
63770 +struct xt_gradm_mtinfo {
63771 + __u16 flags;
63772 + __u16 invflags;
63773 +};
63774 +
63775 +#endif
63776 diff -urNp linux-2.6.32.46/include/linux/nodemask.h linux-2.6.32.46/include/linux/nodemask.h
63777 --- linux-2.6.32.46/include/linux/nodemask.h 2011-03-27 14:31:47.000000000 -0400
63778 +++ linux-2.6.32.46/include/linux/nodemask.h 2011-04-17 15:56:46.000000000 -0400
63779 @@ -464,11 +464,11 @@ static inline int num_node_state(enum no
63780
63781 #define any_online_node(mask) \
63782 ({ \
63783 - int node; \
63784 - for_each_node_mask(node, (mask)) \
63785 - if (node_online(node)) \
63786 + int __node; \
63787 + for_each_node_mask(__node, (mask)) \
63788 + if (node_online(__node)) \
63789 break; \
63790 - node; \
63791 + __node; \
63792 })
63793
63794 #define num_online_nodes() num_node_state(N_ONLINE)
63795 diff -urNp linux-2.6.32.46/include/linux/oprofile.h linux-2.6.32.46/include/linux/oprofile.h
63796 --- linux-2.6.32.46/include/linux/oprofile.h 2011-03-27 14:31:47.000000000 -0400
63797 +++ linux-2.6.32.46/include/linux/oprofile.h 2011-04-17 15:56:46.000000000 -0400
63798 @@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super
63799 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
63800 char const * name, ulong * val);
63801
63802 -/** Create a file for read-only access to an atomic_t. */
63803 +/** Create a file for read-only access to an atomic_unchecked_t. */
63804 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
63805 - char const * name, atomic_t * val);
63806 + char const * name, atomic_unchecked_t * val);
63807
63808 /** create a directory */
63809 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
63810 diff -urNp linux-2.6.32.46/include/linux/pagemap.h linux-2.6.32.46/include/linux/pagemap.h
63811 --- linux-2.6.32.46/include/linux/pagemap.h 2011-03-27 14:31:47.000000000 -0400
63812 +++ linux-2.6.32.46/include/linux/pagemap.h 2011-08-17 19:36:28.000000000 -0400
63813 @@ -425,6 +425,7 @@ static inline int fault_in_pages_readabl
63814 if (((unsigned long)uaddr & PAGE_MASK) !=
63815 ((unsigned long)end & PAGE_MASK))
63816 ret = __get_user(c, end);
63817 + (void)c;
63818 }
63819 return ret;
63820 }
63821 diff -urNp linux-2.6.32.46/include/linux/perf_event.h linux-2.6.32.46/include/linux/perf_event.h
63822 --- linux-2.6.32.46/include/linux/perf_event.h 2011-03-27 14:31:47.000000000 -0400
63823 +++ linux-2.6.32.46/include/linux/perf_event.h 2011-05-04 17:56:28.000000000 -0400
63824 @@ -476,7 +476,7 @@ struct hw_perf_event {
63825 struct hrtimer hrtimer;
63826 };
63827 };
63828 - atomic64_t prev_count;
63829 + atomic64_unchecked_t prev_count;
63830 u64 sample_period;
63831 u64 last_period;
63832 atomic64_t period_left;
63833 @@ -557,7 +557,7 @@ struct perf_event {
63834 const struct pmu *pmu;
63835
63836 enum perf_event_active_state state;
63837 - atomic64_t count;
63838 + atomic64_unchecked_t count;
63839
63840 /*
63841 * These are the total time in nanoseconds that the event
63842 @@ -595,8 +595,8 @@ struct perf_event {
63843 * These accumulate total time (in nanoseconds) that children
63844 * events have been enabled and running, respectively.
63845 */
63846 - atomic64_t child_total_time_enabled;
63847 - atomic64_t child_total_time_running;
63848 + atomic64_unchecked_t child_total_time_enabled;
63849 + atomic64_unchecked_t child_total_time_running;
63850
63851 /*
63852 * Protect attach/detach and child_list:
63853 diff -urNp linux-2.6.32.46/include/linux/pipe_fs_i.h linux-2.6.32.46/include/linux/pipe_fs_i.h
63854 --- linux-2.6.32.46/include/linux/pipe_fs_i.h 2011-03-27 14:31:47.000000000 -0400
63855 +++ linux-2.6.32.46/include/linux/pipe_fs_i.h 2011-04-17 15:56:46.000000000 -0400
63856 @@ -46,9 +46,9 @@ struct pipe_inode_info {
63857 wait_queue_head_t wait;
63858 unsigned int nrbufs, curbuf;
63859 struct page *tmp_page;
63860 - unsigned int readers;
63861 - unsigned int writers;
63862 - unsigned int waiting_writers;
63863 + atomic_t readers;
63864 + atomic_t writers;
63865 + atomic_t waiting_writers;
63866 unsigned int r_counter;
63867 unsigned int w_counter;
63868 struct fasync_struct *fasync_readers;
63869 diff -urNp linux-2.6.32.46/include/linux/poison.h linux-2.6.32.46/include/linux/poison.h
63870 --- linux-2.6.32.46/include/linux/poison.h 2011-03-27 14:31:47.000000000 -0400
63871 +++ linux-2.6.32.46/include/linux/poison.h 2011-04-17 15:56:46.000000000 -0400
63872 @@ -19,8 +19,8 @@
63873 * under normal circumstances, used to verify that nobody uses
63874 * non-initialized list entries.
63875 */
63876 -#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
63877 -#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
63878 +#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
63879 +#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
63880
63881 /********** include/linux/timer.h **********/
63882 /*
63883 diff -urNp linux-2.6.32.46/include/linux/posix-timers.h linux-2.6.32.46/include/linux/posix-timers.h
63884 --- linux-2.6.32.46/include/linux/posix-timers.h 2011-03-27 14:31:47.000000000 -0400
63885 +++ linux-2.6.32.46/include/linux/posix-timers.h 2011-08-05 20:33:55.000000000 -0400
63886 @@ -67,7 +67,7 @@ struct k_itimer {
63887 };
63888
63889 struct k_clock {
63890 - int res; /* in nanoseconds */
63891 + const int res; /* in nanoseconds */
63892 int (*clock_getres) (const clockid_t which_clock, struct timespec *tp);
63893 int (*clock_set) (const clockid_t which_clock, struct timespec * tp);
63894 int (*clock_get) (const clockid_t which_clock, struct timespec * tp);
63895 diff -urNp linux-2.6.32.46/include/linux/preempt.h linux-2.6.32.46/include/linux/preempt.h
63896 --- linux-2.6.32.46/include/linux/preempt.h 2011-03-27 14:31:47.000000000 -0400
63897 +++ linux-2.6.32.46/include/linux/preempt.h 2011-08-05 20:33:55.000000000 -0400
63898 @@ -110,7 +110,7 @@ struct preempt_ops {
63899 void (*sched_in)(struct preempt_notifier *notifier, int cpu);
63900 void (*sched_out)(struct preempt_notifier *notifier,
63901 struct task_struct *next);
63902 -};
63903 +} __no_const;
63904
63905 /**
63906 * preempt_notifier - key for installing preemption notifiers
63907 diff -urNp linux-2.6.32.46/include/linux/proc_fs.h linux-2.6.32.46/include/linux/proc_fs.h
63908 --- linux-2.6.32.46/include/linux/proc_fs.h 2011-03-27 14:31:47.000000000 -0400
63909 +++ linux-2.6.32.46/include/linux/proc_fs.h 2011-08-05 20:33:55.000000000 -0400
63910 @@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
63911 return proc_create_data(name, mode, parent, proc_fops, NULL);
63912 }
63913
63914 +static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
63915 + struct proc_dir_entry *parent, const struct file_operations *proc_fops)
63916 +{
63917 +#ifdef CONFIG_GRKERNSEC_PROC_USER
63918 + return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
63919 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
63920 + return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
63921 +#else
63922 + return proc_create_data(name, mode, parent, proc_fops, NULL);
63923 +#endif
63924 +}
63925 +
63926 +
63927 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
63928 mode_t mode, struct proc_dir_entry *base,
63929 read_proc_t *read_proc, void * data)
63930 @@ -256,7 +269,7 @@ union proc_op {
63931 int (*proc_show)(struct seq_file *m,
63932 struct pid_namespace *ns, struct pid *pid,
63933 struct task_struct *task);
63934 -};
63935 +} __no_const;
63936
63937 struct ctl_table_header;
63938 struct ctl_table;
63939 diff -urNp linux-2.6.32.46/include/linux/ptrace.h linux-2.6.32.46/include/linux/ptrace.h
63940 --- linux-2.6.32.46/include/linux/ptrace.h 2011-03-27 14:31:47.000000000 -0400
63941 +++ linux-2.6.32.46/include/linux/ptrace.h 2011-04-17 15:56:46.000000000 -0400
63942 @@ -96,10 +96,10 @@ extern void __ptrace_unlink(struct task_
63943 extern void exit_ptrace(struct task_struct *tracer);
63944 #define PTRACE_MODE_READ 1
63945 #define PTRACE_MODE_ATTACH 2
63946 -/* Returns 0 on success, -errno on denial. */
63947 -extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
63948 /* Returns true on success, false on denial. */
63949 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
63950 +/* Returns true on success, false on denial. */
63951 +extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
63952
63953 static inline int ptrace_reparented(struct task_struct *child)
63954 {
63955 diff -urNp linux-2.6.32.46/include/linux/random.h linux-2.6.32.46/include/linux/random.h
63956 --- linux-2.6.32.46/include/linux/random.h 2011-08-16 20:37:25.000000000 -0400
63957 +++ linux-2.6.32.46/include/linux/random.h 2011-08-07 19:48:09.000000000 -0400
63958 @@ -63,6 +63,11 @@ unsigned long randomize_range(unsigned l
63959 u32 random32(void);
63960 void srandom32(u32 seed);
63961
63962 +static inline unsigned long pax_get_random_long(void)
63963 +{
63964 + return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
63965 +}
63966 +
63967 #endif /* __KERNEL___ */
63968
63969 #endif /* _LINUX_RANDOM_H */
63970 diff -urNp linux-2.6.32.46/include/linux/reboot.h linux-2.6.32.46/include/linux/reboot.h
63971 --- linux-2.6.32.46/include/linux/reboot.h 2011-03-27 14:31:47.000000000 -0400
63972 +++ linux-2.6.32.46/include/linux/reboot.h 2011-05-22 23:02:06.000000000 -0400
63973 @@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(st
63974 * Architecture-specific implementations of sys_reboot commands.
63975 */
63976
63977 -extern void machine_restart(char *cmd);
63978 -extern void machine_halt(void);
63979 -extern void machine_power_off(void);
63980 +extern void machine_restart(char *cmd) __noreturn;
63981 +extern void machine_halt(void) __noreturn;
63982 +extern void machine_power_off(void) __noreturn;
63983
63984 extern void machine_shutdown(void);
63985 struct pt_regs;
63986 @@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struc
63987 */
63988
63989 extern void kernel_restart_prepare(char *cmd);
63990 -extern void kernel_restart(char *cmd);
63991 -extern void kernel_halt(void);
63992 -extern void kernel_power_off(void);
63993 +extern void kernel_restart(char *cmd) __noreturn;
63994 +extern void kernel_halt(void) __noreturn;
63995 +extern void kernel_power_off(void) __noreturn;
63996
63997 void ctrl_alt_del(void);
63998
63999 @@ -75,7 +75,7 @@ extern int orderly_poweroff(bool force);
64000 * Emergency restart, callable from an interrupt handler.
64001 */
64002
64003 -extern void emergency_restart(void);
64004 +extern void emergency_restart(void) __noreturn;
64005 #include <asm/emergency-restart.h>
64006
64007 #endif
64008 diff -urNp linux-2.6.32.46/include/linux/reiserfs_fs.h linux-2.6.32.46/include/linux/reiserfs_fs.h
64009 --- linux-2.6.32.46/include/linux/reiserfs_fs.h 2011-03-27 14:31:47.000000000 -0400
64010 +++ linux-2.6.32.46/include/linux/reiserfs_fs.h 2011-04-17 15:56:46.000000000 -0400
64011 @@ -1326,7 +1326,7 @@ static inline loff_t max_reiserfs_offset
64012 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
64013
64014 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
64015 -#define get_generation(s) atomic_read (&fs_generation(s))
64016 +#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
64017 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
64018 #define __fs_changed(gen,s) (gen != get_generation (s))
64019 #define fs_changed(gen,s) ({cond_resched(); __fs_changed(gen, s);})
64020 @@ -1534,24 +1534,24 @@ static inline struct super_block *sb_fro
64021 */
64022
64023 struct item_operations {
64024 - int (*bytes_number) (struct item_head * ih, int block_size);
64025 - void (*decrement_key) (struct cpu_key *);
64026 - int (*is_left_mergeable) (struct reiserfs_key * ih,
64027 + int (* const bytes_number) (struct item_head * ih, int block_size);
64028 + void (* const decrement_key) (struct cpu_key *);
64029 + int (* const is_left_mergeable) (struct reiserfs_key * ih,
64030 unsigned long bsize);
64031 - void (*print_item) (struct item_head *, char *item);
64032 - void (*check_item) (struct item_head *, char *item);
64033 + void (* const print_item) (struct item_head *, char *item);
64034 + void (* const check_item) (struct item_head *, char *item);
64035
64036 - int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
64037 + int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
64038 int is_affected, int insert_size);
64039 - int (*check_left) (struct virtual_item * vi, int free,
64040 + int (* const check_left) (struct virtual_item * vi, int free,
64041 int start_skip, int end_skip);
64042 - int (*check_right) (struct virtual_item * vi, int free);
64043 - int (*part_size) (struct virtual_item * vi, int from, int to);
64044 - int (*unit_num) (struct virtual_item * vi);
64045 - void (*print_vi) (struct virtual_item * vi);
64046 + int (* const check_right) (struct virtual_item * vi, int free);
64047 + int (* const part_size) (struct virtual_item * vi, int from, int to);
64048 + int (* const unit_num) (struct virtual_item * vi);
64049 + void (* const print_vi) (struct virtual_item * vi);
64050 };
64051
64052 -extern struct item_operations *item_ops[TYPE_ANY + 1];
64053 +extern const struct item_operations * const item_ops[TYPE_ANY + 1];
64054
64055 #define op_bytes_number(ih,bsize) item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
64056 #define op_is_left_mergeable(key,bsize) item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
64057 diff -urNp linux-2.6.32.46/include/linux/reiserfs_fs_sb.h linux-2.6.32.46/include/linux/reiserfs_fs_sb.h
64058 --- linux-2.6.32.46/include/linux/reiserfs_fs_sb.h 2011-03-27 14:31:47.000000000 -0400
64059 +++ linux-2.6.32.46/include/linux/reiserfs_fs_sb.h 2011-04-17 15:56:46.000000000 -0400
64060 @@ -377,7 +377,7 @@ struct reiserfs_sb_info {
64061 /* Comment? -Hans */
64062 wait_queue_head_t s_wait;
64063 /* To be obsoleted soon by per buffer seals.. -Hans */
64064 - atomic_t s_generation_counter; // increased by one every time the
64065 + atomic_unchecked_t s_generation_counter; // increased by one every time the
64066 // tree gets re-balanced
64067 unsigned long s_properties; /* File system properties. Currently holds
64068 on-disk FS format */
64069 diff -urNp linux-2.6.32.46/include/linux/relay.h linux-2.6.32.46/include/linux/relay.h
64070 --- linux-2.6.32.46/include/linux/relay.h 2011-03-27 14:31:47.000000000 -0400
64071 +++ linux-2.6.32.46/include/linux/relay.h 2011-08-05 20:33:55.000000000 -0400
64072 @@ -159,7 +159,7 @@ struct rchan_callbacks
64073 * The callback should return 0 if successful, negative if not.
64074 */
64075 int (*remove_buf_file)(struct dentry *dentry);
64076 -};
64077 +} __no_const;
64078
64079 /*
64080 * CONFIG_RELAY kernel API, kernel/relay.c
64081 diff -urNp linux-2.6.32.46/include/linux/rfkill.h linux-2.6.32.46/include/linux/rfkill.h
64082 --- linux-2.6.32.46/include/linux/rfkill.h 2011-03-27 14:31:47.000000000 -0400
64083 +++ linux-2.6.32.46/include/linux/rfkill.h 2011-08-23 21:22:38.000000000 -0400
64084 @@ -144,6 +144,7 @@ struct rfkill_ops {
64085 void (*query)(struct rfkill *rfkill, void *data);
64086 int (*set_block)(void *data, bool blocked);
64087 };
64088 +typedef struct rfkill_ops __no_const rfkill_ops_no_const;
64089
64090 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
64091 /**
64092 diff -urNp linux-2.6.32.46/include/linux/sched.h linux-2.6.32.46/include/linux/sched.h
64093 --- linux-2.6.32.46/include/linux/sched.h 2011-03-27 14:31:47.000000000 -0400
64094 +++ linux-2.6.32.46/include/linux/sched.h 2011-08-11 19:48:55.000000000 -0400
64095 @@ -101,6 +101,7 @@ struct bio;
64096 struct fs_struct;
64097 struct bts_context;
64098 struct perf_event_context;
64099 +struct linux_binprm;
64100
64101 /*
64102 * List of flags we want to share for kernel threads,
64103 @@ -350,7 +351,7 @@ extern signed long schedule_timeout_kill
64104 extern signed long schedule_timeout_uninterruptible(signed long timeout);
64105 asmlinkage void __schedule(void);
64106 asmlinkage void schedule(void);
64107 -extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
64108 +extern int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner);
64109
64110 struct nsproxy;
64111 struct user_namespace;
64112 @@ -371,9 +372,12 @@ struct user_namespace;
64113 #define DEFAULT_MAX_MAP_COUNT (USHORT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
64114
64115 extern int sysctl_max_map_count;
64116 +extern unsigned long sysctl_heap_stack_gap;
64117
64118 #include <linux/aio.h>
64119
64120 +extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
64121 +extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
64122 extern unsigned long
64123 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
64124 unsigned long, unsigned long);
64125 @@ -666,6 +670,16 @@ struct signal_struct {
64126 struct tty_audit_buf *tty_audit_buf;
64127 #endif
64128
64129 +#ifdef CONFIG_GRKERNSEC
64130 + u32 curr_ip;
64131 + u32 saved_ip;
64132 + u32 gr_saddr;
64133 + u32 gr_daddr;
64134 + u16 gr_sport;
64135 + u16 gr_dport;
64136 + u8 used_accept:1;
64137 +#endif
64138 +
64139 int oom_adj; /* OOM kill score adjustment (bit shift) */
64140 };
64141
64142 @@ -723,6 +737,11 @@ struct user_struct {
64143 struct key *session_keyring; /* UID's default session keyring */
64144 #endif
64145
64146 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
64147 + unsigned int banned;
64148 + unsigned long ban_expires;
64149 +#endif
64150 +
64151 /* Hash table maintenance information */
64152 struct hlist_node uidhash_node;
64153 uid_t uid;
64154 @@ -1328,8 +1347,8 @@ struct task_struct {
64155 struct list_head thread_group;
64156
64157 struct completion *vfork_done; /* for vfork() */
64158 - int __user *set_child_tid; /* CLONE_CHILD_SETTID */
64159 - int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
64160 + pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
64161 + pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
64162
64163 cputime_t utime, stime, utimescaled, stimescaled;
64164 cputime_t gtime;
64165 @@ -1343,16 +1362,6 @@ struct task_struct {
64166 struct task_cputime cputime_expires;
64167 struct list_head cpu_timers[3];
64168
64169 -/* process credentials */
64170 - const struct cred *real_cred; /* objective and real subjective task
64171 - * credentials (COW) */
64172 - const struct cred *cred; /* effective (overridable) subjective task
64173 - * credentials (COW) */
64174 - struct mutex cred_guard_mutex; /* guard against foreign influences on
64175 - * credential calculations
64176 - * (notably. ptrace) */
64177 - struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
64178 -
64179 char comm[TASK_COMM_LEN]; /* executable name excluding path
64180 - access with [gs]et_task_comm (which lock
64181 it with task_lock())
64182 @@ -1369,6 +1378,10 @@ struct task_struct {
64183 #endif
64184 /* CPU-specific state of this task */
64185 struct thread_struct thread;
64186 +/* thread_info moved to task_struct */
64187 +#ifdef CONFIG_X86
64188 + struct thread_info tinfo;
64189 +#endif
64190 /* filesystem information */
64191 struct fs_struct *fs;
64192 /* open file information */
64193 @@ -1436,6 +1449,15 @@ struct task_struct {
64194 int hardirq_context;
64195 int softirq_context;
64196 #endif
64197 +
64198 +/* process credentials */
64199 + const struct cred *real_cred; /* objective and real subjective task
64200 + * credentials (COW) */
64201 + struct mutex cred_guard_mutex; /* guard against foreign influences on
64202 + * credential calculations
64203 + * (notably. ptrace) */
64204 + struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
64205 +
64206 #ifdef CONFIG_LOCKDEP
64207 # define MAX_LOCK_DEPTH 48UL
64208 u64 curr_chain_key;
64209 @@ -1456,6 +1478,9 @@ struct task_struct {
64210
64211 struct backing_dev_info *backing_dev_info;
64212
64213 + const struct cred *cred; /* effective (overridable) subjective task
64214 + * credentials (COW) */
64215 +
64216 struct io_context *io_context;
64217
64218 unsigned long ptrace_message;
64219 @@ -1519,6 +1544,21 @@ struct task_struct {
64220 unsigned long default_timer_slack_ns;
64221
64222 struct list_head *scm_work_list;
64223 +
64224 +#ifdef CONFIG_GRKERNSEC
64225 + /* grsecurity */
64226 + struct dentry *gr_chroot_dentry;
64227 + struct acl_subject_label *acl;
64228 + struct acl_role_label *role;
64229 + struct file *exec_file;
64230 + u16 acl_role_id;
64231 + /* is this the task that authenticated to the special role */
64232 + u8 acl_sp_role;
64233 + u8 is_writable;
64234 + u8 brute;
64235 + u8 gr_is_chrooted;
64236 +#endif
64237 +
64238 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
64239 /* Index of current stored adress in ret_stack */
64240 int curr_ret_stack;
64241 @@ -1542,6 +1582,57 @@ struct task_struct {
64242 #endif /* CONFIG_TRACING */
64243 };
64244
64245 +#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
64246 +#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
64247 +#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
64248 +#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
64249 +/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
64250 +#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
64251 +
64252 +#ifdef CONFIG_PAX_SOFTMODE
64253 +extern int pax_softmode;
64254 +#endif
64255 +
64256 +extern int pax_check_flags(unsigned long *);
64257 +
64258 +/* if tsk != current then task_lock must be held on it */
64259 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
64260 +static inline unsigned long pax_get_flags(struct task_struct *tsk)
64261 +{
64262 + if (likely(tsk->mm))
64263 + return tsk->mm->pax_flags;
64264 + else
64265 + return 0UL;
64266 +}
64267 +
64268 +/* if tsk != current then task_lock must be held on it */
64269 +static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
64270 +{
64271 + if (likely(tsk->mm)) {
64272 + tsk->mm->pax_flags = flags;
64273 + return 0;
64274 + }
64275 + return -EINVAL;
64276 +}
64277 +#endif
64278 +
64279 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
64280 +extern void pax_set_initial_flags(struct linux_binprm *bprm);
64281 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
64282 +extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
64283 +#endif
64284 +
64285 +extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
64286 +extern void pax_report_insns(void *pc, void *sp);
64287 +extern void pax_report_refcount_overflow(struct pt_regs *regs);
64288 +extern NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type) ATTRIB_NORET;
64289 +
64290 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
64291 +extern void pax_track_stack(void);
64292 +#else
64293 +static inline void pax_track_stack(void) {}
64294 +#endif
64295 +
64296 /* Future-safe accessor for struct task_struct's cpus_allowed. */
64297 #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
64298
64299 @@ -1740,7 +1831,7 @@ extern void thread_group_times(struct ta
64300 #define PF_DUMPCORE 0x00000200 /* dumped core */
64301 #define PF_SIGNALED 0x00000400 /* killed by a signal */
64302 #define PF_MEMALLOC 0x00000800 /* Allocating memory */
64303 -#define PF_FLUSHER 0x00001000 /* responsible for disk writeback */
64304 +#define PF_NPROC_EXCEEDED 0x00001000 /* set_user noticed that RLIMIT_NPROC was exceeded */
64305 #define PF_USED_MATH 0x00002000 /* if unset the fpu must be initialized before use */
64306 #define PF_FREEZING 0x00004000 /* freeze in progress. do not account to load */
64307 #define PF_NOFREEZE 0x00008000 /* this thread should not be frozen */
64308 @@ -1978,7 +2069,9 @@ void yield(void);
64309 extern struct exec_domain default_exec_domain;
64310
64311 union thread_union {
64312 +#ifndef CONFIG_X86
64313 struct thread_info thread_info;
64314 +#endif
64315 unsigned long stack[THREAD_SIZE/sizeof(long)];
64316 };
64317
64318 @@ -2011,6 +2104,7 @@ extern struct pid_namespace init_pid_ns;
64319 */
64320
64321 extern struct task_struct *find_task_by_vpid(pid_t nr);
64322 +extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
64323 extern struct task_struct *find_task_by_pid_ns(pid_t nr,
64324 struct pid_namespace *ns);
64325
64326 @@ -2155,7 +2249,7 @@ extern void __cleanup_sighand(struct sig
64327 extern void exit_itimers(struct signal_struct *);
64328 extern void flush_itimer_signals(void);
64329
64330 -extern NORET_TYPE void do_group_exit(int);
64331 +extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
64332
64333 extern void daemonize(const char *, ...);
64334 extern int allow_signal(int);
64335 @@ -2284,13 +2378,17 @@ static inline unsigned long *end_of_stac
64336
64337 #endif
64338
64339 -static inline int object_is_on_stack(void *obj)
64340 +static inline int object_starts_on_stack(void *obj)
64341 {
64342 - void *stack = task_stack_page(current);
64343 + const void *stack = task_stack_page(current);
64344
64345 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
64346 }
64347
64348 +#ifdef CONFIG_PAX_USERCOPY
64349 +extern int object_is_on_stack(const void *obj, unsigned long len);
64350 +#endif
64351 +
64352 extern void thread_info_cache_init(void);
64353
64354 #ifdef CONFIG_DEBUG_STACK_USAGE
64355 diff -urNp linux-2.6.32.46/include/linux/screen_info.h linux-2.6.32.46/include/linux/screen_info.h
64356 --- linux-2.6.32.46/include/linux/screen_info.h 2011-03-27 14:31:47.000000000 -0400
64357 +++ linux-2.6.32.46/include/linux/screen_info.h 2011-04-17 15:56:46.000000000 -0400
64358 @@ -42,7 +42,8 @@ struct screen_info {
64359 __u16 pages; /* 0x32 */
64360 __u16 vesa_attributes; /* 0x34 */
64361 __u32 capabilities; /* 0x36 */
64362 - __u8 _reserved[6]; /* 0x3a */
64363 + __u16 vesapm_size; /* 0x3a */
64364 + __u8 _reserved[4]; /* 0x3c */
64365 } __attribute__((packed));
64366
64367 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
64368 diff -urNp linux-2.6.32.46/include/linux/security.h linux-2.6.32.46/include/linux/security.h
64369 --- linux-2.6.32.46/include/linux/security.h 2011-03-27 14:31:47.000000000 -0400
64370 +++ linux-2.6.32.46/include/linux/security.h 2011-04-17 15:56:46.000000000 -0400
64371 @@ -34,6 +34,7 @@
64372 #include <linux/key.h>
64373 #include <linux/xfrm.h>
64374 #include <linux/gfp.h>
64375 +#include <linux/grsecurity.h>
64376 #include <net/flow.h>
64377
64378 /* Maximum number of letters for an LSM name string */
64379 diff -urNp linux-2.6.32.46/include/linux/seq_file.h linux-2.6.32.46/include/linux/seq_file.h
64380 --- linux-2.6.32.46/include/linux/seq_file.h 2011-03-27 14:31:47.000000000 -0400
64381 +++ linux-2.6.32.46/include/linux/seq_file.h 2011-08-23 21:22:38.000000000 -0400
64382 @@ -32,6 +32,7 @@ struct seq_operations {
64383 void * (*next) (struct seq_file *m, void *v, loff_t *pos);
64384 int (*show) (struct seq_file *m, void *v);
64385 };
64386 +typedef struct seq_operations __no_const seq_operations_no_const;
64387
64388 #define SEQ_SKIP 1
64389
64390 diff -urNp linux-2.6.32.46/include/linux/shm.h linux-2.6.32.46/include/linux/shm.h
64391 --- linux-2.6.32.46/include/linux/shm.h 2011-03-27 14:31:47.000000000 -0400
64392 +++ linux-2.6.32.46/include/linux/shm.h 2011-04-17 15:56:46.000000000 -0400
64393 @@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
64394 pid_t shm_cprid;
64395 pid_t shm_lprid;
64396 struct user_struct *mlock_user;
64397 +#ifdef CONFIG_GRKERNSEC
64398 + time_t shm_createtime;
64399 + pid_t shm_lapid;
64400 +#endif
64401 };
64402
64403 /* shm_mode upper byte flags */
64404 diff -urNp linux-2.6.32.46/include/linux/skbuff.h linux-2.6.32.46/include/linux/skbuff.h
64405 --- linux-2.6.32.46/include/linux/skbuff.h 2011-03-27 14:31:47.000000000 -0400
64406 +++ linux-2.6.32.46/include/linux/skbuff.h 2011-08-21 15:27:56.000000000 -0400
64407 @@ -14,6 +14,7 @@
64408 #ifndef _LINUX_SKBUFF_H
64409 #define _LINUX_SKBUFF_H
64410
64411 +#include <linux/const.h>
64412 #include <linux/kernel.h>
64413 #include <linux/kmemcheck.h>
64414 #include <linux/compiler.h>
64415 @@ -544,7 +545,7 @@ static inline union skb_shared_tx *skb_t
64416 */
64417 static inline int skb_queue_empty(const struct sk_buff_head *list)
64418 {
64419 - return list->next == (struct sk_buff *)list;
64420 + return list->next == (const struct sk_buff *)list;
64421 }
64422
64423 /**
64424 @@ -557,7 +558,7 @@ static inline int skb_queue_empty(const
64425 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
64426 const struct sk_buff *skb)
64427 {
64428 - return (skb->next == (struct sk_buff *) list);
64429 + return (skb->next == (const struct sk_buff *) list);
64430 }
64431
64432 /**
64433 @@ -570,7 +571,7 @@ static inline bool skb_queue_is_last(con
64434 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
64435 const struct sk_buff *skb)
64436 {
64437 - return (skb->prev == (struct sk_buff *) list);
64438 + return (skb->prev == (const struct sk_buff *) list);
64439 }
64440
64441 /**
64442 @@ -1367,7 +1368,7 @@ static inline int skb_network_offset(con
64443 * headroom, you should not reduce this.
64444 */
64445 #ifndef NET_SKB_PAD
64446 -#define NET_SKB_PAD 32
64447 +#define NET_SKB_PAD (_AC(32,UL))
64448 #endif
64449
64450 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
64451 diff -urNp linux-2.6.32.46/include/linux/slab_def.h linux-2.6.32.46/include/linux/slab_def.h
64452 --- linux-2.6.32.46/include/linux/slab_def.h 2011-03-27 14:31:47.000000000 -0400
64453 +++ linux-2.6.32.46/include/linux/slab_def.h 2011-05-04 17:56:28.000000000 -0400
64454 @@ -69,10 +69,10 @@ struct kmem_cache {
64455 unsigned long node_allocs;
64456 unsigned long node_frees;
64457 unsigned long node_overflow;
64458 - atomic_t allochit;
64459 - atomic_t allocmiss;
64460 - atomic_t freehit;
64461 - atomic_t freemiss;
64462 + atomic_unchecked_t allochit;
64463 + atomic_unchecked_t allocmiss;
64464 + atomic_unchecked_t freehit;
64465 + atomic_unchecked_t freemiss;
64466
64467 /*
64468 * If debugging is enabled, then the allocator can add additional
64469 diff -urNp linux-2.6.32.46/include/linux/slab.h linux-2.6.32.46/include/linux/slab.h
64470 --- linux-2.6.32.46/include/linux/slab.h 2011-03-27 14:31:47.000000000 -0400
64471 +++ linux-2.6.32.46/include/linux/slab.h 2011-04-17 15:56:46.000000000 -0400
64472 @@ -11,12 +11,20 @@
64473
64474 #include <linux/gfp.h>
64475 #include <linux/types.h>
64476 +#include <linux/err.h>
64477
64478 /*
64479 * Flags to pass to kmem_cache_create().
64480 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
64481 */
64482 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
64483 +
64484 +#ifdef CONFIG_PAX_USERCOPY
64485 +#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
64486 +#else
64487 +#define SLAB_USERCOPY 0x00000000UL
64488 +#endif
64489 +
64490 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
64491 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
64492 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
64493 @@ -82,10 +90,13 @@
64494 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
64495 * Both make kfree a no-op.
64496 */
64497 -#define ZERO_SIZE_PTR ((void *)16)
64498 +#define ZERO_SIZE_PTR \
64499 +({ \
64500 + BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
64501 + (void *)(-MAX_ERRNO-1L); \
64502 +})
64503
64504 -#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
64505 - (unsigned long)ZERO_SIZE_PTR)
64506 +#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
64507
64508 /*
64509 * struct kmem_cache related prototypes
64510 @@ -138,6 +149,7 @@ void * __must_check krealloc(const void
64511 void kfree(const void *);
64512 void kzfree(const void *);
64513 size_t ksize(const void *);
64514 +void check_object_size(const void *ptr, unsigned long n, bool to);
64515
64516 /*
64517 * Allocator specific definitions. These are mainly used to establish optimized
64518 @@ -328,4 +340,37 @@ static inline void *kzalloc_node(size_t
64519
64520 void __init kmem_cache_init_late(void);
64521
64522 +#define kmalloc(x, y) \
64523 +({ \
64524 + void *___retval; \
64525 + intoverflow_t ___x = (intoverflow_t)x; \
64526 + if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n"))\
64527 + ___retval = NULL; \
64528 + else \
64529 + ___retval = kmalloc((size_t)___x, (y)); \
64530 + ___retval; \
64531 +})
64532 +
64533 +#define kmalloc_node(x, y, z) \
64534 +({ \
64535 + void *___retval; \
64536 + intoverflow_t ___x = (intoverflow_t)x; \
64537 + if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
64538 + ___retval = NULL; \
64539 + else \
64540 + ___retval = kmalloc_node((size_t)___x, (y), (z));\
64541 + ___retval; \
64542 +})
64543 +
64544 +#define kzalloc(x, y) \
64545 +({ \
64546 + void *___retval; \
64547 + intoverflow_t ___x = (intoverflow_t)x; \
64548 + if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n"))\
64549 + ___retval = NULL; \
64550 + else \
64551 + ___retval = kzalloc((size_t)___x, (y)); \
64552 + ___retval; \
64553 +})
64554 +
64555 #endif /* _LINUX_SLAB_H */
64556 diff -urNp linux-2.6.32.46/include/linux/slub_def.h linux-2.6.32.46/include/linux/slub_def.h
64557 --- linux-2.6.32.46/include/linux/slub_def.h 2011-03-27 14:31:47.000000000 -0400
64558 +++ linux-2.6.32.46/include/linux/slub_def.h 2011-08-05 20:33:55.000000000 -0400
64559 @@ -86,7 +86,7 @@ struct kmem_cache {
64560 struct kmem_cache_order_objects max;
64561 struct kmem_cache_order_objects min;
64562 gfp_t allocflags; /* gfp flags to use on each alloc */
64563 - int refcount; /* Refcount for slab cache destroy */
64564 + atomic_t refcount; /* Refcount for slab cache destroy */
64565 void (*ctor)(void *);
64566 int inuse; /* Offset to metadata */
64567 int align; /* Alignment */
64568 @@ -215,7 +215,7 @@ static __always_inline struct kmem_cache
64569 #endif
64570
64571 void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
64572 -void *__kmalloc(size_t size, gfp_t flags);
64573 +void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1);
64574
64575 #ifdef CONFIG_KMEMTRACE
64576 extern void *kmem_cache_alloc_notrace(struct kmem_cache *s, gfp_t gfpflags);
64577 diff -urNp linux-2.6.32.46/include/linux/sonet.h linux-2.6.32.46/include/linux/sonet.h
64578 --- linux-2.6.32.46/include/linux/sonet.h 2011-03-27 14:31:47.000000000 -0400
64579 +++ linux-2.6.32.46/include/linux/sonet.h 2011-04-17 15:56:46.000000000 -0400
64580 @@ -61,7 +61,7 @@ struct sonet_stats {
64581 #include <asm/atomic.h>
64582
64583 struct k_sonet_stats {
64584 -#define __HANDLE_ITEM(i) atomic_t i
64585 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
64586 __SONET_ITEMS
64587 #undef __HANDLE_ITEM
64588 };
64589 diff -urNp linux-2.6.32.46/include/linux/sunrpc/cache.h linux-2.6.32.46/include/linux/sunrpc/cache.h
64590 --- linux-2.6.32.46/include/linux/sunrpc/cache.h 2011-03-27 14:31:47.000000000 -0400
64591 +++ linux-2.6.32.46/include/linux/sunrpc/cache.h 2011-08-05 20:33:55.000000000 -0400
64592 @@ -125,7 +125,7 @@ struct cache_detail {
64593 */
64594 struct cache_req {
64595 struct cache_deferred_req *(*defer)(struct cache_req *req);
64596 -};
64597 +} __no_const;
64598 /* this must be embedded in a deferred_request that is being
64599 * delayed awaiting cache-fill
64600 */
64601 diff -urNp linux-2.6.32.46/include/linux/sunrpc/clnt.h linux-2.6.32.46/include/linux/sunrpc/clnt.h
64602 --- linux-2.6.32.46/include/linux/sunrpc/clnt.h 2011-03-27 14:31:47.000000000 -0400
64603 +++ linux-2.6.32.46/include/linux/sunrpc/clnt.h 2011-04-17 15:56:46.000000000 -0400
64604 @@ -167,9 +167,9 @@ static inline unsigned short rpc_get_por
64605 {
64606 switch (sap->sa_family) {
64607 case AF_INET:
64608 - return ntohs(((struct sockaddr_in *)sap)->sin_port);
64609 + return ntohs(((const struct sockaddr_in *)sap)->sin_port);
64610 case AF_INET6:
64611 - return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
64612 + return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
64613 }
64614 return 0;
64615 }
64616 @@ -202,7 +202,7 @@ static inline bool __rpc_cmp_addr4(const
64617 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
64618 const struct sockaddr *src)
64619 {
64620 - const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
64621 + const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
64622 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
64623
64624 dsin->sin_family = ssin->sin_family;
64625 @@ -299,7 +299,7 @@ static inline u32 rpc_get_scope_id(const
64626 if (sa->sa_family != AF_INET6)
64627 return 0;
64628
64629 - return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
64630 + return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
64631 }
64632
64633 #endif /* __KERNEL__ */
64634 diff -urNp linux-2.6.32.46/include/linux/sunrpc/svc_rdma.h linux-2.6.32.46/include/linux/sunrpc/svc_rdma.h
64635 --- linux-2.6.32.46/include/linux/sunrpc/svc_rdma.h 2011-03-27 14:31:47.000000000 -0400
64636 +++ linux-2.6.32.46/include/linux/sunrpc/svc_rdma.h 2011-05-04 17:56:28.000000000 -0400
64637 @@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
64638 extern unsigned int svcrdma_max_requests;
64639 extern unsigned int svcrdma_max_req_size;
64640
64641 -extern atomic_t rdma_stat_recv;
64642 -extern atomic_t rdma_stat_read;
64643 -extern atomic_t rdma_stat_write;
64644 -extern atomic_t rdma_stat_sq_starve;
64645 -extern atomic_t rdma_stat_rq_starve;
64646 -extern atomic_t rdma_stat_rq_poll;
64647 -extern atomic_t rdma_stat_rq_prod;
64648 -extern atomic_t rdma_stat_sq_poll;
64649 -extern atomic_t rdma_stat_sq_prod;
64650 +extern atomic_unchecked_t rdma_stat_recv;
64651 +extern atomic_unchecked_t rdma_stat_read;
64652 +extern atomic_unchecked_t rdma_stat_write;
64653 +extern atomic_unchecked_t rdma_stat_sq_starve;
64654 +extern atomic_unchecked_t rdma_stat_rq_starve;
64655 +extern atomic_unchecked_t rdma_stat_rq_poll;
64656 +extern atomic_unchecked_t rdma_stat_rq_prod;
64657 +extern atomic_unchecked_t rdma_stat_sq_poll;
64658 +extern atomic_unchecked_t rdma_stat_sq_prod;
64659
64660 #define RPCRDMA_VERSION 1
64661
64662 diff -urNp linux-2.6.32.46/include/linux/suspend.h linux-2.6.32.46/include/linux/suspend.h
64663 --- linux-2.6.32.46/include/linux/suspend.h 2011-03-27 14:31:47.000000000 -0400
64664 +++ linux-2.6.32.46/include/linux/suspend.h 2011-04-17 15:56:46.000000000 -0400
64665 @@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
64666 * which require special recovery actions in that situation.
64667 */
64668 struct platform_suspend_ops {
64669 - int (*valid)(suspend_state_t state);
64670 - int (*begin)(suspend_state_t state);
64671 - int (*prepare)(void);
64672 - int (*prepare_late)(void);
64673 - int (*enter)(suspend_state_t state);
64674 - void (*wake)(void);
64675 - void (*finish)(void);
64676 - void (*end)(void);
64677 - void (*recover)(void);
64678 + int (* const valid)(suspend_state_t state);
64679 + int (* const begin)(suspend_state_t state);
64680 + int (* const prepare)(void);
64681 + int (* const prepare_late)(void);
64682 + int (* const enter)(suspend_state_t state);
64683 + void (* const wake)(void);
64684 + void (* const finish)(void);
64685 + void (* const end)(void);
64686 + void (* const recover)(void);
64687 };
64688
64689 #ifdef CONFIG_SUSPEND
64690 @@ -120,7 +120,7 @@ struct platform_suspend_ops {
64691 * suspend_set_ops - set platform dependent suspend operations
64692 * @ops: The new suspend operations to set.
64693 */
64694 -extern void suspend_set_ops(struct platform_suspend_ops *ops);
64695 +extern void suspend_set_ops(const struct platform_suspend_ops *ops);
64696 extern int suspend_valid_only_mem(suspend_state_t state);
64697
64698 /**
64699 @@ -145,7 +145,7 @@ extern int pm_suspend(suspend_state_t st
64700 #else /* !CONFIG_SUSPEND */
64701 #define suspend_valid_only_mem NULL
64702
64703 -static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
64704 +static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
64705 static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
64706 #endif /* !CONFIG_SUSPEND */
64707
64708 @@ -215,16 +215,16 @@ extern void mark_free_pages(struct zone
64709 * platforms which require special recovery actions in that situation.
64710 */
64711 struct platform_hibernation_ops {
64712 - int (*begin)(void);
64713 - void (*end)(void);
64714 - int (*pre_snapshot)(void);
64715 - void (*finish)(void);
64716 - int (*prepare)(void);
64717 - int (*enter)(void);
64718 - void (*leave)(void);
64719 - int (*pre_restore)(void);
64720 - void (*restore_cleanup)(void);
64721 - void (*recover)(void);
64722 + int (* const begin)(void);
64723 + void (* const end)(void);
64724 + int (* const pre_snapshot)(void);
64725 + void (* const finish)(void);
64726 + int (* const prepare)(void);
64727 + int (* const enter)(void);
64728 + void (* const leave)(void);
64729 + int (* const pre_restore)(void);
64730 + void (* const restore_cleanup)(void);
64731 + void (* const recover)(void);
64732 };
64733
64734 #ifdef CONFIG_HIBERNATION
64735 @@ -243,7 +243,7 @@ extern void swsusp_set_page_free(struct
64736 extern void swsusp_unset_page_free(struct page *);
64737 extern unsigned long get_safe_page(gfp_t gfp_mask);
64738
64739 -extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
64740 +extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
64741 extern int hibernate(void);
64742 extern bool system_entering_hibernation(void);
64743 #else /* CONFIG_HIBERNATION */
64744 @@ -251,7 +251,7 @@ static inline int swsusp_page_is_forbidd
64745 static inline void swsusp_set_page_free(struct page *p) {}
64746 static inline void swsusp_unset_page_free(struct page *p) {}
64747
64748 -static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
64749 +static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
64750 static inline int hibernate(void) { return -ENOSYS; }
64751 static inline bool system_entering_hibernation(void) { return false; }
64752 #endif /* CONFIG_HIBERNATION */
64753 diff -urNp linux-2.6.32.46/include/linux/sysctl.h linux-2.6.32.46/include/linux/sysctl.h
64754 --- linux-2.6.32.46/include/linux/sysctl.h 2011-03-27 14:31:47.000000000 -0400
64755 +++ linux-2.6.32.46/include/linux/sysctl.h 2011-04-17 15:56:46.000000000 -0400
64756 @@ -164,7 +164,11 @@ enum
64757 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
64758 };
64759
64760 -
64761 +#ifdef CONFIG_PAX_SOFTMODE
64762 +enum {
64763 + PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
64764 +};
64765 +#endif
64766
64767 /* CTL_VM names: */
64768 enum
64769 @@ -982,6 +986,8 @@ typedef int proc_handler (struct ctl_tab
64770
64771 extern int proc_dostring(struct ctl_table *, int,
64772 void __user *, size_t *, loff_t *);
64773 +extern int proc_dostring_modpriv(struct ctl_table *, int,
64774 + void __user *, size_t *, loff_t *);
64775 extern int proc_dointvec(struct ctl_table *, int,
64776 void __user *, size_t *, loff_t *);
64777 extern int proc_dointvec_minmax(struct ctl_table *, int,
64778 @@ -1003,6 +1009,7 @@ extern int do_sysctl (int __user *name,
64779
64780 extern ctl_handler sysctl_data;
64781 extern ctl_handler sysctl_string;
64782 +extern ctl_handler sysctl_string_modpriv;
64783 extern ctl_handler sysctl_intvec;
64784 extern ctl_handler sysctl_jiffies;
64785 extern ctl_handler sysctl_ms_jiffies;
64786 diff -urNp linux-2.6.32.46/include/linux/sysfs.h linux-2.6.32.46/include/linux/sysfs.h
64787 --- linux-2.6.32.46/include/linux/sysfs.h 2011-03-27 14:31:47.000000000 -0400
64788 +++ linux-2.6.32.46/include/linux/sysfs.h 2011-04-17 15:56:46.000000000 -0400
64789 @@ -75,8 +75,8 @@ struct bin_attribute {
64790 };
64791
64792 struct sysfs_ops {
64793 - ssize_t (*show)(struct kobject *, struct attribute *,char *);
64794 - ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
64795 + ssize_t (* const show)(struct kobject *, struct attribute *,char *);
64796 + ssize_t (* const store)(struct kobject *,struct attribute *,const char *, size_t);
64797 };
64798
64799 struct sysfs_dirent;
64800 diff -urNp linux-2.6.32.46/include/linux/thread_info.h linux-2.6.32.46/include/linux/thread_info.h
64801 --- linux-2.6.32.46/include/linux/thread_info.h 2011-03-27 14:31:47.000000000 -0400
64802 +++ linux-2.6.32.46/include/linux/thread_info.h 2011-04-17 15:56:46.000000000 -0400
64803 @@ -23,7 +23,7 @@ struct restart_block {
64804 };
64805 /* For futex_wait and futex_wait_requeue_pi */
64806 struct {
64807 - u32 *uaddr;
64808 + u32 __user *uaddr;
64809 u32 val;
64810 u32 flags;
64811 u32 bitset;
64812 diff -urNp linux-2.6.32.46/include/linux/tty.h linux-2.6.32.46/include/linux/tty.h
64813 --- linux-2.6.32.46/include/linux/tty.h 2011-03-27 14:31:47.000000000 -0400
64814 +++ linux-2.6.32.46/include/linux/tty.h 2011-08-05 20:33:55.000000000 -0400
64815 @@ -493,7 +493,6 @@ extern void tty_ldisc_begin(void);
64816 /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
64817 extern void tty_ldisc_enable(struct tty_struct *tty);
64818
64819 -
64820 /* n_tty.c */
64821 extern struct tty_ldisc_ops tty_ldisc_N_TTY;
64822
64823 diff -urNp linux-2.6.32.46/include/linux/tty_ldisc.h linux-2.6.32.46/include/linux/tty_ldisc.h
64824 --- linux-2.6.32.46/include/linux/tty_ldisc.h 2011-03-27 14:31:47.000000000 -0400
64825 +++ linux-2.6.32.46/include/linux/tty_ldisc.h 2011-04-17 15:56:46.000000000 -0400
64826 @@ -139,7 +139,7 @@ struct tty_ldisc_ops {
64827
64828 struct module *owner;
64829
64830 - int refcount;
64831 + atomic_t refcount;
64832 };
64833
64834 struct tty_ldisc {
64835 diff -urNp linux-2.6.32.46/include/linux/types.h linux-2.6.32.46/include/linux/types.h
64836 --- linux-2.6.32.46/include/linux/types.h 2011-03-27 14:31:47.000000000 -0400
64837 +++ linux-2.6.32.46/include/linux/types.h 2011-04-17 15:56:46.000000000 -0400
64838 @@ -191,10 +191,26 @@ typedef struct {
64839 volatile int counter;
64840 } atomic_t;
64841
64842 +#ifdef CONFIG_PAX_REFCOUNT
64843 +typedef struct {
64844 + volatile int counter;
64845 +} atomic_unchecked_t;
64846 +#else
64847 +typedef atomic_t atomic_unchecked_t;
64848 +#endif
64849 +
64850 #ifdef CONFIG_64BIT
64851 typedef struct {
64852 volatile long counter;
64853 } atomic64_t;
64854 +
64855 +#ifdef CONFIG_PAX_REFCOUNT
64856 +typedef struct {
64857 + volatile long counter;
64858 +} atomic64_unchecked_t;
64859 +#else
64860 +typedef atomic64_t atomic64_unchecked_t;
64861 +#endif
64862 #endif
64863
64864 struct ustat {
64865 diff -urNp linux-2.6.32.46/include/linux/uaccess.h linux-2.6.32.46/include/linux/uaccess.h
64866 --- linux-2.6.32.46/include/linux/uaccess.h 2011-03-27 14:31:47.000000000 -0400
64867 +++ linux-2.6.32.46/include/linux/uaccess.h 2011-10-06 09:37:14.000000000 -0400
64868 @@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
64869 long ret; \
64870 mm_segment_t old_fs = get_fs(); \
64871 \
64872 - set_fs(KERNEL_DS); \
64873 pagefault_disable(); \
64874 - ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
64875 - pagefault_enable(); \
64876 + set_fs(KERNEL_DS); \
64877 + ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \
64878 set_fs(old_fs); \
64879 + pagefault_enable(); \
64880 ret; \
64881 })
64882
64883 @@ -93,7 +93,7 @@ static inline unsigned long __copy_from_
64884 * Safely read from address @src to the buffer at @dst. If a kernel fault
64885 * happens, handle that and return -EFAULT.
64886 */
64887 -extern long probe_kernel_read(void *dst, void *src, size_t size);
64888 +extern long probe_kernel_read(void *dst, const void *src, size_t size);
64889
64890 /*
64891 * probe_kernel_write(): safely attempt to write to a location
64892 @@ -104,6 +104,6 @@ extern long probe_kernel_read(void *dst,
64893 * Safely write to address @dst from the buffer at @src. If a kernel fault
64894 * happens, handle that and return -EFAULT.
64895 */
64896 -extern long probe_kernel_write(void *dst, void *src, size_t size);
64897 +extern long probe_kernel_write(void *dst, const void *src, size_t size);
64898
64899 #endif /* __LINUX_UACCESS_H__ */
64900 diff -urNp linux-2.6.32.46/include/linux/unaligned/access_ok.h linux-2.6.32.46/include/linux/unaligned/access_ok.h
64901 --- linux-2.6.32.46/include/linux/unaligned/access_ok.h 2011-03-27 14:31:47.000000000 -0400
64902 +++ linux-2.6.32.46/include/linux/unaligned/access_ok.h 2011-04-17 15:56:46.000000000 -0400
64903 @@ -6,32 +6,32 @@
64904
64905 static inline u16 get_unaligned_le16(const void *p)
64906 {
64907 - return le16_to_cpup((__le16 *)p);
64908 + return le16_to_cpup((const __le16 *)p);
64909 }
64910
64911 static inline u32 get_unaligned_le32(const void *p)
64912 {
64913 - return le32_to_cpup((__le32 *)p);
64914 + return le32_to_cpup((const __le32 *)p);
64915 }
64916
64917 static inline u64 get_unaligned_le64(const void *p)
64918 {
64919 - return le64_to_cpup((__le64 *)p);
64920 + return le64_to_cpup((const __le64 *)p);
64921 }
64922
64923 static inline u16 get_unaligned_be16(const void *p)
64924 {
64925 - return be16_to_cpup((__be16 *)p);
64926 + return be16_to_cpup((const __be16 *)p);
64927 }
64928
64929 static inline u32 get_unaligned_be32(const void *p)
64930 {
64931 - return be32_to_cpup((__be32 *)p);
64932 + return be32_to_cpup((const __be32 *)p);
64933 }
64934
64935 static inline u64 get_unaligned_be64(const void *p)
64936 {
64937 - return be64_to_cpup((__be64 *)p);
64938 + return be64_to_cpup((const __be64 *)p);
64939 }
64940
64941 static inline void put_unaligned_le16(u16 val, void *p)
64942 diff -urNp linux-2.6.32.46/include/linux/vermagic.h linux-2.6.32.46/include/linux/vermagic.h
64943 --- linux-2.6.32.46/include/linux/vermagic.h 2011-03-27 14:31:47.000000000 -0400
64944 +++ linux-2.6.32.46/include/linux/vermagic.h 2011-10-08 08:17:48.000000000 -0400
64945 @@ -26,9 +26,28 @@
64946 #define MODULE_ARCH_VERMAGIC ""
64947 #endif
64948
64949 +#ifdef CONFIG_PAX_REFCOUNT
64950 +#define MODULE_PAX_REFCOUNT "REFCOUNT "
64951 +#else
64952 +#define MODULE_PAX_REFCOUNT ""
64953 +#endif
64954 +
64955 +#ifdef CONSTIFY_PLUGIN
64956 +#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN "
64957 +#else
64958 +#define MODULE_CONSTIFY_PLUGIN ""
64959 +#endif
64960 +
64961 +#ifdef CONFIG_GRKERNSEC
64962 +#define MODULE_GRSEC "GRSEC "
64963 +#else
64964 +#define MODULE_GRSEC ""
64965 +#endif
64966 +
64967 #define VERMAGIC_STRING \
64968 UTS_RELEASE " " \
64969 MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \
64970 MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \
64971 - MODULE_ARCH_VERMAGIC
64972 + MODULE_ARCH_VERMAGIC \
64973 + MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN MODULE_GRSEC
64974
64975 diff -urNp linux-2.6.32.46/include/linux/vmalloc.h linux-2.6.32.46/include/linux/vmalloc.h
64976 --- linux-2.6.32.46/include/linux/vmalloc.h 2011-03-27 14:31:47.000000000 -0400
64977 +++ linux-2.6.32.46/include/linux/vmalloc.h 2011-04-17 15:56:46.000000000 -0400
64978 @@ -13,6 +13,11 @@ struct vm_area_struct; /* vma defining
64979 #define VM_MAP 0x00000004 /* vmap()ed pages */
64980 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
64981 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
64982 +
64983 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
64984 +#define VM_KERNEXEC 0x00000020 /* allocate from executable kernel memory range */
64985 +#endif
64986 +
64987 /* bits [20..32] reserved for arch specific ioremap internals */
64988
64989 /*
64990 @@ -123,4 +128,81 @@ struct vm_struct **pcpu_get_vm_areas(con
64991
64992 void pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms);
64993
64994 +#define vmalloc(x) \
64995 +({ \
64996 + void *___retval; \
64997 + intoverflow_t ___x = (intoverflow_t)x; \
64998 + if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
64999 + ___retval = NULL; \
65000 + else \
65001 + ___retval = vmalloc((unsigned long)___x); \
65002 + ___retval; \
65003 +})
65004 +
65005 +#define __vmalloc(x, y, z) \
65006 +({ \
65007 + void *___retval; \
65008 + intoverflow_t ___x = (intoverflow_t)x; \
65009 + if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
65010 + ___retval = NULL; \
65011 + else \
65012 + ___retval = __vmalloc((unsigned long)___x, (y), (z));\
65013 + ___retval; \
65014 +})
65015 +
65016 +#define vmalloc_user(x) \
65017 +({ \
65018 + void *___retval; \
65019 + intoverflow_t ___x = (intoverflow_t)x; \
65020 + if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
65021 + ___retval = NULL; \
65022 + else \
65023 + ___retval = vmalloc_user((unsigned long)___x); \
65024 + ___retval; \
65025 +})
65026 +
65027 +#define vmalloc_exec(x) \
65028 +({ \
65029 + void *___retval; \
65030 + intoverflow_t ___x = (intoverflow_t)x; \
65031 + if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
65032 + ___retval = NULL; \
65033 + else \
65034 + ___retval = vmalloc_exec((unsigned long)___x); \
65035 + ___retval; \
65036 +})
65037 +
65038 +#define vmalloc_node(x, y) \
65039 +({ \
65040 + void *___retval; \
65041 + intoverflow_t ___x = (intoverflow_t)x; \
65042 + if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
65043 + ___retval = NULL; \
65044 + else \
65045 + ___retval = vmalloc_node((unsigned long)___x, (y));\
65046 + ___retval; \
65047 +})
65048 +
65049 +#define vmalloc_32(x) \
65050 +({ \
65051 + void *___retval; \
65052 + intoverflow_t ___x = (intoverflow_t)x; \
65053 + if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
65054 + ___retval = NULL; \
65055 + else \
65056 + ___retval = vmalloc_32((unsigned long)___x); \
65057 + ___retval; \
65058 +})
65059 +
65060 +#define vmalloc_32_user(x) \
65061 +({ \
65062 + void *___retval; \
65063 + intoverflow_t ___x = (intoverflow_t)x; \
65064 + if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
65065 + ___retval = NULL; \
65066 + else \
65067 + ___retval = vmalloc_32_user((unsigned long)___x);\
65068 + ___retval; \
65069 +})
65070 +
65071 #endif /* _LINUX_VMALLOC_H */
65072 diff -urNp linux-2.6.32.46/include/linux/vmstat.h linux-2.6.32.46/include/linux/vmstat.h
65073 --- linux-2.6.32.46/include/linux/vmstat.h 2011-03-27 14:31:47.000000000 -0400
65074 +++ linux-2.6.32.46/include/linux/vmstat.h 2011-04-17 15:56:46.000000000 -0400
65075 @@ -136,18 +136,18 @@ static inline void vm_events_fold_cpu(in
65076 /*
65077 * Zone based page accounting with per cpu differentials.
65078 */
65079 -extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
65080 +extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
65081
65082 static inline void zone_page_state_add(long x, struct zone *zone,
65083 enum zone_stat_item item)
65084 {
65085 - atomic_long_add(x, &zone->vm_stat[item]);
65086 - atomic_long_add(x, &vm_stat[item]);
65087 + atomic_long_add_unchecked(x, &zone->vm_stat[item]);
65088 + atomic_long_add_unchecked(x, &vm_stat[item]);
65089 }
65090
65091 static inline unsigned long global_page_state(enum zone_stat_item item)
65092 {
65093 - long x = atomic_long_read(&vm_stat[item]);
65094 + long x = atomic_long_read_unchecked(&vm_stat[item]);
65095 #ifdef CONFIG_SMP
65096 if (x < 0)
65097 x = 0;
65098 @@ -158,7 +158,7 @@ static inline unsigned long global_page_
65099 static inline unsigned long zone_page_state(struct zone *zone,
65100 enum zone_stat_item item)
65101 {
65102 - long x = atomic_long_read(&zone->vm_stat[item]);
65103 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
65104 #ifdef CONFIG_SMP
65105 if (x < 0)
65106 x = 0;
65107 @@ -175,7 +175,7 @@ static inline unsigned long zone_page_st
65108 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
65109 enum zone_stat_item item)
65110 {
65111 - long x = atomic_long_read(&zone->vm_stat[item]);
65112 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
65113
65114 #ifdef CONFIG_SMP
65115 int cpu;
65116 @@ -264,8 +264,8 @@ static inline void __mod_zone_page_state
65117
65118 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
65119 {
65120 - atomic_long_inc(&zone->vm_stat[item]);
65121 - atomic_long_inc(&vm_stat[item]);
65122 + atomic_long_inc_unchecked(&zone->vm_stat[item]);
65123 + atomic_long_inc_unchecked(&vm_stat[item]);
65124 }
65125
65126 static inline void __inc_zone_page_state(struct page *page,
65127 @@ -276,8 +276,8 @@ static inline void __inc_zone_page_state
65128
65129 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
65130 {
65131 - atomic_long_dec(&zone->vm_stat[item]);
65132 - atomic_long_dec(&vm_stat[item]);
65133 + atomic_long_dec_unchecked(&zone->vm_stat[item]);
65134 + atomic_long_dec_unchecked(&vm_stat[item]);
65135 }
65136
65137 static inline void __dec_zone_page_state(struct page *page,
65138 diff -urNp linux-2.6.32.46/include/media/saa7146_vv.h linux-2.6.32.46/include/media/saa7146_vv.h
65139 --- linux-2.6.32.46/include/media/saa7146_vv.h 2011-03-27 14:31:47.000000000 -0400
65140 +++ linux-2.6.32.46/include/media/saa7146_vv.h 2011-08-23 21:22:38.000000000 -0400
65141 @@ -167,7 +167,7 @@ struct saa7146_ext_vv
65142 int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *);
65143
65144 /* the extension can override this */
65145 - struct v4l2_ioctl_ops ops;
65146 + v4l2_ioctl_ops_no_const ops;
65147 /* pointer to the saa7146 core ops */
65148 const struct v4l2_ioctl_ops *core_ops;
65149
65150 diff -urNp linux-2.6.32.46/include/media/v4l2-dev.h linux-2.6.32.46/include/media/v4l2-dev.h
65151 --- linux-2.6.32.46/include/media/v4l2-dev.h 2011-03-27 14:31:47.000000000 -0400
65152 +++ linux-2.6.32.46/include/media/v4l2-dev.h 2011-10-08 08:14:40.000000000 -0400
65153 @@ -34,7 +34,7 @@ struct v4l2_device;
65154 #define V4L2_FL_UNREGISTERED (0)
65155
65156 struct v4l2_file_operations {
65157 - struct module *owner;
65158 + struct module * const owner;
65159 ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
65160 ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
65161 unsigned int (*poll) (struct file *, struct poll_table_struct *);
65162 @@ -46,6 +46,7 @@ struct v4l2_file_operations {
65163 int (*open) (struct file *);
65164 int (*release) (struct file *);
65165 };
65166 +typedef struct v4l2_file_operations __no_const v4l2_file_operations_no_const;
65167
65168 /*
65169 * Newer version of video_device, handled by videodev2.c
65170 diff -urNp linux-2.6.32.46/include/media/v4l2-device.h linux-2.6.32.46/include/media/v4l2-device.h
65171 --- linux-2.6.32.46/include/media/v4l2-device.h 2011-03-27 14:31:47.000000000 -0400
65172 +++ linux-2.6.32.46/include/media/v4l2-device.h 2011-05-04 17:56:28.000000000 -0400
65173 @@ -71,7 +71,7 @@ int __must_check v4l2_device_register(st
65174 this function returns 0. If the name ends with a digit (e.g. cx18),
65175 then the name will be set to cx18-0 since cx180 looks really odd. */
65176 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
65177 - atomic_t *instance);
65178 + atomic_unchecked_t *instance);
65179
65180 /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
65181 Since the parent disappears this ensures that v4l2_dev doesn't have an
65182 diff -urNp linux-2.6.32.46/include/media/v4l2-ioctl.h linux-2.6.32.46/include/media/v4l2-ioctl.h
65183 --- linux-2.6.32.46/include/media/v4l2-ioctl.h 2011-03-27 14:31:47.000000000 -0400
65184 +++ linux-2.6.32.46/include/media/v4l2-ioctl.h 2011-08-23 21:22:38.000000000 -0400
65185 @@ -243,6 +243,7 @@ struct v4l2_ioctl_ops {
65186 long (*vidioc_default) (struct file *file, void *fh,
65187 int cmd, void *arg);
65188 };
65189 +typedef struct v4l2_ioctl_ops __no_const v4l2_ioctl_ops_no_const;
65190
65191
65192 /* v4l debugging and diagnostics */
65193 diff -urNp linux-2.6.32.46/include/net/flow.h linux-2.6.32.46/include/net/flow.h
65194 --- linux-2.6.32.46/include/net/flow.h 2011-03-27 14:31:47.000000000 -0400
65195 +++ linux-2.6.32.46/include/net/flow.h 2011-05-04 17:56:28.000000000 -0400
65196 @@ -92,7 +92,7 @@ typedef int (*flow_resolve_t)(struct net
65197 extern void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family,
65198 u8 dir, flow_resolve_t resolver);
65199 extern void flow_cache_flush(void);
65200 -extern atomic_t flow_cache_genid;
65201 +extern atomic_unchecked_t flow_cache_genid;
65202
65203 static inline int flow_cache_uli_match(struct flowi *fl1, struct flowi *fl2)
65204 {
65205 diff -urNp linux-2.6.32.46/include/net/inetpeer.h linux-2.6.32.46/include/net/inetpeer.h
65206 --- linux-2.6.32.46/include/net/inetpeer.h 2011-03-27 14:31:47.000000000 -0400
65207 +++ linux-2.6.32.46/include/net/inetpeer.h 2011-04-17 15:56:46.000000000 -0400
65208 @@ -24,7 +24,7 @@ struct inet_peer
65209 __u32 dtime; /* the time of last use of not
65210 * referenced entries */
65211 atomic_t refcnt;
65212 - atomic_t rid; /* Frag reception counter */
65213 + atomic_unchecked_t rid; /* Frag reception counter */
65214 __u32 tcp_ts;
65215 unsigned long tcp_ts_stamp;
65216 };
65217 diff -urNp linux-2.6.32.46/include/net/ip_vs.h linux-2.6.32.46/include/net/ip_vs.h
65218 --- linux-2.6.32.46/include/net/ip_vs.h 2011-03-27 14:31:47.000000000 -0400
65219 +++ linux-2.6.32.46/include/net/ip_vs.h 2011-05-04 17:56:28.000000000 -0400
65220 @@ -365,7 +365,7 @@ struct ip_vs_conn {
65221 struct ip_vs_conn *control; /* Master control connection */
65222 atomic_t n_control; /* Number of controlled ones */
65223 struct ip_vs_dest *dest; /* real server */
65224 - atomic_t in_pkts; /* incoming packet counter */
65225 + atomic_unchecked_t in_pkts; /* incoming packet counter */
65226
65227 /* packet transmitter for different forwarding methods. If it
65228 mangles the packet, it must return NF_DROP or better NF_STOLEN,
65229 @@ -466,7 +466,7 @@ struct ip_vs_dest {
65230 union nf_inet_addr addr; /* IP address of the server */
65231 __be16 port; /* port number of the server */
65232 volatile unsigned flags; /* dest status flags */
65233 - atomic_t conn_flags; /* flags to copy to conn */
65234 + atomic_unchecked_t conn_flags; /* flags to copy to conn */
65235 atomic_t weight; /* server weight */
65236
65237 atomic_t refcnt; /* reference counter */
65238 diff -urNp linux-2.6.32.46/include/net/irda/ircomm_core.h linux-2.6.32.46/include/net/irda/ircomm_core.h
65239 --- linux-2.6.32.46/include/net/irda/ircomm_core.h 2011-03-27 14:31:47.000000000 -0400
65240 +++ linux-2.6.32.46/include/net/irda/ircomm_core.h 2011-08-05 20:33:55.000000000 -0400
65241 @@ -51,7 +51,7 @@ typedef struct {
65242 int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
65243 int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *,
65244 struct ircomm_info *);
65245 -} call_t;
65246 +} __no_const call_t;
65247
65248 struct ircomm_cb {
65249 irda_queue_t queue;
65250 diff -urNp linux-2.6.32.46/include/net/irda/ircomm_tty.h linux-2.6.32.46/include/net/irda/ircomm_tty.h
65251 --- linux-2.6.32.46/include/net/irda/ircomm_tty.h 2011-03-27 14:31:47.000000000 -0400
65252 +++ linux-2.6.32.46/include/net/irda/ircomm_tty.h 2011-04-17 15:56:46.000000000 -0400
65253 @@ -35,6 +35,7 @@
65254 #include <linux/termios.h>
65255 #include <linux/timer.h>
65256 #include <linux/tty.h> /* struct tty_struct */
65257 +#include <asm/local.h>
65258
65259 #include <net/irda/irias_object.h>
65260 #include <net/irda/ircomm_core.h>
65261 @@ -105,8 +106,8 @@ struct ircomm_tty_cb {
65262 unsigned short close_delay;
65263 unsigned short closing_wait; /* time to wait before closing */
65264
65265 - int open_count;
65266 - int blocked_open; /* # of blocked opens */
65267 + local_t open_count;
65268 + local_t blocked_open; /* # of blocked opens */
65269
65270 /* Protect concurent access to :
65271 * o self->open_count
65272 diff -urNp linux-2.6.32.46/include/net/iucv/af_iucv.h linux-2.6.32.46/include/net/iucv/af_iucv.h
65273 --- linux-2.6.32.46/include/net/iucv/af_iucv.h 2011-03-27 14:31:47.000000000 -0400
65274 +++ linux-2.6.32.46/include/net/iucv/af_iucv.h 2011-05-04 17:56:28.000000000 -0400
65275 @@ -87,7 +87,7 @@ struct iucv_sock {
65276 struct iucv_sock_list {
65277 struct hlist_head head;
65278 rwlock_t lock;
65279 - atomic_t autobind_name;
65280 + atomic_unchecked_t autobind_name;
65281 };
65282
65283 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
65284 diff -urNp linux-2.6.32.46/include/net/lapb.h linux-2.6.32.46/include/net/lapb.h
65285 --- linux-2.6.32.46/include/net/lapb.h 2011-03-27 14:31:47.000000000 -0400
65286 +++ linux-2.6.32.46/include/net/lapb.h 2011-08-05 20:33:55.000000000 -0400
65287 @@ -95,7 +95,7 @@ struct lapb_cb {
65288 struct sk_buff_head write_queue;
65289 struct sk_buff_head ack_queue;
65290 unsigned char window;
65291 - struct lapb_register_struct callbacks;
65292 + struct lapb_register_struct *callbacks;
65293
65294 /* FRMR control information */
65295 struct lapb_frame frmr_data;
65296 diff -urNp linux-2.6.32.46/include/net/neighbour.h linux-2.6.32.46/include/net/neighbour.h
65297 --- linux-2.6.32.46/include/net/neighbour.h 2011-03-27 14:31:47.000000000 -0400
65298 +++ linux-2.6.32.46/include/net/neighbour.h 2011-08-26 20:29:08.000000000 -0400
65299 @@ -131,7 +131,7 @@ struct neigh_ops
65300 int (*connected_output)(struct sk_buff*);
65301 int (*hh_output)(struct sk_buff*);
65302 int (*queue_xmit)(struct sk_buff*);
65303 -};
65304 +} __do_const;
65305
65306 struct pneigh_entry
65307 {
65308 diff -urNp linux-2.6.32.46/include/net/netlink.h linux-2.6.32.46/include/net/netlink.h
65309 --- linux-2.6.32.46/include/net/netlink.h 2011-07-13 17:23:04.000000000 -0400
65310 +++ linux-2.6.32.46/include/net/netlink.h 2011-08-21 18:08:11.000000000 -0400
65311 @@ -335,7 +335,7 @@ static inline int nlmsg_ok(const struct
65312 {
65313 return (remaining >= (int) sizeof(struct nlmsghdr) &&
65314 nlh->nlmsg_len >= sizeof(struct nlmsghdr) &&
65315 - nlh->nlmsg_len <= remaining);
65316 + nlh->nlmsg_len <= (unsigned int)remaining);
65317 }
65318
65319 /**
65320 @@ -558,7 +558,7 @@ static inline void *nlmsg_get_pos(struct
65321 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
65322 {
65323 if (mark)
65324 - skb_trim(skb, (unsigned char *) mark - skb->data);
65325 + skb_trim(skb, (const unsigned char *) mark - skb->data);
65326 }
65327
65328 /**
65329 diff -urNp linux-2.6.32.46/include/net/netns/ipv4.h linux-2.6.32.46/include/net/netns/ipv4.h
65330 --- linux-2.6.32.46/include/net/netns/ipv4.h 2011-03-27 14:31:47.000000000 -0400
65331 +++ linux-2.6.32.46/include/net/netns/ipv4.h 2011-05-04 17:56:28.000000000 -0400
65332 @@ -54,7 +54,7 @@ struct netns_ipv4 {
65333 int current_rt_cache_rebuild_count;
65334
65335 struct timer_list rt_secret_timer;
65336 - atomic_t rt_genid;
65337 + atomic_unchecked_t rt_genid;
65338
65339 #ifdef CONFIG_IP_MROUTE
65340 struct sock *mroute_sk;
65341 diff -urNp linux-2.6.32.46/include/net/sctp/sctp.h linux-2.6.32.46/include/net/sctp/sctp.h
65342 --- linux-2.6.32.46/include/net/sctp/sctp.h 2011-03-27 14:31:47.000000000 -0400
65343 +++ linux-2.6.32.46/include/net/sctp/sctp.h 2011-04-17 15:56:46.000000000 -0400
65344 @@ -305,8 +305,8 @@ extern int sctp_debug_flag;
65345
65346 #else /* SCTP_DEBUG */
65347
65348 -#define SCTP_DEBUG_PRINTK(whatever...)
65349 -#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
65350 +#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
65351 +#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
65352 #define SCTP_ENABLE_DEBUG
65353 #define SCTP_DISABLE_DEBUG
65354 #define SCTP_ASSERT(expr, str, func)
65355 diff -urNp linux-2.6.32.46/include/net/secure_seq.h linux-2.6.32.46/include/net/secure_seq.h
65356 --- linux-2.6.32.46/include/net/secure_seq.h 2011-08-16 20:37:25.000000000 -0400
65357 +++ linux-2.6.32.46/include/net/secure_seq.h 2011-08-07 19:48:09.000000000 -0400
65358 @@ -7,14 +7,14 @@ extern __u32 secure_ip_id(__be32 daddr);
65359 extern __u32 secure_ipv6_id(const __be32 daddr[4]);
65360 extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
65361 extern u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
65362 - __be16 dport);
65363 + __be16 dport);
65364 extern __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
65365 __be16 sport, __be16 dport);
65366 extern __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
65367 - __be16 sport, __be16 dport);
65368 + __be16 sport, __be16 dport);
65369 extern u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
65370 - __be16 sport, __be16 dport);
65371 + __be16 sport, __be16 dport);
65372 extern u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr,
65373 - __be16 sport, __be16 dport);
65374 + __be16 sport, __be16 dport);
65375
65376 #endif /* _NET_SECURE_SEQ */
65377 diff -urNp linux-2.6.32.46/include/net/sock.h linux-2.6.32.46/include/net/sock.h
65378 --- linux-2.6.32.46/include/net/sock.h 2011-03-27 14:31:47.000000000 -0400
65379 +++ linux-2.6.32.46/include/net/sock.h 2011-08-21 17:24:37.000000000 -0400
65380 @@ -272,7 +272,7 @@ struct sock {
65381 rwlock_t sk_callback_lock;
65382 int sk_err,
65383 sk_err_soft;
65384 - atomic_t sk_drops;
65385 + atomic_unchecked_t sk_drops;
65386 unsigned short sk_ack_backlog;
65387 unsigned short sk_max_ack_backlog;
65388 __u32 sk_priority;
65389 @@ -737,7 +737,7 @@ static inline void sk_refcnt_debug_relea
65390 extern void sock_prot_inuse_add(struct net *net, struct proto *prot, int inc);
65391 extern int sock_prot_inuse_get(struct net *net, struct proto *proto);
65392 #else
65393 -static void inline sock_prot_inuse_add(struct net *net, struct proto *prot,
65394 +static inline void sock_prot_inuse_add(struct net *net, struct proto *prot,
65395 int inc)
65396 {
65397 }
65398 diff -urNp linux-2.6.32.46/include/net/tcp.h linux-2.6.32.46/include/net/tcp.h
65399 --- linux-2.6.32.46/include/net/tcp.h 2011-03-27 14:31:47.000000000 -0400
65400 +++ linux-2.6.32.46/include/net/tcp.h 2011-08-23 21:29:10.000000000 -0400
65401 @@ -1444,8 +1444,8 @@ enum tcp_seq_states {
65402 struct tcp_seq_afinfo {
65403 char *name;
65404 sa_family_t family;
65405 - struct file_operations seq_fops;
65406 - struct seq_operations seq_ops;
65407 + file_operations_no_const seq_fops;
65408 + seq_operations_no_const seq_ops;
65409 };
65410
65411 struct tcp_iter_state {
65412 diff -urNp linux-2.6.32.46/include/net/udp.h linux-2.6.32.46/include/net/udp.h
65413 --- linux-2.6.32.46/include/net/udp.h 2011-03-27 14:31:47.000000000 -0400
65414 +++ linux-2.6.32.46/include/net/udp.h 2011-08-23 21:29:34.000000000 -0400
65415 @@ -187,8 +187,8 @@ struct udp_seq_afinfo {
65416 char *name;
65417 sa_family_t family;
65418 struct udp_table *udp_table;
65419 - struct file_operations seq_fops;
65420 - struct seq_operations seq_ops;
65421 + file_operations_no_const seq_fops;
65422 + seq_operations_no_const seq_ops;
65423 };
65424
65425 struct udp_iter_state {
65426 diff -urNp linux-2.6.32.46/include/rdma/iw_cm.h linux-2.6.32.46/include/rdma/iw_cm.h
65427 --- linux-2.6.32.46/include/rdma/iw_cm.h 2011-03-27 14:31:47.000000000 -0400
65428 +++ linux-2.6.32.46/include/rdma/iw_cm.h 2011-08-05 20:33:55.000000000 -0400
65429 @@ -129,7 +129,7 @@ struct iw_cm_verbs {
65430 int backlog);
65431
65432 int (*destroy_listen)(struct iw_cm_id *cm_id);
65433 -};
65434 +} __no_const;
65435
65436 /**
65437 * iw_create_cm_id - Create an IW CM identifier.
65438 diff -urNp linux-2.6.32.46/include/scsi/libfc.h linux-2.6.32.46/include/scsi/libfc.h
65439 --- linux-2.6.32.46/include/scsi/libfc.h 2011-03-27 14:31:47.000000000 -0400
65440 +++ linux-2.6.32.46/include/scsi/libfc.h 2011-08-23 21:22:38.000000000 -0400
65441 @@ -675,6 +675,7 @@ struct libfc_function_template {
65442 */
65443 void (*disc_stop_final) (struct fc_lport *);
65444 };
65445 +typedef struct libfc_function_template __no_const libfc_function_template_no_const;
65446
65447 /* information used by the discovery layer */
65448 struct fc_disc {
65449 @@ -707,7 +708,7 @@ struct fc_lport {
65450 struct fc_disc disc;
65451
65452 /* Operational Information */
65453 - struct libfc_function_template tt;
65454 + libfc_function_template_no_const tt;
65455 u8 link_up;
65456 u8 qfull;
65457 enum fc_lport_state state;
65458 diff -urNp linux-2.6.32.46/include/scsi/scsi_device.h linux-2.6.32.46/include/scsi/scsi_device.h
65459 --- linux-2.6.32.46/include/scsi/scsi_device.h 2011-04-17 17:00:52.000000000 -0400
65460 +++ linux-2.6.32.46/include/scsi/scsi_device.h 2011-05-04 17:56:28.000000000 -0400
65461 @@ -156,9 +156,9 @@ struct scsi_device {
65462 unsigned int max_device_blocked; /* what device_blocked counts down from */
65463 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
65464
65465 - atomic_t iorequest_cnt;
65466 - atomic_t iodone_cnt;
65467 - atomic_t ioerr_cnt;
65468 + atomic_unchecked_t iorequest_cnt;
65469 + atomic_unchecked_t iodone_cnt;
65470 + atomic_unchecked_t ioerr_cnt;
65471
65472 struct device sdev_gendev,
65473 sdev_dev;
65474 diff -urNp linux-2.6.32.46/include/scsi/scsi_transport_fc.h linux-2.6.32.46/include/scsi/scsi_transport_fc.h
65475 --- linux-2.6.32.46/include/scsi/scsi_transport_fc.h 2011-03-27 14:31:47.000000000 -0400
65476 +++ linux-2.6.32.46/include/scsi/scsi_transport_fc.h 2011-08-26 20:19:09.000000000 -0400
65477 @@ -708,7 +708,7 @@ struct fc_function_template {
65478 unsigned long show_host_system_hostname:1;
65479
65480 unsigned long disable_target_scan:1;
65481 -};
65482 +} __do_const;
65483
65484
65485 /**
65486 diff -urNp linux-2.6.32.46/include/sound/ac97_codec.h linux-2.6.32.46/include/sound/ac97_codec.h
65487 --- linux-2.6.32.46/include/sound/ac97_codec.h 2011-03-27 14:31:47.000000000 -0400
65488 +++ linux-2.6.32.46/include/sound/ac97_codec.h 2011-04-17 15:56:46.000000000 -0400
65489 @@ -419,15 +419,15 @@
65490 struct snd_ac97;
65491
65492 struct snd_ac97_build_ops {
65493 - int (*build_3d) (struct snd_ac97 *ac97);
65494 - int (*build_specific) (struct snd_ac97 *ac97);
65495 - int (*build_spdif) (struct snd_ac97 *ac97);
65496 - int (*build_post_spdif) (struct snd_ac97 *ac97);
65497 + int (* const build_3d) (struct snd_ac97 *ac97);
65498 + int (* const build_specific) (struct snd_ac97 *ac97);
65499 + int (* const build_spdif) (struct snd_ac97 *ac97);
65500 + int (* const build_post_spdif) (struct snd_ac97 *ac97);
65501 #ifdef CONFIG_PM
65502 - void (*suspend) (struct snd_ac97 *ac97);
65503 - void (*resume) (struct snd_ac97 *ac97);
65504 + void (* const suspend) (struct snd_ac97 *ac97);
65505 + void (* const resume) (struct snd_ac97 *ac97);
65506 #endif
65507 - void (*update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
65508 + void (* const update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
65509 };
65510
65511 struct snd_ac97_bus_ops {
65512 @@ -477,7 +477,7 @@ struct snd_ac97_template {
65513
65514 struct snd_ac97 {
65515 /* -- lowlevel (hardware) driver specific -- */
65516 - struct snd_ac97_build_ops * build_ops;
65517 + const struct snd_ac97_build_ops * build_ops;
65518 void *private_data;
65519 void (*private_free) (struct snd_ac97 *ac97);
65520 /* --- */
65521 diff -urNp linux-2.6.32.46/include/sound/ak4xxx-adda.h linux-2.6.32.46/include/sound/ak4xxx-adda.h
65522 --- linux-2.6.32.46/include/sound/ak4xxx-adda.h 2011-03-27 14:31:47.000000000 -0400
65523 +++ linux-2.6.32.46/include/sound/ak4xxx-adda.h 2011-08-05 20:33:55.000000000 -0400
65524 @@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
65525 void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
65526 unsigned char val);
65527 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
65528 -};
65529 +} __no_const;
65530
65531 #define AK4XXX_IMAGE_SIZE (AK4XXX_MAX_CHIPS * 16) /* 64 bytes */
65532
65533 diff -urNp linux-2.6.32.46/include/sound/hwdep.h linux-2.6.32.46/include/sound/hwdep.h
65534 --- linux-2.6.32.46/include/sound/hwdep.h 2011-03-27 14:31:47.000000000 -0400
65535 +++ linux-2.6.32.46/include/sound/hwdep.h 2011-08-05 20:33:55.000000000 -0400
65536 @@ -49,7 +49,7 @@ struct snd_hwdep_ops {
65537 struct snd_hwdep_dsp_status *status);
65538 int (*dsp_load)(struct snd_hwdep *hw,
65539 struct snd_hwdep_dsp_image *image);
65540 -};
65541 +} __no_const;
65542
65543 struct snd_hwdep {
65544 struct snd_card *card;
65545 diff -urNp linux-2.6.32.46/include/sound/info.h linux-2.6.32.46/include/sound/info.h
65546 --- linux-2.6.32.46/include/sound/info.h 2011-03-27 14:31:47.000000000 -0400
65547 +++ linux-2.6.32.46/include/sound/info.h 2011-08-05 20:33:55.000000000 -0400
65548 @@ -44,7 +44,7 @@ struct snd_info_entry_text {
65549 struct snd_info_buffer *buffer);
65550 void (*write)(struct snd_info_entry *entry,
65551 struct snd_info_buffer *buffer);
65552 -};
65553 +} __no_const;
65554
65555 struct snd_info_entry_ops {
65556 int (*open)(struct snd_info_entry *entry,
65557 diff -urNp linux-2.6.32.46/include/sound/pcm.h linux-2.6.32.46/include/sound/pcm.h
65558 --- linux-2.6.32.46/include/sound/pcm.h 2011-03-27 14:31:47.000000000 -0400
65559 +++ linux-2.6.32.46/include/sound/pcm.h 2011-08-23 21:22:38.000000000 -0400
65560 @@ -80,6 +80,7 @@ struct snd_pcm_ops {
65561 int (*mmap)(struct snd_pcm_substream *substream, struct vm_area_struct *vma);
65562 int (*ack)(struct snd_pcm_substream *substream);
65563 };
65564 +typedef struct snd_pcm_ops __no_const snd_pcm_ops_no_const;
65565
65566 /*
65567 *
65568 diff -urNp linux-2.6.32.46/include/sound/sb16_csp.h linux-2.6.32.46/include/sound/sb16_csp.h
65569 --- linux-2.6.32.46/include/sound/sb16_csp.h 2011-03-27 14:31:47.000000000 -0400
65570 +++ linux-2.6.32.46/include/sound/sb16_csp.h 2011-08-05 20:33:55.000000000 -0400
65571 @@ -139,7 +139,7 @@ struct snd_sb_csp_ops {
65572 int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
65573 int (*csp_stop) (struct snd_sb_csp * p);
65574 int (*csp_qsound_transfer) (struct snd_sb_csp * p);
65575 -};
65576 +} __no_const;
65577
65578 /*
65579 * CSP private data
65580 diff -urNp linux-2.6.32.46/include/sound/ymfpci.h linux-2.6.32.46/include/sound/ymfpci.h
65581 --- linux-2.6.32.46/include/sound/ymfpci.h 2011-03-27 14:31:47.000000000 -0400
65582 +++ linux-2.6.32.46/include/sound/ymfpci.h 2011-05-04 17:56:28.000000000 -0400
65583 @@ -358,7 +358,7 @@ struct snd_ymfpci {
65584 spinlock_t reg_lock;
65585 spinlock_t voice_lock;
65586 wait_queue_head_t interrupt_sleep;
65587 - atomic_t interrupt_sleep_count;
65588 + atomic_unchecked_t interrupt_sleep_count;
65589 struct snd_info_entry *proc_entry;
65590 const struct firmware *dsp_microcode;
65591 const struct firmware *controller_microcode;
65592 diff -urNp linux-2.6.32.46/include/trace/events/irq.h linux-2.6.32.46/include/trace/events/irq.h
65593 --- linux-2.6.32.46/include/trace/events/irq.h 2011-03-27 14:31:47.000000000 -0400
65594 +++ linux-2.6.32.46/include/trace/events/irq.h 2011-04-17 15:56:46.000000000 -0400
65595 @@ -34,7 +34,7 @@
65596 */
65597 TRACE_EVENT(irq_handler_entry,
65598
65599 - TP_PROTO(int irq, struct irqaction *action),
65600 + TP_PROTO(int irq, const struct irqaction *action),
65601
65602 TP_ARGS(irq, action),
65603
65604 @@ -64,7 +64,7 @@ TRACE_EVENT(irq_handler_entry,
65605 */
65606 TRACE_EVENT(irq_handler_exit,
65607
65608 - TP_PROTO(int irq, struct irqaction *action, int ret),
65609 + TP_PROTO(int irq, const struct irqaction *action, int ret),
65610
65611 TP_ARGS(irq, action, ret),
65612
65613 @@ -95,7 +95,7 @@ TRACE_EVENT(irq_handler_exit,
65614 */
65615 TRACE_EVENT(softirq_entry,
65616
65617 - TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
65618 + TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
65619
65620 TP_ARGS(h, vec),
65621
65622 @@ -124,7 +124,7 @@ TRACE_EVENT(softirq_entry,
65623 */
65624 TRACE_EVENT(softirq_exit,
65625
65626 - TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
65627 + TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
65628
65629 TP_ARGS(h, vec),
65630
65631 diff -urNp linux-2.6.32.46/include/video/uvesafb.h linux-2.6.32.46/include/video/uvesafb.h
65632 --- linux-2.6.32.46/include/video/uvesafb.h 2011-03-27 14:31:47.000000000 -0400
65633 +++ linux-2.6.32.46/include/video/uvesafb.h 2011-04-17 15:56:46.000000000 -0400
65634 @@ -177,6 +177,7 @@ struct uvesafb_par {
65635 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
65636 u8 pmi_setpal; /* PMI for palette changes */
65637 u16 *pmi_base; /* protected mode interface location */
65638 + u8 *pmi_code; /* protected mode code location */
65639 void *pmi_start;
65640 void *pmi_pal;
65641 u8 *vbe_state_orig; /*
65642 diff -urNp linux-2.6.32.46/init/do_mounts.c linux-2.6.32.46/init/do_mounts.c
65643 --- linux-2.6.32.46/init/do_mounts.c 2011-03-27 14:31:47.000000000 -0400
65644 +++ linux-2.6.32.46/init/do_mounts.c 2011-04-17 15:56:46.000000000 -0400
65645 @@ -216,11 +216,11 @@ static void __init get_fs_names(char *pa
65646
65647 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
65648 {
65649 - int err = sys_mount(name, "/root", fs, flags, data);
65650 + int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
65651 if (err)
65652 return err;
65653
65654 - sys_chdir("/root");
65655 + sys_chdir((__force const char __user *)"/root");
65656 ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
65657 printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
65658 current->fs->pwd.mnt->mnt_sb->s_type->name,
65659 @@ -311,18 +311,18 @@ void __init change_floppy(char *fmt, ...
65660 va_start(args, fmt);
65661 vsprintf(buf, fmt, args);
65662 va_end(args);
65663 - fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
65664 + fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
65665 if (fd >= 0) {
65666 sys_ioctl(fd, FDEJECT, 0);
65667 sys_close(fd);
65668 }
65669 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
65670 - fd = sys_open("/dev/console", O_RDWR, 0);
65671 + fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
65672 if (fd >= 0) {
65673 sys_ioctl(fd, TCGETS, (long)&termios);
65674 termios.c_lflag &= ~ICANON;
65675 sys_ioctl(fd, TCSETSF, (long)&termios);
65676 - sys_read(fd, &c, 1);
65677 + sys_read(fd, (char __user *)&c, 1);
65678 termios.c_lflag |= ICANON;
65679 sys_ioctl(fd, TCSETSF, (long)&termios);
65680 sys_close(fd);
65681 @@ -416,6 +416,6 @@ void __init prepare_namespace(void)
65682 mount_root();
65683 out:
65684 devtmpfs_mount("dev");
65685 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
65686 - sys_chroot(".");
65687 + sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
65688 + sys_chroot((__force char __user *)".");
65689 }
65690 diff -urNp linux-2.6.32.46/init/do_mounts.h linux-2.6.32.46/init/do_mounts.h
65691 --- linux-2.6.32.46/init/do_mounts.h 2011-03-27 14:31:47.000000000 -0400
65692 +++ linux-2.6.32.46/init/do_mounts.h 2011-10-06 09:37:14.000000000 -0400
65693 @@ -15,15 +15,15 @@ extern int root_mountflags;
65694
65695 static inline int create_dev(char *name, dev_t dev)
65696 {
65697 - sys_unlink(name);
65698 - return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
65699 + sys_unlink((char __force_user *)name);
65700 + return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev));
65701 }
65702
65703 #if BITS_PER_LONG == 32
65704 static inline u32 bstat(char *name)
65705 {
65706 struct stat64 stat;
65707 - if (sys_stat64(name, &stat) != 0)
65708 + if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0)
65709 return 0;
65710 if (!S_ISBLK(stat.st_mode))
65711 return 0;
65712 @@ -35,7 +35,7 @@ static inline u32 bstat(char *name)
65713 static inline u32 bstat(char *name)
65714 {
65715 struct stat stat;
65716 - if (sys_newstat(name, &stat) != 0)
65717 + if (sys_newstat((const char __force_user *)name, (struct stat __force_user *)&stat) != 0)
65718 return 0;
65719 if (!S_ISBLK(stat.st_mode))
65720 return 0;
65721 diff -urNp linux-2.6.32.46/init/do_mounts_initrd.c linux-2.6.32.46/init/do_mounts_initrd.c
65722 --- linux-2.6.32.46/init/do_mounts_initrd.c 2011-03-27 14:31:47.000000000 -0400
65723 +++ linux-2.6.32.46/init/do_mounts_initrd.c 2011-10-06 09:37:14.000000000 -0400
65724 @@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shel
65725 sys_close(old_fd);sys_close(root_fd);
65726 sys_close(0);sys_close(1);sys_close(2);
65727 sys_setsid();
65728 - (void) sys_open("/dev/console",O_RDWR,0);
65729 + (void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
65730 (void) sys_dup(0);
65731 (void) sys_dup(0);
65732 return kernel_execve(shell, argv, envp_init);
65733 @@ -47,13 +47,13 @@ static void __init handle_initrd(void)
65734 create_dev("/dev/root.old", Root_RAM0);
65735 /* mount initrd on rootfs' /root */
65736 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
65737 - sys_mkdir("/old", 0700);
65738 - root_fd = sys_open("/", 0, 0);
65739 - old_fd = sys_open("/old", 0, 0);
65740 + sys_mkdir((const char __force_user *)"/old", 0700);
65741 + root_fd = sys_open((const char __force_user *)"/", 0, 0);
65742 + old_fd = sys_open((const char __force_user *)"/old", 0, 0);
65743 /* move initrd over / and chdir/chroot in initrd root */
65744 - sys_chdir("/root");
65745 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
65746 - sys_chroot(".");
65747 + sys_chdir((const char __force_user *)"/root");
65748 + sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
65749 + sys_chroot((const char __force_user *)".");
65750
65751 /*
65752 * In case that a resume from disk is carried out by linuxrc or one of
65753 @@ -70,15 +70,15 @@ static void __init handle_initrd(void)
65754
65755 /* move initrd to rootfs' /old */
65756 sys_fchdir(old_fd);
65757 - sys_mount("/", ".", NULL, MS_MOVE, NULL);
65758 + sys_mount((char __force_user *)"/", (char __force_user *)".", NULL, MS_MOVE, NULL);
65759 /* switch root and cwd back to / of rootfs */
65760 sys_fchdir(root_fd);
65761 - sys_chroot(".");
65762 + sys_chroot((const char __force_user *)".");
65763 sys_close(old_fd);
65764 sys_close(root_fd);
65765
65766 if (new_decode_dev(real_root_dev) == Root_RAM0) {
65767 - sys_chdir("/old");
65768 + sys_chdir((const char __force_user *)"/old");
65769 return;
65770 }
65771
65772 @@ -86,17 +86,17 @@ static void __init handle_initrd(void)
65773 mount_root();
65774
65775 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
65776 - error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
65777 + error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL);
65778 if (!error)
65779 printk("okay\n");
65780 else {
65781 - int fd = sys_open("/dev/root.old", O_RDWR, 0);
65782 + int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0);
65783 if (error == -ENOENT)
65784 printk("/initrd does not exist. Ignored.\n");
65785 else
65786 printk("failed\n");
65787 printk(KERN_NOTICE "Unmounting old root\n");
65788 - sys_umount("/old", MNT_DETACH);
65789 + sys_umount((char __force_user *)"/old", MNT_DETACH);
65790 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
65791 if (fd < 0) {
65792 error = fd;
65793 @@ -119,11 +119,11 @@ int __init initrd_load(void)
65794 * mounted in the normal path.
65795 */
65796 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
65797 - sys_unlink("/initrd.image");
65798 + sys_unlink((const char __force_user *)"/initrd.image");
65799 handle_initrd();
65800 return 1;
65801 }
65802 }
65803 - sys_unlink("/initrd.image");
65804 + sys_unlink((const char __force_user *)"/initrd.image");
65805 return 0;
65806 }
65807 diff -urNp linux-2.6.32.46/init/do_mounts_md.c linux-2.6.32.46/init/do_mounts_md.c
65808 --- linux-2.6.32.46/init/do_mounts_md.c 2011-03-27 14:31:47.000000000 -0400
65809 +++ linux-2.6.32.46/init/do_mounts_md.c 2011-10-06 09:37:14.000000000 -0400
65810 @@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
65811 partitioned ? "_d" : "", minor,
65812 md_setup_args[ent].device_names);
65813
65814 - fd = sys_open(name, 0, 0);
65815 + fd = sys_open((char __force_user *)name, 0, 0);
65816 if (fd < 0) {
65817 printk(KERN_ERR "md: open failed - cannot start "
65818 "array %s\n", name);
65819 @@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
65820 * array without it
65821 */
65822 sys_close(fd);
65823 - fd = sys_open(name, 0, 0);
65824 + fd = sys_open((char __force_user *)name, 0, 0);
65825 sys_ioctl(fd, BLKRRPART, 0);
65826 }
65827 sys_close(fd);
65828 @@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
65829
65830 wait_for_device_probe();
65831
65832 - fd = sys_open("/dev/md0", 0, 0);
65833 + fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
65834 if (fd >= 0) {
65835 sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
65836 sys_close(fd);
65837 diff -urNp linux-2.6.32.46/init/initramfs.c linux-2.6.32.46/init/initramfs.c
65838 --- linux-2.6.32.46/init/initramfs.c 2011-03-27 14:31:47.000000000 -0400
65839 +++ linux-2.6.32.46/init/initramfs.c 2011-10-06 09:37:14.000000000 -0400
65840 @@ -74,7 +74,7 @@ static void __init free_hash(void)
65841 }
65842 }
65843
65844 -static long __init do_utime(char __user *filename, time_t mtime)
65845 +static long __init do_utime(__force char __user *filename, time_t mtime)
65846 {
65847 struct timespec t[2];
65848
65849 @@ -109,7 +109,7 @@ static void __init dir_utime(void)
65850 struct dir_entry *de, *tmp;
65851 list_for_each_entry_safe(de, tmp, &dir_list, list) {
65852 list_del(&de->list);
65853 - do_utime(de->name, de->mtime);
65854 + do_utime((char __force_user *)de->name, de->mtime);
65855 kfree(de->name);
65856 kfree(de);
65857 }
65858 @@ -271,7 +271,7 @@ static int __init maybe_link(void)
65859 if (nlink >= 2) {
65860 char *old = find_link(major, minor, ino, mode, collected);
65861 if (old)
65862 - return (sys_link(old, collected) < 0) ? -1 : 1;
65863 + return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1;
65864 }
65865 return 0;
65866 }
65867 @@ -280,11 +280,11 @@ static void __init clean_path(char *path
65868 {
65869 struct stat st;
65870
65871 - if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
65872 + if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) {
65873 if (S_ISDIR(st.st_mode))
65874 - sys_rmdir(path);
65875 + sys_rmdir((char __force_user *)path);
65876 else
65877 - sys_unlink(path);
65878 + sys_unlink((char __force_user *)path);
65879 }
65880 }
65881
65882 @@ -305,7 +305,7 @@ static int __init do_name(void)
65883 int openflags = O_WRONLY|O_CREAT;
65884 if (ml != 1)
65885 openflags |= O_TRUNC;
65886 - wfd = sys_open(collected, openflags, mode);
65887 + wfd = sys_open((char __force_user *)collected, openflags, mode);
65888
65889 if (wfd >= 0) {
65890 sys_fchown(wfd, uid, gid);
65891 @@ -317,17 +317,17 @@ static int __init do_name(void)
65892 }
65893 }
65894 } else if (S_ISDIR(mode)) {
65895 - sys_mkdir(collected, mode);
65896 - sys_chown(collected, uid, gid);
65897 - sys_chmod(collected, mode);
65898 + sys_mkdir((char __force_user *)collected, mode);
65899 + sys_chown((char __force_user *)collected, uid, gid);
65900 + sys_chmod((char __force_user *)collected, mode);
65901 dir_add(collected, mtime);
65902 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
65903 S_ISFIFO(mode) || S_ISSOCK(mode)) {
65904 if (maybe_link() == 0) {
65905 - sys_mknod(collected, mode, rdev);
65906 - sys_chown(collected, uid, gid);
65907 - sys_chmod(collected, mode);
65908 - do_utime(collected, mtime);
65909 + sys_mknod((char __force_user *)collected, mode, rdev);
65910 + sys_chown((char __force_user *)collected, uid, gid);
65911 + sys_chmod((char __force_user *)collected, mode);
65912 + do_utime((char __force_user *)collected, mtime);
65913 }
65914 }
65915 return 0;
65916 @@ -336,15 +336,15 @@ static int __init do_name(void)
65917 static int __init do_copy(void)
65918 {
65919 if (count >= body_len) {
65920 - sys_write(wfd, victim, body_len);
65921 + sys_write(wfd, (char __force_user *)victim, body_len);
65922 sys_close(wfd);
65923 - do_utime(vcollected, mtime);
65924 + do_utime((char __force_user *)vcollected, mtime);
65925 kfree(vcollected);
65926 eat(body_len);
65927 state = SkipIt;
65928 return 0;
65929 } else {
65930 - sys_write(wfd, victim, count);
65931 + sys_write(wfd, (char __force_user *)victim, count);
65932 body_len -= count;
65933 eat(count);
65934 return 1;
65935 @@ -355,9 +355,9 @@ static int __init do_symlink(void)
65936 {
65937 collected[N_ALIGN(name_len) + body_len] = '\0';
65938 clean_path(collected, 0);
65939 - sys_symlink(collected + N_ALIGN(name_len), collected);
65940 - sys_lchown(collected, uid, gid);
65941 - do_utime(collected, mtime);
65942 + sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected);
65943 + sys_lchown((char __force_user *)collected, uid, gid);
65944 + do_utime((char __force_user *)collected, mtime);
65945 state = SkipIt;
65946 next_state = Reset;
65947 return 0;
65948 diff -urNp linux-2.6.32.46/init/Kconfig linux-2.6.32.46/init/Kconfig
65949 --- linux-2.6.32.46/init/Kconfig 2011-05-10 22:12:01.000000000 -0400
65950 +++ linux-2.6.32.46/init/Kconfig 2011-05-10 22:12:34.000000000 -0400
65951 @@ -1004,7 +1004,7 @@ config SLUB_DEBUG
65952
65953 config COMPAT_BRK
65954 bool "Disable heap randomization"
65955 - default y
65956 + default n
65957 help
65958 Randomizing heap placement makes heap exploits harder, but it
65959 also breaks ancient binaries (including anything libc5 based).
65960 diff -urNp linux-2.6.32.46/init/main.c linux-2.6.32.46/init/main.c
65961 --- linux-2.6.32.46/init/main.c 2011-05-10 22:12:01.000000000 -0400
65962 +++ linux-2.6.32.46/init/main.c 2011-10-06 09:37:14.000000000 -0400
65963 @@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void)
65964 #ifdef CONFIG_TC
65965 extern void tc_init(void);
65966 #endif
65967 +extern void grsecurity_init(void);
65968
65969 enum system_states system_state __read_mostly;
65970 EXPORT_SYMBOL(system_state);
65971 @@ -183,6 +184,49 @@ static int __init set_reset_devices(char
65972
65973 __setup("reset_devices", set_reset_devices);
65974
65975 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
65976 +extern char pax_enter_kernel_user[];
65977 +extern char pax_exit_kernel_user[];
65978 +extern pgdval_t clone_pgd_mask;
65979 +#endif
65980 +
65981 +#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
65982 +static int __init setup_pax_nouderef(char *str)
65983 +{
65984 +#ifdef CONFIG_X86_32
65985 + unsigned int cpu;
65986 + struct desc_struct *gdt;
65987 +
65988 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
65989 + gdt = get_cpu_gdt_table(cpu);
65990 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
65991 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
65992 + gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
65993 + gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
65994 + }
65995 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
65996 +#else
65997 + memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
65998 + memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
65999 + clone_pgd_mask = ~(pgdval_t)0UL;
66000 +#endif
66001 +
66002 + return 0;
66003 +}
66004 +early_param("pax_nouderef", setup_pax_nouderef);
66005 +#endif
66006 +
66007 +#ifdef CONFIG_PAX_SOFTMODE
66008 +int pax_softmode;
66009 +
66010 +static int __init setup_pax_softmode(char *str)
66011 +{
66012 + get_option(&str, &pax_softmode);
66013 + return 1;
66014 +}
66015 +__setup("pax_softmode=", setup_pax_softmode);
66016 +#endif
66017 +
66018 static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
66019 char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
66020 static const char *panic_later, *panic_param;
66021 @@ -705,52 +749,53 @@ int initcall_debug;
66022 core_param(initcall_debug, initcall_debug, bool, 0644);
66023
66024 static char msgbuf[64];
66025 -static struct boot_trace_call call;
66026 -static struct boot_trace_ret ret;
66027 +static struct boot_trace_call trace_call;
66028 +static struct boot_trace_ret trace_ret;
66029
66030 int do_one_initcall(initcall_t fn)
66031 {
66032 int count = preempt_count();
66033 ktime_t calltime, delta, rettime;
66034 + const char *msg1 = "", *msg2 = "";
66035
66036 if (initcall_debug) {
66037 - call.caller = task_pid_nr(current);
66038 - printk("calling %pF @ %i\n", fn, call.caller);
66039 + trace_call.caller = task_pid_nr(current);
66040 + printk("calling %pF @ %i\n", fn, trace_call.caller);
66041 calltime = ktime_get();
66042 - trace_boot_call(&call, fn);
66043 + trace_boot_call(&trace_call, fn);
66044 enable_boot_trace();
66045 }
66046
66047 - ret.result = fn();
66048 + trace_ret.result = fn();
66049
66050 if (initcall_debug) {
66051 disable_boot_trace();
66052 rettime = ktime_get();
66053 delta = ktime_sub(rettime, calltime);
66054 - ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
66055 - trace_boot_ret(&ret, fn);
66056 + trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
66057 + trace_boot_ret(&trace_ret, fn);
66058 printk("initcall %pF returned %d after %Ld usecs\n", fn,
66059 - ret.result, ret.duration);
66060 + trace_ret.result, trace_ret.duration);
66061 }
66062
66063 msgbuf[0] = 0;
66064
66065 - if (ret.result && ret.result != -ENODEV && initcall_debug)
66066 - sprintf(msgbuf, "error code %d ", ret.result);
66067 + if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
66068 + sprintf(msgbuf, "error code %d ", trace_ret.result);
66069
66070 if (preempt_count() != count) {
66071 - strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
66072 + msg1 = " preemption imbalance";
66073 preempt_count() = count;
66074 }
66075 if (irqs_disabled()) {
66076 - strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
66077 + msg2 = " disabled interrupts";
66078 local_irq_enable();
66079 }
66080 - if (msgbuf[0]) {
66081 - printk("initcall %pF returned with %s\n", fn, msgbuf);
66082 + if (msgbuf[0] || *msg1 || *msg2) {
66083 + printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
66084 }
66085
66086 - return ret.result;
66087 + return trace_ret.result;
66088 }
66089
66090
66091 @@ -893,11 +938,13 @@ static int __init kernel_init(void * unu
66092 if (!ramdisk_execute_command)
66093 ramdisk_execute_command = "/init";
66094
66095 - if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
66096 + if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) {
66097 ramdisk_execute_command = NULL;
66098 prepare_namespace();
66099 }
66100
66101 + grsecurity_init();
66102 +
66103 /*
66104 * Ok, we have completed the initial bootup, and
66105 * we're essentially up and running. Get rid of the
66106 diff -urNp linux-2.6.32.46/init/noinitramfs.c linux-2.6.32.46/init/noinitramfs.c
66107 --- linux-2.6.32.46/init/noinitramfs.c 2011-03-27 14:31:47.000000000 -0400
66108 +++ linux-2.6.32.46/init/noinitramfs.c 2011-04-17 15:56:46.000000000 -0400
66109 @@ -29,7 +29,7 @@ static int __init default_rootfs(void)
66110 {
66111 int err;
66112
66113 - err = sys_mkdir("/dev", 0755);
66114 + err = sys_mkdir((const char __user *)"/dev", 0755);
66115 if (err < 0)
66116 goto out;
66117
66118 @@ -39,7 +39,7 @@ static int __init default_rootfs(void)
66119 if (err < 0)
66120 goto out;
66121
66122 - err = sys_mkdir("/root", 0700);
66123 + err = sys_mkdir((const char __user *)"/root", 0700);
66124 if (err < 0)
66125 goto out;
66126
66127 diff -urNp linux-2.6.32.46/ipc/mqueue.c linux-2.6.32.46/ipc/mqueue.c
66128 --- linux-2.6.32.46/ipc/mqueue.c 2011-03-27 14:31:47.000000000 -0400
66129 +++ linux-2.6.32.46/ipc/mqueue.c 2011-04-17 15:56:46.000000000 -0400
66130 @@ -150,6 +150,7 @@ static struct inode *mqueue_get_inode(st
66131 mq_bytes = (mq_msg_tblsz +
66132 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
66133
66134 + gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
66135 spin_lock(&mq_lock);
66136 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
66137 u->mq_bytes + mq_bytes >
66138 diff -urNp linux-2.6.32.46/ipc/msg.c linux-2.6.32.46/ipc/msg.c
66139 --- linux-2.6.32.46/ipc/msg.c 2011-03-27 14:31:47.000000000 -0400
66140 +++ linux-2.6.32.46/ipc/msg.c 2011-08-05 20:33:55.000000000 -0400
66141 @@ -310,18 +310,19 @@ static inline int msg_security(struct ke
66142 return security_msg_queue_associate(msq, msgflg);
66143 }
66144
66145 +static struct ipc_ops msg_ops = {
66146 + .getnew = newque,
66147 + .associate = msg_security,
66148 + .more_checks = NULL
66149 +};
66150 +
66151 SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
66152 {
66153 struct ipc_namespace *ns;
66154 - struct ipc_ops msg_ops;
66155 struct ipc_params msg_params;
66156
66157 ns = current->nsproxy->ipc_ns;
66158
66159 - msg_ops.getnew = newque;
66160 - msg_ops.associate = msg_security;
66161 - msg_ops.more_checks = NULL;
66162 -
66163 msg_params.key = key;
66164 msg_params.flg = msgflg;
66165
66166 diff -urNp linux-2.6.32.46/ipc/sem.c linux-2.6.32.46/ipc/sem.c
66167 --- linux-2.6.32.46/ipc/sem.c 2011-03-27 14:31:47.000000000 -0400
66168 +++ linux-2.6.32.46/ipc/sem.c 2011-08-05 20:33:55.000000000 -0400
66169 @@ -309,10 +309,15 @@ static inline int sem_more_checks(struct
66170 return 0;
66171 }
66172
66173 +static struct ipc_ops sem_ops = {
66174 + .getnew = newary,
66175 + .associate = sem_security,
66176 + .more_checks = sem_more_checks
66177 +};
66178 +
66179 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
66180 {
66181 struct ipc_namespace *ns;
66182 - struct ipc_ops sem_ops;
66183 struct ipc_params sem_params;
66184
66185 ns = current->nsproxy->ipc_ns;
66186 @@ -320,10 +325,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int,
66187 if (nsems < 0 || nsems > ns->sc_semmsl)
66188 return -EINVAL;
66189
66190 - sem_ops.getnew = newary;
66191 - sem_ops.associate = sem_security;
66192 - sem_ops.more_checks = sem_more_checks;
66193 -
66194 sem_params.key = key;
66195 sem_params.flg = semflg;
66196 sem_params.u.nsems = nsems;
66197 @@ -671,6 +672,8 @@ static int semctl_main(struct ipc_namesp
66198 ushort* sem_io = fast_sem_io;
66199 int nsems;
66200
66201 + pax_track_stack();
66202 +
66203 sma = sem_lock_check(ns, semid);
66204 if (IS_ERR(sma))
66205 return PTR_ERR(sma);
66206 @@ -1071,6 +1074,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid,
66207 unsigned long jiffies_left = 0;
66208 struct ipc_namespace *ns;
66209
66210 + pax_track_stack();
66211 +
66212 ns = current->nsproxy->ipc_ns;
66213
66214 if (nsops < 1 || semid < 0)
66215 diff -urNp linux-2.6.32.46/ipc/shm.c linux-2.6.32.46/ipc/shm.c
66216 --- linux-2.6.32.46/ipc/shm.c 2011-03-27 14:31:47.000000000 -0400
66217 +++ linux-2.6.32.46/ipc/shm.c 2011-08-05 20:33:55.000000000 -0400
66218 @@ -70,6 +70,14 @@ static void shm_destroy (struct ipc_name
66219 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
66220 #endif
66221
66222 +#ifdef CONFIG_GRKERNSEC
66223 +extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
66224 + const time_t shm_createtime, const uid_t cuid,
66225 + const int shmid);
66226 +extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
66227 + const time_t shm_createtime);
66228 +#endif
66229 +
66230 void shm_init_ns(struct ipc_namespace *ns)
66231 {
66232 ns->shm_ctlmax = SHMMAX;
66233 @@ -396,6 +404,14 @@ static int newseg(struct ipc_namespace *
66234 shp->shm_lprid = 0;
66235 shp->shm_atim = shp->shm_dtim = 0;
66236 shp->shm_ctim = get_seconds();
66237 +#ifdef CONFIG_GRKERNSEC
66238 + {
66239 + struct timespec timeval;
66240 + do_posix_clock_monotonic_gettime(&timeval);
66241 +
66242 + shp->shm_createtime = timeval.tv_sec;
66243 + }
66244 +#endif
66245 shp->shm_segsz = size;
66246 shp->shm_nattch = 0;
66247 shp->shm_file = file;
66248 @@ -446,18 +462,19 @@ static inline int shm_more_checks(struct
66249 return 0;
66250 }
66251
66252 +static struct ipc_ops shm_ops = {
66253 + .getnew = newseg,
66254 + .associate = shm_security,
66255 + .more_checks = shm_more_checks
66256 +};
66257 +
66258 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
66259 {
66260 struct ipc_namespace *ns;
66261 - struct ipc_ops shm_ops;
66262 struct ipc_params shm_params;
66263
66264 ns = current->nsproxy->ipc_ns;
66265
66266 - shm_ops.getnew = newseg;
66267 - shm_ops.associate = shm_security;
66268 - shm_ops.more_checks = shm_more_checks;
66269 -
66270 shm_params.key = key;
66271 shm_params.flg = shmflg;
66272 shm_params.u.size = size;
66273 @@ -880,9 +897,21 @@ long do_shmat(int shmid, char __user *sh
66274 if (err)
66275 goto out_unlock;
66276
66277 +#ifdef CONFIG_GRKERNSEC
66278 + if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
66279 + shp->shm_perm.cuid, shmid) ||
66280 + !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
66281 + err = -EACCES;
66282 + goto out_unlock;
66283 + }
66284 +#endif
66285 +
66286 path.dentry = dget(shp->shm_file->f_path.dentry);
66287 path.mnt = shp->shm_file->f_path.mnt;
66288 shp->shm_nattch++;
66289 +#ifdef CONFIG_GRKERNSEC
66290 + shp->shm_lapid = current->pid;
66291 +#endif
66292 size = i_size_read(path.dentry->d_inode);
66293 shm_unlock(shp);
66294
66295 diff -urNp linux-2.6.32.46/kernel/acct.c linux-2.6.32.46/kernel/acct.c
66296 --- linux-2.6.32.46/kernel/acct.c 2011-03-27 14:31:47.000000000 -0400
66297 +++ linux-2.6.32.46/kernel/acct.c 2011-10-06 09:37:14.000000000 -0400
66298 @@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_a
66299 */
66300 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
66301 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
66302 - file->f_op->write(file, (char *)&ac,
66303 + file->f_op->write(file, (char __force_user *)&ac,
66304 sizeof(acct_t), &file->f_pos);
66305 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
66306 set_fs(fs);
66307 diff -urNp linux-2.6.32.46/kernel/audit.c linux-2.6.32.46/kernel/audit.c
66308 --- linux-2.6.32.46/kernel/audit.c 2011-03-27 14:31:47.000000000 -0400
66309 +++ linux-2.6.32.46/kernel/audit.c 2011-05-04 17:56:28.000000000 -0400
66310 @@ -110,7 +110,7 @@ u32 audit_sig_sid = 0;
66311 3) suppressed due to audit_rate_limit
66312 4) suppressed due to audit_backlog_limit
66313 */
66314 -static atomic_t audit_lost = ATOMIC_INIT(0);
66315 +static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
66316
66317 /* The netlink socket. */
66318 static struct sock *audit_sock;
66319 @@ -232,7 +232,7 @@ void audit_log_lost(const char *message)
66320 unsigned long now;
66321 int print;
66322
66323 - atomic_inc(&audit_lost);
66324 + atomic_inc_unchecked(&audit_lost);
66325
66326 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
66327
66328 @@ -251,7 +251,7 @@ void audit_log_lost(const char *message)
66329 printk(KERN_WARNING
66330 "audit: audit_lost=%d audit_rate_limit=%d "
66331 "audit_backlog_limit=%d\n",
66332 - atomic_read(&audit_lost),
66333 + atomic_read_unchecked(&audit_lost),
66334 audit_rate_limit,
66335 audit_backlog_limit);
66336 audit_panic(message);
66337 @@ -691,7 +691,7 @@ static int audit_receive_msg(struct sk_b
66338 status_set.pid = audit_pid;
66339 status_set.rate_limit = audit_rate_limit;
66340 status_set.backlog_limit = audit_backlog_limit;
66341 - status_set.lost = atomic_read(&audit_lost);
66342 + status_set.lost = atomic_read_unchecked(&audit_lost);
66343 status_set.backlog = skb_queue_len(&audit_skb_queue);
66344 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
66345 &status_set, sizeof(status_set));
66346 @@ -891,8 +891,10 @@ static int audit_receive_msg(struct sk_b
66347 spin_unlock_irq(&tsk->sighand->siglock);
66348 }
66349 read_unlock(&tasklist_lock);
66350 - audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
66351 - &s, sizeof(s));
66352 +
66353 + if (!err)
66354 + audit_send_reply(NETLINK_CB(skb).pid, seq,
66355 + AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
66356 break;
66357 }
66358 case AUDIT_TTY_SET: {
66359 diff -urNp linux-2.6.32.46/kernel/auditsc.c linux-2.6.32.46/kernel/auditsc.c
66360 --- linux-2.6.32.46/kernel/auditsc.c 2011-03-27 14:31:47.000000000 -0400
66361 +++ linux-2.6.32.46/kernel/auditsc.c 2011-05-04 17:56:28.000000000 -0400
66362 @@ -2113,7 +2113,7 @@ int auditsc_get_stamp(struct audit_conte
66363 }
66364
66365 /* global counter which is incremented every time something logs in */
66366 -static atomic_t session_id = ATOMIC_INIT(0);
66367 +static atomic_unchecked_t session_id = ATOMIC_INIT(0);
66368
66369 /**
66370 * audit_set_loginuid - set a task's audit_context loginuid
66371 @@ -2126,7 +2126,7 @@ static atomic_t session_id = ATOMIC_INIT
66372 */
66373 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
66374 {
66375 - unsigned int sessionid = atomic_inc_return(&session_id);
66376 + unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
66377 struct audit_context *context = task->audit_context;
66378
66379 if (context && context->in_syscall) {
66380 diff -urNp linux-2.6.32.46/kernel/capability.c linux-2.6.32.46/kernel/capability.c
66381 --- linux-2.6.32.46/kernel/capability.c 2011-03-27 14:31:47.000000000 -0400
66382 +++ linux-2.6.32.46/kernel/capability.c 2011-04-17 15:56:46.000000000 -0400
66383 @@ -305,10 +305,26 @@ int capable(int cap)
66384 BUG();
66385 }
66386
66387 - if (security_capable(cap) == 0) {
66388 + if (security_capable(cap) == 0 && gr_is_capable(cap)) {
66389 current->flags |= PF_SUPERPRIV;
66390 return 1;
66391 }
66392 return 0;
66393 }
66394 +
66395 +int capable_nolog(int cap)
66396 +{
66397 + if (unlikely(!cap_valid(cap))) {
66398 + printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
66399 + BUG();
66400 + }
66401 +
66402 + if (security_capable(cap) == 0 && gr_is_capable_nolog(cap)) {
66403 + current->flags |= PF_SUPERPRIV;
66404 + return 1;
66405 + }
66406 + return 0;
66407 +}
66408 +
66409 EXPORT_SYMBOL(capable);
66410 +EXPORT_SYMBOL(capable_nolog);
66411 diff -urNp linux-2.6.32.46/kernel/cgroup.c linux-2.6.32.46/kernel/cgroup.c
66412 --- linux-2.6.32.46/kernel/cgroup.c 2011-03-27 14:31:47.000000000 -0400
66413 +++ linux-2.6.32.46/kernel/cgroup.c 2011-05-16 21:46:57.000000000 -0400
66414 @@ -536,6 +536,8 @@ static struct css_set *find_css_set(
66415 struct hlist_head *hhead;
66416 struct cg_cgroup_link *link;
66417
66418 + pax_track_stack();
66419 +
66420 /* First see if we already have a cgroup group that matches
66421 * the desired set */
66422 read_lock(&css_set_lock);
66423 diff -urNp linux-2.6.32.46/kernel/compat.c linux-2.6.32.46/kernel/compat.c
66424 --- linux-2.6.32.46/kernel/compat.c 2011-03-27 14:31:47.000000000 -0400
66425 +++ linux-2.6.32.46/kernel/compat.c 2011-10-06 09:37:14.000000000 -0400
66426 @@ -108,7 +108,7 @@ static long compat_nanosleep_restart(str
66427 mm_segment_t oldfs;
66428 long ret;
66429
66430 - restart->nanosleep.rmtp = (struct timespec __user *) &rmt;
66431 + restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt;
66432 oldfs = get_fs();
66433 set_fs(KERNEL_DS);
66434 ret = hrtimer_nanosleep_restart(restart);
66435 @@ -140,7 +140,7 @@ asmlinkage long compat_sys_nanosleep(str
66436 oldfs = get_fs();
66437 set_fs(KERNEL_DS);
66438 ret = hrtimer_nanosleep(&tu,
66439 - rmtp ? (struct timespec __user *)&rmt : NULL,
66440 + rmtp ? (struct timespec __force_user *)&rmt : NULL,
66441 HRTIMER_MODE_REL, CLOCK_MONOTONIC);
66442 set_fs(oldfs);
66443
66444 @@ -247,7 +247,7 @@ asmlinkage long compat_sys_sigpending(co
66445 mm_segment_t old_fs = get_fs();
66446
66447 set_fs(KERNEL_DS);
66448 - ret = sys_sigpending((old_sigset_t __user *) &s);
66449 + ret = sys_sigpending((old_sigset_t __force_user *) &s);
66450 set_fs(old_fs);
66451 if (ret == 0)
66452 ret = put_user(s, set);
66453 @@ -266,8 +266,8 @@ asmlinkage long compat_sys_sigprocmask(i
66454 old_fs = get_fs();
66455 set_fs(KERNEL_DS);
66456 ret = sys_sigprocmask(how,
66457 - set ? (old_sigset_t __user *) &s : NULL,
66458 - oset ? (old_sigset_t __user *) &s : NULL);
66459 + set ? (old_sigset_t __force_user *) &s : NULL,
66460 + oset ? (old_sigset_t __force_user *) &s : NULL);
66461 set_fs(old_fs);
66462 if (ret == 0)
66463 if (oset)
66464 @@ -310,7 +310,7 @@ asmlinkage long compat_sys_old_getrlimit
66465 mm_segment_t old_fs = get_fs();
66466
66467 set_fs(KERNEL_DS);
66468 - ret = sys_old_getrlimit(resource, &r);
66469 + ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r);
66470 set_fs(old_fs);
66471
66472 if (!ret) {
66473 @@ -385,7 +385,7 @@ asmlinkage long compat_sys_getrusage(int
66474 mm_segment_t old_fs = get_fs();
66475
66476 set_fs(KERNEL_DS);
66477 - ret = sys_getrusage(who, (struct rusage __user *) &r);
66478 + ret = sys_getrusage(who, (struct rusage __force_user *) &r);
66479 set_fs(old_fs);
66480
66481 if (ret)
66482 @@ -412,8 +412,8 @@ compat_sys_wait4(compat_pid_t pid, compa
66483 set_fs (KERNEL_DS);
66484 ret = sys_wait4(pid,
66485 (stat_addr ?
66486 - (unsigned int __user *) &status : NULL),
66487 - options, (struct rusage __user *) &r);
66488 + (unsigned int __force_user *) &status : NULL),
66489 + options, (struct rusage __force_user *) &r);
66490 set_fs (old_fs);
66491
66492 if (ret > 0) {
66493 @@ -438,8 +438,8 @@ asmlinkage long compat_sys_waitid(int wh
66494 memset(&info, 0, sizeof(info));
66495
66496 set_fs(KERNEL_DS);
66497 - ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options,
66498 - uru ? (struct rusage __user *)&ru : NULL);
66499 + ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options,
66500 + uru ? (struct rusage __force_user *)&ru : NULL);
66501 set_fs(old_fs);
66502
66503 if ((ret < 0) || (info.si_signo == 0))
66504 @@ -569,8 +569,8 @@ long compat_sys_timer_settime(timer_t ti
66505 oldfs = get_fs();
66506 set_fs(KERNEL_DS);
66507 err = sys_timer_settime(timer_id, flags,
66508 - (struct itimerspec __user *) &newts,
66509 - (struct itimerspec __user *) &oldts);
66510 + (struct itimerspec __force_user *) &newts,
66511 + (struct itimerspec __force_user *) &oldts);
66512 set_fs(oldfs);
66513 if (!err && old && put_compat_itimerspec(old, &oldts))
66514 return -EFAULT;
66515 @@ -587,7 +587,7 @@ long compat_sys_timer_gettime(timer_t ti
66516 oldfs = get_fs();
66517 set_fs(KERNEL_DS);
66518 err = sys_timer_gettime(timer_id,
66519 - (struct itimerspec __user *) &ts);
66520 + (struct itimerspec __force_user *) &ts);
66521 set_fs(oldfs);
66522 if (!err && put_compat_itimerspec(setting, &ts))
66523 return -EFAULT;
66524 @@ -606,7 +606,7 @@ long compat_sys_clock_settime(clockid_t
66525 oldfs = get_fs();
66526 set_fs(KERNEL_DS);
66527 err = sys_clock_settime(which_clock,
66528 - (struct timespec __user *) &ts);
66529 + (struct timespec __force_user *) &ts);
66530 set_fs(oldfs);
66531 return err;
66532 }
66533 @@ -621,7 +621,7 @@ long compat_sys_clock_gettime(clockid_t
66534 oldfs = get_fs();
66535 set_fs(KERNEL_DS);
66536 err = sys_clock_gettime(which_clock,
66537 - (struct timespec __user *) &ts);
66538 + (struct timespec __force_user *) &ts);
66539 set_fs(oldfs);
66540 if (!err && put_compat_timespec(&ts, tp))
66541 return -EFAULT;
66542 @@ -638,7 +638,7 @@ long compat_sys_clock_getres(clockid_t w
66543 oldfs = get_fs();
66544 set_fs(KERNEL_DS);
66545 err = sys_clock_getres(which_clock,
66546 - (struct timespec __user *) &ts);
66547 + (struct timespec __force_user *) &ts);
66548 set_fs(oldfs);
66549 if (!err && tp && put_compat_timespec(&ts, tp))
66550 return -EFAULT;
66551 @@ -650,9 +650,9 @@ static long compat_clock_nanosleep_resta
66552 long err;
66553 mm_segment_t oldfs;
66554 struct timespec tu;
66555 - struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp;
66556 + struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp;
66557
66558 - restart->nanosleep.rmtp = (struct timespec __user *) &tu;
66559 + restart->nanosleep.rmtp = (struct timespec __force_user *) &tu;
66560 oldfs = get_fs();
66561 set_fs(KERNEL_DS);
66562 err = clock_nanosleep_restart(restart);
66563 @@ -684,8 +684,8 @@ long compat_sys_clock_nanosleep(clockid_
66564 oldfs = get_fs();
66565 set_fs(KERNEL_DS);
66566 err = sys_clock_nanosleep(which_clock, flags,
66567 - (struct timespec __user *) &in,
66568 - (struct timespec __user *) &out);
66569 + (struct timespec __force_user *) &in,
66570 + (struct timespec __force_user *) &out);
66571 set_fs(oldfs);
66572
66573 if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
66574 diff -urNp linux-2.6.32.46/kernel/configs.c linux-2.6.32.46/kernel/configs.c
66575 --- linux-2.6.32.46/kernel/configs.c 2011-03-27 14:31:47.000000000 -0400
66576 +++ linux-2.6.32.46/kernel/configs.c 2011-04-17 15:56:46.000000000 -0400
66577 @@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
66578 struct proc_dir_entry *entry;
66579
66580 /* create the current config file */
66581 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
66582 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
66583 + entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
66584 + &ikconfig_file_ops);
66585 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
66586 + entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
66587 + &ikconfig_file_ops);
66588 +#endif
66589 +#else
66590 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
66591 &ikconfig_file_ops);
66592 +#endif
66593 +
66594 if (!entry)
66595 return -ENOMEM;
66596
66597 diff -urNp linux-2.6.32.46/kernel/cpu.c linux-2.6.32.46/kernel/cpu.c
66598 --- linux-2.6.32.46/kernel/cpu.c 2011-03-27 14:31:47.000000000 -0400
66599 +++ linux-2.6.32.46/kernel/cpu.c 2011-04-17 15:56:46.000000000 -0400
66600 @@ -19,7 +19,7 @@
66601 /* Serializes the updates to cpu_online_mask, cpu_present_mask */
66602 static DEFINE_MUTEX(cpu_add_remove_lock);
66603
66604 -static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
66605 +static RAW_NOTIFIER_HEAD(cpu_chain);
66606
66607 /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
66608 * Should always be manipulated under cpu_add_remove_lock
66609 diff -urNp linux-2.6.32.46/kernel/cred.c linux-2.6.32.46/kernel/cred.c
66610 --- linux-2.6.32.46/kernel/cred.c 2011-03-27 14:31:47.000000000 -0400
66611 +++ linux-2.6.32.46/kernel/cred.c 2011-08-11 19:49:38.000000000 -0400
66612 @@ -160,6 +160,8 @@ static void put_cred_rcu(struct rcu_head
66613 */
66614 void __put_cred(struct cred *cred)
66615 {
66616 + pax_track_stack();
66617 +
66618 kdebug("__put_cred(%p{%d,%d})", cred,
66619 atomic_read(&cred->usage),
66620 read_cred_subscribers(cred));
66621 @@ -184,6 +186,8 @@ void exit_creds(struct task_struct *tsk)
66622 {
66623 struct cred *cred;
66624
66625 + pax_track_stack();
66626 +
66627 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
66628 atomic_read(&tsk->cred->usage),
66629 read_cred_subscribers(tsk->cred));
66630 @@ -222,6 +226,8 @@ const struct cred *get_task_cred(struct
66631 {
66632 const struct cred *cred;
66633
66634 + pax_track_stack();
66635 +
66636 rcu_read_lock();
66637
66638 do {
66639 @@ -241,6 +247,8 @@ struct cred *cred_alloc_blank(void)
66640 {
66641 struct cred *new;
66642
66643 + pax_track_stack();
66644 +
66645 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
66646 if (!new)
66647 return NULL;
66648 @@ -289,6 +297,8 @@ struct cred *prepare_creds(void)
66649 const struct cred *old;
66650 struct cred *new;
66651
66652 + pax_track_stack();
66653 +
66654 validate_process_creds();
66655
66656 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
66657 @@ -335,6 +345,8 @@ struct cred *prepare_exec_creds(void)
66658 struct thread_group_cred *tgcred = NULL;
66659 struct cred *new;
66660
66661 + pax_track_stack();
66662 +
66663 #ifdef CONFIG_KEYS
66664 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
66665 if (!tgcred)
66666 @@ -441,6 +453,8 @@ int copy_creds(struct task_struct *p, un
66667 struct cred *new;
66668 int ret;
66669
66670 + pax_track_stack();
66671 +
66672 mutex_init(&p->cred_guard_mutex);
66673
66674 if (
66675 @@ -528,6 +542,8 @@ int commit_creds(struct cred *new)
66676 struct task_struct *task = current;
66677 const struct cred *old = task->real_cred;
66678
66679 + pax_track_stack();
66680 +
66681 kdebug("commit_creds(%p{%d,%d})", new,
66682 atomic_read(&new->usage),
66683 read_cred_subscribers(new));
66684 @@ -544,6 +560,8 @@ int commit_creds(struct cred *new)
66685
66686 get_cred(new); /* we will require a ref for the subj creds too */
66687
66688 + gr_set_role_label(task, new->uid, new->gid);
66689 +
66690 /* dumpability changes */
66691 if (old->euid != new->euid ||
66692 old->egid != new->egid ||
66693 @@ -563,10 +581,8 @@ int commit_creds(struct cred *new)
66694 key_fsgid_changed(task);
66695
66696 /* do it
66697 - * - What if a process setreuid()'s and this brings the
66698 - * new uid over his NPROC rlimit? We can check this now
66699 - * cheaply with the new uid cache, so if it matters
66700 - * we should be checking for it. -DaveM
66701 + * RLIMIT_NPROC limits on user->processes have already been checked
66702 + * in set_user().
66703 */
66704 alter_cred_subscribers(new, 2);
66705 if (new->user != old->user)
66706 @@ -606,6 +622,8 @@ EXPORT_SYMBOL(commit_creds);
66707 */
66708 void abort_creds(struct cred *new)
66709 {
66710 + pax_track_stack();
66711 +
66712 kdebug("abort_creds(%p{%d,%d})", new,
66713 atomic_read(&new->usage),
66714 read_cred_subscribers(new));
66715 @@ -629,6 +647,8 @@ const struct cred *override_creds(const
66716 {
66717 const struct cred *old = current->cred;
66718
66719 + pax_track_stack();
66720 +
66721 kdebug("override_creds(%p{%d,%d})", new,
66722 atomic_read(&new->usage),
66723 read_cred_subscribers(new));
66724 @@ -658,6 +678,8 @@ void revert_creds(const struct cred *old
66725 {
66726 const struct cred *override = current->cred;
66727
66728 + pax_track_stack();
66729 +
66730 kdebug("revert_creds(%p{%d,%d})", old,
66731 atomic_read(&old->usage),
66732 read_cred_subscribers(old));
66733 @@ -704,6 +726,8 @@ struct cred *prepare_kernel_cred(struct
66734 const struct cred *old;
66735 struct cred *new;
66736
66737 + pax_track_stack();
66738 +
66739 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
66740 if (!new)
66741 return NULL;
66742 @@ -758,6 +782,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
66743 */
66744 int set_security_override(struct cred *new, u32 secid)
66745 {
66746 + pax_track_stack();
66747 +
66748 return security_kernel_act_as(new, secid);
66749 }
66750 EXPORT_SYMBOL(set_security_override);
66751 @@ -777,6 +803,8 @@ int set_security_override_from_ctx(struc
66752 u32 secid;
66753 int ret;
66754
66755 + pax_track_stack();
66756 +
66757 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
66758 if (ret < 0)
66759 return ret;
66760 diff -urNp linux-2.6.32.46/kernel/exit.c linux-2.6.32.46/kernel/exit.c
66761 --- linux-2.6.32.46/kernel/exit.c 2011-03-27 14:31:47.000000000 -0400
66762 +++ linux-2.6.32.46/kernel/exit.c 2011-08-17 19:19:50.000000000 -0400
66763 @@ -55,6 +55,10 @@
66764 #include <asm/pgtable.h>
66765 #include <asm/mmu_context.h>
66766
66767 +#ifdef CONFIG_GRKERNSEC
66768 +extern rwlock_t grsec_exec_file_lock;
66769 +#endif
66770 +
66771 static void exit_mm(struct task_struct * tsk);
66772
66773 static void __unhash_process(struct task_struct *p)
66774 @@ -174,6 +178,10 @@ void release_task(struct task_struct * p
66775 struct task_struct *leader;
66776 int zap_leader;
66777 repeat:
66778 +#ifdef CONFIG_NET
66779 + gr_del_task_from_ip_table(p);
66780 +#endif
66781 +
66782 tracehook_prepare_release_task(p);
66783 /* don't need to get the RCU readlock here - the process is dead and
66784 * can't be modifying its own credentials */
66785 @@ -341,11 +349,22 @@ static void reparent_to_kthreadd(void)
66786 {
66787 write_lock_irq(&tasklist_lock);
66788
66789 +#ifdef CONFIG_GRKERNSEC
66790 + write_lock(&grsec_exec_file_lock);
66791 + if (current->exec_file) {
66792 + fput(current->exec_file);
66793 + current->exec_file = NULL;
66794 + }
66795 + write_unlock(&grsec_exec_file_lock);
66796 +#endif
66797 +
66798 ptrace_unlink(current);
66799 /* Reparent to init */
66800 current->real_parent = current->parent = kthreadd_task;
66801 list_move_tail(&current->sibling, &current->real_parent->children);
66802
66803 + gr_set_kernel_label(current);
66804 +
66805 /* Set the exit signal to SIGCHLD so we signal init on exit */
66806 current->exit_signal = SIGCHLD;
66807
66808 @@ -397,7 +416,7 @@ int allow_signal(int sig)
66809 * know it'll be handled, so that they don't get converted to
66810 * SIGKILL or just silently dropped.
66811 */
66812 - current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
66813 + current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
66814 recalc_sigpending();
66815 spin_unlock_irq(&current->sighand->siglock);
66816 return 0;
66817 @@ -433,6 +452,17 @@ void daemonize(const char *name, ...)
66818 vsnprintf(current->comm, sizeof(current->comm), name, args);
66819 va_end(args);
66820
66821 +#ifdef CONFIG_GRKERNSEC
66822 + write_lock(&grsec_exec_file_lock);
66823 + if (current->exec_file) {
66824 + fput(current->exec_file);
66825 + current->exec_file = NULL;
66826 + }
66827 + write_unlock(&grsec_exec_file_lock);
66828 +#endif
66829 +
66830 + gr_set_kernel_label(current);
66831 +
66832 /*
66833 * If we were started as result of loading a module, close all of the
66834 * user space pages. We don't need them, and if we didn't close them
66835 @@ -897,17 +927,17 @@ NORET_TYPE void do_exit(long code)
66836 struct task_struct *tsk = current;
66837 int group_dead;
66838
66839 - profile_task_exit(tsk);
66840 -
66841 - WARN_ON(atomic_read(&tsk->fs_excl));
66842 -
66843 + /*
66844 + * Check this first since set_fs() below depends on
66845 + * current_thread_info(), which we better not access when we're in
66846 + * interrupt context. Other than that, we want to do the set_fs()
66847 + * as early as possible.
66848 + */
66849 if (unlikely(in_interrupt()))
66850 panic("Aiee, killing interrupt handler!");
66851 - if (unlikely(!tsk->pid))
66852 - panic("Attempted to kill the idle task!");
66853
66854 /*
66855 - * If do_exit is called because this processes oopsed, it's possible
66856 + * If do_exit is called because this processes Oops'ed, it's possible
66857 * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
66858 * continuing. Amongst other possible reasons, this is to prevent
66859 * mm_release()->clear_child_tid() from writing to a user-controlled
66860 @@ -915,6 +945,13 @@ NORET_TYPE void do_exit(long code)
66861 */
66862 set_fs(USER_DS);
66863
66864 + profile_task_exit(tsk);
66865 +
66866 + WARN_ON(atomic_read(&tsk->fs_excl));
66867 +
66868 + if (unlikely(!tsk->pid))
66869 + panic("Attempted to kill the idle task!");
66870 +
66871 tracehook_report_exit(&code);
66872
66873 validate_creds_for_do_exit(tsk);
66874 @@ -973,6 +1010,9 @@ NORET_TYPE void do_exit(long code)
66875 tsk->exit_code = code;
66876 taskstats_exit(tsk, group_dead);
66877
66878 + gr_acl_handle_psacct(tsk, code);
66879 + gr_acl_handle_exit();
66880 +
66881 exit_mm(tsk);
66882
66883 if (group_dead)
66884 @@ -1188,7 +1228,7 @@ static int wait_task_zombie(struct wait_
66885
66886 if (unlikely(wo->wo_flags & WNOWAIT)) {
66887 int exit_code = p->exit_code;
66888 - int why, status;
66889 + int why;
66890
66891 get_task_struct(p);
66892 read_unlock(&tasklist_lock);
66893 diff -urNp linux-2.6.32.46/kernel/fork.c linux-2.6.32.46/kernel/fork.c
66894 --- linux-2.6.32.46/kernel/fork.c 2011-03-27 14:31:47.000000000 -0400
66895 +++ linux-2.6.32.46/kernel/fork.c 2011-08-11 19:50:07.000000000 -0400
66896 @@ -253,7 +253,7 @@ static struct task_struct *dup_task_stru
66897 *stackend = STACK_END_MAGIC; /* for overflow detection */
66898
66899 #ifdef CONFIG_CC_STACKPROTECTOR
66900 - tsk->stack_canary = get_random_int();
66901 + tsk->stack_canary = pax_get_random_long();
66902 #endif
66903
66904 /* One for us, one for whoever does the "release_task()" (usually parent) */
66905 @@ -293,8 +293,8 @@ static int dup_mmap(struct mm_struct *mm
66906 mm->locked_vm = 0;
66907 mm->mmap = NULL;
66908 mm->mmap_cache = NULL;
66909 - mm->free_area_cache = oldmm->mmap_base;
66910 - mm->cached_hole_size = ~0UL;
66911 + mm->free_area_cache = oldmm->free_area_cache;
66912 + mm->cached_hole_size = oldmm->cached_hole_size;
66913 mm->map_count = 0;
66914 cpumask_clear(mm_cpumask(mm));
66915 mm->mm_rb = RB_ROOT;
66916 @@ -335,6 +335,7 @@ static int dup_mmap(struct mm_struct *mm
66917 tmp->vm_flags &= ~VM_LOCKED;
66918 tmp->vm_mm = mm;
66919 tmp->vm_next = tmp->vm_prev = NULL;
66920 + tmp->vm_mirror = NULL;
66921 anon_vma_link(tmp);
66922 file = tmp->vm_file;
66923 if (file) {
66924 @@ -384,6 +385,31 @@ static int dup_mmap(struct mm_struct *mm
66925 if (retval)
66926 goto out;
66927 }
66928 +
66929 +#ifdef CONFIG_PAX_SEGMEXEC
66930 + if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
66931 + struct vm_area_struct *mpnt_m;
66932 +
66933 + for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
66934 + BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
66935 +
66936 + if (!mpnt->vm_mirror)
66937 + continue;
66938 +
66939 + if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
66940 + BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
66941 + mpnt->vm_mirror = mpnt_m;
66942 + } else {
66943 + BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
66944 + mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
66945 + mpnt_m->vm_mirror->vm_mirror = mpnt_m;
66946 + mpnt->vm_mirror->vm_mirror = mpnt;
66947 + }
66948 + }
66949 + BUG_ON(mpnt_m);
66950 + }
66951 +#endif
66952 +
66953 /* a new mm has just been created */
66954 arch_dup_mmap(oldmm, mm);
66955 retval = 0;
66956 @@ -734,13 +760,14 @@ static int copy_fs(unsigned long clone_f
66957 write_unlock(&fs->lock);
66958 return -EAGAIN;
66959 }
66960 - fs->users++;
66961 + atomic_inc(&fs->users);
66962 write_unlock(&fs->lock);
66963 return 0;
66964 }
66965 tsk->fs = copy_fs_struct(fs);
66966 if (!tsk->fs)
66967 return -ENOMEM;
66968 + gr_set_chroot_entries(tsk, &tsk->fs->root);
66969 return 0;
66970 }
66971
66972 @@ -1033,12 +1060,16 @@ static struct task_struct *copy_process(
66973 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
66974 #endif
66975 retval = -EAGAIN;
66976 +
66977 + gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
66978 +
66979 if (atomic_read(&p->real_cred->user->processes) >=
66980 p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
66981 - if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
66982 - p->real_cred->user != INIT_USER)
66983 + if (p->real_cred->user != INIT_USER &&
66984 + !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
66985 goto bad_fork_free;
66986 }
66987 + current->flags &= ~PF_NPROC_EXCEEDED;
66988
66989 retval = copy_creds(p, clone_flags);
66990 if (retval < 0)
66991 @@ -1183,6 +1214,8 @@ static struct task_struct *copy_process(
66992 goto bad_fork_free_pid;
66993 }
66994
66995 + gr_copy_label(p);
66996 +
66997 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
66998 /*
66999 * Clear TID on mm_release()?
67000 @@ -1333,6 +1366,8 @@ bad_fork_cleanup_count:
67001 bad_fork_free:
67002 free_task(p);
67003 fork_out:
67004 + gr_log_forkfail(retval);
67005 +
67006 return ERR_PTR(retval);
67007 }
67008
67009 @@ -1426,6 +1461,8 @@ long do_fork(unsigned long clone_flags,
67010 if (clone_flags & CLONE_PARENT_SETTID)
67011 put_user(nr, parent_tidptr);
67012
67013 + gr_handle_brute_check();
67014 +
67015 if (clone_flags & CLONE_VFORK) {
67016 p->vfork_done = &vfork;
67017 init_completion(&vfork);
67018 @@ -1558,7 +1595,7 @@ static int unshare_fs(unsigned long unsh
67019 return 0;
67020
67021 /* don't need lock here; in the worst case we'll do useless copy */
67022 - if (fs->users == 1)
67023 + if (atomic_read(&fs->users) == 1)
67024 return 0;
67025
67026 *new_fsp = copy_fs_struct(fs);
67027 @@ -1681,7 +1718,8 @@ SYSCALL_DEFINE1(unshare, unsigned long,
67028 fs = current->fs;
67029 write_lock(&fs->lock);
67030 current->fs = new_fs;
67031 - if (--fs->users)
67032 + gr_set_chroot_entries(current, &current->fs->root);
67033 + if (atomic_dec_return(&fs->users))
67034 new_fs = NULL;
67035 else
67036 new_fs = fs;
67037 diff -urNp linux-2.6.32.46/kernel/futex.c linux-2.6.32.46/kernel/futex.c
67038 --- linux-2.6.32.46/kernel/futex.c 2011-08-29 22:24:44.000000000 -0400
67039 +++ linux-2.6.32.46/kernel/futex.c 2011-08-29 22:25:07.000000000 -0400
67040 @@ -54,6 +54,7 @@
67041 #include <linux/mount.h>
67042 #include <linux/pagemap.h>
67043 #include <linux/syscalls.h>
67044 +#include <linux/ptrace.h>
67045 #include <linux/signal.h>
67046 #include <linux/module.h>
67047 #include <linux/magic.h>
67048 @@ -223,6 +224,11 @@ get_futex_key(u32 __user *uaddr, int fsh
67049 struct page *page;
67050 int err, ro = 0;
67051
67052 +#ifdef CONFIG_PAX_SEGMEXEC
67053 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
67054 + return -EFAULT;
67055 +#endif
67056 +
67057 /*
67058 * The futex address must be "naturally" aligned.
67059 */
67060 @@ -1819,6 +1825,8 @@ static int futex_wait(u32 __user *uaddr,
67061 struct futex_q q;
67062 int ret;
67063
67064 + pax_track_stack();
67065 +
67066 if (!bitset)
67067 return -EINVAL;
67068
67069 @@ -1871,7 +1879,7 @@ retry:
67070
67071 restart = &current_thread_info()->restart_block;
67072 restart->fn = futex_wait_restart;
67073 - restart->futex.uaddr = (u32 *)uaddr;
67074 + restart->futex.uaddr = uaddr;
67075 restart->futex.val = val;
67076 restart->futex.time = abs_time->tv64;
67077 restart->futex.bitset = bitset;
67078 @@ -2233,6 +2241,8 @@ static int futex_wait_requeue_pi(u32 __u
67079 struct futex_q q;
67080 int res, ret;
67081
67082 + pax_track_stack();
67083 +
67084 if (!bitset)
67085 return -EINVAL;
67086
67087 @@ -2407,7 +2417,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67088 {
67089 struct robust_list_head __user *head;
67090 unsigned long ret;
67091 +#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
67092 const struct cred *cred = current_cred(), *pcred;
67093 +#endif
67094
67095 if (!futex_cmpxchg_enabled)
67096 return -ENOSYS;
67097 @@ -2423,11 +2435,16 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67098 if (!p)
67099 goto err_unlock;
67100 ret = -EPERM;
67101 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
67102 + if (!ptrace_may_access(p, PTRACE_MODE_READ))
67103 + goto err_unlock;
67104 +#else
67105 pcred = __task_cred(p);
67106 if (cred->euid != pcred->euid &&
67107 cred->euid != pcred->uid &&
67108 !capable(CAP_SYS_PTRACE))
67109 goto err_unlock;
67110 +#endif
67111 head = p->robust_list;
67112 rcu_read_unlock();
67113 }
67114 @@ -2489,7 +2506,7 @@ retry:
67115 */
67116 static inline int fetch_robust_entry(struct robust_list __user **entry,
67117 struct robust_list __user * __user *head,
67118 - int *pi)
67119 + unsigned int *pi)
67120 {
67121 unsigned long uentry;
67122
67123 @@ -2670,6 +2687,7 @@ static int __init futex_init(void)
67124 {
67125 u32 curval;
67126 int i;
67127 + mm_segment_t oldfs;
67128
67129 /*
67130 * This will fail and we want it. Some arch implementations do
67131 @@ -2681,7 +2699,10 @@ static int __init futex_init(void)
67132 * implementation, the non functional ones will return
67133 * -ENOSYS.
67134 */
67135 + oldfs = get_fs();
67136 + set_fs(USER_DS);
67137 curval = cmpxchg_futex_value_locked(NULL, 0, 0);
67138 + set_fs(oldfs);
67139 if (curval == -EFAULT)
67140 futex_cmpxchg_enabled = 1;
67141
67142 diff -urNp linux-2.6.32.46/kernel/futex_compat.c linux-2.6.32.46/kernel/futex_compat.c
67143 --- linux-2.6.32.46/kernel/futex_compat.c 2011-03-27 14:31:47.000000000 -0400
67144 +++ linux-2.6.32.46/kernel/futex_compat.c 2011-04-17 15:56:46.000000000 -0400
67145 @@ -10,6 +10,7 @@
67146 #include <linux/compat.h>
67147 #include <linux/nsproxy.h>
67148 #include <linux/futex.h>
67149 +#include <linux/ptrace.h>
67150
67151 #include <asm/uaccess.h>
67152
67153 @@ -135,7 +136,10 @@ compat_sys_get_robust_list(int pid, comp
67154 {
67155 struct compat_robust_list_head __user *head;
67156 unsigned long ret;
67157 - const struct cred *cred = current_cred(), *pcred;
67158 +#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
67159 + const struct cred *cred = current_cred();
67160 + const struct cred *pcred;
67161 +#endif
67162
67163 if (!futex_cmpxchg_enabled)
67164 return -ENOSYS;
67165 @@ -151,11 +155,16 @@ compat_sys_get_robust_list(int pid, comp
67166 if (!p)
67167 goto err_unlock;
67168 ret = -EPERM;
67169 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
67170 + if (!ptrace_may_access(p, PTRACE_MODE_READ))
67171 + goto err_unlock;
67172 +#else
67173 pcred = __task_cred(p);
67174 if (cred->euid != pcred->euid &&
67175 cred->euid != pcred->uid &&
67176 !capable(CAP_SYS_PTRACE))
67177 goto err_unlock;
67178 +#endif
67179 head = p->compat_robust_list;
67180 read_unlock(&tasklist_lock);
67181 }
67182 diff -urNp linux-2.6.32.46/kernel/gcov/base.c linux-2.6.32.46/kernel/gcov/base.c
67183 --- linux-2.6.32.46/kernel/gcov/base.c 2011-03-27 14:31:47.000000000 -0400
67184 +++ linux-2.6.32.46/kernel/gcov/base.c 2011-04-17 15:56:46.000000000 -0400
67185 @@ -102,11 +102,6 @@ void gcov_enable_events(void)
67186 }
67187
67188 #ifdef CONFIG_MODULES
67189 -static inline int within(void *addr, void *start, unsigned long size)
67190 -{
67191 - return ((addr >= start) && (addr < start + size));
67192 -}
67193 -
67194 /* Update list and generate events when modules are unloaded. */
67195 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
67196 void *data)
67197 @@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
67198 prev = NULL;
67199 /* Remove entries located in module from linked list. */
67200 for (info = gcov_info_head; info; info = info->next) {
67201 - if (within(info, mod->module_core, mod->core_size)) {
67202 + if (within_module_core_rw((unsigned long)info, mod)) {
67203 if (prev)
67204 prev->next = info->next;
67205 else
67206 diff -urNp linux-2.6.32.46/kernel/hrtimer.c linux-2.6.32.46/kernel/hrtimer.c
67207 --- linux-2.6.32.46/kernel/hrtimer.c 2011-03-27 14:31:47.000000000 -0400
67208 +++ linux-2.6.32.46/kernel/hrtimer.c 2011-04-17 15:56:46.000000000 -0400
67209 @@ -1391,7 +1391,7 @@ void hrtimer_peek_ahead_timers(void)
67210 local_irq_restore(flags);
67211 }
67212
67213 -static void run_hrtimer_softirq(struct softirq_action *h)
67214 +static void run_hrtimer_softirq(void)
67215 {
67216 hrtimer_peek_ahead_timers();
67217 }
67218 diff -urNp linux-2.6.32.46/kernel/kallsyms.c linux-2.6.32.46/kernel/kallsyms.c
67219 --- linux-2.6.32.46/kernel/kallsyms.c 2011-03-27 14:31:47.000000000 -0400
67220 +++ linux-2.6.32.46/kernel/kallsyms.c 2011-04-17 15:56:46.000000000 -0400
67221 @@ -11,6 +11,9 @@
67222 * Changed the compression method from stem compression to "table lookup"
67223 * compression (see scripts/kallsyms.c for a more complete description)
67224 */
67225 +#ifdef CONFIG_GRKERNSEC_HIDESYM
67226 +#define __INCLUDED_BY_HIDESYM 1
67227 +#endif
67228 #include <linux/kallsyms.h>
67229 #include <linux/module.h>
67230 #include <linux/init.h>
67231 @@ -51,12 +54,33 @@ extern const unsigned long kallsyms_mark
67232
67233 static inline int is_kernel_inittext(unsigned long addr)
67234 {
67235 + if (system_state != SYSTEM_BOOTING)
67236 + return 0;
67237 +
67238 if (addr >= (unsigned long)_sinittext
67239 && addr <= (unsigned long)_einittext)
67240 return 1;
67241 return 0;
67242 }
67243
67244 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67245 +#ifdef CONFIG_MODULES
67246 +static inline int is_module_text(unsigned long addr)
67247 +{
67248 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
67249 + return 1;
67250 +
67251 + addr = ktla_ktva(addr);
67252 + return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
67253 +}
67254 +#else
67255 +static inline int is_module_text(unsigned long addr)
67256 +{
67257 + return 0;
67258 +}
67259 +#endif
67260 +#endif
67261 +
67262 static inline int is_kernel_text(unsigned long addr)
67263 {
67264 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
67265 @@ -67,13 +91,28 @@ static inline int is_kernel_text(unsigne
67266
67267 static inline int is_kernel(unsigned long addr)
67268 {
67269 +
67270 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67271 + if (is_kernel_text(addr) || is_kernel_inittext(addr))
67272 + return 1;
67273 +
67274 + if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
67275 +#else
67276 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
67277 +#endif
67278 +
67279 return 1;
67280 return in_gate_area_no_task(addr);
67281 }
67282
67283 static int is_ksym_addr(unsigned long addr)
67284 {
67285 +
67286 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67287 + if (is_module_text(addr))
67288 + return 0;
67289 +#endif
67290 +
67291 if (all_var)
67292 return is_kernel(addr);
67293
67294 @@ -413,7 +452,6 @@ static unsigned long get_ksymbol_core(st
67295
67296 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
67297 {
67298 - iter->name[0] = '\0';
67299 iter->nameoff = get_symbol_offset(new_pos);
67300 iter->pos = new_pos;
67301 }
67302 @@ -461,6 +499,11 @@ static int s_show(struct seq_file *m, vo
67303 {
67304 struct kallsym_iter *iter = m->private;
67305
67306 +#ifdef CONFIG_GRKERNSEC_HIDESYM
67307 + if (current_uid())
67308 + return 0;
67309 +#endif
67310 +
67311 /* Some debugging symbols have no name. Ignore them. */
67312 if (!iter->name[0])
67313 return 0;
67314 @@ -501,7 +544,7 @@ static int kallsyms_open(struct inode *i
67315 struct kallsym_iter *iter;
67316 int ret;
67317
67318 - iter = kmalloc(sizeof(*iter), GFP_KERNEL);
67319 + iter = kzalloc(sizeof(*iter), GFP_KERNEL);
67320 if (!iter)
67321 return -ENOMEM;
67322 reset_iter(iter, 0);
67323 diff -urNp linux-2.6.32.46/kernel/kexec.c linux-2.6.32.46/kernel/kexec.c
67324 --- linux-2.6.32.46/kernel/kexec.c 2011-03-27 14:31:47.000000000 -0400
67325 +++ linux-2.6.32.46/kernel/kexec.c 2011-10-06 09:37:14.000000000 -0400
67326 @@ -1028,7 +1028,8 @@ asmlinkage long compat_sys_kexec_load(un
67327 unsigned long flags)
67328 {
67329 struct compat_kexec_segment in;
67330 - struct kexec_segment out, __user *ksegments;
67331 + struct kexec_segment out;
67332 + struct kexec_segment __user *ksegments;
67333 unsigned long i, result;
67334
67335 /* Don't allow clients that don't understand the native
67336 diff -urNp linux-2.6.32.46/kernel/kgdb.c linux-2.6.32.46/kernel/kgdb.c
67337 --- linux-2.6.32.46/kernel/kgdb.c 2011-04-17 17:00:52.000000000 -0400
67338 +++ linux-2.6.32.46/kernel/kgdb.c 2011-05-04 17:56:20.000000000 -0400
67339 @@ -86,7 +86,7 @@ static int kgdb_io_module_registered;
67340 /* Guard for recursive entry */
67341 static int exception_level;
67342
67343 -static struct kgdb_io *kgdb_io_ops;
67344 +static const struct kgdb_io *kgdb_io_ops;
67345 static DEFINE_SPINLOCK(kgdb_registration_lock);
67346
67347 /* kgdb console driver is loaded */
67348 @@ -123,7 +123,7 @@ atomic_t kgdb_active = ATOMIC_INIT(-1)
67349 */
67350 static atomic_t passive_cpu_wait[NR_CPUS];
67351 static atomic_t cpu_in_kgdb[NR_CPUS];
67352 -atomic_t kgdb_setting_breakpoint;
67353 +atomic_unchecked_t kgdb_setting_breakpoint;
67354
67355 struct task_struct *kgdb_usethread;
67356 struct task_struct *kgdb_contthread;
67357 @@ -140,7 +140,7 @@ static unsigned long gdb_regs[(NUMREGBY
67358 sizeof(unsigned long)];
67359
67360 /* to keep track of the CPU which is doing the single stepping*/
67361 -atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
67362 +atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
67363
67364 /*
67365 * If you are debugging a problem where roundup (the collection of
67366 @@ -815,7 +815,7 @@ static int kgdb_io_ready(int print_wait)
67367 return 0;
67368 if (kgdb_connected)
67369 return 1;
67370 - if (atomic_read(&kgdb_setting_breakpoint))
67371 + if (atomic_read_unchecked(&kgdb_setting_breakpoint))
67372 return 1;
67373 if (print_wait)
67374 printk(KERN_CRIT "KGDB: Waiting for remote debugger\n");
67375 @@ -1426,8 +1426,8 @@ acquirelock:
67376 * instance of the exception handler wanted to come into the
67377 * debugger on a different CPU via a single step
67378 */
67379 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
67380 - atomic_read(&kgdb_cpu_doing_single_step) != cpu) {
67381 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
67382 + atomic_read_unchecked(&kgdb_cpu_doing_single_step) != cpu) {
67383
67384 atomic_set(&kgdb_active, -1);
67385 touch_softlockup_watchdog();
67386 @@ -1634,7 +1634,7 @@ static void kgdb_initial_breakpoint(void
67387 *
67388 * Register it with the KGDB core.
67389 */
67390 -int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
67391 +int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
67392 {
67393 int err;
67394
67395 @@ -1679,7 +1679,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
67396 *
67397 * Unregister it with the KGDB core.
67398 */
67399 -void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
67400 +void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
67401 {
67402 BUG_ON(kgdb_connected);
67403
67404 @@ -1712,11 +1712,11 @@ EXPORT_SYMBOL_GPL(kgdb_unregister_io_mod
67405 */
67406 void kgdb_breakpoint(void)
67407 {
67408 - atomic_set(&kgdb_setting_breakpoint, 1);
67409 + atomic_set_unchecked(&kgdb_setting_breakpoint, 1);
67410 wmb(); /* Sync point before breakpoint */
67411 arch_kgdb_breakpoint();
67412 wmb(); /* Sync point after breakpoint */
67413 - atomic_set(&kgdb_setting_breakpoint, 0);
67414 + atomic_set_unchecked(&kgdb_setting_breakpoint, 0);
67415 }
67416 EXPORT_SYMBOL_GPL(kgdb_breakpoint);
67417
67418 diff -urNp linux-2.6.32.46/kernel/kmod.c linux-2.6.32.46/kernel/kmod.c
67419 --- linux-2.6.32.46/kernel/kmod.c 2011-03-27 14:31:47.000000000 -0400
67420 +++ linux-2.6.32.46/kernel/kmod.c 2011-10-06 09:37:14.000000000 -0400
67421 @@ -65,13 +65,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb
67422 * If module auto-loading support is disabled then this function
67423 * becomes a no-operation.
67424 */
67425 -int __request_module(bool wait, const char *fmt, ...)
67426 +static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
67427 {
67428 - va_list args;
67429 char module_name[MODULE_NAME_LEN];
67430 unsigned int max_modprobes;
67431 int ret;
67432 - char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
67433 + char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
67434 static char *envp[] = { "HOME=/",
67435 "TERM=linux",
67436 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
67437 @@ -84,12 +83,24 @@ int __request_module(bool wait, const ch
67438 if (ret)
67439 return ret;
67440
67441 - va_start(args, fmt);
67442 - ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
67443 - va_end(args);
67444 + ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
67445 if (ret >= MODULE_NAME_LEN)
67446 return -ENAMETOOLONG;
67447
67448 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
67449 + if (!current_uid()) {
67450 + /* hack to workaround consolekit/udisks stupidity */
67451 + read_lock(&tasklist_lock);
67452 + if (!strcmp(current->comm, "mount") &&
67453 + current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
67454 + read_unlock(&tasklist_lock);
67455 + printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
67456 + return -EPERM;
67457 + }
67458 + read_unlock(&tasklist_lock);
67459 + }
67460 +#endif
67461 +
67462 /* If modprobe needs a service that is in a module, we get a recursive
67463 * loop. Limit the number of running kmod threads to max_threads/2 or
67464 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
67465 @@ -121,6 +132,48 @@ int __request_module(bool wait, const ch
67466 atomic_dec(&kmod_concurrent);
67467 return ret;
67468 }
67469 +
67470 +int ___request_module(bool wait, char *module_param, const char *fmt, ...)
67471 +{
67472 + va_list args;
67473 + int ret;
67474 +
67475 + va_start(args, fmt);
67476 + ret = ____request_module(wait, module_param, fmt, args);
67477 + va_end(args);
67478 +
67479 + return ret;
67480 +}
67481 +
67482 +int __request_module(bool wait, const char *fmt, ...)
67483 +{
67484 + va_list args;
67485 + int ret;
67486 +
67487 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
67488 + if (current_uid()) {
67489 + char module_param[MODULE_NAME_LEN];
67490 +
67491 + memset(module_param, 0, sizeof(module_param));
67492 +
67493 + snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
67494 +
67495 + va_start(args, fmt);
67496 + ret = ____request_module(wait, module_param, fmt, args);
67497 + va_end(args);
67498 +
67499 + return ret;
67500 + }
67501 +#endif
67502 +
67503 + va_start(args, fmt);
67504 + ret = ____request_module(wait, NULL, fmt, args);
67505 + va_end(args);
67506 +
67507 + return ret;
67508 +}
67509 +
67510 +
67511 EXPORT_SYMBOL(__request_module);
67512 #endif /* CONFIG_MODULES */
67513
67514 @@ -226,7 +279,7 @@ static int wait_for_helper(void *data)
67515 *
67516 * Thus the __user pointer cast is valid here.
67517 */
67518 - sys_wait4(pid, (int __user *)&ret, 0, NULL);
67519 + sys_wait4(pid, (int __force_user *)&ret, 0, NULL);
67520
67521 /*
67522 * If ret is 0, either ____call_usermodehelper failed and the
67523 diff -urNp linux-2.6.32.46/kernel/kprobes.c linux-2.6.32.46/kernel/kprobes.c
67524 --- linux-2.6.32.46/kernel/kprobes.c 2011-03-27 14:31:47.000000000 -0400
67525 +++ linux-2.6.32.46/kernel/kprobes.c 2011-04-17 15:56:46.000000000 -0400
67526 @@ -183,7 +183,7 @@ static kprobe_opcode_t __kprobes *__get_
67527 * kernel image and loaded module images reside. This is required
67528 * so x86_64 can correctly handle the %rip-relative fixups.
67529 */
67530 - kip->insns = module_alloc(PAGE_SIZE);
67531 + kip->insns = module_alloc_exec(PAGE_SIZE);
67532 if (!kip->insns) {
67533 kfree(kip);
67534 return NULL;
67535 @@ -220,7 +220,7 @@ static int __kprobes collect_one_slot(st
67536 */
67537 if (!list_is_singular(&kprobe_insn_pages)) {
67538 list_del(&kip->list);
67539 - module_free(NULL, kip->insns);
67540 + module_free_exec(NULL, kip->insns);
67541 kfree(kip);
67542 }
67543 return 1;
67544 @@ -1189,7 +1189,7 @@ static int __init init_kprobes(void)
67545 {
67546 int i, err = 0;
67547 unsigned long offset = 0, size = 0;
67548 - char *modname, namebuf[128];
67549 + char *modname, namebuf[KSYM_NAME_LEN];
67550 const char *symbol_name;
67551 void *addr;
67552 struct kprobe_blackpoint *kb;
67553 @@ -1304,7 +1304,7 @@ static int __kprobes show_kprobe_addr(st
67554 const char *sym = NULL;
67555 unsigned int i = *(loff_t *) v;
67556 unsigned long offset = 0;
67557 - char *modname, namebuf[128];
67558 + char *modname, namebuf[KSYM_NAME_LEN];
67559
67560 head = &kprobe_table[i];
67561 preempt_disable();
67562 diff -urNp linux-2.6.32.46/kernel/lockdep.c linux-2.6.32.46/kernel/lockdep.c
67563 --- linux-2.6.32.46/kernel/lockdep.c 2011-06-25 12:55:35.000000000 -0400
67564 +++ linux-2.6.32.46/kernel/lockdep.c 2011-06-25 12:56:37.000000000 -0400
67565 @@ -421,20 +421,20 @@ static struct stack_trace lockdep_init_t
67566 /*
67567 * Various lockdep statistics:
67568 */
67569 -atomic_t chain_lookup_hits;
67570 -atomic_t chain_lookup_misses;
67571 -atomic_t hardirqs_on_events;
67572 -atomic_t hardirqs_off_events;
67573 -atomic_t redundant_hardirqs_on;
67574 -atomic_t redundant_hardirqs_off;
67575 -atomic_t softirqs_on_events;
67576 -atomic_t softirqs_off_events;
67577 -atomic_t redundant_softirqs_on;
67578 -atomic_t redundant_softirqs_off;
67579 -atomic_t nr_unused_locks;
67580 -atomic_t nr_cyclic_checks;
67581 -atomic_t nr_find_usage_forwards_checks;
67582 -atomic_t nr_find_usage_backwards_checks;
67583 +atomic_unchecked_t chain_lookup_hits;
67584 +atomic_unchecked_t chain_lookup_misses;
67585 +atomic_unchecked_t hardirqs_on_events;
67586 +atomic_unchecked_t hardirqs_off_events;
67587 +atomic_unchecked_t redundant_hardirqs_on;
67588 +atomic_unchecked_t redundant_hardirqs_off;
67589 +atomic_unchecked_t softirqs_on_events;
67590 +atomic_unchecked_t softirqs_off_events;
67591 +atomic_unchecked_t redundant_softirqs_on;
67592 +atomic_unchecked_t redundant_softirqs_off;
67593 +atomic_unchecked_t nr_unused_locks;
67594 +atomic_unchecked_t nr_cyclic_checks;
67595 +atomic_unchecked_t nr_find_usage_forwards_checks;
67596 +atomic_unchecked_t nr_find_usage_backwards_checks;
67597 #endif
67598
67599 /*
67600 @@ -577,6 +577,10 @@ static int static_obj(void *obj)
67601 int i;
67602 #endif
67603
67604 +#ifdef CONFIG_PAX_KERNEXEC
67605 + start = ktla_ktva(start);
67606 +#endif
67607 +
67608 /*
67609 * static variable?
67610 */
67611 @@ -592,8 +596,7 @@ static int static_obj(void *obj)
67612 */
67613 for_each_possible_cpu(i) {
67614 start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
67615 - end = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
67616 - + per_cpu_offset(i);
67617 + end = start + PERCPU_ENOUGH_ROOM;
67618
67619 if ((addr >= start) && (addr < end))
67620 return 1;
67621 @@ -710,6 +713,7 @@ register_lock_class(struct lockdep_map *
67622 if (!static_obj(lock->key)) {
67623 debug_locks_off();
67624 printk("INFO: trying to register non-static key.\n");
67625 + printk("lock:%pS key:%pS.\n", lock, lock->key);
67626 printk("the code is fine but needs lockdep annotation.\n");
67627 printk("turning off the locking correctness validator.\n");
67628 dump_stack();
67629 @@ -2751,7 +2755,7 @@ static int __lock_acquire(struct lockdep
67630 if (!class)
67631 return 0;
67632 }
67633 - debug_atomic_inc((atomic_t *)&class->ops);
67634 + debug_atomic_inc((atomic_unchecked_t *)&class->ops);
67635 if (very_verbose(class)) {
67636 printk("\nacquire class [%p] %s", class->key, class->name);
67637 if (class->name_version > 1)
67638 diff -urNp linux-2.6.32.46/kernel/lockdep_internals.h linux-2.6.32.46/kernel/lockdep_internals.h
67639 --- linux-2.6.32.46/kernel/lockdep_internals.h 2011-03-27 14:31:47.000000000 -0400
67640 +++ linux-2.6.32.46/kernel/lockdep_internals.h 2011-04-17 15:56:46.000000000 -0400
67641 @@ -113,26 +113,26 @@ lockdep_count_backward_deps(struct lock_
67642 /*
67643 * Various lockdep statistics:
67644 */
67645 -extern atomic_t chain_lookup_hits;
67646 -extern atomic_t chain_lookup_misses;
67647 -extern atomic_t hardirqs_on_events;
67648 -extern atomic_t hardirqs_off_events;
67649 -extern atomic_t redundant_hardirqs_on;
67650 -extern atomic_t redundant_hardirqs_off;
67651 -extern atomic_t softirqs_on_events;
67652 -extern atomic_t softirqs_off_events;
67653 -extern atomic_t redundant_softirqs_on;
67654 -extern atomic_t redundant_softirqs_off;
67655 -extern atomic_t nr_unused_locks;
67656 -extern atomic_t nr_cyclic_checks;
67657 -extern atomic_t nr_cyclic_check_recursions;
67658 -extern atomic_t nr_find_usage_forwards_checks;
67659 -extern atomic_t nr_find_usage_forwards_recursions;
67660 -extern atomic_t nr_find_usage_backwards_checks;
67661 -extern atomic_t nr_find_usage_backwards_recursions;
67662 -# define debug_atomic_inc(ptr) atomic_inc(ptr)
67663 -# define debug_atomic_dec(ptr) atomic_dec(ptr)
67664 -# define debug_atomic_read(ptr) atomic_read(ptr)
67665 +extern atomic_unchecked_t chain_lookup_hits;
67666 +extern atomic_unchecked_t chain_lookup_misses;
67667 +extern atomic_unchecked_t hardirqs_on_events;
67668 +extern atomic_unchecked_t hardirqs_off_events;
67669 +extern atomic_unchecked_t redundant_hardirqs_on;
67670 +extern atomic_unchecked_t redundant_hardirqs_off;
67671 +extern atomic_unchecked_t softirqs_on_events;
67672 +extern atomic_unchecked_t softirqs_off_events;
67673 +extern atomic_unchecked_t redundant_softirqs_on;
67674 +extern atomic_unchecked_t redundant_softirqs_off;
67675 +extern atomic_unchecked_t nr_unused_locks;
67676 +extern atomic_unchecked_t nr_cyclic_checks;
67677 +extern atomic_unchecked_t nr_cyclic_check_recursions;
67678 +extern atomic_unchecked_t nr_find_usage_forwards_checks;
67679 +extern atomic_unchecked_t nr_find_usage_forwards_recursions;
67680 +extern atomic_unchecked_t nr_find_usage_backwards_checks;
67681 +extern atomic_unchecked_t nr_find_usage_backwards_recursions;
67682 +# define debug_atomic_inc(ptr) atomic_inc_unchecked(ptr)
67683 +# define debug_atomic_dec(ptr) atomic_dec_unchecked(ptr)
67684 +# define debug_atomic_read(ptr) atomic_read_unchecked(ptr)
67685 #else
67686 # define debug_atomic_inc(ptr) do { } while (0)
67687 # define debug_atomic_dec(ptr) do { } while (0)
67688 diff -urNp linux-2.6.32.46/kernel/lockdep_proc.c linux-2.6.32.46/kernel/lockdep_proc.c
67689 --- linux-2.6.32.46/kernel/lockdep_proc.c 2011-03-27 14:31:47.000000000 -0400
67690 +++ linux-2.6.32.46/kernel/lockdep_proc.c 2011-04-17 15:56:46.000000000 -0400
67691 @@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
67692
67693 static void print_name(struct seq_file *m, struct lock_class *class)
67694 {
67695 - char str[128];
67696 + char str[KSYM_NAME_LEN];
67697 const char *name = class->name;
67698
67699 if (!name) {
67700 diff -urNp linux-2.6.32.46/kernel/module.c linux-2.6.32.46/kernel/module.c
67701 --- linux-2.6.32.46/kernel/module.c 2011-03-27 14:31:47.000000000 -0400
67702 +++ linux-2.6.32.46/kernel/module.c 2011-04-29 18:52:40.000000000 -0400
67703 @@ -55,6 +55,7 @@
67704 #include <linux/async.h>
67705 #include <linux/percpu.h>
67706 #include <linux/kmemleak.h>
67707 +#include <linux/grsecurity.h>
67708
67709 #define CREATE_TRACE_POINTS
67710 #include <trace/events/module.h>
67711 @@ -89,7 +90,8 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq
67712 static BLOCKING_NOTIFIER_HEAD(module_notify_list);
67713
67714 /* Bounds of module allocation, for speeding __module_address */
67715 -static unsigned long module_addr_min = -1UL, module_addr_max = 0;
67716 +static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
67717 +static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
67718
67719 int register_module_notifier(struct notifier_block * nb)
67720 {
67721 @@ -245,7 +247,7 @@ bool each_symbol(bool (*fn)(const struct
67722 return true;
67723
67724 list_for_each_entry_rcu(mod, &modules, list) {
67725 - struct symsearch arr[] = {
67726 + struct symsearch modarr[] = {
67727 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
67728 NOT_GPL_ONLY, false },
67729 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
67730 @@ -267,7 +269,7 @@ bool each_symbol(bool (*fn)(const struct
67731 #endif
67732 };
67733
67734 - if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
67735 + if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
67736 return true;
67737 }
67738 return false;
67739 @@ -442,7 +444,7 @@ static void *percpu_modalloc(unsigned lo
67740 void *ptr;
67741 int cpu;
67742
67743 - if (align > PAGE_SIZE) {
67744 + if (align-1 >= PAGE_SIZE) {
67745 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
67746 name, align, PAGE_SIZE);
67747 align = PAGE_SIZE;
67748 @@ -1158,7 +1160,7 @@ static const struct kernel_symbol *resol
67749 * /sys/module/foo/sections stuff
67750 * J. Corbet <corbet@lwn.net>
67751 */
67752 -#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS)
67753 +#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
67754
67755 static inline bool sect_empty(const Elf_Shdr *sect)
67756 {
67757 @@ -1545,7 +1547,8 @@ static void free_module(struct module *m
67758 destroy_params(mod->kp, mod->num_kp);
67759
67760 /* This may be NULL, but that's OK */
67761 - module_free(mod, mod->module_init);
67762 + module_free(mod, mod->module_init_rw);
67763 + module_free_exec(mod, mod->module_init_rx);
67764 kfree(mod->args);
67765 if (mod->percpu)
67766 percpu_modfree(mod->percpu);
67767 @@ -1554,10 +1557,12 @@ static void free_module(struct module *m
67768 percpu_modfree(mod->refptr);
67769 #endif
67770 /* Free lock-classes: */
67771 - lockdep_free_key_range(mod->module_core, mod->core_size);
67772 + lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
67773 + lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
67774
67775 /* Finally, free the core (containing the module structure) */
67776 - module_free(mod, mod->module_core);
67777 + module_free_exec(mod, mod->module_core_rx);
67778 + module_free(mod, mod->module_core_rw);
67779
67780 #ifdef CONFIG_MPU
67781 update_protections(current->mm);
67782 @@ -1628,8 +1633,32 @@ static int simplify_symbols(Elf_Shdr *se
67783 unsigned int i, n = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
67784 int ret = 0;
67785 const struct kernel_symbol *ksym;
67786 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
67787 + int is_fs_load = 0;
67788 + int register_filesystem_found = 0;
67789 + char *p;
67790 +
67791 + p = strstr(mod->args, "grsec_modharden_fs");
67792 +
67793 + if (p) {
67794 + char *endptr = p + strlen("grsec_modharden_fs");
67795 + /* copy \0 as well */
67796 + memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
67797 + is_fs_load = 1;
67798 + }
67799 +#endif
67800 +
67801
67802 for (i = 1; i < n; i++) {
67803 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
67804 + const char *name = strtab + sym[i].st_name;
67805 +
67806 + /* it's a real shame this will never get ripped and copied
67807 + upstream! ;(
67808 + */
67809 + if (is_fs_load && !strcmp(name, "register_filesystem"))
67810 + register_filesystem_found = 1;
67811 +#endif
67812 switch (sym[i].st_shndx) {
67813 case SHN_COMMON:
67814 /* We compiled with -fno-common. These are not
67815 @@ -1651,7 +1680,9 @@ static int simplify_symbols(Elf_Shdr *se
67816 strtab + sym[i].st_name, mod);
67817 /* Ok if resolved. */
67818 if (ksym) {
67819 + pax_open_kernel();
67820 sym[i].st_value = ksym->value;
67821 + pax_close_kernel();
67822 break;
67823 }
67824
67825 @@ -1670,11 +1701,20 @@ static int simplify_symbols(Elf_Shdr *se
67826 secbase = (unsigned long)mod->percpu;
67827 else
67828 secbase = sechdrs[sym[i].st_shndx].sh_addr;
67829 + pax_open_kernel();
67830 sym[i].st_value += secbase;
67831 + pax_close_kernel();
67832 break;
67833 }
67834 }
67835
67836 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
67837 + if (is_fs_load && !register_filesystem_found) {
67838 + printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
67839 + ret = -EPERM;
67840 + }
67841 +#endif
67842 +
67843 return ret;
67844 }
67845
67846 @@ -1731,11 +1771,12 @@ static void layout_sections(struct modul
67847 || s->sh_entsize != ~0UL
67848 || strstarts(secstrings + s->sh_name, ".init"))
67849 continue;
67850 - s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
67851 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
67852 + s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
67853 + else
67854 + s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
67855 DEBUGP("\t%s\n", secstrings + s->sh_name);
67856 }
67857 - if (m == 0)
67858 - mod->core_text_size = mod->core_size;
67859 }
67860
67861 DEBUGP("Init section allocation order:\n");
67862 @@ -1748,12 +1789,13 @@ static void layout_sections(struct modul
67863 || s->sh_entsize != ~0UL
67864 || !strstarts(secstrings + s->sh_name, ".init"))
67865 continue;
67866 - s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
67867 - | INIT_OFFSET_MASK);
67868 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
67869 + s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
67870 + else
67871 + s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
67872 + s->sh_entsize |= INIT_OFFSET_MASK;
67873 DEBUGP("\t%s\n", secstrings + s->sh_name);
67874 }
67875 - if (m == 0)
67876 - mod->init_text_size = mod->init_size;
67877 }
67878 }
67879
67880 @@ -1857,9 +1899,8 @@ static int is_exported(const char *name,
67881
67882 /* As per nm */
67883 static char elf_type(const Elf_Sym *sym,
67884 - Elf_Shdr *sechdrs,
67885 - const char *secstrings,
67886 - struct module *mod)
67887 + const Elf_Shdr *sechdrs,
67888 + const char *secstrings)
67889 {
67890 if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
67891 if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
67892 @@ -1934,7 +1975,7 @@ static unsigned long layout_symtab(struc
67893
67894 /* Put symbol section at end of init part of module. */
67895 symsect->sh_flags |= SHF_ALLOC;
67896 - symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
67897 + symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
67898 symindex) | INIT_OFFSET_MASK;
67899 DEBUGP("\t%s\n", secstrings + symsect->sh_name);
67900
67901 @@ -1951,19 +1992,19 @@ static unsigned long layout_symtab(struc
67902 }
67903
67904 /* Append room for core symbols at end of core part. */
67905 - symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
67906 - mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
67907 + symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
67908 + mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
67909
67910 /* Put string table section at end of init part of module. */
67911 strsect->sh_flags |= SHF_ALLOC;
67912 - strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
67913 + strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
67914 strindex) | INIT_OFFSET_MASK;
67915 DEBUGP("\t%s\n", secstrings + strsect->sh_name);
67916
67917 /* Append room for core symbols' strings at end of core part. */
67918 - *pstroffs = mod->core_size;
67919 + *pstroffs = mod->core_size_rx;
67920 __set_bit(0, strmap);
67921 - mod->core_size += bitmap_weight(strmap, strsect->sh_size);
67922 + mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
67923
67924 return symoffs;
67925 }
67926 @@ -1987,12 +2028,14 @@ static void add_kallsyms(struct module *
67927 mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
67928 mod->strtab = (void *)sechdrs[strindex].sh_addr;
67929
67930 + pax_open_kernel();
67931 +
67932 /* Set types up while we still have access to sections. */
67933 for (i = 0; i < mod->num_symtab; i++)
67934 mod->symtab[i].st_info
67935 - = elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
67936 + = elf_type(&mod->symtab[i], sechdrs, secstrings);
67937
67938 - mod->core_symtab = dst = mod->module_core + symoffs;
67939 + mod->core_symtab = dst = mod->module_core_rx + symoffs;
67940 src = mod->symtab;
67941 *dst = *src;
67942 for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
67943 @@ -2004,10 +2047,12 @@ static void add_kallsyms(struct module *
67944 }
67945 mod->core_num_syms = ndst;
67946
67947 - mod->core_strtab = s = mod->module_core + stroffs;
67948 + mod->core_strtab = s = mod->module_core_rx + stroffs;
67949 for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
67950 if (test_bit(i, strmap))
67951 *++s = mod->strtab[i];
67952 +
67953 + pax_close_kernel();
67954 }
67955 #else
67956 static inline unsigned long layout_symtab(struct module *mod,
67957 @@ -2044,16 +2089,30 @@ static void dynamic_debug_setup(struct _
67958 #endif
67959 }
67960
67961 -static void *module_alloc_update_bounds(unsigned long size)
67962 +static void *module_alloc_update_bounds_rw(unsigned long size)
67963 {
67964 void *ret = module_alloc(size);
67965
67966 if (ret) {
67967 /* Update module bounds. */
67968 - if ((unsigned long)ret < module_addr_min)
67969 - module_addr_min = (unsigned long)ret;
67970 - if ((unsigned long)ret + size > module_addr_max)
67971 - module_addr_max = (unsigned long)ret + size;
67972 + if ((unsigned long)ret < module_addr_min_rw)
67973 + module_addr_min_rw = (unsigned long)ret;
67974 + if ((unsigned long)ret + size > module_addr_max_rw)
67975 + module_addr_max_rw = (unsigned long)ret + size;
67976 + }
67977 + return ret;
67978 +}
67979 +
67980 +static void *module_alloc_update_bounds_rx(unsigned long size)
67981 +{
67982 + void *ret = module_alloc_exec(size);
67983 +
67984 + if (ret) {
67985 + /* Update module bounds. */
67986 + if ((unsigned long)ret < module_addr_min_rx)
67987 + module_addr_min_rx = (unsigned long)ret;
67988 + if ((unsigned long)ret + size > module_addr_max_rx)
67989 + module_addr_max_rx = (unsigned long)ret + size;
67990 }
67991 return ret;
67992 }
67993 @@ -2065,8 +2124,8 @@ static void kmemleak_load_module(struct
67994 unsigned int i;
67995
67996 /* only scan the sections containing data */
67997 - kmemleak_scan_area(mod->module_core, (unsigned long)mod -
67998 - (unsigned long)mod->module_core,
67999 + kmemleak_scan_area(mod->module_core_rw, (unsigned long)mod -
68000 + (unsigned long)mod->module_core_rw,
68001 sizeof(struct module), GFP_KERNEL);
68002
68003 for (i = 1; i < hdr->e_shnum; i++) {
68004 @@ -2076,8 +2135,8 @@ static void kmemleak_load_module(struct
68005 && strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) != 0)
68006 continue;
68007
68008 - kmemleak_scan_area(mod->module_core, sechdrs[i].sh_addr -
68009 - (unsigned long)mod->module_core,
68010 + kmemleak_scan_area(mod->module_core_rw, sechdrs[i].sh_addr -
68011 + (unsigned long)mod->module_core_rw,
68012 sechdrs[i].sh_size, GFP_KERNEL);
68013 }
68014 }
68015 @@ -2263,7 +2322,7 @@ static noinline struct module *load_modu
68016 secstrings, &stroffs, strmap);
68017
68018 /* Do the allocs. */
68019 - ptr = module_alloc_update_bounds(mod->core_size);
68020 + ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
68021 /*
68022 * The pointer to this block is stored in the module structure
68023 * which is inside the block. Just mark it as not being a
68024 @@ -2274,23 +2333,47 @@ static noinline struct module *load_modu
68025 err = -ENOMEM;
68026 goto free_percpu;
68027 }
68028 - memset(ptr, 0, mod->core_size);
68029 - mod->module_core = ptr;
68030 + memset(ptr, 0, mod->core_size_rw);
68031 + mod->module_core_rw = ptr;
68032
68033 - ptr = module_alloc_update_bounds(mod->init_size);
68034 + ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
68035 /*
68036 * The pointer to this block is stored in the module structure
68037 * which is inside the block. This block doesn't need to be
68038 * scanned as it contains data and code that will be freed
68039 * after the module is initialized.
68040 */
68041 - kmemleak_ignore(ptr);
68042 - if (!ptr && mod->init_size) {
68043 + kmemleak_not_leak(ptr);
68044 + if (!ptr && mod->init_size_rw) {
68045 + err = -ENOMEM;
68046 + goto free_core_rw;
68047 + }
68048 + memset(ptr, 0, mod->init_size_rw);
68049 + mod->module_init_rw = ptr;
68050 +
68051 + ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
68052 + kmemleak_not_leak(ptr);
68053 + if (!ptr) {
68054 err = -ENOMEM;
68055 - goto free_core;
68056 + goto free_init_rw;
68057 }
68058 - memset(ptr, 0, mod->init_size);
68059 - mod->module_init = ptr;
68060 +
68061 + pax_open_kernel();
68062 + memset(ptr, 0, mod->core_size_rx);
68063 + pax_close_kernel();
68064 + mod->module_core_rx = ptr;
68065 +
68066 + ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
68067 + kmemleak_not_leak(ptr);
68068 + if (!ptr && mod->init_size_rx) {
68069 + err = -ENOMEM;
68070 + goto free_core_rx;
68071 + }
68072 +
68073 + pax_open_kernel();
68074 + memset(ptr, 0, mod->init_size_rx);
68075 + pax_close_kernel();
68076 + mod->module_init_rx = ptr;
68077
68078 /* Transfer each section which specifies SHF_ALLOC */
68079 DEBUGP("final section addresses:\n");
68080 @@ -2300,17 +2383,45 @@ static noinline struct module *load_modu
68081 if (!(sechdrs[i].sh_flags & SHF_ALLOC))
68082 continue;
68083
68084 - if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
68085 - dest = mod->module_init
68086 - + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
68087 - else
68088 - dest = mod->module_core + sechdrs[i].sh_entsize;
68089 + if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
68090 + if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
68091 + dest = mod->module_init_rw
68092 + + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
68093 + else
68094 + dest = mod->module_init_rx
68095 + + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
68096 + } else {
68097 + if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
68098 + dest = mod->module_core_rw + sechdrs[i].sh_entsize;
68099 + else
68100 + dest = mod->module_core_rx + sechdrs[i].sh_entsize;
68101 + }
68102 +
68103 + if (sechdrs[i].sh_type != SHT_NOBITS) {
68104
68105 - if (sechdrs[i].sh_type != SHT_NOBITS)
68106 - memcpy(dest, (void *)sechdrs[i].sh_addr,
68107 - sechdrs[i].sh_size);
68108 +#ifdef CONFIG_PAX_KERNEXEC
68109 +#ifdef CONFIG_X86_64
68110 + if ((sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_EXECINSTR))
68111 + set_memory_x((unsigned long)dest, (sechdrs[i].sh_size + PAGE_SIZE) >> PAGE_SHIFT);
68112 +#endif
68113 + if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
68114 + pax_open_kernel();
68115 + memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
68116 + pax_close_kernel();
68117 + } else
68118 +#endif
68119 +
68120 + memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
68121 + }
68122 /* Update sh_addr to point to copy in image. */
68123 - sechdrs[i].sh_addr = (unsigned long)dest;
68124 +
68125 +#ifdef CONFIG_PAX_KERNEXEC
68126 + if (sechdrs[i].sh_flags & SHF_EXECINSTR)
68127 + sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
68128 + else
68129 +#endif
68130 +
68131 + sechdrs[i].sh_addr = (unsigned long)dest;
68132 DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
68133 }
68134 /* Module has been moved. */
68135 @@ -2322,7 +2433,7 @@ static noinline struct module *load_modu
68136 mod->name);
68137 if (!mod->refptr) {
68138 err = -ENOMEM;
68139 - goto free_init;
68140 + goto free_init_rx;
68141 }
68142 #endif
68143 /* Now we've moved module, initialize linked lists, etc. */
68144 @@ -2351,6 +2462,31 @@ static noinline struct module *load_modu
68145 /* Set up MODINFO_ATTR fields */
68146 setup_modinfo(mod, sechdrs, infoindex);
68147
68148 + mod->args = args;
68149 +
68150 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
68151 + {
68152 + char *p, *p2;
68153 +
68154 + if (strstr(mod->args, "grsec_modharden_netdev")) {
68155 + printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
68156 + err = -EPERM;
68157 + goto cleanup;
68158 + } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
68159 + p += strlen("grsec_modharden_normal");
68160 + p2 = strstr(p, "_");
68161 + if (p2) {
68162 + *p2 = '\0';
68163 + printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
68164 + *p2 = '_';
68165 + }
68166 + err = -EPERM;
68167 + goto cleanup;
68168 + }
68169 + }
68170 +#endif
68171 +
68172 +
68173 /* Fix up syms, so that st_value is a pointer to location. */
68174 err = simplify_symbols(sechdrs, symindex, strtab, versindex, pcpuindex,
68175 mod);
68176 @@ -2431,8 +2567,8 @@ static noinline struct module *load_modu
68177
68178 /* Now do relocations. */
68179 for (i = 1; i < hdr->e_shnum; i++) {
68180 - const char *strtab = (char *)sechdrs[strindex].sh_addr;
68181 unsigned int info = sechdrs[i].sh_info;
68182 + strtab = (char *)sechdrs[strindex].sh_addr;
68183
68184 /* Not a valid relocation section? */
68185 if (info >= hdr->e_shnum)
68186 @@ -2493,16 +2629,15 @@ static noinline struct module *load_modu
68187 * Do it before processing of module parameters, so the module
68188 * can provide parameter accessor functions of its own.
68189 */
68190 - if (mod->module_init)
68191 - flush_icache_range((unsigned long)mod->module_init,
68192 - (unsigned long)mod->module_init
68193 - + mod->init_size);
68194 - flush_icache_range((unsigned long)mod->module_core,
68195 - (unsigned long)mod->module_core + mod->core_size);
68196 + if (mod->module_init_rx)
68197 + flush_icache_range((unsigned long)mod->module_init_rx,
68198 + (unsigned long)mod->module_init_rx
68199 + + mod->init_size_rx);
68200 + flush_icache_range((unsigned long)mod->module_core_rx,
68201 + (unsigned long)mod->module_core_rx + mod->core_size_rx);
68202
68203 set_fs(old_fs);
68204
68205 - mod->args = args;
68206 if (section_addr(hdr, sechdrs, secstrings, "__obsparm"))
68207 printk(KERN_WARNING "%s: Ignoring obsolete parameters\n",
68208 mod->name);
68209 @@ -2546,12 +2681,16 @@ static noinline struct module *load_modu
68210 free_unload:
68211 module_unload_free(mod);
68212 #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
68213 + free_init_rx:
68214 percpu_modfree(mod->refptr);
68215 - free_init:
68216 #endif
68217 - module_free(mod, mod->module_init);
68218 - free_core:
68219 - module_free(mod, mod->module_core);
68220 + module_free_exec(mod, mod->module_init_rx);
68221 + free_core_rx:
68222 + module_free_exec(mod, mod->module_core_rx);
68223 + free_init_rw:
68224 + module_free(mod, mod->module_init_rw);
68225 + free_core_rw:
68226 + module_free(mod, mod->module_core_rw);
68227 /* mod will be freed with core. Don't access it beyond this line! */
68228 free_percpu:
68229 if (percpu)
68230 @@ -2653,10 +2792,12 @@ SYSCALL_DEFINE3(init_module, void __user
68231 mod->symtab = mod->core_symtab;
68232 mod->strtab = mod->core_strtab;
68233 #endif
68234 - module_free(mod, mod->module_init);
68235 - mod->module_init = NULL;
68236 - mod->init_size = 0;
68237 - mod->init_text_size = 0;
68238 + module_free(mod, mod->module_init_rw);
68239 + module_free_exec(mod, mod->module_init_rx);
68240 + mod->module_init_rw = NULL;
68241 + mod->module_init_rx = NULL;
68242 + mod->init_size_rw = 0;
68243 + mod->init_size_rx = 0;
68244 mutex_unlock(&module_mutex);
68245
68246 return 0;
68247 @@ -2687,10 +2828,16 @@ static const char *get_ksymbol(struct mo
68248 unsigned long nextval;
68249
68250 /* At worse, next value is at end of module */
68251 - if (within_module_init(addr, mod))
68252 - nextval = (unsigned long)mod->module_init+mod->init_text_size;
68253 + if (within_module_init_rx(addr, mod))
68254 + nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
68255 + else if (within_module_init_rw(addr, mod))
68256 + nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
68257 + else if (within_module_core_rx(addr, mod))
68258 + nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
68259 + else if (within_module_core_rw(addr, mod))
68260 + nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
68261 else
68262 - nextval = (unsigned long)mod->module_core+mod->core_text_size;
68263 + return NULL;
68264
68265 /* Scan for closest preceeding symbol, and next symbol. (ELF
68266 starts real symbols at 1). */
68267 @@ -2936,7 +3083,7 @@ static int m_show(struct seq_file *m, vo
68268 char buf[8];
68269
68270 seq_printf(m, "%s %u",
68271 - mod->name, mod->init_size + mod->core_size);
68272 + mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
68273 print_unload_info(m, mod);
68274
68275 /* Informative for users. */
68276 @@ -2945,7 +3092,7 @@ static int m_show(struct seq_file *m, vo
68277 mod->state == MODULE_STATE_COMING ? "Loading":
68278 "Live");
68279 /* Used by oprofile and other similar tools. */
68280 - seq_printf(m, " 0x%p", mod->module_core);
68281 + seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
68282
68283 /* Taints info */
68284 if (mod->taints)
68285 @@ -2981,7 +3128,17 @@ static const struct file_operations proc
68286
68287 static int __init proc_modules_init(void)
68288 {
68289 +#ifndef CONFIG_GRKERNSEC_HIDESYM
68290 +#ifdef CONFIG_GRKERNSEC_PROC_USER
68291 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
68292 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
68293 + proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
68294 +#else
68295 proc_create("modules", 0, NULL, &proc_modules_operations);
68296 +#endif
68297 +#else
68298 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
68299 +#endif
68300 return 0;
68301 }
68302 module_init(proc_modules_init);
68303 @@ -3040,12 +3197,12 @@ struct module *__module_address(unsigned
68304 {
68305 struct module *mod;
68306
68307 - if (addr < module_addr_min || addr > module_addr_max)
68308 + if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
68309 + (addr < module_addr_min_rw || addr > module_addr_max_rw))
68310 return NULL;
68311
68312 list_for_each_entry_rcu(mod, &modules, list)
68313 - if (within_module_core(addr, mod)
68314 - || within_module_init(addr, mod))
68315 + if (within_module_init(addr, mod) || within_module_core(addr, mod))
68316 return mod;
68317 return NULL;
68318 }
68319 @@ -3079,11 +3236,20 @@ bool is_module_text_address(unsigned lon
68320 */
68321 struct module *__module_text_address(unsigned long addr)
68322 {
68323 - struct module *mod = __module_address(addr);
68324 + struct module *mod;
68325 +
68326 +#ifdef CONFIG_X86_32
68327 + addr = ktla_ktva(addr);
68328 +#endif
68329 +
68330 + if (addr < module_addr_min_rx || addr > module_addr_max_rx)
68331 + return NULL;
68332 +
68333 + mod = __module_address(addr);
68334 +
68335 if (mod) {
68336 /* Make sure it's within the text section. */
68337 - if (!within(addr, mod->module_init, mod->init_text_size)
68338 - && !within(addr, mod->module_core, mod->core_text_size))
68339 + if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
68340 mod = NULL;
68341 }
68342 return mod;
68343 diff -urNp linux-2.6.32.46/kernel/mutex.c linux-2.6.32.46/kernel/mutex.c
68344 --- linux-2.6.32.46/kernel/mutex.c 2011-03-27 14:31:47.000000000 -0400
68345 +++ linux-2.6.32.46/kernel/mutex.c 2011-04-17 15:56:46.000000000 -0400
68346 @@ -169,7 +169,7 @@ __mutex_lock_common(struct mutex *lock,
68347 */
68348
68349 for (;;) {
68350 - struct thread_info *owner;
68351 + struct task_struct *owner;
68352
68353 /*
68354 * If we own the BKL, then don't spin. The owner of
68355 @@ -214,7 +214,7 @@ __mutex_lock_common(struct mutex *lock,
68356 spin_lock_mutex(&lock->wait_lock, flags);
68357
68358 debug_mutex_lock_common(lock, &waiter);
68359 - debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
68360 + debug_mutex_add_waiter(lock, &waiter, task);
68361
68362 /* add waiting tasks to the end of the waitqueue (FIFO): */
68363 list_add_tail(&waiter.list, &lock->wait_list);
68364 @@ -243,8 +243,7 @@ __mutex_lock_common(struct mutex *lock,
68365 * TASK_UNINTERRUPTIBLE case.)
68366 */
68367 if (unlikely(signal_pending_state(state, task))) {
68368 - mutex_remove_waiter(lock, &waiter,
68369 - task_thread_info(task));
68370 + mutex_remove_waiter(lock, &waiter, task);
68371 mutex_release(&lock->dep_map, 1, ip);
68372 spin_unlock_mutex(&lock->wait_lock, flags);
68373
68374 @@ -265,7 +264,7 @@ __mutex_lock_common(struct mutex *lock,
68375 done:
68376 lock_acquired(&lock->dep_map, ip);
68377 /* got the lock - rejoice! */
68378 - mutex_remove_waiter(lock, &waiter, current_thread_info());
68379 + mutex_remove_waiter(lock, &waiter, task);
68380 mutex_set_owner(lock);
68381
68382 /* set it to 0 if there are no waiters left: */
68383 diff -urNp linux-2.6.32.46/kernel/mutex-debug.c linux-2.6.32.46/kernel/mutex-debug.c
68384 --- linux-2.6.32.46/kernel/mutex-debug.c 2011-03-27 14:31:47.000000000 -0400
68385 +++ linux-2.6.32.46/kernel/mutex-debug.c 2011-04-17 15:56:46.000000000 -0400
68386 @@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mute
68387 }
68388
68389 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68390 - struct thread_info *ti)
68391 + struct task_struct *task)
68392 {
68393 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
68394
68395 /* Mark the current thread as blocked on the lock: */
68396 - ti->task->blocked_on = waiter;
68397 + task->blocked_on = waiter;
68398 }
68399
68400 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68401 - struct thread_info *ti)
68402 + struct task_struct *task)
68403 {
68404 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
68405 - DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
68406 - DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
68407 - ti->task->blocked_on = NULL;
68408 + DEBUG_LOCKS_WARN_ON(waiter->task != task);
68409 + DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
68410 + task->blocked_on = NULL;
68411
68412 list_del_init(&waiter->list);
68413 waiter->task = NULL;
68414 @@ -75,7 +75,7 @@ void debug_mutex_unlock(struct mutex *lo
68415 return;
68416
68417 DEBUG_LOCKS_WARN_ON(lock->magic != lock);
68418 - DEBUG_LOCKS_WARN_ON(lock->owner != current_thread_info());
68419 + DEBUG_LOCKS_WARN_ON(lock->owner != current);
68420 DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
68421 mutex_clear_owner(lock);
68422 }
68423 diff -urNp linux-2.6.32.46/kernel/mutex-debug.h linux-2.6.32.46/kernel/mutex-debug.h
68424 --- linux-2.6.32.46/kernel/mutex-debug.h 2011-03-27 14:31:47.000000000 -0400
68425 +++ linux-2.6.32.46/kernel/mutex-debug.h 2011-04-17 15:56:46.000000000 -0400
68426 @@ -20,16 +20,16 @@ extern void debug_mutex_wake_waiter(stru
68427 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
68428 extern void debug_mutex_add_waiter(struct mutex *lock,
68429 struct mutex_waiter *waiter,
68430 - struct thread_info *ti);
68431 + struct task_struct *task);
68432 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68433 - struct thread_info *ti);
68434 + struct task_struct *task);
68435 extern void debug_mutex_unlock(struct mutex *lock);
68436 extern void debug_mutex_init(struct mutex *lock, const char *name,
68437 struct lock_class_key *key);
68438
68439 static inline void mutex_set_owner(struct mutex *lock)
68440 {
68441 - lock->owner = current_thread_info();
68442 + lock->owner = current;
68443 }
68444
68445 static inline void mutex_clear_owner(struct mutex *lock)
68446 diff -urNp linux-2.6.32.46/kernel/mutex.h linux-2.6.32.46/kernel/mutex.h
68447 --- linux-2.6.32.46/kernel/mutex.h 2011-03-27 14:31:47.000000000 -0400
68448 +++ linux-2.6.32.46/kernel/mutex.h 2011-04-17 15:56:46.000000000 -0400
68449 @@ -19,7 +19,7 @@
68450 #ifdef CONFIG_SMP
68451 static inline void mutex_set_owner(struct mutex *lock)
68452 {
68453 - lock->owner = current_thread_info();
68454 + lock->owner = current;
68455 }
68456
68457 static inline void mutex_clear_owner(struct mutex *lock)
68458 diff -urNp linux-2.6.32.46/kernel/panic.c linux-2.6.32.46/kernel/panic.c
68459 --- linux-2.6.32.46/kernel/panic.c 2011-03-27 14:31:47.000000000 -0400
68460 +++ linux-2.6.32.46/kernel/panic.c 2011-04-17 15:56:46.000000000 -0400
68461 @@ -352,7 +352,7 @@ static void warn_slowpath_common(const c
68462 const char *board;
68463
68464 printk(KERN_WARNING "------------[ cut here ]------------\n");
68465 - printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
68466 + printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
68467 board = dmi_get_system_info(DMI_PRODUCT_NAME);
68468 if (board)
68469 printk(KERN_WARNING "Hardware name: %s\n", board);
68470 @@ -392,7 +392,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
68471 */
68472 void __stack_chk_fail(void)
68473 {
68474 - panic("stack-protector: Kernel stack is corrupted in: %p\n",
68475 + dump_stack();
68476 + panic("stack-protector: Kernel stack is corrupted in: %pA\n",
68477 __builtin_return_address(0));
68478 }
68479 EXPORT_SYMBOL(__stack_chk_fail);
68480 diff -urNp linux-2.6.32.46/kernel/params.c linux-2.6.32.46/kernel/params.c
68481 --- linux-2.6.32.46/kernel/params.c 2011-03-27 14:31:47.000000000 -0400
68482 +++ linux-2.6.32.46/kernel/params.c 2011-04-17 15:56:46.000000000 -0400
68483 @@ -725,7 +725,7 @@ static ssize_t module_attr_store(struct
68484 return ret;
68485 }
68486
68487 -static struct sysfs_ops module_sysfs_ops = {
68488 +static const struct sysfs_ops module_sysfs_ops = {
68489 .show = module_attr_show,
68490 .store = module_attr_store,
68491 };
68492 @@ -739,7 +739,7 @@ static int uevent_filter(struct kset *ks
68493 return 0;
68494 }
68495
68496 -static struct kset_uevent_ops module_uevent_ops = {
68497 +static const struct kset_uevent_ops module_uevent_ops = {
68498 .filter = uevent_filter,
68499 };
68500
68501 diff -urNp linux-2.6.32.46/kernel/perf_event.c linux-2.6.32.46/kernel/perf_event.c
68502 --- linux-2.6.32.46/kernel/perf_event.c 2011-08-09 18:35:30.000000000 -0400
68503 +++ linux-2.6.32.46/kernel/perf_event.c 2011-10-06 09:37:14.000000000 -0400
68504 @@ -77,7 +77,7 @@ int sysctl_perf_event_mlock __read_mostl
68505 */
68506 int sysctl_perf_event_sample_rate __read_mostly = 100000;
68507
68508 -static atomic64_t perf_event_id;
68509 +static atomic64_unchecked_t perf_event_id;
68510
68511 /*
68512 * Lock for (sysadmin-configurable) event reservations:
68513 @@ -1094,9 +1094,9 @@ static void __perf_event_sync_stat(struc
68514 * In order to keep per-task stats reliable we need to flip the event
68515 * values when we flip the contexts.
68516 */
68517 - value = atomic64_read(&next_event->count);
68518 - value = atomic64_xchg(&event->count, value);
68519 - atomic64_set(&next_event->count, value);
68520 + value = atomic64_read_unchecked(&next_event->count);
68521 + value = atomic64_xchg_unchecked(&event->count, value);
68522 + atomic64_set_unchecked(&next_event->count, value);
68523
68524 swap(event->total_time_enabled, next_event->total_time_enabled);
68525 swap(event->total_time_running, next_event->total_time_running);
68526 @@ -1552,7 +1552,7 @@ static u64 perf_event_read(struct perf_e
68527 update_event_times(event);
68528 }
68529
68530 - return atomic64_read(&event->count);
68531 + return atomic64_read_unchecked(&event->count);
68532 }
68533
68534 /*
68535 @@ -1790,11 +1790,11 @@ static int perf_event_read_group(struct
68536 values[n++] = 1 + leader->nr_siblings;
68537 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
68538 values[n++] = leader->total_time_enabled +
68539 - atomic64_read(&leader->child_total_time_enabled);
68540 + atomic64_read_unchecked(&leader->child_total_time_enabled);
68541 }
68542 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
68543 values[n++] = leader->total_time_running +
68544 - atomic64_read(&leader->child_total_time_running);
68545 + atomic64_read_unchecked(&leader->child_total_time_running);
68546 }
68547
68548 size = n * sizeof(u64);
68549 @@ -1829,11 +1829,11 @@ static int perf_event_read_one(struct pe
68550 values[n++] = perf_event_read_value(event);
68551 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
68552 values[n++] = event->total_time_enabled +
68553 - atomic64_read(&event->child_total_time_enabled);
68554 + atomic64_read_unchecked(&event->child_total_time_enabled);
68555 }
68556 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
68557 values[n++] = event->total_time_running +
68558 - atomic64_read(&event->child_total_time_running);
68559 + atomic64_read_unchecked(&event->child_total_time_running);
68560 }
68561 if (read_format & PERF_FORMAT_ID)
68562 values[n++] = primary_event_id(event);
68563 @@ -1903,7 +1903,7 @@ static unsigned int perf_poll(struct fil
68564 static void perf_event_reset(struct perf_event *event)
68565 {
68566 (void)perf_event_read(event);
68567 - atomic64_set(&event->count, 0);
68568 + atomic64_set_unchecked(&event->count, 0);
68569 perf_event_update_userpage(event);
68570 }
68571
68572 @@ -2079,15 +2079,15 @@ void perf_event_update_userpage(struct p
68573 ++userpg->lock;
68574 barrier();
68575 userpg->index = perf_event_index(event);
68576 - userpg->offset = atomic64_read(&event->count);
68577 + userpg->offset = atomic64_read_unchecked(&event->count);
68578 if (event->state == PERF_EVENT_STATE_ACTIVE)
68579 - userpg->offset -= atomic64_read(&event->hw.prev_count);
68580 + userpg->offset -= atomic64_read_unchecked(&event->hw.prev_count);
68581
68582 userpg->time_enabled = event->total_time_enabled +
68583 - atomic64_read(&event->child_total_time_enabled);
68584 + atomic64_read_unchecked(&event->child_total_time_enabled);
68585
68586 userpg->time_running = event->total_time_running +
68587 - atomic64_read(&event->child_total_time_running);
68588 + atomic64_read_unchecked(&event->child_total_time_running);
68589
68590 barrier();
68591 ++userpg->lock;
68592 @@ -2903,14 +2903,14 @@ static void perf_output_read_one(struct
68593 u64 values[4];
68594 int n = 0;
68595
68596 - values[n++] = atomic64_read(&event->count);
68597 + values[n++] = atomic64_read_unchecked(&event->count);
68598 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
68599 values[n++] = event->total_time_enabled +
68600 - atomic64_read(&event->child_total_time_enabled);
68601 + atomic64_read_unchecked(&event->child_total_time_enabled);
68602 }
68603 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
68604 values[n++] = event->total_time_running +
68605 - atomic64_read(&event->child_total_time_running);
68606 + atomic64_read_unchecked(&event->child_total_time_running);
68607 }
68608 if (read_format & PERF_FORMAT_ID)
68609 values[n++] = primary_event_id(event);
68610 @@ -2940,7 +2940,7 @@ static void perf_output_read_group(struc
68611 if (leader != event)
68612 leader->pmu->read(leader);
68613
68614 - values[n++] = atomic64_read(&leader->count);
68615 + values[n++] = atomic64_read_unchecked(&leader->count);
68616 if (read_format & PERF_FORMAT_ID)
68617 values[n++] = primary_event_id(leader);
68618
68619 @@ -2952,7 +2952,7 @@ static void perf_output_read_group(struc
68620 if (sub != event)
68621 sub->pmu->read(sub);
68622
68623 - values[n++] = atomic64_read(&sub->count);
68624 + values[n++] = atomic64_read_unchecked(&sub->count);
68625 if (read_format & PERF_FORMAT_ID)
68626 values[n++] = primary_event_id(sub);
68627
68628 @@ -3525,12 +3525,12 @@ static void perf_event_mmap_event(struct
68629 * need to add enough zero bytes after the string to handle
68630 * the 64bit alignment we do later.
68631 */
68632 - buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL);
68633 + buf = kzalloc(PATH_MAX, GFP_KERNEL);
68634 if (!buf) {
68635 name = strncpy(tmp, "//enomem", sizeof(tmp));
68636 goto got_name;
68637 }
68638 - name = d_path(&file->f_path, buf, PATH_MAX);
68639 + name = d_path(&file->f_path, buf, PATH_MAX - sizeof(u64));
68640 if (IS_ERR(name)) {
68641 name = strncpy(tmp, "//toolong", sizeof(tmp));
68642 goto got_name;
68643 @@ -3783,7 +3783,7 @@ static void perf_swevent_add(struct perf
68644 {
68645 struct hw_perf_event *hwc = &event->hw;
68646
68647 - atomic64_add(nr, &event->count);
68648 + atomic64_add_unchecked(nr, &event->count);
68649
68650 if (!hwc->sample_period)
68651 return;
68652 @@ -4040,9 +4040,9 @@ static void cpu_clock_perf_event_update(
68653 u64 now;
68654
68655 now = cpu_clock(cpu);
68656 - prev = atomic64_read(&event->hw.prev_count);
68657 - atomic64_set(&event->hw.prev_count, now);
68658 - atomic64_add(now - prev, &event->count);
68659 + prev = atomic64_read_unchecked(&event->hw.prev_count);
68660 + atomic64_set_unchecked(&event->hw.prev_count, now);
68661 + atomic64_add_unchecked(now - prev, &event->count);
68662 }
68663
68664 static int cpu_clock_perf_event_enable(struct perf_event *event)
68665 @@ -4050,7 +4050,7 @@ static int cpu_clock_perf_event_enable(s
68666 struct hw_perf_event *hwc = &event->hw;
68667 int cpu = raw_smp_processor_id();
68668
68669 - atomic64_set(&hwc->prev_count, cpu_clock(cpu));
68670 + atomic64_set_unchecked(&hwc->prev_count, cpu_clock(cpu));
68671 perf_swevent_start_hrtimer(event);
68672
68673 return 0;
68674 @@ -4082,9 +4082,9 @@ static void task_clock_perf_event_update
68675 u64 prev;
68676 s64 delta;
68677
68678 - prev = atomic64_xchg(&event->hw.prev_count, now);
68679 + prev = atomic64_xchg_unchecked(&event->hw.prev_count, now);
68680 delta = now - prev;
68681 - atomic64_add(delta, &event->count);
68682 + atomic64_add_unchecked(delta, &event->count);
68683 }
68684
68685 static int task_clock_perf_event_enable(struct perf_event *event)
68686 @@ -4094,7 +4094,7 @@ static int task_clock_perf_event_enable(
68687
68688 now = event->ctx->time;
68689
68690 - atomic64_set(&hwc->prev_count, now);
68691 + atomic64_set_unchecked(&hwc->prev_count, now);
68692
68693 perf_swevent_start_hrtimer(event);
68694
68695 @@ -4289,7 +4289,7 @@ perf_event_alloc(struct perf_event_attr
68696 event->parent = parent_event;
68697
68698 event->ns = get_pid_ns(current->nsproxy->pid_ns);
68699 - event->id = atomic64_inc_return(&perf_event_id);
68700 + event->id = atomic64_inc_return_unchecked(&perf_event_id);
68701
68702 event->state = PERF_EVENT_STATE_INACTIVE;
68703
68704 @@ -4720,15 +4720,15 @@ static void sync_child_event(struct perf
68705 if (child_event->attr.inherit_stat)
68706 perf_event_read_event(child_event, child);
68707
68708 - child_val = atomic64_read(&child_event->count);
68709 + child_val = atomic64_read_unchecked(&child_event->count);
68710
68711 /*
68712 * Add back the child's count to the parent's count:
68713 */
68714 - atomic64_add(child_val, &parent_event->count);
68715 - atomic64_add(child_event->total_time_enabled,
68716 + atomic64_add_unchecked(child_val, &parent_event->count);
68717 + atomic64_add_unchecked(child_event->total_time_enabled,
68718 &parent_event->child_total_time_enabled);
68719 - atomic64_add(child_event->total_time_running,
68720 + atomic64_add_unchecked(child_event->total_time_running,
68721 &parent_event->child_total_time_running);
68722
68723 /*
68724 diff -urNp linux-2.6.32.46/kernel/pid.c linux-2.6.32.46/kernel/pid.c
68725 --- linux-2.6.32.46/kernel/pid.c 2011-04-22 19:16:29.000000000 -0400
68726 +++ linux-2.6.32.46/kernel/pid.c 2011-08-21 19:11:29.000000000 -0400
68727 @@ -33,6 +33,7 @@
68728 #include <linux/rculist.h>
68729 #include <linux/bootmem.h>
68730 #include <linux/hash.h>
68731 +#include <linux/security.h>
68732 #include <linux/pid_namespace.h>
68733 #include <linux/init_task.h>
68734 #include <linux/syscalls.h>
68735 @@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
68736
68737 int pid_max = PID_MAX_DEFAULT;
68738
68739 -#define RESERVED_PIDS 300
68740 +#define RESERVED_PIDS 500
68741
68742 int pid_max_min = RESERVED_PIDS + 1;
68743 int pid_max_max = PID_MAX_LIMIT;
68744 @@ -383,7 +384,14 @@ EXPORT_SYMBOL(pid_task);
68745 */
68746 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
68747 {
68748 - return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
68749 + struct task_struct *task;
68750 +
68751 + task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
68752 +
68753 + if (gr_pid_is_chrooted(task))
68754 + return NULL;
68755 +
68756 + return task;
68757 }
68758
68759 struct task_struct *find_task_by_vpid(pid_t vnr)
68760 @@ -391,6 +399,11 @@ struct task_struct *find_task_by_vpid(pi
68761 return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
68762 }
68763
68764 +struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
68765 +{
68766 + return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
68767 +}
68768 +
68769 struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
68770 {
68771 struct pid *pid;
68772 diff -urNp linux-2.6.32.46/kernel/posix-cpu-timers.c linux-2.6.32.46/kernel/posix-cpu-timers.c
68773 --- linux-2.6.32.46/kernel/posix-cpu-timers.c 2011-03-27 14:31:47.000000000 -0400
68774 +++ linux-2.6.32.46/kernel/posix-cpu-timers.c 2011-08-06 09:33:44.000000000 -0400
68775 @@ -6,6 +6,7 @@
68776 #include <linux/posix-timers.h>
68777 #include <linux/errno.h>
68778 #include <linux/math64.h>
68779 +#include <linux/security.h>
68780 #include <asm/uaccess.h>
68781 #include <linux/kernel_stat.h>
68782 #include <trace/events/timer.h>
68783 @@ -1697,7 +1698,7 @@ static long thread_cpu_nsleep_restart(st
68784
68785 static __init int init_posix_cpu_timers(void)
68786 {
68787 - struct k_clock process = {
68788 + static struct k_clock process = {
68789 .clock_getres = process_cpu_clock_getres,
68790 .clock_get = process_cpu_clock_get,
68791 .clock_set = do_posix_clock_nosettime,
68792 @@ -1705,7 +1706,7 @@ static __init int init_posix_cpu_timers(
68793 .nsleep = process_cpu_nsleep,
68794 .nsleep_restart = process_cpu_nsleep_restart,
68795 };
68796 - struct k_clock thread = {
68797 + static struct k_clock thread = {
68798 .clock_getres = thread_cpu_clock_getres,
68799 .clock_get = thread_cpu_clock_get,
68800 .clock_set = do_posix_clock_nosettime,
68801 diff -urNp linux-2.6.32.46/kernel/posix-timers.c linux-2.6.32.46/kernel/posix-timers.c
68802 --- linux-2.6.32.46/kernel/posix-timers.c 2011-03-27 14:31:47.000000000 -0400
68803 +++ linux-2.6.32.46/kernel/posix-timers.c 2011-08-23 20:22:38.000000000 -0400
68804 @@ -42,6 +42,7 @@
68805 #include <linux/compiler.h>
68806 #include <linux/idr.h>
68807 #include <linux/posix-timers.h>
68808 +#include <linux/grsecurity.h>
68809 #include <linux/syscalls.h>
68810 #include <linux/wait.h>
68811 #include <linux/workqueue.h>
68812 @@ -131,7 +132,7 @@ static DEFINE_SPINLOCK(idr_lock);
68813 * which we beg off on and pass to do_sys_settimeofday().
68814 */
68815
68816 -static struct k_clock posix_clocks[MAX_CLOCKS];
68817 +static struct k_clock *posix_clocks[MAX_CLOCKS];
68818
68819 /*
68820 * These ones are defined below.
68821 @@ -157,8 +158,8 @@ static inline void unlock_timer(struct k
68822 */
68823 #define CLOCK_DISPATCH(clock, call, arglist) \
68824 ((clock) < 0 ? posix_cpu_##call arglist : \
68825 - (posix_clocks[clock].call != NULL \
68826 - ? (*posix_clocks[clock].call) arglist : common_##call arglist))
68827 + (posix_clocks[clock]->call != NULL \
68828 + ? (*posix_clocks[clock]->call) arglist : common_##call arglist))
68829
68830 /*
68831 * Default clock hook functions when the struct k_clock passed
68832 @@ -172,7 +173,7 @@ static inline int common_clock_getres(co
68833 struct timespec *tp)
68834 {
68835 tp->tv_sec = 0;
68836 - tp->tv_nsec = posix_clocks[which_clock].res;
68837 + tp->tv_nsec = posix_clocks[which_clock]->res;
68838 return 0;
68839 }
68840
68841 @@ -217,9 +218,11 @@ static inline int invalid_clockid(const
68842 return 0;
68843 if ((unsigned) which_clock >= MAX_CLOCKS)
68844 return 1;
68845 - if (posix_clocks[which_clock].clock_getres != NULL)
68846 + if (posix_clocks[which_clock] == NULL)
68847 return 0;
68848 - if (posix_clocks[which_clock].res != 0)
68849 + if (posix_clocks[which_clock]->clock_getres != NULL)
68850 + return 0;
68851 + if (posix_clocks[which_clock]->res != 0)
68852 return 0;
68853 return 1;
68854 }
68855 @@ -266,29 +269,29 @@ int posix_get_coarse_res(const clockid_t
68856 */
68857 static __init int init_posix_timers(void)
68858 {
68859 - struct k_clock clock_realtime = {
68860 + static struct k_clock clock_realtime = {
68861 .clock_getres = hrtimer_get_res,
68862 };
68863 - struct k_clock clock_monotonic = {
68864 + static struct k_clock clock_monotonic = {
68865 .clock_getres = hrtimer_get_res,
68866 .clock_get = posix_ktime_get_ts,
68867 .clock_set = do_posix_clock_nosettime,
68868 };
68869 - struct k_clock clock_monotonic_raw = {
68870 + static struct k_clock clock_monotonic_raw = {
68871 .clock_getres = hrtimer_get_res,
68872 .clock_get = posix_get_monotonic_raw,
68873 .clock_set = do_posix_clock_nosettime,
68874 .timer_create = no_timer_create,
68875 .nsleep = no_nsleep,
68876 };
68877 - struct k_clock clock_realtime_coarse = {
68878 + static struct k_clock clock_realtime_coarse = {
68879 .clock_getres = posix_get_coarse_res,
68880 .clock_get = posix_get_realtime_coarse,
68881 .clock_set = do_posix_clock_nosettime,
68882 .timer_create = no_timer_create,
68883 .nsleep = no_nsleep,
68884 };
68885 - struct k_clock clock_monotonic_coarse = {
68886 + static struct k_clock clock_monotonic_coarse = {
68887 .clock_getres = posix_get_coarse_res,
68888 .clock_get = posix_get_monotonic_coarse,
68889 .clock_set = do_posix_clock_nosettime,
68890 @@ -296,6 +299,8 @@ static __init int init_posix_timers(void
68891 .nsleep = no_nsleep,
68892 };
68893
68894 + pax_track_stack();
68895 +
68896 register_posix_clock(CLOCK_REALTIME, &clock_realtime);
68897 register_posix_clock(CLOCK_MONOTONIC, &clock_monotonic);
68898 register_posix_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
68899 @@ -484,7 +489,7 @@ void register_posix_clock(const clockid_
68900 return;
68901 }
68902
68903 - posix_clocks[clock_id] = *new_clock;
68904 + posix_clocks[clock_id] = new_clock;
68905 }
68906 EXPORT_SYMBOL_GPL(register_posix_clock);
68907
68908 @@ -948,6 +953,13 @@ SYSCALL_DEFINE2(clock_settime, const clo
68909 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
68910 return -EFAULT;
68911
68912 + /* only the CLOCK_REALTIME clock can be set, all other clocks
68913 + have their clock_set fptr set to a nosettime dummy function
68914 + CLOCK_REALTIME has a NULL clock_set fptr which causes it to
68915 + call common_clock_set, which calls do_sys_settimeofday, which
68916 + we hook
68917 + */
68918 +
68919 return CLOCK_DISPATCH(which_clock, clock_set, (which_clock, &new_tp));
68920 }
68921
68922 diff -urNp linux-2.6.32.46/kernel/power/hibernate.c linux-2.6.32.46/kernel/power/hibernate.c
68923 --- linux-2.6.32.46/kernel/power/hibernate.c 2011-03-27 14:31:47.000000000 -0400
68924 +++ linux-2.6.32.46/kernel/power/hibernate.c 2011-04-17 15:56:46.000000000 -0400
68925 @@ -48,14 +48,14 @@ enum {
68926
68927 static int hibernation_mode = HIBERNATION_SHUTDOWN;
68928
68929 -static struct platform_hibernation_ops *hibernation_ops;
68930 +static const struct platform_hibernation_ops *hibernation_ops;
68931
68932 /**
68933 * hibernation_set_ops - set the global hibernate operations
68934 * @ops: the hibernation operations to use in subsequent hibernation transitions
68935 */
68936
68937 -void hibernation_set_ops(struct platform_hibernation_ops *ops)
68938 +void hibernation_set_ops(const struct platform_hibernation_ops *ops)
68939 {
68940 if (ops && !(ops->begin && ops->end && ops->pre_snapshot
68941 && ops->prepare && ops->finish && ops->enter && ops->pre_restore
68942 diff -urNp linux-2.6.32.46/kernel/power/poweroff.c linux-2.6.32.46/kernel/power/poweroff.c
68943 --- linux-2.6.32.46/kernel/power/poweroff.c 2011-03-27 14:31:47.000000000 -0400
68944 +++ linux-2.6.32.46/kernel/power/poweroff.c 2011-04-17 15:56:46.000000000 -0400
68945 @@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_powerof
68946 .enable_mask = SYSRQ_ENABLE_BOOT,
68947 };
68948
68949 -static int pm_sysrq_init(void)
68950 +static int __init pm_sysrq_init(void)
68951 {
68952 register_sysrq_key('o', &sysrq_poweroff_op);
68953 return 0;
68954 diff -urNp linux-2.6.32.46/kernel/power/process.c linux-2.6.32.46/kernel/power/process.c
68955 --- linux-2.6.32.46/kernel/power/process.c 2011-03-27 14:31:47.000000000 -0400
68956 +++ linux-2.6.32.46/kernel/power/process.c 2011-04-17 15:56:46.000000000 -0400
68957 @@ -37,12 +37,15 @@ static int try_to_freeze_tasks(bool sig_
68958 struct timeval start, end;
68959 u64 elapsed_csecs64;
68960 unsigned int elapsed_csecs;
68961 + bool timedout = false;
68962
68963 do_gettimeofday(&start);
68964
68965 end_time = jiffies + TIMEOUT;
68966 do {
68967 todo = 0;
68968 + if (time_after(jiffies, end_time))
68969 + timedout = true;
68970 read_lock(&tasklist_lock);
68971 do_each_thread(g, p) {
68972 if (frozen(p) || !freezeable(p))
68973 @@ -57,15 +60,17 @@ static int try_to_freeze_tasks(bool sig_
68974 * It is "frozen enough". If the task does wake
68975 * up, it will immediately call try_to_freeze.
68976 */
68977 - if (!task_is_stopped_or_traced(p) &&
68978 - !freezer_should_skip(p))
68979 + if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
68980 todo++;
68981 + if (timedout) {
68982 + printk(KERN_ERR "Task refusing to freeze:\n");
68983 + sched_show_task(p);
68984 + }
68985 + }
68986 } while_each_thread(g, p);
68987 read_unlock(&tasklist_lock);
68988 yield(); /* Yield is okay here */
68989 - if (time_after(jiffies, end_time))
68990 - break;
68991 - } while (todo);
68992 + } while (todo && !timedout);
68993
68994 do_gettimeofday(&end);
68995 elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
68996 diff -urNp linux-2.6.32.46/kernel/power/suspend.c linux-2.6.32.46/kernel/power/suspend.c
68997 --- linux-2.6.32.46/kernel/power/suspend.c 2011-03-27 14:31:47.000000000 -0400
68998 +++ linux-2.6.32.46/kernel/power/suspend.c 2011-04-17 15:56:46.000000000 -0400
68999 @@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_M
69000 [PM_SUSPEND_MEM] = "mem",
69001 };
69002
69003 -static struct platform_suspend_ops *suspend_ops;
69004 +static const struct platform_suspend_ops *suspend_ops;
69005
69006 /**
69007 * suspend_set_ops - Set the global suspend method table.
69008 * @ops: Pointer to ops structure.
69009 */
69010 -void suspend_set_ops(struct platform_suspend_ops *ops)
69011 +void suspend_set_ops(const struct platform_suspend_ops *ops)
69012 {
69013 mutex_lock(&pm_mutex);
69014 suspend_ops = ops;
69015 diff -urNp linux-2.6.32.46/kernel/printk.c linux-2.6.32.46/kernel/printk.c
69016 --- linux-2.6.32.46/kernel/printk.c 2011-03-27 14:31:47.000000000 -0400
69017 +++ linux-2.6.32.46/kernel/printk.c 2011-04-17 15:56:46.000000000 -0400
69018 @@ -278,6 +278,11 @@ int do_syslog(int type, char __user *buf
69019 char c;
69020 int error = 0;
69021
69022 +#ifdef CONFIG_GRKERNSEC_DMESG
69023 + if (grsec_enable_dmesg && !capable(CAP_SYS_ADMIN))
69024 + return -EPERM;
69025 +#endif
69026 +
69027 error = security_syslog(type);
69028 if (error)
69029 return error;
69030 diff -urNp linux-2.6.32.46/kernel/profile.c linux-2.6.32.46/kernel/profile.c
69031 --- linux-2.6.32.46/kernel/profile.c 2011-03-27 14:31:47.000000000 -0400
69032 +++ linux-2.6.32.46/kernel/profile.c 2011-05-04 17:56:28.000000000 -0400
69033 @@ -39,7 +39,7 @@ struct profile_hit {
69034 /* Oprofile timer tick hook */
69035 static int (*timer_hook)(struct pt_regs *) __read_mostly;
69036
69037 -static atomic_t *prof_buffer;
69038 +static atomic_unchecked_t *prof_buffer;
69039 static unsigned long prof_len, prof_shift;
69040
69041 int prof_on __read_mostly;
69042 @@ -283,7 +283,7 @@ static void profile_flip_buffers(void)
69043 hits[i].pc = 0;
69044 continue;
69045 }
69046 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
69047 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
69048 hits[i].hits = hits[i].pc = 0;
69049 }
69050 }
69051 @@ -346,9 +346,9 @@ void profile_hits(int type, void *__pc,
69052 * Add the current hit(s) and flush the write-queue out
69053 * to the global buffer:
69054 */
69055 - atomic_add(nr_hits, &prof_buffer[pc]);
69056 + atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
69057 for (i = 0; i < NR_PROFILE_HIT; ++i) {
69058 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
69059 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
69060 hits[i].pc = hits[i].hits = 0;
69061 }
69062 out:
69063 @@ -426,7 +426,7 @@ void profile_hits(int type, void *__pc,
69064 if (prof_on != type || !prof_buffer)
69065 return;
69066 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
69067 - atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
69068 + atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
69069 }
69070 #endif /* !CONFIG_SMP */
69071 EXPORT_SYMBOL_GPL(profile_hits);
69072 @@ -517,7 +517,7 @@ read_profile(struct file *file, char __u
69073 return -EFAULT;
69074 buf++; p++; count--; read++;
69075 }
69076 - pnt = (char *)prof_buffer + p - sizeof(atomic_t);
69077 + pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
69078 if (copy_to_user(buf, (void *)pnt, count))
69079 return -EFAULT;
69080 read += count;
69081 @@ -548,7 +548,7 @@ static ssize_t write_profile(struct file
69082 }
69083 #endif
69084 profile_discard_flip_buffers();
69085 - memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
69086 + memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
69087 return count;
69088 }
69089
69090 diff -urNp linux-2.6.32.46/kernel/ptrace.c linux-2.6.32.46/kernel/ptrace.c
69091 --- linux-2.6.32.46/kernel/ptrace.c 2011-03-27 14:31:47.000000000 -0400
69092 +++ linux-2.6.32.46/kernel/ptrace.c 2011-05-22 23:02:06.000000000 -0400
69093 @@ -117,7 +117,8 @@ int ptrace_check_attach(struct task_stru
69094 return ret;
69095 }
69096
69097 -int __ptrace_may_access(struct task_struct *task, unsigned int mode)
69098 +static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
69099 + unsigned int log)
69100 {
69101 const struct cred *cred = current_cred(), *tcred;
69102
69103 @@ -141,7 +142,9 @@ int __ptrace_may_access(struct task_stru
69104 cred->gid != tcred->egid ||
69105 cred->gid != tcred->sgid ||
69106 cred->gid != tcred->gid) &&
69107 - !capable(CAP_SYS_PTRACE)) {
69108 + ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
69109 + (log && !capable(CAP_SYS_PTRACE)))
69110 + ) {
69111 rcu_read_unlock();
69112 return -EPERM;
69113 }
69114 @@ -149,7 +152,9 @@ int __ptrace_may_access(struct task_stru
69115 smp_rmb();
69116 if (task->mm)
69117 dumpable = get_dumpable(task->mm);
69118 - if (!dumpable && !capable(CAP_SYS_PTRACE))
69119 + if (!dumpable &&
69120 + ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
69121 + (log && !capable(CAP_SYS_PTRACE))))
69122 return -EPERM;
69123
69124 return security_ptrace_access_check(task, mode);
69125 @@ -159,7 +164,16 @@ bool ptrace_may_access(struct task_struc
69126 {
69127 int err;
69128 task_lock(task);
69129 - err = __ptrace_may_access(task, mode);
69130 + err = __ptrace_may_access(task, mode, 0);
69131 + task_unlock(task);
69132 + return !err;
69133 +}
69134 +
69135 +bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
69136 +{
69137 + int err;
69138 + task_lock(task);
69139 + err = __ptrace_may_access(task, mode, 1);
69140 task_unlock(task);
69141 return !err;
69142 }
69143 @@ -186,7 +200,7 @@ int ptrace_attach(struct task_struct *ta
69144 goto out;
69145
69146 task_lock(task);
69147 - retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
69148 + retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
69149 task_unlock(task);
69150 if (retval)
69151 goto unlock_creds;
69152 @@ -199,7 +213,7 @@ int ptrace_attach(struct task_struct *ta
69153 goto unlock_tasklist;
69154
69155 task->ptrace = PT_PTRACED;
69156 - if (capable(CAP_SYS_PTRACE))
69157 + if (capable_nolog(CAP_SYS_PTRACE))
69158 task->ptrace |= PT_PTRACE_CAP;
69159
69160 __ptrace_link(task, current);
69161 @@ -351,6 +365,8 @@ int ptrace_readdata(struct task_struct *
69162 {
69163 int copied = 0;
69164
69165 + pax_track_stack();
69166 +
69167 while (len > 0) {
69168 char buf[128];
69169 int this_len, retval;
69170 @@ -376,6 +392,8 @@ int ptrace_writedata(struct task_struct
69171 {
69172 int copied = 0;
69173
69174 + pax_track_stack();
69175 +
69176 while (len > 0) {
69177 char buf[128];
69178 int this_len, retval;
69179 @@ -517,6 +535,8 @@ int ptrace_request(struct task_struct *c
69180 int ret = -EIO;
69181 siginfo_t siginfo;
69182
69183 + pax_track_stack();
69184 +
69185 switch (request) {
69186 case PTRACE_PEEKTEXT:
69187 case PTRACE_PEEKDATA:
69188 @@ -532,18 +552,18 @@ int ptrace_request(struct task_struct *c
69189 ret = ptrace_setoptions(child, data);
69190 break;
69191 case PTRACE_GETEVENTMSG:
69192 - ret = put_user(child->ptrace_message, (unsigned long __user *) data);
69193 + ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
69194 break;
69195
69196 case PTRACE_GETSIGINFO:
69197 ret = ptrace_getsiginfo(child, &siginfo);
69198 if (!ret)
69199 - ret = copy_siginfo_to_user((siginfo_t __user *) data,
69200 + ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
69201 &siginfo);
69202 break;
69203
69204 case PTRACE_SETSIGINFO:
69205 - if (copy_from_user(&siginfo, (siginfo_t __user *) data,
69206 + if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
69207 sizeof siginfo))
69208 ret = -EFAULT;
69209 else
69210 @@ -621,14 +641,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
69211 goto out;
69212 }
69213
69214 + if (gr_handle_ptrace(child, request)) {
69215 + ret = -EPERM;
69216 + goto out_put_task_struct;
69217 + }
69218 +
69219 if (request == PTRACE_ATTACH) {
69220 ret = ptrace_attach(child);
69221 /*
69222 * Some architectures need to do book-keeping after
69223 * a ptrace attach.
69224 */
69225 - if (!ret)
69226 + if (!ret) {
69227 arch_ptrace_attach(child);
69228 + gr_audit_ptrace(child);
69229 + }
69230 goto out_put_task_struct;
69231 }
69232
69233 @@ -653,7 +680,7 @@ int generic_ptrace_peekdata(struct task_
69234 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
69235 if (copied != sizeof(tmp))
69236 return -EIO;
69237 - return put_user(tmp, (unsigned long __user *)data);
69238 + return put_user(tmp, (__force unsigned long __user *)data);
69239 }
69240
69241 int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
69242 @@ -675,6 +702,8 @@ int compat_ptrace_request(struct task_st
69243 siginfo_t siginfo;
69244 int ret;
69245
69246 + pax_track_stack();
69247 +
69248 switch (request) {
69249 case PTRACE_PEEKTEXT:
69250 case PTRACE_PEEKDATA:
69251 @@ -740,14 +769,21 @@ asmlinkage long compat_sys_ptrace(compat
69252 goto out;
69253 }
69254
69255 + if (gr_handle_ptrace(child, request)) {
69256 + ret = -EPERM;
69257 + goto out_put_task_struct;
69258 + }
69259 +
69260 if (request == PTRACE_ATTACH) {
69261 ret = ptrace_attach(child);
69262 /*
69263 * Some architectures need to do book-keeping after
69264 * a ptrace attach.
69265 */
69266 - if (!ret)
69267 + if (!ret) {
69268 arch_ptrace_attach(child);
69269 + gr_audit_ptrace(child);
69270 + }
69271 goto out_put_task_struct;
69272 }
69273
69274 diff -urNp linux-2.6.32.46/kernel/rcutorture.c linux-2.6.32.46/kernel/rcutorture.c
69275 --- linux-2.6.32.46/kernel/rcutorture.c 2011-03-27 14:31:47.000000000 -0400
69276 +++ linux-2.6.32.46/kernel/rcutorture.c 2011-05-04 17:56:28.000000000 -0400
69277 @@ -118,12 +118,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_
69278 { 0 };
69279 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
69280 { 0 };
69281 -static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
69282 -static atomic_t n_rcu_torture_alloc;
69283 -static atomic_t n_rcu_torture_alloc_fail;
69284 -static atomic_t n_rcu_torture_free;
69285 -static atomic_t n_rcu_torture_mberror;
69286 -static atomic_t n_rcu_torture_error;
69287 +static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
69288 +static atomic_unchecked_t n_rcu_torture_alloc;
69289 +static atomic_unchecked_t n_rcu_torture_alloc_fail;
69290 +static atomic_unchecked_t n_rcu_torture_free;
69291 +static atomic_unchecked_t n_rcu_torture_mberror;
69292 +static atomic_unchecked_t n_rcu_torture_error;
69293 static long n_rcu_torture_timers;
69294 static struct list_head rcu_torture_removed;
69295 static cpumask_var_t shuffle_tmp_mask;
69296 @@ -187,11 +187,11 @@ rcu_torture_alloc(void)
69297
69298 spin_lock_bh(&rcu_torture_lock);
69299 if (list_empty(&rcu_torture_freelist)) {
69300 - atomic_inc(&n_rcu_torture_alloc_fail);
69301 + atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
69302 spin_unlock_bh(&rcu_torture_lock);
69303 return NULL;
69304 }
69305 - atomic_inc(&n_rcu_torture_alloc);
69306 + atomic_inc_unchecked(&n_rcu_torture_alloc);
69307 p = rcu_torture_freelist.next;
69308 list_del_init(p);
69309 spin_unlock_bh(&rcu_torture_lock);
69310 @@ -204,7 +204,7 @@ rcu_torture_alloc(void)
69311 static void
69312 rcu_torture_free(struct rcu_torture *p)
69313 {
69314 - atomic_inc(&n_rcu_torture_free);
69315 + atomic_inc_unchecked(&n_rcu_torture_free);
69316 spin_lock_bh(&rcu_torture_lock);
69317 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
69318 spin_unlock_bh(&rcu_torture_lock);
69319 @@ -319,7 +319,7 @@ rcu_torture_cb(struct rcu_head *p)
69320 i = rp->rtort_pipe_count;
69321 if (i > RCU_TORTURE_PIPE_LEN)
69322 i = RCU_TORTURE_PIPE_LEN;
69323 - atomic_inc(&rcu_torture_wcount[i]);
69324 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
69325 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
69326 rp->rtort_mbtest = 0;
69327 rcu_torture_free(rp);
69328 @@ -359,7 +359,7 @@ static void rcu_sync_torture_deferred_fr
69329 i = rp->rtort_pipe_count;
69330 if (i > RCU_TORTURE_PIPE_LEN)
69331 i = RCU_TORTURE_PIPE_LEN;
69332 - atomic_inc(&rcu_torture_wcount[i]);
69333 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
69334 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
69335 rp->rtort_mbtest = 0;
69336 list_del(&rp->rtort_free);
69337 @@ -653,7 +653,7 @@ rcu_torture_writer(void *arg)
69338 i = old_rp->rtort_pipe_count;
69339 if (i > RCU_TORTURE_PIPE_LEN)
69340 i = RCU_TORTURE_PIPE_LEN;
69341 - atomic_inc(&rcu_torture_wcount[i]);
69342 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
69343 old_rp->rtort_pipe_count++;
69344 cur_ops->deferred_free(old_rp);
69345 }
69346 @@ -718,7 +718,7 @@ static void rcu_torture_timer(unsigned l
69347 return;
69348 }
69349 if (p->rtort_mbtest == 0)
69350 - atomic_inc(&n_rcu_torture_mberror);
69351 + atomic_inc_unchecked(&n_rcu_torture_mberror);
69352 spin_lock(&rand_lock);
69353 cur_ops->read_delay(&rand);
69354 n_rcu_torture_timers++;
69355 @@ -776,7 +776,7 @@ rcu_torture_reader(void *arg)
69356 continue;
69357 }
69358 if (p->rtort_mbtest == 0)
69359 - atomic_inc(&n_rcu_torture_mberror);
69360 + atomic_inc_unchecked(&n_rcu_torture_mberror);
69361 cur_ops->read_delay(&rand);
69362 preempt_disable();
69363 pipe_count = p->rtort_pipe_count;
69364 @@ -834,17 +834,17 @@ rcu_torture_printk(char *page)
69365 rcu_torture_current,
69366 rcu_torture_current_version,
69367 list_empty(&rcu_torture_freelist),
69368 - atomic_read(&n_rcu_torture_alloc),
69369 - atomic_read(&n_rcu_torture_alloc_fail),
69370 - atomic_read(&n_rcu_torture_free),
69371 - atomic_read(&n_rcu_torture_mberror),
69372 + atomic_read_unchecked(&n_rcu_torture_alloc),
69373 + atomic_read_unchecked(&n_rcu_torture_alloc_fail),
69374 + atomic_read_unchecked(&n_rcu_torture_free),
69375 + atomic_read_unchecked(&n_rcu_torture_mberror),
69376 n_rcu_torture_timers);
69377 - if (atomic_read(&n_rcu_torture_mberror) != 0)
69378 + if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0)
69379 cnt += sprintf(&page[cnt], " !!!");
69380 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
69381 if (i > 1) {
69382 cnt += sprintf(&page[cnt], "!!! ");
69383 - atomic_inc(&n_rcu_torture_error);
69384 + atomic_inc_unchecked(&n_rcu_torture_error);
69385 WARN_ON_ONCE(1);
69386 }
69387 cnt += sprintf(&page[cnt], "Reader Pipe: ");
69388 @@ -858,7 +858,7 @@ rcu_torture_printk(char *page)
69389 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
69390 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
69391 cnt += sprintf(&page[cnt], " %d",
69392 - atomic_read(&rcu_torture_wcount[i]));
69393 + atomic_read_unchecked(&rcu_torture_wcount[i]));
69394 }
69395 cnt += sprintf(&page[cnt], "\n");
69396 if (cur_ops->stats)
69397 @@ -1084,7 +1084,7 @@ rcu_torture_cleanup(void)
69398
69399 if (cur_ops->cleanup)
69400 cur_ops->cleanup();
69401 - if (atomic_read(&n_rcu_torture_error))
69402 + if (atomic_read_unchecked(&n_rcu_torture_error))
69403 rcu_torture_print_module_parms("End of test: FAILURE");
69404 else
69405 rcu_torture_print_module_parms("End of test: SUCCESS");
69406 @@ -1138,13 +1138,13 @@ rcu_torture_init(void)
69407
69408 rcu_torture_current = NULL;
69409 rcu_torture_current_version = 0;
69410 - atomic_set(&n_rcu_torture_alloc, 0);
69411 - atomic_set(&n_rcu_torture_alloc_fail, 0);
69412 - atomic_set(&n_rcu_torture_free, 0);
69413 - atomic_set(&n_rcu_torture_mberror, 0);
69414 - atomic_set(&n_rcu_torture_error, 0);
69415 + atomic_set_unchecked(&n_rcu_torture_alloc, 0);
69416 + atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
69417 + atomic_set_unchecked(&n_rcu_torture_free, 0);
69418 + atomic_set_unchecked(&n_rcu_torture_mberror, 0);
69419 + atomic_set_unchecked(&n_rcu_torture_error, 0);
69420 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
69421 - atomic_set(&rcu_torture_wcount[i], 0);
69422 + atomic_set_unchecked(&rcu_torture_wcount[i], 0);
69423 for_each_possible_cpu(cpu) {
69424 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
69425 per_cpu(rcu_torture_count, cpu)[i] = 0;
69426 diff -urNp linux-2.6.32.46/kernel/rcutree.c linux-2.6.32.46/kernel/rcutree.c
69427 --- linux-2.6.32.46/kernel/rcutree.c 2011-03-27 14:31:47.000000000 -0400
69428 +++ linux-2.6.32.46/kernel/rcutree.c 2011-04-17 15:56:46.000000000 -0400
69429 @@ -1303,7 +1303,7 @@ __rcu_process_callbacks(struct rcu_state
69430 /*
69431 * Do softirq processing for the current CPU.
69432 */
69433 -static void rcu_process_callbacks(struct softirq_action *unused)
69434 +static void rcu_process_callbacks(void)
69435 {
69436 /*
69437 * Memory references from any prior RCU read-side critical sections
69438 diff -urNp linux-2.6.32.46/kernel/rcutree_plugin.h linux-2.6.32.46/kernel/rcutree_plugin.h
69439 --- linux-2.6.32.46/kernel/rcutree_plugin.h 2011-03-27 14:31:47.000000000 -0400
69440 +++ linux-2.6.32.46/kernel/rcutree_plugin.h 2011-04-17 15:56:46.000000000 -0400
69441 @@ -145,7 +145,7 @@ static void rcu_preempt_note_context_swi
69442 */
69443 void __rcu_read_lock(void)
69444 {
69445 - ACCESS_ONCE(current->rcu_read_lock_nesting)++;
69446 + ACCESS_ONCE_RW(current->rcu_read_lock_nesting)++;
69447 barrier(); /* needed if we ever invoke rcu_read_lock in rcutree.c */
69448 }
69449 EXPORT_SYMBOL_GPL(__rcu_read_lock);
69450 @@ -251,7 +251,7 @@ void __rcu_read_unlock(void)
69451 struct task_struct *t = current;
69452
69453 barrier(); /* needed if we ever invoke rcu_read_unlock in rcutree.c */
69454 - if (--ACCESS_ONCE(t->rcu_read_lock_nesting) == 0 &&
69455 + if (--ACCESS_ONCE_RW(t->rcu_read_lock_nesting) == 0 &&
69456 unlikely(ACCESS_ONCE(t->rcu_read_unlock_special)))
69457 rcu_read_unlock_special(t);
69458 }
69459 diff -urNp linux-2.6.32.46/kernel/relay.c linux-2.6.32.46/kernel/relay.c
69460 --- linux-2.6.32.46/kernel/relay.c 2011-03-27 14:31:47.000000000 -0400
69461 +++ linux-2.6.32.46/kernel/relay.c 2011-05-16 21:46:57.000000000 -0400
69462 @@ -1222,7 +1222,7 @@ static int subbuf_splice_actor(struct fi
69463 unsigned int flags,
69464 int *nonpad_ret)
69465 {
69466 - unsigned int pidx, poff, total_len, subbuf_pages, nr_pages, ret;
69467 + unsigned int pidx, poff, total_len, subbuf_pages, nr_pages;
69468 struct rchan_buf *rbuf = in->private_data;
69469 unsigned int subbuf_size = rbuf->chan->subbuf_size;
69470 uint64_t pos = (uint64_t) *ppos;
69471 @@ -1241,6 +1241,9 @@ static int subbuf_splice_actor(struct fi
69472 .ops = &relay_pipe_buf_ops,
69473 .spd_release = relay_page_release,
69474 };
69475 + ssize_t ret;
69476 +
69477 + pax_track_stack();
69478
69479 if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
69480 return 0;
69481 diff -urNp linux-2.6.32.46/kernel/resource.c linux-2.6.32.46/kernel/resource.c
69482 --- linux-2.6.32.46/kernel/resource.c 2011-03-27 14:31:47.000000000 -0400
69483 +++ linux-2.6.32.46/kernel/resource.c 2011-04-17 15:56:46.000000000 -0400
69484 @@ -132,8 +132,18 @@ static const struct file_operations proc
69485
69486 static int __init ioresources_init(void)
69487 {
69488 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
69489 +#ifdef CONFIG_GRKERNSEC_PROC_USER
69490 + proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
69491 + proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
69492 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
69493 + proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
69494 + proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
69495 +#endif
69496 +#else
69497 proc_create("ioports", 0, NULL, &proc_ioports_operations);
69498 proc_create("iomem", 0, NULL, &proc_iomem_operations);
69499 +#endif
69500 return 0;
69501 }
69502 __initcall(ioresources_init);
69503 diff -urNp linux-2.6.32.46/kernel/rtmutex.c linux-2.6.32.46/kernel/rtmutex.c
69504 --- linux-2.6.32.46/kernel/rtmutex.c 2011-03-27 14:31:47.000000000 -0400
69505 +++ linux-2.6.32.46/kernel/rtmutex.c 2011-04-17 15:56:46.000000000 -0400
69506 @@ -511,7 +511,7 @@ static void wakeup_next_waiter(struct rt
69507 */
69508 spin_lock_irqsave(&pendowner->pi_lock, flags);
69509
69510 - WARN_ON(!pendowner->pi_blocked_on);
69511 + BUG_ON(!pendowner->pi_blocked_on);
69512 WARN_ON(pendowner->pi_blocked_on != waiter);
69513 WARN_ON(pendowner->pi_blocked_on->lock != lock);
69514
69515 diff -urNp linux-2.6.32.46/kernel/rtmutex-tester.c linux-2.6.32.46/kernel/rtmutex-tester.c
69516 --- linux-2.6.32.46/kernel/rtmutex-tester.c 2011-03-27 14:31:47.000000000 -0400
69517 +++ linux-2.6.32.46/kernel/rtmutex-tester.c 2011-05-04 17:56:28.000000000 -0400
69518 @@ -21,7 +21,7 @@
69519 #define MAX_RT_TEST_MUTEXES 8
69520
69521 static spinlock_t rttest_lock;
69522 -static atomic_t rttest_event;
69523 +static atomic_unchecked_t rttest_event;
69524
69525 struct test_thread_data {
69526 int opcode;
69527 @@ -64,7 +64,7 @@ static int handle_op(struct test_thread_
69528
69529 case RTTEST_LOCKCONT:
69530 td->mutexes[td->opdata] = 1;
69531 - td->event = atomic_add_return(1, &rttest_event);
69532 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69533 return 0;
69534
69535 case RTTEST_RESET:
69536 @@ -82,7 +82,7 @@ static int handle_op(struct test_thread_
69537 return 0;
69538
69539 case RTTEST_RESETEVENT:
69540 - atomic_set(&rttest_event, 0);
69541 + atomic_set_unchecked(&rttest_event, 0);
69542 return 0;
69543
69544 default:
69545 @@ -99,9 +99,9 @@ static int handle_op(struct test_thread_
69546 return ret;
69547
69548 td->mutexes[id] = 1;
69549 - td->event = atomic_add_return(1, &rttest_event);
69550 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69551 rt_mutex_lock(&mutexes[id]);
69552 - td->event = atomic_add_return(1, &rttest_event);
69553 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69554 td->mutexes[id] = 4;
69555 return 0;
69556
69557 @@ -112,9 +112,9 @@ static int handle_op(struct test_thread_
69558 return ret;
69559
69560 td->mutexes[id] = 1;
69561 - td->event = atomic_add_return(1, &rttest_event);
69562 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69563 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
69564 - td->event = atomic_add_return(1, &rttest_event);
69565 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69566 td->mutexes[id] = ret ? 0 : 4;
69567 return ret ? -EINTR : 0;
69568
69569 @@ -123,9 +123,9 @@ static int handle_op(struct test_thread_
69570 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
69571 return ret;
69572
69573 - td->event = atomic_add_return(1, &rttest_event);
69574 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69575 rt_mutex_unlock(&mutexes[id]);
69576 - td->event = atomic_add_return(1, &rttest_event);
69577 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69578 td->mutexes[id] = 0;
69579 return 0;
69580
69581 @@ -187,7 +187,7 @@ void schedule_rt_mutex_test(struct rt_mu
69582 break;
69583
69584 td->mutexes[dat] = 2;
69585 - td->event = atomic_add_return(1, &rttest_event);
69586 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69587 break;
69588
69589 case RTTEST_LOCKBKL:
69590 @@ -208,7 +208,7 @@ void schedule_rt_mutex_test(struct rt_mu
69591 return;
69592
69593 td->mutexes[dat] = 3;
69594 - td->event = atomic_add_return(1, &rttest_event);
69595 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69596 break;
69597
69598 case RTTEST_LOCKNOWAIT:
69599 @@ -220,7 +220,7 @@ void schedule_rt_mutex_test(struct rt_mu
69600 return;
69601
69602 td->mutexes[dat] = 1;
69603 - td->event = atomic_add_return(1, &rttest_event);
69604 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69605 return;
69606
69607 case RTTEST_LOCKBKL:
69608 diff -urNp linux-2.6.32.46/kernel/sched.c linux-2.6.32.46/kernel/sched.c
69609 --- linux-2.6.32.46/kernel/sched.c 2011-03-27 14:31:47.000000000 -0400
69610 +++ linux-2.6.32.46/kernel/sched.c 2011-08-21 19:29:25.000000000 -0400
69611 @@ -2764,9 +2764,10 @@ void wake_up_new_task(struct task_struct
69612 {
69613 unsigned long flags;
69614 struct rq *rq;
69615 - int cpu = get_cpu();
69616
69617 #ifdef CONFIG_SMP
69618 + int cpu = get_cpu();
69619 +
69620 rq = task_rq_lock(p, &flags);
69621 p->state = TASK_WAKING;
69622
69623 @@ -5043,7 +5044,7 @@ out:
69624 * In CONFIG_NO_HZ case, the idle load balance owner will do the
69625 * rebalancing for all the cpus for whom scheduler ticks are stopped.
69626 */
69627 -static void run_rebalance_domains(struct softirq_action *h)
69628 +static void run_rebalance_domains(void)
69629 {
69630 int this_cpu = smp_processor_id();
69631 struct rq *this_rq = cpu_rq(this_cpu);
69632 @@ -5700,6 +5701,8 @@ asmlinkage void __sched schedule(void)
69633 struct rq *rq;
69634 int cpu;
69635
69636 + pax_track_stack();
69637 +
69638 need_resched:
69639 preempt_disable();
69640 cpu = smp_processor_id();
69641 @@ -5770,7 +5773,7 @@ EXPORT_SYMBOL(schedule);
69642 * Look out! "owner" is an entirely speculative pointer
69643 * access and not reliable.
69644 */
69645 -int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
69646 +int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner)
69647 {
69648 unsigned int cpu;
69649 struct rq *rq;
69650 @@ -5784,10 +5787,10 @@ int mutex_spin_on_owner(struct mutex *lo
69651 * DEBUG_PAGEALLOC could have unmapped it if
69652 * the mutex owner just released it and exited.
69653 */
69654 - if (probe_kernel_address(&owner->cpu, cpu))
69655 + if (probe_kernel_address(&task_thread_info(owner)->cpu, cpu))
69656 return 0;
69657 #else
69658 - cpu = owner->cpu;
69659 + cpu = task_thread_info(owner)->cpu;
69660 #endif
69661
69662 /*
69663 @@ -5816,7 +5819,7 @@ int mutex_spin_on_owner(struct mutex *lo
69664 /*
69665 * Is that owner really running on that cpu?
69666 */
69667 - if (task_thread_info(rq->curr) != owner || need_resched())
69668 + if (rq->curr != owner || need_resched())
69669 return 0;
69670
69671 cpu_relax();
69672 @@ -6359,6 +6362,8 @@ int can_nice(const struct task_struct *p
69673 /* convert nice value [19,-20] to rlimit style value [1,40] */
69674 int nice_rlim = 20 - nice;
69675
69676 + gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
69677 +
69678 return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
69679 capable(CAP_SYS_NICE));
69680 }
69681 @@ -6392,7 +6397,8 @@ SYSCALL_DEFINE1(nice, int, increment)
69682 if (nice > 19)
69683 nice = 19;
69684
69685 - if (increment < 0 && !can_nice(current, nice))
69686 + if (increment < 0 && (!can_nice(current, nice) ||
69687 + gr_handle_chroot_nice()))
69688 return -EPERM;
69689
69690 retval = security_task_setnice(current, nice);
69691 @@ -8774,7 +8780,7 @@ static void init_sched_groups_power(int
69692 long power;
69693 int weight;
69694
69695 - WARN_ON(!sd || !sd->groups);
69696 + BUG_ON(!sd || !sd->groups);
69697
69698 if (cpu != group_first_cpu(sd->groups))
69699 return;
69700 diff -urNp linux-2.6.32.46/kernel/signal.c linux-2.6.32.46/kernel/signal.c
69701 --- linux-2.6.32.46/kernel/signal.c 2011-04-17 17:00:52.000000000 -0400
69702 +++ linux-2.6.32.46/kernel/signal.c 2011-08-16 21:15:58.000000000 -0400
69703 @@ -41,12 +41,12 @@
69704
69705 static struct kmem_cache *sigqueue_cachep;
69706
69707 -static void __user *sig_handler(struct task_struct *t, int sig)
69708 +static __sighandler_t sig_handler(struct task_struct *t, int sig)
69709 {
69710 return t->sighand->action[sig - 1].sa.sa_handler;
69711 }
69712
69713 -static int sig_handler_ignored(void __user *handler, int sig)
69714 +static int sig_handler_ignored(__sighandler_t handler, int sig)
69715 {
69716 /* Is it explicitly or implicitly ignored? */
69717 return handler == SIG_IGN ||
69718 @@ -56,7 +56,7 @@ static int sig_handler_ignored(void __us
69719 static int sig_task_ignored(struct task_struct *t, int sig,
69720 int from_ancestor_ns)
69721 {
69722 - void __user *handler;
69723 + __sighandler_t handler;
69724
69725 handler = sig_handler(t, sig);
69726
69727 @@ -207,6 +207,9 @@ static struct sigqueue *__sigqueue_alloc
69728 */
69729 user = get_uid(__task_cred(t)->user);
69730 atomic_inc(&user->sigpending);
69731 +
69732 + if (!override_rlimit)
69733 + gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
69734 if (override_rlimit ||
69735 atomic_read(&user->sigpending) <=
69736 t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
69737 @@ -327,7 +330,7 @@ flush_signal_handlers(struct task_struct
69738
69739 int unhandled_signal(struct task_struct *tsk, int sig)
69740 {
69741 - void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
69742 + __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
69743 if (is_global_init(tsk))
69744 return 1;
69745 if (handler != SIG_IGN && handler != SIG_DFL)
69746 @@ -627,6 +630,13 @@ static int check_kill_permission(int sig
69747 }
69748 }
69749
69750 + /* allow glibc communication via tgkill to other threads in our
69751 + thread group */
69752 + if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
69753 + sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
69754 + && gr_handle_signal(t, sig))
69755 + return -EPERM;
69756 +
69757 return security_task_kill(t, info, sig, 0);
69758 }
69759
69760 @@ -968,7 +978,7 @@ __group_send_sig_info(int sig, struct si
69761 return send_signal(sig, info, p, 1);
69762 }
69763
69764 -static int
69765 +int
69766 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
69767 {
69768 return send_signal(sig, info, t, 0);
69769 @@ -1005,6 +1015,7 @@ force_sig_info(int sig, struct siginfo *
69770 unsigned long int flags;
69771 int ret, blocked, ignored;
69772 struct k_sigaction *action;
69773 + int is_unhandled = 0;
69774
69775 spin_lock_irqsave(&t->sighand->siglock, flags);
69776 action = &t->sighand->action[sig-1];
69777 @@ -1019,9 +1030,18 @@ force_sig_info(int sig, struct siginfo *
69778 }
69779 if (action->sa.sa_handler == SIG_DFL)
69780 t->signal->flags &= ~SIGNAL_UNKILLABLE;
69781 + if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
69782 + is_unhandled = 1;
69783 ret = specific_send_sig_info(sig, info, t);
69784 spin_unlock_irqrestore(&t->sighand->siglock, flags);
69785
69786 + /* only deal with unhandled signals, java etc trigger SIGSEGV during
69787 + normal operation */
69788 + if (is_unhandled) {
69789 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
69790 + gr_handle_crash(t, sig);
69791 + }
69792 +
69793 return ret;
69794 }
69795
69796 @@ -1081,8 +1101,11 @@ int group_send_sig_info(int sig, struct
69797 {
69798 int ret = check_kill_permission(sig, info, p);
69799
69800 - if (!ret && sig)
69801 + if (!ret && sig) {
69802 ret = do_send_sig_info(sig, info, p, true);
69803 + if (!ret)
69804 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
69805 + }
69806
69807 return ret;
69808 }
69809 @@ -1644,6 +1667,8 @@ void ptrace_notify(int exit_code)
69810 {
69811 siginfo_t info;
69812
69813 + pax_track_stack();
69814 +
69815 BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
69816
69817 memset(&info, 0, sizeof info);
69818 @@ -2275,7 +2300,15 @@ do_send_specific(pid_t tgid, pid_t pid,
69819 int error = -ESRCH;
69820
69821 rcu_read_lock();
69822 - p = find_task_by_vpid(pid);
69823 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
69824 + /* allow glibc communication via tgkill to other threads in our
69825 + thread group */
69826 + if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
69827 + sig == (SIGRTMIN+1) && tgid == info->si_pid)
69828 + p = find_task_by_vpid_unrestricted(pid);
69829 + else
69830 +#endif
69831 + p = find_task_by_vpid(pid);
69832 if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
69833 error = check_kill_permission(sig, info, p);
69834 /*
69835 diff -urNp linux-2.6.32.46/kernel/smp.c linux-2.6.32.46/kernel/smp.c
69836 --- linux-2.6.32.46/kernel/smp.c 2011-03-27 14:31:47.000000000 -0400
69837 +++ linux-2.6.32.46/kernel/smp.c 2011-04-17 15:56:46.000000000 -0400
69838 @@ -522,22 +522,22 @@ int smp_call_function(void (*func)(void
69839 }
69840 EXPORT_SYMBOL(smp_call_function);
69841
69842 -void ipi_call_lock(void)
69843 +void ipi_call_lock(void) __acquires(call_function.lock)
69844 {
69845 spin_lock(&call_function.lock);
69846 }
69847
69848 -void ipi_call_unlock(void)
69849 +void ipi_call_unlock(void) __releases(call_function.lock)
69850 {
69851 spin_unlock(&call_function.lock);
69852 }
69853
69854 -void ipi_call_lock_irq(void)
69855 +void ipi_call_lock_irq(void) __acquires(call_function.lock)
69856 {
69857 spin_lock_irq(&call_function.lock);
69858 }
69859
69860 -void ipi_call_unlock_irq(void)
69861 +void ipi_call_unlock_irq(void) __releases(call_function.lock)
69862 {
69863 spin_unlock_irq(&call_function.lock);
69864 }
69865 diff -urNp linux-2.6.32.46/kernel/softirq.c linux-2.6.32.46/kernel/softirq.c
69866 --- linux-2.6.32.46/kernel/softirq.c 2011-03-27 14:31:47.000000000 -0400
69867 +++ linux-2.6.32.46/kernel/softirq.c 2011-08-05 20:33:55.000000000 -0400
69868 @@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
69869
69870 static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
69871
69872 -char *softirq_to_name[NR_SOFTIRQS] = {
69873 +const char * const softirq_to_name[NR_SOFTIRQS] = {
69874 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
69875 "TASKLET", "SCHED", "HRTIMER", "RCU"
69876 };
69877 @@ -206,7 +206,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
69878
69879 asmlinkage void __do_softirq(void)
69880 {
69881 - struct softirq_action *h;
69882 + const struct softirq_action *h;
69883 __u32 pending;
69884 int max_restart = MAX_SOFTIRQ_RESTART;
69885 int cpu;
69886 @@ -233,7 +233,7 @@ restart:
69887 kstat_incr_softirqs_this_cpu(h - softirq_vec);
69888
69889 trace_softirq_entry(h, softirq_vec);
69890 - h->action(h);
69891 + h->action();
69892 trace_softirq_exit(h, softirq_vec);
69893 if (unlikely(prev_count != preempt_count())) {
69894 printk(KERN_ERR "huh, entered softirq %td %s %p"
69895 @@ -363,9 +363,11 @@ void raise_softirq(unsigned int nr)
69896 local_irq_restore(flags);
69897 }
69898
69899 -void open_softirq(int nr, void (*action)(struct softirq_action *))
69900 +void open_softirq(int nr, void (*action)(void))
69901 {
69902 - softirq_vec[nr].action = action;
69903 + pax_open_kernel();
69904 + *(void **)&softirq_vec[nr].action = action;
69905 + pax_close_kernel();
69906 }
69907
69908 /*
69909 @@ -419,7 +421,7 @@ void __tasklet_hi_schedule_first(struct
69910
69911 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
69912
69913 -static void tasklet_action(struct softirq_action *a)
69914 +static void tasklet_action(void)
69915 {
69916 struct tasklet_struct *list;
69917
69918 @@ -454,7 +456,7 @@ static void tasklet_action(struct softir
69919 }
69920 }
69921
69922 -static void tasklet_hi_action(struct softirq_action *a)
69923 +static void tasklet_hi_action(void)
69924 {
69925 struct tasklet_struct *list;
69926
69927 diff -urNp linux-2.6.32.46/kernel/sys.c linux-2.6.32.46/kernel/sys.c
69928 --- linux-2.6.32.46/kernel/sys.c 2011-03-27 14:31:47.000000000 -0400
69929 +++ linux-2.6.32.46/kernel/sys.c 2011-08-11 19:51:54.000000000 -0400
69930 @@ -133,6 +133,12 @@ static int set_one_prio(struct task_stru
69931 error = -EACCES;
69932 goto out;
69933 }
69934 +
69935 + if (gr_handle_chroot_setpriority(p, niceval)) {
69936 + error = -EACCES;
69937 + goto out;
69938 + }
69939 +
69940 no_nice = security_task_setnice(p, niceval);
69941 if (no_nice) {
69942 error = no_nice;
69943 @@ -190,10 +196,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
69944 !(user = find_user(who)))
69945 goto out_unlock; /* No processes for this user */
69946
69947 - do_each_thread(g, p)
69948 + do_each_thread(g, p) {
69949 if (__task_cred(p)->uid == who)
69950 error = set_one_prio(p, niceval, error);
69951 - while_each_thread(g, p);
69952 + } while_each_thread(g, p);
69953 if (who != cred->uid)
69954 free_uid(user); /* For find_user() */
69955 break;
69956 @@ -253,13 +259,13 @@ SYSCALL_DEFINE2(getpriority, int, which,
69957 !(user = find_user(who)))
69958 goto out_unlock; /* No processes for this user */
69959
69960 - do_each_thread(g, p)
69961 + do_each_thread(g, p) {
69962 if (__task_cred(p)->uid == who) {
69963 niceval = 20 - task_nice(p);
69964 if (niceval > retval)
69965 retval = niceval;
69966 }
69967 - while_each_thread(g, p);
69968 + } while_each_thread(g, p);
69969 if (who != cred->uid)
69970 free_uid(user); /* for find_user() */
69971 break;
69972 @@ -509,6 +515,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
69973 goto error;
69974 }
69975
69976 + if (gr_check_group_change(new->gid, new->egid, -1))
69977 + goto error;
69978 +
69979 if (rgid != (gid_t) -1 ||
69980 (egid != (gid_t) -1 && egid != old->gid))
69981 new->sgid = new->egid;
69982 @@ -542,6 +551,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
69983 goto error;
69984
69985 retval = -EPERM;
69986 +
69987 + if (gr_check_group_change(gid, gid, gid))
69988 + goto error;
69989 +
69990 if (capable(CAP_SETGID))
69991 new->gid = new->egid = new->sgid = new->fsgid = gid;
69992 else if (gid == old->gid || gid == old->sgid)
69993 @@ -567,12 +580,19 @@ static int set_user(struct cred *new)
69994 if (!new_user)
69995 return -EAGAIN;
69996
69997 + /*
69998 + * We don't fail in case of NPROC limit excess here because too many
69999 + * poorly written programs don't check set*uid() return code, assuming
70000 + * it never fails if called by root. We may still enforce NPROC limit
70001 + * for programs doing set*uid()+execve() by harmlessly deferring the
70002 + * failure to the execve() stage.
70003 + */
70004 if (atomic_read(&new_user->processes) >=
70005 current->signal->rlim[RLIMIT_NPROC].rlim_cur &&
70006 - new_user != INIT_USER) {
70007 - free_uid(new_user);
70008 - return -EAGAIN;
70009 - }
70010 + new_user != INIT_USER)
70011 + current->flags |= PF_NPROC_EXCEEDED;
70012 + else
70013 + current->flags &= ~PF_NPROC_EXCEEDED;
70014
70015 free_uid(new->user);
70016 new->user = new_user;
70017 @@ -627,6 +647,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
70018 goto error;
70019 }
70020
70021 + if (gr_check_user_change(new->uid, new->euid, -1))
70022 + goto error;
70023 +
70024 if (new->uid != old->uid) {
70025 retval = set_user(new);
70026 if (retval < 0)
70027 @@ -675,6 +698,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
70028 goto error;
70029
70030 retval = -EPERM;
70031 +
70032 + if (gr_check_crash_uid(uid))
70033 + goto error;
70034 + if (gr_check_user_change(uid, uid, uid))
70035 + goto error;
70036 +
70037 if (capable(CAP_SETUID)) {
70038 new->suid = new->uid = uid;
70039 if (uid != old->uid) {
70040 @@ -732,6 +761,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
70041 goto error;
70042 }
70043
70044 + if (gr_check_user_change(ruid, euid, -1))
70045 + goto error;
70046 +
70047 if (ruid != (uid_t) -1) {
70048 new->uid = ruid;
70049 if (ruid != old->uid) {
70050 @@ -800,6 +832,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
70051 goto error;
70052 }
70053
70054 + if (gr_check_group_change(rgid, egid, -1))
70055 + goto error;
70056 +
70057 if (rgid != (gid_t) -1)
70058 new->gid = rgid;
70059 if (egid != (gid_t) -1)
70060 @@ -849,6 +884,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
70061 if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
70062 goto error;
70063
70064 + if (gr_check_user_change(-1, -1, uid))
70065 + goto error;
70066 +
70067 if (uid == old->uid || uid == old->euid ||
70068 uid == old->suid || uid == old->fsuid ||
70069 capable(CAP_SETUID)) {
70070 @@ -889,6 +927,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
70071 if (gid == old->gid || gid == old->egid ||
70072 gid == old->sgid || gid == old->fsgid ||
70073 capable(CAP_SETGID)) {
70074 + if (gr_check_group_change(-1, -1, gid))
70075 + goto error;
70076 +
70077 if (gid != old_fsgid) {
70078 new->fsgid = gid;
70079 goto change_okay;
70080 @@ -1454,7 +1495,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
70081 error = get_dumpable(me->mm);
70082 break;
70083 case PR_SET_DUMPABLE:
70084 - if (arg2 < 0 || arg2 > 1) {
70085 + if (arg2 > 1) {
70086 error = -EINVAL;
70087 break;
70088 }
70089 diff -urNp linux-2.6.32.46/kernel/sysctl.c linux-2.6.32.46/kernel/sysctl.c
70090 --- linux-2.6.32.46/kernel/sysctl.c 2011-03-27 14:31:47.000000000 -0400
70091 +++ linux-2.6.32.46/kernel/sysctl.c 2011-04-17 15:56:46.000000000 -0400
70092 @@ -63,6 +63,13 @@
70093 static int deprecated_sysctl_warning(struct __sysctl_args *args);
70094
70095 #if defined(CONFIG_SYSCTL)
70096 +#include <linux/grsecurity.h>
70097 +#include <linux/grinternal.h>
70098 +
70099 +extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
70100 +extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
70101 + const int op);
70102 +extern int gr_handle_chroot_sysctl(const int op);
70103
70104 /* External variables not in a header file. */
70105 extern int C_A_D;
70106 @@ -168,6 +175,7 @@ static int proc_do_cad_pid(struct ctl_ta
70107 static int proc_taint(struct ctl_table *table, int write,
70108 void __user *buffer, size_t *lenp, loff_t *ppos);
70109 #endif
70110 +extern ctl_table grsecurity_table[];
70111
70112 static struct ctl_table root_table[];
70113 static struct ctl_table_root sysctl_table_root;
70114 @@ -200,6 +208,21 @@ extern struct ctl_table epoll_table[];
70115 int sysctl_legacy_va_layout;
70116 #endif
70117
70118 +#ifdef CONFIG_PAX_SOFTMODE
70119 +static ctl_table pax_table[] = {
70120 + {
70121 + .ctl_name = CTL_UNNUMBERED,
70122 + .procname = "softmode",
70123 + .data = &pax_softmode,
70124 + .maxlen = sizeof(unsigned int),
70125 + .mode = 0600,
70126 + .proc_handler = &proc_dointvec,
70127 + },
70128 +
70129 + { .ctl_name = 0 }
70130 +};
70131 +#endif
70132 +
70133 extern int prove_locking;
70134 extern int lock_stat;
70135
70136 @@ -251,6 +274,24 @@ static int max_wakeup_granularity_ns = N
70137 #endif
70138
70139 static struct ctl_table kern_table[] = {
70140 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
70141 + {
70142 + .ctl_name = CTL_UNNUMBERED,
70143 + .procname = "grsecurity",
70144 + .mode = 0500,
70145 + .child = grsecurity_table,
70146 + },
70147 +#endif
70148 +
70149 +#ifdef CONFIG_PAX_SOFTMODE
70150 + {
70151 + .ctl_name = CTL_UNNUMBERED,
70152 + .procname = "pax",
70153 + .mode = 0500,
70154 + .child = pax_table,
70155 + },
70156 +#endif
70157 +
70158 {
70159 .ctl_name = CTL_UNNUMBERED,
70160 .procname = "sched_child_runs_first",
70161 @@ -567,8 +608,8 @@ static struct ctl_table kern_table[] = {
70162 .data = &modprobe_path,
70163 .maxlen = KMOD_PATH_LEN,
70164 .mode = 0644,
70165 - .proc_handler = &proc_dostring,
70166 - .strategy = &sysctl_string,
70167 + .proc_handler = &proc_dostring_modpriv,
70168 + .strategy = &sysctl_string_modpriv,
70169 },
70170 {
70171 .ctl_name = CTL_UNNUMBERED,
70172 @@ -1247,6 +1288,13 @@ static struct ctl_table vm_table[] = {
70173 .mode = 0644,
70174 .proc_handler = &proc_dointvec
70175 },
70176 + {
70177 + .procname = "heap_stack_gap",
70178 + .data = &sysctl_heap_stack_gap,
70179 + .maxlen = sizeof(sysctl_heap_stack_gap),
70180 + .mode = 0644,
70181 + .proc_handler = proc_doulongvec_minmax,
70182 + },
70183 #else
70184 {
70185 .ctl_name = CTL_UNNUMBERED,
70186 @@ -1803,6 +1851,8 @@ static int do_sysctl_strategy(struct ctl
70187 return 0;
70188 }
70189
70190 +static int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op);
70191 +
70192 static int parse_table(int __user *name, int nlen,
70193 void __user *oldval, size_t __user *oldlenp,
70194 void __user *newval, size_t newlen,
70195 @@ -1821,7 +1871,7 @@ repeat:
70196 if (n == table->ctl_name) {
70197 int error;
70198 if (table->child) {
70199 - if (sysctl_perm(root, table, MAY_EXEC))
70200 + if (sysctl_perm_nochk(root, table, MAY_EXEC))
70201 return -EPERM;
70202 name++;
70203 nlen--;
70204 @@ -1906,6 +1956,33 @@ int sysctl_perm(struct ctl_table_root *r
70205 int error;
70206 int mode;
70207
70208 + if (table->parent != NULL && table->parent->procname != NULL &&
70209 + table->procname != NULL &&
70210 + gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
70211 + return -EACCES;
70212 + if (gr_handle_chroot_sysctl(op))
70213 + return -EACCES;
70214 + error = gr_handle_sysctl(table, op);
70215 + if (error)
70216 + return error;
70217 +
70218 + error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
70219 + if (error)
70220 + return error;
70221 +
70222 + if (root->permissions)
70223 + mode = root->permissions(root, current->nsproxy, table);
70224 + else
70225 + mode = table->mode;
70226 +
70227 + return test_perm(mode, op);
70228 +}
70229 +
70230 +int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op)
70231 +{
70232 + int error;
70233 + int mode;
70234 +
70235 error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
70236 if (error)
70237 return error;
70238 @@ -2335,6 +2412,16 @@ int proc_dostring(struct ctl_table *tabl
70239 buffer, lenp, ppos);
70240 }
70241
70242 +int proc_dostring_modpriv(struct ctl_table *table, int write,
70243 + void __user *buffer, size_t *lenp, loff_t *ppos)
70244 +{
70245 + if (write && !capable(CAP_SYS_MODULE))
70246 + return -EPERM;
70247 +
70248 + return _proc_do_string(table->data, table->maxlen, write,
70249 + buffer, lenp, ppos);
70250 +}
70251 +
70252
70253 static int do_proc_dointvec_conv(int *negp, unsigned long *lvalp,
70254 int *valp,
70255 @@ -2609,7 +2696,7 @@ static int __do_proc_doulongvec_minmax(v
70256 vleft = table->maxlen / sizeof(unsigned long);
70257 left = *lenp;
70258
70259 - for (; left && vleft--; i++, min++, max++, first=0) {
70260 + for (; left && vleft--; i++, first=0) {
70261 if (write) {
70262 while (left) {
70263 char c;
70264 @@ -2910,6 +2997,12 @@ int proc_dostring(struct ctl_table *tabl
70265 return -ENOSYS;
70266 }
70267
70268 +int proc_dostring_modpriv(struct ctl_table *table, int write,
70269 + void __user *buffer, size_t *lenp, loff_t *ppos)
70270 +{
70271 + return -ENOSYS;
70272 +}
70273 +
70274 int proc_dointvec(struct ctl_table *table, int write,
70275 void __user *buffer, size_t *lenp, loff_t *ppos)
70276 {
70277 @@ -3038,6 +3131,16 @@ int sysctl_string(struct ctl_table *tabl
70278 return 1;
70279 }
70280
70281 +int sysctl_string_modpriv(struct ctl_table *table,
70282 + void __user *oldval, size_t __user *oldlenp,
70283 + void __user *newval, size_t newlen)
70284 +{
70285 + if (newval && newlen && !capable(CAP_SYS_MODULE))
70286 + return -EPERM;
70287 +
70288 + return sysctl_string(table, oldval, oldlenp, newval, newlen);
70289 +}
70290 +
70291 /*
70292 * This function makes sure that all of the integers in the vector
70293 * are between the minimum and maximum values given in the arrays
70294 @@ -3182,6 +3285,13 @@ int sysctl_string(struct ctl_table *tabl
70295 return -ENOSYS;
70296 }
70297
70298 +int sysctl_string_modpriv(struct ctl_table *table,
70299 + void __user *oldval, size_t __user *oldlenp,
70300 + void __user *newval, size_t newlen)
70301 +{
70302 + return -ENOSYS;
70303 +}
70304 +
70305 int sysctl_intvec(struct ctl_table *table,
70306 void __user *oldval, size_t __user *oldlenp,
70307 void __user *newval, size_t newlen)
70308 @@ -3246,6 +3356,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
70309 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
70310 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
70311 EXPORT_SYMBOL(proc_dostring);
70312 +EXPORT_SYMBOL(proc_dostring_modpriv);
70313 EXPORT_SYMBOL(proc_doulongvec_minmax);
70314 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
70315 EXPORT_SYMBOL(register_sysctl_table);
70316 @@ -3254,5 +3365,6 @@ EXPORT_SYMBOL(sysctl_intvec);
70317 EXPORT_SYMBOL(sysctl_jiffies);
70318 EXPORT_SYMBOL(sysctl_ms_jiffies);
70319 EXPORT_SYMBOL(sysctl_string);
70320 +EXPORT_SYMBOL(sysctl_string_modpriv);
70321 EXPORT_SYMBOL(sysctl_data);
70322 EXPORT_SYMBOL(unregister_sysctl_table);
70323 diff -urNp linux-2.6.32.46/kernel/sysctl_check.c linux-2.6.32.46/kernel/sysctl_check.c
70324 --- linux-2.6.32.46/kernel/sysctl_check.c 2011-03-27 14:31:47.000000000 -0400
70325 +++ linux-2.6.32.46/kernel/sysctl_check.c 2011-04-17 15:56:46.000000000 -0400
70326 @@ -1489,10 +1489,12 @@ int sysctl_check_table(struct nsproxy *n
70327 } else {
70328 if ((table->strategy == sysctl_data) ||
70329 (table->strategy == sysctl_string) ||
70330 + (table->strategy == sysctl_string_modpriv) ||
70331 (table->strategy == sysctl_intvec) ||
70332 (table->strategy == sysctl_jiffies) ||
70333 (table->strategy == sysctl_ms_jiffies) ||
70334 (table->proc_handler == proc_dostring) ||
70335 + (table->proc_handler == proc_dostring_modpriv) ||
70336 (table->proc_handler == proc_dointvec) ||
70337 (table->proc_handler == proc_dointvec_minmax) ||
70338 (table->proc_handler == proc_dointvec_jiffies) ||
70339 diff -urNp linux-2.6.32.46/kernel/taskstats.c linux-2.6.32.46/kernel/taskstats.c
70340 --- linux-2.6.32.46/kernel/taskstats.c 2011-07-13 17:23:04.000000000 -0400
70341 +++ linux-2.6.32.46/kernel/taskstats.c 2011-07-13 17:23:19.000000000 -0400
70342 @@ -26,9 +26,12 @@
70343 #include <linux/cgroup.h>
70344 #include <linux/fs.h>
70345 #include <linux/file.h>
70346 +#include <linux/grsecurity.h>
70347 #include <net/genetlink.h>
70348 #include <asm/atomic.h>
70349
70350 +extern int gr_is_taskstats_denied(int pid);
70351 +
70352 /*
70353 * Maximum length of a cpumask that can be specified in
70354 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
70355 @@ -442,6 +445,9 @@ static int taskstats_user_cmd(struct sk_
70356 size_t size;
70357 cpumask_var_t mask;
70358
70359 + if (gr_is_taskstats_denied(current->pid))
70360 + return -EACCES;
70361 +
70362 if (!alloc_cpumask_var(&mask, GFP_KERNEL))
70363 return -ENOMEM;
70364
70365 diff -urNp linux-2.6.32.46/kernel/time/tick-broadcast.c linux-2.6.32.46/kernel/time/tick-broadcast.c
70366 --- linux-2.6.32.46/kernel/time/tick-broadcast.c 2011-05-23 16:56:59.000000000 -0400
70367 +++ linux-2.6.32.46/kernel/time/tick-broadcast.c 2011-05-23 16:57:13.000000000 -0400
70368 @@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct cl
70369 * then clear the broadcast bit.
70370 */
70371 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
70372 - int cpu = smp_processor_id();
70373 + cpu = smp_processor_id();
70374
70375 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
70376 tick_broadcast_clear_oneshot(cpu);
70377 diff -urNp linux-2.6.32.46/kernel/time/timekeeping.c linux-2.6.32.46/kernel/time/timekeeping.c
70378 --- linux-2.6.32.46/kernel/time/timekeeping.c 2011-06-25 12:55:35.000000000 -0400
70379 +++ linux-2.6.32.46/kernel/time/timekeeping.c 2011-06-25 12:56:37.000000000 -0400
70380 @@ -14,6 +14,7 @@
70381 #include <linux/init.h>
70382 #include <linux/mm.h>
70383 #include <linux/sched.h>
70384 +#include <linux/grsecurity.h>
70385 #include <linux/sysdev.h>
70386 #include <linux/clocksource.h>
70387 #include <linux/jiffies.h>
70388 @@ -180,7 +181,7 @@ void update_xtime_cache(u64 nsec)
70389 */
70390 struct timespec ts = xtime;
70391 timespec_add_ns(&ts, nsec);
70392 - ACCESS_ONCE(xtime_cache) = ts;
70393 + ACCESS_ONCE_RW(xtime_cache) = ts;
70394 }
70395
70396 /* must hold xtime_lock */
70397 @@ -333,6 +334,8 @@ int do_settimeofday(struct timespec *tv)
70398 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
70399 return -EINVAL;
70400
70401 + gr_log_timechange();
70402 +
70403 write_seqlock_irqsave(&xtime_lock, flags);
70404
70405 timekeeping_forward_now();
70406 diff -urNp linux-2.6.32.46/kernel/time/timer_list.c linux-2.6.32.46/kernel/time/timer_list.c
70407 --- linux-2.6.32.46/kernel/time/timer_list.c 2011-03-27 14:31:47.000000000 -0400
70408 +++ linux-2.6.32.46/kernel/time/timer_list.c 2011-04-17 15:56:46.000000000 -0400
70409 @@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base,
70410
70411 static void print_name_offset(struct seq_file *m, void *sym)
70412 {
70413 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70414 + SEQ_printf(m, "<%p>", NULL);
70415 +#else
70416 char symname[KSYM_NAME_LEN];
70417
70418 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
70419 SEQ_printf(m, "<%p>", sym);
70420 else
70421 SEQ_printf(m, "%s", symname);
70422 +#endif
70423 }
70424
70425 static void
70426 @@ -112,7 +116,11 @@ next_one:
70427 static void
70428 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
70429 {
70430 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70431 + SEQ_printf(m, " .base: %p\n", NULL);
70432 +#else
70433 SEQ_printf(m, " .base: %p\n", base);
70434 +#endif
70435 SEQ_printf(m, " .index: %d\n",
70436 base->index);
70437 SEQ_printf(m, " .resolution: %Lu nsecs\n",
70438 @@ -289,7 +297,11 @@ static int __init init_timer_list_procfs
70439 {
70440 struct proc_dir_entry *pe;
70441
70442 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
70443 + pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
70444 +#else
70445 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
70446 +#endif
70447 if (!pe)
70448 return -ENOMEM;
70449 return 0;
70450 diff -urNp linux-2.6.32.46/kernel/time/timer_stats.c linux-2.6.32.46/kernel/time/timer_stats.c
70451 --- linux-2.6.32.46/kernel/time/timer_stats.c 2011-03-27 14:31:47.000000000 -0400
70452 +++ linux-2.6.32.46/kernel/time/timer_stats.c 2011-05-04 17:56:28.000000000 -0400
70453 @@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
70454 static unsigned long nr_entries;
70455 static struct entry entries[MAX_ENTRIES];
70456
70457 -static atomic_t overflow_count;
70458 +static atomic_unchecked_t overflow_count;
70459
70460 /*
70461 * The entries are in a hash-table, for fast lookup:
70462 @@ -140,7 +140,7 @@ static void reset_entries(void)
70463 nr_entries = 0;
70464 memset(entries, 0, sizeof(entries));
70465 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
70466 - atomic_set(&overflow_count, 0);
70467 + atomic_set_unchecked(&overflow_count, 0);
70468 }
70469
70470 static struct entry *alloc_entry(void)
70471 @@ -261,7 +261,7 @@ void timer_stats_update_stats(void *time
70472 if (likely(entry))
70473 entry->count++;
70474 else
70475 - atomic_inc(&overflow_count);
70476 + atomic_inc_unchecked(&overflow_count);
70477
70478 out_unlock:
70479 spin_unlock_irqrestore(lock, flags);
70480 @@ -269,12 +269,16 @@ void timer_stats_update_stats(void *time
70481
70482 static void print_name_offset(struct seq_file *m, unsigned long addr)
70483 {
70484 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70485 + seq_printf(m, "<%p>", NULL);
70486 +#else
70487 char symname[KSYM_NAME_LEN];
70488
70489 if (lookup_symbol_name(addr, symname) < 0)
70490 seq_printf(m, "<%p>", (void *)addr);
70491 else
70492 seq_printf(m, "%s", symname);
70493 +#endif
70494 }
70495
70496 static int tstats_show(struct seq_file *m, void *v)
70497 @@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *
70498
70499 seq_puts(m, "Timer Stats Version: v0.2\n");
70500 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
70501 - if (atomic_read(&overflow_count))
70502 + if (atomic_read_unchecked(&overflow_count))
70503 seq_printf(m, "Overflow: %d entries\n",
70504 - atomic_read(&overflow_count));
70505 + atomic_read_unchecked(&overflow_count));
70506
70507 for (i = 0; i < nr_entries; i++) {
70508 entry = entries + i;
70509 @@ -415,7 +419,11 @@ static int __init init_tstats_procfs(voi
70510 {
70511 struct proc_dir_entry *pe;
70512
70513 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
70514 + pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
70515 +#else
70516 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
70517 +#endif
70518 if (!pe)
70519 return -ENOMEM;
70520 return 0;
70521 diff -urNp linux-2.6.32.46/kernel/time.c linux-2.6.32.46/kernel/time.c
70522 --- linux-2.6.32.46/kernel/time.c 2011-03-27 14:31:47.000000000 -0400
70523 +++ linux-2.6.32.46/kernel/time.c 2011-04-17 15:56:46.000000000 -0400
70524 @@ -165,6 +165,11 @@ int do_sys_settimeofday(struct timespec
70525 return error;
70526
70527 if (tz) {
70528 + /* we log in do_settimeofday called below, so don't log twice
70529 + */
70530 + if (!tv)
70531 + gr_log_timechange();
70532 +
70533 /* SMP safe, global irq locking makes it work. */
70534 sys_tz = *tz;
70535 update_vsyscall_tz();
70536 @@ -240,7 +245,7 @@ EXPORT_SYMBOL(current_fs_time);
70537 * Avoid unnecessary multiplications/divisions in the
70538 * two most common HZ cases:
70539 */
70540 -unsigned int inline jiffies_to_msecs(const unsigned long j)
70541 +inline unsigned int jiffies_to_msecs(const unsigned long j)
70542 {
70543 #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
70544 return (MSEC_PER_SEC / HZ) * j;
70545 @@ -256,7 +261,7 @@ unsigned int inline jiffies_to_msecs(con
70546 }
70547 EXPORT_SYMBOL(jiffies_to_msecs);
70548
70549 -unsigned int inline jiffies_to_usecs(const unsigned long j)
70550 +inline unsigned int jiffies_to_usecs(const unsigned long j)
70551 {
70552 #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
70553 return (USEC_PER_SEC / HZ) * j;
70554 diff -urNp linux-2.6.32.46/kernel/timer.c linux-2.6.32.46/kernel/timer.c
70555 --- linux-2.6.32.46/kernel/timer.c 2011-03-27 14:31:47.000000000 -0400
70556 +++ linux-2.6.32.46/kernel/timer.c 2011-04-17 15:56:46.000000000 -0400
70557 @@ -1213,7 +1213,7 @@ void update_process_times(int user_tick)
70558 /*
70559 * This function runs timers and the timer-tq in bottom half context.
70560 */
70561 -static void run_timer_softirq(struct softirq_action *h)
70562 +static void run_timer_softirq(void)
70563 {
70564 struct tvec_base *base = __get_cpu_var(tvec_bases);
70565
70566 diff -urNp linux-2.6.32.46/kernel/trace/blktrace.c linux-2.6.32.46/kernel/trace/blktrace.c
70567 --- linux-2.6.32.46/kernel/trace/blktrace.c 2011-03-27 14:31:47.000000000 -0400
70568 +++ linux-2.6.32.46/kernel/trace/blktrace.c 2011-05-04 17:56:28.000000000 -0400
70569 @@ -313,7 +313,7 @@ static ssize_t blk_dropped_read(struct f
70570 struct blk_trace *bt = filp->private_data;
70571 char buf[16];
70572
70573 - snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
70574 + snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
70575
70576 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
70577 }
70578 @@ -376,7 +376,7 @@ static int blk_subbuf_start_callback(str
70579 return 1;
70580
70581 bt = buf->chan->private_data;
70582 - atomic_inc(&bt->dropped);
70583 + atomic_inc_unchecked(&bt->dropped);
70584 return 0;
70585 }
70586
70587 @@ -477,7 +477,7 @@ int do_blk_trace_setup(struct request_qu
70588
70589 bt->dir = dir;
70590 bt->dev = dev;
70591 - atomic_set(&bt->dropped, 0);
70592 + atomic_set_unchecked(&bt->dropped, 0);
70593
70594 ret = -EIO;
70595 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
70596 diff -urNp linux-2.6.32.46/kernel/trace/ftrace.c linux-2.6.32.46/kernel/trace/ftrace.c
70597 --- linux-2.6.32.46/kernel/trace/ftrace.c 2011-06-25 12:55:35.000000000 -0400
70598 +++ linux-2.6.32.46/kernel/trace/ftrace.c 2011-06-25 12:56:37.000000000 -0400
70599 @@ -1100,13 +1100,18 @@ ftrace_code_disable(struct module *mod,
70600
70601 ip = rec->ip;
70602
70603 + ret = ftrace_arch_code_modify_prepare();
70604 + FTRACE_WARN_ON(ret);
70605 + if (ret)
70606 + return 0;
70607 +
70608 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
70609 + FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
70610 if (ret) {
70611 ftrace_bug(ret, ip);
70612 rec->flags |= FTRACE_FL_FAILED;
70613 - return 0;
70614 }
70615 - return 1;
70616 + return ret ? 0 : 1;
70617 }
70618
70619 /*
70620 diff -urNp linux-2.6.32.46/kernel/trace/ring_buffer.c linux-2.6.32.46/kernel/trace/ring_buffer.c
70621 --- linux-2.6.32.46/kernel/trace/ring_buffer.c 2011-03-27 14:31:47.000000000 -0400
70622 +++ linux-2.6.32.46/kernel/trace/ring_buffer.c 2011-04-17 15:56:46.000000000 -0400
70623 @@ -606,7 +606,7 @@ static struct list_head *rb_list_head(st
70624 * the reader page). But if the next page is a header page,
70625 * its flags will be non zero.
70626 */
70627 -static int inline
70628 +static inline int
70629 rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
70630 struct buffer_page *page, struct list_head *list)
70631 {
70632 diff -urNp linux-2.6.32.46/kernel/trace/trace.c linux-2.6.32.46/kernel/trace/trace.c
70633 --- linux-2.6.32.46/kernel/trace/trace.c 2011-03-27 14:31:47.000000000 -0400
70634 +++ linux-2.6.32.46/kernel/trace/trace.c 2011-05-16 21:46:57.000000000 -0400
70635 @@ -3193,6 +3193,8 @@ static ssize_t tracing_splice_read_pipe(
70636 size_t rem;
70637 unsigned int i;
70638
70639 + pax_track_stack();
70640 +
70641 /* copy the tracer to avoid using a global lock all around */
70642 mutex_lock(&trace_types_lock);
70643 if (unlikely(old_tracer != current_trace && current_trace)) {
70644 @@ -3659,6 +3661,8 @@ tracing_buffers_splice_read(struct file
70645 int entries, size, i;
70646 size_t ret;
70647
70648 + pax_track_stack();
70649 +
70650 if (*ppos & (PAGE_SIZE - 1)) {
70651 WARN_ONCE(1, "Ftrace: previous read must page-align\n");
70652 return -EINVAL;
70653 @@ -3816,10 +3820,9 @@ static const struct file_operations trac
70654 };
70655 #endif
70656
70657 -static struct dentry *d_tracer;
70658 -
70659 struct dentry *tracing_init_dentry(void)
70660 {
70661 + static struct dentry *d_tracer;
70662 static int once;
70663
70664 if (d_tracer)
70665 @@ -3839,10 +3842,9 @@ struct dentry *tracing_init_dentry(void)
70666 return d_tracer;
70667 }
70668
70669 -static struct dentry *d_percpu;
70670 -
70671 struct dentry *tracing_dentry_percpu(void)
70672 {
70673 + static struct dentry *d_percpu;
70674 static int once;
70675 struct dentry *d_tracer;
70676
70677 diff -urNp linux-2.6.32.46/kernel/trace/trace_events.c linux-2.6.32.46/kernel/trace/trace_events.c
70678 --- linux-2.6.32.46/kernel/trace/trace_events.c 2011-03-27 14:31:47.000000000 -0400
70679 +++ linux-2.6.32.46/kernel/trace/trace_events.c 2011-08-05 20:33:55.000000000 -0400
70680 @@ -951,13 +951,10 @@ static LIST_HEAD(ftrace_module_file_list
70681 * Modules must own their file_operations to keep up with
70682 * reference counting.
70683 */
70684 +
70685 struct ftrace_module_file_ops {
70686 struct list_head list;
70687 struct module *mod;
70688 - struct file_operations id;
70689 - struct file_operations enable;
70690 - struct file_operations format;
70691 - struct file_operations filter;
70692 };
70693
70694 static void remove_subsystem_dir(const char *name)
70695 @@ -1004,17 +1001,12 @@ trace_create_file_ops(struct module *mod
70696
70697 file_ops->mod = mod;
70698
70699 - file_ops->id = ftrace_event_id_fops;
70700 - file_ops->id.owner = mod;
70701 -
70702 - file_ops->enable = ftrace_enable_fops;
70703 - file_ops->enable.owner = mod;
70704 -
70705 - file_ops->filter = ftrace_event_filter_fops;
70706 - file_ops->filter.owner = mod;
70707 -
70708 - file_ops->format = ftrace_event_format_fops;
70709 - file_ops->format.owner = mod;
70710 + pax_open_kernel();
70711 + *(void **)&mod->trace_id.owner = mod;
70712 + *(void **)&mod->trace_enable.owner = mod;
70713 + *(void **)&mod->trace_filter.owner = mod;
70714 + *(void **)&mod->trace_format.owner = mod;
70715 + pax_close_kernel();
70716
70717 list_add(&file_ops->list, &ftrace_module_file_list);
70718
70719 @@ -1063,8 +1055,8 @@ static void trace_module_add_events(stru
70720 call->mod = mod;
70721 list_add(&call->list, &ftrace_events);
70722 event_create_dir(call, d_events,
70723 - &file_ops->id, &file_ops->enable,
70724 - &file_ops->filter, &file_ops->format);
70725 + &mod->trace_id, &mod->trace_enable,
70726 + &mod->trace_filter, &mod->trace_format);
70727 }
70728 }
70729
70730 diff -urNp linux-2.6.32.46/kernel/trace/trace_mmiotrace.c linux-2.6.32.46/kernel/trace/trace_mmiotrace.c
70731 --- linux-2.6.32.46/kernel/trace/trace_mmiotrace.c 2011-03-27 14:31:47.000000000 -0400
70732 +++ linux-2.6.32.46/kernel/trace/trace_mmiotrace.c 2011-05-04 17:56:28.000000000 -0400
70733 @@ -23,7 +23,7 @@ struct header_iter {
70734 static struct trace_array *mmio_trace_array;
70735 static bool overrun_detected;
70736 static unsigned long prev_overruns;
70737 -static atomic_t dropped_count;
70738 +static atomic_unchecked_t dropped_count;
70739
70740 static void mmio_reset_data(struct trace_array *tr)
70741 {
70742 @@ -126,7 +126,7 @@ static void mmio_close(struct trace_iter
70743
70744 static unsigned long count_overruns(struct trace_iterator *iter)
70745 {
70746 - unsigned long cnt = atomic_xchg(&dropped_count, 0);
70747 + unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
70748 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
70749
70750 if (over > prev_overruns)
70751 @@ -316,7 +316,7 @@ static void __trace_mmiotrace_rw(struct
70752 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
70753 sizeof(*entry), 0, pc);
70754 if (!event) {
70755 - atomic_inc(&dropped_count);
70756 + atomic_inc_unchecked(&dropped_count);
70757 return;
70758 }
70759 entry = ring_buffer_event_data(event);
70760 @@ -346,7 +346,7 @@ static void __trace_mmiotrace_map(struct
70761 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
70762 sizeof(*entry), 0, pc);
70763 if (!event) {
70764 - atomic_inc(&dropped_count);
70765 + atomic_inc_unchecked(&dropped_count);
70766 return;
70767 }
70768 entry = ring_buffer_event_data(event);
70769 diff -urNp linux-2.6.32.46/kernel/trace/trace_output.c linux-2.6.32.46/kernel/trace/trace_output.c
70770 --- linux-2.6.32.46/kernel/trace/trace_output.c 2011-03-27 14:31:47.000000000 -0400
70771 +++ linux-2.6.32.46/kernel/trace/trace_output.c 2011-04-17 15:56:46.000000000 -0400
70772 @@ -237,7 +237,7 @@ int trace_seq_path(struct trace_seq *s,
70773 return 0;
70774 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
70775 if (!IS_ERR(p)) {
70776 - p = mangle_path(s->buffer + s->len, p, "\n");
70777 + p = mangle_path(s->buffer + s->len, p, "\n\\");
70778 if (p) {
70779 s->len = p - s->buffer;
70780 return 1;
70781 diff -urNp linux-2.6.32.46/kernel/trace/trace_stack.c linux-2.6.32.46/kernel/trace/trace_stack.c
70782 --- linux-2.6.32.46/kernel/trace/trace_stack.c 2011-03-27 14:31:47.000000000 -0400
70783 +++ linux-2.6.32.46/kernel/trace/trace_stack.c 2011-04-17 15:56:46.000000000 -0400
70784 @@ -50,7 +50,7 @@ static inline void check_stack(void)
70785 return;
70786
70787 /* we do not handle interrupt stacks yet */
70788 - if (!object_is_on_stack(&this_size))
70789 + if (!object_starts_on_stack(&this_size))
70790 return;
70791
70792 local_irq_save(flags);
70793 diff -urNp linux-2.6.32.46/kernel/trace/trace_workqueue.c linux-2.6.32.46/kernel/trace/trace_workqueue.c
70794 --- linux-2.6.32.46/kernel/trace/trace_workqueue.c 2011-03-27 14:31:47.000000000 -0400
70795 +++ linux-2.6.32.46/kernel/trace/trace_workqueue.c 2011-04-17 15:56:46.000000000 -0400
70796 @@ -21,7 +21,7 @@ struct cpu_workqueue_stats {
70797 int cpu;
70798 pid_t pid;
70799 /* Can be inserted from interrupt or user context, need to be atomic */
70800 - atomic_t inserted;
70801 + atomic_unchecked_t inserted;
70802 /*
70803 * Don't need to be atomic, works are serialized in a single workqueue thread
70804 * on a single CPU.
70805 @@ -58,7 +58,7 @@ probe_workqueue_insertion(struct task_st
70806 spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
70807 list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
70808 if (node->pid == wq_thread->pid) {
70809 - atomic_inc(&node->inserted);
70810 + atomic_inc_unchecked(&node->inserted);
70811 goto found;
70812 }
70813 }
70814 @@ -205,7 +205,7 @@ static int workqueue_stat_show(struct se
70815 tsk = get_pid_task(pid, PIDTYPE_PID);
70816 if (tsk) {
70817 seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
70818 - atomic_read(&cws->inserted), cws->executed,
70819 + atomic_read_unchecked(&cws->inserted), cws->executed,
70820 tsk->comm);
70821 put_task_struct(tsk);
70822 }
70823 diff -urNp linux-2.6.32.46/kernel/user.c linux-2.6.32.46/kernel/user.c
70824 --- linux-2.6.32.46/kernel/user.c 2011-03-27 14:31:47.000000000 -0400
70825 +++ linux-2.6.32.46/kernel/user.c 2011-04-17 15:56:46.000000000 -0400
70826 @@ -159,6 +159,7 @@ struct user_struct *alloc_uid(struct use
70827 spin_lock_irq(&uidhash_lock);
70828 up = uid_hash_find(uid, hashent);
70829 if (up) {
70830 + put_user_ns(ns);
70831 key_put(new->uid_keyring);
70832 key_put(new->session_keyring);
70833 kmem_cache_free(uid_cachep, new);
70834 diff -urNp linux-2.6.32.46/lib/bitmap.c linux-2.6.32.46/lib/bitmap.c
70835 --- linux-2.6.32.46/lib/bitmap.c 2011-03-27 14:31:47.000000000 -0400
70836 +++ linux-2.6.32.46/lib/bitmap.c 2011-10-06 09:37:14.000000000 -0400
70837 @@ -341,7 +341,7 @@ int __bitmap_parse(const char *buf, unsi
70838 {
70839 int c, old_c, totaldigits, ndigits, nchunks, nbits;
70840 u32 chunk;
70841 - const char __user *ubuf = buf;
70842 + const char __user *ubuf = (const char __force_user *)buf;
70843
70844 bitmap_zero(maskp, nmaskbits);
70845
70846 @@ -426,7 +426,7 @@ int bitmap_parse_user(const char __user
70847 {
70848 if (!access_ok(VERIFY_READ, ubuf, ulen))
70849 return -EFAULT;
70850 - return __bitmap_parse((const char *)ubuf, ulen, 1, maskp, nmaskbits);
70851 + return __bitmap_parse((const char __force_kernel *)ubuf, ulen, 1, maskp, nmaskbits);
70852 }
70853 EXPORT_SYMBOL(bitmap_parse_user);
70854
70855 diff -urNp linux-2.6.32.46/lib/bug.c linux-2.6.32.46/lib/bug.c
70856 --- linux-2.6.32.46/lib/bug.c 2011-03-27 14:31:47.000000000 -0400
70857 +++ linux-2.6.32.46/lib/bug.c 2011-04-17 15:56:46.000000000 -0400
70858 @@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned l
70859 return BUG_TRAP_TYPE_NONE;
70860
70861 bug = find_bug(bugaddr);
70862 + if (!bug)
70863 + return BUG_TRAP_TYPE_NONE;
70864
70865 printk(KERN_EMERG "------------[ cut here ]------------\n");
70866
70867 diff -urNp linux-2.6.32.46/lib/debugobjects.c linux-2.6.32.46/lib/debugobjects.c
70868 --- linux-2.6.32.46/lib/debugobjects.c 2011-07-13 17:23:04.000000000 -0400
70869 +++ linux-2.6.32.46/lib/debugobjects.c 2011-07-13 17:23:19.000000000 -0400
70870 @@ -277,7 +277,7 @@ static void debug_object_is_on_stack(voi
70871 if (limit > 4)
70872 return;
70873
70874 - is_on_stack = object_is_on_stack(addr);
70875 + is_on_stack = object_starts_on_stack(addr);
70876 if (is_on_stack == onstack)
70877 return;
70878
70879 diff -urNp linux-2.6.32.46/lib/devres.c linux-2.6.32.46/lib/devres.c
70880 --- linux-2.6.32.46/lib/devres.c 2011-03-27 14:31:47.000000000 -0400
70881 +++ linux-2.6.32.46/lib/devres.c 2011-10-06 09:37:14.000000000 -0400
70882 @@ -80,7 +80,7 @@ void devm_iounmap(struct device *dev, vo
70883 {
70884 iounmap(addr);
70885 WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match,
70886 - (void *)addr));
70887 + (void __force *)addr));
70888 }
70889 EXPORT_SYMBOL(devm_iounmap);
70890
70891 @@ -140,7 +140,7 @@ void devm_ioport_unmap(struct device *de
70892 {
70893 ioport_unmap(addr);
70894 WARN_ON(devres_destroy(dev, devm_ioport_map_release,
70895 - devm_ioport_map_match, (void *)addr));
70896 + devm_ioport_map_match, (void __force *)addr));
70897 }
70898 EXPORT_SYMBOL(devm_ioport_unmap);
70899
70900 diff -urNp linux-2.6.32.46/lib/dma-debug.c linux-2.6.32.46/lib/dma-debug.c
70901 --- linux-2.6.32.46/lib/dma-debug.c 2011-03-27 14:31:47.000000000 -0400
70902 +++ linux-2.6.32.46/lib/dma-debug.c 2011-04-17 15:56:46.000000000 -0400
70903 @@ -861,7 +861,7 @@ out:
70904
70905 static void check_for_stack(struct device *dev, void *addr)
70906 {
70907 - if (object_is_on_stack(addr))
70908 + if (object_starts_on_stack(addr))
70909 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
70910 "stack [addr=%p]\n", addr);
70911 }
70912 diff -urNp linux-2.6.32.46/lib/idr.c linux-2.6.32.46/lib/idr.c
70913 --- linux-2.6.32.46/lib/idr.c 2011-03-27 14:31:47.000000000 -0400
70914 +++ linux-2.6.32.46/lib/idr.c 2011-04-17 15:56:46.000000000 -0400
70915 @@ -156,7 +156,7 @@ static int sub_alloc(struct idr *idp, in
70916 id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
70917
70918 /* if already at the top layer, we need to grow */
70919 - if (id >= 1 << (idp->layers * IDR_BITS)) {
70920 + if (id >= (1 << (idp->layers * IDR_BITS))) {
70921 *starting_id = id;
70922 return IDR_NEED_TO_GROW;
70923 }
70924 diff -urNp linux-2.6.32.46/lib/inflate.c linux-2.6.32.46/lib/inflate.c
70925 --- linux-2.6.32.46/lib/inflate.c 2011-03-27 14:31:47.000000000 -0400
70926 +++ linux-2.6.32.46/lib/inflate.c 2011-04-17 15:56:46.000000000 -0400
70927 @@ -266,7 +266,7 @@ static void free(void *where)
70928 malloc_ptr = free_mem_ptr;
70929 }
70930 #else
70931 -#define malloc(a) kmalloc(a, GFP_KERNEL)
70932 +#define malloc(a) kmalloc((a), GFP_KERNEL)
70933 #define free(a) kfree(a)
70934 #endif
70935
70936 diff -urNp linux-2.6.32.46/lib/Kconfig.debug linux-2.6.32.46/lib/Kconfig.debug
70937 --- linux-2.6.32.46/lib/Kconfig.debug 2011-03-27 14:31:47.000000000 -0400
70938 +++ linux-2.6.32.46/lib/Kconfig.debug 2011-04-17 15:56:46.000000000 -0400
70939 @@ -905,7 +905,7 @@ config LATENCYTOP
70940 select STACKTRACE
70941 select SCHEDSTATS
70942 select SCHED_DEBUG
70943 - depends on HAVE_LATENCYTOP_SUPPORT
70944 + depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
70945 help
70946 Enable this option if you want to use the LatencyTOP tool
70947 to find out which userspace is blocking on what kernel operations.
70948 diff -urNp linux-2.6.32.46/lib/kobject.c linux-2.6.32.46/lib/kobject.c
70949 --- linux-2.6.32.46/lib/kobject.c 2011-03-27 14:31:47.000000000 -0400
70950 +++ linux-2.6.32.46/lib/kobject.c 2011-04-17 15:56:46.000000000 -0400
70951 @@ -700,7 +700,7 @@ static ssize_t kobj_attr_store(struct ko
70952 return ret;
70953 }
70954
70955 -struct sysfs_ops kobj_sysfs_ops = {
70956 +const struct sysfs_ops kobj_sysfs_ops = {
70957 .show = kobj_attr_show,
70958 .store = kobj_attr_store,
70959 };
70960 @@ -789,7 +789,7 @@ static struct kobj_type kset_ktype = {
70961 * If the kset was not able to be created, NULL will be returned.
70962 */
70963 static struct kset *kset_create(const char *name,
70964 - struct kset_uevent_ops *uevent_ops,
70965 + const struct kset_uevent_ops *uevent_ops,
70966 struct kobject *parent_kobj)
70967 {
70968 struct kset *kset;
70969 @@ -832,7 +832,7 @@ static struct kset *kset_create(const ch
70970 * If the kset was not able to be created, NULL will be returned.
70971 */
70972 struct kset *kset_create_and_add(const char *name,
70973 - struct kset_uevent_ops *uevent_ops,
70974 + const struct kset_uevent_ops *uevent_ops,
70975 struct kobject *parent_kobj)
70976 {
70977 struct kset *kset;
70978 diff -urNp linux-2.6.32.46/lib/kobject_uevent.c linux-2.6.32.46/lib/kobject_uevent.c
70979 --- linux-2.6.32.46/lib/kobject_uevent.c 2011-03-27 14:31:47.000000000 -0400
70980 +++ linux-2.6.32.46/lib/kobject_uevent.c 2011-04-17 15:56:46.000000000 -0400
70981 @@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *k
70982 const char *subsystem;
70983 struct kobject *top_kobj;
70984 struct kset *kset;
70985 - struct kset_uevent_ops *uevent_ops;
70986 + const struct kset_uevent_ops *uevent_ops;
70987 u64 seq;
70988 int i = 0;
70989 int retval = 0;
70990 diff -urNp linux-2.6.32.46/lib/kref.c linux-2.6.32.46/lib/kref.c
70991 --- linux-2.6.32.46/lib/kref.c 2011-03-27 14:31:47.000000000 -0400
70992 +++ linux-2.6.32.46/lib/kref.c 2011-04-17 15:56:46.000000000 -0400
70993 @@ -61,7 +61,7 @@ void kref_get(struct kref *kref)
70994 */
70995 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
70996 {
70997 - WARN_ON(release == NULL);
70998 + BUG_ON(release == NULL);
70999 WARN_ON(release == (void (*)(struct kref *))kfree);
71000
71001 if (atomic_dec_and_test(&kref->refcount)) {
71002 diff -urNp linux-2.6.32.46/lib/parser.c linux-2.6.32.46/lib/parser.c
71003 --- linux-2.6.32.46/lib/parser.c 2011-03-27 14:31:47.000000000 -0400
71004 +++ linux-2.6.32.46/lib/parser.c 2011-04-17 15:56:46.000000000 -0400
71005 @@ -126,7 +126,7 @@ static int match_number(substring_t *s,
71006 char *buf;
71007 int ret;
71008
71009 - buf = kmalloc(s->to - s->from + 1, GFP_KERNEL);
71010 + buf = kmalloc((s->to - s->from) + 1, GFP_KERNEL);
71011 if (!buf)
71012 return -ENOMEM;
71013 memcpy(buf, s->from, s->to - s->from);
71014 diff -urNp linux-2.6.32.46/lib/radix-tree.c linux-2.6.32.46/lib/radix-tree.c
71015 --- linux-2.6.32.46/lib/radix-tree.c 2011-03-27 14:31:47.000000000 -0400
71016 +++ linux-2.6.32.46/lib/radix-tree.c 2011-04-17 15:56:46.000000000 -0400
71017 @@ -81,7 +81,7 @@ struct radix_tree_preload {
71018 int nr;
71019 struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
71020 };
71021 -static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
71022 +static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
71023
71024 static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
71025 {
71026 diff -urNp linux-2.6.32.46/lib/random32.c linux-2.6.32.46/lib/random32.c
71027 --- linux-2.6.32.46/lib/random32.c 2011-03-27 14:31:47.000000000 -0400
71028 +++ linux-2.6.32.46/lib/random32.c 2011-04-17 15:56:46.000000000 -0400
71029 @@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *
71030 */
71031 static inline u32 __seed(u32 x, u32 m)
71032 {
71033 - return (x < m) ? x + m : x;
71034 + return (x <= m) ? x + m + 1 : x;
71035 }
71036
71037 /**
71038 diff -urNp linux-2.6.32.46/lib/vsprintf.c linux-2.6.32.46/lib/vsprintf.c
71039 --- linux-2.6.32.46/lib/vsprintf.c 2011-03-27 14:31:47.000000000 -0400
71040 +++ linux-2.6.32.46/lib/vsprintf.c 2011-04-17 15:56:46.000000000 -0400
71041 @@ -16,6 +16,9 @@
71042 * - scnprintf and vscnprintf
71043 */
71044
71045 +#ifdef CONFIG_GRKERNSEC_HIDESYM
71046 +#define __INCLUDED_BY_HIDESYM 1
71047 +#endif
71048 #include <stdarg.h>
71049 #include <linux/module.h>
71050 #include <linux/types.h>
71051 @@ -546,12 +549,12 @@ static char *number(char *buf, char *end
71052 return buf;
71053 }
71054
71055 -static char *string(char *buf, char *end, char *s, struct printf_spec spec)
71056 +static char *string(char *buf, char *end, const char *s, struct printf_spec spec)
71057 {
71058 int len, i;
71059
71060 if ((unsigned long)s < PAGE_SIZE)
71061 - s = "<NULL>";
71062 + s = "(null)";
71063
71064 len = strnlen(s, spec.precision);
71065
71066 @@ -581,7 +584,7 @@ static char *symbol_string(char *buf, ch
71067 unsigned long value = (unsigned long) ptr;
71068 #ifdef CONFIG_KALLSYMS
71069 char sym[KSYM_SYMBOL_LEN];
71070 - if (ext != 'f' && ext != 's')
71071 + if (ext != 'f' && ext != 's' && ext != 'a')
71072 sprint_symbol(sym, value);
71073 else
71074 kallsyms_lookup(value, NULL, NULL, NULL, sym);
71075 @@ -801,6 +804,8 @@ static char *ip4_addr_string(char *buf,
71076 * - 'f' For simple symbolic function names without offset
71077 * - 'S' For symbolic direct pointers with offset
71078 * - 's' For symbolic direct pointers without offset
71079 + * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
71080 + * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
71081 * - 'R' For a struct resource pointer, it prints the range of
71082 * addresses (not the name nor the flags)
71083 * - 'M' For a 6-byte MAC address, it prints the address in the
71084 @@ -822,7 +827,7 @@ static char *pointer(const char *fmt, ch
71085 struct printf_spec spec)
71086 {
71087 if (!ptr)
71088 - return string(buf, end, "(null)", spec);
71089 + return string(buf, end, "(nil)", spec);
71090
71091 switch (*fmt) {
71092 case 'F':
71093 @@ -831,6 +836,14 @@ static char *pointer(const char *fmt, ch
71094 case 's':
71095 /* Fallthrough */
71096 case 'S':
71097 +#ifdef CONFIG_GRKERNSEC_HIDESYM
71098 + break;
71099 +#else
71100 + return symbol_string(buf, end, ptr, spec, *fmt);
71101 +#endif
71102 + case 'a':
71103 + /* Fallthrough */
71104 + case 'A':
71105 return symbol_string(buf, end, ptr, spec, *fmt);
71106 case 'R':
71107 return resource_string(buf, end, ptr, spec);
71108 @@ -1445,7 +1458,7 @@ do { \
71109 size_t len;
71110 if ((unsigned long)save_str > (unsigned long)-PAGE_SIZE
71111 || (unsigned long)save_str < PAGE_SIZE)
71112 - save_str = "<NULL>";
71113 + save_str = "(null)";
71114 len = strlen(save_str);
71115 if (str + len + 1 < end)
71116 memcpy(str, save_str, len + 1);
71117 @@ -1555,11 +1568,11 @@ int bstr_printf(char *buf, size_t size,
71118 typeof(type) value; \
71119 if (sizeof(type) == 8) { \
71120 args = PTR_ALIGN(args, sizeof(u32)); \
71121 - *(u32 *)&value = *(u32 *)args; \
71122 - *((u32 *)&value + 1) = *(u32 *)(args + 4); \
71123 + *(u32 *)&value = *(const u32 *)args; \
71124 + *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
71125 } else { \
71126 args = PTR_ALIGN(args, sizeof(type)); \
71127 - value = *(typeof(type) *)args; \
71128 + value = *(const typeof(type) *)args; \
71129 } \
71130 args += sizeof(type); \
71131 value; \
71132 @@ -1622,7 +1635,7 @@ int bstr_printf(char *buf, size_t size,
71133 const char *str_arg = args;
71134 size_t len = strlen(str_arg);
71135 args += len + 1;
71136 - str = string(str, end, (char *)str_arg, spec);
71137 + str = string(str, end, str_arg, spec);
71138 break;
71139 }
71140
71141 diff -urNp linux-2.6.32.46/localversion-grsec linux-2.6.32.46/localversion-grsec
71142 --- linux-2.6.32.46/localversion-grsec 1969-12-31 19:00:00.000000000 -0500
71143 +++ linux-2.6.32.46/localversion-grsec 2011-04-17 15:56:46.000000000 -0400
71144 @@ -0,0 +1 @@
71145 +-grsec
71146 diff -urNp linux-2.6.32.46/Makefile linux-2.6.32.46/Makefile
71147 --- linux-2.6.32.46/Makefile 2011-08-29 22:24:44.000000000 -0400
71148 +++ linux-2.6.32.46/Makefile 2011-10-08 08:14:40.000000000 -0400
71149 @@ -221,8 +221,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
71150
71151 HOSTCC = gcc
71152 HOSTCXX = g++
71153 -HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
71154 -HOSTCXXFLAGS = -O2
71155 +HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
71156 +HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
71157 +HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
71158
71159 # Decide whether to build built-in, modular, or both.
71160 # Normally, just do built-in.
71161 @@ -342,10 +343,12 @@ LINUXINCLUDE := -Iinclude \
71162 KBUILD_CPPFLAGS := -D__KERNEL__
71163
71164 KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
71165 + -W -Wno-unused-parameter -Wno-missing-field-initializers \
71166 -fno-strict-aliasing -fno-common \
71167 -Werror-implicit-function-declaration \
71168 -Wno-format-security \
71169 -fno-delete-null-pointer-checks
71170 +KBUILD_CFLAGS += $(call cc-option, -Wno-empty-body)
71171 KBUILD_AFLAGS := -D__ASSEMBLY__
71172
71173 # Read KERNELRELEASE from include/config/kernel.release (if it exists)
71174 @@ -376,8 +379,8 @@ export RCS_TAR_IGNORE := --exclude SCCS
71175 # Rules shared between *config targets and build targets
71176
71177 # Basic helpers built in scripts/
71178 -PHONY += scripts_basic
71179 -scripts_basic:
71180 +PHONY += scripts_basic gcc-plugins
71181 +scripts_basic: gcc-plugins
71182 $(Q)$(MAKE) $(build)=scripts/basic
71183
71184 # To avoid any implicit rule to kick in, define an empty command.
71185 @@ -403,7 +406,7 @@ endif
71186 # of make so .config is not included in this case either (for *config).
71187
71188 no-dot-config-targets := clean mrproper distclean \
71189 - cscope TAGS tags help %docs check% \
71190 + cscope gtags TAGS tags help %docs check% \
71191 include/linux/version.h headers_% \
71192 kernelrelease kernelversion
71193
71194 @@ -526,6 +529,36 @@ else
71195 KBUILD_CFLAGS += -O2
71196 endif
71197
71198 +ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(CC)"), y)
71199 +CONSTIFY_PLUGIN := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
71200 +ifdef CONFIG_PAX_MEMORY_STACKLEAK
71201 +STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -fplugin-arg-stackleak_plugin-track-lowest-sp=100
71202 +endif
71203 +ifdef CONFIG_KALLOCSTAT_PLUGIN
71204 +KALLOCSTAT_PLUGIN := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
71205 +endif
71206 +ifdef CONFIG_PAX_KERNEXEC_PLUGIN
71207 +KERNEXEC_PLUGIN := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
71208 +endif
71209 +ifdef CONFIG_CHECKER_PLUGIN
71210 +ifeq ($(call cc-ifversion, -ge, 0406, y), y)
71211 +CHECKER_PLUGIN := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
71212 +endif
71213 +endif
71214 +GCC_PLUGINS := $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) $(KALLOCSTAT_PLUGIN) $(KERNEXEC_PLUGIN) $(CHECKER_PLUGIN)
71215 +export CONSTIFY_PLUGIN STACKLEAK_PLUGIN KERNEXEC_PLUGIN CHECKER_PLUGIN
71216 +gcc-plugins:
71217 + $(Q)$(MAKE) $(build)=tools/gcc
71218 +else
71219 +gcc-plugins:
71220 +ifeq ($(call cc-ifversion, -ge, 0405, y), y)
71221 + $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev.))
71222 +else
71223 + $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
71224 +endif
71225 + $(Q)echo "PAX_MEMORY_STACKLEAK and constification will be less secure"
71226 +endif
71227 +
71228 include $(srctree)/arch/$(SRCARCH)/Makefile
71229
71230 ifneq ($(CONFIG_FRAME_WARN),0)
71231 @@ -644,7 +677,7 @@ export mod_strip_cmd
71232
71233
71234 ifeq ($(KBUILD_EXTMOD),)
71235 -core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
71236 +core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
71237
71238 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
71239 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
71240 @@ -865,6 +898,7 @@ vmlinux.o: $(modpost-init) $(vmlinux-mai
71241
71242 # The actual objects are generated when descending,
71243 # make sure no implicit rule kicks in
71244 +$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): KBUILD_CFLAGS += $(GCC_PLUGINS)
71245 $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
71246
71247 # Handle descending into subdirectories listed in $(vmlinux-dirs)
71248 @@ -874,7 +908,7 @@ $(sort $(vmlinux-init) $(vmlinux-main))
71249 # Error messages still appears in the original language
71250
71251 PHONY += $(vmlinux-dirs)
71252 -$(vmlinux-dirs): prepare scripts
71253 +$(vmlinux-dirs): gcc-plugins prepare scripts
71254 $(Q)$(MAKE) $(build)=$@
71255
71256 # Build the kernel release string
71257 @@ -983,6 +1017,7 @@ prepare0: archprepare FORCE
71258 $(Q)$(MAKE) $(build)=. missing-syscalls
71259
71260 # All the preparing..
71261 +prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS),$(KBUILD_CFLAGS))
71262 prepare: prepare0
71263
71264 # The asm symlink changes when $(ARCH) changes.
71265 @@ -1124,6 +1159,7 @@ all: modules
71266 # using awk while concatenating to the final file.
71267
71268 PHONY += modules
71269 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
71270 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux)
71271 $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
71272 @$(kecho) ' Building modules, stage 2.';
71273 @@ -1133,7 +1169,7 @@ modules: $(vmlinux-dirs) $(if $(KBUILD_B
71274
71275 # Target to prepare building external modules
71276 PHONY += modules_prepare
71277 -modules_prepare: prepare scripts
71278 +modules_prepare: gcc-plugins prepare scripts
71279
71280 # Target to install modules
71281 PHONY += modules_install
71282 @@ -1198,7 +1234,7 @@ MRPROPER_FILES += .config .config.old in
71283 include/linux/autoconf.h include/linux/version.h \
71284 include/linux/utsrelease.h \
71285 include/linux/bounds.h include/asm*/asm-offsets.h \
71286 - Module.symvers Module.markers tags TAGS cscope*
71287 + Module.symvers Module.markers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS
71288
71289 # clean - Delete most, but leave enough to build external modules
71290 #
71291 @@ -1242,7 +1278,7 @@ distclean: mrproper
71292 @find $(srctree) $(RCS_FIND_IGNORE) \
71293 \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
71294 -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
71295 - -o -name '.*.rej' -o -size 0 \
71296 + -o -name '.*.rej' -o -name '*.so' -o -size 0 \
71297 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
71298 -type f -print | xargs rm -f
71299
71300 @@ -1289,6 +1325,7 @@ help:
71301 @echo ' modules_prepare - Set up for building external modules'
71302 @echo ' tags/TAGS - Generate tags file for editors'
71303 @echo ' cscope - Generate cscope index'
71304 + @echo ' gtags - Generate GNU GLOBAL index'
71305 @echo ' kernelrelease - Output the release version string'
71306 @echo ' kernelversion - Output the version stored in Makefile'
71307 @echo ' headers_install - Install sanitised kernel headers to INSTALL_HDR_PATH'; \
71308 @@ -1390,6 +1427,7 @@ PHONY += $(module-dirs) modules
71309 $(module-dirs): crmodverdir $(objtree)/Module.symvers
71310 $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
71311
71312 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
71313 modules: $(module-dirs)
71314 @$(kecho) ' Building modules, stage 2.';
71315 $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
71316 @@ -1445,7 +1483,7 @@ endif # KBUILD_EXTMOD
71317 quiet_cmd_tags = GEN $@
71318 cmd_tags = $(CONFIG_SHELL) $(srctree)/scripts/tags.sh $@
71319
71320 -tags TAGS cscope: FORCE
71321 +tags TAGS cscope gtags: FORCE
71322 $(call cmd,tags)
71323
71324 # Scripts to check various things for consistency
71325 @@ -1510,17 +1548,19 @@ else
71326 target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
71327 endif
71328
71329 -%.s: %.c prepare scripts FORCE
71330 +%.s: KBUILD_CFLAGS += $(GCC_PLUGINS)
71331 +%.s: %.c gcc-plugins prepare scripts FORCE
71332 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
71333 %.i: %.c prepare scripts FORCE
71334 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
71335 -%.o: %.c prepare scripts FORCE
71336 +%.o: KBUILD_CFLAGS += $(GCC_PLUGINS)
71337 +%.o: %.c gcc-plugins prepare scripts FORCE
71338 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
71339 %.lst: %.c prepare scripts FORCE
71340 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
71341 -%.s: %.S prepare scripts FORCE
71342 +%.s: %.S gcc-plugins prepare scripts FORCE
71343 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
71344 -%.o: %.S prepare scripts FORCE
71345 +%.o: %.S gcc-plugins prepare scripts FORCE
71346 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
71347 %.symtypes: %.c prepare scripts FORCE
71348 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
71349 @@ -1530,11 +1570,13 @@ endif
71350 $(cmd_crmodverdir)
71351 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
71352 $(build)=$(build-dir)
71353 -%/: prepare scripts FORCE
71354 +%/: KBUILD_CFLAGS += $(GCC_PLUGINS)
71355 +%/: gcc-plugins prepare scripts FORCE
71356 $(cmd_crmodverdir)
71357 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
71358 $(build)=$(build-dir)
71359 -%.ko: prepare scripts FORCE
71360 +%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS)
71361 +%.ko: gcc-plugins prepare scripts FORCE
71362 $(cmd_crmodverdir)
71363 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
71364 $(build)=$(build-dir) $(@:.ko=.o)
71365 diff -urNp linux-2.6.32.46/mm/backing-dev.c linux-2.6.32.46/mm/backing-dev.c
71366 --- linux-2.6.32.46/mm/backing-dev.c 2011-03-27 14:31:47.000000000 -0400
71367 +++ linux-2.6.32.46/mm/backing-dev.c 2011-08-11 19:48:17.000000000 -0400
71368 @@ -272,7 +272,7 @@ static void bdi_task_init(struct backing
71369 list_add_tail_rcu(&wb->list, &bdi->wb_list);
71370 spin_unlock(&bdi->wb_lock);
71371
71372 - tsk->flags |= PF_FLUSHER | PF_SWAPWRITE;
71373 + tsk->flags |= PF_SWAPWRITE;
71374 set_freezable();
71375
71376 /*
71377 @@ -484,7 +484,7 @@ static void bdi_add_to_pending(struct rc
71378 * Add the default flusher task that gets created for any bdi
71379 * that has dirty data pending writeout
71380 */
71381 -void static bdi_add_default_flusher_task(struct backing_dev_info *bdi)
71382 +static void bdi_add_default_flusher_task(struct backing_dev_info *bdi)
71383 {
71384 if (!bdi_cap_writeback_dirty(bdi))
71385 return;
71386 diff -urNp linux-2.6.32.46/mm/filemap.c linux-2.6.32.46/mm/filemap.c
71387 --- linux-2.6.32.46/mm/filemap.c 2011-03-27 14:31:47.000000000 -0400
71388 +++ linux-2.6.32.46/mm/filemap.c 2011-04-17 15:56:46.000000000 -0400
71389 @@ -1631,7 +1631,7 @@ int generic_file_mmap(struct file * file
71390 struct address_space *mapping = file->f_mapping;
71391
71392 if (!mapping->a_ops->readpage)
71393 - return -ENOEXEC;
71394 + return -ENODEV;
71395 file_accessed(file);
71396 vma->vm_ops = &generic_file_vm_ops;
71397 vma->vm_flags |= VM_CAN_NONLINEAR;
71398 @@ -2027,6 +2027,7 @@ inline int generic_write_checks(struct f
71399 *pos = i_size_read(inode);
71400
71401 if (limit != RLIM_INFINITY) {
71402 + gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
71403 if (*pos >= limit) {
71404 send_sig(SIGXFSZ, current, 0);
71405 return -EFBIG;
71406 diff -urNp linux-2.6.32.46/mm/fremap.c linux-2.6.32.46/mm/fremap.c
71407 --- linux-2.6.32.46/mm/fremap.c 2011-03-27 14:31:47.000000000 -0400
71408 +++ linux-2.6.32.46/mm/fremap.c 2011-04-17 15:56:46.000000000 -0400
71409 @@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
71410 retry:
71411 vma = find_vma(mm, start);
71412
71413 +#ifdef CONFIG_PAX_SEGMEXEC
71414 + if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
71415 + goto out;
71416 +#endif
71417 +
71418 /*
71419 * Make sure the vma is shared, that it supports prefaulting,
71420 * and that the remapped range is valid and fully within
71421 @@ -221,7 +226,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
71422 /*
71423 * drop PG_Mlocked flag for over-mapped range
71424 */
71425 - unsigned int saved_flags = vma->vm_flags;
71426 + unsigned long saved_flags = vma->vm_flags;
71427 munlock_vma_pages_range(vma, start, start + size);
71428 vma->vm_flags = saved_flags;
71429 }
71430 diff -urNp linux-2.6.32.46/mm/highmem.c linux-2.6.32.46/mm/highmem.c
71431 --- linux-2.6.32.46/mm/highmem.c 2011-03-27 14:31:47.000000000 -0400
71432 +++ linux-2.6.32.46/mm/highmem.c 2011-04-17 15:56:46.000000000 -0400
71433 @@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
71434 * So no dangers, even with speculative execution.
71435 */
71436 page = pte_page(pkmap_page_table[i]);
71437 + pax_open_kernel();
71438 pte_clear(&init_mm, (unsigned long)page_address(page),
71439 &pkmap_page_table[i]);
71440 -
71441 + pax_close_kernel();
71442 set_page_address(page, NULL);
71443 need_flush = 1;
71444 }
71445 @@ -177,9 +178,11 @@ start:
71446 }
71447 }
71448 vaddr = PKMAP_ADDR(last_pkmap_nr);
71449 +
71450 + pax_open_kernel();
71451 set_pte_at(&init_mm, vaddr,
71452 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
71453 -
71454 + pax_close_kernel();
71455 pkmap_count[last_pkmap_nr] = 1;
71456 set_page_address(page, (void *)vaddr);
71457
71458 diff -urNp linux-2.6.32.46/mm/hugetlb.c linux-2.6.32.46/mm/hugetlb.c
71459 --- linux-2.6.32.46/mm/hugetlb.c 2011-07-13 17:23:04.000000000 -0400
71460 +++ linux-2.6.32.46/mm/hugetlb.c 2011-07-13 17:23:19.000000000 -0400
71461 @@ -1933,6 +1933,26 @@ static int unmap_ref_private(struct mm_s
71462 return 1;
71463 }
71464
71465 +#ifdef CONFIG_PAX_SEGMEXEC
71466 +static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
71467 +{
71468 + struct mm_struct *mm = vma->vm_mm;
71469 + struct vm_area_struct *vma_m;
71470 + unsigned long address_m;
71471 + pte_t *ptep_m;
71472 +
71473 + vma_m = pax_find_mirror_vma(vma);
71474 + if (!vma_m)
71475 + return;
71476 +
71477 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71478 + address_m = address + SEGMEXEC_TASK_SIZE;
71479 + ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
71480 + get_page(page_m);
71481 + set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
71482 +}
71483 +#endif
71484 +
71485 static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
71486 unsigned long address, pte_t *ptep, pte_t pte,
71487 struct page *pagecache_page)
71488 @@ -2004,6 +2024,11 @@ retry_avoidcopy:
71489 huge_ptep_clear_flush(vma, address, ptep);
71490 set_huge_pte_at(mm, address, ptep,
71491 make_huge_pte(vma, new_page, 1));
71492 +
71493 +#ifdef CONFIG_PAX_SEGMEXEC
71494 + pax_mirror_huge_pte(vma, address, new_page);
71495 +#endif
71496 +
71497 /* Make the old page be freed below */
71498 new_page = old_page;
71499 }
71500 @@ -2135,6 +2160,10 @@ retry:
71501 && (vma->vm_flags & VM_SHARED)));
71502 set_huge_pte_at(mm, address, ptep, new_pte);
71503
71504 +#ifdef CONFIG_PAX_SEGMEXEC
71505 + pax_mirror_huge_pte(vma, address, page);
71506 +#endif
71507 +
71508 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
71509 /* Optimization, do the COW without a second fault */
71510 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
71511 @@ -2163,6 +2192,28 @@ int hugetlb_fault(struct mm_struct *mm,
71512 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
71513 struct hstate *h = hstate_vma(vma);
71514
71515 +#ifdef CONFIG_PAX_SEGMEXEC
71516 + struct vm_area_struct *vma_m;
71517 +
71518 + vma_m = pax_find_mirror_vma(vma);
71519 + if (vma_m) {
71520 + unsigned long address_m;
71521 +
71522 + if (vma->vm_start > vma_m->vm_start) {
71523 + address_m = address;
71524 + address -= SEGMEXEC_TASK_SIZE;
71525 + vma = vma_m;
71526 + h = hstate_vma(vma);
71527 + } else
71528 + address_m = address + SEGMEXEC_TASK_SIZE;
71529 +
71530 + if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
71531 + return VM_FAULT_OOM;
71532 + address_m &= HPAGE_MASK;
71533 + unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
71534 + }
71535 +#endif
71536 +
71537 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
71538 if (!ptep)
71539 return VM_FAULT_OOM;
71540 diff -urNp linux-2.6.32.46/mm/internal.h linux-2.6.32.46/mm/internal.h
71541 --- linux-2.6.32.46/mm/internal.h 2011-03-27 14:31:47.000000000 -0400
71542 +++ linux-2.6.32.46/mm/internal.h 2011-07-09 09:13:08.000000000 -0400
71543 @@ -49,6 +49,7 @@ extern void putback_lru_page(struct page
71544 * in mm/page_alloc.c
71545 */
71546 extern void __free_pages_bootmem(struct page *page, unsigned int order);
71547 +extern void free_compound_page(struct page *page);
71548 extern void prep_compound_page(struct page *page, unsigned long order);
71549
71550
71551 diff -urNp linux-2.6.32.46/mm/Kconfig linux-2.6.32.46/mm/Kconfig
71552 --- linux-2.6.32.46/mm/Kconfig 2011-03-27 14:31:47.000000000 -0400
71553 +++ linux-2.6.32.46/mm/Kconfig 2011-04-17 15:56:46.000000000 -0400
71554 @@ -228,7 +228,7 @@ config KSM
71555 config DEFAULT_MMAP_MIN_ADDR
71556 int "Low address space to protect from user allocation"
71557 depends on MMU
71558 - default 4096
71559 + default 65536
71560 help
71561 This is the portion of low virtual memory which should be protected
71562 from userspace allocation. Keeping a user from writing to low pages
71563 diff -urNp linux-2.6.32.46/mm/kmemleak.c linux-2.6.32.46/mm/kmemleak.c
71564 --- linux-2.6.32.46/mm/kmemleak.c 2011-06-25 12:55:35.000000000 -0400
71565 +++ linux-2.6.32.46/mm/kmemleak.c 2011-06-25 12:56:37.000000000 -0400
71566 @@ -358,7 +358,7 @@ static void print_unreferenced(struct se
71567
71568 for (i = 0; i < object->trace_len; i++) {
71569 void *ptr = (void *)object->trace[i];
71570 - seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
71571 + seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
71572 }
71573 }
71574
71575 diff -urNp linux-2.6.32.46/mm/maccess.c linux-2.6.32.46/mm/maccess.c
71576 --- linux-2.6.32.46/mm/maccess.c 2011-03-27 14:31:47.000000000 -0400
71577 +++ linux-2.6.32.46/mm/maccess.c 2011-10-06 09:37:14.000000000 -0400
71578 @@ -14,7 +14,7 @@
71579 * Safely read from address @src to the buffer at @dst. If a kernel fault
71580 * happens, handle that and return -EFAULT.
71581 */
71582 -long probe_kernel_read(void *dst, void *src, size_t size)
71583 +long probe_kernel_read(void *dst, const void *src, size_t size)
71584 {
71585 long ret;
71586 mm_segment_t old_fs = get_fs();
71587 @@ -22,7 +22,7 @@ long probe_kernel_read(void *dst, void *
71588 set_fs(KERNEL_DS);
71589 pagefault_disable();
71590 ret = __copy_from_user_inatomic(dst,
71591 - (__force const void __user *)src, size);
71592 + (const void __force_user *)src, size);
71593 pagefault_enable();
71594 set_fs(old_fs);
71595
71596 @@ -39,14 +39,14 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
71597 * Safely write to address @dst from the buffer at @src. If a kernel fault
71598 * happens, handle that and return -EFAULT.
71599 */
71600 -long notrace __weak probe_kernel_write(void *dst, void *src, size_t size)
71601 +long notrace __weak probe_kernel_write(void *dst, const void *src, size_t size)
71602 {
71603 long ret;
71604 mm_segment_t old_fs = get_fs();
71605
71606 set_fs(KERNEL_DS);
71607 pagefault_disable();
71608 - ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
71609 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
71610 pagefault_enable();
71611 set_fs(old_fs);
71612
71613 diff -urNp linux-2.6.32.46/mm/madvise.c linux-2.6.32.46/mm/madvise.c
71614 --- linux-2.6.32.46/mm/madvise.c 2011-03-27 14:31:47.000000000 -0400
71615 +++ linux-2.6.32.46/mm/madvise.c 2011-04-17 15:56:46.000000000 -0400
71616 @@ -44,6 +44,10 @@ static long madvise_behavior(struct vm_a
71617 pgoff_t pgoff;
71618 unsigned long new_flags = vma->vm_flags;
71619
71620 +#ifdef CONFIG_PAX_SEGMEXEC
71621 + struct vm_area_struct *vma_m;
71622 +#endif
71623 +
71624 switch (behavior) {
71625 case MADV_NORMAL:
71626 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
71627 @@ -103,6 +107,13 @@ success:
71628 /*
71629 * vm_flags is protected by the mmap_sem held in write mode.
71630 */
71631 +
71632 +#ifdef CONFIG_PAX_SEGMEXEC
71633 + vma_m = pax_find_mirror_vma(vma);
71634 + if (vma_m)
71635 + vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
71636 +#endif
71637 +
71638 vma->vm_flags = new_flags;
71639
71640 out:
71641 @@ -161,6 +172,11 @@ static long madvise_dontneed(struct vm_a
71642 struct vm_area_struct ** prev,
71643 unsigned long start, unsigned long end)
71644 {
71645 +
71646 +#ifdef CONFIG_PAX_SEGMEXEC
71647 + struct vm_area_struct *vma_m;
71648 +#endif
71649 +
71650 *prev = vma;
71651 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
71652 return -EINVAL;
71653 @@ -173,6 +189,21 @@ static long madvise_dontneed(struct vm_a
71654 zap_page_range(vma, start, end - start, &details);
71655 } else
71656 zap_page_range(vma, start, end - start, NULL);
71657 +
71658 +#ifdef CONFIG_PAX_SEGMEXEC
71659 + vma_m = pax_find_mirror_vma(vma);
71660 + if (vma_m) {
71661 + if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
71662 + struct zap_details details = {
71663 + .nonlinear_vma = vma_m,
71664 + .last_index = ULONG_MAX,
71665 + };
71666 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
71667 + } else
71668 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
71669 + }
71670 +#endif
71671 +
71672 return 0;
71673 }
71674
71675 @@ -359,6 +390,16 @@ SYSCALL_DEFINE3(madvise, unsigned long,
71676 if (end < start)
71677 goto out;
71678
71679 +#ifdef CONFIG_PAX_SEGMEXEC
71680 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
71681 + if (end > SEGMEXEC_TASK_SIZE)
71682 + goto out;
71683 + } else
71684 +#endif
71685 +
71686 + if (end > TASK_SIZE)
71687 + goto out;
71688 +
71689 error = 0;
71690 if (end == start)
71691 goto out;
71692 diff -urNp linux-2.6.32.46/mm/memory.c linux-2.6.32.46/mm/memory.c
71693 --- linux-2.6.32.46/mm/memory.c 2011-07-13 17:23:04.000000000 -0400
71694 +++ linux-2.6.32.46/mm/memory.c 2011-07-13 17:23:23.000000000 -0400
71695 @@ -187,8 +187,12 @@ static inline void free_pmd_range(struct
71696 return;
71697
71698 pmd = pmd_offset(pud, start);
71699 +
71700 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
71701 pud_clear(pud);
71702 pmd_free_tlb(tlb, pmd, start);
71703 +#endif
71704 +
71705 }
71706
71707 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
71708 @@ -219,9 +223,12 @@ static inline void free_pud_range(struct
71709 if (end - 1 > ceiling - 1)
71710 return;
71711
71712 +#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
71713 pud = pud_offset(pgd, start);
71714 pgd_clear(pgd);
71715 pud_free_tlb(tlb, pud, start);
71716 +#endif
71717 +
71718 }
71719
71720 /*
71721 @@ -1251,10 +1258,10 @@ int __get_user_pages(struct task_struct
71722 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
71723 i = 0;
71724
71725 - do {
71726 + while (nr_pages) {
71727 struct vm_area_struct *vma;
71728
71729 - vma = find_extend_vma(mm, start);
71730 + vma = find_vma(mm, start);
71731 if (!vma && in_gate_area(tsk, start)) {
71732 unsigned long pg = start & PAGE_MASK;
71733 struct vm_area_struct *gate_vma = get_gate_vma(tsk);
71734 @@ -1306,7 +1313,7 @@ int __get_user_pages(struct task_struct
71735 continue;
71736 }
71737
71738 - if (!vma ||
71739 + if (!vma || start < vma->vm_start ||
71740 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
71741 !(vm_flags & vma->vm_flags))
71742 return i ? : -EFAULT;
71743 @@ -1381,7 +1388,7 @@ int __get_user_pages(struct task_struct
71744 start += PAGE_SIZE;
71745 nr_pages--;
71746 } while (nr_pages && start < vma->vm_end);
71747 - } while (nr_pages);
71748 + }
71749 return i;
71750 }
71751
71752 @@ -1526,6 +1533,10 @@ static int insert_page(struct vm_area_st
71753 page_add_file_rmap(page);
71754 set_pte_at(mm, addr, pte, mk_pte(page, prot));
71755
71756 +#ifdef CONFIG_PAX_SEGMEXEC
71757 + pax_mirror_file_pte(vma, addr, page, ptl);
71758 +#endif
71759 +
71760 retval = 0;
71761 pte_unmap_unlock(pte, ptl);
71762 return retval;
71763 @@ -1560,10 +1571,22 @@ out:
71764 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
71765 struct page *page)
71766 {
71767 +
71768 +#ifdef CONFIG_PAX_SEGMEXEC
71769 + struct vm_area_struct *vma_m;
71770 +#endif
71771 +
71772 if (addr < vma->vm_start || addr >= vma->vm_end)
71773 return -EFAULT;
71774 if (!page_count(page))
71775 return -EINVAL;
71776 +
71777 +#ifdef CONFIG_PAX_SEGMEXEC
71778 + vma_m = pax_find_mirror_vma(vma);
71779 + if (vma_m)
71780 + vma_m->vm_flags |= VM_INSERTPAGE;
71781 +#endif
71782 +
71783 vma->vm_flags |= VM_INSERTPAGE;
71784 return insert_page(vma, addr, page, vma->vm_page_prot);
71785 }
71786 @@ -1649,6 +1672,7 @@ int vm_insert_mixed(struct vm_area_struc
71787 unsigned long pfn)
71788 {
71789 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
71790 + BUG_ON(vma->vm_mirror);
71791
71792 if (addr < vma->vm_start || addr >= vma->vm_end)
71793 return -EFAULT;
71794 @@ -1977,6 +2001,186 @@ static inline void cow_user_page(struct
71795 copy_user_highpage(dst, src, va, vma);
71796 }
71797
71798 +#ifdef CONFIG_PAX_SEGMEXEC
71799 +static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
71800 +{
71801 + struct mm_struct *mm = vma->vm_mm;
71802 + spinlock_t *ptl;
71803 + pte_t *pte, entry;
71804 +
71805 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
71806 + entry = *pte;
71807 + if (!pte_present(entry)) {
71808 + if (!pte_none(entry)) {
71809 + BUG_ON(pte_file(entry));
71810 + free_swap_and_cache(pte_to_swp_entry(entry));
71811 + pte_clear_not_present_full(mm, address, pte, 0);
71812 + }
71813 + } else {
71814 + struct page *page;
71815 +
71816 + flush_cache_page(vma, address, pte_pfn(entry));
71817 + entry = ptep_clear_flush(vma, address, pte);
71818 + BUG_ON(pte_dirty(entry));
71819 + page = vm_normal_page(vma, address, entry);
71820 + if (page) {
71821 + update_hiwater_rss(mm);
71822 + if (PageAnon(page))
71823 + dec_mm_counter(mm, anon_rss);
71824 + else
71825 + dec_mm_counter(mm, file_rss);
71826 + page_remove_rmap(page);
71827 + page_cache_release(page);
71828 + }
71829 + }
71830 + pte_unmap_unlock(pte, ptl);
71831 +}
71832 +
71833 +/* PaX: if vma is mirrored, synchronize the mirror's PTE
71834 + *
71835 + * the ptl of the lower mapped page is held on entry and is not released on exit
71836 + * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
71837 + */
71838 +static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
71839 +{
71840 + struct mm_struct *mm = vma->vm_mm;
71841 + unsigned long address_m;
71842 + spinlock_t *ptl_m;
71843 + struct vm_area_struct *vma_m;
71844 + pmd_t *pmd_m;
71845 + pte_t *pte_m, entry_m;
71846 +
71847 + BUG_ON(!page_m || !PageAnon(page_m));
71848 +
71849 + vma_m = pax_find_mirror_vma(vma);
71850 + if (!vma_m)
71851 + return;
71852 +
71853 + BUG_ON(!PageLocked(page_m));
71854 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71855 + address_m = address + SEGMEXEC_TASK_SIZE;
71856 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71857 + pte_m = pte_offset_map_nested(pmd_m, address_m);
71858 + ptl_m = pte_lockptr(mm, pmd_m);
71859 + if (ptl != ptl_m) {
71860 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71861 + if (!pte_none(*pte_m))
71862 + goto out;
71863 + }
71864 +
71865 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
71866 + page_cache_get(page_m);
71867 + page_add_anon_rmap(page_m, vma_m, address_m);
71868 + inc_mm_counter(mm, anon_rss);
71869 + set_pte_at(mm, address_m, pte_m, entry_m);
71870 + update_mmu_cache(vma_m, address_m, entry_m);
71871 +out:
71872 + if (ptl != ptl_m)
71873 + spin_unlock(ptl_m);
71874 + pte_unmap_nested(pte_m);
71875 + unlock_page(page_m);
71876 +}
71877 +
71878 +void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
71879 +{
71880 + struct mm_struct *mm = vma->vm_mm;
71881 + unsigned long address_m;
71882 + spinlock_t *ptl_m;
71883 + struct vm_area_struct *vma_m;
71884 + pmd_t *pmd_m;
71885 + pte_t *pte_m, entry_m;
71886 +
71887 + BUG_ON(!page_m || PageAnon(page_m));
71888 +
71889 + vma_m = pax_find_mirror_vma(vma);
71890 + if (!vma_m)
71891 + return;
71892 +
71893 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71894 + address_m = address + SEGMEXEC_TASK_SIZE;
71895 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71896 + pte_m = pte_offset_map_nested(pmd_m, address_m);
71897 + ptl_m = pte_lockptr(mm, pmd_m);
71898 + if (ptl != ptl_m) {
71899 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71900 + if (!pte_none(*pte_m))
71901 + goto out;
71902 + }
71903 +
71904 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
71905 + page_cache_get(page_m);
71906 + page_add_file_rmap(page_m);
71907 + inc_mm_counter(mm, file_rss);
71908 + set_pte_at(mm, address_m, pte_m, entry_m);
71909 + update_mmu_cache(vma_m, address_m, entry_m);
71910 +out:
71911 + if (ptl != ptl_m)
71912 + spin_unlock(ptl_m);
71913 + pte_unmap_nested(pte_m);
71914 +}
71915 +
71916 +static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
71917 +{
71918 + struct mm_struct *mm = vma->vm_mm;
71919 + unsigned long address_m;
71920 + spinlock_t *ptl_m;
71921 + struct vm_area_struct *vma_m;
71922 + pmd_t *pmd_m;
71923 + pte_t *pte_m, entry_m;
71924 +
71925 + vma_m = pax_find_mirror_vma(vma);
71926 + if (!vma_m)
71927 + return;
71928 +
71929 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71930 + address_m = address + SEGMEXEC_TASK_SIZE;
71931 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71932 + pte_m = pte_offset_map_nested(pmd_m, address_m);
71933 + ptl_m = pte_lockptr(mm, pmd_m);
71934 + if (ptl != ptl_m) {
71935 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71936 + if (!pte_none(*pte_m))
71937 + goto out;
71938 + }
71939 +
71940 + entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
71941 + set_pte_at(mm, address_m, pte_m, entry_m);
71942 +out:
71943 + if (ptl != ptl_m)
71944 + spin_unlock(ptl_m);
71945 + pte_unmap_nested(pte_m);
71946 +}
71947 +
71948 +static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
71949 +{
71950 + struct page *page_m;
71951 + pte_t entry;
71952 +
71953 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
71954 + goto out;
71955 +
71956 + entry = *pte;
71957 + page_m = vm_normal_page(vma, address, entry);
71958 + if (!page_m)
71959 + pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
71960 + else if (PageAnon(page_m)) {
71961 + if (pax_find_mirror_vma(vma)) {
71962 + pte_unmap_unlock(pte, ptl);
71963 + lock_page(page_m);
71964 + pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
71965 + if (pte_same(entry, *pte))
71966 + pax_mirror_anon_pte(vma, address, page_m, ptl);
71967 + else
71968 + unlock_page(page_m);
71969 + }
71970 + } else
71971 + pax_mirror_file_pte(vma, address, page_m, ptl);
71972 +
71973 +out:
71974 + pte_unmap_unlock(pte, ptl);
71975 +}
71976 +#endif
71977 +
71978 /*
71979 * This routine handles present pages, when users try to write
71980 * to a shared page. It is done by copying the page to a new address
71981 @@ -2156,6 +2360,12 @@ gotten:
71982 */
71983 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
71984 if (likely(pte_same(*page_table, orig_pte))) {
71985 +
71986 +#ifdef CONFIG_PAX_SEGMEXEC
71987 + if (pax_find_mirror_vma(vma))
71988 + BUG_ON(!trylock_page(new_page));
71989 +#endif
71990 +
71991 if (old_page) {
71992 if (!PageAnon(old_page)) {
71993 dec_mm_counter(mm, file_rss);
71994 @@ -2207,6 +2417,10 @@ gotten:
71995 page_remove_rmap(old_page);
71996 }
71997
71998 +#ifdef CONFIG_PAX_SEGMEXEC
71999 + pax_mirror_anon_pte(vma, address, new_page, ptl);
72000 +#endif
72001 +
72002 /* Free the old page.. */
72003 new_page = old_page;
72004 ret |= VM_FAULT_WRITE;
72005 @@ -2606,6 +2820,11 @@ static int do_swap_page(struct mm_struct
72006 swap_free(entry);
72007 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
72008 try_to_free_swap(page);
72009 +
72010 +#ifdef CONFIG_PAX_SEGMEXEC
72011 + if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
72012 +#endif
72013 +
72014 unlock_page(page);
72015
72016 if (flags & FAULT_FLAG_WRITE) {
72017 @@ -2617,6 +2836,11 @@ static int do_swap_page(struct mm_struct
72018
72019 /* No need to invalidate - it was non-present before */
72020 update_mmu_cache(vma, address, pte);
72021 +
72022 +#ifdef CONFIG_PAX_SEGMEXEC
72023 + pax_mirror_anon_pte(vma, address, page, ptl);
72024 +#endif
72025 +
72026 unlock:
72027 pte_unmap_unlock(page_table, ptl);
72028 out:
72029 @@ -2632,40 +2856,6 @@ out_release:
72030 }
72031
72032 /*
72033 - * This is like a special single-page "expand_{down|up}wards()",
72034 - * except we must first make sure that 'address{-|+}PAGE_SIZE'
72035 - * doesn't hit another vma.
72036 - */
72037 -static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
72038 -{
72039 - address &= PAGE_MASK;
72040 - if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
72041 - struct vm_area_struct *prev = vma->vm_prev;
72042 -
72043 - /*
72044 - * Is there a mapping abutting this one below?
72045 - *
72046 - * That's only ok if it's the same stack mapping
72047 - * that has gotten split..
72048 - */
72049 - if (prev && prev->vm_end == address)
72050 - return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
72051 -
72052 - expand_stack(vma, address - PAGE_SIZE);
72053 - }
72054 - if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
72055 - struct vm_area_struct *next = vma->vm_next;
72056 -
72057 - /* As VM_GROWSDOWN but s/below/above/ */
72058 - if (next && next->vm_start == address + PAGE_SIZE)
72059 - return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
72060 -
72061 - expand_upwards(vma, address + PAGE_SIZE);
72062 - }
72063 - return 0;
72064 -}
72065 -
72066 -/*
72067 * We enter with non-exclusive mmap_sem (to exclude vma changes,
72068 * but allow concurrent faults), and pte mapped but not yet locked.
72069 * We return with mmap_sem still held, but pte unmapped and unlocked.
72070 @@ -2674,27 +2864,23 @@ static int do_anonymous_page(struct mm_s
72071 unsigned long address, pte_t *page_table, pmd_t *pmd,
72072 unsigned int flags)
72073 {
72074 - struct page *page;
72075 + struct page *page = NULL;
72076 spinlock_t *ptl;
72077 pte_t entry;
72078
72079 - pte_unmap(page_table);
72080 -
72081 - /* Check if we need to add a guard page to the stack */
72082 - if (check_stack_guard_page(vma, address) < 0)
72083 - return VM_FAULT_SIGBUS;
72084 -
72085 - /* Use the zero-page for reads */
72086 if (!(flags & FAULT_FLAG_WRITE)) {
72087 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
72088 vma->vm_page_prot));
72089 - page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
72090 + ptl = pte_lockptr(mm, pmd);
72091 + spin_lock(ptl);
72092 if (!pte_none(*page_table))
72093 goto unlock;
72094 goto setpte;
72095 }
72096
72097 /* Allocate our own private page. */
72098 + pte_unmap(page_table);
72099 +
72100 if (unlikely(anon_vma_prepare(vma)))
72101 goto oom;
72102 page = alloc_zeroed_user_highpage_movable(vma, address);
72103 @@ -2713,6 +2899,11 @@ static int do_anonymous_page(struct mm_s
72104 if (!pte_none(*page_table))
72105 goto release;
72106
72107 +#ifdef CONFIG_PAX_SEGMEXEC
72108 + if (pax_find_mirror_vma(vma))
72109 + BUG_ON(!trylock_page(page));
72110 +#endif
72111 +
72112 inc_mm_counter(mm, anon_rss);
72113 page_add_new_anon_rmap(page, vma, address);
72114 setpte:
72115 @@ -2720,6 +2911,12 @@ setpte:
72116
72117 /* No need to invalidate - it was non-present before */
72118 update_mmu_cache(vma, address, entry);
72119 +
72120 +#ifdef CONFIG_PAX_SEGMEXEC
72121 + if (page)
72122 + pax_mirror_anon_pte(vma, address, page, ptl);
72123 +#endif
72124 +
72125 unlock:
72126 pte_unmap_unlock(page_table, ptl);
72127 return 0;
72128 @@ -2862,6 +3059,12 @@ static int __do_fault(struct mm_struct *
72129 */
72130 /* Only go through if we didn't race with anybody else... */
72131 if (likely(pte_same(*page_table, orig_pte))) {
72132 +
72133 +#ifdef CONFIG_PAX_SEGMEXEC
72134 + if (anon && pax_find_mirror_vma(vma))
72135 + BUG_ON(!trylock_page(page));
72136 +#endif
72137 +
72138 flush_icache_page(vma, page);
72139 entry = mk_pte(page, vma->vm_page_prot);
72140 if (flags & FAULT_FLAG_WRITE)
72141 @@ -2881,6 +3084,14 @@ static int __do_fault(struct mm_struct *
72142
72143 /* no need to invalidate: a not-present page won't be cached */
72144 update_mmu_cache(vma, address, entry);
72145 +
72146 +#ifdef CONFIG_PAX_SEGMEXEC
72147 + if (anon)
72148 + pax_mirror_anon_pte(vma, address, page, ptl);
72149 + else
72150 + pax_mirror_file_pte(vma, address, page, ptl);
72151 +#endif
72152 +
72153 } else {
72154 if (charged)
72155 mem_cgroup_uncharge_page(page);
72156 @@ -3028,6 +3239,12 @@ static inline int handle_pte_fault(struc
72157 if (flags & FAULT_FLAG_WRITE)
72158 flush_tlb_page(vma, address);
72159 }
72160 +
72161 +#ifdef CONFIG_PAX_SEGMEXEC
72162 + pax_mirror_pte(vma, address, pte, pmd, ptl);
72163 + return 0;
72164 +#endif
72165 +
72166 unlock:
72167 pte_unmap_unlock(pte, ptl);
72168 return 0;
72169 @@ -3044,6 +3261,10 @@ int handle_mm_fault(struct mm_struct *mm
72170 pmd_t *pmd;
72171 pte_t *pte;
72172
72173 +#ifdef CONFIG_PAX_SEGMEXEC
72174 + struct vm_area_struct *vma_m;
72175 +#endif
72176 +
72177 __set_current_state(TASK_RUNNING);
72178
72179 count_vm_event(PGFAULT);
72180 @@ -3051,6 +3272,34 @@ int handle_mm_fault(struct mm_struct *mm
72181 if (unlikely(is_vm_hugetlb_page(vma)))
72182 return hugetlb_fault(mm, vma, address, flags);
72183
72184 +#ifdef CONFIG_PAX_SEGMEXEC
72185 + vma_m = pax_find_mirror_vma(vma);
72186 + if (vma_m) {
72187 + unsigned long address_m;
72188 + pgd_t *pgd_m;
72189 + pud_t *pud_m;
72190 + pmd_t *pmd_m;
72191 +
72192 + if (vma->vm_start > vma_m->vm_start) {
72193 + address_m = address;
72194 + address -= SEGMEXEC_TASK_SIZE;
72195 + vma = vma_m;
72196 + } else
72197 + address_m = address + SEGMEXEC_TASK_SIZE;
72198 +
72199 + pgd_m = pgd_offset(mm, address_m);
72200 + pud_m = pud_alloc(mm, pgd_m, address_m);
72201 + if (!pud_m)
72202 + return VM_FAULT_OOM;
72203 + pmd_m = pmd_alloc(mm, pud_m, address_m);
72204 + if (!pmd_m)
72205 + return VM_FAULT_OOM;
72206 + if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
72207 + return VM_FAULT_OOM;
72208 + pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
72209 + }
72210 +#endif
72211 +
72212 pgd = pgd_offset(mm, address);
72213 pud = pud_alloc(mm, pgd, address);
72214 if (!pud)
72215 @@ -3148,7 +3397,7 @@ static int __init gate_vma_init(void)
72216 gate_vma.vm_start = FIXADDR_USER_START;
72217 gate_vma.vm_end = FIXADDR_USER_END;
72218 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
72219 - gate_vma.vm_page_prot = __P101;
72220 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
72221 /*
72222 * Make sure the vDSO gets into every core dump.
72223 * Dumping its contents makes post-mortem fully interpretable later
72224 diff -urNp linux-2.6.32.46/mm/memory-failure.c linux-2.6.32.46/mm/memory-failure.c
72225 --- linux-2.6.32.46/mm/memory-failure.c 2011-03-27 14:31:47.000000000 -0400
72226 +++ linux-2.6.32.46/mm/memory-failure.c 2011-10-06 09:37:14.000000000 -0400
72227 @@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __r
72228
72229 int sysctl_memory_failure_recovery __read_mostly = 1;
72230
72231 -atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
72232 +atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
72233
72234 /*
72235 * Send all the processes who have the page mapped an ``action optional''
72236 @@ -64,7 +64,7 @@ static int kill_proc_ao(struct task_stru
72237 si.si_signo = SIGBUS;
72238 si.si_errno = 0;
72239 si.si_code = BUS_MCEERR_AO;
72240 - si.si_addr = (void *)addr;
72241 + si.si_addr = (void __user *)addr;
72242 #ifdef __ARCH_SI_TRAPNO
72243 si.si_trapno = trapno;
72244 #endif
72245 @@ -745,7 +745,7 @@ int __memory_failure(unsigned long pfn,
72246 return 0;
72247 }
72248
72249 - atomic_long_add(1, &mce_bad_pages);
72250 + atomic_long_add_unchecked(1, &mce_bad_pages);
72251
72252 /*
72253 * We need/can do nothing about count=0 pages.
72254 diff -urNp linux-2.6.32.46/mm/mempolicy.c linux-2.6.32.46/mm/mempolicy.c
72255 --- linux-2.6.32.46/mm/mempolicy.c 2011-03-27 14:31:47.000000000 -0400
72256 +++ linux-2.6.32.46/mm/mempolicy.c 2011-04-17 15:56:46.000000000 -0400
72257 @@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_st
72258 struct vm_area_struct *next;
72259 int err;
72260
72261 +#ifdef CONFIG_PAX_SEGMEXEC
72262 + struct vm_area_struct *vma_m;
72263 +#endif
72264 +
72265 err = 0;
72266 for (; vma && vma->vm_start < end; vma = next) {
72267 next = vma->vm_next;
72268 @@ -584,6 +588,16 @@ static int mbind_range(struct vm_area_st
72269 err = policy_vma(vma, new);
72270 if (err)
72271 break;
72272 +
72273 +#ifdef CONFIG_PAX_SEGMEXEC
72274 + vma_m = pax_find_mirror_vma(vma);
72275 + if (vma_m) {
72276 + err = policy_vma(vma_m, new);
72277 + if (err)
72278 + break;
72279 + }
72280 +#endif
72281 +
72282 }
72283 return err;
72284 }
72285 @@ -1002,6 +1016,17 @@ static long do_mbind(unsigned long start
72286
72287 if (end < start)
72288 return -EINVAL;
72289 +
72290 +#ifdef CONFIG_PAX_SEGMEXEC
72291 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
72292 + if (end > SEGMEXEC_TASK_SIZE)
72293 + return -EINVAL;
72294 + } else
72295 +#endif
72296 +
72297 + if (end > TASK_SIZE)
72298 + return -EINVAL;
72299 +
72300 if (end == start)
72301 return 0;
72302
72303 @@ -1207,6 +1232,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
72304 if (!mm)
72305 return -EINVAL;
72306
72307 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
72308 + if (mm != current->mm &&
72309 + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
72310 + err = -EPERM;
72311 + goto out;
72312 + }
72313 +#endif
72314 +
72315 /*
72316 * Check if this process has the right to modify the specified
72317 * process. The right exists if the process has administrative
72318 @@ -1216,8 +1249,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
72319 rcu_read_lock();
72320 tcred = __task_cred(task);
72321 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
72322 - cred->uid != tcred->suid && cred->uid != tcred->uid &&
72323 - !capable(CAP_SYS_NICE)) {
72324 + cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
72325 rcu_read_unlock();
72326 err = -EPERM;
72327 goto out;
72328 @@ -2396,7 +2428,7 @@ int show_numa_map(struct seq_file *m, vo
72329
72330 if (file) {
72331 seq_printf(m, " file=");
72332 - seq_path(m, &file->f_path, "\n\t= ");
72333 + seq_path(m, &file->f_path, "\n\t\\= ");
72334 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
72335 seq_printf(m, " heap");
72336 } else if (vma->vm_start <= mm->start_stack &&
72337 diff -urNp linux-2.6.32.46/mm/migrate.c linux-2.6.32.46/mm/migrate.c
72338 --- linux-2.6.32.46/mm/migrate.c 2011-07-13 17:23:04.000000000 -0400
72339 +++ linux-2.6.32.46/mm/migrate.c 2011-07-13 17:23:23.000000000 -0400
72340 @@ -916,6 +916,8 @@ static int do_pages_move(struct mm_struc
72341 unsigned long chunk_start;
72342 int err;
72343
72344 + pax_track_stack();
72345 +
72346 task_nodes = cpuset_mems_allowed(task);
72347
72348 err = -ENOMEM;
72349 @@ -1106,6 +1108,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
72350 if (!mm)
72351 return -EINVAL;
72352
72353 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
72354 + if (mm != current->mm &&
72355 + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
72356 + err = -EPERM;
72357 + goto out;
72358 + }
72359 +#endif
72360 +
72361 /*
72362 * Check if this process has the right to modify the specified
72363 * process. The right exists if the process has administrative
72364 @@ -1115,8 +1125,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
72365 rcu_read_lock();
72366 tcred = __task_cred(task);
72367 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
72368 - cred->uid != tcred->suid && cred->uid != tcred->uid &&
72369 - !capable(CAP_SYS_NICE)) {
72370 + cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
72371 rcu_read_unlock();
72372 err = -EPERM;
72373 goto out;
72374 diff -urNp linux-2.6.32.46/mm/mlock.c linux-2.6.32.46/mm/mlock.c
72375 --- linux-2.6.32.46/mm/mlock.c 2011-03-27 14:31:47.000000000 -0400
72376 +++ linux-2.6.32.46/mm/mlock.c 2011-04-17 15:56:46.000000000 -0400
72377 @@ -13,6 +13,7 @@
72378 #include <linux/pagemap.h>
72379 #include <linux/mempolicy.h>
72380 #include <linux/syscalls.h>
72381 +#include <linux/security.h>
72382 #include <linux/sched.h>
72383 #include <linux/module.h>
72384 #include <linux/rmap.h>
72385 @@ -138,13 +139,6 @@ void munlock_vma_page(struct page *page)
72386 }
72387 }
72388
72389 -static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
72390 -{
72391 - return (vma->vm_flags & VM_GROWSDOWN) &&
72392 - (vma->vm_start == addr) &&
72393 - !vma_stack_continue(vma->vm_prev, addr);
72394 -}
72395 -
72396 /**
72397 * __mlock_vma_pages_range() - mlock a range of pages in the vma.
72398 * @vma: target vma
72399 @@ -177,12 +171,6 @@ static long __mlock_vma_pages_range(stru
72400 if (vma->vm_flags & VM_WRITE)
72401 gup_flags |= FOLL_WRITE;
72402
72403 - /* We don't try to access the guard page of a stack vma */
72404 - if (stack_guard_page(vma, start)) {
72405 - addr += PAGE_SIZE;
72406 - nr_pages--;
72407 - }
72408 -
72409 while (nr_pages > 0) {
72410 int i;
72411
72412 @@ -440,7 +428,7 @@ static int do_mlock(unsigned long start,
72413 {
72414 unsigned long nstart, end, tmp;
72415 struct vm_area_struct * vma, * prev;
72416 - int error;
72417 + int error = -EINVAL;
72418
72419 len = PAGE_ALIGN(len);
72420 end = start + len;
72421 @@ -448,6 +436,9 @@ static int do_mlock(unsigned long start,
72422 return -EINVAL;
72423 if (end == start)
72424 return 0;
72425 + if (end > TASK_SIZE)
72426 + return -EINVAL;
72427 +
72428 vma = find_vma_prev(current->mm, start, &prev);
72429 if (!vma || vma->vm_start > start)
72430 return -ENOMEM;
72431 @@ -458,6 +449,11 @@ static int do_mlock(unsigned long start,
72432 for (nstart = start ; ; ) {
72433 unsigned int newflags;
72434
72435 +#ifdef CONFIG_PAX_SEGMEXEC
72436 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
72437 + break;
72438 +#endif
72439 +
72440 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
72441
72442 newflags = vma->vm_flags | VM_LOCKED;
72443 @@ -507,6 +503,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
72444 lock_limit >>= PAGE_SHIFT;
72445
72446 /* check against resource limits */
72447 + gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
72448 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
72449 error = do_mlock(start, len, 1);
72450 up_write(&current->mm->mmap_sem);
72451 @@ -528,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long,
72452 static int do_mlockall(int flags)
72453 {
72454 struct vm_area_struct * vma, * prev = NULL;
72455 - unsigned int def_flags = 0;
72456
72457 if (flags & MCL_FUTURE)
72458 - def_flags = VM_LOCKED;
72459 - current->mm->def_flags = def_flags;
72460 + current->mm->def_flags |= VM_LOCKED;
72461 + else
72462 + current->mm->def_flags &= ~VM_LOCKED;
72463 if (flags == MCL_FUTURE)
72464 goto out;
72465
72466 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
72467 - unsigned int newflags;
72468 + unsigned long newflags;
72469 +
72470 +#ifdef CONFIG_PAX_SEGMEXEC
72471 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
72472 + break;
72473 +#endif
72474
72475 + BUG_ON(vma->vm_end > TASK_SIZE);
72476 newflags = vma->vm_flags | VM_LOCKED;
72477 if (!(flags & MCL_CURRENT))
72478 newflags &= ~VM_LOCKED;
72479 @@ -570,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
72480 lock_limit >>= PAGE_SHIFT;
72481
72482 ret = -ENOMEM;
72483 + gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
72484 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
72485 capable(CAP_IPC_LOCK))
72486 ret = do_mlockall(flags);
72487 diff -urNp linux-2.6.32.46/mm/mmap.c linux-2.6.32.46/mm/mmap.c
72488 --- linux-2.6.32.46/mm/mmap.c 2011-03-27 14:31:47.000000000 -0400
72489 +++ linux-2.6.32.46/mm/mmap.c 2011-04-17 15:56:46.000000000 -0400
72490 @@ -45,6 +45,16 @@
72491 #define arch_rebalance_pgtables(addr, len) (addr)
72492 #endif
72493
72494 +static inline void verify_mm_writelocked(struct mm_struct *mm)
72495 +{
72496 +#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
72497 + if (unlikely(down_read_trylock(&mm->mmap_sem))) {
72498 + up_read(&mm->mmap_sem);
72499 + BUG();
72500 + }
72501 +#endif
72502 +}
72503 +
72504 static void unmap_region(struct mm_struct *mm,
72505 struct vm_area_struct *vma, struct vm_area_struct *prev,
72506 unsigned long start, unsigned long end);
72507 @@ -70,22 +80,32 @@ static void unmap_region(struct mm_struc
72508 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
72509 *
72510 */
72511 -pgprot_t protection_map[16] = {
72512 +pgprot_t protection_map[16] __read_only = {
72513 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
72514 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
72515 };
72516
72517 pgprot_t vm_get_page_prot(unsigned long vm_flags)
72518 {
72519 - return __pgprot(pgprot_val(protection_map[vm_flags &
72520 + pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
72521 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
72522 pgprot_val(arch_vm_get_page_prot(vm_flags)));
72523 +
72524 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72525 + if (!nx_enabled &&
72526 + (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
72527 + (vm_flags & (VM_READ | VM_WRITE)))
72528 + prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
72529 +#endif
72530 +
72531 + return prot;
72532 }
72533 EXPORT_SYMBOL(vm_get_page_prot);
72534
72535 int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
72536 int sysctl_overcommit_ratio = 50; /* default is 50% */
72537 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
72538 +unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
72539 struct percpu_counter vm_committed_as;
72540
72541 /*
72542 @@ -231,6 +251,7 @@ static struct vm_area_struct *remove_vma
72543 struct vm_area_struct *next = vma->vm_next;
72544
72545 might_sleep();
72546 + BUG_ON(vma->vm_mirror);
72547 if (vma->vm_ops && vma->vm_ops->close)
72548 vma->vm_ops->close(vma);
72549 if (vma->vm_file) {
72550 @@ -267,6 +288,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
72551 * not page aligned -Ram Gupta
72552 */
72553 rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
72554 + gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
72555 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
72556 (mm->end_data - mm->start_data) > rlim)
72557 goto out;
72558 @@ -704,6 +726,12 @@ static int
72559 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
72560 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72561 {
72562 +
72563 +#ifdef CONFIG_PAX_SEGMEXEC
72564 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
72565 + return 0;
72566 +#endif
72567 +
72568 if (is_mergeable_vma(vma, file, vm_flags) &&
72569 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
72570 if (vma->vm_pgoff == vm_pgoff)
72571 @@ -723,6 +751,12 @@ static int
72572 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
72573 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72574 {
72575 +
72576 +#ifdef CONFIG_PAX_SEGMEXEC
72577 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
72578 + return 0;
72579 +#endif
72580 +
72581 if (is_mergeable_vma(vma, file, vm_flags) &&
72582 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
72583 pgoff_t vm_pglen;
72584 @@ -765,12 +799,19 @@ can_vma_merge_after(struct vm_area_struc
72585 struct vm_area_struct *vma_merge(struct mm_struct *mm,
72586 struct vm_area_struct *prev, unsigned long addr,
72587 unsigned long end, unsigned long vm_flags,
72588 - struct anon_vma *anon_vma, struct file *file,
72589 + struct anon_vma *anon_vma, struct file *file,
72590 pgoff_t pgoff, struct mempolicy *policy)
72591 {
72592 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
72593 struct vm_area_struct *area, *next;
72594
72595 +#ifdef CONFIG_PAX_SEGMEXEC
72596 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
72597 + struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
72598 +
72599 + BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
72600 +#endif
72601 +
72602 /*
72603 * We later require that vma->vm_flags == vm_flags,
72604 * so this tests vma->vm_flags & VM_SPECIAL, too.
72605 @@ -786,6 +827,15 @@ struct vm_area_struct *vma_merge(struct
72606 if (next && next->vm_end == end) /* cases 6, 7, 8 */
72607 next = next->vm_next;
72608
72609 +#ifdef CONFIG_PAX_SEGMEXEC
72610 + if (prev)
72611 + prev_m = pax_find_mirror_vma(prev);
72612 + if (area)
72613 + area_m = pax_find_mirror_vma(area);
72614 + if (next)
72615 + next_m = pax_find_mirror_vma(next);
72616 +#endif
72617 +
72618 /*
72619 * Can it merge with the predecessor?
72620 */
72621 @@ -805,9 +855,24 @@ struct vm_area_struct *vma_merge(struct
72622 /* cases 1, 6 */
72623 vma_adjust(prev, prev->vm_start,
72624 next->vm_end, prev->vm_pgoff, NULL);
72625 - } else /* cases 2, 5, 7 */
72626 +
72627 +#ifdef CONFIG_PAX_SEGMEXEC
72628 + if (prev_m)
72629 + vma_adjust(prev_m, prev_m->vm_start,
72630 + next_m->vm_end, prev_m->vm_pgoff, NULL);
72631 +#endif
72632 +
72633 + } else { /* cases 2, 5, 7 */
72634 vma_adjust(prev, prev->vm_start,
72635 end, prev->vm_pgoff, NULL);
72636 +
72637 +#ifdef CONFIG_PAX_SEGMEXEC
72638 + if (prev_m)
72639 + vma_adjust(prev_m, prev_m->vm_start,
72640 + end_m, prev_m->vm_pgoff, NULL);
72641 +#endif
72642 +
72643 + }
72644 return prev;
72645 }
72646
72647 @@ -818,12 +883,27 @@ struct vm_area_struct *vma_merge(struct
72648 mpol_equal(policy, vma_policy(next)) &&
72649 can_vma_merge_before(next, vm_flags,
72650 anon_vma, file, pgoff+pglen)) {
72651 - if (prev && addr < prev->vm_end) /* case 4 */
72652 + if (prev && addr < prev->vm_end) { /* case 4 */
72653 vma_adjust(prev, prev->vm_start,
72654 addr, prev->vm_pgoff, NULL);
72655 - else /* cases 3, 8 */
72656 +
72657 +#ifdef CONFIG_PAX_SEGMEXEC
72658 + if (prev_m)
72659 + vma_adjust(prev_m, prev_m->vm_start,
72660 + addr_m, prev_m->vm_pgoff, NULL);
72661 +#endif
72662 +
72663 + } else { /* cases 3, 8 */
72664 vma_adjust(area, addr, next->vm_end,
72665 next->vm_pgoff - pglen, NULL);
72666 +
72667 +#ifdef CONFIG_PAX_SEGMEXEC
72668 + if (area_m)
72669 + vma_adjust(area_m, addr_m, next_m->vm_end,
72670 + next_m->vm_pgoff - pglen, NULL);
72671 +#endif
72672 +
72673 + }
72674 return area;
72675 }
72676
72677 @@ -898,14 +978,11 @@ none:
72678 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
72679 struct file *file, long pages)
72680 {
72681 - const unsigned long stack_flags
72682 - = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
72683 -
72684 if (file) {
72685 mm->shared_vm += pages;
72686 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
72687 mm->exec_vm += pages;
72688 - } else if (flags & stack_flags)
72689 + } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
72690 mm->stack_vm += pages;
72691 if (flags & (VM_RESERVED|VM_IO))
72692 mm->reserved_vm += pages;
72693 @@ -932,7 +1009,7 @@ unsigned long do_mmap_pgoff(struct file
72694 * (the exception is when the underlying filesystem is noexec
72695 * mounted, in which case we dont add PROT_EXEC.)
72696 */
72697 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
72698 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
72699 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
72700 prot |= PROT_EXEC;
72701
72702 @@ -958,7 +1035,7 @@ unsigned long do_mmap_pgoff(struct file
72703 /* Obtain the address to map to. we verify (or select) it and ensure
72704 * that it represents a valid section of the address space.
72705 */
72706 - addr = get_unmapped_area(file, addr, len, pgoff, flags);
72707 + addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
72708 if (addr & ~PAGE_MASK)
72709 return addr;
72710
72711 @@ -969,6 +1046,36 @@ unsigned long do_mmap_pgoff(struct file
72712 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
72713 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
72714
72715 +#ifdef CONFIG_PAX_MPROTECT
72716 + if (mm->pax_flags & MF_PAX_MPROTECT) {
72717 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
72718 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
72719 + gr_log_rwxmmap(file);
72720 +
72721 +#ifdef CONFIG_PAX_EMUPLT
72722 + vm_flags &= ~VM_EXEC;
72723 +#else
72724 + return -EPERM;
72725 +#endif
72726 +
72727 + }
72728 +
72729 + if (!(vm_flags & VM_EXEC))
72730 + vm_flags &= ~VM_MAYEXEC;
72731 +#else
72732 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
72733 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
72734 +#endif
72735 + else
72736 + vm_flags &= ~VM_MAYWRITE;
72737 + }
72738 +#endif
72739 +
72740 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72741 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
72742 + vm_flags &= ~VM_PAGEEXEC;
72743 +#endif
72744 +
72745 if (flags & MAP_LOCKED)
72746 if (!can_do_mlock())
72747 return -EPERM;
72748 @@ -980,6 +1087,7 @@ unsigned long do_mmap_pgoff(struct file
72749 locked += mm->locked_vm;
72750 lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
72751 lock_limit >>= PAGE_SHIFT;
72752 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
72753 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
72754 return -EAGAIN;
72755 }
72756 @@ -1053,6 +1161,9 @@ unsigned long do_mmap_pgoff(struct file
72757 if (error)
72758 return error;
72759
72760 + if (!gr_acl_handle_mmap(file, prot))
72761 + return -EACCES;
72762 +
72763 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
72764 }
72765 EXPORT_SYMBOL(do_mmap_pgoff);
72766 @@ -1065,10 +1176,10 @@ EXPORT_SYMBOL(do_mmap_pgoff);
72767 */
72768 int vma_wants_writenotify(struct vm_area_struct *vma)
72769 {
72770 - unsigned int vm_flags = vma->vm_flags;
72771 + unsigned long vm_flags = vma->vm_flags;
72772
72773 /* If it was private or non-writable, the write bit is already clear */
72774 - if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
72775 + if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
72776 return 0;
72777
72778 /* The backer wishes to know when pages are first written to? */
72779 @@ -1117,14 +1228,24 @@ unsigned long mmap_region(struct file *f
72780 unsigned long charged = 0;
72781 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
72782
72783 +#ifdef CONFIG_PAX_SEGMEXEC
72784 + struct vm_area_struct *vma_m = NULL;
72785 +#endif
72786 +
72787 + /*
72788 + * mm->mmap_sem is required to protect against another thread
72789 + * changing the mappings in case we sleep.
72790 + */
72791 + verify_mm_writelocked(mm);
72792 +
72793 /* Clear old maps */
72794 error = -ENOMEM;
72795 -munmap_back:
72796 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72797 if (vma && vma->vm_start < addr + len) {
72798 if (do_munmap(mm, addr, len))
72799 return -ENOMEM;
72800 - goto munmap_back;
72801 + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72802 + BUG_ON(vma && vma->vm_start < addr + len);
72803 }
72804
72805 /* Check against address space limit. */
72806 @@ -1173,6 +1294,16 @@ munmap_back:
72807 goto unacct_error;
72808 }
72809
72810 +#ifdef CONFIG_PAX_SEGMEXEC
72811 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
72812 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72813 + if (!vma_m) {
72814 + error = -ENOMEM;
72815 + goto free_vma;
72816 + }
72817 + }
72818 +#endif
72819 +
72820 vma->vm_mm = mm;
72821 vma->vm_start = addr;
72822 vma->vm_end = addr + len;
72823 @@ -1195,6 +1326,19 @@ munmap_back:
72824 error = file->f_op->mmap(file, vma);
72825 if (error)
72826 goto unmap_and_free_vma;
72827 +
72828 +#ifdef CONFIG_PAX_SEGMEXEC
72829 + if (vma_m && (vm_flags & VM_EXECUTABLE))
72830 + added_exe_file_vma(mm);
72831 +#endif
72832 +
72833 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72834 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
72835 + vma->vm_flags |= VM_PAGEEXEC;
72836 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
72837 + }
72838 +#endif
72839 +
72840 if (vm_flags & VM_EXECUTABLE)
72841 added_exe_file_vma(mm);
72842
72843 @@ -1218,6 +1362,11 @@ munmap_back:
72844 vma_link(mm, vma, prev, rb_link, rb_parent);
72845 file = vma->vm_file;
72846
72847 +#ifdef CONFIG_PAX_SEGMEXEC
72848 + if (vma_m)
72849 + pax_mirror_vma(vma_m, vma);
72850 +#endif
72851 +
72852 /* Once vma denies write, undo our temporary denial count */
72853 if (correct_wcount)
72854 atomic_inc(&inode->i_writecount);
72855 @@ -1226,6 +1375,7 @@ out:
72856
72857 mm->total_vm += len >> PAGE_SHIFT;
72858 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
72859 + track_exec_limit(mm, addr, addr + len, vm_flags);
72860 if (vm_flags & VM_LOCKED) {
72861 /*
72862 * makes pages present; downgrades, drops, reacquires mmap_sem
72863 @@ -1248,6 +1398,12 @@ unmap_and_free_vma:
72864 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
72865 charged = 0;
72866 free_vma:
72867 +
72868 +#ifdef CONFIG_PAX_SEGMEXEC
72869 + if (vma_m)
72870 + kmem_cache_free(vm_area_cachep, vma_m);
72871 +#endif
72872 +
72873 kmem_cache_free(vm_area_cachep, vma);
72874 unacct_error:
72875 if (charged)
72876 @@ -1255,6 +1411,44 @@ unacct_error:
72877 return error;
72878 }
72879
72880 +bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
72881 +{
72882 + if (!vma) {
72883 +#ifdef CONFIG_STACK_GROWSUP
72884 + if (addr > sysctl_heap_stack_gap)
72885 + vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
72886 + else
72887 + vma = find_vma(current->mm, 0);
72888 + if (vma && (vma->vm_flags & VM_GROWSUP))
72889 + return false;
72890 +#endif
72891 + return true;
72892 + }
72893 +
72894 + if (addr + len > vma->vm_start)
72895 + return false;
72896 +
72897 + if (vma->vm_flags & VM_GROWSDOWN)
72898 + return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
72899 +#ifdef CONFIG_STACK_GROWSUP
72900 + else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
72901 + return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
72902 +#endif
72903 +
72904 + return true;
72905 +}
72906 +
72907 +unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
72908 +{
72909 + if (vma->vm_start < len)
72910 + return -ENOMEM;
72911 + if (!(vma->vm_flags & VM_GROWSDOWN))
72912 + return vma->vm_start - len;
72913 + if (sysctl_heap_stack_gap <= vma->vm_start - len)
72914 + return vma->vm_start - len - sysctl_heap_stack_gap;
72915 + return -ENOMEM;
72916 +}
72917 +
72918 /* Get an address range which is currently unmapped.
72919 * For shmat() with addr=0.
72920 *
72921 @@ -1281,18 +1475,23 @@ arch_get_unmapped_area(struct file *filp
72922 if (flags & MAP_FIXED)
72923 return addr;
72924
72925 +#ifdef CONFIG_PAX_RANDMMAP
72926 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
72927 +#endif
72928 +
72929 if (addr) {
72930 addr = PAGE_ALIGN(addr);
72931 - vma = find_vma(mm, addr);
72932 - if (TASK_SIZE - len >= addr &&
72933 - (!vma || addr + len <= vma->vm_start))
72934 - return addr;
72935 + if (TASK_SIZE - len >= addr) {
72936 + vma = find_vma(mm, addr);
72937 + if (check_heap_stack_gap(vma, addr, len))
72938 + return addr;
72939 + }
72940 }
72941 if (len > mm->cached_hole_size) {
72942 - start_addr = addr = mm->free_area_cache;
72943 + start_addr = addr = mm->free_area_cache;
72944 } else {
72945 - start_addr = addr = TASK_UNMAPPED_BASE;
72946 - mm->cached_hole_size = 0;
72947 + start_addr = addr = mm->mmap_base;
72948 + mm->cached_hole_size = 0;
72949 }
72950
72951 full_search:
72952 @@ -1303,34 +1502,40 @@ full_search:
72953 * Start a new search - just in case we missed
72954 * some holes.
72955 */
72956 - if (start_addr != TASK_UNMAPPED_BASE) {
72957 - addr = TASK_UNMAPPED_BASE;
72958 - start_addr = addr;
72959 + if (start_addr != mm->mmap_base) {
72960 + start_addr = addr = mm->mmap_base;
72961 mm->cached_hole_size = 0;
72962 goto full_search;
72963 }
72964 return -ENOMEM;
72965 }
72966 - if (!vma || addr + len <= vma->vm_start) {
72967 - /*
72968 - * Remember the place where we stopped the search:
72969 - */
72970 - mm->free_area_cache = addr + len;
72971 - return addr;
72972 - }
72973 + if (check_heap_stack_gap(vma, addr, len))
72974 + break;
72975 if (addr + mm->cached_hole_size < vma->vm_start)
72976 mm->cached_hole_size = vma->vm_start - addr;
72977 addr = vma->vm_end;
72978 }
72979 +
72980 + /*
72981 + * Remember the place where we stopped the search:
72982 + */
72983 + mm->free_area_cache = addr + len;
72984 + return addr;
72985 }
72986 #endif
72987
72988 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
72989 {
72990 +
72991 +#ifdef CONFIG_PAX_SEGMEXEC
72992 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
72993 + return;
72994 +#endif
72995 +
72996 /*
72997 * Is this a new hole at the lowest possible address?
72998 */
72999 - if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
73000 + if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
73001 mm->free_area_cache = addr;
73002 mm->cached_hole_size = ~0UL;
73003 }
73004 @@ -1348,7 +1553,7 @@ arch_get_unmapped_area_topdown(struct fi
73005 {
73006 struct vm_area_struct *vma;
73007 struct mm_struct *mm = current->mm;
73008 - unsigned long addr = addr0;
73009 + unsigned long base = mm->mmap_base, addr = addr0;
73010
73011 /* requested length too big for entire address space */
73012 if (len > TASK_SIZE)
73013 @@ -1357,13 +1562,18 @@ arch_get_unmapped_area_topdown(struct fi
73014 if (flags & MAP_FIXED)
73015 return addr;
73016
73017 +#ifdef CONFIG_PAX_RANDMMAP
73018 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
73019 +#endif
73020 +
73021 /* requesting a specific address */
73022 if (addr) {
73023 addr = PAGE_ALIGN(addr);
73024 - vma = find_vma(mm, addr);
73025 - if (TASK_SIZE - len >= addr &&
73026 - (!vma || addr + len <= vma->vm_start))
73027 - return addr;
73028 + if (TASK_SIZE - len >= addr) {
73029 + vma = find_vma(mm, addr);
73030 + if (check_heap_stack_gap(vma, addr, len))
73031 + return addr;
73032 + }
73033 }
73034
73035 /* check if free_area_cache is useful for us */
73036 @@ -1378,7 +1588,7 @@ arch_get_unmapped_area_topdown(struct fi
73037 /* make sure it can fit in the remaining address space */
73038 if (addr > len) {
73039 vma = find_vma(mm, addr-len);
73040 - if (!vma || addr <= vma->vm_start)
73041 + if (check_heap_stack_gap(vma, addr - len, len))
73042 /* remember the address as a hint for next time */
73043 return (mm->free_area_cache = addr-len);
73044 }
73045 @@ -1395,7 +1605,7 @@ arch_get_unmapped_area_topdown(struct fi
73046 * return with success:
73047 */
73048 vma = find_vma(mm, addr);
73049 - if (!vma || addr+len <= vma->vm_start)
73050 + if (check_heap_stack_gap(vma, addr, len))
73051 /* remember the address as a hint for next time */
73052 return (mm->free_area_cache = addr);
73053
73054 @@ -1404,8 +1614,8 @@ arch_get_unmapped_area_topdown(struct fi
73055 mm->cached_hole_size = vma->vm_start - addr;
73056
73057 /* try just below the current vma->vm_start */
73058 - addr = vma->vm_start-len;
73059 - } while (len < vma->vm_start);
73060 + addr = skip_heap_stack_gap(vma, len);
73061 + } while (!IS_ERR_VALUE(addr));
73062
73063 bottomup:
73064 /*
73065 @@ -1414,13 +1624,21 @@ bottomup:
73066 * can happen with large stack limits and large mmap()
73067 * allocations.
73068 */
73069 + mm->mmap_base = TASK_UNMAPPED_BASE;
73070 +
73071 +#ifdef CONFIG_PAX_RANDMMAP
73072 + if (mm->pax_flags & MF_PAX_RANDMMAP)
73073 + mm->mmap_base += mm->delta_mmap;
73074 +#endif
73075 +
73076 + mm->free_area_cache = mm->mmap_base;
73077 mm->cached_hole_size = ~0UL;
73078 - mm->free_area_cache = TASK_UNMAPPED_BASE;
73079 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
73080 /*
73081 * Restore the topdown base:
73082 */
73083 - mm->free_area_cache = mm->mmap_base;
73084 + mm->mmap_base = base;
73085 + mm->free_area_cache = base;
73086 mm->cached_hole_size = ~0UL;
73087
73088 return addr;
73089 @@ -1429,6 +1647,12 @@ bottomup:
73090
73091 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
73092 {
73093 +
73094 +#ifdef CONFIG_PAX_SEGMEXEC
73095 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
73096 + return;
73097 +#endif
73098 +
73099 /*
73100 * Is this a new hole at the highest possible address?
73101 */
73102 @@ -1436,8 +1660,10 @@ void arch_unmap_area_topdown(struct mm_s
73103 mm->free_area_cache = addr;
73104
73105 /* dont allow allocations above current base */
73106 - if (mm->free_area_cache > mm->mmap_base)
73107 + if (mm->free_area_cache > mm->mmap_base) {
73108 mm->free_area_cache = mm->mmap_base;
73109 + mm->cached_hole_size = ~0UL;
73110 + }
73111 }
73112
73113 unsigned long
73114 @@ -1545,6 +1771,27 @@ out:
73115 return prev ? prev->vm_next : vma;
73116 }
73117
73118 +#ifdef CONFIG_PAX_SEGMEXEC
73119 +struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
73120 +{
73121 + struct vm_area_struct *vma_m;
73122 +
73123 + BUG_ON(!vma || vma->vm_start >= vma->vm_end);
73124 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
73125 + BUG_ON(vma->vm_mirror);
73126 + return NULL;
73127 + }
73128 + BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
73129 + vma_m = vma->vm_mirror;
73130 + BUG_ON(!vma_m || vma_m->vm_mirror != vma);
73131 + BUG_ON(vma->vm_file != vma_m->vm_file);
73132 + BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
73133 + BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
73134 + BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
73135 + return vma_m;
73136 +}
73137 +#endif
73138 +
73139 /*
73140 * Verify that the stack growth is acceptable and
73141 * update accounting. This is shared with both the
73142 @@ -1561,6 +1808,7 @@ static int acct_stack_growth(struct vm_a
73143 return -ENOMEM;
73144
73145 /* Stack limit test */
73146 + gr_learn_resource(current, RLIMIT_STACK, size, 1);
73147 if (size > rlim[RLIMIT_STACK].rlim_cur)
73148 return -ENOMEM;
73149
73150 @@ -1570,6 +1818,7 @@ static int acct_stack_growth(struct vm_a
73151 unsigned long limit;
73152 locked = mm->locked_vm + grow;
73153 limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
73154 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
73155 if (locked > limit && !capable(CAP_IPC_LOCK))
73156 return -ENOMEM;
73157 }
73158 @@ -1600,37 +1849,48 @@ static int acct_stack_growth(struct vm_a
73159 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
73160 * vma is the last one with address > vma->vm_end. Have to extend vma.
73161 */
73162 +#ifndef CONFIG_IA64
73163 +static
73164 +#endif
73165 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
73166 {
73167 int error;
73168 + bool locknext;
73169
73170 if (!(vma->vm_flags & VM_GROWSUP))
73171 return -EFAULT;
73172
73173 + /* Also guard against wrapping around to address 0. */
73174 + if (address < PAGE_ALIGN(address+1))
73175 + address = PAGE_ALIGN(address+1);
73176 + else
73177 + return -ENOMEM;
73178 +
73179 /*
73180 * We must make sure the anon_vma is allocated
73181 * so that the anon_vma locking is not a noop.
73182 */
73183 if (unlikely(anon_vma_prepare(vma)))
73184 return -ENOMEM;
73185 + locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
73186 + if (locknext && anon_vma_prepare(vma->vm_next))
73187 + return -ENOMEM;
73188 anon_vma_lock(vma);
73189 + if (locknext)
73190 + anon_vma_lock(vma->vm_next);
73191
73192 /*
73193 * vma->vm_start/vm_end cannot change under us because the caller
73194 * is required to hold the mmap_sem in read mode. We need the
73195 - * anon_vma lock to serialize against concurrent expand_stacks.
73196 - * Also guard against wrapping around to address 0.
73197 + * anon_vma locks to serialize against concurrent expand_stacks
73198 + * and expand_upwards.
73199 */
73200 - if (address < PAGE_ALIGN(address+4))
73201 - address = PAGE_ALIGN(address+4);
73202 - else {
73203 - anon_vma_unlock(vma);
73204 - return -ENOMEM;
73205 - }
73206 error = 0;
73207
73208 /* Somebody else might have raced and expanded it already */
73209 - if (address > vma->vm_end) {
73210 + if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
73211 + error = -ENOMEM;
73212 + else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
73213 unsigned long size, grow;
73214
73215 size = address - vma->vm_start;
73216 @@ -1640,6 +1900,8 @@ int expand_upwards(struct vm_area_struct
73217 if (!error)
73218 vma->vm_end = address;
73219 }
73220 + if (locknext)
73221 + anon_vma_unlock(vma->vm_next);
73222 anon_vma_unlock(vma);
73223 return error;
73224 }
73225 @@ -1652,6 +1914,8 @@ static int expand_downwards(struct vm_ar
73226 unsigned long address)
73227 {
73228 int error;
73229 + bool lockprev = false;
73230 + struct vm_area_struct *prev;
73231
73232 /*
73233 * We must make sure the anon_vma is allocated
73234 @@ -1665,6 +1929,15 @@ static int expand_downwards(struct vm_ar
73235 if (error)
73236 return error;
73237
73238 + prev = vma->vm_prev;
73239 +#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
73240 + lockprev = prev && (prev->vm_flags & VM_GROWSUP);
73241 +#endif
73242 + if (lockprev && anon_vma_prepare(prev))
73243 + return -ENOMEM;
73244 + if (lockprev)
73245 + anon_vma_lock(prev);
73246 +
73247 anon_vma_lock(vma);
73248
73249 /*
73250 @@ -1674,9 +1947,17 @@ static int expand_downwards(struct vm_ar
73251 */
73252
73253 /* Somebody else might have raced and expanded it already */
73254 - if (address < vma->vm_start) {
73255 + if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
73256 + error = -ENOMEM;
73257 + else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
73258 unsigned long size, grow;
73259
73260 +#ifdef CONFIG_PAX_SEGMEXEC
73261 + struct vm_area_struct *vma_m;
73262 +
73263 + vma_m = pax_find_mirror_vma(vma);
73264 +#endif
73265 +
73266 size = vma->vm_end - address;
73267 grow = (vma->vm_start - address) >> PAGE_SHIFT;
73268
73269 @@ -1684,9 +1965,20 @@ static int expand_downwards(struct vm_ar
73270 if (!error) {
73271 vma->vm_start = address;
73272 vma->vm_pgoff -= grow;
73273 + track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
73274 +
73275 +#ifdef CONFIG_PAX_SEGMEXEC
73276 + if (vma_m) {
73277 + vma_m->vm_start -= grow << PAGE_SHIFT;
73278 + vma_m->vm_pgoff -= grow;
73279 + }
73280 +#endif
73281 +
73282 }
73283 }
73284 anon_vma_unlock(vma);
73285 + if (lockprev)
73286 + anon_vma_unlock(prev);
73287 return error;
73288 }
73289
73290 @@ -1762,6 +2054,13 @@ static void remove_vma_list(struct mm_st
73291 do {
73292 long nrpages = vma_pages(vma);
73293
73294 +#ifdef CONFIG_PAX_SEGMEXEC
73295 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
73296 + vma = remove_vma(vma);
73297 + continue;
73298 + }
73299 +#endif
73300 +
73301 mm->total_vm -= nrpages;
73302 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
73303 vma = remove_vma(vma);
73304 @@ -1807,6 +2106,16 @@ detach_vmas_to_be_unmapped(struct mm_str
73305 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
73306 vma->vm_prev = NULL;
73307 do {
73308 +
73309 +#ifdef CONFIG_PAX_SEGMEXEC
73310 + if (vma->vm_mirror) {
73311 + BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
73312 + vma->vm_mirror->vm_mirror = NULL;
73313 + vma->vm_mirror->vm_flags &= ~VM_EXEC;
73314 + vma->vm_mirror = NULL;
73315 + }
73316 +#endif
73317 +
73318 rb_erase(&vma->vm_rb, &mm->mm_rb);
73319 mm->map_count--;
73320 tail_vma = vma;
73321 @@ -1834,10 +2143,25 @@ int split_vma(struct mm_struct * mm, str
73322 struct mempolicy *pol;
73323 struct vm_area_struct *new;
73324
73325 +#ifdef CONFIG_PAX_SEGMEXEC
73326 + struct vm_area_struct *vma_m, *new_m = NULL;
73327 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
73328 +#endif
73329 +
73330 if (is_vm_hugetlb_page(vma) && (addr &
73331 ~(huge_page_mask(hstate_vma(vma)))))
73332 return -EINVAL;
73333
73334 +#ifdef CONFIG_PAX_SEGMEXEC
73335 + vma_m = pax_find_mirror_vma(vma);
73336 +
73337 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
73338 + BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
73339 + if (mm->map_count >= sysctl_max_map_count-1)
73340 + return -ENOMEM;
73341 + } else
73342 +#endif
73343 +
73344 if (mm->map_count >= sysctl_max_map_count)
73345 return -ENOMEM;
73346
73347 @@ -1845,6 +2169,16 @@ int split_vma(struct mm_struct * mm, str
73348 if (!new)
73349 return -ENOMEM;
73350
73351 +#ifdef CONFIG_PAX_SEGMEXEC
73352 + if (vma_m) {
73353 + new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
73354 + if (!new_m) {
73355 + kmem_cache_free(vm_area_cachep, new);
73356 + return -ENOMEM;
73357 + }
73358 + }
73359 +#endif
73360 +
73361 /* most fields are the same, copy all, and then fixup */
73362 *new = *vma;
73363
73364 @@ -1855,8 +2189,29 @@ int split_vma(struct mm_struct * mm, str
73365 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
73366 }
73367
73368 +#ifdef CONFIG_PAX_SEGMEXEC
73369 + if (vma_m) {
73370 + *new_m = *vma_m;
73371 + new_m->vm_mirror = new;
73372 + new->vm_mirror = new_m;
73373 +
73374 + if (new_below)
73375 + new_m->vm_end = addr_m;
73376 + else {
73377 + new_m->vm_start = addr_m;
73378 + new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
73379 + }
73380 + }
73381 +#endif
73382 +
73383 pol = mpol_dup(vma_policy(vma));
73384 if (IS_ERR(pol)) {
73385 +
73386 +#ifdef CONFIG_PAX_SEGMEXEC
73387 + if (new_m)
73388 + kmem_cache_free(vm_area_cachep, new_m);
73389 +#endif
73390 +
73391 kmem_cache_free(vm_area_cachep, new);
73392 return PTR_ERR(pol);
73393 }
73394 @@ -1877,6 +2232,28 @@ int split_vma(struct mm_struct * mm, str
73395 else
73396 vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
73397
73398 +#ifdef CONFIG_PAX_SEGMEXEC
73399 + if (vma_m) {
73400 + mpol_get(pol);
73401 + vma_set_policy(new_m, pol);
73402 +
73403 + if (new_m->vm_file) {
73404 + get_file(new_m->vm_file);
73405 + if (vma_m->vm_flags & VM_EXECUTABLE)
73406 + added_exe_file_vma(mm);
73407 + }
73408 +
73409 + if (new_m->vm_ops && new_m->vm_ops->open)
73410 + new_m->vm_ops->open(new_m);
73411 +
73412 + if (new_below)
73413 + vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
73414 + ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
73415 + else
73416 + vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
73417 + }
73418 +#endif
73419 +
73420 return 0;
73421 }
73422
73423 @@ -1885,11 +2262,30 @@ int split_vma(struct mm_struct * mm, str
73424 * work. This now handles partial unmappings.
73425 * Jeremy Fitzhardinge <jeremy@goop.org>
73426 */
73427 +#ifdef CONFIG_PAX_SEGMEXEC
73428 +int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73429 +{
73430 + int ret = __do_munmap(mm, start, len);
73431 + if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
73432 + return ret;
73433 +
73434 + return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
73435 +}
73436 +
73437 +int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73438 +#else
73439 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73440 +#endif
73441 {
73442 unsigned long end;
73443 struct vm_area_struct *vma, *prev, *last;
73444
73445 + /*
73446 + * mm->mmap_sem is required to protect against another thread
73447 + * changing the mappings in case we sleep.
73448 + */
73449 + verify_mm_writelocked(mm);
73450 +
73451 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
73452 return -EINVAL;
73453
73454 @@ -1953,6 +2349,8 @@ int do_munmap(struct mm_struct *mm, unsi
73455 /* Fix up all other VM information */
73456 remove_vma_list(mm, vma);
73457
73458 + track_exec_limit(mm, start, end, 0UL);
73459 +
73460 return 0;
73461 }
73462
73463 @@ -1965,22 +2363,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
73464
73465 profile_munmap(addr);
73466
73467 +#ifdef CONFIG_PAX_SEGMEXEC
73468 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
73469 + (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
73470 + return -EINVAL;
73471 +#endif
73472 +
73473 down_write(&mm->mmap_sem);
73474 ret = do_munmap(mm, addr, len);
73475 up_write(&mm->mmap_sem);
73476 return ret;
73477 }
73478
73479 -static inline void verify_mm_writelocked(struct mm_struct *mm)
73480 -{
73481 -#ifdef CONFIG_DEBUG_VM
73482 - if (unlikely(down_read_trylock(&mm->mmap_sem))) {
73483 - WARN_ON(1);
73484 - up_read(&mm->mmap_sem);
73485 - }
73486 -#endif
73487 -}
73488 -
73489 /*
73490 * this is really a simplified "do_mmap". it only handles
73491 * anonymous maps. eventually we may be able to do some
73492 @@ -1994,6 +2388,7 @@ unsigned long do_brk(unsigned long addr,
73493 struct rb_node ** rb_link, * rb_parent;
73494 pgoff_t pgoff = addr >> PAGE_SHIFT;
73495 int error;
73496 + unsigned long charged;
73497
73498 len = PAGE_ALIGN(len);
73499 if (!len)
73500 @@ -2005,16 +2400,30 @@ unsigned long do_brk(unsigned long addr,
73501
73502 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
73503
73504 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
73505 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
73506 + flags &= ~VM_EXEC;
73507 +
73508 +#ifdef CONFIG_PAX_MPROTECT
73509 + if (mm->pax_flags & MF_PAX_MPROTECT)
73510 + flags &= ~VM_MAYEXEC;
73511 +#endif
73512 +
73513 + }
73514 +#endif
73515 +
73516 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
73517 if (error & ~PAGE_MASK)
73518 return error;
73519
73520 + charged = len >> PAGE_SHIFT;
73521 +
73522 /*
73523 * mlock MCL_FUTURE?
73524 */
73525 if (mm->def_flags & VM_LOCKED) {
73526 unsigned long locked, lock_limit;
73527 - locked = len >> PAGE_SHIFT;
73528 + locked = charged;
73529 locked += mm->locked_vm;
73530 lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
73531 lock_limit >>= PAGE_SHIFT;
73532 @@ -2031,22 +2440,22 @@ unsigned long do_brk(unsigned long addr,
73533 /*
73534 * Clear old maps. this also does some error checking for us
73535 */
73536 - munmap_back:
73537 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73538 if (vma && vma->vm_start < addr + len) {
73539 if (do_munmap(mm, addr, len))
73540 return -ENOMEM;
73541 - goto munmap_back;
73542 + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73543 + BUG_ON(vma && vma->vm_start < addr + len);
73544 }
73545
73546 /* Check against address space limits *after* clearing old maps... */
73547 - if (!may_expand_vm(mm, len >> PAGE_SHIFT))
73548 + if (!may_expand_vm(mm, charged))
73549 return -ENOMEM;
73550
73551 if (mm->map_count > sysctl_max_map_count)
73552 return -ENOMEM;
73553
73554 - if (security_vm_enough_memory(len >> PAGE_SHIFT))
73555 + if (security_vm_enough_memory(charged))
73556 return -ENOMEM;
73557
73558 /* Can we just expand an old private anonymous mapping? */
73559 @@ -2060,7 +2469,7 @@ unsigned long do_brk(unsigned long addr,
73560 */
73561 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73562 if (!vma) {
73563 - vm_unacct_memory(len >> PAGE_SHIFT);
73564 + vm_unacct_memory(charged);
73565 return -ENOMEM;
73566 }
73567
73568 @@ -2072,11 +2481,12 @@ unsigned long do_brk(unsigned long addr,
73569 vma->vm_page_prot = vm_get_page_prot(flags);
73570 vma_link(mm, vma, prev, rb_link, rb_parent);
73571 out:
73572 - mm->total_vm += len >> PAGE_SHIFT;
73573 + mm->total_vm += charged;
73574 if (flags & VM_LOCKED) {
73575 if (!mlock_vma_pages_range(vma, addr, addr + len))
73576 - mm->locked_vm += (len >> PAGE_SHIFT);
73577 + mm->locked_vm += charged;
73578 }
73579 + track_exec_limit(mm, addr, addr + len, flags);
73580 return addr;
73581 }
73582
73583 @@ -2123,8 +2533,10 @@ void exit_mmap(struct mm_struct *mm)
73584 * Walk the list again, actually closing and freeing it,
73585 * with preemption enabled, without holding any MM locks.
73586 */
73587 - while (vma)
73588 + while (vma) {
73589 + vma->vm_mirror = NULL;
73590 vma = remove_vma(vma);
73591 + }
73592
73593 BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
73594 }
73595 @@ -2138,6 +2550,10 @@ int insert_vm_struct(struct mm_struct *
73596 struct vm_area_struct * __vma, * prev;
73597 struct rb_node ** rb_link, * rb_parent;
73598
73599 +#ifdef CONFIG_PAX_SEGMEXEC
73600 + struct vm_area_struct *vma_m = NULL;
73601 +#endif
73602 +
73603 /*
73604 * The vm_pgoff of a purely anonymous vma should be irrelevant
73605 * until its first write fault, when page's anon_vma and index
73606 @@ -2160,7 +2576,22 @@ int insert_vm_struct(struct mm_struct *
73607 if ((vma->vm_flags & VM_ACCOUNT) &&
73608 security_vm_enough_memory_mm(mm, vma_pages(vma)))
73609 return -ENOMEM;
73610 +
73611 +#ifdef CONFIG_PAX_SEGMEXEC
73612 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
73613 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73614 + if (!vma_m)
73615 + return -ENOMEM;
73616 + }
73617 +#endif
73618 +
73619 vma_link(mm, vma, prev, rb_link, rb_parent);
73620 +
73621 +#ifdef CONFIG_PAX_SEGMEXEC
73622 + if (vma_m)
73623 + pax_mirror_vma(vma_m, vma);
73624 +#endif
73625 +
73626 return 0;
73627 }
73628
73629 @@ -2178,6 +2609,8 @@ struct vm_area_struct *copy_vma(struct v
73630 struct rb_node **rb_link, *rb_parent;
73631 struct mempolicy *pol;
73632
73633 + BUG_ON(vma->vm_mirror);
73634 +
73635 /*
73636 * If anonymous vma has not yet been faulted, update new pgoff
73637 * to match new location, to increase its chance of merging.
73638 @@ -2221,6 +2654,35 @@ struct vm_area_struct *copy_vma(struct v
73639 return new_vma;
73640 }
73641
73642 +#ifdef CONFIG_PAX_SEGMEXEC
73643 +void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
73644 +{
73645 + struct vm_area_struct *prev_m;
73646 + struct rb_node **rb_link_m, *rb_parent_m;
73647 + struct mempolicy *pol_m;
73648 +
73649 + BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
73650 + BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
73651 + BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
73652 + *vma_m = *vma;
73653 + pol_m = vma_policy(vma_m);
73654 + mpol_get(pol_m);
73655 + vma_set_policy(vma_m, pol_m);
73656 + vma_m->vm_start += SEGMEXEC_TASK_SIZE;
73657 + vma_m->vm_end += SEGMEXEC_TASK_SIZE;
73658 + vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
73659 + vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
73660 + if (vma_m->vm_file)
73661 + get_file(vma_m->vm_file);
73662 + if (vma_m->vm_ops && vma_m->vm_ops->open)
73663 + vma_m->vm_ops->open(vma_m);
73664 + find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
73665 + vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
73666 + vma_m->vm_mirror = vma;
73667 + vma->vm_mirror = vma_m;
73668 +}
73669 +#endif
73670 +
73671 /*
73672 * Return true if the calling process may expand its vm space by the passed
73673 * number of pages
73674 @@ -2231,7 +2693,7 @@ int may_expand_vm(struct mm_struct *mm,
73675 unsigned long lim;
73676
73677 lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
73678 -
73679 + gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
73680 if (cur + npages > lim)
73681 return 0;
73682 return 1;
73683 @@ -2301,6 +2763,22 @@ int install_special_mapping(struct mm_st
73684 vma->vm_start = addr;
73685 vma->vm_end = addr + len;
73686
73687 +#ifdef CONFIG_PAX_MPROTECT
73688 + if (mm->pax_flags & MF_PAX_MPROTECT) {
73689 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
73690 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
73691 + return -EPERM;
73692 + if (!(vm_flags & VM_EXEC))
73693 + vm_flags &= ~VM_MAYEXEC;
73694 +#else
73695 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
73696 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
73697 +#endif
73698 + else
73699 + vm_flags &= ~VM_MAYWRITE;
73700 + }
73701 +#endif
73702 +
73703 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
73704 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
73705
73706 diff -urNp linux-2.6.32.46/mm/mprotect.c linux-2.6.32.46/mm/mprotect.c
73707 --- linux-2.6.32.46/mm/mprotect.c 2011-03-27 14:31:47.000000000 -0400
73708 +++ linux-2.6.32.46/mm/mprotect.c 2011-04-17 15:56:46.000000000 -0400
73709 @@ -24,10 +24,16 @@
73710 #include <linux/mmu_notifier.h>
73711 #include <linux/migrate.h>
73712 #include <linux/perf_event.h>
73713 +
73714 +#ifdef CONFIG_PAX_MPROTECT
73715 +#include <linux/elf.h>
73716 +#endif
73717 +
73718 #include <asm/uaccess.h>
73719 #include <asm/pgtable.h>
73720 #include <asm/cacheflush.h>
73721 #include <asm/tlbflush.h>
73722 +#include <asm/mmu_context.h>
73723
73724 #ifndef pgprot_modify
73725 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
73726 @@ -132,6 +138,48 @@ static void change_protection(struct vm_
73727 flush_tlb_range(vma, start, end);
73728 }
73729
73730 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
73731 +/* called while holding the mmap semaphor for writing except stack expansion */
73732 +void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
73733 +{
73734 + unsigned long oldlimit, newlimit = 0UL;
73735 +
73736 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || nx_enabled)
73737 + return;
73738 +
73739 + spin_lock(&mm->page_table_lock);
73740 + oldlimit = mm->context.user_cs_limit;
73741 + if ((prot & VM_EXEC) && oldlimit < end)
73742 + /* USER_CS limit moved up */
73743 + newlimit = end;
73744 + else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
73745 + /* USER_CS limit moved down */
73746 + newlimit = start;
73747 +
73748 + if (newlimit) {
73749 + mm->context.user_cs_limit = newlimit;
73750 +
73751 +#ifdef CONFIG_SMP
73752 + wmb();
73753 + cpus_clear(mm->context.cpu_user_cs_mask);
73754 + cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
73755 +#endif
73756 +
73757 + set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
73758 + }
73759 + spin_unlock(&mm->page_table_lock);
73760 + if (newlimit == end) {
73761 + struct vm_area_struct *vma = find_vma(mm, oldlimit);
73762 +
73763 + for (; vma && vma->vm_start < end; vma = vma->vm_next)
73764 + if (is_vm_hugetlb_page(vma))
73765 + hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
73766 + else
73767 + change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
73768 + }
73769 +}
73770 +#endif
73771 +
73772 int
73773 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
73774 unsigned long start, unsigned long end, unsigned long newflags)
73775 @@ -144,11 +192,29 @@ mprotect_fixup(struct vm_area_struct *vm
73776 int error;
73777 int dirty_accountable = 0;
73778
73779 +#ifdef CONFIG_PAX_SEGMEXEC
73780 + struct vm_area_struct *vma_m = NULL;
73781 + unsigned long start_m, end_m;
73782 +
73783 + start_m = start + SEGMEXEC_TASK_SIZE;
73784 + end_m = end + SEGMEXEC_TASK_SIZE;
73785 +#endif
73786 +
73787 if (newflags == oldflags) {
73788 *pprev = vma;
73789 return 0;
73790 }
73791
73792 + if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
73793 + struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
73794 +
73795 + if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
73796 + return -ENOMEM;
73797 +
73798 + if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
73799 + return -ENOMEM;
73800 + }
73801 +
73802 /*
73803 * If we make a private mapping writable we increase our commit;
73804 * but (without finer accounting) cannot reduce our commit if we
73805 @@ -165,6 +231,38 @@ mprotect_fixup(struct vm_area_struct *vm
73806 }
73807 }
73808
73809 +#ifdef CONFIG_PAX_SEGMEXEC
73810 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
73811 + if (start != vma->vm_start) {
73812 + error = split_vma(mm, vma, start, 1);
73813 + if (error)
73814 + goto fail;
73815 + BUG_ON(!*pprev || (*pprev)->vm_next == vma);
73816 + *pprev = (*pprev)->vm_next;
73817 + }
73818 +
73819 + if (end != vma->vm_end) {
73820 + error = split_vma(mm, vma, end, 0);
73821 + if (error)
73822 + goto fail;
73823 + }
73824 +
73825 + if (pax_find_mirror_vma(vma)) {
73826 + error = __do_munmap(mm, start_m, end_m - start_m);
73827 + if (error)
73828 + goto fail;
73829 + } else {
73830 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73831 + if (!vma_m) {
73832 + error = -ENOMEM;
73833 + goto fail;
73834 + }
73835 + vma->vm_flags = newflags;
73836 + pax_mirror_vma(vma_m, vma);
73837 + }
73838 + }
73839 +#endif
73840 +
73841 /*
73842 * First try to merge with previous and/or next vma.
73843 */
73844 @@ -195,9 +293,21 @@ success:
73845 * vm_flags and vm_page_prot are protected by the mmap_sem
73846 * held in write mode.
73847 */
73848 +
73849 +#ifdef CONFIG_PAX_SEGMEXEC
73850 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
73851 + pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
73852 +#endif
73853 +
73854 vma->vm_flags = newflags;
73855 +
73856 +#ifdef CONFIG_PAX_MPROTECT
73857 + if (mm->binfmt && mm->binfmt->handle_mprotect)
73858 + mm->binfmt->handle_mprotect(vma, newflags);
73859 +#endif
73860 +
73861 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
73862 - vm_get_page_prot(newflags));
73863 + vm_get_page_prot(vma->vm_flags));
73864
73865 if (vma_wants_writenotify(vma)) {
73866 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
73867 @@ -239,6 +349,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
73868 end = start + len;
73869 if (end <= start)
73870 return -ENOMEM;
73871 +
73872 +#ifdef CONFIG_PAX_SEGMEXEC
73873 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
73874 + if (end > SEGMEXEC_TASK_SIZE)
73875 + return -EINVAL;
73876 + } else
73877 +#endif
73878 +
73879 + if (end > TASK_SIZE)
73880 + return -EINVAL;
73881 +
73882 if (!arch_validate_prot(prot))
73883 return -EINVAL;
73884
73885 @@ -246,7 +367,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
73886 /*
73887 * Does the application expect PROT_READ to imply PROT_EXEC:
73888 */
73889 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
73890 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
73891 prot |= PROT_EXEC;
73892
73893 vm_flags = calc_vm_prot_bits(prot);
73894 @@ -278,6 +399,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
73895 if (start > vma->vm_start)
73896 prev = vma;
73897
73898 +#ifdef CONFIG_PAX_MPROTECT
73899 + if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
73900 + current->mm->binfmt->handle_mprotect(vma, vm_flags);
73901 +#endif
73902 +
73903 for (nstart = start ; ; ) {
73904 unsigned long newflags;
73905
73906 @@ -287,6 +413,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
73907
73908 /* newflags >> 4 shift VM_MAY% in place of VM_% */
73909 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
73910 + if (prot & (PROT_WRITE | PROT_EXEC))
73911 + gr_log_rwxmprotect(vma->vm_file);
73912 +
73913 + error = -EACCES;
73914 + goto out;
73915 + }
73916 +
73917 + if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
73918 error = -EACCES;
73919 goto out;
73920 }
73921 @@ -301,6 +435,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
73922 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
73923 if (error)
73924 goto out;
73925 +
73926 + track_exec_limit(current->mm, nstart, tmp, vm_flags);
73927 +
73928 nstart = tmp;
73929
73930 if (nstart < prev->vm_end)
73931 diff -urNp linux-2.6.32.46/mm/mremap.c linux-2.6.32.46/mm/mremap.c
73932 --- linux-2.6.32.46/mm/mremap.c 2011-04-17 17:00:52.000000000 -0400
73933 +++ linux-2.6.32.46/mm/mremap.c 2011-04-17 17:03:58.000000000 -0400
73934 @@ -112,6 +112,12 @@ static void move_ptes(struct vm_area_str
73935 continue;
73936 pte = ptep_clear_flush(vma, old_addr, old_pte);
73937 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
73938 +
73939 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
73940 + if (!nx_enabled && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
73941 + pte = pte_exprotect(pte);
73942 +#endif
73943 +
73944 set_pte_at(mm, new_addr, new_pte, pte);
73945 }
73946
73947 @@ -271,6 +277,11 @@ static struct vm_area_struct *vma_to_res
73948 if (is_vm_hugetlb_page(vma))
73949 goto Einval;
73950
73951 +#ifdef CONFIG_PAX_SEGMEXEC
73952 + if (pax_find_mirror_vma(vma))
73953 + goto Einval;
73954 +#endif
73955 +
73956 /* We can't remap across vm area boundaries */
73957 if (old_len > vma->vm_end - addr)
73958 goto Efault;
73959 @@ -327,20 +338,25 @@ static unsigned long mremap_to(unsigned
73960 unsigned long ret = -EINVAL;
73961 unsigned long charged = 0;
73962 unsigned long map_flags;
73963 + unsigned long pax_task_size = TASK_SIZE;
73964
73965 if (new_addr & ~PAGE_MASK)
73966 goto out;
73967
73968 - if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
73969 +#ifdef CONFIG_PAX_SEGMEXEC
73970 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
73971 + pax_task_size = SEGMEXEC_TASK_SIZE;
73972 +#endif
73973 +
73974 + pax_task_size -= PAGE_SIZE;
73975 +
73976 + if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
73977 goto out;
73978
73979 /* Check if the location we're moving into overlaps the
73980 * old location at all, and fail if it does.
73981 */
73982 - if ((new_addr <= addr) && (new_addr+new_len) > addr)
73983 - goto out;
73984 -
73985 - if ((addr <= new_addr) && (addr+old_len) > new_addr)
73986 + if (addr + old_len > new_addr && new_addr + new_len > addr)
73987 goto out;
73988
73989 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
73990 @@ -412,6 +428,7 @@ unsigned long do_mremap(unsigned long ad
73991 struct vm_area_struct *vma;
73992 unsigned long ret = -EINVAL;
73993 unsigned long charged = 0;
73994 + unsigned long pax_task_size = TASK_SIZE;
73995
73996 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
73997 goto out;
73998 @@ -430,6 +447,17 @@ unsigned long do_mremap(unsigned long ad
73999 if (!new_len)
74000 goto out;
74001
74002 +#ifdef CONFIG_PAX_SEGMEXEC
74003 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
74004 + pax_task_size = SEGMEXEC_TASK_SIZE;
74005 +#endif
74006 +
74007 + pax_task_size -= PAGE_SIZE;
74008 +
74009 + if (new_len > pax_task_size || addr > pax_task_size-new_len ||
74010 + old_len > pax_task_size || addr > pax_task_size-old_len)
74011 + goto out;
74012 +
74013 if (flags & MREMAP_FIXED) {
74014 if (flags & MREMAP_MAYMOVE)
74015 ret = mremap_to(addr, old_len, new_addr, new_len);
74016 @@ -476,6 +504,7 @@ unsigned long do_mremap(unsigned long ad
74017 addr + new_len);
74018 }
74019 ret = addr;
74020 + track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
74021 goto out;
74022 }
74023 }
74024 @@ -502,7 +531,13 @@ unsigned long do_mremap(unsigned long ad
74025 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
74026 if (ret)
74027 goto out;
74028 +
74029 + map_flags = vma->vm_flags;
74030 ret = move_vma(vma, addr, old_len, new_len, new_addr);
74031 + if (!(ret & ~PAGE_MASK)) {
74032 + track_exec_limit(current->mm, addr, addr + old_len, 0UL);
74033 + track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
74034 + }
74035 }
74036 out:
74037 if (ret & ~PAGE_MASK)
74038 diff -urNp linux-2.6.32.46/mm/nommu.c linux-2.6.32.46/mm/nommu.c
74039 --- linux-2.6.32.46/mm/nommu.c 2011-03-27 14:31:47.000000000 -0400
74040 +++ linux-2.6.32.46/mm/nommu.c 2011-04-17 15:56:46.000000000 -0400
74041 @@ -67,7 +67,6 @@ int sysctl_overcommit_memory = OVERCOMMI
74042 int sysctl_overcommit_ratio = 50; /* default is 50% */
74043 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
74044 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
74045 -int heap_stack_gap = 0;
74046
74047 atomic_long_t mmap_pages_allocated;
74048
74049 @@ -761,15 +760,6 @@ struct vm_area_struct *find_vma(struct m
74050 EXPORT_SYMBOL(find_vma);
74051
74052 /*
74053 - * find a VMA
74054 - * - we don't extend stack VMAs under NOMMU conditions
74055 - */
74056 -struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
74057 -{
74058 - return find_vma(mm, addr);
74059 -}
74060 -
74061 -/*
74062 * expand a stack to a given address
74063 * - not supported under NOMMU conditions
74064 */
74065 diff -urNp linux-2.6.32.46/mm/page_alloc.c linux-2.6.32.46/mm/page_alloc.c
74066 --- linux-2.6.32.46/mm/page_alloc.c 2011-06-25 12:55:35.000000000 -0400
74067 +++ linux-2.6.32.46/mm/page_alloc.c 2011-07-09 09:13:08.000000000 -0400
74068 @@ -289,7 +289,7 @@ out:
74069 * This usage means that zero-order pages may not be compound.
74070 */
74071
74072 -static void free_compound_page(struct page *page)
74073 +void free_compound_page(struct page *page)
74074 {
74075 __free_pages_ok(page, compound_order(page));
74076 }
74077 @@ -587,6 +587,10 @@ static void __free_pages_ok(struct page
74078 int bad = 0;
74079 int wasMlocked = __TestClearPageMlocked(page);
74080
74081 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
74082 + unsigned long index = 1UL << order;
74083 +#endif
74084 +
74085 kmemcheck_free_shadow(page, order);
74086
74087 for (i = 0 ; i < (1 << order) ; ++i)
74088 @@ -599,6 +603,12 @@ static void __free_pages_ok(struct page
74089 debug_check_no_obj_freed(page_address(page),
74090 PAGE_SIZE << order);
74091 }
74092 +
74093 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
74094 + for (; index; --index)
74095 + sanitize_highpage(page + index - 1);
74096 +#endif
74097 +
74098 arch_free_page(page, order);
74099 kernel_map_pages(page, 1 << order, 0);
74100
74101 @@ -702,8 +712,10 @@ static int prep_new_page(struct page *pa
74102 arch_alloc_page(page, order);
74103 kernel_map_pages(page, 1 << order, 1);
74104
74105 +#ifndef CONFIG_PAX_MEMORY_SANITIZE
74106 if (gfp_flags & __GFP_ZERO)
74107 prep_zero_page(page, order, gfp_flags);
74108 +#endif
74109
74110 if (order && (gfp_flags & __GFP_COMP))
74111 prep_compound_page(page, order);
74112 @@ -1097,6 +1109,11 @@ static void free_hot_cold_page(struct pa
74113 debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
74114 debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
74115 }
74116 +
74117 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
74118 + sanitize_highpage(page);
74119 +#endif
74120 +
74121 arch_free_page(page, 0);
74122 kernel_map_pages(page, 1, 0);
74123
74124 @@ -2179,6 +2196,8 @@ void show_free_areas(void)
74125 int cpu;
74126 struct zone *zone;
74127
74128 + pax_track_stack();
74129 +
74130 for_each_populated_zone(zone) {
74131 show_node(zone);
74132 printk("%s per-cpu:\n", zone->name);
74133 @@ -3736,7 +3755,7 @@ static void __init setup_usemap(struct p
74134 zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
74135 }
74136 #else
74137 -static void inline setup_usemap(struct pglist_data *pgdat,
74138 +static inline void setup_usemap(struct pglist_data *pgdat,
74139 struct zone *zone, unsigned long zonesize) {}
74140 #endif /* CONFIG_SPARSEMEM */
74141
74142 diff -urNp linux-2.6.32.46/mm/percpu.c linux-2.6.32.46/mm/percpu.c
74143 --- linux-2.6.32.46/mm/percpu.c 2011-03-27 14:31:47.000000000 -0400
74144 +++ linux-2.6.32.46/mm/percpu.c 2011-04-17 15:56:46.000000000 -0400
74145 @@ -115,7 +115,7 @@ static unsigned int pcpu_first_unit_cpu
74146 static unsigned int pcpu_last_unit_cpu __read_mostly;
74147
74148 /* the address of the first chunk which starts with the kernel static area */
74149 -void *pcpu_base_addr __read_mostly;
74150 +void *pcpu_base_addr __read_only;
74151 EXPORT_SYMBOL_GPL(pcpu_base_addr);
74152
74153 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
74154 diff -urNp linux-2.6.32.46/mm/rmap.c linux-2.6.32.46/mm/rmap.c
74155 --- linux-2.6.32.46/mm/rmap.c 2011-03-27 14:31:47.000000000 -0400
74156 +++ linux-2.6.32.46/mm/rmap.c 2011-04-17 15:56:46.000000000 -0400
74157 @@ -121,6 +121,17 @@ int anon_vma_prepare(struct vm_area_stru
74158 /* page_table_lock to protect against threads */
74159 spin_lock(&mm->page_table_lock);
74160 if (likely(!vma->anon_vma)) {
74161 +
74162 +#ifdef CONFIG_PAX_SEGMEXEC
74163 + struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
74164 +
74165 + if (vma_m) {
74166 + BUG_ON(vma_m->anon_vma);
74167 + vma_m->anon_vma = anon_vma;
74168 + list_add_tail(&vma_m->anon_vma_node, &anon_vma->head);
74169 + }
74170 +#endif
74171 +
74172 vma->anon_vma = anon_vma;
74173 list_add_tail(&vma->anon_vma_node, &anon_vma->head);
74174 allocated = NULL;
74175 diff -urNp linux-2.6.32.46/mm/shmem.c linux-2.6.32.46/mm/shmem.c
74176 --- linux-2.6.32.46/mm/shmem.c 2011-03-27 14:31:47.000000000 -0400
74177 +++ linux-2.6.32.46/mm/shmem.c 2011-05-18 20:09:37.000000000 -0400
74178 @@ -31,7 +31,7 @@
74179 #include <linux/swap.h>
74180 #include <linux/ima.h>
74181
74182 -static struct vfsmount *shm_mnt;
74183 +struct vfsmount *shm_mnt;
74184
74185 #ifdef CONFIG_SHMEM
74186 /*
74187 @@ -1061,6 +1061,8 @@ static int shmem_writepage(struct page *
74188 goto unlock;
74189 }
74190 entry = shmem_swp_entry(info, index, NULL);
74191 + if (!entry)
74192 + goto unlock;
74193 if (entry->val) {
74194 /*
74195 * The more uptodate page coming down from a stacked
74196 @@ -1144,6 +1146,8 @@ static struct page *shmem_swapin(swp_ent
74197 struct vm_area_struct pvma;
74198 struct page *page;
74199
74200 + pax_track_stack();
74201 +
74202 spol = mpol_cond_copy(&mpol,
74203 mpol_shared_policy_lookup(&info->policy, idx));
74204
74205 @@ -1962,7 +1966,7 @@ static int shmem_symlink(struct inode *d
74206
74207 info = SHMEM_I(inode);
74208 inode->i_size = len-1;
74209 - if (len <= (char *)inode - (char *)info) {
74210 + if (len <= (char *)inode - (char *)info && len <= 64) {
74211 /* do it inline */
74212 memcpy(info, symname, len);
74213 inode->i_op = &shmem_symlink_inline_operations;
74214 @@ -2310,8 +2314,7 @@ int shmem_fill_super(struct super_block
74215 int err = -ENOMEM;
74216
74217 /* Round up to L1_CACHE_BYTES to resist false sharing */
74218 - sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
74219 - L1_CACHE_BYTES), GFP_KERNEL);
74220 + sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
74221 if (!sbinfo)
74222 return -ENOMEM;
74223
74224 diff -urNp linux-2.6.32.46/mm/slab.c linux-2.6.32.46/mm/slab.c
74225 --- linux-2.6.32.46/mm/slab.c 2011-03-27 14:31:47.000000000 -0400
74226 +++ linux-2.6.32.46/mm/slab.c 2011-05-04 17:56:20.000000000 -0400
74227 @@ -174,7 +174,7 @@
74228
74229 /* Legal flag mask for kmem_cache_create(). */
74230 #if DEBUG
74231 -# define CREATE_MASK (SLAB_RED_ZONE | \
74232 +# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
74233 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
74234 SLAB_CACHE_DMA | \
74235 SLAB_STORE_USER | \
74236 @@ -182,7 +182,7 @@
74237 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
74238 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
74239 #else
74240 -# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
74241 +# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
74242 SLAB_CACHE_DMA | \
74243 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
74244 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
74245 @@ -308,7 +308,7 @@ struct kmem_list3 {
74246 * Need this for bootstrapping a per node allocator.
74247 */
74248 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
74249 -struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
74250 +struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
74251 #define CACHE_CACHE 0
74252 #define SIZE_AC MAX_NUMNODES
74253 #define SIZE_L3 (2 * MAX_NUMNODES)
74254 @@ -409,10 +409,10 @@ static void kmem_list3_init(struct kmem_
74255 if ((x)->max_freeable < i) \
74256 (x)->max_freeable = i; \
74257 } while (0)
74258 -#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
74259 -#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
74260 -#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
74261 -#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
74262 +#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
74263 +#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
74264 +#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
74265 +#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
74266 #else
74267 #define STATS_INC_ACTIVE(x) do { } while (0)
74268 #define STATS_DEC_ACTIVE(x) do { } while (0)
74269 @@ -558,7 +558,7 @@ static inline void *index_to_obj(struct
74270 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
74271 */
74272 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
74273 - const struct slab *slab, void *obj)
74274 + const struct slab *slab, const void *obj)
74275 {
74276 u32 offset = (obj - slab->s_mem);
74277 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
74278 @@ -1453,7 +1453,7 @@ void __init kmem_cache_init(void)
74279 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
74280 sizes[INDEX_AC].cs_size,
74281 ARCH_KMALLOC_MINALIGN,
74282 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74283 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74284 NULL);
74285
74286 if (INDEX_AC != INDEX_L3) {
74287 @@ -1461,7 +1461,7 @@ void __init kmem_cache_init(void)
74288 kmem_cache_create(names[INDEX_L3].name,
74289 sizes[INDEX_L3].cs_size,
74290 ARCH_KMALLOC_MINALIGN,
74291 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74292 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74293 NULL);
74294 }
74295
74296 @@ -1479,7 +1479,7 @@ void __init kmem_cache_init(void)
74297 sizes->cs_cachep = kmem_cache_create(names->name,
74298 sizes->cs_size,
74299 ARCH_KMALLOC_MINALIGN,
74300 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74301 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74302 NULL);
74303 }
74304 #ifdef CONFIG_ZONE_DMA
74305 @@ -4211,10 +4211,10 @@ static int s_show(struct seq_file *m, vo
74306 }
74307 /* cpu stats */
74308 {
74309 - unsigned long allochit = atomic_read(&cachep->allochit);
74310 - unsigned long allocmiss = atomic_read(&cachep->allocmiss);
74311 - unsigned long freehit = atomic_read(&cachep->freehit);
74312 - unsigned long freemiss = atomic_read(&cachep->freemiss);
74313 + unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
74314 + unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
74315 + unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
74316 + unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
74317
74318 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
74319 allochit, allocmiss, freehit, freemiss);
74320 @@ -4471,15 +4471,66 @@ static const struct file_operations proc
74321
74322 static int __init slab_proc_init(void)
74323 {
74324 - proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
74325 + mode_t gr_mode = S_IRUGO;
74326 +
74327 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
74328 + gr_mode = S_IRUSR;
74329 +#endif
74330 +
74331 + proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
74332 #ifdef CONFIG_DEBUG_SLAB_LEAK
74333 - proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
74334 + proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
74335 #endif
74336 return 0;
74337 }
74338 module_init(slab_proc_init);
74339 #endif
74340
74341 +void check_object_size(const void *ptr, unsigned long n, bool to)
74342 +{
74343 +
74344 +#ifdef CONFIG_PAX_USERCOPY
74345 + struct page *page;
74346 + struct kmem_cache *cachep = NULL;
74347 + struct slab *slabp;
74348 + unsigned int objnr;
74349 + unsigned long offset;
74350 +
74351 + if (!n)
74352 + return;
74353 +
74354 + if (ZERO_OR_NULL_PTR(ptr))
74355 + goto report;
74356 +
74357 + if (!virt_addr_valid(ptr))
74358 + return;
74359 +
74360 + page = virt_to_head_page(ptr);
74361 +
74362 + if (!PageSlab(page)) {
74363 + if (object_is_on_stack(ptr, n) == -1)
74364 + goto report;
74365 + return;
74366 + }
74367 +
74368 + cachep = page_get_cache(page);
74369 + if (!(cachep->flags & SLAB_USERCOPY))
74370 + goto report;
74371 +
74372 + slabp = page_get_slab(page);
74373 + objnr = obj_to_index(cachep, slabp, ptr);
74374 + BUG_ON(objnr >= cachep->num);
74375 + offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
74376 + if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
74377 + return;
74378 +
74379 +report:
74380 + pax_report_usercopy(ptr, n, to, cachep ? cachep->name : NULL);
74381 +#endif
74382 +
74383 +}
74384 +EXPORT_SYMBOL(check_object_size);
74385 +
74386 /**
74387 * ksize - get the actual amount of memory allocated for a given object
74388 * @objp: Pointer to the object
74389 diff -urNp linux-2.6.32.46/mm/slob.c linux-2.6.32.46/mm/slob.c
74390 --- linux-2.6.32.46/mm/slob.c 2011-03-27 14:31:47.000000000 -0400
74391 +++ linux-2.6.32.46/mm/slob.c 2011-07-06 19:53:33.000000000 -0400
74392 @@ -29,7 +29,7 @@
74393 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
74394 * alloc_pages() directly, allocating compound pages so the page order
74395 * does not have to be separately tracked, and also stores the exact
74396 - * allocation size in page->private so that it can be used to accurately
74397 + * allocation size in slob_page->size so that it can be used to accurately
74398 * provide ksize(). These objects are detected in kfree() because slob_page()
74399 * is false for them.
74400 *
74401 @@ -58,6 +58,7 @@
74402 */
74403
74404 #include <linux/kernel.h>
74405 +#include <linux/sched.h>
74406 #include <linux/slab.h>
74407 #include <linux/mm.h>
74408 #include <linux/swap.h> /* struct reclaim_state */
74409 @@ -100,7 +101,8 @@ struct slob_page {
74410 unsigned long flags; /* mandatory */
74411 atomic_t _count; /* mandatory */
74412 slobidx_t units; /* free units left in page */
74413 - unsigned long pad[2];
74414 + unsigned long pad[1];
74415 + unsigned long size; /* size when >=PAGE_SIZE */
74416 slob_t *free; /* first free slob_t in page */
74417 struct list_head list; /* linked list of free pages */
74418 };
74419 @@ -133,7 +135,7 @@ static LIST_HEAD(free_slob_large);
74420 */
74421 static inline int is_slob_page(struct slob_page *sp)
74422 {
74423 - return PageSlab((struct page *)sp);
74424 + return PageSlab((struct page *)sp) && !sp->size;
74425 }
74426
74427 static inline void set_slob_page(struct slob_page *sp)
74428 @@ -148,7 +150,7 @@ static inline void clear_slob_page(struc
74429
74430 static inline struct slob_page *slob_page(const void *addr)
74431 {
74432 - return (struct slob_page *)virt_to_page(addr);
74433 + return (struct slob_page *)virt_to_head_page(addr);
74434 }
74435
74436 /*
74437 @@ -208,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_
74438 /*
74439 * Return the size of a slob block.
74440 */
74441 -static slobidx_t slob_units(slob_t *s)
74442 +static slobidx_t slob_units(const slob_t *s)
74443 {
74444 if (s->units > 0)
74445 return s->units;
74446 @@ -218,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
74447 /*
74448 * Return the next free slob block pointer after this one.
74449 */
74450 -static slob_t *slob_next(slob_t *s)
74451 +static slob_t *slob_next(const slob_t *s)
74452 {
74453 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
74454 slobidx_t next;
74455 @@ -233,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
74456 /*
74457 * Returns true if s is the last free block in its page.
74458 */
74459 -static int slob_last(slob_t *s)
74460 +static int slob_last(const slob_t *s)
74461 {
74462 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
74463 }
74464 @@ -252,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, i
74465 if (!page)
74466 return NULL;
74467
74468 + set_slob_page(page);
74469 return page_address(page);
74470 }
74471
74472 @@ -368,11 +371,11 @@ static void *slob_alloc(size_t size, gfp
74473 if (!b)
74474 return NULL;
74475 sp = slob_page(b);
74476 - set_slob_page(sp);
74477
74478 spin_lock_irqsave(&slob_lock, flags);
74479 sp->units = SLOB_UNITS(PAGE_SIZE);
74480 sp->free = b;
74481 + sp->size = 0;
74482 INIT_LIST_HEAD(&sp->list);
74483 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
74484 set_slob_page_free(sp, slob_list);
74485 @@ -475,10 +478,9 @@ out:
74486 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
74487 #endif
74488
74489 -void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74490 +static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
74491 {
74492 - unsigned int *m;
74493 - int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74494 + slob_t *m;
74495 void *ret;
74496
74497 lockdep_trace_alloc(gfp);
74498 @@ -491,7 +493,10 @@ void *__kmalloc_node(size_t size, gfp_t
74499
74500 if (!m)
74501 return NULL;
74502 - *m = size;
74503 + BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
74504 + BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
74505 + m[0].units = size;
74506 + m[1].units = align;
74507 ret = (void *)m + align;
74508
74509 trace_kmalloc_node(_RET_IP_, ret,
74510 @@ -501,16 +506,25 @@ void *__kmalloc_node(size_t size, gfp_t
74511
74512 ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
74513 if (ret) {
74514 - struct page *page;
74515 - page = virt_to_page(ret);
74516 - page->private = size;
74517 + struct slob_page *sp;
74518 + sp = slob_page(ret);
74519 + sp->size = size;
74520 }
74521
74522 trace_kmalloc_node(_RET_IP_, ret,
74523 size, PAGE_SIZE << order, gfp, node);
74524 }
74525
74526 - kmemleak_alloc(ret, size, 1, gfp);
74527 + return ret;
74528 +}
74529 +
74530 +void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74531 +{
74532 + int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74533 + void *ret = __kmalloc_node_align(size, gfp, node, align);
74534 +
74535 + if (!ZERO_OR_NULL_PTR(ret))
74536 + kmemleak_alloc(ret, size, 1, gfp);
74537 return ret;
74538 }
74539 EXPORT_SYMBOL(__kmalloc_node);
74540 @@ -528,13 +542,88 @@ void kfree(const void *block)
74541 sp = slob_page(block);
74542 if (is_slob_page(sp)) {
74543 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74544 - unsigned int *m = (unsigned int *)(block - align);
74545 - slob_free(m, *m + align);
74546 - } else
74547 + slob_t *m = (slob_t *)(block - align);
74548 + slob_free(m, m[0].units + align);
74549 + } else {
74550 + clear_slob_page(sp);
74551 + free_slob_page(sp);
74552 + sp->size = 0;
74553 put_page(&sp->page);
74554 + }
74555 }
74556 EXPORT_SYMBOL(kfree);
74557
74558 +void check_object_size(const void *ptr, unsigned long n, bool to)
74559 +{
74560 +
74561 +#ifdef CONFIG_PAX_USERCOPY
74562 + struct slob_page *sp;
74563 + const slob_t *free;
74564 + const void *base;
74565 + unsigned long flags;
74566 +
74567 + if (!n)
74568 + return;
74569 +
74570 + if (ZERO_OR_NULL_PTR(ptr))
74571 + goto report;
74572 +
74573 + if (!virt_addr_valid(ptr))
74574 + return;
74575 +
74576 + sp = slob_page(ptr);
74577 + if (!PageSlab((struct page*)sp)) {
74578 + if (object_is_on_stack(ptr, n) == -1)
74579 + goto report;
74580 + return;
74581 + }
74582 +
74583 + if (sp->size) {
74584 + base = page_address(&sp->page);
74585 + if (base <= ptr && n <= sp->size - (ptr - base))
74586 + return;
74587 + goto report;
74588 + }
74589 +
74590 + /* some tricky double walking to find the chunk */
74591 + spin_lock_irqsave(&slob_lock, flags);
74592 + base = (void *)((unsigned long)ptr & PAGE_MASK);
74593 + free = sp->free;
74594 +
74595 + while (!slob_last(free) && (void *)free <= ptr) {
74596 + base = free + slob_units(free);
74597 + free = slob_next(free);
74598 + }
74599 +
74600 + while (base < (void *)free) {
74601 + slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
74602 + int size = SLOB_UNIT * SLOB_UNITS(m + align);
74603 + int offset;
74604 +
74605 + if (ptr < base + align)
74606 + break;
74607 +
74608 + offset = ptr - base - align;
74609 + if (offset >= m) {
74610 + base += size;
74611 + continue;
74612 + }
74613 +
74614 + if (n > m - offset)
74615 + break;
74616 +
74617 + spin_unlock_irqrestore(&slob_lock, flags);
74618 + return;
74619 + }
74620 +
74621 + spin_unlock_irqrestore(&slob_lock, flags);
74622 +report:
74623 + pax_report_usercopy(ptr, n, to, NULL);
74624 +#endif
74625 +
74626 +}
74627 +EXPORT_SYMBOL(check_object_size);
74628 +
74629 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
74630 size_t ksize(const void *block)
74631 {
74632 @@ -547,10 +636,10 @@ size_t ksize(const void *block)
74633 sp = slob_page(block);
74634 if (is_slob_page(sp)) {
74635 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74636 - unsigned int *m = (unsigned int *)(block - align);
74637 - return SLOB_UNITS(*m) * SLOB_UNIT;
74638 + slob_t *m = (slob_t *)(block - align);
74639 + return SLOB_UNITS(m[0].units) * SLOB_UNIT;
74640 } else
74641 - return sp->page.private;
74642 + return sp->size;
74643 }
74644 EXPORT_SYMBOL(ksize);
74645
74646 @@ -566,8 +655,13 @@ struct kmem_cache *kmem_cache_create(con
74647 {
74648 struct kmem_cache *c;
74649
74650 +#ifdef CONFIG_PAX_USERCOPY
74651 + c = __kmalloc_node_align(sizeof(struct kmem_cache),
74652 + GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
74653 +#else
74654 c = slob_alloc(sizeof(struct kmem_cache),
74655 GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
74656 +#endif
74657
74658 if (c) {
74659 c->name = name;
74660 @@ -605,17 +699,25 @@ void *kmem_cache_alloc_node(struct kmem_
74661 {
74662 void *b;
74663
74664 +#ifdef CONFIG_PAX_USERCOPY
74665 + b = __kmalloc_node_align(c->size, flags, node, c->align);
74666 +#else
74667 if (c->size < PAGE_SIZE) {
74668 b = slob_alloc(c->size, flags, c->align, node);
74669 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
74670 SLOB_UNITS(c->size) * SLOB_UNIT,
74671 flags, node);
74672 } else {
74673 + struct slob_page *sp;
74674 +
74675 b = slob_new_pages(flags, get_order(c->size), node);
74676 + sp = slob_page(b);
74677 + sp->size = c->size;
74678 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
74679 PAGE_SIZE << get_order(c->size),
74680 flags, node);
74681 }
74682 +#endif
74683
74684 if (c->ctor)
74685 c->ctor(b);
74686 @@ -627,10 +729,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
74687
74688 static void __kmem_cache_free(void *b, int size)
74689 {
74690 - if (size < PAGE_SIZE)
74691 + struct slob_page *sp = slob_page(b);
74692 +
74693 + if (is_slob_page(sp))
74694 slob_free(b, size);
74695 - else
74696 + else {
74697 + clear_slob_page(sp);
74698 + free_slob_page(sp);
74699 + sp->size = 0;
74700 slob_free_pages(b, get_order(size));
74701 + }
74702 }
74703
74704 static void kmem_rcu_free(struct rcu_head *head)
74705 @@ -643,18 +751,32 @@ static void kmem_rcu_free(struct rcu_hea
74706
74707 void kmem_cache_free(struct kmem_cache *c, void *b)
74708 {
74709 + int size = c->size;
74710 +
74711 +#ifdef CONFIG_PAX_USERCOPY
74712 + if (size + c->align < PAGE_SIZE) {
74713 + size += c->align;
74714 + b -= c->align;
74715 + }
74716 +#endif
74717 +
74718 kmemleak_free_recursive(b, c->flags);
74719 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
74720 struct slob_rcu *slob_rcu;
74721 - slob_rcu = b + (c->size - sizeof(struct slob_rcu));
74722 + slob_rcu = b + (size - sizeof(struct slob_rcu));
74723 INIT_RCU_HEAD(&slob_rcu->head);
74724 - slob_rcu->size = c->size;
74725 + slob_rcu->size = size;
74726 call_rcu(&slob_rcu->head, kmem_rcu_free);
74727 } else {
74728 - __kmem_cache_free(b, c->size);
74729 + __kmem_cache_free(b, size);
74730 }
74731
74732 +#ifdef CONFIG_PAX_USERCOPY
74733 + trace_kfree(_RET_IP_, b);
74734 +#else
74735 trace_kmem_cache_free(_RET_IP_, b);
74736 +#endif
74737 +
74738 }
74739 EXPORT_SYMBOL(kmem_cache_free);
74740
74741 diff -urNp linux-2.6.32.46/mm/slub.c linux-2.6.32.46/mm/slub.c
74742 --- linux-2.6.32.46/mm/slub.c 2011-03-27 14:31:47.000000000 -0400
74743 +++ linux-2.6.32.46/mm/slub.c 2011-09-25 22:23:01.000000000 -0400
74744 @@ -201,7 +201,7 @@ struct track {
74745
74746 enum track_item { TRACK_ALLOC, TRACK_FREE };
74747
74748 -#ifdef CONFIG_SLUB_DEBUG
74749 +#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74750 static int sysfs_slab_add(struct kmem_cache *);
74751 static int sysfs_slab_alias(struct kmem_cache *, const char *);
74752 static void sysfs_slab_remove(struct kmem_cache *);
74753 @@ -410,7 +410,7 @@ static void print_track(const char *s, s
74754 if (!t->addr)
74755 return;
74756
74757 - printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
74758 + printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
74759 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
74760 }
74761
74762 @@ -1893,6 +1893,8 @@ void kmem_cache_free(struct kmem_cache *
74763
74764 page = virt_to_head_page(x);
74765
74766 + BUG_ON(!PageSlab(page));
74767 +
74768 slab_free(s, page, x, _RET_IP_);
74769
74770 trace_kmem_cache_free(_RET_IP_, x);
74771 @@ -1937,7 +1939,7 @@ static int slub_min_objects;
74772 * Merge control. If this is set then no merging of slab caches will occur.
74773 * (Could be removed. This was introduced to pacify the merge skeptics.)
74774 */
74775 -static int slub_nomerge;
74776 +static int slub_nomerge = 1;
74777
74778 /*
74779 * Calculate the order of allocation given an slab object size.
74780 @@ -2493,7 +2495,7 @@ static int kmem_cache_open(struct kmem_c
74781 * list to avoid pounding the page allocator excessively.
74782 */
74783 set_min_partial(s, ilog2(s->size));
74784 - s->refcount = 1;
74785 + atomic_set(&s->refcount, 1);
74786 #ifdef CONFIG_NUMA
74787 s->remote_node_defrag_ratio = 1000;
74788 #endif
74789 @@ -2630,8 +2632,7 @@ static inline int kmem_cache_close(struc
74790 void kmem_cache_destroy(struct kmem_cache *s)
74791 {
74792 down_write(&slub_lock);
74793 - s->refcount--;
74794 - if (!s->refcount) {
74795 + if (atomic_dec_and_test(&s->refcount)) {
74796 list_del(&s->list);
74797 up_write(&slub_lock);
74798 if (kmem_cache_close(s)) {
74799 @@ -2691,12 +2692,10 @@ static int __init setup_slub_nomerge(cha
74800 __setup("slub_nomerge", setup_slub_nomerge);
74801
74802 static struct kmem_cache *create_kmalloc_cache(struct kmem_cache *s,
74803 - const char *name, int size, gfp_t gfp_flags)
74804 + const char *name, int size, gfp_t gfp_flags, unsigned int flags)
74805 {
74806 - unsigned int flags = 0;
74807 -
74808 if (gfp_flags & SLUB_DMA)
74809 - flags = SLAB_CACHE_DMA;
74810 + flags |= SLAB_CACHE_DMA;
74811
74812 /*
74813 * This function is called with IRQs disabled during early-boot on
74814 @@ -2915,6 +2914,46 @@ void *__kmalloc_node(size_t size, gfp_t
74815 EXPORT_SYMBOL(__kmalloc_node);
74816 #endif
74817
74818 +void check_object_size(const void *ptr, unsigned long n, bool to)
74819 +{
74820 +
74821 +#ifdef CONFIG_PAX_USERCOPY
74822 + struct page *page;
74823 + struct kmem_cache *s = NULL;
74824 + unsigned long offset;
74825 +
74826 + if (!n)
74827 + return;
74828 +
74829 + if (ZERO_OR_NULL_PTR(ptr))
74830 + goto report;
74831 +
74832 + if (!virt_addr_valid(ptr))
74833 + return;
74834 +
74835 + page = get_object_page(ptr);
74836 +
74837 + if (!page) {
74838 + if (object_is_on_stack(ptr, n) == -1)
74839 + goto report;
74840 + return;
74841 + }
74842 +
74843 + s = page->slab;
74844 + if (!(s->flags & SLAB_USERCOPY))
74845 + goto report;
74846 +
74847 + offset = (ptr - page_address(page)) % s->size;
74848 + if (offset <= s->objsize && n <= s->objsize - offset)
74849 + return;
74850 +
74851 +report:
74852 + pax_report_usercopy(ptr, n, to, s ? s->name : NULL);
74853 +#endif
74854 +
74855 +}
74856 +EXPORT_SYMBOL(check_object_size);
74857 +
74858 size_t ksize(const void *object)
74859 {
74860 struct page *page;
74861 @@ -3185,8 +3224,8 @@ void __init kmem_cache_init(void)
74862 * kmem_cache_open for slab_state == DOWN.
74863 */
74864 create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
74865 - sizeof(struct kmem_cache_node), GFP_NOWAIT);
74866 - kmalloc_caches[0].refcount = -1;
74867 + sizeof(struct kmem_cache_node), GFP_NOWAIT, 0);
74868 + atomic_set(&kmalloc_caches[0].refcount, -1);
74869 caches++;
74870
74871 hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
74872 @@ -3198,18 +3237,18 @@ void __init kmem_cache_init(void)
74873 /* Caches that are not of the two-to-the-power-of size */
74874 if (KMALLOC_MIN_SIZE <= 32) {
74875 create_kmalloc_cache(&kmalloc_caches[1],
74876 - "kmalloc-96", 96, GFP_NOWAIT);
74877 + "kmalloc-96", 96, GFP_NOWAIT, SLAB_USERCOPY);
74878 caches++;
74879 }
74880 if (KMALLOC_MIN_SIZE <= 64) {
74881 create_kmalloc_cache(&kmalloc_caches[2],
74882 - "kmalloc-192", 192, GFP_NOWAIT);
74883 + "kmalloc-192", 192, GFP_NOWAIT, SLAB_USERCOPY);
74884 caches++;
74885 }
74886
74887 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
74888 create_kmalloc_cache(&kmalloc_caches[i],
74889 - "kmalloc", 1 << i, GFP_NOWAIT);
74890 + "kmalloc", 1 << i, GFP_NOWAIT, SLAB_USERCOPY);
74891 caches++;
74892 }
74893
74894 @@ -3293,7 +3332,7 @@ static int slab_unmergeable(struct kmem_
74895 /*
74896 * We may have set a slab to be unmergeable during bootstrap.
74897 */
74898 - if (s->refcount < 0)
74899 + if (atomic_read(&s->refcount) < 0)
74900 return 1;
74901
74902 return 0;
74903 @@ -3353,7 +3392,7 @@ struct kmem_cache *kmem_cache_create(con
74904 if (s) {
74905 int cpu;
74906
74907 - s->refcount++;
74908 + atomic_inc(&s->refcount);
74909 /*
74910 * Adjust the object sizes so that we clear
74911 * the complete object on kzalloc.
74912 @@ -3372,7 +3411,7 @@ struct kmem_cache *kmem_cache_create(con
74913
74914 if (sysfs_slab_alias(s, name)) {
74915 down_write(&slub_lock);
74916 - s->refcount--;
74917 + atomic_dec(&s->refcount);
74918 up_write(&slub_lock);
74919 goto err;
74920 }
74921 @@ -4101,7 +4140,7 @@ SLAB_ATTR_RO(ctor);
74922
74923 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
74924 {
74925 - return sprintf(buf, "%d\n", s->refcount - 1);
74926 + return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
74927 }
74928 SLAB_ATTR_RO(aliases);
74929
74930 @@ -4503,7 +4542,7 @@ static void kmem_cache_release(struct ko
74931 kfree(s);
74932 }
74933
74934 -static struct sysfs_ops slab_sysfs_ops = {
74935 +static const struct sysfs_ops slab_sysfs_ops = {
74936 .show = slab_attr_show,
74937 .store = slab_attr_store,
74938 };
74939 @@ -4522,7 +4561,7 @@ static int uevent_filter(struct kset *ks
74940 return 0;
74941 }
74942
74943 -static struct kset_uevent_ops slab_uevent_ops = {
74944 +static const struct kset_uevent_ops slab_uevent_ops = {
74945 .filter = uevent_filter,
74946 };
74947
74948 @@ -4564,6 +4603,7 @@ static char *create_unique_id(struct kme
74949 return name;
74950 }
74951
74952 +#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74953 static int sysfs_slab_add(struct kmem_cache *s)
74954 {
74955 int err;
74956 @@ -4619,6 +4659,7 @@ static void sysfs_slab_remove(struct kme
74957 kobject_del(&s->kobj);
74958 kobject_put(&s->kobj);
74959 }
74960 +#endif
74961
74962 /*
74963 * Need to buffer aliases during bootup until sysfs becomes
74964 @@ -4632,6 +4673,7 @@ struct saved_alias {
74965
74966 static struct saved_alias *alias_list;
74967
74968 +#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74969 static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
74970 {
74971 struct saved_alias *al;
74972 @@ -4654,6 +4696,7 @@ static int sysfs_slab_alias(struct kmem_
74973 alias_list = al;
74974 return 0;
74975 }
74976 +#endif
74977
74978 static int __init slab_sysfs_init(void)
74979 {
74980 @@ -4785,7 +4828,13 @@ static const struct file_operations proc
74981
74982 static int __init slab_proc_init(void)
74983 {
74984 - proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
74985 + mode_t gr_mode = S_IRUGO;
74986 +
74987 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
74988 + gr_mode = S_IRUSR;
74989 +#endif
74990 +
74991 + proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
74992 return 0;
74993 }
74994 module_init(slab_proc_init);
74995 diff -urNp linux-2.6.32.46/mm/swap.c linux-2.6.32.46/mm/swap.c
74996 --- linux-2.6.32.46/mm/swap.c 2011-03-27 14:31:47.000000000 -0400
74997 +++ linux-2.6.32.46/mm/swap.c 2011-07-09 09:15:19.000000000 -0400
74998 @@ -30,6 +30,7 @@
74999 #include <linux/notifier.h>
75000 #include <linux/backing-dev.h>
75001 #include <linux/memcontrol.h>
75002 +#include <linux/hugetlb.h>
75003
75004 #include "internal.h"
75005
75006 @@ -65,6 +66,8 @@ static void put_compound_page(struct pag
75007 compound_page_dtor *dtor;
75008
75009 dtor = get_compound_page_dtor(page);
75010 + if (!PageHuge(page))
75011 + BUG_ON(dtor != free_compound_page);
75012 (*dtor)(page);
75013 }
75014 }
75015 diff -urNp linux-2.6.32.46/mm/util.c linux-2.6.32.46/mm/util.c
75016 --- linux-2.6.32.46/mm/util.c 2011-03-27 14:31:47.000000000 -0400
75017 +++ linux-2.6.32.46/mm/util.c 2011-04-17 15:56:46.000000000 -0400
75018 @@ -228,6 +228,12 @@ EXPORT_SYMBOL(strndup_user);
75019 void arch_pick_mmap_layout(struct mm_struct *mm)
75020 {
75021 mm->mmap_base = TASK_UNMAPPED_BASE;
75022 +
75023 +#ifdef CONFIG_PAX_RANDMMAP
75024 + if (mm->pax_flags & MF_PAX_RANDMMAP)
75025 + mm->mmap_base += mm->delta_mmap;
75026 +#endif
75027 +
75028 mm->get_unmapped_area = arch_get_unmapped_area;
75029 mm->unmap_area = arch_unmap_area;
75030 }
75031 diff -urNp linux-2.6.32.46/mm/vmalloc.c linux-2.6.32.46/mm/vmalloc.c
75032 --- linux-2.6.32.46/mm/vmalloc.c 2011-08-29 22:24:44.000000000 -0400
75033 +++ linux-2.6.32.46/mm/vmalloc.c 2011-08-29 22:25:07.000000000 -0400
75034 @@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd,
75035
75036 pte = pte_offset_kernel(pmd, addr);
75037 do {
75038 - pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
75039 - WARN_ON(!pte_none(ptent) && !pte_present(ptent));
75040 +
75041 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75042 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
75043 + BUG_ON(!pte_exec(*pte));
75044 + set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
75045 + continue;
75046 + }
75047 +#endif
75048 +
75049 + {
75050 + pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
75051 + WARN_ON(!pte_none(ptent) && !pte_present(ptent));
75052 + }
75053 } while (pte++, addr += PAGE_SIZE, addr != end);
75054 }
75055
75056 @@ -92,6 +103,7 @@ static int vmap_pte_range(pmd_t *pmd, un
75057 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
75058 {
75059 pte_t *pte;
75060 + int ret = -ENOMEM;
75061
75062 /*
75063 * nr is a running index into the array which helps higher level
75064 @@ -101,17 +113,32 @@ static int vmap_pte_range(pmd_t *pmd, un
75065 pte = pte_alloc_kernel(pmd, addr);
75066 if (!pte)
75067 return -ENOMEM;
75068 +
75069 + pax_open_kernel();
75070 do {
75071 struct page *page = pages[*nr];
75072
75073 - if (WARN_ON(!pte_none(*pte)))
75074 - return -EBUSY;
75075 - if (WARN_ON(!page))
75076 - return -ENOMEM;
75077 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75078 + if (!(pgprot_val(prot) & _PAGE_NX))
75079 + BUG_ON(!pte_exec(*pte) || pte_pfn(*pte) != __pa(addr) >> PAGE_SHIFT);
75080 + else
75081 +#endif
75082 +
75083 + if (WARN_ON(!pte_none(*pte))) {
75084 + ret = -EBUSY;
75085 + goto out;
75086 + }
75087 + if (WARN_ON(!page)) {
75088 + ret = -ENOMEM;
75089 + goto out;
75090 + }
75091 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
75092 (*nr)++;
75093 } while (pte++, addr += PAGE_SIZE, addr != end);
75094 - return 0;
75095 + ret = 0;
75096 +out:
75097 + pax_close_kernel();
75098 + return ret;
75099 }
75100
75101 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
75102 @@ -192,11 +219,20 @@ int is_vmalloc_or_module_addr(const void
75103 * and fall back on vmalloc() if that fails. Others
75104 * just put it in the vmalloc space.
75105 */
75106 -#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
75107 +#ifdef CONFIG_MODULES
75108 +#ifdef MODULES_VADDR
75109 unsigned long addr = (unsigned long)x;
75110 if (addr >= MODULES_VADDR && addr < MODULES_END)
75111 return 1;
75112 #endif
75113 +
75114 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75115 + if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
75116 + return 1;
75117 +#endif
75118 +
75119 +#endif
75120 +
75121 return is_vmalloc_addr(x);
75122 }
75123
75124 @@ -217,8 +253,14 @@ struct page *vmalloc_to_page(const void
75125
75126 if (!pgd_none(*pgd)) {
75127 pud_t *pud = pud_offset(pgd, addr);
75128 +#ifdef CONFIG_X86
75129 + if (!pud_large(*pud))
75130 +#endif
75131 if (!pud_none(*pud)) {
75132 pmd_t *pmd = pmd_offset(pud, addr);
75133 +#ifdef CONFIG_X86
75134 + if (!pmd_large(*pmd))
75135 +#endif
75136 if (!pmd_none(*pmd)) {
75137 pte_t *ptep, pte;
75138
75139 @@ -292,13 +334,13 @@ static void __insert_vmap_area(struct vm
75140 struct rb_node *tmp;
75141
75142 while (*p) {
75143 - struct vmap_area *tmp;
75144 + struct vmap_area *varea;
75145
75146 parent = *p;
75147 - tmp = rb_entry(parent, struct vmap_area, rb_node);
75148 - if (va->va_start < tmp->va_end)
75149 + varea = rb_entry(parent, struct vmap_area, rb_node);
75150 + if (va->va_start < varea->va_end)
75151 p = &(*p)->rb_left;
75152 - else if (va->va_end > tmp->va_start)
75153 + else if (va->va_end > varea->va_start)
75154 p = &(*p)->rb_right;
75155 else
75156 BUG();
75157 @@ -1233,6 +1275,16 @@ static struct vm_struct *__get_vm_area_n
75158 struct vm_struct *area;
75159
75160 BUG_ON(in_interrupt());
75161 +
75162 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75163 + if (flags & VM_KERNEXEC) {
75164 + if (start != VMALLOC_START || end != VMALLOC_END)
75165 + return NULL;
75166 + start = (unsigned long)MODULES_EXEC_VADDR;
75167 + end = (unsigned long)MODULES_EXEC_END;
75168 + }
75169 +#endif
75170 +
75171 if (flags & VM_IOREMAP) {
75172 int bit = fls(size);
75173
75174 @@ -1458,6 +1510,11 @@ void *vmap(struct page **pages, unsigned
75175 if (count > totalram_pages)
75176 return NULL;
75177
75178 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75179 + if (!(pgprot_val(prot) & _PAGE_NX))
75180 + flags |= VM_KERNEXEC;
75181 +#endif
75182 +
75183 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
75184 __builtin_return_address(0));
75185 if (!area)
75186 @@ -1568,6 +1625,13 @@ static void *__vmalloc_node(unsigned lon
75187 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
75188 return NULL;
75189
75190 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75191 + if (!(pgprot_val(prot) & _PAGE_NX))
75192 + area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
75193 + node, gfp_mask, caller);
75194 + else
75195 +#endif
75196 +
75197 area = __get_vm_area_node(size, align, VM_ALLOC, VMALLOC_START,
75198 VMALLOC_END, node, gfp_mask, caller);
75199
75200 @@ -1586,6 +1650,7 @@ static void *__vmalloc_node(unsigned lon
75201 return addr;
75202 }
75203
75204 +#undef __vmalloc
75205 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
75206 {
75207 return __vmalloc_node(size, 1, gfp_mask, prot, -1,
75208 @@ -1602,6 +1667,7 @@ EXPORT_SYMBOL(__vmalloc);
75209 * For tight control over page level allocator and protection flags
75210 * use __vmalloc() instead.
75211 */
75212 +#undef vmalloc
75213 void *vmalloc(unsigned long size)
75214 {
75215 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
75216 @@ -1616,6 +1682,7 @@ EXPORT_SYMBOL(vmalloc);
75217 * The resulting memory area is zeroed so it can be mapped to userspace
75218 * without leaking data.
75219 */
75220 +#undef vmalloc_user
75221 void *vmalloc_user(unsigned long size)
75222 {
75223 struct vm_struct *area;
75224 @@ -1643,6 +1710,7 @@ EXPORT_SYMBOL(vmalloc_user);
75225 * For tight control over page level allocator and protection flags
75226 * use __vmalloc() instead.
75227 */
75228 +#undef vmalloc_node
75229 void *vmalloc_node(unsigned long size, int node)
75230 {
75231 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
75232 @@ -1665,10 +1733,10 @@ EXPORT_SYMBOL(vmalloc_node);
75233 * For tight control over page level allocator and protection flags
75234 * use __vmalloc() instead.
75235 */
75236 -
75237 +#undef vmalloc_exec
75238 void *vmalloc_exec(unsigned long size)
75239 {
75240 - return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
75241 + return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
75242 -1, __builtin_return_address(0));
75243 }
75244
75245 @@ -1687,6 +1755,7 @@ void *vmalloc_exec(unsigned long size)
75246 * Allocate enough 32bit PA addressable pages to cover @size from the
75247 * page level allocator and map them into contiguous kernel virtual space.
75248 */
75249 +#undef vmalloc_32
75250 void *vmalloc_32(unsigned long size)
75251 {
75252 return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
75253 @@ -1701,6 +1770,7 @@ EXPORT_SYMBOL(vmalloc_32);
75254 * The resulting memory area is 32bit addressable and zeroed so it can be
75255 * mapped to userspace without leaking data.
75256 */
75257 +#undef vmalloc_32_user
75258 void *vmalloc_32_user(unsigned long size)
75259 {
75260 struct vm_struct *area;
75261 @@ -1965,6 +2035,8 @@ int remap_vmalloc_range(struct vm_area_s
75262 unsigned long uaddr = vma->vm_start;
75263 unsigned long usize = vma->vm_end - vma->vm_start;
75264
75265 + BUG_ON(vma->vm_mirror);
75266 +
75267 if ((PAGE_SIZE-1) & (unsigned long)addr)
75268 return -EINVAL;
75269
75270 diff -urNp linux-2.6.32.46/mm/vmstat.c linux-2.6.32.46/mm/vmstat.c
75271 --- linux-2.6.32.46/mm/vmstat.c 2011-03-27 14:31:47.000000000 -0400
75272 +++ linux-2.6.32.46/mm/vmstat.c 2011-04-17 15:56:46.000000000 -0400
75273 @@ -74,7 +74,7 @@ void vm_events_fold_cpu(int cpu)
75274 *
75275 * vm_stat contains the global counters
75276 */
75277 -atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
75278 +atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
75279 EXPORT_SYMBOL(vm_stat);
75280
75281 #ifdef CONFIG_SMP
75282 @@ -324,7 +324,7 @@ void refresh_cpu_vm_stats(int cpu)
75283 v = p->vm_stat_diff[i];
75284 p->vm_stat_diff[i] = 0;
75285 local_irq_restore(flags);
75286 - atomic_long_add(v, &zone->vm_stat[i]);
75287 + atomic_long_add_unchecked(v, &zone->vm_stat[i]);
75288 global_diff[i] += v;
75289 #ifdef CONFIG_NUMA
75290 /* 3 seconds idle till flush */
75291 @@ -362,7 +362,7 @@ void refresh_cpu_vm_stats(int cpu)
75292
75293 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
75294 if (global_diff[i])
75295 - atomic_long_add(global_diff[i], &vm_stat[i]);
75296 + atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
75297 }
75298
75299 #endif
75300 @@ -953,10 +953,20 @@ static int __init setup_vmstat(void)
75301 start_cpu_timer(cpu);
75302 #endif
75303 #ifdef CONFIG_PROC_FS
75304 - proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
75305 - proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
75306 - proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
75307 - proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
75308 + {
75309 + mode_t gr_mode = S_IRUGO;
75310 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
75311 + gr_mode = S_IRUSR;
75312 +#endif
75313 + proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
75314 + proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
75315 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
75316 + proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
75317 +#else
75318 + proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
75319 +#endif
75320 + proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
75321 + }
75322 #endif
75323 return 0;
75324 }
75325 diff -urNp linux-2.6.32.46/net/8021q/vlan.c linux-2.6.32.46/net/8021q/vlan.c
75326 --- linux-2.6.32.46/net/8021q/vlan.c 2011-03-27 14:31:47.000000000 -0400
75327 +++ linux-2.6.32.46/net/8021q/vlan.c 2011-04-17 15:56:46.000000000 -0400
75328 @@ -622,8 +622,7 @@ static int vlan_ioctl_handler(struct net
75329 err = -EPERM;
75330 if (!capable(CAP_NET_ADMIN))
75331 break;
75332 - if ((args.u.name_type >= 0) &&
75333 - (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
75334 + if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
75335 struct vlan_net *vn;
75336
75337 vn = net_generic(net, vlan_net_id);
75338 diff -urNp linux-2.6.32.46/net/9p/trans_fd.c linux-2.6.32.46/net/9p/trans_fd.c
75339 --- linux-2.6.32.46/net/9p/trans_fd.c 2011-03-27 14:31:47.000000000 -0400
75340 +++ linux-2.6.32.46/net/9p/trans_fd.c 2011-10-06 09:37:14.000000000 -0400
75341 @@ -419,7 +419,7 @@ static int p9_fd_write(struct p9_client
75342 oldfs = get_fs();
75343 set_fs(get_ds());
75344 /* The cast to a user pointer is valid due to the set_fs() */
75345 - ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
75346 + ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos);
75347 set_fs(oldfs);
75348
75349 if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
75350 diff -urNp linux-2.6.32.46/net/atm/atm_misc.c linux-2.6.32.46/net/atm/atm_misc.c
75351 --- linux-2.6.32.46/net/atm/atm_misc.c 2011-03-27 14:31:47.000000000 -0400
75352 +++ linux-2.6.32.46/net/atm/atm_misc.c 2011-04-17 15:56:46.000000000 -0400
75353 @@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int t
75354 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
75355 return 1;
75356 atm_return(vcc,truesize);
75357 - atomic_inc(&vcc->stats->rx_drop);
75358 + atomic_inc_unchecked(&vcc->stats->rx_drop);
75359 return 0;
75360 }
75361
75362 @@ -41,7 +41,7 @@ struct sk_buff *atm_alloc_charge(struct
75363 }
75364 }
75365 atm_return(vcc,guess);
75366 - atomic_inc(&vcc->stats->rx_drop);
75367 + atomic_inc_unchecked(&vcc->stats->rx_drop);
75368 return NULL;
75369 }
75370
75371 @@ -88,7 +88,7 @@ int atm_pcr_goal(const struct atm_trafpr
75372
75373 void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
75374 {
75375 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75376 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75377 __SONET_ITEMS
75378 #undef __HANDLE_ITEM
75379 }
75380 @@ -96,7 +96,7 @@ void sonet_copy_stats(struct k_sonet_sta
75381
75382 void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
75383 {
75384 -#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
75385 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
75386 __SONET_ITEMS
75387 #undef __HANDLE_ITEM
75388 }
75389 diff -urNp linux-2.6.32.46/net/atm/lec.h linux-2.6.32.46/net/atm/lec.h
75390 --- linux-2.6.32.46/net/atm/lec.h 2011-03-27 14:31:47.000000000 -0400
75391 +++ linux-2.6.32.46/net/atm/lec.h 2011-08-05 20:33:55.000000000 -0400
75392 @@ -48,7 +48,7 @@ struct lane2_ops {
75393 const u8 *tlvs, u32 sizeoftlvs);
75394 void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
75395 const u8 *tlvs, u32 sizeoftlvs);
75396 -};
75397 +} __no_const;
75398
75399 /*
75400 * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
75401 diff -urNp linux-2.6.32.46/net/atm/mpc.h linux-2.6.32.46/net/atm/mpc.h
75402 --- linux-2.6.32.46/net/atm/mpc.h 2011-03-27 14:31:47.000000000 -0400
75403 +++ linux-2.6.32.46/net/atm/mpc.h 2011-08-23 21:22:38.000000000 -0400
75404 @@ -33,7 +33,7 @@ struct mpoa_client {
75405 struct mpc_parameters parameters; /* parameters for this client */
75406
75407 const struct net_device_ops *old_ops;
75408 - struct net_device_ops new_ops;
75409 + net_device_ops_no_const new_ops;
75410 };
75411
75412
75413 diff -urNp linux-2.6.32.46/net/atm/mpoa_caches.c linux-2.6.32.46/net/atm/mpoa_caches.c
75414 --- linux-2.6.32.46/net/atm/mpoa_caches.c 2011-03-27 14:31:47.000000000 -0400
75415 +++ linux-2.6.32.46/net/atm/mpoa_caches.c 2011-05-16 21:46:57.000000000 -0400
75416 @@ -498,6 +498,8 @@ static void clear_expired(struct mpoa_cl
75417 struct timeval now;
75418 struct k_message msg;
75419
75420 + pax_track_stack();
75421 +
75422 do_gettimeofday(&now);
75423
75424 write_lock_irq(&client->egress_lock);
75425 diff -urNp linux-2.6.32.46/net/atm/proc.c linux-2.6.32.46/net/atm/proc.c
75426 --- linux-2.6.32.46/net/atm/proc.c 2011-03-27 14:31:47.000000000 -0400
75427 +++ linux-2.6.32.46/net/atm/proc.c 2011-04-17 15:56:46.000000000 -0400
75428 @@ -43,9 +43,9 @@ static void add_stats(struct seq_file *s
75429 const struct k_atm_aal_stats *stats)
75430 {
75431 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
75432 - atomic_read(&stats->tx),atomic_read(&stats->tx_err),
75433 - atomic_read(&stats->rx),atomic_read(&stats->rx_err),
75434 - atomic_read(&stats->rx_drop));
75435 + atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
75436 + atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
75437 + atomic_read_unchecked(&stats->rx_drop));
75438 }
75439
75440 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
75441 @@ -188,7 +188,12 @@ static void vcc_info(struct seq_file *se
75442 {
75443 struct sock *sk = sk_atm(vcc);
75444
75445 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75446 + seq_printf(seq, "%p ", NULL);
75447 +#else
75448 seq_printf(seq, "%p ", vcc);
75449 +#endif
75450 +
75451 if (!vcc->dev)
75452 seq_printf(seq, "Unassigned ");
75453 else
75454 @@ -214,7 +219,11 @@ static void svc_info(struct seq_file *se
75455 {
75456 if (!vcc->dev)
75457 seq_printf(seq, sizeof(void *) == 4 ?
75458 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75459 + "N/A@%p%10s" : "N/A@%p%2s", NULL, "");
75460 +#else
75461 "N/A@%p%10s" : "N/A@%p%2s", vcc, "");
75462 +#endif
75463 else
75464 seq_printf(seq, "%3d %3d %5d ",
75465 vcc->dev->number, vcc->vpi, vcc->vci);
75466 diff -urNp linux-2.6.32.46/net/atm/resources.c linux-2.6.32.46/net/atm/resources.c
75467 --- linux-2.6.32.46/net/atm/resources.c 2011-03-27 14:31:47.000000000 -0400
75468 +++ linux-2.6.32.46/net/atm/resources.c 2011-04-17 15:56:46.000000000 -0400
75469 @@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *
75470 static void copy_aal_stats(struct k_atm_aal_stats *from,
75471 struct atm_aal_stats *to)
75472 {
75473 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75474 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75475 __AAL_STAT_ITEMS
75476 #undef __HANDLE_ITEM
75477 }
75478 @@ -170,7 +170,7 @@ static void copy_aal_stats(struct k_atm_
75479 static void subtract_aal_stats(struct k_atm_aal_stats *from,
75480 struct atm_aal_stats *to)
75481 {
75482 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
75483 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
75484 __AAL_STAT_ITEMS
75485 #undef __HANDLE_ITEM
75486 }
75487 diff -urNp linux-2.6.32.46/net/bluetooth/l2cap.c linux-2.6.32.46/net/bluetooth/l2cap.c
75488 --- linux-2.6.32.46/net/bluetooth/l2cap.c 2011-03-27 14:31:47.000000000 -0400
75489 +++ linux-2.6.32.46/net/bluetooth/l2cap.c 2011-06-25 14:36:21.000000000 -0400
75490 @@ -1885,7 +1885,7 @@ static int l2cap_sock_getsockopt_old(str
75491 err = -ENOTCONN;
75492 break;
75493 }
75494 -
75495 + memset(&cinfo, 0, sizeof(cinfo));
75496 cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
75497 memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
75498
75499 @@ -2719,7 +2719,7 @@ static inline int l2cap_config_req(struc
75500
75501 /* Reject if config buffer is too small. */
75502 len = cmd_len - sizeof(*req);
75503 - if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
75504 + if (len < 0 || l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
75505 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
75506 l2cap_build_conf_rsp(sk, rsp,
75507 L2CAP_CONF_REJECT, flags), rsp);
75508 diff -urNp linux-2.6.32.46/net/bluetooth/rfcomm/sock.c linux-2.6.32.46/net/bluetooth/rfcomm/sock.c
75509 --- linux-2.6.32.46/net/bluetooth/rfcomm/sock.c 2011-03-27 14:31:47.000000000 -0400
75510 +++ linux-2.6.32.46/net/bluetooth/rfcomm/sock.c 2011-06-12 06:35:00.000000000 -0400
75511 @@ -878,6 +878,7 @@ static int rfcomm_sock_getsockopt_old(st
75512
75513 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
75514
75515 + memset(&cinfo, 0, sizeof(cinfo));
75516 cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
75517 memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
75518
75519 diff -urNp linux-2.6.32.46/net/bridge/br_private.h linux-2.6.32.46/net/bridge/br_private.h
75520 --- linux-2.6.32.46/net/bridge/br_private.h 2011-08-09 18:35:30.000000000 -0400
75521 +++ linux-2.6.32.46/net/bridge/br_private.h 2011-08-09 18:34:01.000000000 -0400
75522 @@ -255,7 +255,7 @@ extern void br_ifinfo_notify(int event,
75523
75524 #ifdef CONFIG_SYSFS
75525 /* br_sysfs_if.c */
75526 -extern struct sysfs_ops brport_sysfs_ops;
75527 +extern const struct sysfs_ops brport_sysfs_ops;
75528 extern int br_sysfs_addif(struct net_bridge_port *p);
75529
75530 /* br_sysfs_br.c */
75531 diff -urNp linux-2.6.32.46/net/bridge/br_stp_if.c linux-2.6.32.46/net/bridge/br_stp_if.c
75532 --- linux-2.6.32.46/net/bridge/br_stp_if.c 2011-03-27 14:31:47.000000000 -0400
75533 +++ linux-2.6.32.46/net/bridge/br_stp_if.c 2011-04-17 15:56:46.000000000 -0400
75534 @@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridg
75535 char *envp[] = { NULL };
75536
75537 if (br->stp_enabled == BR_USER_STP) {
75538 - r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
75539 + r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
75540 printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
75541 br->dev->name, r);
75542
75543 diff -urNp linux-2.6.32.46/net/bridge/br_sysfs_if.c linux-2.6.32.46/net/bridge/br_sysfs_if.c
75544 --- linux-2.6.32.46/net/bridge/br_sysfs_if.c 2011-03-27 14:31:47.000000000 -0400
75545 +++ linux-2.6.32.46/net/bridge/br_sysfs_if.c 2011-04-17 15:56:46.000000000 -0400
75546 @@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobje
75547 return ret;
75548 }
75549
75550 -struct sysfs_ops brport_sysfs_ops = {
75551 +const struct sysfs_ops brport_sysfs_ops = {
75552 .show = brport_show,
75553 .store = brport_store,
75554 };
75555 diff -urNp linux-2.6.32.46/net/bridge/netfilter/ebtables.c linux-2.6.32.46/net/bridge/netfilter/ebtables.c
75556 --- linux-2.6.32.46/net/bridge/netfilter/ebtables.c 2011-04-17 17:00:52.000000000 -0400
75557 +++ linux-2.6.32.46/net/bridge/netfilter/ebtables.c 2011-05-16 21:46:57.000000000 -0400
75558 @@ -1337,6 +1337,8 @@ static int copy_everything_to_user(struc
75559 unsigned int entries_size, nentries;
75560 char *entries;
75561
75562 + pax_track_stack();
75563 +
75564 if (cmd == EBT_SO_GET_ENTRIES) {
75565 entries_size = t->private->entries_size;
75566 nentries = t->private->nentries;
75567 diff -urNp linux-2.6.32.46/net/can/bcm.c linux-2.6.32.46/net/can/bcm.c
75568 --- linux-2.6.32.46/net/can/bcm.c 2011-05-10 22:12:01.000000000 -0400
75569 +++ linux-2.6.32.46/net/can/bcm.c 2011-05-10 22:12:34.000000000 -0400
75570 @@ -164,9 +164,15 @@ static int bcm_proc_show(struct seq_file
75571 struct bcm_sock *bo = bcm_sk(sk);
75572 struct bcm_op *op;
75573
75574 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75575 + seq_printf(m, ">>> socket %p", NULL);
75576 + seq_printf(m, " / sk %p", NULL);
75577 + seq_printf(m, " / bo %p", NULL);
75578 +#else
75579 seq_printf(m, ">>> socket %p", sk->sk_socket);
75580 seq_printf(m, " / sk %p", sk);
75581 seq_printf(m, " / bo %p", bo);
75582 +#endif
75583 seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
75584 seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
75585 seq_printf(m, " <<<\n");
75586 diff -urNp linux-2.6.32.46/net/compat.c linux-2.6.32.46/net/compat.c
75587 --- linux-2.6.32.46/net/compat.c 2011-03-27 14:31:47.000000000 -0400
75588 +++ linux-2.6.32.46/net/compat.c 2011-10-06 09:37:14.000000000 -0400
75589 @@ -69,9 +69,9 @@ int get_compat_msghdr(struct msghdr *kms
75590 __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
75591 __get_user(kmsg->msg_flags, &umsg->msg_flags))
75592 return -EFAULT;
75593 - kmsg->msg_name = compat_ptr(tmp1);
75594 - kmsg->msg_iov = compat_ptr(tmp2);
75595 - kmsg->msg_control = compat_ptr(tmp3);
75596 + kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1);
75597 + kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2);
75598 + kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3);
75599 return 0;
75600 }
75601
75602 @@ -94,7 +94,7 @@ int verify_compat_iovec(struct msghdr *k
75603 kern_msg->msg_name = NULL;
75604
75605 tot_len = iov_from_user_compat_to_kern(kern_iov,
75606 - (struct compat_iovec __user *)kern_msg->msg_iov,
75607 + (struct compat_iovec __force_user *)kern_msg->msg_iov,
75608 kern_msg->msg_iovlen);
75609 if (tot_len >= 0)
75610 kern_msg->msg_iov = kern_iov;
75611 @@ -114,20 +114,20 @@ int verify_compat_iovec(struct msghdr *k
75612
75613 #define CMSG_COMPAT_FIRSTHDR(msg) \
75614 (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
75615 - (struct compat_cmsghdr __user *)((msg)->msg_control) : \
75616 + (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \
75617 (struct compat_cmsghdr __user *)NULL)
75618
75619 #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
75620 ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
75621 (ucmlen) <= (unsigned long) \
75622 ((mhdr)->msg_controllen - \
75623 - ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
75624 + ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control)))
75625
75626 static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
75627 struct compat_cmsghdr __user *cmsg, int cmsg_len)
75628 {
75629 char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
75630 - if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
75631 + if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) >
75632 msg->msg_controllen)
75633 return NULL;
75634 return (struct compat_cmsghdr __user *)ptr;
75635 @@ -219,7 +219,7 @@ int put_cmsg_compat(struct msghdr *kmsg,
75636 {
75637 struct compat_timeval ctv;
75638 struct compat_timespec cts[3];
75639 - struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
75640 + struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
75641 struct compat_cmsghdr cmhdr;
75642 int cmlen;
75643
75644 @@ -271,7 +271,7 @@ int put_cmsg_compat(struct msghdr *kmsg,
75645
75646 void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
75647 {
75648 - struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
75649 + struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
75650 int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
75651 int fdnum = scm->fp->count;
75652 struct file **fp = scm->fp->fp;
75653 @@ -433,7 +433,7 @@ static int do_get_sock_timeout(struct so
75654 len = sizeof(ktime);
75655 old_fs = get_fs();
75656 set_fs(KERNEL_DS);
75657 - err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len);
75658 + err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len);
75659 set_fs(old_fs);
75660
75661 if (!err) {
75662 @@ -570,7 +570,7 @@ int compat_mc_setsockopt(struct sock *so
75663 case MCAST_JOIN_GROUP:
75664 case MCAST_LEAVE_GROUP:
75665 {
75666 - struct compat_group_req __user *gr32 = (void *)optval;
75667 + struct compat_group_req __user *gr32 = (void __user *)optval;
75668 struct group_req __user *kgr =
75669 compat_alloc_user_space(sizeof(struct group_req));
75670 u32 interface;
75671 @@ -591,7 +591,7 @@ int compat_mc_setsockopt(struct sock *so
75672 case MCAST_BLOCK_SOURCE:
75673 case MCAST_UNBLOCK_SOURCE:
75674 {
75675 - struct compat_group_source_req __user *gsr32 = (void *)optval;
75676 + struct compat_group_source_req __user *gsr32 = (void __user *)optval;
75677 struct group_source_req __user *kgsr = compat_alloc_user_space(
75678 sizeof(struct group_source_req));
75679 u32 interface;
75680 @@ -612,7 +612,7 @@ int compat_mc_setsockopt(struct sock *so
75681 }
75682 case MCAST_MSFILTER:
75683 {
75684 - struct compat_group_filter __user *gf32 = (void *)optval;
75685 + struct compat_group_filter __user *gf32 = (void __user *)optval;
75686 struct group_filter __user *kgf;
75687 u32 interface, fmode, numsrc;
75688
75689 diff -urNp linux-2.6.32.46/net/core/dev.c linux-2.6.32.46/net/core/dev.c
75690 --- linux-2.6.32.46/net/core/dev.c 2011-04-17 17:00:52.000000000 -0400
75691 +++ linux-2.6.32.46/net/core/dev.c 2011-08-05 20:33:55.000000000 -0400
75692 @@ -1047,10 +1047,14 @@ void dev_load(struct net *net, const cha
75693 if (no_module && capable(CAP_NET_ADMIN))
75694 no_module = request_module("netdev-%s", name);
75695 if (no_module && capable(CAP_SYS_MODULE)) {
75696 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
75697 + ___request_module(true, "grsec_modharden_netdev", "%s", name);
75698 +#else
75699 if (!request_module("%s", name))
75700 pr_err("Loading kernel module for a network device "
75701 "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
75702 "instead\n", name);
75703 +#endif
75704 }
75705 }
75706 EXPORT_SYMBOL(dev_load);
75707 @@ -1654,7 +1658,7 @@ static inline int illegal_highdma(struct
75708
75709 struct dev_gso_cb {
75710 void (*destructor)(struct sk_buff *skb);
75711 -};
75712 +} __no_const;
75713
75714 #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
75715
75716 @@ -2063,7 +2067,7 @@ int netif_rx_ni(struct sk_buff *skb)
75717 }
75718 EXPORT_SYMBOL(netif_rx_ni);
75719
75720 -static void net_tx_action(struct softirq_action *h)
75721 +static void net_tx_action(void)
75722 {
75723 struct softnet_data *sd = &__get_cpu_var(softnet_data);
75724
75725 @@ -2826,7 +2830,7 @@ void netif_napi_del(struct napi_struct *
75726 EXPORT_SYMBOL(netif_napi_del);
75727
75728
75729 -static void net_rx_action(struct softirq_action *h)
75730 +static void net_rx_action(void)
75731 {
75732 struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
75733 unsigned long time_limit = jiffies + 2;
75734 diff -urNp linux-2.6.32.46/net/core/flow.c linux-2.6.32.46/net/core/flow.c
75735 --- linux-2.6.32.46/net/core/flow.c 2011-03-27 14:31:47.000000000 -0400
75736 +++ linux-2.6.32.46/net/core/flow.c 2011-05-04 17:56:20.000000000 -0400
75737 @@ -35,11 +35,11 @@ struct flow_cache_entry {
75738 atomic_t *object_ref;
75739 };
75740
75741 -atomic_t flow_cache_genid = ATOMIC_INIT(0);
75742 +atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
75743
75744 static u32 flow_hash_shift;
75745 #define flow_hash_size (1 << flow_hash_shift)
75746 -static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
75747 +static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
75748
75749 #define flow_table(cpu) (per_cpu(flow_tables, cpu))
75750
75751 @@ -52,7 +52,7 @@ struct flow_percpu_info {
75752 u32 hash_rnd;
75753 int count;
75754 };
75755 -static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
75756 +static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
75757
75758 #define flow_hash_rnd_recalc(cpu) \
75759 (per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
75760 @@ -69,7 +69,7 @@ struct flow_flush_info {
75761 atomic_t cpuleft;
75762 struct completion completion;
75763 };
75764 -static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
75765 +static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
75766
75767 #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
75768
75769 @@ -190,7 +190,7 @@ void *flow_cache_lookup(struct net *net,
75770 if (fle->family == family &&
75771 fle->dir == dir &&
75772 flow_key_compare(key, &fle->key) == 0) {
75773 - if (fle->genid == atomic_read(&flow_cache_genid)) {
75774 + if (fle->genid == atomic_read_unchecked(&flow_cache_genid)) {
75775 void *ret = fle->object;
75776
75777 if (ret)
75778 @@ -228,7 +228,7 @@ nocache:
75779 err = resolver(net, key, family, dir, &obj, &obj_ref);
75780
75781 if (fle && !err) {
75782 - fle->genid = atomic_read(&flow_cache_genid);
75783 + fle->genid = atomic_read_unchecked(&flow_cache_genid);
75784
75785 if (fle->object)
75786 atomic_dec(fle->object_ref);
75787 @@ -258,7 +258,7 @@ static void flow_cache_flush_tasklet(uns
75788
75789 fle = flow_table(cpu)[i];
75790 for (; fle; fle = fle->next) {
75791 - unsigned genid = atomic_read(&flow_cache_genid);
75792 + unsigned genid = atomic_read_unchecked(&flow_cache_genid);
75793
75794 if (!fle->object || fle->genid == genid)
75795 continue;
75796 diff -urNp linux-2.6.32.46/net/core/rtnetlink.c linux-2.6.32.46/net/core/rtnetlink.c
75797 --- linux-2.6.32.46/net/core/rtnetlink.c 2011-03-27 14:31:47.000000000 -0400
75798 +++ linux-2.6.32.46/net/core/rtnetlink.c 2011-08-05 20:33:55.000000000 -0400
75799 @@ -57,7 +57,7 @@ struct rtnl_link
75800 {
75801 rtnl_doit_func doit;
75802 rtnl_dumpit_func dumpit;
75803 -};
75804 +} __no_const;
75805
75806 static DEFINE_MUTEX(rtnl_mutex);
75807
75808 diff -urNp linux-2.6.32.46/net/core/scm.c linux-2.6.32.46/net/core/scm.c
75809 --- linux-2.6.32.46/net/core/scm.c 2011-03-27 14:31:47.000000000 -0400
75810 +++ linux-2.6.32.46/net/core/scm.c 2011-10-06 09:37:14.000000000 -0400
75811 @@ -190,7 +190,7 @@ error:
75812 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
75813 {
75814 struct cmsghdr __user *cm
75815 - = (__force struct cmsghdr __user *)msg->msg_control;
75816 + = (struct cmsghdr __force_user *)msg->msg_control;
75817 struct cmsghdr cmhdr;
75818 int cmlen = CMSG_LEN(len);
75819 int err;
75820 @@ -213,7 +213,7 @@ int put_cmsg(struct msghdr * msg, int le
75821 err = -EFAULT;
75822 if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
75823 goto out;
75824 - if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
75825 + if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr)))
75826 goto out;
75827 cmlen = CMSG_SPACE(len);
75828 if (msg->msg_controllen < cmlen)
75829 @@ -228,7 +228,7 @@ out:
75830 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
75831 {
75832 struct cmsghdr __user *cm
75833 - = (__force struct cmsghdr __user*)msg->msg_control;
75834 + = (struct cmsghdr __force_user *)msg->msg_control;
75835
75836 int fdmax = 0;
75837 int fdnum = scm->fp->count;
75838 @@ -248,7 +248,7 @@ void scm_detach_fds(struct msghdr *msg,
75839 if (fdnum < fdmax)
75840 fdmax = fdnum;
75841
75842 - for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
75843 + for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax;
75844 i++, cmfptr++)
75845 {
75846 int new_fd;
75847 diff -urNp linux-2.6.32.46/net/core/secure_seq.c linux-2.6.32.46/net/core/secure_seq.c
75848 --- linux-2.6.32.46/net/core/secure_seq.c 2011-08-16 20:37:25.000000000 -0400
75849 +++ linux-2.6.32.46/net/core/secure_seq.c 2011-08-07 19:48:09.000000000 -0400
75850 @@ -57,7 +57,7 @@ __u32 secure_tcpv6_sequence_number(__be3
75851 EXPORT_SYMBOL(secure_tcpv6_sequence_number);
75852
75853 u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
75854 - __be16 dport)
75855 + __be16 dport)
75856 {
75857 u32 secret[MD5_MESSAGE_BYTES / 4];
75858 u32 hash[MD5_DIGEST_WORDS];
75859 @@ -71,7 +71,6 @@ u32 secure_ipv6_port_ephemeral(const __b
75860 secret[i] = net_secret[i];
75861
75862 md5_transform(hash, secret);
75863 -
75864 return hash[0];
75865 }
75866 #endif
75867 diff -urNp linux-2.6.32.46/net/core/skbuff.c linux-2.6.32.46/net/core/skbuff.c
75868 --- linux-2.6.32.46/net/core/skbuff.c 2011-03-27 14:31:47.000000000 -0400
75869 +++ linux-2.6.32.46/net/core/skbuff.c 2011-05-16 21:46:57.000000000 -0400
75870 @@ -1544,6 +1544,8 @@ int skb_splice_bits(struct sk_buff *skb,
75871 struct sk_buff *frag_iter;
75872 struct sock *sk = skb->sk;
75873
75874 + pax_track_stack();
75875 +
75876 /*
75877 * __skb_splice_bits() only fails if the output has no room left,
75878 * so no point in going over the frag_list for the error case.
75879 diff -urNp linux-2.6.32.46/net/core/sock.c linux-2.6.32.46/net/core/sock.c
75880 --- linux-2.6.32.46/net/core/sock.c 2011-03-27 14:31:47.000000000 -0400
75881 +++ linux-2.6.32.46/net/core/sock.c 2011-05-04 17:56:20.000000000 -0400
75882 @@ -864,11 +864,15 @@ int sock_getsockopt(struct socket *sock,
75883 break;
75884
75885 case SO_PEERCRED:
75886 + {
75887 + struct ucred peercred;
75888 if (len > sizeof(sk->sk_peercred))
75889 len = sizeof(sk->sk_peercred);
75890 - if (copy_to_user(optval, &sk->sk_peercred, len))
75891 + peercred = sk->sk_peercred;
75892 + if (copy_to_user(optval, &peercred, len))
75893 return -EFAULT;
75894 goto lenout;
75895 + }
75896
75897 case SO_PEERNAME:
75898 {
75899 @@ -1892,7 +1896,7 @@ void sock_init_data(struct socket *sock,
75900 */
75901 smp_wmb();
75902 atomic_set(&sk->sk_refcnt, 1);
75903 - atomic_set(&sk->sk_drops, 0);
75904 + atomic_set_unchecked(&sk->sk_drops, 0);
75905 }
75906 EXPORT_SYMBOL(sock_init_data);
75907
75908 diff -urNp linux-2.6.32.46/net/decnet/sysctl_net_decnet.c linux-2.6.32.46/net/decnet/sysctl_net_decnet.c
75909 --- linux-2.6.32.46/net/decnet/sysctl_net_decnet.c 2011-03-27 14:31:47.000000000 -0400
75910 +++ linux-2.6.32.46/net/decnet/sysctl_net_decnet.c 2011-04-17 15:56:46.000000000 -0400
75911 @@ -206,7 +206,7 @@ static int dn_node_address_handler(ctl_t
75912
75913 if (len > *lenp) len = *lenp;
75914
75915 - if (copy_to_user(buffer, addr, len))
75916 + if (len > sizeof addr || copy_to_user(buffer, addr, len))
75917 return -EFAULT;
75918
75919 *lenp = len;
75920 @@ -327,7 +327,7 @@ static int dn_def_dev_handler(ctl_table
75921
75922 if (len > *lenp) len = *lenp;
75923
75924 - if (copy_to_user(buffer, devname, len))
75925 + if (len > sizeof devname || copy_to_user(buffer, devname, len))
75926 return -EFAULT;
75927
75928 *lenp = len;
75929 diff -urNp linux-2.6.32.46/net/econet/Kconfig linux-2.6.32.46/net/econet/Kconfig
75930 --- linux-2.6.32.46/net/econet/Kconfig 2011-03-27 14:31:47.000000000 -0400
75931 +++ linux-2.6.32.46/net/econet/Kconfig 2011-04-17 15:56:46.000000000 -0400
75932 @@ -4,7 +4,7 @@
75933
75934 config ECONET
75935 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
75936 - depends on EXPERIMENTAL && INET
75937 + depends on EXPERIMENTAL && INET && BROKEN
75938 ---help---
75939 Econet is a fairly old and slow networking protocol mainly used by
75940 Acorn computers to access file and print servers. It uses native
75941 diff -urNp linux-2.6.32.46/net/ieee802154/dgram.c linux-2.6.32.46/net/ieee802154/dgram.c
75942 --- linux-2.6.32.46/net/ieee802154/dgram.c 2011-03-27 14:31:47.000000000 -0400
75943 +++ linux-2.6.32.46/net/ieee802154/dgram.c 2011-05-04 17:56:28.000000000 -0400
75944 @@ -318,7 +318,7 @@ out:
75945 static int dgram_rcv_skb(struct sock *sk, struct sk_buff *skb)
75946 {
75947 if (sock_queue_rcv_skb(sk, skb) < 0) {
75948 - atomic_inc(&sk->sk_drops);
75949 + atomic_inc_unchecked(&sk->sk_drops);
75950 kfree_skb(skb);
75951 return NET_RX_DROP;
75952 }
75953 diff -urNp linux-2.6.32.46/net/ieee802154/raw.c linux-2.6.32.46/net/ieee802154/raw.c
75954 --- linux-2.6.32.46/net/ieee802154/raw.c 2011-03-27 14:31:47.000000000 -0400
75955 +++ linux-2.6.32.46/net/ieee802154/raw.c 2011-05-04 17:56:28.000000000 -0400
75956 @@ -206,7 +206,7 @@ out:
75957 static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
75958 {
75959 if (sock_queue_rcv_skb(sk, skb) < 0) {
75960 - atomic_inc(&sk->sk_drops);
75961 + atomic_inc_unchecked(&sk->sk_drops);
75962 kfree_skb(skb);
75963 return NET_RX_DROP;
75964 }
75965 diff -urNp linux-2.6.32.46/net/ipv4/inet_diag.c linux-2.6.32.46/net/ipv4/inet_diag.c
75966 --- linux-2.6.32.46/net/ipv4/inet_diag.c 2011-07-13 17:23:04.000000000 -0400
75967 +++ linux-2.6.32.46/net/ipv4/inet_diag.c 2011-06-20 19:31:13.000000000 -0400
75968 @@ -113,8 +113,13 @@ static int inet_csk_diag_fill(struct soc
75969 r->idiag_retrans = 0;
75970
75971 r->id.idiag_if = sk->sk_bound_dev_if;
75972 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75973 + r->id.idiag_cookie[0] = 0;
75974 + r->id.idiag_cookie[1] = 0;
75975 +#else
75976 r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
75977 r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
75978 +#endif
75979
75980 r->id.idiag_sport = inet->sport;
75981 r->id.idiag_dport = inet->dport;
75982 @@ -200,8 +205,15 @@ static int inet_twsk_diag_fill(struct in
75983 r->idiag_family = tw->tw_family;
75984 r->idiag_retrans = 0;
75985 r->id.idiag_if = tw->tw_bound_dev_if;
75986 +
75987 +#ifdef CONFIG_GRKERNSEC_HIDESYM
75988 + r->id.idiag_cookie[0] = 0;
75989 + r->id.idiag_cookie[1] = 0;
75990 +#else
75991 r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
75992 r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
75993 +#endif
75994 +
75995 r->id.idiag_sport = tw->tw_sport;
75996 r->id.idiag_dport = tw->tw_dport;
75997 r->id.idiag_src[0] = tw->tw_rcv_saddr;
75998 @@ -284,12 +296,14 @@ static int inet_diag_get_exact(struct sk
75999 if (sk == NULL)
76000 goto unlock;
76001
76002 +#ifndef CONFIG_GRKERNSEC_HIDESYM
76003 err = -ESTALE;
76004 if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
76005 req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
76006 ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
76007 (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
76008 goto out;
76009 +#endif
76010
76011 err = -ENOMEM;
76012 rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
76013 @@ -579,8 +593,14 @@ static int inet_diag_fill_req(struct sk_
76014 r->idiag_retrans = req->retrans;
76015
76016 r->id.idiag_if = sk->sk_bound_dev_if;
76017 +
76018 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76019 + r->id.idiag_cookie[0] = 0;
76020 + r->id.idiag_cookie[1] = 0;
76021 +#else
76022 r->id.idiag_cookie[0] = (u32)(unsigned long)req;
76023 r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
76024 +#endif
76025
76026 tmo = req->expires - jiffies;
76027 if (tmo < 0)
76028 diff -urNp linux-2.6.32.46/net/ipv4/inet_hashtables.c linux-2.6.32.46/net/ipv4/inet_hashtables.c
76029 --- linux-2.6.32.46/net/ipv4/inet_hashtables.c 2011-08-16 20:37:25.000000000 -0400
76030 +++ linux-2.6.32.46/net/ipv4/inet_hashtables.c 2011-08-16 20:42:30.000000000 -0400
76031 @@ -18,12 +18,15 @@
76032 #include <linux/sched.h>
76033 #include <linux/slab.h>
76034 #include <linux/wait.h>
76035 +#include <linux/security.h>
76036
76037 #include <net/inet_connection_sock.h>
76038 #include <net/inet_hashtables.h>
76039 #include <net/secure_seq.h>
76040 #include <net/ip.h>
76041
76042 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
76043 +
76044 /*
76045 * Allocate and initialize a new local port bind bucket.
76046 * The bindhash mutex for snum's hash chain must be held here.
76047 @@ -491,6 +494,8 @@ ok:
76048 }
76049 spin_unlock(&head->lock);
76050
76051 + gr_update_task_in_ip_table(current, inet_sk(sk));
76052 +
76053 if (tw) {
76054 inet_twsk_deschedule(tw, death_row);
76055 inet_twsk_put(tw);
76056 diff -urNp linux-2.6.32.46/net/ipv4/inetpeer.c linux-2.6.32.46/net/ipv4/inetpeer.c
76057 --- linux-2.6.32.46/net/ipv4/inetpeer.c 2011-08-16 20:37:25.000000000 -0400
76058 +++ linux-2.6.32.46/net/ipv4/inetpeer.c 2011-08-07 19:48:09.000000000 -0400
76059 @@ -367,6 +367,8 @@ struct inet_peer *inet_getpeer(__be32 da
76060 struct inet_peer *p, *n;
76061 struct inet_peer **stack[PEER_MAXDEPTH], ***stackptr;
76062
76063 + pax_track_stack();
76064 +
76065 /* Look up for the address quickly. */
76066 read_lock_bh(&peer_pool_lock);
76067 p = lookup(daddr, NULL);
76068 @@ -390,7 +392,7 @@ struct inet_peer *inet_getpeer(__be32 da
76069 return NULL;
76070 n->v4daddr = daddr;
76071 atomic_set(&n->refcnt, 1);
76072 - atomic_set(&n->rid, 0);
76073 + atomic_set_unchecked(&n->rid, 0);
76074 n->ip_id_count = secure_ip_id(daddr);
76075 n->tcp_ts_stamp = 0;
76076
76077 diff -urNp linux-2.6.32.46/net/ipv4/ipconfig.c linux-2.6.32.46/net/ipv4/ipconfig.c
76078 --- linux-2.6.32.46/net/ipv4/ipconfig.c 2011-03-27 14:31:47.000000000 -0400
76079 +++ linux-2.6.32.46/net/ipv4/ipconfig.c 2011-10-06 09:37:14.000000000 -0400
76080 @@ -295,7 +295,7 @@ static int __init ic_devinet_ioctl(unsig
76081
76082 mm_segment_t oldfs = get_fs();
76083 set_fs(get_ds());
76084 - res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
76085 + res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
76086 set_fs(oldfs);
76087 return res;
76088 }
76089 @@ -306,7 +306,7 @@ static int __init ic_dev_ioctl(unsigned
76090
76091 mm_segment_t oldfs = get_fs();
76092 set_fs(get_ds());
76093 - res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
76094 + res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
76095 set_fs(oldfs);
76096 return res;
76097 }
76098 @@ -317,7 +317,7 @@ static int __init ic_route_ioctl(unsigne
76099
76100 mm_segment_t oldfs = get_fs();
76101 set_fs(get_ds());
76102 - res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg);
76103 + res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg);
76104 set_fs(oldfs);
76105 return res;
76106 }
76107 diff -urNp linux-2.6.32.46/net/ipv4/ip_fragment.c linux-2.6.32.46/net/ipv4/ip_fragment.c
76108 --- linux-2.6.32.46/net/ipv4/ip_fragment.c 2011-03-27 14:31:47.000000000 -0400
76109 +++ linux-2.6.32.46/net/ipv4/ip_fragment.c 2011-04-17 15:56:46.000000000 -0400
76110 @@ -255,7 +255,7 @@ static inline int ip_frag_too_far(struct
76111 return 0;
76112
76113 start = qp->rid;
76114 - end = atomic_inc_return(&peer->rid);
76115 + end = atomic_inc_return_unchecked(&peer->rid);
76116 qp->rid = end;
76117
76118 rc = qp->q.fragments && (end - start) > max;
76119 diff -urNp linux-2.6.32.46/net/ipv4/ip_sockglue.c linux-2.6.32.46/net/ipv4/ip_sockglue.c
76120 --- linux-2.6.32.46/net/ipv4/ip_sockglue.c 2011-03-27 14:31:47.000000000 -0400
76121 +++ linux-2.6.32.46/net/ipv4/ip_sockglue.c 2011-10-06 09:37:14.000000000 -0400
76122 @@ -1015,6 +1015,8 @@ static int do_ip_getsockopt(struct sock
76123 int val;
76124 int len;
76125
76126 + pax_track_stack();
76127 +
76128 if (level != SOL_IP)
76129 return -EOPNOTSUPP;
76130
76131 @@ -1173,7 +1175,7 @@ static int do_ip_getsockopt(struct sock
76132 if (sk->sk_type != SOCK_STREAM)
76133 return -ENOPROTOOPT;
76134
76135 - msg.msg_control = optval;
76136 + msg.msg_control = (void __force_kernel *)optval;
76137 msg.msg_controllen = len;
76138 msg.msg_flags = 0;
76139
76140 diff -urNp linux-2.6.32.46/net/ipv4/netfilter/arp_tables.c linux-2.6.32.46/net/ipv4/netfilter/arp_tables.c
76141 --- linux-2.6.32.46/net/ipv4/netfilter/arp_tables.c 2011-04-17 17:00:52.000000000 -0400
76142 +++ linux-2.6.32.46/net/ipv4/netfilter/arp_tables.c 2011-04-17 17:04:18.000000000 -0400
76143 @@ -934,6 +934,7 @@ static int get_info(struct net *net, voi
76144 private = &tmp;
76145 }
76146 #endif
76147 + memset(&info, 0, sizeof(info));
76148 info.valid_hooks = t->valid_hooks;
76149 memcpy(info.hook_entry, private->hook_entry,
76150 sizeof(info.hook_entry));
76151 diff -urNp linux-2.6.32.46/net/ipv4/netfilter/ip_queue.c linux-2.6.32.46/net/ipv4/netfilter/ip_queue.c
76152 --- linux-2.6.32.46/net/ipv4/netfilter/ip_queue.c 2011-03-27 14:31:47.000000000 -0400
76153 +++ linux-2.6.32.46/net/ipv4/netfilter/ip_queue.c 2011-08-21 18:42:53.000000000 -0400
76154 @@ -286,6 +286,9 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, st
76155
76156 if (v->data_len < sizeof(*user_iph))
76157 return 0;
76158 + if (v->data_len > 65535)
76159 + return -EMSGSIZE;
76160 +
76161 diff = v->data_len - e->skb->len;
76162 if (diff < 0) {
76163 if (pskb_trim(e->skb, v->data_len))
76164 @@ -409,7 +412,8 @@ ipq_dev_drop(int ifindex)
76165 static inline void
76166 __ipq_rcv_skb(struct sk_buff *skb)
76167 {
76168 - int status, type, pid, flags, nlmsglen, skblen;
76169 + int status, type, pid, flags;
76170 + unsigned int nlmsglen, skblen;
76171 struct nlmsghdr *nlh;
76172
76173 skblen = skb->len;
76174 diff -urNp linux-2.6.32.46/net/ipv4/netfilter/ip_tables.c linux-2.6.32.46/net/ipv4/netfilter/ip_tables.c
76175 --- linux-2.6.32.46/net/ipv4/netfilter/ip_tables.c 2011-04-17 17:00:52.000000000 -0400
76176 +++ linux-2.6.32.46/net/ipv4/netfilter/ip_tables.c 2011-04-17 17:04:18.000000000 -0400
76177 @@ -1141,6 +1141,7 @@ static int get_info(struct net *net, voi
76178 private = &tmp;
76179 }
76180 #endif
76181 + memset(&info, 0, sizeof(info));
76182 info.valid_hooks = t->valid_hooks;
76183 memcpy(info.hook_entry, private->hook_entry,
76184 sizeof(info.hook_entry));
76185 diff -urNp linux-2.6.32.46/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.32.46/net/ipv4/netfilter/nf_nat_snmp_basic.c
76186 --- linux-2.6.32.46/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-03-27 14:31:47.000000000 -0400
76187 +++ linux-2.6.32.46/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-04-17 15:56:46.000000000 -0400
76188 @@ -397,7 +397,7 @@ static unsigned char asn1_octets_decode(
76189
76190 *len = 0;
76191
76192 - *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
76193 + *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
76194 if (*octets == NULL) {
76195 if (net_ratelimit())
76196 printk("OOM in bsalg (%d)\n", __LINE__);
76197 diff -urNp linux-2.6.32.46/net/ipv4/raw.c linux-2.6.32.46/net/ipv4/raw.c
76198 --- linux-2.6.32.46/net/ipv4/raw.c 2011-03-27 14:31:47.000000000 -0400
76199 +++ linux-2.6.32.46/net/ipv4/raw.c 2011-08-14 11:46:51.000000000 -0400
76200 @@ -292,7 +292,7 @@ static int raw_rcv_skb(struct sock * sk,
76201 /* Charge it to the socket. */
76202
76203 if (sock_queue_rcv_skb(sk, skb) < 0) {
76204 - atomic_inc(&sk->sk_drops);
76205 + atomic_inc_unchecked(&sk->sk_drops);
76206 kfree_skb(skb);
76207 return NET_RX_DROP;
76208 }
76209 @@ -303,7 +303,7 @@ static int raw_rcv_skb(struct sock * sk,
76210 int raw_rcv(struct sock *sk, struct sk_buff *skb)
76211 {
76212 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
76213 - atomic_inc(&sk->sk_drops);
76214 + atomic_inc_unchecked(&sk->sk_drops);
76215 kfree_skb(skb);
76216 return NET_RX_DROP;
76217 }
76218 @@ -724,16 +724,23 @@ static int raw_init(struct sock *sk)
76219
76220 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
76221 {
76222 + struct icmp_filter filter;
76223 +
76224 + if (optlen < 0)
76225 + return -EINVAL;
76226 if (optlen > sizeof(struct icmp_filter))
76227 optlen = sizeof(struct icmp_filter);
76228 - if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
76229 + if (copy_from_user(&filter, optval, optlen))
76230 return -EFAULT;
76231 + raw_sk(sk)->filter = filter;
76232 +
76233 return 0;
76234 }
76235
76236 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
76237 {
76238 int len, ret = -EFAULT;
76239 + struct icmp_filter filter;
76240
76241 if (get_user(len, optlen))
76242 goto out;
76243 @@ -743,8 +750,9 @@ static int raw_geticmpfilter(struct sock
76244 if (len > sizeof(struct icmp_filter))
76245 len = sizeof(struct icmp_filter);
76246 ret = -EFAULT;
76247 - if (put_user(len, optlen) ||
76248 - copy_to_user(optval, &raw_sk(sk)->filter, len))
76249 + filter = raw_sk(sk)->filter;
76250 + if (put_user(len, optlen) || len > sizeof filter ||
76251 + copy_to_user(optval, &filter, len))
76252 goto out;
76253 ret = 0;
76254 out: return ret;
76255 @@ -954,7 +962,13 @@ static void raw_sock_seq_show(struct seq
76256 sk_wmem_alloc_get(sp),
76257 sk_rmem_alloc_get(sp),
76258 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76259 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
76260 + atomic_read(&sp->sk_refcnt),
76261 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76262 + NULL,
76263 +#else
76264 + sp,
76265 +#endif
76266 + atomic_read_unchecked(&sp->sk_drops));
76267 }
76268
76269 static int raw_seq_show(struct seq_file *seq, void *v)
76270 diff -urNp linux-2.6.32.46/net/ipv4/route.c linux-2.6.32.46/net/ipv4/route.c
76271 --- linux-2.6.32.46/net/ipv4/route.c 2011-08-16 20:37:25.000000000 -0400
76272 +++ linux-2.6.32.46/net/ipv4/route.c 2011-08-07 19:48:09.000000000 -0400
76273 @@ -269,7 +269,7 @@ static inline unsigned int rt_hash(__be3
76274
76275 static inline int rt_genid(struct net *net)
76276 {
76277 - return atomic_read(&net->ipv4.rt_genid);
76278 + return atomic_read_unchecked(&net->ipv4.rt_genid);
76279 }
76280
76281 #ifdef CONFIG_PROC_FS
76282 @@ -889,7 +889,7 @@ static void rt_cache_invalidate(struct n
76283 unsigned char shuffle;
76284
76285 get_random_bytes(&shuffle, sizeof(shuffle));
76286 - atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
76287 + atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
76288 }
76289
76290 /*
76291 @@ -3357,7 +3357,7 @@ static __net_initdata struct pernet_oper
76292
76293 static __net_init int rt_secret_timer_init(struct net *net)
76294 {
76295 - atomic_set(&net->ipv4.rt_genid,
76296 + atomic_set_unchecked(&net->ipv4.rt_genid,
76297 (int) ((num_physpages ^ (num_physpages>>8)) ^
76298 (jiffies ^ (jiffies >> 7))));
76299
76300 diff -urNp linux-2.6.32.46/net/ipv4/tcp.c linux-2.6.32.46/net/ipv4/tcp.c
76301 --- linux-2.6.32.46/net/ipv4/tcp.c 2011-03-27 14:31:47.000000000 -0400
76302 +++ linux-2.6.32.46/net/ipv4/tcp.c 2011-05-16 21:46:57.000000000 -0400
76303 @@ -2085,6 +2085,8 @@ static int do_tcp_setsockopt(struct sock
76304 int val;
76305 int err = 0;
76306
76307 + pax_track_stack();
76308 +
76309 /* This is a string value all the others are int's */
76310 if (optname == TCP_CONGESTION) {
76311 char name[TCP_CA_NAME_MAX];
76312 @@ -2355,6 +2357,8 @@ static int do_tcp_getsockopt(struct sock
76313 struct tcp_sock *tp = tcp_sk(sk);
76314 int val, len;
76315
76316 + pax_track_stack();
76317 +
76318 if (get_user(len, optlen))
76319 return -EFAULT;
76320
76321 diff -urNp linux-2.6.32.46/net/ipv4/tcp_ipv4.c linux-2.6.32.46/net/ipv4/tcp_ipv4.c
76322 --- linux-2.6.32.46/net/ipv4/tcp_ipv4.c 2011-08-16 20:37:25.000000000 -0400
76323 +++ linux-2.6.32.46/net/ipv4/tcp_ipv4.c 2011-08-23 21:22:32.000000000 -0400
76324 @@ -85,6 +85,9 @@
76325 int sysctl_tcp_tw_reuse __read_mostly;
76326 int sysctl_tcp_low_latency __read_mostly;
76327
76328 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76329 +extern int grsec_enable_blackhole;
76330 +#endif
76331
76332 #ifdef CONFIG_TCP_MD5SIG
76333 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
76334 @@ -1543,6 +1546,9 @@ int tcp_v4_do_rcv(struct sock *sk, struc
76335 return 0;
76336
76337 reset:
76338 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76339 + if (!grsec_enable_blackhole)
76340 +#endif
76341 tcp_v4_send_reset(rsk, skb);
76342 discard:
76343 kfree_skb(skb);
76344 @@ -1604,12 +1610,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
76345 TCP_SKB_CB(skb)->sacked = 0;
76346
76347 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76348 - if (!sk)
76349 + if (!sk) {
76350 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76351 + ret = 1;
76352 +#endif
76353 goto no_tcp_socket;
76354 + }
76355
76356 process:
76357 - if (sk->sk_state == TCP_TIME_WAIT)
76358 + if (sk->sk_state == TCP_TIME_WAIT) {
76359 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76360 + ret = 2;
76361 +#endif
76362 goto do_time_wait;
76363 + }
76364
76365 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
76366 goto discard_and_relse;
76367 @@ -1651,6 +1665,10 @@ no_tcp_socket:
76368 bad_packet:
76369 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76370 } else {
76371 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76372 + if (!grsec_enable_blackhole || (ret == 1 &&
76373 + (skb->dev->flags & IFF_LOOPBACK)))
76374 +#endif
76375 tcp_v4_send_reset(NULL, skb);
76376 }
76377
76378 @@ -2238,7 +2256,11 @@ static void get_openreq4(struct sock *sk
76379 0, /* non standard timer */
76380 0, /* open_requests have no inode */
76381 atomic_read(&sk->sk_refcnt),
76382 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76383 + NULL,
76384 +#else
76385 req,
76386 +#endif
76387 len);
76388 }
76389
76390 @@ -2280,7 +2302,12 @@ static void get_tcp4_sock(struct sock *s
76391 sock_i_uid(sk),
76392 icsk->icsk_probes_out,
76393 sock_i_ino(sk),
76394 - atomic_read(&sk->sk_refcnt), sk,
76395 + atomic_read(&sk->sk_refcnt),
76396 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76397 + NULL,
76398 +#else
76399 + sk,
76400 +#endif
76401 jiffies_to_clock_t(icsk->icsk_rto),
76402 jiffies_to_clock_t(icsk->icsk_ack.ato),
76403 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
76404 @@ -2308,7 +2335,13 @@ static void get_timewait4_sock(struct in
76405 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
76406 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
76407 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76408 - atomic_read(&tw->tw_refcnt), tw, len);
76409 + atomic_read(&tw->tw_refcnt),
76410 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76411 + NULL,
76412 +#else
76413 + tw,
76414 +#endif
76415 + len);
76416 }
76417
76418 #define TMPSZ 150
76419 diff -urNp linux-2.6.32.46/net/ipv4/tcp_minisocks.c linux-2.6.32.46/net/ipv4/tcp_minisocks.c
76420 --- linux-2.6.32.46/net/ipv4/tcp_minisocks.c 2011-03-27 14:31:47.000000000 -0400
76421 +++ linux-2.6.32.46/net/ipv4/tcp_minisocks.c 2011-04-17 15:56:46.000000000 -0400
76422 @@ -26,6 +26,10 @@
76423 #include <net/inet_common.h>
76424 #include <net/xfrm.h>
76425
76426 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76427 +extern int grsec_enable_blackhole;
76428 +#endif
76429 +
76430 #ifdef CONFIG_SYSCTL
76431 #define SYNC_INIT 0 /* let the user enable it */
76432 #else
76433 @@ -672,6 +676,10 @@ listen_overflow:
76434
76435 embryonic_reset:
76436 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
76437 +
76438 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76439 + if (!grsec_enable_blackhole)
76440 +#endif
76441 if (!(flg & TCP_FLAG_RST))
76442 req->rsk_ops->send_reset(sk, skb);
76443
76444 diff -urNp linux-2.6.32.46/net/ipv4/tcp_output.c linux-2.6.32.46/net/ipv4/tcp_output.c
76445 --- linux-2.6.32.46/net/ipv4/tcp_output.c 2011-03-27 14:31:47.000000000 -0400
76446 +++ linux-2.6.32.46/net/ipv4/tcp_output.c 2011-05-16 21:46:57.000000000 -0400
76447 @@ -2234,6 +2234,8 @@ struct sk_buff *tcp_make_synack(struct s
76448 __u8 *md5_hash_location;
76449 int mss;
76450
76451 + pax_track_stack();
76452 +
76453 skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
76454 if (skb == NULL)
76455 return NULL;
76456 diff -urNp linux-2.6.32.46/net/ipv4/tcp_probe.c linux-2.6.32.46/net/ipv4/tcp_probe.c
76457 --- linux-2.6.32.46/net/ipv4/tcp_probe.c 2011-03-27 14:31:47.000000000 -0400
76458 +++ linux-2.6.32.46/net/ipv4/tcp_probe.c 2011-04-17 15:56:46.000000000 -0400
76459 @@ -200,7 +200,7 @@ static ssize_t tcpprobe_read(struct file
76460 if (cnt + width >= len)
76461 break;
76462
76463 - if (copy_to_user(buf + cnt, tbuf, width))
76464 + if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
76465 return -EFAULT;
76466 cnt += width;
76467 }
76468 diff -urNp linux-2.6.32.46/net/ipv4/tcp_timer.c linux-2.6.32.46/net/ipv4/tcp_timer.c
76469 --- linux-2.6.32.46/net/ipv4/tcp_timer.c 2011-03-27 14:31:47.000000000 -0400
76470 +++ linux-2.6.32.46/net/ipv4/tcp_timer.c 2011-04-17 15:56:46.000000000 -0400
76471 @@ -21,6 +21,10 @@
76472 #include <linux/module.h>
76473 #include <net/tcp.h>
76474
76475 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76476 +extern int grsec_lastack_retries;
76477 +#endif
76478 +
76479 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
76480 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
76481 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
76482 @@ -164,6 +168,13 @@ static int tcp_write_timeout(struct sock
76483 }
76484 }
76485
76486 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76487 + if ((sk->sk_state == TCP_LAST_ACK) &&
76488 + (grsec_lastack_retries > 0) &&
76489 + (grsec_lastack_retries < retry_until))
76490 + retry_until = grsec_lastack_retries;
76491 +#endif
76492 +
76493 if (retransmits_timed_out(sk, retry_until)) {
76494 /* Has it gone just too far? */
76495 tcp_write_err(sk);
76496 diff -urNp linux-2.6.32.46/net/ipv4/udp.c linux-2.6.32.46/net/ipv4/udp.c
76497 --- linux-2.6.32.46/net/ipv4/udp.c 2011-07-13 17:23:04.000000000 -0400
76498 +++ linux-2.6.32.46/net/ipv4/udp.c 2011-08-23 21:22:32.000000000 -0400
76499 @@ -86,6 +86,7 @@
76500 #include <linux/types.h>
76501 #include <linux/fcntl.h>
76502 #include <linux/module.h>
76503 +#include <linux/security.h>
76504 #include <linux/socket.h>
76505 #include <linux/sockios.h>
76506 #include <linux/igmp.h>
76507 @@ -106,6 +107,10 @@
76508 #include <net/xfrm.h>
76509 #include "udp_impl.h"
76510
76511 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76512 +extern int grsec_enable_blackhole;
76513 +#endif
76514 +
76515 struct udp_table udp_table;
76516 EXPORT_SYMBOL(udp_table);
76517
76518 @@ -371,6 +376,9 @@ found:
76519 return s;
76520 }
76521
76522 +extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
76523 +extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
76524 +
76525 /*
76526 * This routine is called by the ICMP module when it gets some
76527 * sort of error condition. If err < 0 then the socket should
76528 @@ -639,9 +647,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
76529 dport = usin->sin_port;
76530 if (dport == 0)
76531 return -EINVAL;
76532 +
76533 + err = gr_search_udp_sendmsg(sk, usin);
76534 + if (err)
76535 + return err;
76536 } else {
76537 if (sk->sk_state != TCP_ESTABLISHED)
76538 return -EDESTADDRREQ;
76539 +
76540 + err = gr_search_udp_sendmsg(sk, NULL);
76541 + if (err)
76542 + return err;
76543 +
76544 daddr = inet->daddr;
76545 dport = inet->dport;
76546 /* Open fast path for connected socket.
76547 @@ -945,6 +962,10 @@ try_again:
76548 if (!skb)
76549 goto out;
76550
76551 + err = gr_search_udp_recvmsg(sk, skb);
76552 + if (err)
76553 + goto out_free;
76554 +
76555 ulen = skb->len - sizeof(struct udphdr);
76556 copied = len;
76557 if (copied > ulen)
76558 @@ -1068,7 +1089,7 @@ static int __udp_queue_rcv_skb(struct so
76559 if (rc == -ENOMEM) {
76560 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
76561 is_udplite);
76562 - atomic_inc(&sk->sk_drops);
76563 + atomic_inc_unchecked(&sk->sk_drops);
76564 }
76565 goto drop;
76566 }
76567 @@ -1338,6 +1359,9 @@ int __udp4_lib_rcv(struct sk_buff *skb,
76568 goto csum_error;
76569
76570 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
76571 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76572 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
76573 +#endif
76574 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
76575
76576 /*
76577 @@ -1758,8 +1782,13 @@ static void udp4_format_sock(struct sock
76578 sk_wmem_alloc_get(sp),
76579 sk_rmem_alloc_get(sp),
76580 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76581 - atomic_read(&sp->sk_refcnt), sp,
76582 - atomic_read(&sp->sk_drops), len);
76583 + atomic_read(&sp->sk_refcnt),
76584 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76585 + NULL,
76586 +#else
76587 + sp,
76588 +#endif
76589 + atomic_read_unchecked(&sp->sk_drops), len);
76590 }
76591
76592 int udp4_seq_show(struct seq_file *seq, void *v)
76593 diff -urNp linux-2.6.32.46/net/ipv6/addrconf.c linux-2.6.32.46/net/ipv6/addrconf.c
76594 --- linux-2.6.32.46/net/ipv6/addrconf.c 2011-05-10 22:12:02.000000000 -0400
76595 +++ linux-2.6.32.46/net/ipv6/addrconf.c 2011-10-06 09:37:14.000000000 -0400
76596 @@ -2053,7 +2053,7 @@ int addrconf_set_dstaddr(struct net *net
76597 p.iph.ihl = 5;
76598 p.iph.protocol = IPPROTO_IPV6;
76599 p.iph.ttl = 64;
76600 - ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
76601 + ifr.ifr_ifru.ifru_data = (void __force_user *)&p;
76602
76603 if (ops->ndo_do_ioctl) {
76604 mm_segment_t oldfs = get_fs();
76605 diff -urNp linux-2.6.32.46/net/ipv6/inet6_connection_sock.c linux-2.6.32.46/net/ipv6/inet6_connection_sock.c
76606 --- linux-2.6.32.46/net/ipv6/inet6_connection_sock.c 2011-03-27 14:31:47.000000000 -0400
76607 +++ linux-2.6.32.46/net/ipv6/inet6_connection_sock.c 2011-05-04 17:56:28.000000000 -0400
76608 @@ -152,7 +152,7 @@ void __inet6_csk_dst_store(struct sock *
76609 #ifdef CONFIG_XFRM
76610 {
76611 struct rt6_info *rt = (struct rt6_info *)dst;
76612 - rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
76613 + rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
76614 }
76615 #endif
76616 }
76617 @@ -167,7 +167,7 @@ struct dst_entry *__inet6_csk_dst_check(
76618 #ifdef CONFIG_XFRM
76619 if (dst) {
76620 struct rt6_info *rt = (struct rt6_info *)dst;
76621 - if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
76622 + if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
76623 sk->sk_dst_cache = NULL;
76624 dst_release(dst);
76625 dst = NULL;
76626 diff -urNp linux-2.6.32.46/net/ipv6/inet6_hashtables.c linux-2.6.32.46/net/ipv6/inet6_hashtables.c
76627 --- linux-2.6.32.46/net/ipv6/inet6_hashtables.c 2011-08-16 20:37:25.000000000 -0400
76628 +++ linux-2.6.32.46/net/ipv6/inet6_hashtables.c 2011-08-07 19:48:09.000000000 -0400
76629 @@ -119,7 +119,7 @@ out:
76630 }
76631 EXPORT_SYMBOL(__inet6_lookup_established);
76632
76633 -static int inline compute_score(struct sock *sk, struct net *net,
76634 +static inline int compute_score(struct sock *sk, struct net *net,
76635 const unsigned short hnum,
76636 const struct in6_addr *daddr,
76637 const int dif)
76638 diff -urNp linux-2.6.32.46/net/ipv6/ip6_tunnel.c linux-2.6.32.46/net/ipv6/ip6_tunnel.c
76639 --- linux-2.6.32.46/net/ipv6/ip6_tunnel.c 2011-08-09 18:35:30.000000000 -0400
76640 +++ linux-2.6.32.46/net/ipv6/ip6_tunnel.c 2011-08-24 18:52:25.000000000 -0400
76641 @@ -1466,7 +1466,7 @@ static int __init ip6_tunnel_init(void)
76642 {
76643 int err;
76644
76645 - err = register_pernet_device(&ip6_tnl_net_ops);
76646 + err = register_pernet_gen_device(&ip6_tnl_net_id, &ip6_tnl_net_ops);
76647 if (err < 0)
76648 goto out_pernet;
76649
76650 @@ -1487,7 +1487,7 @@ static int __init ip6_tunnel_init(void)
76651 out_ip6ip6:
76652 xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET);
76653 out_ip4ip6:
76654 - unregister_pernet_device(&ip6_tnl_net_ops);
76655 + unregister_pernet_gen_device(ip6_tnl_net_id, &ip6_tnl_net_ops);
76656 out_pernet:
76657 return err;
76658 }
76659 diff -urNp linux-2.6.32.46/net/ipv6/ipv6_sockglue.c linux-2.6.32.46/net/ipv6/ipv6_sockglue.c
76660 --- linux-2.6.32.46/net/ipv6/ipv6_sockglue.c 2011-03-27 14:31:47.000000000 -0400
76661 +++ linux-2.6.32.46/net/ipv6/ipv6_sockglue.c 2011-10-06 09:37:16.000000000 -0400
76662 @@ -130,6 +130,8 @@ static int do_ipv6_setsockopt(struct soc
76663 int val, valbool;
76664 int retv = -ENOPROTOOPT;
76665
76666 + pax_track_stack();
76667 +
76668 if (optval == NULL)
76669 val=0;
76670 else {
76671 @@ -881,6 +883,8 @@ static int do_ipv6_getsockopt(struct soc
76672 int len;
76673 int val;
76674
76675 + pax_track_stack();
76676 +
76677 if (ip6_mroute_opt(optname))
76678 return ip6_mroute_getsockopt(sk, optname, optval, optlen);
76679
76680 @@ -922,7 +926,7 @@ static int do_ipv6_getsockopt(struct soc
76681 if (sk->sk_type != SOCK_STREAM)
76682 return -ENOPROTOOPT;
76683
76684 - msg.msg_control = optval;
76685 + msg.msg_control = (void __force_kernel *)optval;
76686 msg.msg_controllen = len;
76687 msg.msg_flags = 0;
76688
76689 diff -urNp linux-2.6.32.46/net/ipv6/netfilter/ip6_queue.c linux-2.6.32.46/net/ipv6/netfilter/ip6_queue.c
76690 --- linux-2.6.32.46/net/ipv6/netfilter/ip6_queue.c 2011-03-27 14:31:47.000000000 -0400
76691 +++ linux-2.6.32.46/net/ipv6/netfilter/ip6_queue.c 2011-08-21 18:43:32.000000000 -0400
76692 @@ -287,6 +287,9 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, st
76693
76694 if (v->data_len < sizeof(*user_iph))
76695 return 0;
76696 + if (v->data_len > 65535)
76697 + return -EMSGSIZE;
76698 +
76699 diff = v->data_len - e->skb->len;
76700 if (diff < 0) {
76701 if (pskb_trim(e->skb, v->data_len))
76702 @@ -411,7 +414,8 @@ ipq_dev_drop(int ifindex)
76703 static inline void
76704 __ipq_rcv_skb(struct sk_buff *skb)
76705 {
76706 - int status, type, pid, flags, nlmsglen, skblen;
76707 + int status, type, pid, flags;
76708 + unsigned int nlmsglen, skblen;
76709 struct nlmsghdr *nlh;
76710
76711 skblen = skb->len;
76712 diff -urNp linux-2.6.32.46/net/ipv6/netfilter/ip6_tables.c linux-2.6.32.46/net/ipv6/netfilter/ip6_tables.c
76713 --- linux-2.6.32.46/net/ipv6/netfilter/ip6_tables.c 2011-04-17 17:00:52.000000000 -0400
76714 +++ linux-2.6.32.46/net/ipv6/netfilter/ip6_tables.c 2011-04-17 17:04:18.000000000 -0400
76715 @@ -1173,6 +1173,7 @@ static int get_info(struct net *net, voi
76716 private = &tmp;
76717 }
76718 #endif
76719 + memset(&info, 0, sizeof(info));
76720 info.valid_hooks = t->valid_hooks;
76721 memcpy(info.hook_entry, private->hook_entry,
76722 sizeof(info.hook_entry));
76723 diff -urNp linux-2.6.32.46/net/ipv6/raw.c linux-2.6.32.46/net/ipv6/raw.c
76724 --- linux-2.6.32.46/net/ipv6/raw.c 2011-03-27 14:31:47.000000000 -0400
76725 +++ linux-2.6.32.46/net/ipv6/raw.c 2011-08-14 11:48:20.000000000 -0400
76726 @@ -375,14 +375,14 @@ static inline int rawv6_rcv_skb(struct s
76727 {
76728 if ((raw6_sk(sk)->checksum || sk->sk_filter) &&
76729 skb_checksum_complete(skb)) {
76730 - atomic_inc(&sk->sk_drops);
76731 + atomic_inc_unchecked(&sk->sk_drops);
76732 kfree_skb(skb);
76733 return NET_RX_DROP;
76734 }
76735
76736 /* Charge it to the socket. */
76737 if (sock_queue_rcv_skb(sk,skb)<0) {
76738 - atomic_inc(&sk->sk_drops);
76739 + atomic_inc_unchecked(&sk->sk_drops);
76740 kfree_skb(skb);
76741 return NET_RX_DROP;
76742 }
76743 @@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk
76744 struct raw6_sock *rp = raw6_sk(sk);
76745
76746 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
76747 - atomic_inc(&sk->sk_drops);
76748 + atomic_inc_unchecked(&sk->sk_drops);
76749 kfree_skb(skb);
76750 return NET_RX_DROP;
76751 }
76752 @@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk
76753
76754 if (inet->hdrincl) {
76755 if (skb_checksum_complete(skb)) {
76756 - atomic_inc(&sk->sk_drops);
76757 + atomic_inc_unchecked(&sk->sk_drops);
76758 kfree_skb(skb);
76759 return NET_RX_DROP;
76760 }
76761 @@ -518,7 +518,7 @@ csum_copy_err:
76762 as some normal condition.
76763 */
76764 err = (flags&MSG_DONTWAIT) ? -EAGAIN : -EHOSTUNREACH;
76765 - atomic_inc(&sk->sk_drops);
76766 + atomic_inc_unchecked(&sk->sk_drops);
76767 goto out;
76768 }
76769
76770 @@ -600,7 +600,7 @@ out:
76771 return err;
76772 }
76773
76774 -static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
76775 +static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
76776 struct flowi *fl, struct rt6_info *rt,
76777 unsigned int flags)
76778 {
76779 @@ -738,6 +738,8 @@ static int rawv6_sendmsg(struct kiocb *i
76780 u16 proto;
76781 int err;
76782
76783 + pax_track_stack();
76784 +
76785 /* Rough check on arithmetic overflow,
76786 better check is made in ip6_append_data().
76787 */
76788 @@ -916,12 +918,17 @@ do_confirm:
76789 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
76790 char __user *optval, int optlen)
76791 {
76792 + struct icmp6_filter filter;
76793 +
76794 switch (optname) {
76795 case ICMPV6_FILTER:
76796 + if (optlen < 0)
76797 + return -EINVAL;
76798 if (optlen > sizeof(struct icmp6_filter))
76799 optlen = sizeof(struct icmp6_filter);
76800 - if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
76801 + if (copy_from_user(&filter, optval, optlen))
76802 return -EFAULT;
76803 + raw6_sk(sk)->filter = filter;
76804 return 0;
76805 default:
76806 return -ENOPROTOOPT;
76807 @@ -934,6 +941,7 @@ static int rawv6_geticmpfilter(struct so
76808 char __user *optval, int __user *optlen)
76809 {
76810 int len;
76811 + struct icmp6_filter filter;
76812
76813 switch (optname) {
76814 case ICMPV6_FILTER:
76815 @@ -945,7 +953,8 @@ static int rawv6_geticmpfilter(struct so
76816 len = sizeof(struct icmp6_filter);
76817 if (put_user(len, optlen))
76818 return -EFAULT;
76819 - if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
76820 + filter = raw6_sk(sk)->filter;
76821 + if (len > sizeof filter || copy_to_user(optval, &filter, len))
76822 return -EFAULT;
76823 return 0;
76824 default:
76825 @@ -1241,7 +1250,13 @@ static void raw6_sock_seq_show(struct se
76826 0, 0L, 0,
76827 sock_i_uid(sp), 0,
76828 sock_i_ino(sp),
76829 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
76830 + atomic_read(&sp->sk_refcnt),
76831 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76832 + NULL,
76833 +#else
76834 + sp,
76835 +#endif
76836 + atomic_read_unchecked(&sp->sk_drops));
76837 }
76838
76839 static int raw6_seq_show(struct seq_file *seq, void *v)
76840 diff -urNp linux-2.6.32.46/net/ipv6/tcp_ipv6.c linux-2.6.32.46/net/ipv6/tcp_ipv6.c
76841 --- linux-2.6.32.46/net/ipv6/tcp_ipv6.c 2011-08-16 20:37:25.000000000 -0400
76842 +++ linux-2.6.32.46/net/ipv6/tcp_ipv6.c 2011-08-07 19:48:09.000000000 -0400
76843 @@ -89,6 +89,10 @@ static struct tcp_md5sig_key *tcp_v6_md5
76844 }
76845 #endif
76846
76847 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76848 +extern int grsec_enable_blackhole;
76849 +#endif
76850 +
76851 static void tcp_v6_hash(struct sock *sk)
76852 {
76853 if (sk->sk_state != TCP_CLOSE) {
76854 @@ -1579,6 +1583,9 @@ static int tcp_v6_do_rcv(struct sock *sk
76855 return 0;
76856
76857 reset:
76858 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76859 + if (!grsec_enable_blackhole)
76860 +#endif
76861 tcp_v6_send_reset(sk, skb);
76862 discard:
76863 if (opt_skb)
76864 @@ -1656,12 +1663,20 @@ static int tcp_v6_rcv(struct sk_buff *sk
76865 TCP_SKB_CB(skb)->sacked = 0;
76866
76867 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76868 - if (!sk)
76869 + if (!sk) {
76870 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76871 + ret = 1;
76872 +#endif
76873 goto no_tcp_socket;
76874 + }
76875
76876 process:
76877 - if (sk->sk_state == TCP_TIME_WAIT)
76878 + if (sk->sk_state == TCP_TIME_WAIT) {
76879 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76880 + ret = 2;
76881 +#endif
76882 goto do_time_wait;
76883 + }
76884
76885 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
76886 goto discard_and_relse;
76887 @@ -1701,6 +1716,10 @@ no_tcp_socket:
76888 bad_packet:
76889 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76890 } else {
76891 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76892 + if (!grsec_enable_blackhole || (ret == 1 &&
76893 + (skb->dev->flags & IFF_LOOPBACK)))
76894 +#endif
76895 tcp_v6_send_reset(NULL, skb);
76896 }
76897
76898 @@ -1916,7 +1935,13 @@ static void get_openreq6(struct seq_file
76899 uid,
76900 0, /* non standard timer */
76901 0, /* open_requests have no inode */
76902 - 0, req);
76903 + 0,
76904 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76905 + NULL
76906 +#else
76907 + req
76908 +#endif
76909 + );
76910 }
76911
76912 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
76913 @@ -1966,7 +1991,12 @@ static void get_tcp6_sock(struct seq_fil
76914 sock_i_uid(sp),
76915 icsk->icsk_probes_out,
76916 sock_i_ino(sp),
76917 - atomic_read(&sp->sk_refcnt), sp,
76918 + atomic_read(&sp->sk_refcnt),
76919 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76920 + NULL,
76921 +#else
76922 + sp,
76923 +#endif
76924 jiffies_to_clock_t(icsk->icsk_rto),
76925 jiffies_to_clock_t(icsk->icsk_ack.ato),
76926 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
76927 @@ -2001,7 +2031,13 @@ static void get_timewait6_sock(struct se
76928 dest->s6_addr32[2], dest->s6_addr32[3], destp,
76929 tw->tw_substate, 0, 0,
76930 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76931 - atomic_read(&tw->tw_refcnt), tw);
76932 + atomic_read(&tw->tw_refcnt),
76933 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76934 + NULL
76935 +#else
76936 + tw
76937 +#endif
76938 + );
76939 }
76940
76941 static int tcp6_seq_show(struct seq_file *seq, void *v)
76942 diff -urNp linux-2.6.32.46/net/ipv6/udp.c linux-2.6.32.46/net/ipv6/udp.c
76943 --- linux-2.6.32.46/net/ipv6/udp.c 2011-07-13 17:23:04.000000000 -0400
76944 +++ linux-2.6.32.46/net/ipv6/udp.c 2011-07-13 17:23:27.000000000 -0400
76945 @@ -49,6 +49,10 @@
76946 #include <linux/seq_file.h>
76947 #include "udp_impl.h"
76948
76949 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76950 +extern int grsec_enable_blackhole;
76951 +#endif
76952 +
76953 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
76954 {
76955 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
76956 @@ -391,7 +395,7 @@ int udpv6_queue_rcv_skb(struct sock * sk
76957 if (rc == -ENOMEM) {
76958 UDP6_INC_STATS_BH(sock_net(sk),
76959 UDP_MIB_RCVBUFERRORS, is_udplite);
76960 - atomic_inc(&sk->sk_drops);
76961 + atomic_inc_unchecked(&sk->sk_drops);
76962 }
76963 goto drop;
76964 }
76965 @@ -590,6 +594,9 @@ int __udp6_lib_rcv(struct sk_buff *skb,
76966 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
76967 proto == IPPROTO_UDPLITE);
76968
76969 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76970 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
76971 +#endif
76972 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
76973
76974 kfree_skb(skb);
76975 @@ -1209,8 +1216,13 @@ static void udp6_sock_seq_show(struct se
76976 0, 0L, 0,
76977 sock_i_uid(sp), 0,
76978 sock_i_ino(sp),
76979 - atomic_read(&sp->sk_refcnt), sp,
76980 - atomic_read(&sp->sk_drops));
76981 + atomic_read(&sp->sk_refcnt),
76982 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76983 + NULL,
76984 +#else
76985 + sp,
76986 +#endif
76987 + atomic_read_unchecked(&sp->sk_drops));
76988 }
76989
76990 int udp6_seq_show(struct seq_file *seq, void *v)
76991 diff -urNp linux-2.6.32.46/net/irda/ircomm/ircomm_tty.c linux-2.6.32.46/net/irda/ircomm/ircomm_tty.c
76992 --- linux-2.6.32.46/net/irda/ircomm/ircomm_tty.c 2011-03-27 14:31:47.000000000 -0400
76993 +++ linux-2.6.32.46/net/irda/ircomm/ircomm_tty.c 2011-04-17 15:56:46.000000000 -0400
76994 @@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(st
76995 add_wait_queue(&self->open_wait, &wait);
76996
76997 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
76998 - __FILE__,__LINE__, tty->driver->name, self->open_count );
76999 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
77000
77001 /* As far as I can see, we protect open_count - Jean II */
77002 spin_lock_irqsave(&self->spinlock, flags);
77003 if (!tty_hung_up_p(filp)) {
77004 extra_count = 1;
77005 - self->open_count--;
77006 + local_dec(&self->open_count);
77007 }
77008 spin_unlock_irqrestore(&self->spinlock, flags);
77009 - self->blocked_open++;
77010 + local_inc(&self->blocked_open);
77011
77012 while (1) {
77013 if (tty->termios->c_cflag & CBAUD) {
77014 @@ -329,7 +329,7 @@ static int ircomm_tty_block_til_ready(st
77015 }
77016
77017 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
77018 - __FILE__,__LINE__, tty->driver->name, self->open_count );
77019 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
77020
77021 schedule();
77022 }
77023 @@ -340,13 +340,13 @@ static int ircomm_tty_block_til_ready(st
77024 if (extra_count) {
77025 /* ++ is not atomic, so this should be protected - Jean II */
77026 spin_lock_irqsave(&self->spinlock, flags);
77027 - self->open_count++;
77028 + local_inc(&self->open_count);
77029 spin_unlock_irqrestore(&self->spinlock, flags);
77030 }
77031 - self->blocked_open--;
77032 + local_dec(&self->blocked_open);
77033
77034 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
77035 - __FILE__,__LINE__, tty->driver->name, self->open_count);
77036 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
77037
77038 if (!retval)
77039 self->flags |= ASYNC_NORMAL_ACTIVE;
77040 @@ -415,14 +415,14 @@ static int ircomm_tty_open(struct tty_st
77041 }
77042 /* ++ is not atomic, so this should be protected - Jean II */
77043 spin_lock_irqsave(&self->spinlock, flags);
77044 - self->open_count++;
77045 + local_inc(&self->open_count);
77046
77047 tty->driver_data = self;
77048 self->tty = tty;
77049 spin_unlock_irqrestore(&self->spinlock, flags);
77050
77051 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
77052 - self->line, self->open_count);
77053 + self->line, local_read(&self->open_count));
77054
77055 /* Not really used by us, but lets do it anyway */
77056 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
77057 @@ -511,7 +511,7 @@ static void ircomm_tty_close(struct tty_
77058 return;
77059 }
77060
77061 - if ((tty->count == 1) && (self->open_count != 1)) {
77062 + if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
77063 /*
77064 * Uh, oh. tty->count is 1, which means that the tty
77065 * structure will be freed. state->count should always
77066 @@ -521,16 +521,16 @@ static void ircomm_tty_close(struct tty_
77067 */
77068 IRDA_DEBUG(0, "%s(), bad serial port count; "
77069 "tty->count is 1, state->count is %d\n", __func__ ,
77070 - self->open_count);
77071 - self->open_count = 1;
77072 + local_read(&self->open_count));
77073 + local_set(&self->open_count, 1);
77074 }
77075
77076 - if (--self->open_count < 0) {
77077 + if (local_dec_return(&self->open_count) < 0) {
77078 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
77079 - __func__, self->line, self->open_count);
77080 - self->open_count = 0;
77081 + __func__, self->line, local_read(&self->open_count));
77082 + local_set(&self->open_count, 0);
77083 }
77084 - if (self->open_count) {
77085 + if (local_read(&self->open_count)) {
77086 spin_unlock_irqrestore(&self->spinlock, flags);
77087
77088 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
77089 @@ -562,7 +562,7 @@ static void ircomm_tty_close(struct tty_
77090 tty->closing = 0;
77091 self->tty = NULL;
77092
77093 - if (self->blocked_open) {
77094 + if (local_read(&self->blocked_open)) {
77095 if (self->close_delay)
77096 schedule_timeout_interruptible(self->close_delay);
77097 wake_up_interruptible(&self->open_wait);
77098 @@ -1017,7 +1017,7 @@ static void ircomm_tty_hangup(struct tty
77099 spin_lock_irqsave(&self->spinlock, flags);
77100 self->flags &= ~ASYNC_NORMAL_ACTIVE;
77101 self->tty = NULL;
77102 - self->open_count = 0;
77103 + local_set(&self->open_count, 0);
77104 spin_unlock_irqrestore(&self->spinlock, flags);
77105
77106 wake_up_interruptible(&self->open_wait);
77107 @@ -1369,7 +1369,7 @@ static void ircomm_tty_line_info(struct
77108 seq_putc(m, '\n');
77109
77110 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
77111 - seq_printf(m, "Open count: %d\n", self->open_count);
77112 + seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
77113 seq_printf(m, "Max data size: %d\n", self->max_data_size);
77114 seq_printf(m, "Max header size: %d\n", self->max_header_size);
77115
77116 diff -urNp linux-2.6.32.46/net/iucv/af_iucv.c linux-2.6.32.46/net/iucv/af_iucv.c
77117 --- linux-2.6.32.46/net/iucv/af_iucv.c 2011-03-27 14:31:47.000000000 -0400
77118 +++ linux-2.6.32.46/net/iucv/af_iucv.c 2011-05-04 17:56:28.000000000 -0400
77119 @@ -651,10 +651,10 @@ static int iucv_sock_autobind(struct soc
77120
77121 write_lock_bh(&iucv_sk_list.lock);
77122
77123 - sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
77124 + sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77125 while (__iucv_get_sock_by_name(name)) {
77126 sprintf(name, "%08x",
77127 - atomic_inc_return(&iucv_sk_list.autobind_name));
77128 + atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77129 }
77130
77131 write_unlock_bh(&iucv_sk_list.lock);
77132 diff -urNp linux-2.6.32.46/net/key/af_key.c linux-2.6.32.46/net/key/af_key.c
77133 --- linux-2.6.32.46/net/key/af_key.c 2011-03-27 14:31:47.000000000 -0400
77134 +++ linux-2.6.32.46/net/key/af_key.c 2011-05-16 21:46:57.000000000 -0400
77135 @@ -2489,6 +2489,8 @@ static int pfkey_migrate(struct sock *sk
77136 struct xfrm_migrate m[XFRM_MAX_DEPTH];
77137 struct xfrm_kmaddress k;
77138
77139 + pax_track_stack();
77140 +
77141 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
77142 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
77143 !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
77144 @@ -3660,7 +3662,11 @@ static int pfkey_seq_show(struct seq_fil
77145 seq_printf(f ,"sk RefCnt Rmem Wmem User Inode\n");
77146 else
77147 seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
77148 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77149 + NULL,
77150 +#else
77151 s,
77152 +#endif
77153 atomic_read(&s->sk_refcnt),
77154 sk_rmem_alloc_get(s),
77155 sk_wmem_alloc_get(s),
77156 diff -urNp linux-2.6.32.46/net/lapb/lapb_iface.c linux-2.6.32.46/net/lapb/lapb_iface.c
77157 --- linux-2.6.32.46/net/lapb/lapb_iface.c 2011-03-27 14:31:47.000000000 -0400
77158 +++ linux-2.6.32.46/net/lapb/lapb_iface.c 2011-08-05 20:33:55.000000000 -0400
77159 @@ -157,7 +157,7 @@ int lapb_register(struct net_device *dev
77160 goto out;
77161
77162 lapb->dev = dev;
77163 - lapb->callbacks = *callbacks;
77164 + lapb->callbacks = callbacks;
77165
77166 __lapb_insert_cb(lapb);
77167
77168 @@ -379,32 +379,32 @@ int lapb_data_received(struct net_device
77169
77170 void lapb_connect_confirmation(struct lapb_cb *lapb, int reason)
77171 {
77172 - if (lapb->callbacks.connect_confirmation)
77173 - lapb->callbacks.connect_confirmation(lapb->dev, reason);
77174 + if (lapb->callbacks->connect_confirmation)
77175 + lapb->callbacks->connect_confirmation(lapb->dev, reason);
77176 }
77177
77178 void lapb_connect_indication(struct lapb_cb *lapb, int reason)
77179 {
77180 - if (lapb->callbacks.connect_indication)
77181 - lapb->callbacks.connect_indication(lapb->dev, reason);
77182 + if (lapb->callbacks->connect_indication)
77183 + lapb->callbacks->connect_indication(lapb->dev, reason);
77184 }
77185
77186 void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason)
77187 {
77188 - if (lapb->callbacks.disconnect_confirmation)
77189 - lapb->callbacks.disconnect_confirmation(lapb->dev, reason);
77190 + if (lapb->callbacks->disconnect_confirmation)
77191 + lapb->callbacks->disconnect_confirmation(lapb->dev, reason);
77192 }
77193
77194 void lapb_disconnect_indication(struct lapb_cb *lapb, int reason)
77195 {
77196 - if (lapb->callbacks.disconnect_indication)
77197 - lapb->callbacks.disconnect_indication(lapb->dev, reason);
77198 + if (lapb->callbacks->disconnect_indication)
77199 + lapb->callbacks->disconnect_indication(lapb->dev, reason);
77200 }
77201
77202 int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
77203 {
77204 - if (lapb->callbacks.data_indication)
77205 - return lapb->callbacks.data_indication(lapb->dev, skb);
77206 + if (lapb->callbacks->data_indication)
77207 + return lapb->callbacks->data_indication(lapb->dev, skb);
77208
77209 kfree_skb(skb);
77210 return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
77211 @@ -414,8 +414,8 @@ int lapb_data_transmit(struct lapb_cb *l
77212 {
77213 int used = 0;
77214
77215 - if (lapb->callbacks.data_transmit) {
77216 - lapb->callbacks.data_transmit(lapb->dev, skb);
77217 + if (lapb->callbacks->data_transmit) {
77218 + lapb->callbacks->data_transmit(lapb->dev, skb);
77219 used = 1;
77220 }
77221
77222 diff -urNp linux-2.6.32.46/net/mac80211/cfg.c linux-2.6.32.46/net/mac80211/cfg.c
77223 --- linux-2.6.32.46/net/mac80211/cfg.c 2011-03-27 14:31:47.000000000 -0400
77224 +++ linux-2.6.32.46/net/mac80211/cfg.c 2011-04-17 15:56:46.000000000 -0400
77225 @@ -1369,7 +1369,7 @@ static int ieee80211_set_bitrate_mask(st
77226 return err;
77227 }
77228
77229 -struct cfg80211_ops mac80211_config_ops = {
77230 +const struct cfg80211_ops mac80211_config_ops = {
77231 .add_virtual_intf = ieee80211_add_iface,
77232 .del_virtual_intf = ieee80211_del_iface,
77233 .change_virtual_intf = ieee80211_change_iface,
77234 diff -urNp linux-2.6.32.46/net/mac80211/cfg.h linux-2.6.32.46/net/mac80211/cfg.h
77235 --- linux-2.6.32.46/net/mac80211/cfg.h 2011-03-27 14:31:47.000000000 -0400
77236 +++ linux-2.6.32.46/net/mac80211/cfg.h 2011-04-17 15:56:46.000000000 -0400
77237 @@ -4,6 +4,6 @@
77238 #ifndef __CFG_H
77239 #define __CFG_H
77240
77241 -extern struct cfg80211_ops mac80211_config_ops;
77242 +extern const struct cfg80211_ops mac80211_config_ops;
77243
77244 #endif /* __CFG_H */
77245 diff -urNp linux-2.6.32.46/net/mac80211/debugfs_key.c linux-2.6.32.46/net/mac80211/debugfs_key.c
77246 --- linux-2.6.32.46/net/mac80211/debugfs_key.c 2011-03-27 14:31:47.000000000 -0400
77247 +++ linux-2.6.32.46/net/mac80211/debugfs_key.c 2011-04-17 15:56:46.000000000 -0400
77248 @@ -211,9 +211,13 @@ static ssize_t key_key_read(struct file
77249 size_t count, loff_t *ppos)
77250 {
77251 struct ieee80211_key *key = file->private_data;
77252 - int i, res, bufsize = 2 * key->conf.keylen + 2;
77253 + int i, bufsize = 2 * key->conf.keylen + 2;
77254 char *buf = kmalloc(bufsize, GFP_KERNEL);
77255 char *p = buf;
77256 + ssize_t res;
77257 +
77258 + if (buf == NULL)
77259 + return -ENOMEM;
77260
77261 for (i = 0; i < key->conf.keylen; i++)
77262 p += scnprintf(p, bufsize + buf - p, "%02x", key->conf.key[i]);
77263 diff -urNp linux-2.6.32.46/net/mac80211/debugfs_sta.c linux-2.6.32.46/net/mac80211/debugfs_sta.c
77264 --- linux-2.6.32.46/net/mac80211/debugfs_sta.c 2011-03-27 14:31:47.000000000 -0400
77265 +++ linux-2.6.32.46/net/mac80211/debugfs_sta.c 2011-05-16 21:46:57.000000000 -0400
77266 @@ -124,6 +124,8 @@ static ssize_t sta_agg_status_read(struc
77267 int i;
77268 struct sta_info *sta = file->private_data;
77269
77270 + pax_track_stack();
77271 +
77272 spin_lock_bh(&sta->lock);
77273 p += scnprintf(p, sizeof(buf)+buf-p, "next dialog_token is %#02x\n",
77274 sta->ampdu_mlme.dialog_token_allocator + 1);
77275 diff -urNp linux-2.6.32.46/net/mac80211/ieee80211_i.h linux-2.6.32.46/net/mac80211/ieee80211_i.h
77276 --- linux-2.6.32.46/net/mac80211/ieee80211_i.h 2011-03-27 14:31:47.000000000 -0400
77277 +++ linux-2.6.32.46/net/mac80211/ieee80211_i.h 2011-04-17 15:56:46.000000000 -0400
77278 @@ -25,6 +25,7 @@
77279 #include <linux/etherdevice.h>
77280 #include <net/cfg80211.h>
77281 #include <net/mac80211.h>
77282 +#include <asm/local.h>
77283 #include "key.h"
77284 #include "sta_info.h"
77285
77286 @@ -635,7 +636,7 @@ struct ieee80211_local {
77287 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
77288 spinlock_t queue_stop_reason_lock;
77289
77290 - int open_count;
77291 + local_t open_count;
77292 int monitors, cooked_mntrs;
77293 /* number of interfaces with corresponding FIF_ flags */
77294 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
77295 diff -urNp linux-2.6.32.46/net/mac80211/iface.c linux-2.6.32.46/net/mac80211/iface.c
77296 --- linux-2.6.32.46/net/mac80211/iface.c 2011-03-27 14:31:47.000000000 -0400
77297 +++ linux-2.6.32.46/net/mac80211/iface.c 2011-04-17 15:56:46.000000000 -0400
77298 @@ -166,7 +166,7 @@ static int ieee80211_open(struct net_dev
77299 break;
77300 }
77301
77302 - if (local->open_count == 0) {
77303 + if (local_read(&local->open_count) == 0) {
77304 res = drv_start(local);
77305 if (res)
77306 goto err_del_bss;
77307 @@ -196,7 +196,7 @@ static int ieee80211_open(struct net_dev
77308 * Validate the MAC address for this device.
77309 */
77310 if (!is_valid_ether_addr(dev->dev_addr)) {
77311 - if (!local->open_count)
77312 + if (!local_read(&local->open_count))
77313 drv_stop(local);
77314 return -EADDRNOTAVAIL;
77315 }
77316 @@ -292,7 +292,7 @@ static int ieee80211_open(struct net_dev
77317
77318 hw_reconf_flags |= __ieee80211_recalc_idle(local);
77319
77320 - local->open_count++;
77321 + local_inc(&local->open_count);
77322 if (hw_reconf_flags) {
77323 ieee80211_hw_config(local, hw_reconf_flags);
77324 /*
77325 @@ -320,7 +320,7 @@ static int ieee80211_open(struct net_dev
77326 err_del_interface:
77327 drv_remove_interface(local, &conf);
77328 err_stop:
77329 - if (!local->open_count)
77330 + if (!local_read(&local->open_count))
77331 drv_stop(local);
77332 err_del_bss:
77333 sdata->bss = NULL;
77334 @@ -420,7 +420,7 @@ static int ieee80211_stop(struct net_dev
77335 WARN_ON(!list_empty(&sdata->u.ap.vlans));
77336 }
77337
77338 - local->open_count--;
77339 + local_dec(&local->open_count);
77340
77341 switch (sdata->vif.type) {
77342 case NL80211_IFTYPE_AP_VLAN:
77343 @@ -526,7 +526,7 @@ static int ieee80211_stop(struct net_dev
77344
77345 ieee80211_recalc_ps(local, -1);
77346
77347 - if (local->open_count == 0) {
77348 + if (local_read(&local->open_count) == 0) {
77349 ieee80211_clear_tx_pending(local);
77350 ieee80211_stop_device(local);
77351
77352 diff -urNp linux-2.6.32.46/net/mac80211/main.c linux-2.6.32.46/net/mac80211/main.c
77353 --- linux-2.6.32.46/net/mac80211/main.c 2011-05-10 22:12:02.000000000 -0400
77354 +++ linux-2.6.32.46/net/mac80211/main.c 2011-05-10 22:12:34.000000000 -0400
77355 @@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211
77356 local->hw.conf.power_level = power;
77357 }
77358
77359 - if (changed && local->open_count) {
77360 + if (changed && local_read(&local->open_count)) {
77361 ret = drv_config(local, changed);
77362 /*
77363 * Goal:
77364 diff -urNp linux-2.6.32.46/net/mac80211/mlme.c linux-2.6.32.46/net/mac80211/mlme.c
77365 --- linux-2.6.32.46/net/mac80211/mlme.c 2011-08-09 18:35:30.000000000 -0400
77366 +++ linux-2.6.32.46/net/mac80211/mlme.c 2011-08-09 18:34:01.000000000 -0400
77367 @@ -1438,6 +1438,8 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee
77368 bool have_higher_than_11mbit = false, newsta = false;
77369 u16 ap_ht_cap_flags;
77370
77371 + pax_track_stack();
77372 +
77373 /*
77374 * AssocResp and ReassocResp have identical structure, so process both
77375 * of them in this function.
77376 diff -urNp linux-2.6.32.46/net/mac80211/pm.c linux-2.6.32.46/net/mac80211/pm.c
77377 --- linux-2.6.32.46/net/mac80211/pm.c 2011-03-27 14:31:47.000000000 -0400
77378 +++ linux-2.6.32.46/net/mac80211/pm.c 2011-04-17 15:56:46.000000000 -0400
77379 @@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211
77380 }
77381
77382 /* stop hardware - this must stop RX */
77383 - if (local->open_count)
77384 + if (local_read(&local->open_count))
77385 ieee80211_stop_device(local);
77386
77387 local->suspended = true;
77388 diff -urNp linux-2.6.32.46/net/mac80211/rate.c linux-2.6.32.46/net/mac80211/rate.c
77389 --- linux-2.6.32.46/net/mac80211/rate.c 2011-03-27 14:31:47.000000000 -0400
77390 +++ linux-2.6.32.46/net/mac80211/rate.c 2011-04-17 15:56:46.000000000 -0400
77391 @@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct
77392 struct rate_control_ref *ref, *old;
77393
77394 ASSERT_RTNL();
77395 - if (local->open_count)
77396 + if (local_read(&local->open_count))
77397 return -EBUSY;
77398
77399 ref = rate_control_alloc(name, local);
77400 diff -urNp linux-2.6.32.46/net/mac80211/tx.c linux-2.6.32.46/net/mac80211/tx.c
77401 --- linux-2.6.32.46/net/mac80211/tx.c 2011-03-27 14:31:47.000000000 -0400
77402 +++ linux-2.6.32.46/net/mac80211/tx.c 2011-04-17 15:56:46.000000000 -0400
77403 @@ -173,7 +173,7 @@ static __le16 ieee80211_duration(struct
77404 return cpu_to_le16(dur);
77405 }
77406
77407 -static int inline is_ieee80211_device(struct ieee80211_local *local,
77408 +static inline int is_ieee80211_device(struct ieee80211_local *local,
77409 struct net_device *dev)
77410 {
77411 return local == wdev_priv(dev->ieee80211_ptr);
77412 diff -urNp linux-2.6.32.46/net/mac80211/util.c linux-2.6.32.46/net/mac80211/util.c
77413 --- linux-2.6.32.46/net/mac80211/util.c 2011-03-27 14:31:47.000000000 -0400
77414 +++ linux-2.6.32.46/net/mac80211/util.c 2011-04-17 15:56:46.000000000 -0400
77415 @@ -1042,7 +1042,7 @@ int ieee80211_reconfig(struct ieee80211_
77416 local->resuming = true;
77417
77418 /* restart hardware */
77419 - if (local->open_count) {
77420 + if (local_read(&local->open_count)) {
77421 /*
77422 * Upon resume hardware can sometimes be goofy due to
77423 * various platform / driver / bus issues, so restarting
77424 diff -urNp linux-2.6.32.46/net/netfilter/ipvs/ip_vs_app.c linux-2.6.32.46/net/netfilter/ipvs/ip_vs_app.c
77425 --- linux-2.6.32.46/net/netfilter/ipvs/ip_vs_app.c 2011-03-27 14:31:47.000000000 -0400
77426 +++ linux-2.6.32.46/net/netfilter/ipvs/ip_vs_app.c 2011-05-17 19:26:34.000000000 -0400
77427 @@ -564,7 +564,7 @@ static const struct file_operations ip_v
77428 .open = ip_vs_app_open,
77429 .read = seq_read,
77430 .llseek = seq_lseek,
77431 - .release = seq_release,
77432 + .release = seq_release_net,
77433 };
77434 #endif
77435
77436 diff -urNp linux-2.6.32.46/net/netfilter/ipvs/ip_vs_conn.c linux-2.6.32.46/net/netfilter/ipvs/ip_vs_conn.c
77437 --- linux-2.6.32.46/net/netfilter/ipvs/ip_vs_conn.c 2011-03-27 14:31:47.000000000 -0400
77438 +++ linux-2.6.32.46/net/netfilter/ipvs/ip_vs_conn.c 2011-05-17 19:26:34.000000000 -0400
77439 @@ -453,10 +453,10 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
77440 /* if the connection is not template and is created
77441 * by sync, preserve the activity flag.
77442 */
77443 - cp->flags |= atomic_read(&dest->conn_flags) &
77444 + cp->flags |= atomic_read_unchecked(&dest->conn_flags) &
77445 (~IP_VS_CONN_F_INACTIVE);
77446 else
77447 - cp->flags |= atomic_read(&dest->conn_flags);
77448 + cp->flags |= atomic_read_unchecked(&dest->conn_flags);
77449 cp->dest = dest;
77450
77451 IP_VS_DBG_BUF(7, "Bind-dest %s c:%s:%d v:%s:%d "
77452 @@ -723,7 +723,7 @@ ip_vs_conn_new(int af, int proto, const
77453 atomic_set(&cp->refcnt, 1);
77454
77455 atomic_set(&cp->n_control, 0);
77456 - atomic_set(&cp->in_pkts, 0);
77457 + atomic_set_unchecked(&cp->in_pkts, 0);
77458
77459 atomic_inc(&ip_vs_conn_count);
77460 if (flags & IP_VS_CONN_F_NO_CPORT)
77461 @@ -871,7 +871,7 @@ static const struct file_operations ip_v
77462 .open = ip_vs_conn_open,
77463 .read = seq_read,
77464 .llseek = seq_lseek,
77465 - .release = seq_release,
77466 + .release = seq_release_net,
77467 };
77468
77469 static const char *ip_vs_origin_name(unsigned flags)
77470 @@ -934,7 +934,7 @@ static const struct file_operations ip_v
77471 .open = ip_vs_conn_sync_open,
77472 .read = seq_read,
77473 .llseek = seq_lseek,
77474 - .release = seq_release,
77475 + .release = seq_release_net,
77476 };
77477
77478 #endif
77479 @@ -961,7 +961,7 @@ static inline int todrop_entry(struct ip
77480
77481 /* Don't drop the entry if its number of incoming packets is not
77482 located in [0, 8] */
77483 - i = atomic_read(&cp->in_pkts);
77484 + i = atomic_read_unchecked(&cp->in_pkts);
77485 if (i > 8 || i < 0) return 0;
77486
77487 if (!todrop_rate[i]) return 0;
77488 diff -urNp linux-2.6.32.46/net/netfilter/ipvs/ip_vs_core.c linux-2.6.32.46/net/netfilter/ipvs/ip_vs_core.c
77489 --- linux-2.6.32.46/net/netfilter/ipvs/ip_vs_core.c 2011-03-27 14:31:47.000000000 -0400
77490 +++ linux-2.6.32.46/net/netfilter/ipvs/ip_vs_core.c 2011-05-04 17:56:28.000000000 -0400
77491 @@ -485,7 +485,7 @@ int ip_vs_leave(struct ip_vs_service *sv
77492 ret = cp->packet_xmit(skb, cp, pp);
77493 /* do not touch skb anymore */
77494
77495 - atomic_inc(&cp->in_pkts);
77496 + atomic_inc_unchecked(&cp->in_pkts);
77497 ip_vs_conn_put(cp);
77498 return ret;
77499 }
77500 @@ -1357,7 +1357,7 @@ ip_vs_in(unsigned int hooknum, struct sk
77501 * Sync connection if it is about to close to
77502 * encorage the standby servers to update the connections timeout
77503 */
77504 - pkts = atomic_add_return(1, &cp->in_pkts);
77505 + pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77506 if (af == AF_INET &&
77507 (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
77508 (((cp->protocol != IPPROTO_TCP ||
77509 diff -urNp linux-2.6.32.46/net/netfilter/ipvs/ip_vs_ctl.c linux-2.6.32.46/net/netfilter/ipvs/ip_vs_ctl.c
77510 --- linux-2.6.32.46/net/netfilter/ipvs/ip_vs_ctl.c 2011-03-27 14:31:47.000000000 -0400
77511 +++ linux-2.6.32.46/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-17 19:26:34.000000000 -0400
77512 @@ -792,7 +792,7 @@ __ip_vs_update_dest(struct ip_vs_service
77513 ip_vs_rs_hash(dest);
77514 write_unlock_bh(&__ip_vs_rs_lock);
77515 }
77516 - atomic_set(&dest->conn_flags, conn_flags);
77517 + atomic_set_unchecked(&dest->conn_flags, conn_flags);
77518
77519 /* bind the service */
77520 if (!dest->svc) {
77521 @@ -1888,7 +1888,7 @@ static int ip_vs_info_seq_show(struct se
77522 " %-7s %-6d %-10d %-10d\n",
77523 &dest->addr.in6,
77524 ntohs(dest->port),
77525 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77526 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77527 atomic_read(&dest->weight),
77528 atomic_read(&dest->activeconns),
77529 atomic_read(&dest->inactconns));
77530 @@ -1899,7 +1899,7 @@ static int ip_vs_info_seq_show(struct se
77531 "%-7s %-6d %-10d %-10d\n",
77532 ntohl(dest->addr.ip),
77533 ntohs(dest->port),
77534 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77535 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77536 atomic_read(&dest->weight),
77537 atomic_read(&dest->activeconns),
77538 atomic_read(&dest->inactconns));
77539 @@ -1927,7 +1927,7 @@ static const struct file_operations ip_v
77540 .open = ip_vs_info_open,
77541 .read = seq_read,
77542 .llseek = seq_lseek,
77543 - .release = seq_release_private,
77544 + .release = seq_release_net,
77545 };
77546
77547 #endif
77548 @@ -1976,7 +1976,7 @@ static const struct file_operations ip_v
77549 .open = ip_vs_stats_seq_open,
77550 .read = seq_read,
77551 .llseek = seq_lseek,
77552 - .release = single_release,
77553 + .release = single_release_net,
77554 };
77555
77556 #endif
77557 @@ -2292,7 +2292,7 @@ __ip_vs_get_dest_entries(const struct ip
77558
77559 entry.addr = dest->addr.ip;
77560 entry.port = dest->port;
77561 - entry.conn_flags = atomic_read(&dest->conn_flags);
77562 + entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
77563 entry.weight = atomic_read(&dest->weight);
77564 entry.u_threshold = dest->u_threshold;
77565 entry.l_threshold = dest->l_threshold;
77566 @@ -2353,6 +2353,8 @@ do_ip_vs_get_ctl(struct sock *sk, int cm
77567 unsigned char arg[128];
77568 int ret = 0;
77569
77570 + pax_track_stack();
77571 +
77572 if (!capable(CAP_NET_ADMIN))
77573 return -EPERM;
77574
77575 @@ -2802,7 +2804,7 @@ static int ip_vs_genl_fill_dest(struct s
77576 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
77577
77578 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
77579 - atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
77580 + atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
77581 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
77582 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
77583 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
77584 diff -urNp linux-2.6.32.46/net/netfilter/ipvs/ip_vs_sync.c linux-2.6.32.46/net/netfilter/ipvs/ip_vs_sync.c
77585 --- linux-2.6.32.46/net/netfilter/ipvs/ip_vs_sync.c 2011-03-27 14:31:47.000000000 -0400
77586 +++ linux-2.6.32.46/net/netfilter/ipvs/ip_vs_sync.c 2011-05-04 17:56:28.000000000 -0400
77587 @@ -438,7 +438,7 @@ static void ip_vs_process_message(const
77588
77589 if (opt)
77590 memcpy(&cp->in_seq, opt, sizeof(*opt));
77591 - atomic_set(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
77592 + atomic_set_unchecked(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
77593 cp->state = state;
77594 cp->old_state = cp->state;
77595 /*
77596 diff -urNp linux-2.6.32.46/net/netfilter/ipvs/ip_vs_xmit.c linux-2.6.32.46/net/netfilter/ipvs/ip_vs_xmit.c
77597 --- linux-2.6.32.46/net/netfilter/ipvs/ip_vs_xmit.c 2011-03-27 14:31:47.000000000 -0400
77598 +++ linux-2.6.32.46/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-04 17:56:28.000000000 -0400
77599 @@ -875,7 +875,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, str
77600 else
77601 rc = NF_ACCEPT;
77602 /* do not touch skb anymore */
77603 - atomic_inc(&cp->in_pkts);
77604 + atomic_inc_unchecked(&cp->in_pkts);
77605 goto out;
77606 }
77607
77608 @@ -949,7 +949,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb,
77609 else
77610 rc = NF_ACCEPT;
77611 /* do not touch skb anymore */
77612 - atomic_inc(&cp->in_pkts);
77613 + atomic_inc_unchecked(&cp->in_pkts);
77614 goto out;
77615 }
77616
77617 diff -urNp linux-2.6.32.46/net/netfilter/Kconfig linux-2.6.32.46/net/netfilter/Kconfig
77618 --- linux-2.6.32.46/net/netfilter/Kconfig 2011-03-27 14:31:47.000000000 -0400
77619 +++ linux-2.6.32.46/net/netfilter/Kconfig 2011-04-17 15:56:46.000000000 -0400
77620 @@ -635,6 +635,16 @@ config NETFILTER_XT_MATCH_ESP
77621
77622 To compile it as a module, choose M here. If unsure, say N.
77623
77624 +config NETFILTER_XT_MATCH_GRADM
77625 + tristate '"gradm" match support'
77626 + depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
77627 + depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
77628 + ---help---
77629 + The gradm match allows to match on grsecurity RBAC being enabled.
77630 + It is useful when iptables rules are applied early on bootup to
77631 + prevent connections to the machine (except from a trusted host)
77632 + while the RBAC system is disabled.
77633 +
77634 config NETFILTER_XT_MATCH_HASHLIMIT
77635 tristate '"hashlimit" match support'
77636 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
77637 diff -urNp linux-2.6.32.46/net/netfilter/Makefile linux-2.6.32.46/net/netfilter/Makefile
77638 --- linux-2.6.32.46/net/netfilter/Makefile 2011-03-27 14:31:47.000000000 -0400
77639 +++ linux-2.6.32.46/net/netfilter/Makefile 2011-04-17 15:56:46.000000000 -0400
77640 @@ -68,6 +68,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_CONNTRAC
77641 obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
77642 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
77643 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
77644 +obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
77645 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
77646 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
77647 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
77648 diff -urNp linux-2.6.32.46/net/netfilter/nf_conntrack_netlink.c linux-2.6.32.46/net/netfilter/nf_conntrack_netlink.c
77649 --- linux-2.6.32.46/net/netfilter/nf_conntrack_netlink.c 2011-03-27 14:31:47.000000000 -0400
77650 +++ linux-2.6.32.46/net/netfilter/nf_conntrack_netlink.c 2011-04-17 15:56:46.000000000 -0400
77651 @@ -706,7 +706,7 @@ ctnetlink_parse_tuple_proto(struct nlatt
77652 static int
77653 ctnetlink_parse_tuple(const struct nlattr * const cda[],
77654 struct nf_conntrack_tuple *tuple,
77655 - enum ctattr_tuple type, u_int8_t l3num)
77656 + enum ctattr_type type, u_int8_t l3num)
77657 {
77658 struct nlattr *tb[CTA_TUPLE_MAX+1];
77659 int err;
77660 diff -urNp linux-2.6.32.46/net/netfilter/nfnetlink_log.c linux-2.6.32.46/net/netfilter/nfnetlink_log.c
77661 --- linux-2.6.32.46/net/netfilter/nfnetlink_log.c 2011-03-27 14:31:47.000000000 -0400
77662 +++ linux-2.6.32.46/net/netfilter/nfnetlink_log.c 2011-05-04 17:56:28.000000000 -0400
77663 @@ -68,7 +68,7 @@ struct nfulnl_instance {
77664 };
77665
77666 static DEFINE_RWLOCK(instances_lock);
77667 -static atomic_t global_seq;
77668 +static atomic_unchecked_t global_seq;
77669
77670 #define INSTANCE_BUCKETS 16
77671 static struct hlist_head instance_table[INSTANCE_BUCKETS];
77672 @@ -493,7 +493,7 @@ __build_packet_message(struct nfulnl_ins
77673 /* global sequence number */
77674 if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
77675 NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
77676 - htonl(atomic_inc_return(&global_seq)));
77677 + htonl(atomic_inc_return_unchecked(&global_seq)));
77678
77679 if (data_len) {
77680 struct nlattr *nla;
77681 diff -urNp linux-2.6.32.46/net/netfilter/xt_gradm.c linux-2.6.32.46/net/netfilter/xt_gradm.c
77682 --- linux-2.6.32.46/net/netfilter/xt_gradm.c 1969-12-31 19:00:00.000000000 -0500
77683 +++ linux-2.6.32.46/net/netfilter/xt_gradm.c 2011-04-17 15:56:46.000000000 -0400
77684 @@ -0,0 +1,51 @@
77685 +/*
77686 + * gradm match for netfilter
77687 + * Copyright © Zbigniew Krzystolik, 2010
77688 + *
77689 + * This program is free software; you can redistribute it and/or modify
77690 + * it under the terms of the GNU General Public License; either version
77691 + * 2 or 3 as published by the Free Software Foundation.
77692 + */
77693 +#include <linux/module.h>
77694 +#include <linux/moduleparam.h>
77695 +#include <linux/skbuff.h>
77696 +#include <linux/netfilter/x_tables.h>
77697 +#include <linux/grsecurity.h>
77698 +#include <linux/netfilter/xt_gradm.h>
77699 +
77700 +static bool
77701 +gradm_mt(const struct sk_buff *skb, const struct xt_match_param *par)
77702 +{
77703 + const struct xt_gradm_mtinfo *info = par->matchinfo;
77704 + bool retval = false;
77705 + if (gr_acl_is_enabled())
77706 + retval = true;
77707 + return retval ^ info->invflags;
77708 +}
77709 +
77710 +static struct xt_match gradm_mt_reg __read_mostly = {
77711 + .name = "gradm",
77712 + .revision = 0,
77713 + .family = NFPROTO_UNSPEC,
77714 + .match = gradm_mt,
77715 + .matchsize = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
77716 + .me = THIS_MODULE,
77717 +};
77718 +
77719 +static int __init gradm_mt_init(void)
77720 +{
77721 + return xt_register_match(&gradm_mt_reg);
77722 +}
77723 +
77724 +static void __exit gradm_mt_exit(void)
77725 +{
77726 + xt_unregister_match(&gradm_mt_reg);
77727 +}
77728 +
77729 +module_init(gradm_mt_init);
77730 +module_exit(gradm_mt_exit);
77731 +MODULE_AUTHOR("Zbigniew Krzystolik <zbyniu@destrukcja.pl>");
77732 +MODULE_DESCRIPTION("Xtables: Grsecurity RBAC match");
77733 +MODULE_LICENSE("GPL");
77734 +MODULE_ALIAS("ipt_gradm");
77735 +MODULE_ALIAS("ip6t_gradm");
77736 diff -urNp linux-2.6.32.46/net/netlink/af_netlink.c linux-2.6.32.46/net/netlink/af_netlink.c
77737 --- linux-2.6.32.46/net/netlink/af_netlink.c 2011-03-27 14:31:47.000000000 -0400
77738 +++ linux-2.6.32.46/net/netlink/af_netlink.c 2011-05-04 17:56:28.000000000 -0400
77739 @@ -733,7 +733,7 @@ static void netlink_overrun(struct sock
77740 sk->sk_error_report(sk);
77741 }
77742 }
77743 - atomic_inc(&sk->sk_drops);
77744 + atomic_inc_unchecked(&sk->sk_drops);
77745 }
77746
77747 static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
77748 @@ -1964,15 +1964,23 @@ static int netlink_seq_show(struct seq_f
77749 struct netlink_sock *nlk = nlk_sk(s);
77750
77751 seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d\n",
77752 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77753 + NULL,
77754 +#else
77755 s,
77756 +#endif
77757 s->sk_protocol,
77758 nlk->pid,
77759 nlk->groups ? (u32)nlk->groups[0] : 0,
77760 sk_rmem_alloc_get(s),
77761 sk_wmem_alloc_get(s),
77762 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77763 + NULL,
77764 +#else
77765 nlk->cb,
77766 +#endif
77767 atomic_read(&s->sk_refcnt),
77768 - atomic_read(&s->sk_drops)
77769 + atomic_read_unchecked(&s->sk_drops)
77770 );
77771
77772 }
77773 diff -urNp linux-2.6.32.46/net/netrom/af_netrom.c linux-2.6.32.46/net/netrom/af_netrom.c
77774 --- linux-2.6.32.46/net/netrom/af_netrom.c 2011-03-27 14:31:47.000000000 -0400
77775 +++ linux-2.6.32.46/net/netrom/af_netrom.c 2011-04-17 15:56:46.000000000 -0400
77776 @@ -838,6 +838,7 @@ static int nr_getname(struct socket *soc
77777 struct sock *sk = sock->sk;
77778 struct nr_sock *nr = nr_sk(sk);
77779
77780 + memset(sax, 0, sizeof(*sax));
77781 lock_sock(sk);
77782 if (peer != 0) {
77783 if (sk->sk_state != TCP_ESTABLISHED) {
77784 @@ -852,7 +853,6 @@ static int nr_getname(struct socket *soc
77785 *uaddr_len = sizeof(struct full_sockaddr_ax25);
77786 } else {
77787 sax->fsa_ax25.sax25_family = AF_NETROM;
77788 - sax->fsa_ax25.sax25_ndigis = 0;
77789 sax->fsa_ax25.sax25_call = nr->source_addr;
77790 *uaddr_len = sizeof(struct sockaddr_ax25);
77791 }
77792 diff -urNp linux-2.6.32.46/net/packet/af_packet.c linux-2.6.32.46/net/packet/af_packet.c
77793 --- linux-2.6.32.46/net/packet/af_packet.c 2011-07-13 17:23:04.000000000 -0400
77794 +++ linux-2.6.32.46/net/packet/af_packet.c 2011-07-13 17:23:27.000000000 -0400
77795 @@ -2429,7 +2429,11 @@ static int packet_seq_show(struct seq_fi
77796
77797 seq_printf(seq,
77798 "%p %-6d %-4d %04x %-5d %1d %-6u %-6u %-6lu\n",
77799 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77800 + NULL,
77801 +#else
77802 s,
77803 +#endif
77804 atomic_read(&s->sk_refcnt),
77805 s->sk_type,
77806 ntohs(po->num),
77807 diff -urNp linux-2.6.32.46/net/phonet/af_phonet.c linux-2.6.32.46/net/phonet/af_phonet.c
77808 --- linux-2.6.32.46/net/phonet/af_phonet.c 2011-03-27 14:31:47.000000000 -0400
77809 +++ linux-2.6.32.46/net/phonet/af_phonet.c 2011-04-17 15:56:46.000000000 -0400
77810 @@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_pr
77811 {
77812 struct phonet_protocol *pp;
77813
77814 - if (protocol >= PHONET_NPROTO)
77815 + if (protocol < 0 || protocol >= PHONET_NPROTO)
77816 return NULL;
77817
77818 spin_lock(&proto_tab_lock);
77819 @@ -402,7 +402,7 @@ int __init_or_module phonet_proto_regist
77820 {
77821 int err = 0;
77822
77823 - if (protocol >= PHONET_NPROTO)
77824 + if (protocol < 0 || protocol >= PHONET_NPROTO)
77825 return -EINVAL;
77826
77827 err = proto_register(pp->prot, 1);
77828 diff -urNp linux-2.6.32.46/net/phonet/datagram.c linux-2.6.32.46/net/phonet/datagram.c
77829 --- linux-2.6.32.46/net/phonet/datagram.c 2011-03-27 14:31:47.000000000 -0400
77830 +++ linux-2.6.32.46/net/phonet/datagram.c 2011-05-04 17:56:28.000000000 -0400
77831 @@ -162,7 +162,7 @@ static int pn_backlog_rcv(struct sock *s
77832 if (err < 0) {
77833 kfree_skb(skb);
77834 if (err == -ENOMEM)
77835 - atomic_inc(&sk->sk_drops);
77836 + atomic_inc_unchecked(&sk->sk_drops);
77837 }
77838 return err ? NET_RX_DROP : NET_RX_SUCCESS;
77839 }
77840 diff -urNp linux-2.6.32.46/net/phonet/pep.c linux-2.6.32.46/net/phonet/pep.c
77841 --- linux-2.6.32.46/net/phonet/pep.c 2011-03-27 14:31:47.000000000 -0400
77842 +++ linux-2.6.32.46/net/phonet/pep.c 2011-05-04 17:56:28.000000000 -0400
77843 @@ -348,7 +348,7 @@ static int pipe_do_rcv(struct sock *sk,
77844
77845 case PNS_PEP_CTRL_REQ:
77846 if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
77847 - atomic_inc(&sk->sk_drops);
77848 + atomic_inc_unchecked(&sk->sk_drops);
77849 break;
77850 }
77851 __skb_pull(skb, 4);
77852 @@ -362,12 +362,12 @@ static int pipe_do_rcv(struct sock *sk,
77853 if (!err)
77854 return 0;
77855 if (err == -ENOMEM)
77856 - atomic_inc(&sk->sk_drops);
77857 + atomic_inc_unchecked(&sk->sk_drops);
77858 break;
77859 }
77860
77861 if (pn->rx_credits == 0) {
77862 - atomic_inc(&sk->sk_drops);
77863 + atomic_inc_unchecked(&sk->sk_drops);
77864 err = -ENOBUFS;
77865 break;
77866 }
77867 diff -urNp linux-2.6.32.46/net/phonet/socket.c linux-2.6.32.46/net/phonet/socket.c
77868 --- linux-2.6.32.46/net/phonet/socket.c 2011-03-27 14:31:47.000000000 -0400
77869 +++ linux-2.6.32.46/net/phonet/socket.c 2011-05-04 17:57:07.000000000 -0400
77870 @@ -482,8 +482,13 @@ static int pn_sock_seq_show(struct seq_f
77871 sk->sk_state,
77872 sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
77873 sock_i_uid(sk), sock_i_ino(sk),
77874 - atomic_read(&sk->sk_refcnt), sk,
77875 - atomic_read(&sk->sk_drops), &len);
77876 + atomic_read(&sk->sk_refcnt),
77877 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77878 + NULL,
77879 +#else
77880 + sk,
77881 +#endif
77882 + atomic_read_unchecked(&sk->sk_drops), &len);
77883 }
77884 seq_printf(seq, "%*s\n", 127 - len, "");
77885 return 0;
77886 diff -urNp linux-2.6.32.46/net/rds/cong.c linux-2.6.32.46/net/rds/cong.c
77887 --- linux-2.6.32.46/net/rds/cong.c 2011-03-27 14:31:47.000000000 -0400
77888 +++ linux-2.6.32.46/net/rds/cong.c 2011-05-04 17:56:28.000000000 -0400
77889 @@ -77,7 +77,7 @@
77890 * finds that the saved generation number is smaller than the global generation
77891 * number, it wakes up the process.
77892 */
77893 -static atomic_t rds_cong_generation = ATOMIC_INIT(0);
77894 +static atomic_unchecked_t rds_cong_generation = ATOMIC_INIT(0);
77895
77896 /*
77897 * Congestion monitoring
77898 @@ -232,7 +232,7 @@ void rds_cong_map_updated(struct rds_con
77899 rdsdebug("waking map %p for %pI4\n",
77900 map, &map->m_addr);
77901 rds_stats_inc(s_cong_update_received);
77902 - atomic_inc(&rds_cong_generation);
77903 + atomic_inc_unchecked(&rds_cong_generation);
77904 if (waitqueue_active(&map->m_waitq))
77905 wake_up(&map->m_waitq);
77906 if (waitqueue_active(&rds_poll_waitq))
77907 @@ -258,7 +258,7 @@ EXPORT_SYMBOL_GPL(rds_cong_map_updated);
77908
77909 int rds_cong_updated_since(unsigned long *recent)
77910 {
77911 - unsigned long gen = atomic_read(&rds_cong_generation);
77912 + unsigned long gen = atomic_read_unchecked(&rds_cong_generation);
77913
77914 if (likely(*recent == gen))
77915 return 0;
77916 diff -urNp linux-2.6.32.46/net/rds/iw_rdma.c linux-2.6.32.46/net/rds/iw_rdma.c
77917 --- linux-2.6.32.46/net/rds/iw_rdma.c 2011-03-27 14:31:47.000000000 -0400
77918 +++ linux-2.6.32.46/net/rds/iw_rdma.c 2011-05-16 21:46:57.000000000 -0400
77919 @@ -181,6 +181,8 @@ int rds_iw_update_cm_id(struct rds_iw_de
77920 struct rdma_cm_id *pcm_id;
77921 int rc;
77922
77923 + pax_track_stack();
77924 +
77925 src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
77926 dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
77927
77928 diff -urNp linux-2.6.32.46/net/rds/Kconfig linux-2.6.32.46/net/rds/Kconfig
77929 --- linux-2.6.32.46/net/rds/Kconfig 2011-03-27 14:31:47.000000000 -0400
77930 +++ linux-2.6.32.46/net/rds/Kconfig 2011-04-17 15:56:46.000000000 -0400
77931 @@ -1,7 +1,7 @@
77932
77933 config RDS
77934 tristate "The RDS Protocol (EXPERIMENTAL)"
77935 - depends on INET && EXPERIMENTAL
77936 + depends on INET && EXPERIMENTAL && BROKEN
77937 ---help---
77938 The RDS (Reliable Datagram Sockets) protocol provides reliable,
77939 sequenced delivery of datagrams over Infiniband, iWARP,
77940 diff -urNp linux-2.6.32.46/net/rds/tcp.c linux-2.6.32.46/net/rds/tcp.c
77941 --- linux-2.6.32.46/net/rds/tcp.c 2011-03-27 14:31:47.000000000 -0400
77942 +++ linux-2.6.32.46/net/rds/tcp.c 2011-10-06 09:37:16.000000000 -0400
77943 @@ -57,7 +57,7 @@ void rds_tcp_nonagle(struct socket *sock
77944 int val = 1;
77945
77946 set_fs(KERNEL_DS);
77947 - sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __user *)&val,
77948 + sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __force_user *)&val,
77949 sizeof(val));
77950 set_fs(oldfs);
77951 }
77952 diff -urNp linux-2.6.32.46/net/rds/tcp_send.c linux-2.6.32.46/net/rds/tcp_send.c
77953 --- linux-2.6.32.46/net/rds/tcp_send.c 2011-03-27 14:31:47.000000000 -0400
77954 +++ linux-2.6.32.46/net/rds/tcp_send.c 2011-10-06 09:37:16.000000000 -0400
77955 @@ -43,7 +43,7 @@ static void rds_tcp_cork(struct socket *
77956
77957 oldfs = get_fs();
77958 set_fs(KERNEL_DS);
77959 - sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __user *)&val,
77960 + sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __force_user *)&val,
77961 sizeof(val));
77962 set_fs(oldfs);
77963 }
77964 diff -urNp linux-2.6.32.46/net/rxrpc/af_rxrpc.c linux-2.6.32.46/net/rxrpc/af_rxrpc.c
77965 --- linux-2.6.32.46/net/rxrpc/af_rxrpc.c 2011-03-27 14:31:47.000000000 -0400
77966 +++ linux-2.6.32.46/net/rxrpc/af_rxrpc.c 2011-05-04 17:56:28.000000000 -0400
77967 @@ -38,7 +38,7 @@ static const struct proto_ops rxrpc_rpc_
77968 __be32 rxrpc_epoch;
77969
77970 /* current debugging ID */
77971 -atomic_t rxrpc_debug_id;
77972 +atomic_unchecked_t rxrpc_debug_id;
77973
77974 /* count of skbs currently in use */
77975 atomic_t rxrpc_n_skbs;
77976 diff -urNp linux-2.6.32.46/net/rxrpc/ar-ack.c linux-2.6.32.46/net/rxrpc/ar-ack.c
77977 --- linux-2.6.32.46/net/rxrpc/ar-ack.c 2011-03-27 14:31:47.000000000 -0400
77978 +++ linux-2.6.32.46/net/rxrpc/ar-ack.c 2011-05-16 21:46:57.000000000 -0400
77979 @@ -174,7 +174,7 @@ static void rxrpc_resend(struct rxrpc_ca
77980
77981 _enter("{%d,%d,%d,%d},",
77982 call->acks_hard, call->acks_unacked,
77983 - atomic_read(&call->sequence),
77984 + atomic_read_unchecked(&call->sequence),
77985 CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
77986
77987 stop = 0;
77988 @@ -198,7 +198,7 @@ static void rxrpc_resend(struct rxrpc_ca
77989
77990 /* each Tx packet has a new serial number */
77991 sp->hdr.serial =
77992 - htonl(atomic_inc_return(&call->conn->serial));
77993 + htonl(atomic_inc_return_unchecked(&call->conn->serial));
77994
77995 hdr = (struct rxrpc_header *) txb->head;
77996 hdr->serial = sp->hdr.serial;
77997 @@ -401,7 +401,7 @@ static void rxrpc_rotate_tx_window(struc
77998 */
77999 static void rxrpc_clear_tx_window(struct rxrpc_call *call)
78000 {
78001 - rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
78002 + rxrpc_rotate_tx_window(call, atomic_read_unchecked(&call->sequence));
78003 }
78004
78005 /*
78006 @@ -627,7 +627,7 @@ process_further:
78007
78008 latest = ntohl(sp->hdr.serial);
78009 hard = ntohl(ack.firstPacket);
78010 - tx = atomic_read(&call->sequence);
78011 + tx = atomic_read_unchecked(&call->sequence);
78012
78013 _proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
78014 latest,
78015 @@ -840,6 +840,8 @@ void rxrpc_process_call(struct work_stru
78016 u32 abort_code = RX_PROTOCOL_ERROR;
78017 u8 *acks = NULL;
78018
78019 + pax_track_stack();
78020 +
78021 //printk("\n--------------------\n");
78022 _enter("{%d,%s,%lx} [%lu]",
78023 call->debug_id, rxrpc_call_states[call->state], call->events,
78024 @@ -1159,7 +1161,7 @@ void rxrpc_process_call(struct work_stru
78025 goto maybe_reschedule;
78026
78027 send_ACK_with_skew:
78028 - ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
78029 + ack.maxSkew = htons(atomic_read_unchecked(&call->conn->hi_serial) -
78030 ntohl(ack.serial));
78031 send_ACK:
78032 mtu = call->conn->trans->peer->if_mtu;
78033 @@ -1171,7 +1173,7 @@ send_ACK:
78034 ackinfo.rxMTU = htonl(5692);
78035 ackinfo.jumbo_max = htonl(4);
78036
78037 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
78038 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
78039 _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
78040 ntohl(hdr.serial),
78041 ntohs(ack.maxSkew),
78042 @@ -1189,7 +1191,7 @@ send_ACK:
78043 send_message:
78044 _debug("send message");
78045
78046 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
78047 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
78048 _proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
78049 send_message_2:
78050
78051 diff -urNp linux-2.6.32.46/net/rxrpc/ar-call.c linux-2.6.32.46/net/rxrpc/ar-call.c
78052 --- linux-2.6.32.46/net/rxrpc/ar-call.c 2011-03-27 14:31:47.000000000 -0400
78053 +++ linux-2.6.32.46/net/rxrpc/ar-call.c 2011-05-04 17:56:28.000000000 -0400
78054 @@ -82,7 +82,7 @@ static struct rxrpc_call *rxrpc_alloc_ca
78055 spin_lock_init(&call->lock);
78056 rwlock_init(&call->state_lock);
78057 atomic_set(&call->usage, 1);
78058 - call->debug_id = atomic_inc_return(&rxrpc_debug_id);
78059 + call->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78060 call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
78061
78062 memset(&call->sock_node, 0xed, sizeof(call->sock_node));
78063 diff -urNp linux-2.6.32.46/net/rxrpc/ar-connection.c linux-2.6.32.46/net/rxrpc/ar-connection.c
78064 --- linux-2.6.32.46/net/rxrpc/ar-connection.c 2011-03-27 14:31:47.000000000 -0400
78065 +++ linux-2.6.32.46/net/rxrpc/ar-connection.c 2011-05-04 17:56:28.000000000 -0400
78066 @@ -205,7 +205,7 @@ static struct rxrpc_connection *rxrpc_al
78067 rwlock_init(&conn->lock);
78068 spin_lock_init(&conn->state_lock);
78069 atomic_set(&conn->usage, 1);
78070 - conn->debug_id = atomic_inc_return(&rxrpc_debug_id);
78071 + conn->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78072 conn->avail_calls = RXRPC_MAXCALLS;
78073 conn->size_align = 4;
78074 conn->header_size = sizeof(struct rxrpc_header);
78075 diff -urNp linux-2.6.32.46/net/rxrpc/ar-connevent.c linux-2.6.32.46/net/rxrpc/ar-connevent.c
78076 --- linux-2.6.32.46/net/rxrpc/ar-connevent.c 2011-03-27 14:31:47.000000000 -0400
78077 +++ linux-2.6.32.46/net/rxrpc/ar-connevent.c 2011-05-04 17:56:28.000000000 -0400
78078 @@ -109,7 +109,7 @@ static int rxrpc_abort_connection(struct
78079
78080 len = iov[0].iov_len + iov[1].iov_len;
78081
78082 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
78083 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
78084 _proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
78085
78086 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
78087 diff -urNp linux-2.6.32.46/net/rxrpc/ar-input.c linux-2.6.32.46/net/rxrpc/ar-input.c
78088 --- linux-2.6.32.46/net/rxrpc/ar-input.c 2011-03-27 14:31:47.000000000 -0400
78089 +++ linux-2.6.32.46/net/rxrpc/ar-input.c 2011-05-04 17:56:28.000000000 -0400
78090 @@ -339,9 +339,9 @@ void rxrpc_fast_process_packet(struct rx
78091 /* track the latest serial number on this connection for ACK packet
78092 * information */
78093 serial = ntohl(sp->hdr.serial);
78094 - hi_serial = atomic_read(&call->conn->hi_serial);
78095 + hi_serial = atomic_read_unchecked(&call->conn->hi_serial);
78096 while (serial > hi_serial)
78097 - hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
78098 + hi_serial = atomic_cmpxchg_unchecked(&call->conn->hi_serial, hi_serial,
78099 serial);
78100
78101 /* request ACK generation for any ACK or DATA packet that requests
78102 diff -urNp linux-2.6.32.46/net/rxrpc/ar-internal.h linux-2.6.32.46/net/rxrpc/ar-internal.h
78103 --- linux-2.6.32.46/net/rxrpc/ar-internal.h 2011-03-27 14:31:47.000000000 -0400
78104 +++ linux-2.6.32.46/net/rxrpc/ar-internal.h 2011-05-04 17:56:28.000000000 -0400
78105 @@ -272,8 +272,8 @@ struct rxrpc_connection {
78106 int error; /* error code for local abort */
78107 int debug_id; /* debug ID for printks */
78108 unsigned call_counter; /* call ID counter */
78109 - atomic_t serial; /* packet serial number counter */
78110 - atomic_t hi_serial; /* highest serial number received */
78111 + atomic_unchecked_t serial; /* packet serial number counter */
78112 + atomic_unchecked_t hi_serial; /* highest serial number received */
78113 u8 avail_calls; /* number of calls available */
78114 u8 size_align; /* data size alignment (for security) */
78115 u8 header_size; /* rxrpc + security header size */
78116 @@ -346,7 +346,7 @@ struct rxrpc_call {
78117 spinlock_t lock;
78118 rwlock_t state_lock; /* lock for state transition */
78119 atomic_t usage;
78120 - atomic_t sequence; /* Tx data packet sequence counter */
78121 + atomic_unchecked_t sequence; /* Tx data packet sequence counter */
78122 u32 abort_code; /* local/remote abort code */
78123 enum { /* current state of call */
78124 RXRPC_CALL_CLIENT_SEND_REQUEST, /* - client sending request phase */
78125 @@ -420,7 +420,7 @@ static inline void rxrpc_abort_call(stru
78126 */
78127 extern atomic_t rxrpc_n_skbs;
78128 extern __be32 rxrpc_epoch;
78129 -extern atomic_t rxrpc_debug_id;
78130 +extern atomic_unchecked_t rxrpc_debug_id;
78131 extern struct workqueue_struct *rxrpc_workqueue;
78132
78133 /*
78134 diff -urNp linux-2.6.32.46/net/rxrpc/ar-key.c linux-2.6.32.46/net/rxrpc/ar-key.c
78135 --- linux-2.6.32.46/net/rxrpc/ar-key.c 2011-03-27 14:31:47.000000000 -0400
78136 +++ linux-2.6.32.46/net/rxrpc/ar-key.c 2011-04-17 15:56:46.000000000 -0400
78137 @@ -88,11 +88,11 @@ static int rxrpc_instantiate_xdr_rxkad(s
78138 return ret;
78139
78140 plen -= sizeof(*token);
78141 - token = kmalloc(sizeof(*token), GFP_KERNEL);
78142 + token = kzalloc(sizeof(*token), GFP_KERNEL);
78143 if (!token)
78144 return -ENOMEM;
78145
78146 - token->kad = kmalloc(plen, GFP_KERNEL);
78147 + token->kad = kzalloc(plen, GFP_KERNEL);
78148 if (!token->kad) {
78149 kfree(token);
78150 return -ENOMEM;
78151 @@ -730,10 +730,10 @@ static int rxrpc_instantiate(struct key
78152 goto error;
78153
78154 ret = -ENOMEM;
78155 - token = kmalloc(sizeof(*token), GFP_KERNEL);
78156 + token = kzalloc(sizeof(*token), GFP_KERNEL);
78157 if (!token)
78158 goto error;
78159 - token->kad = kmalloc(plen, GFP_KERNEL);
78160 + token->kad = kzalloc(plen, GFP_KERNEL);
78161 if (!token->kad)
78162 goto error_free;
78163
78164 diff -urNp linux-2.6.32.46/net/rxrpc/ar-local.c linux-2.6.32.46/net/rxrpc/ar-local.c
78165 --- linux-2.6.32.46/net/rxrpc/ar-local.c 2011-03-27 14:31:47.000000000 -0400
78166 +++ linux-2.6.32.46/net/rxrpc/ar-local.c 2011-05-04 17:56:28.000000000 -0400
78167 @@ -44,7 +44,7 @@ struct rxrpc_local *rxrpc_alloc_local(st
78168 spin_lock_init(&local->lock);
78169 rwlock_init(&local->services_lock);
78170 atomic_set(&local->usage, 1);
78171 - local->debug_id = atomic_inc_return(&rxrpc_debug_id);
78172 + local->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78173 memcpy(&local->srx, srx, sizeof(*srx));
78174 }
78175
78176 diff -urNp linux-2.6.32.46/net/rxrpc/ar-output.c linux-2.6.32.46/net/rxrpc/ar-output.c
78177 --- linux-2.6.32.46/net/rxrpc/ar-output.c 2011-03-27 14:31:47.000000000 -0400
78178 +++ linux-2.6.32.46/net/rxrpc/ar-output.c 2011-05-04 17:56:28.000000000 -0400
78179 @@ -680,9 +680,9 @@ static int rxrpc_send_data(struct kiocb
78180 sp->hdr.cid = call->cid;
78181 sp->hdr.callNumber = call->call_id;
78182 sp->hdr.seq =
78183 - htonl(atomic_inc_return(&call->sequence));
78184 + htonl(atomic_inc_return_unchecked(&call->sequence));
78185 sp->hdr.serial =
78186 - htonl(atomic_inc_return(&conn->serial));
78187 + htonl(atomic_inc_return_unchecked(&conn->serial));
78188 sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
78189 sp->hdr.userStatus = 0;
78190 sp->hdr.securityIndex = conn->security_ix;
78191 diff -urNp linux-2.6.32.46/net/rxrpc/ar-peer.c linux-2.6.32.46/net/rxrpc/ar-peer.c
78192 --- linux-2.6.32.46/net/rxrpc/ar-peer.c 2011-03-27 14:31:47.000000000 -0400
78193 +++ linux-2.6.32.46/net/rxrpc/ar-peer.c 2011-05-04 17:56:28.000000000 -0400
78194 @@ -86,7 +86,7 @@ static struct rxrpc_peer *rxrpc_alloc_pe
78195 INIT_LIST_HEAD(&peer->error_targets);
78196 spin_lock_init(&peer->lock);
78197 atomic_set(&peer->usage, 1);
78198 - peer->debug_id = atomic_inc_return(&rxrpc_debug_id);
78199 + peer->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78200 memcpy(&peer->srx, srx, sizeof(*srx));
78201
78202 rxrpc_assess_MTU_size(peer);
78203 diff -urNp linux-2.6.32.46/net/rxrpc/ar-proc.c linux-2.6.32.46/net/rxrpc/ar-proc.c
78204 --- linux-2.6.32.46/net/rxrpc/ar-proc.c 2011-03-27 14:31:47.000000000 -0400
78205 +++ linux-2.6.32.46/net/rxrpc/ar-proc.c 2011-05-04 17:56:28.000000000 -0400
78206 @@ -164,8 +164,8 @@ static int rxrpc_connection_seq_show(str
78207 atomic_read(&conn->usage),
78208 rxrpc_conn_states[conn->state],
78209 key_serial(conn->key),
78210 - atomic_read(&conn->serial),
78211 - atomic_read(&conn->hi_serial));
78212 + atomic_read_unchecked(&conn->serial),
78213 + atomic_read_unchecked(&conn->hi_serial));
78214
78215 return 0;
78216 }
78217 diff -urNp linux-2.6.32.46/net/rxrpc/ar-transport.c linux-2.6.32.46/net/rxrpc/ar-transport.c
78218 --- linux-2.6.32.46/net/rxrpc/ar-transport.c 2011-03-27 14:31:47.000000000 -0400
78219 +++ linux-2.6.32.46/net/rxrpc/ar-transport.c 2011-05-04 17:56:28.000000000 -0400
78220 @@ -46,7 +46,7 @@ static struct rxrpc_transport *rxrpc_all
78221 spin_lock_init(&trans->client_lock);
78222 rwlock_init(&trans->conn_lock);
78223 atomic_set(&trans->usage, 1);
78224 - trans->debug_id = atomic_inc_return(&rxrpc_debug_id);
78225 + trans->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78226
78227 if (peer->srx.transport.family == AF_INET) {
78228 switch (peer->srx.transport_type) {
78229 diff -urNp linux-2.6.32.46/net/rxrpc/rxkad.c linux-2.6.32.46/net/rxrpc/rxkad.c
78230 --- linux-2.6.32.46/net/rxrpc/rxkad.c 2011-03-27 14:31:47.000000000 -0400
78231 +++ linux-2.6.32.46/net/rxrpc/rxkad.c 2011-05-16 21:46:57.000000000 -0400
78232 @@ -210,6 +210,8 @@ static int rxkad_secure_packet_encrypt(c
78233 u16 check;
78234 int nsg;
78235
78236 + pax_track_stack();
78237 +
78238 sp = rxrpc_skb(skb);
78239
78240 _enter("");
78241 @@ -337,6 +339,8 @@ static int rxkad_verify_packet_auth(cons
78242 u16 check;
78243 int nsg;
78244
78245 + pax_track_stack();
78246 +
78247 _enter("");
78248
78249 sp = rxrpc_skb(skb);
78250 @@ -609,7 +613,7 @@ static int rxkad_issue_challenge(struct
78251
78252 len = iov[0].iov_len + iov[1].iov_len;
78253
78254 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
78255 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
78256 _proto("Tx CHALLENGE %%%u", ntohl(hdr.serial));
78257
78258 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
78259 @@ -659,7 +663,7 @@ static int rxkad_send_response(struct rx
78260
78261 len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
78262
78263 - hdr->serial = htonl(atomic_inc_return(&conn->serial));
78264 + hdr->serial = htonl(atomic_inc_return_unchecked(&conn->serial));
78265 _proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
78266
78267 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
78268 diff -urNp linux-2.6.32.46/net/sctp/proc.c linux-2.6.32.46/net/sctp/proc.c
78269 --- linux-2.6.32.46/net/sctp/proc.c 2011-03-27 14:31:47.000000000 -0400
78270 +++ linux-2.6.32.46/net/sctp/proc.c 2011-04-17 15:56:46.000000000 -0400
78271 @@ -213,7 +213,12 @@ static int sctp_eps_seq_show(struct seq_
78272 sctp_for_each_hentry(epb, node, &head->chain) {
78273 ep = sctp_ep(epb);
78274 sk = epb->sk;
78275 - seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ", ep, sk,
78276 + seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ",
78277 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78278 + NULL, NULL,
78279 +#else
78280 + ep, sk,
78281 +#endif
78282 sctp_sk(sk)->type, sk->sk_state, hash,
78283 epb->bind_addr.port,
78284 sock_i_uid(sk), sock_i_ino(sk));
78285 @@ -320,7 +325,12 @@ static int sctp_assocs_seq_show(struct s
78286 seq_printf(seq,
78287 "%8p %8p %-3d %-3d %-2d %-4d "
78288 "%4d %8d %8d %7d %5lu %-5d %5d ",
78289 - assoc, sk, sctp_sk(sk)->type, sk->sk_state,
78290 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78291 + NULL, NULL,
78292 +#else
78293 + assoc, sk,
78294 +#endif
78295 + sctp_sk(sk)->type, sk->sk_state,
78296 assoc->state, hash,
78297 assoc->assoc_id,
78298 assoc->sndbuf_used,
78299 diff -urNp linux-2.6.32.46/net/sctp/socket.c linux-2.6.32.46/net/sctp/socket.c
78300 --- linux-2.6.32.46/net/sctp/socket.c 2011-03-27 14:31:47.000000000 -0400
78301 +++ linux-2.6.32.46/net/sctp/socket.c 2011-04-23 12:56:11.000000000 -0400
78302 @@ -5802,7 +5802,6 @@ pp_found:
78303 */
78304 int reuse = sk->sk_reuse;
78305 struct sock *sk2;
78306 - struct hlist_node *node;
78307
78308 SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
78309 if (pp->fastreuse && sk->sk_reuse &&
78310 diff -urNp linux-2.6.32.46/net/socket.c linux-2.6.32.46/net/socket.c
78311 --- linux-2.6.32.46/net/socket.c 2011-03-27 14:31:47.000000000 -0400
78312 +++ linux-2.6.32.46/net/socket.c 2011-10-06 09:37:16.000000000 -0400
78313 @@ -87,6 +87,7 @@
78314 #include <linux/wireless.h>
78315 #include <linux/nsproxy.h>
78316 #include <linux/magic.h>
78317 +#include <linux/in.h>
78318
78319 #include <asm/uaccess.h>
78320 #include <asm/unistd.h>
78321 @@ -97,6 +98,21 @@
78322 #include <net/sock.h>
78323 #include <linux/netfilter.h>
78324
78325 +extern void gr_attach_curr_ip(const struct sock *sk);
78326 +extern int gr_handle_sock_all(const int family, const int type,
78327 + const int protocol);
78328 +extern int gr_handle_sock_server(const struct sockaddr *sck);
78329 +extern int gr_handle_sock_server_other(const struct sock *sck);
78330 +extern int gr_handle_sock_client(const struct sockaddr *sck);
78331 +extern int gr_search_connect(struct socket * sock,
78332 + struct sockaddr_in * addr);
78333 +extern int gr_search_bind(struct socket * sock,
78334 + struct sockaddr_in * addr);
78335 +extern int gr_search_listen(struct socket * sock);
78336 +extern int gr_search_accept(struct socket * sock);
78337 +extern int gr_search_socket(const int domain, const int type,
78338 + const int protocol);
78339 +
78340 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
78341 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
78342 unsigned long nr_segs, loff_t pos);
78343 @@ -298,7 +314,7 @@ static int sockfs_get_sb(struct file_sys
78344 mnt);
78345 }
78346
78347 -static struct vfsmount *sock_mnt __read_mostly;
78348 +struct vfsmount *sock_mnt __read_mostly;
78349
78350 static struct file_system_type sock_fs_type = {
78351 .name = "sockfs",
78352 @@ -1154,6 +1170,8 @@ static int __sock_create(struct net *net
78353 return -EAFNOSUPPORT;
78354 if (type < 0 || type >= SOCK_MAX)
78355 return -EINVAL;
78356 + if (protocol < 0)
78357 + return -EINVAL;
78358
78359 /* Compatibility.
78360
78361 @@ -1283,6 +1301,16 @@ SYSCALL_DEFINE3(socket, int, family, int
78362 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
78363 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
78364
78365 + if(!gr_search_socket(family, type, protocol)) {
78366 + retval = -EACCES;
78367 + goto out;
78368 + }
78369 +
78370 + if (gr_handle_sock_all(family, type, protocol)) {
78371 + retval = -EACCES;
78372 + goto out;
78373 + }
78374 +
78375 retval = sock_create(family, type, protocol, &sock);
78376 if (retval < 0)
78377 goto out;
78378 @@ -1415,6 +1443,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
78379 if (sock) {
78380 err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
78381 if (err >= 0) {
78382 + if (gr_handle_sock_server((struct sockaddr *)&address)) {
78383 + err = -EACCES;
78384 + goto error;
78385 + }
78386 + err = gr_search_bind(sock, (struct sockaddr_in *)&address);
78387 + if (err)
78388 + goto error;
78389 +
78390 err = security_socket_bind(sock,
78391 (struct sockaddr *)&address,
78392 addrlen);
78393 @@ -1423,6 +1459,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
78394 (struct sockaddr *)
78395 &address, addrlen);
78396 }
78397 +error:
78398 fput_light(sock->file, fput_needed);
78399 }
78400 return err;
78401 @@ -1446,10 +1483,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
78402 if ((unsigned)backlog > somaxconn)
78403 backlog = somaxconn;
78404
78405 + if (gr_handle_sock_server_other(sock->sk)) {
78406 + err = -EPERM;
78407 + goto error;
78408 + }
78409 +
78410 + err = gr_search_listen(sock);
78411 + if (err)
78412 + goto error;
78413 +
78414 err = security_socket_listen(sock, backlog);
78415 if (!err)
78416 err = sock->ops->listen(sock, backlog);
78417
78418 +error:
78419 fput_light(sock->file, fput_needed);
78420 }
78421 return err;
78422 @@ -1492,6 +1539,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
78423 newsock->type = sock->type;
78424 newsock->ops = sock->ops;
78425
78426 + if (gr_handle_sock_server_other(sock->sk)) {
78427 + err = -EPERM;
78428 + sock_release(newsock);
78429 + goto out_put;
78430 + }
78431 +
78432 + err = gr_search_accept(sock);
78433 + if (err) {
78434 + sock_release(newsock);
78435 + goto out_put;
78436 + }
78437 +
78438 /*
78439 * We don't need try_module_get here, as the listening socket (sock)
78440 * has the protocol module (sock->ops->owner) held.
78441 @@ -1534,6 +1593,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
78442 fd_install(newfd, newfile);
78443 err = newfd;
78444
78445 + gr_attach_curr_ip(newsock->sk);
78446 +
78447 out_put:
78448 fput_light(sock->file, fput_needed);
78449 out:
78450 @@ -1571,6 +1632,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct
78451 int, addrlen)
78452 {
78453 struct socket *sock;
78454 + struct sockaddr *sck;
78455 struct sockaddr_storage address;
78456 int err, fput_needed;
78457
78458 @@ -1581,6 +1643,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct
78459 if (err < 0)
78460 goto out_put;
78461
78462 + sck = (struct sockaddr *)&address;
78463 +
78464 + if (gr_handle_sock_client(sck)) {
78465 + err = -EACCES;
78466 + goto out_put;
78467 + }
78468 +
78469 + err = gr_search_connect(sock, (struct sockaddr_in *)sck);
78470 + if (err)
78471 + goto out_put;
78472 +
78473 err =
78474 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
78475 if (err)
78476 @@ -1882,6 +1955,8 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct
78477 int err, ctl_len, iov_size, total_len;
78478 int fput_needed;
78479
78480 + pax_track_stack();
78481 +
78482 err = -EFAULT;
78483 if (MSG_CMSG_COMPAT & flags) {
78484 if (get_compat_msghdr(&msg_sys, msg_compat))
78485 @@ -2022,7 +2097,7 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct
78486 * kernel msghdr to use the kernel address space)
78487 */
78488
78489 - uaddr = (__force void __user *)msg_sys.msg_name;
78490 + uaddr = (void __force_user *)msg_sys.msg_name;
78491 uaddr_len = COMPAT_NAMELEN(msg);
78492 if (MSG_CMSG_COMPAT & flags) {
78493 err = verify_compat_iovec(&msg_sys, iov,
78494 diff -urNp linux-2.6.32.46/net/sunrpc/sched.c linux-2.6.32.46/net/sunrpc/sched.c
78495 --- linux-2.6.32.46/net/sunrpc/sched.c 2011-08-09 18:35:30.000000000 -0400
78496 +++ linux-2.6.32.46/net/sunrpc/sched.c 2011-08-09 18:34:01.000000000 -0400
78497 @@ -234,10 +234,10 @@ static int rpc_wait_bit_killable(void *w
78498 #ifdef RPC_DEBUG
78499 static void rpc_task_set_debuginfo(struct rpc_task *task)
78500 {
78501 - static atomic_t rpc_pid;
78502 + static atomic_unchecked_t rpc_pid;
78503
78504 task->tk_magic = RPC_TASK_MAGIC_ID;
78505 - task->tk_pid = atomic_inc_return(&rpc_pid);
78506 + task->tk_pid = atomic_inc_return_unchecked(&rpc_pid);
78507 }
78508 #else
78509 static inline void rpc_task_set_debuginfo(struct rpc_task *task)
78510 diff -urNp linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma.c
78511 --- linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma.c 2011-03-27 14:31:47.000000000 -0400
78512 +++ linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma.c 2011-05-04 17:56:20.000000000 -0400
78513 @@ -59,15 +59,15 @@ unsigned int svcrdma_max_req_size = RPCR
78514 static unsigned int min_max_inline = 4096;
78515 static unsigned int max_max_inline = 65536;
78516
78517 -atomic_t rdma_stat_recv;
78518 -atomic_t rdma_stat_read;
78519 -atomic_t rdma_stat_write;
78520 -atomic_t rdma_stat_sq_starve;
78521 -atomic_t rdma_stat_rq_starve;
78522 -atomic_t rdma_stat_rq_poll;
78523 -atomic_t rdma_stat_rq_prod;
78524 -atomic_t rdma_stat_sq_poll;
78525 -atomic_t rdma_stat_sq_prod;
78526 +atomic_unchecked_t rdma_stat_recv;
78527 +atomic_unchecked_t rdma_stat_read;
78528 +atomic_unchecked_t rdma_stat_write;
78529 +atomic_unchecked_t rdma_stat_sq_starve;
78530 +atomic_unchecked_t rdma_stat_rq_starve;
78531 +atomic_unchecked_t rdma_stat_rq_poll;
78532 +atomic_unchecked_t rdma_stat_rq_prod;
78533 +atomic_unchecked_t rdma_stat_sq_poll;
78534 +atomic_unchecked_t rdma_stat_sq_prod;
78535
78536 /* Temporary NFS request map and context caches */
78537 struct kmem_cache *svc_rdma_map_cachep;
78538 @@ -105,7 +105,7 @@ static int read_reset_stat(ctl_table *ta
78539 len -= *ppos;
78540 if (len > *lenp)
78541 len = *lenp;
78542 - if (len && copy_to_user(buffer, str_buf, len))
78543 + if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
78544 return -EFAULT;
78545 *lenp = len;
78546 *ppos += len;
78547 @@ -149,63 +149,63 @@ static ctl_table svcrdma_parm_table[] =
78548 {
78549 .procname = "rdma_stat_read",
78550 .data = &rdma_stat_read,
78551 - .maxlen = sizeof(atomic_t),
78552 + .maxlen = sizeof(atomic_unchecked_t),
78553 .mode = 0644,
78554 .proc_handler = &read_reset_stat,
78555 },
78556 {
78557 .procname = "rdma_stat_recv",
78558 .data = &rdma_stat_recv,
78559 - .maxlen = sizeof(atomic_t),
78560 + .maxlen = sizeof(atomic_unchecked_t),
78561 .mode = 0644,
78562 .proc_handler = &read_reset_stat,
78563 },
78564 {
78565 .procname = "rdma_stat_write",
78566 .data = &rdma_stat_write,
78567 - .maxlen = sizeof(atomic_t),
78568 + .maxlen = sizeof(atomic_unchecked_t),
78569 .mode = 0644,
78570 .proc_handler = &read_reset_stat,
78571 },
78572 {
78573 .procname = "rdma_stat_sq_starve",
78574 .data = &rdma_stat_sq_starve,
78575 - .maxlen = sizeof(atomic_t),
78576 + .maxlen = sizeof(atomic_unchecked_t),
78577 .mode = 0644,
78578 .proc_handler = &read_reset_stat,
78579 },
78580 {
78581 .procname = "rdma_stat_rq_starve",
78582 .data = &rdma_stat_rq_starve,
78583 - .maxlen = sizeof(atomic_t),
78584 + .maxlen = sizeof(atomic_unchecked_t),
78585 .mode = 0644,
78586 .proc_handler = &read_reset_stat,
78587 },
78588 {
78589 .procname = "rdma_stat_rq_poll",
78590 .data = &rdma_stat_rq_poll,
78591 - .maxlen = sizeof(atomic_t),
78592 + .maxlen = sizeof(atomic_unchecked_t),
78593 .mode = 0644,
78594 .proc_handler = &read_reset_stat,
78595 },
78596 {
78597 .procname = "rdma_stat_rq_prod",
78598 .data = &rdma_stat_rq_prod,
78599 - .maxlen = sizeof(atomic_t),
78600 + .maxlen = sizeof(atomic_unchecked_t),
78601 .mode = 0644,
78602 .proc_handler = &read_reset_stat,
78603 },
78604 {
78605 .procname = "rdma_stat_sq_poll",
78606 .data = &rdma_stat_sq_poll,
78607 - .maxlen = sizeof(atomic_t),
78608 + .maxlen = sizeof(atomic_unchecked_t),
78609 .mode = 0644,
78610 .proc_handler = &read_reset_stat,
78611 },
78612 {
78613 .procname = "rdma_stat_sq_prod",
78614 .data = &rdma_stat_sq_prod,
78615 - .maxlen = sizeof(atomic_t),
78616 + .maxlen = sizeof(atomic_unchecked_t),
78617 .mode = 0644,
78618 .proc_handler = &read_reset_stat,
78619 },
78620 diff -urNp linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
78621 --- linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-03-27 14:31:47.000000000 -0400
78622 +++ linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-05-04 17:56:28.000000000 -0400
78623 @@ -495,7 +495,7 @@ next_sge:
78624 svc_rdma_put_context(ctxt, 0);
78625 goto out;
78626 }
78627 - atomic_inc(&rdma_stat_read);
78628 + atomic_inc_unchecked(&rdma_stat_read);
78629
78630 if (read_wr.num_sge < chl_map->ch[ch_no].count) {
78631 chl_map->ch[ch_no].count -= read_wr.num_sge;
78632 @@ -606,7 +606,7 @@ int svc_rdma_recvfrom(struct svc_rqst *r
78633 dto_q);
78634 list_del_init(&ctxt->dto_q);
78635 } else {
78636 - atomic_inc(&rdma_stat_rq_starve);
78637 + atomic_inc_unchecked(&rdma_stat_rq_starve);
78638 clear_bit(XPT_DATA, &xprt->xpt_flags);
78639 ctxt = NULL;
78640 }
78641 @@ -626,7 +626,7 @@ int svc_rdma_recvfrom(struct svc_rqst *r
78642 dprintk("svcrdma: processing ctxt=%p on xprt=%p, rqstp=%p, status=%d\n",
78643 ctxt, rdma_xprt, rqstp, ctxt->wc_status);
78644 BUG_ON(ctxt->wc_status != IB_WC_SUCCESS);
78645 - atomic_inc(&rdma_stat_recv);
78646 + atomic_inc_unchecked(&rdma_stat_recv);
78647
78648 /* Build up the XDR from the receive buffers. */
78649 rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
78650 diff -urNp linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma_sendto.c linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma_sendto.c
78651 --- linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-03-27 14:31:47.000000000 -0400
78652 +++ linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-05-04 17:56:28.000000000 -0400
78653 @@ -328,7 +328,7 @@ static int send_write(struct svcxprt_rdm
78654 write_wr.wr.rdma.remote_addr = to;
78655
78656 /* Post It */
78657 - atomic_inc(&rdma_stat_write);
78658 + atomic_inc_unchecked(&rdma_stat_write);
78659 if (svc_rdma_send(xprt, &write_wr))
78660 goto err;
78661 return 0;
78662 diff -urNp linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma_transport.c linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma_transport.c
78663 --- linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-03-27 14:31:47.000000000 -0400
78664 +++ linux-2.6.32.46/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-05-04 17:56:28.000000000 -0400
78665 @@ -292,7 +292,7 @@ static void rq_cq_reap(struct svcxprt_rd
78666 return;
78667
78668 ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
78669 - atomic_inc(&rdma_stat_rq_poll);
78670 + atomic_inc_unchecked(&rdma_stat_rq_poll);
78671
78672 while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
78673 ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
78674 @@ -314,7 +314,7 @@ static void rq_cq_reap(struct svcxprt_rd
78675 }
78676
78677 if (ctxt)
78678 - atomic_inc(&rdma_stat_rq_prod);
78679 + atomic_inc_unchecked(&rdma_stat_rq_prod);
78680
78681 set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
78682 /*
78683 @@ -386,7 +386,7 @@ static void sq_cq_reap(struct svcxprt_rd
78684 return;
78685
78686 ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
78687 - atomic_inc(&rdma_stat_sq_poll);
78688 + atomic_inc_unchecked(&rdma_stat_sq_poll);
78689 while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
78690 if (wc.status != IB_WC_SUCCESS)
78691 /* Close the transport */
78692 @@ -404,7 +404,7 @@ static void sq_cq_reap(struct svcxprt_rd
78693 }
78694
78695 if (ctxt)
78696 - atomic_inc(&rdma_stat_sq_prod);
78697 + atomic_inc_unchecked(&rdma_stat_sq_prod);
78698 }
78699
78700 static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
78701 @@ -1260,7 +1260,7 @@ int svc_rdma_send(struct svcxprt_rdma *x
78702 spin_lock_bh(&xprt->sc_lock);
78703 if (xprt->sc_sq_depth < atomic_read(&xprt->sc_sq_count) + wr_count) {
78704 spin_unlock_bh(&xprt->sc_lock);
78705 - atomic_inc(&rdma_stat_sq_starve);
78706 + atomic_inc_unchecked(&rdma_stat_sq_starve);
78707
78708 /* See if we can opportunistically reap SQ WR to make room */
78709 sq_cq_reap(xprt);
78710 diff -urNp linux-2.6.32.46/net/sysctl_net.c linux-2.6.32.46/net/sysctl_net.c
78711 --- linux-2.6.32.46/net/sysctl_net.c 2011-03-27 14:31:47.000000000 -0400
78712 +++ linux-2.6.32.46/net/sysctl_net.c 2011-04-17 15:56:46.000000000 -0400
78713 @@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
78714 struct ctl_table *table)
78715 {
78716 /* Allow network administrator to have same access as root. */
78717 - if (capable(CAP_NET_ADMIN)) {
78718 + if (capable_nolog(CAP_NET_ADMIN)) {
78719 int mode = (table->mode >> 6) & 7;
78720 return (mode << 6) | (mode << 3) | mode;
78721 }
78722 diff -urNp linux-2.6.32.46/net/tipc/link.c linux-2.6.32.46/net/tipc/link.c
78723 --- linux-2.6.32.46/net/tipc/link.c 2011-03-27 14:31:47.000000000 -0400
78724 +++ linux-2.6.32.46/net/tipc/link.c 2011-10-06 09:37:16.000000000 -0400
78725 @@ -1418,7 +1418,7 @@ again:
78726
78727 if (!sect_rest) {
78728 sect_rest = msg_sect[++curr_sect].iov_len;
78729 - sect_crs = (const unchar *)msg_sect[curr_sect].iov_base;
78730 + sect_crs = (const unchar __user *)msg_sect[curr_sect].iov_base;
78731 }
78732
78733 if (sect_rest < fragm_rest)
78734 @@ -1437,7 +1437,7 @@ error:
78735 }
78736 } else
78737 skb_copy_to_linear_data_offset(buf, fragm_crs,
78738 - sect_crs, sz);
78739 + (const void __force_kernel *)sect_crs, sz);
78740 sect_crs += sz;
78741 sect_rest -= sz;
78742 fragm_crs += sz;
78743 diff -urNp linux-2.6.32.46/net/tipc/subscr.c linux-2.6.32.46/net/tipc/subscr.c
78744 --- linux-2.6.32.46/net/tipc/subscr.c 2011-03-27 14:31:47.000000000 -0400
78745 +++ linux-2.6.32.46/net/tipc/subscr.c 2011-10-06 09:37:16.000000000 -0400
78746 @@ -104,7 +104,7 @@ static void subscr_send_event(struct sub
78747 {
78748 struct iovec msg_sect;
78749
78750 - msg_sect.iov_base = (void *)&sub->evt;
78751 + msg_sect.iov_base = (void __force_user *)&sub->evt;
78752 msg_sect.iov_len = sizeof(struct tipc_event);
78753
78754 sub->evt.event = htohl(event, sub->swap);
78755 diff -urNp linux-2.6.32.46/net/unix/af_unix.c linux-2.6.32.46/net/unix/af_unix.c
78756 --- linux-2.6.32.46/net/unix/af_unix.c 2011-05-10 22:12:02.000000000 -0400
78757 +++ linux-2.6.32.46/net/unix/af_unix.c 2011-07-18 18:17:33.000000000 -0400
78758 @@ -745,6 +745,12 @@ static struct sock *unix_find_other(stru
78759 err = -ECONNREFUSED;
78760 if (!S_ISSOCK(inode->i_mode))
78761 goto put_fail;
78762 +
78763 + if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
78764 + err = -EACCES;
78765 + goto put_fail;
78766 + }
78767 +
78768 u = unix_find_socket_byinode(net, inode);
78769 if (!u)
78770 goto put_fail;
78771 @@ -765,6 +771,13 @@ static struct sock *unix_find_other(stru
78772 if (u) {
78773 struct dentry *dentry;
78774 dentry = unix_sk(u)->dentry;
78775 +
78776 + if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
78777 + err = -EPERM;
78778 + sock_put(u);
78779 + goto fail;
78780 + }
78781 +
78782 if (dentry)
78783 touch_atime(unix_sk(u)->mnt, dentry);
78784 } else
78785 @@ -850,11 +863,18 @@ static int unix_bind(struct socket *sock
78786 err = security_path_mknod(&nd.path, dentry, mode, 0);
78787 if (err)
78788 goto out_mknod_drop_write;
78789 + if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
78790 + err = -EACCES;
78791 + goto out_mknod_drop_write;
78792 + }
78793 err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
78794 out_mknod_drop_write:
78795 mnt_drop_write(nd.path.mnt);
78796 if (err)
78797 goto out_mknod_dput;
78798 +
78799 + gr_handle_create(dentry, nd.path.mnt);
78800 +
78801 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
78802 dput(nd.path.dentry);
78803 nd.path.dentry = dentry;
78804 @@ -2211,7 +2231,11 @@ static int unix_seq_show(struct seq_file
78805 unix_state_lock(s);
78806
78807 seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu",
78808 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78809 + NULL,
78810 +#else
78811 s,
78812 +#endif
78813 atomic_read(&s->sk_refcnt),
78814 0,
78815 s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
78816 diff -urNp linux-2.6.32.46/net/wireless/core.h linux-2.6.32.46/net/wireless/core.h
78817 --- linux-2.6.32.46/net/wireless/core.h 2011-03-27 14:31:47.000000000 -0400
78818 +++ linux-2.6.32.46/net/wireless/core.h 2011-08-23 21:22:38.000000000 -0400
78819 @@ -27,7 +27,7 @@ struct cfg80211_registered_device {
78820 struct mutex mtx;
78821
78822 /* rfkill support */
78823 - struct rfkill_ops rfkill_ops;
78824 + rfkill_ops_no_const rfkill_ops;
78825 struct rfkill *rfkill;
78826 struct work_struct rfkill_sync;
78827
78828 diff -urNp linux-2.6.32.46/net/wireless/wext.c linux-2.6.32.46/net/wireless/wext.c
78829 --- linux-2.6.32.46/net/wireless/wext.c 2011-03-27 14:31:47.000000000 -0400
78830 +++ linux-2.6.32.46/net/wireless/wext.c 2011-04-17 15:56:46.000000000 -0400
78831 @@ -816,8 +816,7 @@ static int ioctl_standard_iw_point(struc
78832 */
78833
78834 /* Support for very large requests */
78835 - if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
78836 - (user_length > descr->max_tokens)) {
78837 + if (user_length > descr->max_tokens) {
78838 /* Allow userspace to GET more than max so
78839 * we can support any size GET requests.
78840 * There is still a limit : -ENOMEM.
78841 @@ -854,22 +853,6 @@ static int ioctl_standard_iw_point(struc
78842 }
78843 }
78844
78845 - if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
78846 - /*
78847 - * If this is a GET, but not NOMAX, it means that the extra
78848 - * data is not bounded by userspace, but by max_tokens. Thus
78849 - * set the length to max_tokens. This matches the extra data
78850 - * allocation.
78851 - * The driver should fill it with the number of tokens it
78852 - * provided, and it may check iwp->length rather than having
78853 - * knowledge of max_tokens. If the driver doesn't change the
78854 - * iwp->length, this ioctl just copies back max_token tokens
78855 - * filled with zeroes. Hopefully the driver isn't claiming
78856 - * them to be valid data.
78857 - */
78858 - iwp->length = descr->max_tokens;
78859 - }
78860 -
78861 err = handler(dev, info, (union iwreq_data *) iwp, extra);
78862
78863 iwp->length += essid_compat;
78864 diff -urNp linux-2.6.32.46/net/xfrm/xfrm_policy.c linux-2.6.32.46/net/xfrm/xfrm_policy.c
78865 --- linux-2.6.32.46/net/xfrm/xfrm_policy.c 2011-03-27 14:31:47.000000000 -0400
78866 +++ linux-2.6.32.46/net/xfrm/xfrm_policy.c 2011-05-04 17:56:20.000000000 -0400
78867 @@ -586,7 +586,7 @@ int xfrm_policy_insert(int dir, struct x
78868 hlist_add_head(&policy->bydst, chain);
78869 xfrm_pol_hold(policy);
78870 net->xfrm.policy_count[dir]++;
78871 - atomic_inc(&flow_cache_genid);
78872 + atomic_inc_unchecked(&flow_cache_genid);
78873 if (delpol)
78874 __xfrm_policy_unlink(delpol, dir);
78875 policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
78876 @@ -669,7 +669,7 @@ struct xfrm_policy *xfrm_policy_bysel_ct
78877 write_unlock_bh(&xfrm_policy_lock);
78878
78879 if (ret && delete) {
78880 - atomic_inc(&flow_cache_genid);
78881 + atomic_inc_unchecked(&flow_cache_genid);
78882 xfrm_policy_kill(ret);
78883 }
78884 return ret;
78885 @@ -710,7 +710,7 @@ struct xfrm_policy *xfrm_policy_byid(str
78886 write_unlock_bh(&xfrm_policy_lock);
78887
78888 if (ret && delete) {
78889 - atomic_inc(&flow_cache_genid);
78890 + atomic_inc_unchecked(&flow_cache_genid);
78891 xfrm_policy_kill(ret);
78892 }
78893 return ret;
78894 @@ -824,7 +824,7 @@ int xfrm_policy_flush(struct net *net, u
78895 }
78896
78897 }
78898 - atomic_inc(&flow_cache_genid);
78899 + atomic_inc_unchecked(&flow_cache_genid);
78900 out:
78901 write_unlock_bh(&xfrm_policy_lock);
78902 return err;
78903 @@ -1088,7 +1088,7 @@ int xfrm_policy_delete(struct xfrm_polic
78904 write_unlock_bh(&xfrm_policy_lock);
78905 if (pol) {
78906 if (dir < XFRM_POLICY_MAX)
78907 - atomic_inc(&flow_cache_genid);
78908 + atomic_inc_unchecked(&flow_cache_genid);
78909 xfrm_policy_kill(pol);
78910 return 0;
78911 }
78912 @@ -1477,7 +1477,7 @@ free_dst:
78913 goto out;
78914 }
78915
78916 -static int inline
78917 +static inline int
78918 xfrm_dst_alloc_copy(void **target, void *src, int size)
78919 {
78920 if (!*target) {
78921 @@ -1489,7 +1489,7 @@ xfrm_dst_alloc_copy(void **target, void
78922 return 0;
78923 }
78924
78925 -static int inline
78926 +static inline int
78927 xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
78928 {
78929 #ifdef CONFIG_XFRM_SUB_POLICY
78930 @@ -1501,7 +1501,7 @@ xfrm_dst_update_parent(struct dst_entry
78931 #endif
78932 }
78933
78934 -static int inline
78935 +static inline int
78936 xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
78937 {
78938 #ifdef CONFIG_XFRM_SUB_POLICY
78939 @@ -1537,7 +1537,7 @@ int __xfrm_lookup(struct net *net, struc
78940 u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
78941
78942 restart:
78943 - genid = atomic_read(&flow_cache_genid);
78944 + genid = atomic_read_unchecked(&flow_cache_genid);
78945 policy = NULL;
78946 for (pi = 0; pi < ARRAY_SIZE(pols); pi++)
78947 pols[pi] = NULL;
78948 @@ -1680,7 +1680,7 @@ restart:
78949 goto error;
78950 }
78951 if (nx == -EAGAIN ||
78952 - genid != atomic_read(&flow_cache_genid)) {
78953 + genid != atomic_read_unchecked(&flow_cache_genid)) {
78954 xfrm_pols_put(pols, npols);
78955 goto restart;
78956 }
78957 diff -urNp linux-2.6.32.46/net/xfrm/xfrm_user.c linux-2.6.32.46/net/xfrm/xfrm_user.c
78958 --- linux-2.6.32.46/net/xfrm/xfrm_user.c 2011-03-27 14:31:47.000000000 -0400
78959 +++ linux-2.6.32.46/net/xfrm/xfrm_user.c 2011-05-16 21:46:57.000000000 -0400
78960 @@ -1169,6 +1169,8 @@ static int copy_to_user_tmpl(struct xfrm
78961 struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
78962 int i;
78963
78964 + pax_track_stack();
78965 +
78966 if (xp->xfrm_nr == 0)
78967 return 0;
78968
78969 @@ -1784,6 +1786,8 @@ static int xfrm_do_migrate(struct sk_buf
78970 int err;
78971 int n = 0;
78972
78973 + pax_track_stack();
78974 +
78975 if (attrs[XFRMA_MIGRATE] == NULL)
78976 return -EINVAL;
78977
78978 diff -urNp linux-2.6.32.46/samples/kobject/kset-example.c linux-2.6.32.46/samples/kobject/kset-example.c
78979 --- linux-2.6.32.46/samples/kobject/kset-example.c 2011-03-27 14:31:47.000000000 -0400
78980 +++ linux-2.6.32.46/samples/kobject/kset-example.c 2011-04-17 15:56:46.000000000 -0400
78981 @@ -87,7 +87,7 @@ static ssize_t foo_attr_store(struct kob
78982 }
78983
78984 /* Our custom sysfs_ops that we will associate with our ktype later on */
78985 -static struct sysfs_ops foo_sysfs_ops = {
78986 +static const struct sysfs_ops foo_sysfs_ops = {
78987 .show = foo_attr_show,
78988 .store = foo_attr_store,
78989 };
78990 diff -urNp linux-2.6.32.46/scripts/basic/fixdep.c linux-2.6.32.46/scripts/basic/fixdep.c
78991 --- linux-2.6.32.46/scripts/basic/fixdep.c 2011-03-27 14:31:47.000000000 -0400
78992 +++ linux-2.6.32.46/scripts/basic/fixdep.c 2011-10-06 09:37:14.000000000 -0400
78993 @@ -162,7 +162,7 @@ static void grow_config(int len)
78994 /*
78995 * Lookup a value in the configuration string.
78996 */
78997 -static int is_defined_config(const char * name, int len)
78998 +static int is_defined_config(const char * name, unsigned int len)
78999 {
79000 const char * pconfig;
79001 const char * plast = str_config + len_config - len;
79002 @@ -199,7 +199,7 @@ static void clear_config(void)
79003 /*
79004 * Record the use of a CONFIG_* word.
79005 */
79006 -static void use_config(char *m, int slen)
79007 +static void use_config(char *m, unsigned int slen)
79008 {
79009 char s[PATH_MAX];
79010 char *p;
79011 @@ -222,9 +222,9 @@ static void use_config(char *m, int slen
79012
79013 static void parse_config_file(char *map, size_t len)
79014 {
79015 - int *end = (int *) (map + len);
79016 + unsigned int *end = (unsigned int *) (map + len);
79017 /* start at +1, so that p can never be < map */
79018 - int *m = (int *) map + 1;
79019 + unsigned int *m = (unsigned int *) map + 1;
79020 char *p, *q;
79021
79022 for (; m < end; m++) {
79023 @@ -371,7 +371,7 @@ static void print_deps(void)
79024 static void traps(void)
79025 {
79026 static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
79027 - int *p = (int *)test;
79028 + unsigned int *p = (unsigned int *)test;
79029
79030 if (*p != INT_CONF) {
79031 fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
79032 diff -urNp linux-2.6.32.46/scripts/gcc-plugin.sh linux-2.6.32.46/scripts/gcc-plugin.sh
79033 --- linux-2.6.32.46/scripts/gcc-plugin.sh 1969-12-31 19:00:00.000000000 -0500
79034 +++ linux-2.6.32.46/scripts/gcc-plugin.sh 2011-10-06 09:37:14.000000000 -0400
79035 @@ -0,0 +1,2 @@
79036 +#!/bin/sh
79037 +echo "#include \"gcc-plugin.h\"\n#include \"rtl.h\"" | $1 -x c -shared - -o /dev/null -I`$2 -print-file-name=plugin`/include >/dev/null 2>&1 && echo "y"
79038 diff -urNp linux-2.6.32.46/scripts/Makefile.build linux-2.6.32.46/scripts/Makefile.build
79039 --- linux-2.6.32.46/scripts/Makefile.build 2011-03-27 14:31:47.000000000 -0400
79040 +++ linux-2.6.32.46/scripts/Makefile.build 2011-08-23 20:45:11.000000000 -0400
79041 @@ -59,7 +59,7 @@ endif
79042 endif
79043
79044 # Do not include host rules unless needed
79045 -ifneq ($(hostprogs-y)$(hostprogs-m),)
79046 +ifneq ($(hostprogs-y)$(hostprogs-m)$(hostlibs-y)$(hostlibs-m),)
79047 include scripts/Makefile.host
79048 endif
79049
79050 diff -urNp linux-2.6.32.46/scripts/Makefile.clean linux-2.6.32.46/scripts/Makefile.clean
79051 --- linux-2.6.32.46/scripts/Makefile.clean 2011-03-27 14:31:47.000000000 -0400
79052 +++ linux-2.6.32.46/scripts/Makefile.clean 2011-06-04 20:47:19.000000000 -0400
79053 @@ -43,7 +43,8 @@ subdir-ymn := $(addprefix $(obj)/,$(subd
79054 __clean-files := $(extra-y) $(always) \
79055 $(targets) $(clean-files) \
79056 $(host-progs) \
79057 - $(hostprogs-y) $(hostprogs-m) $(hostprogs-)
79058 + $(hostprogs-y) $(hostprogs-m) $(hostprogs-) \
79059 + $(hostlibs-y) $(hostlibs-m) $(hostlibs-)
79060
79061 # as clean-files is given relative to the current directory, this adds
79062 # a $(obj) prefix, except for absolute paths
79063 diff -urNp linux-2.6.32.46/scripts/Makefile.host linux-2.6.32.46/scripts/Makefile.host
79064 --- linux-2.6.32.46/scripts/Makefile.host 2011-03-27 14:31:47.000000000 -0400
79065 +++ linux-2.6.32.46/scripts/Makefile.host 2011-06-04 20:48:22.000000000 -0400
79066 @@ -31,6 +31,7 @@
79067 # Note: Shared libraries consisting of C++ files are not supported
79068
79069 __hostprogs := $(sort $(hostprogs-y) $(hostprogs-m))
79070 +__hostlibs := $(sort $(hostlibs-y) $(hostlibs-m))
79071
79072 # C code
79073 # Executables compiled from a single .c file
79074 @@ -54,6 +55,7 @@ host-cxxobjs := $(sort $(foreach m,$(hos
79075 # Shared libaries (only .c supported)
79076 # Shared libraries (.so) - all .so files referenced in "xxx-objs"
79077 host-cshlib := $(sort $(filter %.so, $(host-cobjs)))
79078 +host-cshlib += $(sort $(filter %.so, $(__hostlibs)))
79079 # Remove .so files from "xxx-objs"
79080 host-cobjs := $(filter-out %.so,$(host-cobjs))
79081
79082 diff -urNp linux-2.6.32.46/scripts/mod/file2alias.c linux-2.6.32.46/scripts/mod/file2alias.c
79083 --- linux-2.6.32.46/scripts/mod/file2alias.c 2011-03-27 14:31:47.000000000 -0400
79084 +++ linux-2.6.32.46/scripts/mod/file2alias.c 2011-10-06 09:37:14.000000000 -0400
79085 @@ -72,7 +72,7 @@ static void device_id_check(const char *
79086 unsigned long size, unsigned long id_size,
79087 void *symval)
79088 {
79089 - int i;
79090 + unsigned int i;
79091
79092 if (size % id_size || size < id_size) {
79093 if (cross_build != 0)
79094 @@ -102,7 +102,7 @@ static void device_id_check(const char *
79095 /* USB is special because the bcdDevice can be matched against a numeric range */
79096 /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
79097 static void do_usb_entry(struct usb_device_id *id,
79098 - unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
79099 + unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
79100 unsigned char range_lo, unsigned char range_hi,
79101 struct module *mod)
79102 {
79103 @@ -151,7 +151,7 @@ static void do_usb_entry_multi(struct us
79104 {
79105 unsigned int devlo, devhi;
79106 unsigned char chi, clo;
79107 - int ndigits;
79108 + unsigned int ndigits;
79109
79110 id->match_flags = TO_NATIVE(id->match_flags);
79111 id->idVendor = TO_NATIVE(id->idVendor);
79112 @@ -368,7 +368,7 @@ static void do_pnp_device_entry(void *sy
79113 for (i = 0; i < count; i++) {
79114 const char *id = (char *)devs[i].id;
79115 char acpi_id[sizeof(devs[0].id)];
79116 - int j;
79117 + unsigned int j;
79118
79119 buf_printf(&mod->dev_table_buf,
79120 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
79121 @@ -398,7 +398,7 @@ static void do_pnp_card_entries(void *sy
79122
79123 for (j = 0; j < PNP_MAX_DEVICES; j++) {
79124 const char *id = (char *)card->devs[j].id;
79125 - int i2, j2;
79126 + unsigned int i2, j2;
79127 int dup = 0;
79128
79129 if (!id[0])
79130 @@ -424,7 +424,7 @@ static void do_pnp_card_entries(void *sy
79131 /* add an individual alias for every device entry */
79132 if (!dup) {
79133 char acpi_id[sizeof(card->devs[0].id)];
79134 - int k;
79135 + unsigned int k;
79136
79137 buf_printf(&mod->dev_table_buf,
79138 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
79139 @@ -699,7 +699,7 @@ static void dmi_ascii_filter(char *d, co
79140 static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
79141 char *alias)
79142 {
79143 - int i, j;
79144 + unsigned int i, j;
79145
79146 sprintf(alias, "dmi*");
79147
79148 diff -urNp linux-2.6.32.46/scripts/mod/modpost.c linux-2.6.32.46/scripts/mod/modpost.c
79149 --- linux-2.6.32.46/scripts/mod/modpost.c 2011-03-27 14:31:47.000000000 -0400
79150 +++ linux-2.6.32.46/scripts/mod/modpost.c 2011-07-06 19:53:33.000000000 -0400
79151 @@ -835,6 +835,7 @@ enum mismatch {
79152 INIT_TO_EXIT,
79153 EXIT_TO_INIT,
79154 EXPORT_TO_INIT_EXIT,
79155 + DATA_TO_TEXT
79156 };
79157
79158 struct sectioncheck {
79159 @@ -920,6 +921,12 @@ const struct sectioncheck sectioncheck[]
79160 .fromsec = { "__ksymtab*", NULL },
79161 .tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
79162 .mismatch = EXPORT_TO_INIT_EXIT
79163 +},
79164 +/* Do not reference code from writable data */
79165 +{
79166 + .fromsec = { DATA_SECTIONS, NULL },
79167 + .tosec = { TEXT_SECTIONS, NULL },
79168 + .mismatch = DATA_TO_TEXT
79169 }
79170 };
79171
79172 @@ -1024,10 +1031,10 @@ static Elf_Sym *find_elf_symbol(struct e
79173 continue;
79174 if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
79175 continue;
79176 - if (sym->st_value == addr)
79177 - return sym;
79178 /* Find a symbol nearby - addr are maybe negative */
79179 d = sym->st_value - addr;
79180 + if (d == 0)
79181 + return sym;
79182 if (d < 0)
79183 d = addr - sym->st_value;
79184 if (d < distance) {
79185 @@ -1268,6 +1275,14 @@ static void report_sec_mismatch(const ch
79186 "Fix this by removing the %sannotation of %s "
79187 "or drop the export.\n",
79188 tosym, sec2annotation(tosec), sec2annotation(tosec), tosym);
79189 + case DATA_TO_TEXT:
79190 +/*
79191 + fprintf(stderr,
79192 + "The variable %s references\n"
79193 + "the %s %s%s%s\n",
79194 + fromsym, to, sec2annotation(tosec), tosym, to_p);
79195 +*/
79196 + break;
79197 case NO_MISMATCH:
79198 /* To get warnings on missing members */
79199 break;
79200 @@ -1495,7 +1510,7 @@ static void section_rel(const char *modn
79201 static void check_sec_ref(struct module *mod, const char *modname,
79202 struct elf_info *elf)
79203 {
79204 - int i;
79205 + unsigned int i;
79206 Elf_Shdr *sechdrs = elf->sechdrs;
79207
79208 /* Walk through all sections */
79209 @@ -1651,7 +1666,7 @@ void __attribute__((format(printf, 2, 3)
79210 va_end(ap);
79211 }
79212
79213 -void buf_write(struct buffer *buf, const char *s, int len)
79214 +void buf_write(struct buffer *buf, const char *s, unsigned int len)
79215 {
79216 if (buf->size - buf->pos < len) {
79217 buf->size += len + SZ;
79218 @@ -1863,7 +1878,7 @@ static void write_if_changed(struct buff
79219 if (fstat(fileno(file), &st) < 0)
79220 goto close_write;
79221
79222 - if (st.st_size != b->pos)
79223 + if (st.st_size != (off_t)b->pos)
79224 goto close_write;
79225
79226 tmp = NOFAIL(malloc(b->pos));
79227 diff -urNp linux-2.6.32.46/scripts/mod/modpost.h linux-2.6.32.46/scripts/mod/modpost.h
79228 --- linux-2.6.32.46/scripts/mod/modpost.h 2011-03-27 14:31:47.000000000 -0400
79229 +++ linux-2.6.32.46/scripts/mod/modpost.h 2011-04-17 15:56:46.000000000 -0400
79230 @@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
79231
79232 struct buffer {
79233 char *p;
79234 - int pos;
79235 - int size;
79236 + unsigned int pos;
79237 + unsigned int size;
79238 };
79239
79240 void __attribute__((format(printf, 2, 3)))
79241 buf_printf(struct buffer *buf, const char *fmt, ...);
79242
79243 void
79244 -buf_write(struct buffer *buf, const char *s, int len);
79245 +buf_write(struct buffer *buf, const char *s, unsigned int len);
79246
79247 struct module {
79248 struct module *next;
79249 diff -urNp linux-2.6.32.46/scripts/mod/sumversion.c linux-2.6.32.46/scripts/mod/sumversion.c
79250 --- linux-2.6.32.46/scripts/mod/sumversion.c 2011-03-27 14:31:47.000000000 -0400
79251 +++ linux-2.6.32.46/scripts/mod/sumversion.c 2011-04-17 15:56:46.000000000 -0400
79252 @@ -455,7 +455,7 @@ static void write_version(const char *fi
79253 goto out;
79254 }
79255
79256 - if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
79257 + if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
79258 warn("writing sum in %s failed: %s\n",
79259 filename, strerror(errno));
79260 goto out;
79261 diff -urNp linux-2.6.32.46/scripts/package/mkspec linux-2.6.32.46/scripts/package/mkspec
79262 --- linux-2.6.32.46/scripts/package/mkspec 2011-03-27 14:31:47.000000000 -0400
79263 +++ linux-2.6.32.46/scripts/package/mkspec 2011-07-19 18:19:12.000000000 -0400
79264 @@ -70,7 +70,7 @@ echo 'mkdir -p $RPM_BUILD_ROOT/boot $RPM
79265 echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
79266 echo "%endif"
79267
79268 -echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{_smp_mflags} KBUILD_SRC= modules_install'
79269 +echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{?_smp_mflags} KBUILD_SRC= modules_install'
79270 echo "%ifarch ia64"
79271 echo 'cp $KBUILD_IMAGE $RPM_BUILD_ROOT'"/boot/efi/vmlinuz-$KERNELRELEASE"
79272 echo 'ln -s '"efi/vmlinuz-$KERNELRELEASE" '$RPM_BUILD_ROOT'"/boot/"
79273 diff -urNp linux-2.6.32.46/scripts/pnmtologo.c linux-2.6.32.46/scripts/pnmtologo.c
79274 --- linux-2.6.32.46/scripts/pnmtologo.c 2011-03-27 14:31:47.000000000 -0400
79275 +++ linux-2.6.32.46/scripts/pnmtologo.c 2011-04-17 15:56:46.000000000 -0400
79276 @@ -237,14 +237,14 @@ static void write_header(void)
79277 fprintf(out, " * Linux logo %s\n", logoname);
79278 fputs(" */\n\n", out);
79279 fputs("#include <linux/linux_logo.h>\n\n", out);
79280 - fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
79281 + fprintf(out, "static unsigned char %s_data[] = {\n",
79282 logoname);
79283 }
79284
79285 static void write_footer(void)
79286 {
79287 fputs("\n};\n\n", out);
79288 - fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
79289 + fprintf(out, "const struct linux_logo %s = {\n", logoname);
79290 fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
79291 fprintf(out, "\t.width\t\t= %d,\n", logo_width);
79292 fprintf(out, "\t.height\t\t= %d,\n", logo_height);
79293 @@ -374,7 +374,7 @@ static void write_logo_clut224(void)
79294 fputs("\n};\n\n", out);
79295
79296 /* write logo clut */
79297 - fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
79298 + fprintf(out, "static unsigned char %s_clut[] = {\n",
79299 logoname);
79300 write_hex_cnt = 0;
79301 for (i = 0; i < logo_clutsize; i++) {
79302 diff -urNp linux-2.6.32.46/scripts/tags.sh linux-2.6.32.46/scripts/tags.sh
79303 --- linux-2.6.32.46/scripts/tags.sh 2011-03-27 14:31:47.000000000 -0400
79304 +++ linux-2.6.32.46/scripts/tags.sh 2011-06-07 18:06:04.000000000 -0400
79305 @@ -93,6 +93,11 @@ docscope()
79306 cscope -b -f cscope.out
79307 }
79308
79309 +dogtags()
79310 +{
79311 + all_sources | gtags -f -
79312 +}
79313 +
79314 exuberant()
79315 {
79316 all_sources | xargs $1 -a \
79317 @@ -164,6 +169,10 @@ case "$1" in
79318 docscope
79319 ;;
79320
79321 + "gtags")
79322 + dogtags
79323 + ;;
79324 +
79325 "tags")
79326 rm -f tags
79327 xtags ctags
79328 diff -urNp linux-2.6.32.46/security/capability.c linux-2.6.32.46/security/capability.c
79329 --- linux-2.6.32.46/security/capability.c 2011-03-27 14:31:47.000000000 -0400
79330 +++ linux-2.6.32.46/security/capability.c 2011-04-17 15:56:46.000000000 -0400
79331 @@ -890,7 +890,7 @@ static void cap_audit_rule_free(void *ls
79332 }
79333 #endif /* CONFIG_AUDIT */
79334
79335 -struct security_operations default_security_ops = {
79336 +struct security_operations default_security_ops __read_only = {
79337 .name = "default",
79338 };
79339
79340 diff -urNp linux-2.6.32.46/security/commoncap.c linux-2.6.32.46/security/commoncap.c
79341 --- linux-2.6.32.46/security/commoncap.c 2011-03-27 14:31:47.000000000 -0400
79342 +++ linux-2.6.32.46/security/commoncap.c 2011-08-17 19:22:13.000000000 -0400
79343 @@ -27,7 +27,7 @@
79344 #include <linux/sched.h>
79345 #include <linux/prctl.h>
79346 #include <linux/securebits.h>
79347 -
79348 +#include <net/sock.h>
79349 /*
79350 * If a non-root user executes a setuid-root binary in
79351 * !secure(SECURE_NOROOT) mode, then we raise capabilities.
79352 @@ -50,9 +50,18 @@ static void warn_setuid_and_fcaps_mixed(
79353 }
79354 }
79355
79356 +#ifdef CONFIG_NET
79357 +extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
79358 +#endif
79359 +
79360 int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
79361 {
79362 +#ifdef CONFIG_NET
79363 + NETLINK_CB(skb).eff_cap = gr_cap_rtnetlink(sk);
79364 +#else
79365 NETLINK_CB(skb).eff_cap = current_cap();
79366 +#endif
79367 +
79368 return 0;
79369 }
79370
79371 @@ -582,6 +591,9 @@ int cap_bprm_secureexec(struct linux_bin
79372 {
79373 const struct cred *cred = current_cred();
79374
79375 + if (gr_acl_enable_at_secure())
79376 + return 1;
79377 +
79378 if (cred->uid != 0) {
79379 if (bprm->cap_effective)
79380 return 1;
79381 diff -urNp linux-2.6.32.46/security/integrity/ima/ima_api.c linux-2.6.32.46/security/integrity/ima/ima_api.c
79382 --- linux-2.6.32.46/security/integrity/ima/ima_api.c 2011-03-27 14:31:47.000000000 -0400
79383 +++ linux-2.6.32.46/security/integrity/ima/ima_api.c 2011-04-17 15:56:46.000000000 -0400
79384 @@ -74,7 +74,7 @@ void ima_add_violation(struct inode *ino
79385 int result;
79386
79387 /* can overflow, only indicator */
79388 - atomic_long_inc(&ima_htable.violations);
79389 + atomic_long_inc_unchecked(&ima_htable.violations);
79390
79391 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
79392 if (!entry) {
79393 diff -urNp linux-2.6.32.46/security/integrity/ima/ima_fs.c linux-2.6.32.46/security/integrity/ima/ima_fs.c
79394 --- linux-2.6.32.46/security/integrity/ima/ima_fs.c 2011-03-27 14:31:47.000000000 -0400
79395 +++ linux-2.6.32.46/security/integrity/ima/ima_fs.c 2011-04-17 15:56:46.000000000 -0400
79396 @@ -27,12 +27,12 @@
79397 static int valid_policy = 1;
79398 #define TMPBUFLEN 12
79399 static ssize_t ima_show_htable_value(char __user *buf, size_t count,
79400 - loff_t *ppos, atomic_long_t *val)
79401 + loff_t *ppos, atomic_long_unchecked_t *val)
79402 {
79403 char tmpbuf[TMPBUFLEN];
79404 ssize_t len;
79405
79406 - len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
79407 + len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
79408 return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
79409 }
79410
79411 diff -urNp linux-2.6.32.46/security/integrity/ima/ima.h linux-2.6.32.46/security/integrity/ima/ima.h
79412 --- linux-2.6.32.46/security/integrity/ima/ima.h 2011-03-27 14:31:47.000000000 -0400
79413 +++ linux-2.6.32.46/security/integrity/ima/ima.h 2011-04-17 15:56:46.000000000 -0400
79414 @@ -84,8 +84,8 @@ void ima_add_violation(struct inode *ino
79415 extern spinlock_t ima_queue_lock;
79416
79417 struct ima_h_table {
79418 - atomic_long_t len; /* number of stored measurements in the list */
79419 - atomic_long_t violations;
79420 + atomic_long_unchecked_t len; /* number of stored measurements in the list */
79421 + atomic_long_unchecked_t violations;
79422 struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
79423 };
79424 extern struct ima_h_table ima_htable;
79425 diff -urNp linux-2.6.32.46/security/integrity/ima/ima_queue.c linux-2.6.32.46/security/integrity/ima/ima_queue.c
79426 --- linux-2.6.32.46/security/integrity/ima/ima_queue.c 2011-03-27 14:31:47.000000000 -0400
79427 +++ linux-2.6.32.46/security/integrity/ima/ima_queue.c 2011-04-17 15:56:46.000000000 -0400
79428 @@ -78,7 +78,7 @@ static int ima_add_digest_entry(struct i
79429 INIT_LIST_HEAD(&qe->later);
79430 list_add_tail_rcu(&qe->later, &ima_measurements);
79431
79432 - atomic_long_inc(&ima_htable.len);
79433 + atomic_long_inc_unchecked(&ima_htable.len);
79434 key = ima_hash_key(entry->digest);
79435 hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
79436 return 0;
79437 diff -urNp linux-2.6.32.46/security/Kconfig linux-2.6.32.46/security/Kconfig
79438 --- linux-2.6.32.46/security/Kconfig 2011-03-27 14:31:47.000000000 -0400
79439 +++ linux-2.6.32.46/security/Kconfig 2011-10-06 09:38:20.000000000 -0400
79440 @@ -4,6 +4,559 @@
79441
79442 menu "Security options"
79443
79444 +source grsecurity/Kconfig
79445 +
79446 +menu "PaX"
79447 +
79448 + config ARCH_TRACK_EXEC_LIMIT
79449 + bool
79450 +
79451 + config PAX_KERNEXEC_PLUGIN
79452 + bool
79453 +
79454 + config PAX_PER_CPU_PGD
79455 + bool
79456 +
79457 + config TASK_SIZE_MAX_SHIFT
79458 + int
79459 + depends on X86_64
79460 + default 47 if !PAX_PER_CPU_PGD
79461 + default 42 if PAX_PER_CPU_PGD
79462 +
79463 + config PAX_ENABLE_PAE
79464 + bool
79465 + default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
79466 +
79467 +config PAX
79468 + bool "Enable various PaX features"
79469 + depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
79470 + help
79471 + This allows you to enable various PaX features. PaX adds
79472 + intrusion prevention mechanisms to the kernel that reduce
79473 + the risks posed by exploitable memory corruption bugs.
79474 +
79475 +menu "PaX Control"
79476 + depends on PAX
79477 +
79478 +config PAX_SOFTMODE
79479 + bool 'Support soft mode'
79480 + select PAX_PT_PAX_FLAGS
79481 + help
79482 + Enabling this option will allow you to run PaX in soft mode, that
79483 + is, PaX features will not be enforced by default, only on executables
79484 + marked explicitly. You must also enable PT_PAX_FLAGS support as it
79485 + is the only way to mark executables for soft mode use.
79486 +
79487 + Soft mode can be activated by using the "pax_softmode=1" kernel command
79488 + line option on boot. Furthermore you can control various PaX features
79489 + at runtime via the entries in /proc/sys/kernel/pax.
79490 +
79491 +config PAX_EI_PAX
79492 + bool 'Use legacy ELF header marking'
79493 + help
79494 + Enabling this option will allow you to control PaX features on
79495 + a per executable basis via the 'chpax' utility available at
79496 + http://pax.grsecurity.net/. The control flags will be read from
79497 + an otherwise reserved part of the ELF header. This marking has
79498 + numerous drawbacks (no support for soft-mode, toolchain does not
79499 + know about the non-standard use of the ELF header) therefore it
79500 + has been deprecated in favour of PT_PAX_FLAGS support.
79501 +
79502 + Note that if you enable PT_PAX_FLAGS marking support as well,
79503 + the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
79504 +
79505 +config PAX_PT_PAX_FLAGS
79506 + bool 'Use ELF program header marking'
79507 + help
79508 + Enabling this option will allow you to control PaX features on
79509 + a per executable basis via the 'paxctl' utility available at
79510 + http://pax.grsecurity.net/. The control flags will be read from
79511 + a PaX specific ELF program header (PT_PAX_FLAGS). This marking
79512 + has the benefits of supporting both soft mode and being fully
79513 + integrated into the toolchain (the binutils patch is available
79514 + from http://pax.grsecurity.net).
79515 +
79516 + If your toolchain does not support PT_PAX_FLAGS markings,
79517 + you can create one in most cases with 'paxctl -C'.
79518 +
79519 + Note that if you enable the legacy EI_PAX marking support as well,
79520 + the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
79521 +
79522 +choice
79523 + prompt 'MAC system integration'
79524 + default PAX_HAVE_ACL_FLAGS
79525 + help
79526 + Mandatory Access Control systems have the option of controlling
79527 + PaX flags on a per executable basis, choose the method supported
79528 + by your particular system.
79529 +
79530 + - "none": if your MAC system does not interact with PaX,
79531 + - "direct": if your MAC system defines pax_set_initial_flags() itself,
79532 + - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
79533 +
79534 + NOTE: this option is for developers/integrators only.
79535 +
79536 + config PAX_NO_ACL_FLAGS
79537 + bool 'none'
79538 +
79539 + config PAX_HAVE_ACL_FLAGS
79540 + bool 'direct'
79541 +
79542 + config PAX_HOOK_ACL_FLAGS
79543 + bool 'hook'
79544 +endchoice
79545 +
79546 +endmenu
79547 +
79548 +menu "Non-executable pages"
79549 + depends on PAX
79550 +
79551 +config PAX_NOEXEC
79552 + bool "Enforce non-executable pages"
79553 + depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86)
79554 + help
79555 + By design some architectures do not allow for protecting memory
79556 + pages against execution or even if they do, Linux does not make
79557 + use of this feature. In practice this means that if a page is
79558 + readable (such as the stack or heap) it is also executable.
79559 +
79560 + There is a well known exploit technique that makes use of this
79561 + fact and a common programming mistake where an attacker can
79562 + introduce code of his choice somewhere in the attacked program's
79563 + memory (typically the stack or the heap) and then execute it.
79564 +
79565 + If the attacked program was running with different (typically
79566 + higher) privileges than that of the attacker, then he can elevate
79567 + his own privilege level (e.g. get a root shell, write to files for
79568 + which he does not have write access to, etc).
79569 +
79570 + Enabling this option will let you choose from various features
79571 + that prevent the injection and execution of 'foreign' code in
79572 + a program.
79573 +
79574 + This will also break programs that rely on the old behaviour and
79575 + expect that dynamically allocated memory via the malloc() family
79576 + of functions is executable (which it is not). Notable examples
79577 + are the XFree86 4.x server, the java runtime and wine.
79578 +
79579 +config PAX_PAGEEXEC
79580 + bool "Paging based non-executable pages"
79581 + depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
79582 + select S390_SWITCH_AMODE if S390
79583 + select S390_EXEC_PROTECT if S390
79584 + select ARCH_TRACK_EXEC_LIMIT if X86_32
79585 + help
79586 + This implementation is based on the paging feature of the CPU.
79587 + On i386 without hardware non-executable bit support there is a
79588 + variable but usually low performance impact, however on Intel's
79589 + P4 core based CPUs it is very high so you should not enable this
79590 + for kernels meant to be used on such CPUs.
79591 +
79592 + On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
79593 + with hardware non-executable bit support there is no performance
79594 + impact, on ppc the impact is negligible.
79595 +
79596 + Note that several architectures require various emulations due to
79597 + badly designed userland ABIs, this will cause a performance impact
79598 + but will disappear as soon as userland is fixed. For example, ppc
79599 + userland MUST have been built with secure-plt by a recent toolchain.
79600 +
79601 +config PAX_SEGMEXEC
79602 + bool "Segmentation based non-executable pages"
79603 + depends on PAX_NOEXEC && X86_32
79604 + help
79605 + This implementation is based on the segmentation feature of the
79606 + CPU and has a very small performance impact, however applications
79607 + will be limited to a 1.5 GB address space instead of the normal
79608 + 3 GB.
79609 +
79610 +config PAX_EMUTRAMP
79611 + bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
79612 + default y if PARISC
79613 + help
79614 + There are some programs and libraries that for one reason or
79615 + another attempt to execute special small code snippets from
79616 + non-executable memory pages. Most notable examples are the
79617 + signal handler return code generated by the kernel itself and
79618 + the GCC trampolines.
79619 +
79620 + If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
79621 + such programs will no longer work under your kernel.
79622 +
79623 + As a remedy you can say Y here and use the 'chpax' or 'paxctl'
79624 + utilities to enable trampoline emulation for the affected programs
79625 + yet still have the protection provided by the non-executable pages.
79626 +
79627 + On parisc you MUST enable this option and EMUSIGRT as well, otherwise
79628 + your system will not even boot.
79629 +
79630 + Alternatively you can say N here and use the 'chpax' or 'paxctl'
79631 + utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
79632 + for the affected files.
79633 +
79634 + NOTE: enabling this feature *may* open up a loophole in the
79635 + protection provided by non-executable pages that an attacker
79636 + could abuse. Therefore the best solution is to not have any
79637 + files on your system that would require this option. This can
79638 + be achieved by not using libc5 (which relies on the kernel
79639 + signal handler return code) and not using or rewriting programs
79640 + that make use of the nested function implementation of GCC.
79641 + Skilled users can just fix GCC itself so that it implements
79642 + nested function calls in a way that does not interfere with PaX.
79643 +
79644 +config PAX_EMUSIGRT
79645 + bool "Automatically emulate sigreturn trampolines"
79646 + depends on PAX_EMUTRAMP && PARISC
79647 + default y
79648 + help
79649 + Enabling this option will have the kernel automatically detect
79650 + and emulate signal return trampolines executing on the stack
79651 + that would otherwise lead to task termination.
79652 +
79653 + This solution is intended as a temporary one for users with
79654 + legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
79655 + Modula-3 runtime, etc) or executables linked to such, basically
79656 + everything that does not specify its own SA_RESTORER function in
79657 + normal executable memory like glibc 2.1+ does.
79658 +
79659 + On parisc you MUST enable this option, otherwise your system will
79660 + not even boot.
79661 +
79662 + NOTE: this feature cannot be disabled on a per executable basis
79663 + and since it *does* open up a loophole in the protection provided
79664 + by non-executable pages, the best solution is to not have any
79665 + files on your system that would require this option.
79666 +
79667 +config PAX_MPROTECT
79668 + bool "Restrict mprotect()"
79669 + depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
79670 + help
79671 + Enabling this option will prevent programs from
79672 + - changing the executable status of memory pages that were
79673 + not originally created as executable,
79674 + - making read-only executable pages writable again,
79675 + - creating executable pages from anonymous memory,
79676 + - making read-only-after-relocations (RELRO) data pages writable again.
79677 +
79678 + You should say Y here to complete the protection provided by
79679 + the enforcement of non-executable pages.
79680 +
79681 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
79682 + this feature on a per file basis.
79683 +
79684 +config PAX_MPROTECT_COMPAT
79685 + bool "Use legacy/compat protection demoting (read help)"
79686 + depends on PAX_MPROTECT
79687 + default n
79688 + help
79689 + The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
79690 + by sending the proper error code to the application. For some broken
79691 + userland, this can cause problems with Python or other applications. The
79692 + current implementation however allows for applications like clamav to
79693 + detect if JIT compilation/execution is allowed and to fall back gracefully
79694 + to an interpreter-based mode if it does not. While we encourage everyone
79695 + to use the current implementation as-is and push upstream to fix broken
79696 + userland (note that the RWX logging option can assist with this), in some
79697 + environments this may not be possible. Having to disable MPROTECT
79698 + completely on certain binaries reduces the security benefit of PaX,
79699 + so this option is provided for those environments to revert to the old
79700 + behavior.
79701 +
79702 +config PAX_ELFRELOCS
79703 + bool "Allow ELF text relocations (read help)"
79704 + depends on PAX_MPROTECT
79705 + default n
79706 + help
79707 + Non-executable pages and mprotect() restrictions are effective
79708 + in preventing the introduction of new executable code into an
79709 + attacked task's address space. There remain only two venues
79710 + for this kind of attack: if the attacker can execute already
79711 + existing code in the attacked task then he can either have it
79712 + create and mmap() a file containing his code or have it mmap()
79713 + an already existing ELF library that does not have position
79714 + independent code in it and use mprotect() on it to make it
79715 + writable and copy his code there. While protecting against
79716 + the former approach is beyond PaX, the latter can be prevented
79717 + by having only PIC ELF libraries on one's system (which do not
79718 + need to relocate their code). If you are sure this is your case,
79719 + as is the case with all modern Linux distributions, then leave
79720 + this option disabled. You should say 'n' here.
79721 +
79722 +config PAX_ETEXECRELOCS
79723 + bool "Allow ELF ET_EXEC text relocations"
79724 + depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
79725 + select PAX_ELFRELOCS
79726 + default y
79727 + help
79728 + On some architectures there are incorrectly created applications
79729 + that require text relocations and would not work without enabling
79730 + this option. If you are an alpha, ia64 or parisc user, you should
79731 + enable this option and disable it once you have made sure that
79732 + none of your applications need it.
79733 +
79734 +config PAX_EMUPLT
79735 + bool "Automatically emulate ELF PLT"
79736 + depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
79737 + default y
79738 + help
79739 + Enabling this option will have the kernel automatically detect
79740 + and emulate the Procedure Linkage Table entries in ELF files.
79741 + On some architectures such entries are in writable memory, and
79742 + become non-executable leading to task termination. Therefore
79743 + it is mandatory that you enable this option on alpha, parisc,
79744 + sparc and sparc64, otherwise your system would not even boot.
79745 +
79746 + NOTE: this feature *does* open up a loophole in the protection
79747 + provided by the non-executable pages, therefore the proper
79748 + solution is to modify the toolchain to produce a PLT that does
79749 + not need to be writable.
79750 +
79751 +config PAX_DLRESOLVE
79752 + bool 'Emulate old glibc resolver stub'
79753 + depends on PAX_EMUPLT && SPARC
79754 + default n
79755 + help
79756 + This option is needed if userland has an old glibc (before 2.4)
79757 + that puts a 'save' instruction into the runtime generated resolver
79758 + stub that needs special emulation.
79759 +
79760 +config PAX_KERNEXEC
79761 + bool "Enforce non-executable kernel pages"
79762 + depends on (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
79763 + select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
79764 + select PAX_KERNEXEC_PLUGIN if X86_64
79765 + help
79766 + This is the kernel land equivalent of PAGEEXEC and MPROTECT,
79767 + that is, enabling this option will make it harder to inject
79768 + and execute 'foreign' code in kernel memory itself.
79769 +
79770 + Note that on x86_64 kernels there is a known regression when
79771 + this feature and KVM/VMX are both enabled in the host kernel.
79772 +
79773 +config PAX_KERNEXEC_MODULE_TEXT
79774 + int "Minimum amount of memory reserved for module code"
79775 + default "4"
79776 + depends on PAX_KERNEXEC && X86_32 && MODULES
79777 + help
79778 + Due to implementation details the kernel must reserve a fixed
79779 + amount of memory for module code at compile time that cannot be
79780 + changed at runtime. Here you can specify the minimum amount
79781 + in MB that will be reserved. Due to the same implementation
79782 + details this size will always be rounded up to the next 2/4 MB
79783 + boundary (depends on PAE) so the actually available memory for
79784 + module code will usually be more than this minimum.
79785 +
79786 + The default 4 MB should be enough for most users but if you have
79787 + an excessive number of modules (e.g., most distribution configs
79788 + compile many drivers as modules) or use huge modules such as
79789 + nvidia's kernel driver, you will need to adjust this amount.
79790 + A good rule of thumb is to look at your currently loaded kernel
79791 + modules and add up their sizes.
79792 +
79793 +endmenu
79794 +
79795 +menu "Address Space Layout Randomization"
79796 + depends on PAX
79797 +
79798 +config PAX_ASLR
79799 + bool "Address Space Layout Randomization"
79800 + depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
79801 + help
79802 + Many if not most exploit techniques rely on the knowledge of
79803 + certain addresses in the attacked program. The following options
79804 + will allow the kernel to apply a certain amount of randomization
79805 + to specific parts of the program thereby forcing an attacker to
79806 + guess them in most cases. Any failed guess will most likely crash
79807 + the attacked program which allows the kernel to detect such attempts
79808 + and react on them. PaX itself provides no reaction mechanisms,
79809 + instead it is strongly encouraged that you make use of Nergal's
79810 + segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
79811 + (http://www.grsecurity.net/) built-in crash detection features or
79812 + develop one yourself.
79813 +
79814 + By saying Y here you can choose to randomize the following areas:
79815 + - top of the task's kernel stack
79816 + - top of the task's userland stack
79817 + - base address for mmap() requests that do not specify one
79818 + (this includes all libraries)
79819 + - base address of the main executable
79820 +
79821 + It is strongly recommended to say Y here as address space layout
79822 + randomization has negligible impact on performance yet it provides
79823 + a very effective protection.
79824 +
79825 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
79826 + this feature on a per file basis.
79827 +
79828 +config PAX_RANDKSTACK
79829 + bool "Randomize kernel stack base"
79830 + depends on X86_TSC && X86
79831 + help
79832 + By saying Y here the kernel will randomize every task's kernel
79833 + stack on every system call. This will not only force an attacker
79834 + to guess it but also prevent him from making use of possible
79835 + leaked information about it.
79836 +
79837 + Since the kernel stack is a rather scarce resource, randomization
79838 + may cause unexpected stack overflows, therefore you should very
79839 + carefully test your system. Note that once enabled in the kernel
79840 + configuration, this feature cannot be disabled on a per file basis.
79841 +
79842 +config PAX_RANDUSTACK
79843 + bool "Randomize user stack base"
79844 + depends on PAX_ASLR
79845 + help
79846 + By saying Y here the kernel will randomize every task's userland
79847 + stack. The randomization is done in two steps where the second
79848 + one may apply a big amount of shift to the top of the stack and
79849 + cause problems for programs that want to use lots of memory (more
79850 + than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
79851 + For this reason the second step can be controlled by 'chpax' or
79852 + 'paxctl' on a per file basis.
79853 +
79854 +config PAX_RANDMMAP
79855 + bool "Randomize mmap() base"
79856 + depends on PAX_ASLR
79857 + help
79858 + By saying Y here the kernel will use a randomized base address for
79859 + mmap() requests that do not specify one themselves. As a result
79860 + all dynamically loaded libraries will appear at random addresses
79861 + and therefore be harder to exploit by a technique where an attacker
79862 + attempts to execute library code for his purposes (e.g. spawn a
79863 + shell from an exploited program that is running at an elevated
79864 + privilege level).
79865 +
79866 + Furthermore, if a program is relinked as a dynamic ELF file, its
79867 + base address will be randomized as well, completing the full
79868 + randomization of the address space layout. Attacking such programs
79869 + becomes a guess game. You can find an example of doing this at
79870 + http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
79871 + http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
79872 +
79873 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
79874 + feature on a per file basis.
79875 +
79876 +endmenu
79877 +
79878 +menu "Miscellaneous hardening features"
79879 +
79880 +config PAX_MEMORY_SANITIZE
79881 + bool "Sanitize all freed memory"
79882 + help
79883 + By saying Y here the kernel will erase memory pages as soon as they
79884 + are freed. This in turn reduces the lifetime of data stored in the
79885 + pages, making it less likely that sensitive information such as
79886 + passwords, cryptographic secrets, etc stay in memory for too long.
79887 +
79888 + This is especially useful for programs whose runtime is short, long
79889 + lived processes and the kernel itself benefit from this as long as
79890 + they operate on whole memory pages and ensure timely freeing of pages
79891 + that may hold sensitive information.
79892 +
79893 + The tradeoff is performance impact, on a single CPU system kernel
79894 + compilation sees a 3% slowdown, other systems and workloads may vary
79895 + and you are advised to test this feature on your expected workload
79896 + before deploying it.
79897 +
79898 + Note that this feature does not protect data stored in live pages,
79899 + e.g., process memory swapped to disk may stay there for a long time.
79900 +
79901 +config PAX_MEMORY_STACKLEAK
79902 + bool "Sanitize kernel stack"
79903 + depends on X86
79904 + help
79905 + By saying Y here the kernel will erase the kernel stack before it
79906 + returns from a system call. This in turn reduces the information
79907 + that a kernel stack leak bug can reveal.
79908 +
79909 + Note that such a bug can still leak information that was put on
79910 + the stack by the current system call (the one eventually triggering
79911 + the bug) but traces of earlier system calls on the kernel stack
79912 + cannot leak anymore.
79913 +
79914 + The tradeoff is performance impact, on a single CPU system kernel
79915 + compilation sees a 1% slowdown, other systems and workloads may vary
79916 + and you are advised to test this feature on your expected workload
79917 + before deploying it.
79918 +
79919 + Note: full support for this feature requires gcc with plugin support
79920 + so make sure your compiler is at least gcc 4.5.0 (cross compilation
79921 + is not supported). Using older gcc versions means that functions
79922 + with large enough stack frames may leave uninitialized memory behind
79923 + that may be exposed to a later syscall leaking the stack.
79924 +
79925 +config PAX_MEMORY_UDEREF
79926 + bool "Prevent invalid userland pointer dereference"
79927 + depends on X86 && !UML_X86 && !XEN
79928 + select PAX_PER_CPU_PGD if X86_64
79929 + help
79930 + By saying Y here the kernel will be prevented from dereferencing
79931 + userland pointers in contexts where the kernel expects only kernel
79932 + pointers. This is both a useful runtime debugging feature and a
79933 + security measure that prevents exploiting a class of kernel bugs.
79934 +
79935 + The tradeoff is that some virtualization solutions may experience
79936 + a huge slowdown and therefore you should not enable this feature
79937 + for kernels meant to run in such environments. Whether a given VM
79938 + solution is affected or not is best determined by simply trying it
79939 + out, the performance impact will be obvious right on boot as this
79940 + mechanism engages from very early on. A good rule of thumb is that
79941 + VMs running on CPUs without hardware virtualization support (i.e.,
79942 + the majority of IA-32 CPUs) will likely experience the slowdown.
79943 +
79944 +config PAX_REFCOUNT
79945 + bool "Prevent various kernel object reference counter overflows"
79946 + depends on GRKERNSEC && (X86 || SPARC64)
79947 + help
79948 + By saying Y here the kernel will detect and prevent overflowing
79949 + various (but not all) kinds of object reference counters. Such
79950 + overflows can normally occur due to bugs only and are often, if
79951 + not always, exploitable.
79952 +
79953 + The tradeoff is that data structures protected by an overflowed
79954 + refcount will never be freed and therefore will leak memory. Note
79955 + that this leak also happens even without this protection but in
79956 + that case the overflow can eventually trigger the freeing of the
79957 + data structure while it is still being used elsewhere, resulting
79958 + in the exploitable situation that this feature prevents.
79959 +
79960 + Since this has a negligible performance impact, you should enable
79961 + this feature.
79962 +
79963 +config PAX_USERCOPY
79964 + bool "Harden heap object copies between kernel and userland"
79965 + depends on X86 || PPC || SPARC || ARM
79966 + depends on GRKERNSEC && (SLAB || SLUB || SLOB)
79967 + help
79968 + By saying Y here the kernel will enforce the size of heap objects
79969 + when they are copied in either direction between the kernel and
79970 + userland, even if only a part of the heap object is copied.
79971 +
79972 + Specifically, this checking prevents information leaking from the
79973 + kernel heap during kernel to userland copies (if the kernel heap
79974 + object is otherwise fully initialized) and prevents kernel heap
79975 + overflows during userland to kernel copies.
79976 +
79977 + Note that the current implementation provides the strictest bounds
79978 + checks for the SLUB allocator.
79979 +
79980 + Enabling this option also enables per-slab cache protection against
79981 + data in a given cache being copied into/out of via userland
79982 + accessors. Though the whitelist of regions will be reduced over
79983 + time, it notably protects important data structures like task structs.
79984 +
79985 +
79986 + If frame pointers are enabled on x86, this option will also
79987 + restrict copies into and out of the kernel stack to local variables
79988 + within a single frame.
79989 +
79990 + Since this has a negligible performance impact, you should enable
79991 + this feature.
79992 +
79993 +endmenu
79994 +
79995 +endmenu
79996 +
79997 config KEYS
79998 bool "Enable access key retention support"
79999 help
80000 @@ -146,7 +699,7 @@ config INTEL_TXT
80001 config LSM_MMAP_MIN_ADDR
80002 int "Low address space for LSM to protect from user allocation"
80003 depends on SECURITY && SECURITY_SELINUX
80004 - default 65536
80005 + default 32768
80006 help
80007 This is the portion of low virtual memory which should be protected
80008 from userspace allocation. Keeping a user from writing to low pages
80009 diff -urNp linux-2.6.32.46/security/keys/keyring.c linux-2.6.32.46/security/keys/keyring.c
80010 --- linux-2.6.32.46/security/keys/keyring.c 2011-03-27 14:31:47.000000000 -0400
80011 +++ linux-2.6.32.46/security/keys/keyring.c 2011-04-18 22:03:00.000000000 -0400
80012 @@ -214,15 +214,15 @@ static long keyring_read(const struct ke
80013 ret = -EFAULT;
80014
80015 for (loop = 0; loop < klist->nkeys; loop++) {
80016 + key_serial_t serial;
80017 key = klist->keys[loop];
80018 + serial = key->serial;
80019
80020 tmp = sizeof(key_serial_t);
80021 if (tmp > buflen)
80022 tmp = buflen;
80023
80024 - if (copy_to_user(buffer,
80025 - &key->serial,
80026 - tmp) != 0)
80027 + if (copy_to_user(buffer, &serial, tmp))
80028 goto error;
80029
80030 buflen -= tmp;
80031 diff -urNp linux-2.6.32.46/security/min_addr.c linux-2.6.32.46/security/min_addr.c
80032 --- linux-2.6.32.46/security/min_addr.c 2011-03-27 14:31:47.000000000 -0400
80033 +++ linux-2.6.32.46/security/min_addr.c 2011-04-17 15:56:46.000000000 -0400
80034 @@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
80035 */
80036 static void update_mmap_min_addr(void)
80037 {
80038 +#ifndef SPARC
80039 #ifdef CONFIG_LSM_MMAP_MIN_ADDR
80040 if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
80041 mmap_min_addr = dac_mmap_min_addr;
80042 @@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
80043 #else
80044 mmap_min_addr = dac_mmap_min_addr;
80045 #endif
80046 +#endif
80047 }
80048
80049 /*
80050 diff -urNp linux-2.6.32.46/security/root_plug.c linux-2.6.32.46/security/root_plug.c
80051 --- linux-2.6.32.46/security/root_plug.c 2011-03-27 14:31:47.000000000 -0400
80052 +++ linux-2.6.32.46/security/root_plug.c 2011-04-17 15:56:46.000000000 -0400
80053 @@ -70,7 +70,7 @@ static int rootplug_bprm_check_security
80054 return 0;
80055 }
80056
80057 -static struct security_operations rootplug_security_ops = {
80058 +static struct security_operations rootplug_security_ops __read_only = {
80059 .bprm_check_security = rootplug_bprm_check_security,
80060 };
80061
80062 diff -urNp linux-2.6.32.46/security/security.c linux-2.6.32.46/security/security.c
80063 --- linux-2.6.32.46/security/security.c 2011-03-27 14:31:47.000000000 -0400
80064 +++ linux-2.6.32.46/security/security.c 2011-04-17 15:56:46.000000000 -0400
80065 @@ -24,7 +24,7 @@ static __initdata char chosen_lsm[SECURI
80066 extern struct security_operations default_security_ops;
80067 extern void security_fixup_ops(struct security_operations *ops);
80068
80069 -struct security_operations *security_ops; /* Initialized to NULL */
80070 +struct security_operations *security_ops __read_only; /* Initialized to NULL */
80071
80072 static inline int verify(struct security_operations *ops)
80073 {
80074 @@ -106,7 +106,7 @@ int __init security_module_enable(struct
80075 * If there is already a security module registered with the kernel,
80076 * an error will be returned. Otherwise %0 is returned on success.
80077 */
80078 -int register_security(struct security_operations *ops)
80079 +int __init register_security(struct security_operations *ops)
80080 {
80081 if (verify(ops)) {
80082 printk(KERN_DEBUG "%s could not verify "
80083 diff -urNp linux-2.6.32.46/security/selinux/hooks.c linux-2.6.32.46/security/selinux/hooks.c
80084 --- linux-2.6.32.46/security/selinux/hooks.c 2011-03-27 14:31:47.000000000 -0400
80085 +++ linux-2.6.32.46/security/selinux/hooks.c 2011-04-17 15:56:46.000000000 -0400
80086 @@ -131,7 +131,7 @@ int selinux_enabled = 1;
80087 * Minimal support for a secondary security module,
80088 * just to allow the use of the capability module.
80089 */
80090 -static struct security_operations *secondary_ops;
80091 +static struct security_operations *secondary_ops __read_only;
80092
80093 /* Lists of inode and superblock security structures initialized
80094 before the policy was loaded. */
80095 @@ -5457,7 +5457,7 @@ static int selinux_key_getsecurity(struc
80096
80097 #endif
80098
80099 -static struct security_operations selinux_ops = {
80100 +static struct security_operations selinux_ops __read_only = {
80101 .name = "selinux",
80102
80103 .ptrace_access_check = selinux_ptrace_access_check,
80104 @@ -5841,7 +5841,9 @@ int selinux_disable(void)
80105 avc_disable();
80106
80107 /* Reset security_ops to the secondary module, dummy or capability. */
80108 + pax_open_kernel();
80109 security_ops = secondary_ops;
80110 + pax_close_kernel();
80111
80112 /* Unregister netfilter hooks. */
80113 selinux_nf_ip_exit();
80114 diff -urNp linux-2.6.32.46/security/selinux/include/xfrm.h linux-2.6.32.46/security/selinux/include/xfrm.h
80115 --- linux-2.6.32.46/security/selinux/include/xfrm.h 2011-03-27 14:31:47.000000000 -0400
80116 +++ linux-2.6.32.46/security/selinux/include/xfrm.h 2011-05-18 20:09:37.000000000 -0400
80117 @@ -48,7 +48,7 @@ int selinux_xfrm_decode_session(struct s
80118
80119 static inline void selinux_xfrm_notify_policyload(void)
80120 {
80121 - atomic_inc(&flow_cache_genid);
80122 + atomic_inc_unchecked(&flow_cache_genid);
80123 }
80124 #else
80125 static inline int selinux_xfrm_enabled(void)
80126 diff -urNp linux-2.6.32.46/security/selinux/ss/services.c linux-2.6.32.46/security/selinux/ss/services.c
80127 --- linux-2.6.32.46/security/selinux/ss/services.c 2011-03-27 14:31:47.000000000 -0400
80128 +++ linux-2.6.32.46/security/selinux/ss/services.c 2011-05-16 21:46:57.000000000 -0400
80129 @@ -1715,6 +1715,8 @@ int security_load_policy(void *data, siz
80130 int rc = 0;
80131 struct policy_file file = { data, len }, *fp = &file;
80132
80133 + pax_track_stack();
80134 +
80135 if (!ss_initialized) {
80136 avtab_cache_init();
80137 if (policydb_read(&policydb, fp)) {
80138 diff -urNp linux-2.6.32.46/security/smack/smack_lsm.c linux-2.6.32.46/security/smack/smack_lsm.c
80139 --- linux-2.6.32.46/security/smack/smack_lsm.c 2011-03-27 14:31:47.000000000 -0400
80140 +++ linux-2.6.32.46/security/smack/smack_lsm.c 2011-04-17 15:56:46.000000000 -0400
80141 @@ -3073,7 +3073,7 @@ static int smack_inode_getsecctx(struct
80142 return 0;
80143 }
80144
80145 -struct security_operations smack_ops = {
80146 +struct security_operations smack_ops __read_only = {
80147 .name = "smack",
80148
80149 .ptrace_access_check = smack_ptrace_access_check,
80150 diff -urNp linux-2.6.32.46/security/tomoyo/tomoyo.c linux-2.6.32.46/security/tomoyo/tomoyo.c
80151 --- linux-2.6.32.46/security/tomoyo/tomoyo.c 2011-03-27 14:31:47.000000000 -0400
80152 +++ linux-2.6.32.46/security/tomoyo/tomoyo.c 2011-04-17 15:56:46.000000000 -0400
80153 @@ -275,7 +275,7 @@ static int tomoyo_dentry_open(struct fil
80154 * tomoyo_security_ops is a "struct security_operations" which is used for
80155 * registering TOMOYO.
80156 */
80157 -static struct security_operations tomoyo_security_ops = {
80158 +static struct security_operations tomoyo_security_ops __read_only = {
80159 .name = "tomoyo",
80160 .cred_alloc_blank = tomoyo_cred_alloc_blank,
80161 .cred_prepare = tomoyo_cred_prepare,
80162 diff -urNp linux-2.6.32.46/sound/aoa/codecs/onyx.c linux-2.6.32.46/sound/aoa/codecs/onyx.c
80163 --- linux-2.6.32.46/sound/aoa/codecs/onyx.c 2011-03-27 14:31:47.000000000 -0400
80164 +++ linux-2.6.32.46/sound/aoa/codecs/onyx.c 2011-04-17 15:56:46.000000000 -0400
80165 @@ -53,7 +53,7 @@ struct onyx {
80166 spdif_locked:1,
80167 analog_locked:1,
80168 original_mute:2;
80169 - int open_count;
80170 + local_t open_count;
80171 struct codec_info *codec_info;
80172
80173 /* mutex serializes concurrent access to the device
80174 @@ -752,7 +752,7 @@ static int onyx_open(struct codec_info_i
80175 struct onyx *onyx = cii->codec_data;
80176
80177 mutex_lock(&onyx->mutex);
80178 - onyx->open_count++;
80179 + local_inc(&onyx->open_count);
80180 mutex_unlock(&onyx->mutex);
80181
80182 return 0;
80183 @@ -764,8 +764,7 @@ static int onyx_close(struct codec_info_
80184 struct onyx *onyx = cii->codec_data;
80185
80186 mutex_lock(&onyx->mutex);
80187 - onyx->open_count--;
80188 - if (!onyx->open_count)
80189 + if (local_dec_and_test(&onyx->open_count))
80190 onyx->spdif_locked = onyx->analog_locked = 0;
80191 mutex_unlock(&onyx->mutex);
80192
80193 diff -urNp linux-2.6.32.46/sound/aoa/codecs/onyx.h linux-2.6.32.46/sound/aoa/codecs/onyx.h
80194 --- linux-2.6.32.46/sound/aoa/codecs/onyx.h 2011-03-27 14:31:47.000000000 -0400
80195 +++ linux-2.6.32.46/sound/aoa/codecs/onyx.h 2011-04-17 15:56:46.000000000 -0400
80196 @@ -11,6 +11,7 @@
80197 #include <linux/i2c.h>
80198 #include <asm/pmac_low_i2c.h>
80199 #include <asm/prom.h>
80200 +#include <asm/local.h>
80201
80202 /* PCM3052 register definitions */
80203
80204 diff -urNp linux-2.6.32.46/sound/core/oss/pcm_oss.c linux-2.6.32.46/sound/core/oss/pcm_oss.c
80205 --- linux-2.6.32.46/sound/core/oss/pcm_oss.c 2011-03-27 14:31:47.000000000 -0400
80206 +++ linux-2.6.32.46/sound/core/oss/pcm_oss.c 2011-10-06 09:37:16.000000000 -0400
80207 @@ -1395,7 +1395,7 @@ static ssize_t snd_pcm_oss_write1(struct
80208 }
80209 } else {
80210 tmp = snd_pcm_oss_write2(substream,
80211 - (const char __force *)buf,
80212 + (const char __force_kernel *)buf,
80213 runtime->oss.period_bytes, 0);
80214 if (tmp <= 0)
80215 goto err;
80216 @@ -1483,7 +1483,7 @@ static ssize_t snd_pcm_oss_read1(struct
80217 xfer += tmp;
80218 runtime->oss.buffer_used -= tmp;
80219 } else {
80220 - tmp = snd_pcm_oss_read2(substream, (char __force *)buf,
80221 + tmp = snd_pcm_oss_read2(substream, (char __force_kernel *)buf,
80222 runtime->oss.period_bytes, 0);
80223 if (tmp <= 0)
80224 goto err;
80225 diff -urNp linux-2.6.32.46/sound/core/pcm_compat.c linux-2.6.32.46/sound/core/pcm_compat.c
80226 --- linux-2.6.32.46/sound/core/pcm_compat.c 2011-08-09 18:35:30.000000000 -0400
80227 +++ linux-2.6.32.46/sound/core/pcm_compat.c 2011-10-06 09:37:16.000000000 -0400
80228 @@ -30,7 +30,7 @@ static int snd_pcm_ioctl_delay_compat(st
80229 int err;
80230
80231 fs = snd_enter_user();
80232 - err = snd_pcm_delay(substream, &delay);
80233 + err = snd_pcm_delay(substream, (snd_pcm_sframes_t __force_user *)&delay);
80234 snd_leave_user(fs);
80235 if (err < 0)
80236 return err;
80237 diff -urNp linux-2.6.32.46/sound/core/pcm_native.c linux-2.6.32.46/sound/core/pcm_native.c
80238 --- linux-2.6.32.46/sound/core/pcm_native.c 2011-03-27 14:31:47.000000000 -0400
80239 +++ linux-2.6.32.46/sound/core/pcm_native.c 2011-10-06 09:37:16.000000000 -0400
80240 @@ -2747,11 +2747,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_
80241 switch (substream->stream) {
80242 case SNDRV_PCM_STREAM_PLAYBACK:
80243 result = snd_pcm_playback_ioctl1(NULL, substream, cmd,
80244 - (void __user *)arg);
80245 + (void __force_user *)arg);
80246 break;
80247 case SNDRV_PCM_STREAM_CAPTURE:
80248 result = snd_pcm_capture_ioctl1(NULL, substream, cmd,
80249 - (void __user *)arg);
80250 + (void __force_user *)arg);
80251 break;
80252 default:
80253 result = -EINVAL;
80254 diff -urNp linux-2.6.32.46/sound/core/seq/seq_device.c linux-2.6.32.46/sound/core/seq/seq_device.c
80255 --- linux-2.6.32.46/sound/core/seq/seq_device.c 2011-03-27 14:31:47.000000000 -0400
80256 +++ linux-2.6.32.46/sound/core/seq/seq_device.c 2011-08-05 20:33:55.000000000 -0400
80257 @@ -63,7 +63,7 @@ struct ops_list {
80258 int argsize; /* argument size */
80259
80260 /* operators */
80261 - struct snd_seq_dev_ops ops;
80262 + struct snd_seq_dev_ops *ops;
80263
80264 /* registred devices */
80265 struct list_head dev_list; /* list of devices */
80266 @@ -332,7 +332,7 @@ int snd_seq_device_register_driver(char
80267
80268 mutex_lock(&ops->reg_mutex);
80269 /* copy driver operators */
80270 - ops->ops = *entry;
80271 + ops->ops = entry;
80272 ops->driver |= DRIVER_LOADED;
80273 ops->argsize = argsize;
80274
80275 @@ -462,7 +462,7 @@ static int init_device(struct snd_seq_de
80276 dev->name, ops->id, ops->argsize, dev->argsize);
80277 return -EINVAL;
80278 }
80279 - if (ops->ops.init_device(dev) >= 0) {
80280 + if (ops->ops->init_device(dev) >= 0) {
80281 dev->status = SNDRV_SEQ_DEVICE_REGISTERED;
80282 ops->num_init_devices++;
80283 } else {
80284 @@ -489,7 +489,7 @@ static int free_device(struct snd_seq_de
80285 dev->name, ops->id, ops->argsize, dev->argsize);
80286 return -EINVAL;
80287 }
80288 - if ((result = ops->ops.free_device(dev)) >= 0 || result == -ENXIO) {
80289 + if ((result = ops->ops->free_device(dev)) >= 0 || result == -ENXIO) {
80290 dev->status = SNDRV_SEQ_DEVICE_FREE;
80291 dev->driver_data = NULL;
80292 ops->num_init_devices--;
80293 diff -urNp linux-2.6.32.46/sound/drivers/mts64.c linux-2.6.32.46/sound/drivers/mts64.c
80294 --- linux-2.6.32.46/sound/drivers/mts64.c 2011-03-27 14:31:47.000000000 -0400
80295 +++ linux-2.6.32.46/sound/drivers/mts64.c 2011-04-17 15:56:46.000000000 -0400
80296 @@ -27,6 +27,7 @@
80297 #include <sound/initval.h>
80298 #include <sound/rawmidi.h>
80299 #include <sound/control.h>
80300 +#include <asm/local.h>
80301
80302 #define CARD_NAME "Miditerminal 4140"
80303 #define DRIVER_NAME "MTS64"
80304 @@ -65,7 +66,7 @@ struct mts64 {
80305 struct pardevice *pardev;
80306 int pardev_claimed;
80307
80308 - int open_count;
80309 + local_t open_count;
80310 int current_midi_output_port;
80311 int current_midi_input_port;
80312 u8 mode[MTS64_NUM_INPUT_PORTS];
80313 @@ -695,7 +696,7 @@ static int snd_mts64_rawmidi_open(struct
80314 {
80315 struct mts64 *mts = substream->rmidi->private_data;
80316
80317 - if (mts->open_count == 0) {
80318 + if (local_read(&mts->open_count) == 0) {
80319 /* We don't need a spinlock here, because this is just called
80320 if the device has not been opened before.
80321 So there aren't any IRQs from the device */
80322 @@ -703,7 +704,7 @@ static int snd_mts64_rawmidi_open(struct
80323
80324 msleep(50);
80325 }
80326 - ++(mts->open_count);
80327 + local_inc(&mts->open_count);
80328
80329 return 0;
80330 }
80331 @@ -713,8 +714,7 @@ static int snd_mts64_rawmidi_close(struc
80332 struct mts64 *mts = substream->rmidi->private_data;
80333 unsigned long flags;
80334
80335 - --(mts->open_count);
80336 - if (mts->open_count == 0) {
80337 + if (local_dec_return(&mts->open_count) == 0) {
80338 /* We need the spinlock_irqsave here because we can still
80339 have IRQs at this point */
80340 spin_lock_irqsave(&mts->lock, flags);
80341 @@ -723,8 +723,8 @@ static int snd_mts64_rawmidi_close(struc
80342
80343 msleep(500);
80344
80345 - } else if (mts->open_count < 0)
80346 - mts->open_count = 0;
80347 + } else if (local_read(&mts->open_count) < 0)
80348 + local_set(&mts->open_count, 0);
80349
80350 return 0;
80351 }
80352 diff -urNp linux-2.6.32.46/sound/drivers/opl4/opl4_lib.c linux-2.6.32.46/sound/drivers/opl4/opl4_lib.c
80353 --- linux-2.6.32.46/sound/drivers/opl4/opl4_lib.c 2011-03-27 14:31:47.000000000 -0400
80354 +++ linux-2.6.32.46/sound/drivers/opl4/opl4_lib.c 2011-08-05 20:33:55.000000000 -0400
80355 @@ -27,7 +27,7 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@
80356 MODULE_DESCRIPTION("OPL4 driver");
80357 MODULE_LICENSE("GPL");
80358
80359 -static void inline snd_opl4_wait(struct snd_opl4 *opl4)
80360 +static inline void snd_opl4_wait(struct snd_opl4 *opl4)
80361 {
80362 int timeout = 10;
80363 while ((inb(opl4->fm_port) & OPL4_STATUS_BUSY) && --timeout > 0)
80364 diff -urNp linux-2.6.32.46/sound/drivers/portman2x4.c linux-2.6.32.46/sound/drivers/portman2x4.c
80365 --- linux-2.6.32.46/sound/drivers/portman2x4.c 2011-03-27 14:31:47.000000000 -0400
80366 +++ linux-2.6.32.46/sound/drivers/portman2x4.c 2011-04-17 15:56:46.000000000 -0400
80367 @@ -46,6 +46,7 @@
80368 #include <sound/initval.h>
80369 #include <sound/rawmidi.h>
80370 #include <sound/control.h>
80371 +#include <asm/local.h>
80372
80373 #define CARD_NAME "Portman 2x4"
80374 #define DRIVER_NAME "portman"
80375 @@ -83,7 +84,7 @@ struct portman {
80376 struct pardevice *pardev;
80377 int pardev_claimed;
80378
80379 - int open_count;
80380 + local_t open_count;
80381 int mode[PORTMAN_NUM_INPUT_PORTS];
80382 struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
80383 };
80384 diff -urNp linux-2.6.32.46/sound/isa/cmi8330.c linux-2.6.32.46/sound/isa/cmi8330.c
80385 --- linux-2.6.32.46/sound/isa/cmi8330.c 2011-03-27 14:31:47.000000000 -0400
80386 +++ linux-2.6.32.46/sound/isa/cmi8330.c 2011-08-23 21:22:32.000000000 -0400
80387 @@ -173,7 +173,7 @@ struct snd_cmi8330 {
80388
80389 struct snd_pcm *pcm;
80390 struct snd_cmi8330_stream {
80391 - struct snd_pcm_ops ops;
80392 + snd_pcm_ops_no_const ops;
80393 snd_pcm_open_callback_t open;
80394 void *private_data; /* sb or wss */
80395 } streams[2];
80396 diff -urNp linux-2.6.32.46/sound/oss/sb_audio.c linux-2.6.32.46/sound/oss/sb_audio.c
80397 --- linux-2.6.32.46/sound/oss/sb_audio.c 2011-03-27 14:31:47.000000000 -0400
80398 +++ linux-2.6.32.46/sound/oss/sb_audio.c 2011-04-17 15:56:46.000000000 -0400
80399 @@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
80400 buf16 = (signed short *)(localbuf + localoffs);
80401 while (c)
80402 {
80403 - locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
80404 + locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
80405 if (copy_from_user(lbuf8,
80406 userbuf+useroffs + p,
80407 locallen))
80408 diff -urNp linux-2.6.32.46/sound/oss/swarm_cs4297a.c linux-2.6.32.46/sound/oss/swarm_cs4297a.c
80409 --- linux-2.6.32.46/sound/oss/swarm_cs4297a.c 2011-03-27 14:31:47.000000000 -0400
80410 +++ linux-2.6.32.46/sound/oss/swarm_cs4297a.c 2011-04-17 15:56:46.000000000 -0400
80411 @@ -2577,7 +2577,6 @@ static int __init cs4297a_init(void)
80412 {
80413 struct cs4297a_state *s;
80414 u32 pwr, id;
80415 - mm_segment_t fs;
80416 int rval;
80417 #ifndef CONFIG_BCM_CS4297A_CSWARM
80418 u64 cfg;
80419 @@ -2667,22 +2666,23 @@ static int __init cs4297a_init(void)
80420 if (!rval) {
80421 char *sb1250_duart_present;
80422
80423 +#if 0
80424 + mm_segment_t fs;
80425 fs = get_fs();
80426 set_fs(KERNEL_DS);
80427 -#if 0
80428 val = SOUND_MASK_LINE;
80429 mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
80430 for (i = 0; i < ARRAY_SIZE(initvol); i++) {
80431 val = initvol[i].vol;
80432 mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
80433 }
80434 + set_fs(fs);
80435 // cs4297a_write_ac97(s, 0x18, 0x0808);
80436 #else
80437 // cs4297a_write_ac97(s, 0x5e, 0x180);
80438 cs4297a_write_ac97(s, 0x02, 0x0808);
80439 cs4297a_write_ac97(s, 0x18, 0x0808);
80440 #endif
80441 - set_fs(fs);
80442
80443 list_add(&s->list, &cs4297a_devs);
80444
80445 diff -urNp linux-2.6.32.46/sound/pci/ac97/ac97_codec.c linux-2.6.32.46/sound/pci/ac97/ac97_codec.c
80446 --- linux-2.6.32.46/sound/pci/ac97/ac97_codec.c 2011-03-27 14:31:47.000000000 -0400
80447 +++ linux-2.6.32.46/sound/pci/ac97/ac97_codec.c 2011-04-17 15:56:46.000000000 -0400
80448 @@ -1952,7 +1952,7 @@ static int snd_ac97_dev_disconnect(struc
80449 }
80450
80451 /* build_ops to do nothing */
80452 -static struct snd_ac97_build_ops null_build_ops;
80453 +static const struct snd_ac97_build_ops null_build_ops;
80454
80455 #ifdef CONFIG_SND_AC97_POWER_SAVE
80456 static void do_update_power(struct work_struct *work)
80457 diff -urNp linux-2.6.32.46/sound/pci/ac97/ac97_patch.c linux-2.6.32.46/sound/pci/ac97/ac97_patch.c
80458 --- linux-2.6.32.46/sound/pci/ac97/ac97_patch.c 2011-08-29 22:24:44.000000000 -0400
80459 +++ linux-2.6.32.46/sound/pci/ac97/ac97_patch.c 2011-08-29 22:25:07.000000000 -0400
80460 @@ -371,7 +371,7 @@ static int patch_yamaha_ymf743_build_spd
80461 return 0;
80462 }
80463
80464 -static struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
80465 +static const struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
80466 .build_spdif = patch_yamaha_ymf743_build_spdif,
80467 .build_3d = patch_yamaha_ymf7x3_3d,
80468 };
80469 @@ -455,7 +455,7 @@ static int patch_yamaha_ymf753_post_spdi
80470 return 0;
80471 }
80472
80473 -static struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
80474 +static const struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
80475 .build_3d = patch_yamaha_ymf7x3_3d,
80476 .build_post_spdif = patch_yamaha_ymf753_post_spdif
80477 };
80478 @@ -502,7 +502,7 @@ static int patch_wolfson_wm9703_specific
80479 return 0;
80480 }
80481
80482 -static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
80483 +static const struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
80484 .build_specific = patch_wolfson_wm9703_specific,
80485 };
80486
80487 @@ -533,7 +533,7 @@ static int patch_wolfson_wm9704_specific
80488 return 0;
80489 }
80490
80491 -static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
80492 +static const struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
80493 .build_specific = patch_wolfson_wm9704_specific,
80494 };
80495
80496 @@ -555,7 +555,7 @@ static int patch_wolfson_wm9705_specific
80497 return 0;
80498 }
80499
80500 -static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
80501 +static const struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
80502 .build_specific = patch_wolfson_wm9705_specific,
80503 };
80504
80505 @@ -692,7 +692,7 @@ static int patch_wolfson_wm9711_specific
80506 return 0;
80507 }
80508
80509 -static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
80510 +static const struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
80511 .build_specific = patch_wolfson_wm9711_specific,
80512 };
80513
80514 @@ -886,7 +886,7 @@ static void patch_wolfson_wm9713_resume
80515 }
80516 #endif
80517
80518 -static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
80519 +static const struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
80520 .build_specific = patch_wolfson_wm9713_specific,
80521 .build_3d = patch_wolfson_wm9713_3d,
80522 #ifdef CONFIG_PM
80523 @@ -991,7 +991,7 @@ static int patch_sigmatel_stac97xx_speci
80524 return 0;
80525 }
80526
80527 -static struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
80528 +static const struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
80529 .build_3d = patch_sigmatel_stac9700_3d,
80530 .build_specific = patch_sigmatel_stac97xx_specific
80531 };
80532 @@ -1038,7 +1038,7 @@ static int patch_sigmatel_stac9708_speci
80533 return patch_sigmatel_stac97xx_specific(ac97);
80534 }
80535
80536 -static struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
80537 +static const struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
80538 .build_3d = patch_sigmatel_stac9708_3d,
80539 .build_specific = patch_sigmatel_stac9708_specific
80540 };
80541 @@ -1267,7 +1267,7 @@ static int patch_sigmatel_stac9758_speci
80542 return 0;
80543 }
80544
80545 -static struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
80546 +static const struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
80547 .build_3d = patch_sigmatel_stac9700_3d,
80548 .build_specific = patch_sigmatel_stac9758_specific
80549 };
80550 @@ -1342,7 +1342,7 @@ static int patch_cirrus_build_spdif(stru
80551 return 0;
80552 }
80553
80554 -static struct snd_ac97_build_ops patch_cirrus_ops = {
80555 +static const struct snd_ac97_build_ops patch_cirrus_ops = {
80556 .build_spdif = patch_cirrus_build_spdif
80557 };
80558
80559 @@ -1399,7 +1399,7 @@ static int patch_conexant_build_spdif(st
80560 return 0;
80561 }
80562
80563 -static struct snd_ac97_build_ops patch_conexant_ops = {
80564 +static const struct snd_ac97_build_ops patch_conexant_ops = {
80565 .build_spdif = patch_conexant_build_spdif
80566 };
80567
80568 @@ -1575,7 +1575,7 @@ static void patch_ad1881_chained(struct
80569 }
80570 }
80571
80572 -static struct snd_ac97_build_ops patch_ad1881_build_ops = {
80573 +static const struct snd_ac97_build_ops patch_ad1881_build_ops = {
80574 #ifdef CONFIG_PM
80575 .resume = ad18xx_resume
80576 #endif
80577 @@ -1662,7 +1662,7 @@ static int patch_ad1885_specific(struct
80578 return 0;
80579 }
80580
80581 -static struct snd_ac97_build_ops patch_ad1885_build_ops = {
80582 +static const struct snd_ac97_build_ops patch_ad1885_build_ops = {
80583 .build_specific = &patch_ad1885_specific,
80584 #ifdef CONFIG_PM
80585 .resume = ad18xx_resume
80586 @@ -1689,7 +1689,7 @@ static int patch_ad1886_specific(struct
80587 return 0;
80588 }
80589
80590 -static struct snd_ac97_build_ops patch_ad1886_build_ops = {
80591 +static const struct snd_ac97_build_ops patch_ad1886_build_ops = {
80592 .build_specific = &patch_ad1886_specific,
80593 #ifdef CONFIG_PM
80594 .resume = ad18xx_resume
80595 @@ -1896,7 +1896,7 @@ static int patch_ad1981a_specific(struct
80596 ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
80597 }
80598
80599 -static struct snd_ac97_build_ops patch_ad1981a_build_ops = {
80600 +static const struct snd_ac97_build_ops patch_ad1981a_build_ops = {
80601 .build_post_spdif = patch_ad198x_post_spdif,
80602 .build_specific = patch_ad1981a_specific,
80603 #ifdef CONFIG_PM
80604 @@ -1952,7 +1952,7 @@ static int patch_ad1981b_specific(struct
80605 ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
80606 }
80607
80608 -static struct snd_ac97_build_ops patch_ad1981b_build_ops = {
80609 +static const struct snd_ac97_build_ops patch_ad1981b_build_ops = {
80610 .build_post_spdif = patch_ad198x_post_spdif,
80611 .build_specific = patch_ad1981b_specific,
80612 #ifdef CONFIG_PM
80613 @@ -2091,7 +2091,7 @@ static int patch_ad1888_specific(struct
80614 return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
80615 }
80616
80617 -static struct snd_ac97_build_ops patch_ad1888_build_ops = {
80618 +static const struct snd_ac97_build_ops patch_ad1888_build_ops = {
80619 .build_post_spdif = patch_ad198x_post_spdif,
80620 .build_specific = patch_ad1888_specific,
80621 #ifdef CONFIG_PM
80622 @@ -2140,7 +2140,7 @@ static int patch_ad1980_specific(struct
80623 return patch_build_controls(ac97, &snd_ac97_ad198x_2cmic, 1);
80624 }
80625
80626 -static struct snd_ac97_build_ops patch_ad1980_build_ops = {
80627 +static const struct snd_ac97_build_ops patch_ad1980_build_ops = {
80628 .build_post_spdif = patch_ad198x_post_spdif,
80629 .build_specific = patch_ad1980_specific,
80630 #ifdef CONFIG_PM
80631 @@ -2255,7 +2255,7 @@ static int patch_ad1985_specific(struct
80632 ARRAY_SIZE(snd_ac97_ad1985_controls));
80633 }
80634
80635 -static struct snd_ac97_build_ops patch_ad1985_build_ops = {
80636 +static const struct snd_ac97_build_ops patch_ad1985_build_ops = {
80637 .build_post_spdif = patch_ad198x_post_spdif,
80638 .build_specific = patch_ad1985_specific,
80639 #ifdef CONFIG_PM
80640 @@ -2547,7 +2547,7 @@ static int patch_ad1986_specific(struct
80641 ARRAY_SIZE(snd_ac97_ad1985_controls));
80642 }
80643
80644 -static struct snd_ac97_build_ops patch_ad1986_build_ops = {
80645 +static const struct snd_ac97_build_ops patch_ad1986_build_ops = {
80646 .build_post_spdif = patch_ad198x_post_spdif,
80647 .build_specific = patch_ad1986_specific,
80648 #ifdef CONFIG_PM
80649 @@ -2652,7 +2652,7 @@ static int patch_alc650_specific(struct
80650 return 0;
80651 }
80652
80653 -static struct snd_ac97_build_ops patch_alc650_ops = {
80654 +static const struct snd_ac97_build_ops patch_alc650_ops = {
80655 .build_specific = patch_alc650_specific,
80656 .update_jacks = alc650_update_jacks
80657 };
80658 @@ -2804,7 +2804,7 @@ static int patch_alc655_specific(struct
80659 return 0;
80660 }
80661
80662 -static struct snd_ac97_build_ops patch_alc655_ops = {
80663 +static const struct snd_ac97_build_ops patch_alc655_ops = {
80664 .build_specific = patch_alc655_specific,
80665 .update_jacks = alc655_update_jacks
80666 };
80667 @@ -2916,7 +2916,7 @@ static int patch_alc850_specific(struct
80668 return 0;
80669 }
80670
80671 -static struct snd_ac97_build_ops patch_alc850_ops = {
80672 +static const struct snd_ac97_build_ops patch_alc850_ops = {
80673 .build_specific = patch_alc850_specific,
80674 .update_jacks = alc850_update_jacks
80675 };
80676 @@ -2978,7 +2978,7 @@ static int patch_cm9738_specific(struct
80677 return patch_build_controls(ac97, snd_ac97_cm9738_controls, ARRAY_SIZE(snd_ac97_cm9738_controls));
80678 }
80679
80680 -static struct snd_ac97_build_ops patch_cm9738_ops = {
80681 +static const struct snd_ac97_build_ops patch_cm9738_ops = {
80682 .build_specific = patch_cm9738_specific,
80683 .update_jacks = cm9738_update_jacks
80684 };
80685 @@ -3069,7 +3069,7 @@ static int patch_cm9739_post_spdif(struc
80686 return patch_build_controls(ac97, snd_ac97_cm9739_controls_spdif, ARRAY_SIZE(snd_ac97_cm9739_controls_spdif));
80687 }
80688
80689 -static struct snd_ac97_build_ops patch_cm9739_ops = {
80690 +static const struct snd_ac97_build_ops patch_cm9739_ops = {
80691 .build_specific = patch_cm9739_specific,
80692 .build_post_spdif = patch_cm9739_post_spdif,
80693 .update_jacks = cm9739_update_jacks
80694 @@ -3243,7 +3243,7 @@ static int patch_cm9761_specific(struct
80695 return patch_build_controls(ac97, snd_ac97_cm9761_controls, ARRAY_SIZE(snd_ac97_cm9761_controls));
80696 }
80697
80698 -static struct snd_ac97_build_ops patch_cm9761_ops = {
80699 +static const struct snd_ac97_build_ops patch_cm9761_ops = {
80700 .build_specific = patch_cm9761_specific,
80701 .build_post_spdif = patch_cm9761_post_spdif,
80702 .update_jacks = cm9761_update_jacks
80703 @@ -3339,7 +3339,7 @@ static int patch_cm9780_specific(struct
80704 return patch_build_controls(ac97, cm9780_controls, ARRAY_SIZE(cm9780_controls));
80705 }
80706
80707 -static struct snd_ac97_build_ops patch_cm9780_ops = {
80708 +static const struct snd_ac97_build_ops patch_cm9780_ops = {
80709 .build_specific = patch_cm9780_specific,
80710 .build_post_spdif = patch_cm9761_post_spdif /* identical with CM9761 */
80711 };
80712 @@ -3459,7 +3459,7 @@ static int patch_vt1616_specific(struct
80713 return 0;
80714 }
80715
80716 -static struct snd_ac97_build_ops patch_vt1616_ops = {
80717 +static const struct snd_ac97_build_ops patch_vt1616_ops = {
80718 .build_specific = patch_vt1616_specific
80719 };
80720
80721 @@ -3813,7 +3813,7 @@ static int patch_it2646_specific(struct
80722 return 0;
80723 }
80724
80725 -static struct snd_ac97_build_ops patch_it2646_ops = {
80726 +static const struct snd_ac97_build_ops patch_it2646_ops = {
80727 .build_specific = patch_it2646_specific,
80728 .update_jacks = it2646_update_jacks
80729 };
80730 @@ -3847,7 +3847,7 @@ static int patch_si3036_specific(struct
80731 return 0;
80732 }
80733
80734 -static struct snd_ac97_build_ops patch_si3036_ops = {
80735 +static const struct snd_ac97_build_ops patch_si3036_ops = {
80736 .build_specific = patch_si3036_specific,
80737 };
80738
80739 @@ -3914,7 +3914,7 @@ static int patch_ucb1400_specific(struct
80740 return 0;
80741 }
80742
80743 -static struct snd_ac97_build_ops patch_ucb1400_ops = {
80744 +static const struct snd_ac97_build_ops patch_ucb1400_ops = {
80745 .build_specific = patch_ucb1400_specific,
80746 };
80747
80748 diff -urNp linux-2.6.32.46/sound/pci/hda/hda_codec.h linux-2.6.32.46/sound/pci/hda/hda_codec.h
80749 --- linux-2.6.32.46/sound/pci/hda/hda_codec.h 2011-03-27 14:31:47.000000000 -0400
80750 +++ linux-2.6.32.46/sound/pci/hda/hda_codec.h 2011-08-23 21:22:32.000000000 -0400
80751 @@ -580,7 +580,7 @@ struct hda_bus_ops {
80752 /* notify power-up/down from codec to controller */
80753 void (*pm_notify)(struct hda_bus *bus);
80754 #endif
80755 -};
80756 +} __no_const;
80757
80758 /* template to pass to the bus constructor */
80759 struct hda_bus_template {
80760 @@ -675,6 +675,7 @@ struct hda_codec_ops {
80761 int (*check_power_status)(struct hda_codec *codec, hda_nid_t nid);
80762 #endif
80763 };
80764 +typedef struct hda_codec_ops __no_const hda_codec_ops_no_const;
80765
80766 /* record for amp information cache */
80767 struct hda_cache_head {
80768 @@ -705,7 +706,7 @@ struct hda_pcm_ops {
80769 struct snd_pcm_substream *substream);
80770 int (*cleanup)(struct hda_pcm_stream *info, struct hda_codec *codec,
80771 struct snd_pcm_substream *substream);
80772 -};
80773 +} __no_const;
80774
80775 /* PCM information for each substream */
80776 struct hda_pcm_stream {
80777 @@ -760,7 +761,7 @@ struct hda_codec {
80778 const char *modelname; /* model name for preset */
80779
80780 /* set by patch */
80781 - struct hda_codec_ops patch_ops;
80782 + hda_codec_ops_no_const patch_ops;
80783
80784 /* PCM to create, set by patch_ops.build_pcms callback */
80785 unsigned int num_pcms;
80786 diff -urNp linux-2.6.32.46/sound/pci/hda/patch_atihdmi.c linux-2.6.32.46/sound/pci/hda/patch_atihdmi.c
80787 --- linux-2.6.32.46/sound/pci/hda/patch_atihdmi.c 2011-03-27 14:31:47.000000000 -0400
80788 +++ linux-2.6.32.46/sound/pci/hda/patch_atihdmi.c 2011-08-05 20:33:55.000000000 -0400
80789 @@ -177,7 +177,7 @@ static int patch_atihdmi(struct hda_code
80790 */
80791 spec->multiout.dig_out_nid = CVT_NID;
80792
80793 - codec->patch_ops = atihdmi_patch_ops;
80794 + memcpy((void *)&codec->patch_ops, &atihdmi_patch_ops, sizeof(atihdmi_patch_ops));
80795
80796 return 0;
80797 }
80798 diff -urNp linux-2.6.32.46/sound/pci/hda/patch_intelhdmi.c linux-2.6.32.46/sound/pci/hda/patch_intelhdmi.c
80799 --- linux-2.6.32.46/sound/pci/hda/patch_intelhdmi.c 2011-03-27 14:31:47.000000000 -0400
80800 +++ linux-2.6.32.46/sound/pci/hda/patch_intelhdmi.c 2011-08-05 20:33:55.000000000 -0400
80801 @@ -511,10 +511,10 @@ static void hdmi_non_intrinsic_event(str
80802 cp_ready);
80803
80804 /* TODO */
80805 - if (cp_state)
80806 - ;
80807 - if (cp_ready)
80808 - ;
80809 + if (cp_state) {
80810 + }
80811 + if (cp_ready) {
80812 + }
80813 }
80814
80815
80816 @@ -656,7 +656,7 @@ static int do_patch_intel_hdmi(struct hd
80817 spec->multiout.dig_out_nid = cvt_nid;
80818
80819 codec->spec = spec;
80820 - codec->patch_ops = intel_hdmi_patch_ops;
80821 + memcpy((void *)&codec->patch_ops, &intel_hdmi_patch_ops, sizeof(intel_hdmi_patch_ops));
80822
80823 snd_hda_eld_proc_new(codec, &spec->sink_eld);
80824
80825 diff -urNp linux-2.6.32.46/sound/pci/hda/patch_nvhdmi.c linux-2.6.32.46/sound/pci/hda/patch_nvhdmi.c
80826 --- linux-2.6.32.46/sound/pci/hda/patch_nvhdmi.c 2011-03-27 14:31:47.000000000 -0400
80827 +++ linux-2.6.32.46/sound/pci/hda/patch_nvhdmi.c 2011-08-05 20:33:55.000000000 -0400
80828 @@ -367,7 +367,7 @@ static int patch_nvhdmi_8ch(struct hda_c
80829 spec->multiout.max_channels = 8;
80830 spec->multiout.dig_out_nid = Nv_Master_Convert_nid;
80831
80832 - codec->patch_ops = nvhdmi_patch_ops_8ch;
80833 + memcpy((void *)&codec->patch_ops, &nvhdmi_patch_ops_8ch, sizeof(nvhdmi_patch_ops_8ch));
80834
80835 return 0;
80836 }
80837 @@ -386,7 +386,7 @@ static int patch_nvhdmi_2ch(struct hda_c
80838 spec->multiout.max_channels = 2;
80839 spec->multiout.dig_out_nid = Nv_Master_Convert_nid;
80840
80841 - codec->patch_ops = nvhdmi_patch_ops_2ch;
80842 + memcpy((void *)&codec->patch_ops, &nvhdmi_patch_ops_2ch, sizeof(nvhdmi_patch_ops_2ch));
80843
80844 return 0;
80845 }
80846 diff -urNp linux-2.6.32.46/sound/pci/hda/patch_sigmatel.c linux-2.6.32.46/sound/pci/hda/patch_sigmatel.c
80847 --- linux-2.6.32.46/sound/pci/hda/patch_sigmatel.c 2011-06-25 12:55:35.000000000 -0400
80848 +++ linux-2.6.32.46/sound/pci/hda/patch_sigmatel.c 2011-08-23 21:22:32.000000000 -0400
80849 @@ -5220,7 +5220,7 @@ again:
80850 snd_hda_codec_write_cache(codec, nid, 0,
80851 AC_VERB_SET_CONNECT_SEL, num_dacs);
80852
80853 - codec->patch_ops = stac92xx_patch_ops;
80854 + memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
80855
80856 codec->proc_widget_hook = stac92hd_proc_hook;
80857
80858 @@ -5294,7 +5294,7 @@ static int patch_stac92hd71bxx(struct hd
80859 return -ENOMEM;
80860
80861 codec->spec = spec;
80862 - codec->patch_ops = stac92xx_patch_ops;
80863 + memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
80864 spec->num_pins = STAC92HD71BXX_NUM_PINS;
80865 switch (codec->vendor_id) {
80866 case 0x111d76b6:
80867 diff -urNp linux-2.6.32.46/sound/pci/ice1712/ice1712.h linux-2.6.32.46/sound/pci/ice1712/ice1712.h
80868 --- linux-2.6.32.46/sound/pci/ice1712/ice1712.h 2011-03-27 14:31:47.000000000 -0400
80869 +++ linux-2.6.32.46/sound/pci/ice1712/ice1712.h 2011-08-05 20:33:55.000000000 -0400
80870 @@ -269,7 +269,7 @@ struct snd_ak4xxx_private {
80871 unsigned int mask_flags; /* total mask bits */
80872 struct snd_akm4xxx_ops {
80873 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
80874 - } ops;
80875 + } __no_const ops;
80876 };
80877
80878 struct snd_ice1712_spdif {
80879 @@ -285,7 +285,7 @@ struct snd_ice1712_spdif {
80880 int (*default_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
80881 void (*stream_get)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
80882 int (*stream_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
80883 - } ops;
80884 + } __no_const ops;
80885 };
80886
80887
80888 diff -urNp linux-2.6.32.46/sound/pci/intel8x0m.c linux-2.6.32.46/sound/pci/intel8x0m.c
80889 --- linux-2.6.32.46/sound/pci/intel8x0m.c 2011-03-27 14:31:47.000000000 -0400
80890 +++ linux-2.6.32.46/sound/pci/intel8x0m.c 2011-04-23 12:56:12.000000000 -0400
80891 @@ -1264,7 +1264,7 @@ static struct shortname_table {
80892 { 0x5455, "ALi M5455" },
80893 { 0x746d, "AMD AMD8111" },
80894 #endif
80895 - { 0 },
80896 + { 0, },
80897 };
80898
80899 static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
80900 diff -urNp linux-2.6.32.46/sound/pci/ymfpci/ymfpci_main.c linux-2.6.32.46/sound/pci/ymfpci/ymfpci_main.c
80901 --- linux-2.6.32.46/sound/pci/ymfpci/ymfpci_main.c 2011-03-27 14:31:47.000000000 -0400
80902 +++ linux-2.6.32.46/sound/pci/ymfpci/ymfpci_main.c 2011-05-04 17:56:28.000000000 -0400
80903 @@ -202,8 +202,8 @@ static void snd_ymfpci_hw_stop(struct sn
80904 if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
80905 break;
80906 }
80907 - if (atomic_read(&chip->interrupt_sleep_count)) {
80908 - atomic_set(&chip->interrupt_sleep_count, 0);
80909 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
80910 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
80911 wake_up(&chip->interrupt_sleep);
80912 }
80913 __end:
80914 @@ -787,7 +787,7 @@ static void snd_ymfpci_irq_wait(struct s
80915 continue;
80916 init_waitqueue_entry(&wait, current);
80917 add_wait_queue(&chip->interrupt_sleep, &wait);
80918 - atomic_inc(&chip->interrupt_sleep_count);
80919 + atomic_inc_unchecked(&chip->interrupt_sleep_count);
80920 schedule_timeout_uninterruptible(msecs_to_jiffies(50));
80921 remove_wait_queue(&chip->interrupt_sleep, &wait);
80922 }
80923 @@ -825,8 +825,8 @@ static irqreturn_t snd_ymfpci_interrupt(
80924 snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
80925 spin_unlock(&chip->reg_lock);
80926
80927 - if (atomic_read(&chip->interrupt_sleep_count)) {
80928 - atomic_set(&chip->interrupt_sleep_count, 0);
80929 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
80930 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
80931 wake_up(&chip->interrupt_sleep);
80932 }
80933 }
80934 @@ -2369,7 +2369,7 @@ int __devinit snd_ymfpci_create(struct s
80935 spin_lock_init(&chip->reg_lock);
80936 spin_lock_init(&chip->voice_lock);
80937 init_waitqueue_head(&chip->interrupt_sleep);
80938 - atomic_set(&chip->interrupt_sleep_count, 0);
80939 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
80940 chip->card = card;
80941 chip->pci = pci;
80942 chip->irq = -1;
80943 diff -urNp linux-2.6.32.46/sound/soc/soc-core.c linux-2.6.32.46/sound/soc/soc-core.c
80944 --- linux-2.6.32.46/sound/soc/soc-core.c 2011-03-27 14:31:47.000000000 -0400
80945 +++ linux-2.6.32.46/sound/soc/soc-core.c 2011-08-23 21:22:32.000000000 -0400
80946 @@ -609,7 +609,7 @@ static int soc_pcm_trigger(struct snd_pc
80947 }
80948
80949 /* ASoC PCM operations */
80950 -static struct snd_pcm_ops soc_pcm_ops = {
80951 +static snd_pcm_ops_no_const soc_pcm_ops = {
80952 .open = soc_pcm_open,
80953 .close = soc_codec_close,
80954 .hw_params = soc_pcm_hw_params,
80955 diff -urNp linux-2.6.32.46/sound/usb/usbaudio.c linux-2.6.32.46/sound/usb/usbaudio.c
80956 --- linux-2.6.32.46/sound/usb/usbaudio.c 2011-03-27 14:31:47.000000000 -0400
80957 +++ linux-2.6.32.46/sound/usb/usbaudio.c 2011-08-05 20:33:55.000000000 -0400
80958 @@ -963,12 +963,12 @@ static int snd_usb_pcm_playback_trigger(
80959 switch (cmd) {
80960 case SNDRV_PCM_TRIGGER_START:
80961 case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
80962 - subs->ops.prepare = prepare_playback_urb;
80963 + *(void **)&subs->ops.prepare = prepare_playback_urb;
80964 return 0;
80965 case SNDRV_PCM_TRIGGER_STOP:
80966 return deactivate_urbs(subs, 0, 0);
80967 case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
80968 - subs->ops.prepare = prepare_nodata_playback_urb;
80969 + *(void **)&subs->ops.prepare = prepare_nodata_playback_urb;
80970 return 0;
80971 default:
80972 return -EINVAL;
80973 @@ -985,15 +985,15 @@ static int snd_usb_pcm_capture_trigger(s
80974
80975 switch (cmd) {
80976 case SNDRV_PCM_TRIGGER_START:
80977 - subs->ops.retire = retire_capture_urb;
80978 + *(void **)&subs->ops.retire = retire_capture_urb;
80979 return start_urbs(subs, substream->runtime);
80980 case SNDRV_PCM_TRIGGER_STOP:
80981 return deactivate_urbs(subs, 0, 0);
80982 case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
80983 - subs->ops.retire = retire_paused_capture_urb;
80984 + *(void **)&subs->ops.retire = retire_paused_capture_urb;
80985 return 0;
80986 case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
80987 - subs->ops.retire = retire_capture_urb;
80988 + *(void **)&subs->ops.retire = retire_capture_urb;
80989 return 0;
80990 default:
80991 return -EINVAL;
80992 @@ -1542,7 +1542,7 @@ static int snd_usb_pcm_prepare(struct sn
80993 /* for playback, submit the URBs now; otherwise, the first hwptr_done
80994 * updates for all URBs would happen at the same time when starting */
80995 if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK) {
80996 - subs->ops.prepare = prepare_nodata_playback_urb;
80997 + *(void **)&subs->ops.prepare = prepare_nodata_playback_urb;
80998 return start_urbs(subs, runtime);
80999 } else
81000 return 0;
81001 @@ -2228,14 +2228,14 @@ static void init_substream(struct snd_us
81002 subs->direction = stream;
81003 subs->dev = as->chip->dev;
81004 if (snd_usb_get_speed(subs->dev) == USB_SPEED_FULL) {
81005 - subs->ops = audio_urb_ops[stream];
81006 + memcpy((void *)&subs->ops, &audio_urb_ops[stream], sizeof(subs->ops));
81007 } else {
81008 - subs->ops = audio_urb_ops_high_speed[stream];
81009 + memcpy((void *)&subs->ops, &audio_urb_ops_high_speed[stream], sizeof(subs->ops));
81010 switch (as->chip->usb_id) {
81011 case USB_ID(0x041e, 0x3f02): /* E-Mu 0202 USB */
81012 case USB_ID(0x041e, 0x3f04): /* E-Mu 0404 USB */
81013 case USB_ID(0x041e, 0x3f0a): /* E-Mu Tracker Pre */
81014 - subs->ops.retire_sync = retire_playback_sync_urb_hs_emu;
81015 + *(void **)&subs->ops.retire_sync = retire_playback_sync_urb_hs_emu;
81016 break;
81017 }
81018 }
81019 diff -urNp linux-2.6.32.46/tools/gcc/checker_plugin.c linux-2.6.32.46/tools/gcc/checker_plugin.c
81020 --- linux-2.6.32.46/tools/gcc/checker_plugin.c 1969-12-31 19:00:00.000000000 -0500
81021 +++ linux-2.6.32.46/tools/gcc/checker_plugin.c 2011-10-06 09:37:16.000000000 -0400
81022 @@ -0,0 +1,169 @@
81023 +/*
81024 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
81025 + * Licensed under the GPL v2
81026 + *
81027 + * Note: the choice of the license means that the compilation process is
81028 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
81029 + * but for the kernel it doesn't matter since it doesn't link against
81030 + * any of the gcc libraries
81031 + *
81032 + * gcc plugin to implement various sparse (source code checker) features
81033 + *
81034 + * TODO:
81035 + * - define separate __iomem, __percpu and __rcu address spaces (lots of code to patch)
81036 + *
81037 + * BUGS:
81038 + * - none known
81039 + */
81040 +#include "gcc-plugin.h"
81041 +#include "config.h"
81042 +#include "system.h"
81043 +#include "coretypes.h"
81044 +#include "tree.h"
81045 +#include "tree-pass.h"
81046 +#include "intl.h"
81047 +#include "plugin-version.h"
81048 +#include "tm.h"
81049 +#include "toplev.h"
81050 +#include "basic-block.h"
81051 +#include "gimple.h"
81052 +//#include "expr.h" where are you...
81053 +#include "diagnostic.h"
81054 +#include "rtl.h"
81055 +#include "emit-rtl.h"
81056 +#include "function.h"
81057 +#include "tree-flow.h"
81058 +#include "target.h"
81059 +
81060 +extern void c_register_addr_space (const char *str, addr_space_t as);
81061 +extern enum machine_mode default_addr_space_pointer_mode (addr_space_t);
81062 +extern enum machine_mode default_addr_space_address_mode (addr_space_t);
81063 +extern bool default_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as);
81064 +extern bool default_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as);
81065 +extern rtx default_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as);
81066 +
81067 +extern void print_gimple_stmt(FILE *, gimple, int, int);
81068 +extern rtx emit_move_insn(rtx x, rtx y);
81069 +
81070 +int plugin_is_GPL_compatible;
81071 +
81072 +static struct plugin_info checker_plugin_info = {
81073 + .version = "201110031940",
81074 +};
81075 +
81076 +#define ADDR_SPACE_KERNEL 0
81077 +#define ADDR_SPACE_FORCE_KERNEL 1
81078 +#define ADDR_SPACE_USER 2
81079 +#define ADDR_SPACE_FORCE_USER 3
81080 +#define ADDR_SPACE_IOMEM 0
81081 +#define ADDR_SPACE_FORCE_IOMEM 0
81082 +#define ADDR_SPACE_PERCPU 0
81083 +#define ADDR_SPACE_FORCE_PERCPU 0
81084 +#define ADDR_SPACE_RCU 0
81085 +#define ADDR_SPACE_FORCE_RCU 0
81086 +
81087 +static enum machine_mode checker_addr_space_pointer_mode(addr_space_t addrspace)
81088 +{
81089 + return default_addr_space_pointer_mode(ADDR_SPACE_GENERIC);
81090 +}
81091 +
81092 +static enum machine_mode checker_addr_space_address_mode(addr_space_t addrspace)
81093 +{
81094 + return default_addr_space_address_mode(ADDR_SPACE_GENERIC);
81095 +}
81096 +
81097 +static bool checker_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as)
81098 +{
81099 + return default_addr_space_valid_pointer_mode(mode, as);
81100 +}
81101 +
81102 +static bool checker_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as)
81103 +{
81104 + return default_addr_space_legitimate_address_p(mode, mem, strict, ADDR_SPACE_GENERIC);
81105 +}
81106 +
81107 +static rtx checker_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as)
81108 +{
81109 + return default_addr_space_legitimize_address(x, oldx, mode, as);
81110 +}
81111 +
81112 +static bool checker_addr_space_subset_p(addr_space_t subset, addr_space_t superset)
81113 +{
81114 + if (subset == ADDR_SPACE_FORCE_KERNEL && superset == ADDR_SPACE_KERNEL)
81115 + return true;
81116 +
81117 + if (subset == ADDR_SPACE_FORCE_USER && superset == ADDR_SPACE_USER)
81118 + return true;
81119 +
81120 + if (subset == ADDR_SPACE_FORCE_IOMEM && superset == ADDR_SPACE_IOMEM)
81121 + return true;
81122 +
81123 + if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_USER)
81124 + return true;
81125 +
81126 + if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_IOMEM)
81127 + return true;
81128 +
81129 + if (subset == ADDR_SPACE_USER && superset == ADDR_SPACE_FORCE_KERNEL)
81130 + return true;
81131 +
81132 + if (subset == ADDR_SPACE_IOMEM && superset == ADDR_SPACE_FORCE_KERNEL)
81133 + return true;
81134 +
81135 + return subset == superset;
81136 +}
81137 +
81138 +static rtx checker_addr_space_convert(rtx op, tree from_type, tree to_type)
81139 +{
81140 +// addr_space_t from_as = TYPE_ADDR_SPACE(TREE_TYPE(from_type));
81141 +// addr_space_t to_as = TYPE_ADDR_SPACE(TREE_TYPE(to_type));
81142 +
81143 + return op;
81144 +}
81145 +
81146 +static void register_checker_address_spaces(void *event_data, void *data)
81147 +{
81148 + c_register_addr_space("__kernel", ADDR_SPACE_KERNEL);
81149 + c_register_addr_space("__force_kernel", ADDR_SPACE_FORCE_KERNEL);
81150 + c_register_addr_space("__user", ADDR_SPACE_USER);
81151 + c_register_addr_space("__force_user", ADDR_SPACE_FORCE_USER);
81152 +// c_register_addr_space("__iomem", ADDR_SPACE_IOMEM);
81153 +// c_register_addr_space("__force_iomem", ADDR_SPACE_FORCE_IOMEM);
81154 +// c_register_addr_space("__percpu", ADDR_SPACE_PERCPU);
81155 +// c_register_addr_space("__force_percpu", ADDR_SPACE_FORCE_PERCPU);
81156 +// c_register_addr_space("__rcu", ADDR_SPACE_RCU);
81157 +// c_register_addr_space("__force_rcu", ADDR_SPACE_FORCE_RCU);
81158 +
81159 + targetm.addr_space.pointer_mode = checker_addr_space_pointer_mode;
81160 + targetm.addr_space.address_mode = checker_addr_space_address_mode;
81161 + targetm.addr_space.valid_pointer_mode = checker_addr_space_valid_pointer_mode;
81162 + targetm.addr_space.legitimate_address_p = checker_addr_space_legitimate_address_p;
81163 +// targetm.addr_space.legitimize_address = checker_addr_space_legitimize_address;
81164 + targetm.addr_space.subset_p = checker_addr_space_subset_p;
81165 + targetm.addr_space.convert = checker_addr_space_convert;
81166 +}
81167 +
81168 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
81169 +{
81170 + const char * const plugin_name = plugin_info->base_name;
81171 + const int argc = plugin_info->argc;
81172 + const struct plugin_argument * const argv = plugin_info->argv;
81173 + int i;
81174 +
81175 + if (!plugin_default_version_check(version, &gcc_version)) {
81176 + error(G_("incompatible gcc/plugin versions"));
81177 + return 1;
81178 + }
81179 +
81180 + register_callback(plugin_name, PLUGIN_INFO, NULL, &checker_plugin_info);
81181 +
81182 + for (i = 0; i < argc; ++i)
81183 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
81184 +
81185 + if (TARGET_64BIT == 0)
81186 + return 0;
81187 +
81188 + register_callback (plugin_name, PLUGIN_PRAGMAS, register_checker_address_spaces, NULL);
81189 +
81190 + return 0;
81191 +}
81192 diff -urNp linux-2.6.32.46/tools/gcc/constify_plugin.c linux-2.6.32.46/tools/gcc/constify_plugin.c
81193 --- linux-2.6.32.46/tools/gcc/constify_plugin.c 1969-12-31 19:00:00.000000000 -0500
81194 +++ linux-2.6.32.46/tools/gcc/constify_plugin.c 2011-08-30 18:19:52.000000000 -0400
81195 @@ -0,0 +1,293 @@
81196 +/*
81197 + * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
81198 + * Copyright 2011 by PaX Team <pageexec@freemail.hu>
81199 + * Licensed under the GPL v2, or (at your option) v3
81200 + *
81201 + * This gcc plugin constifies all structures which contain only function pointers or are explicitly marked for constification.
81202 + *
81203 + * Homepage:
81204 + * http://www.grsecurity.net/~ephox/const_plugin/
81205 + *
81206 + * Usage:
81207 + * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o constify_plugin.so constify_plugin.c
81208 + * $ gcc -fplugin=constify_plugin.so test.c -O2
81209 + */
81210 +
81211 +#include "gcc-plugin.h"
81212 +#include "config.h"
81213 +#include "system.h"
81214 +#include "coretypes.h"
81215 +#include "tree.h"
81216 +#include "tree-pass.h"
81217 +#include "intl.h"
81218 +#include "plugin-version.h"
81219 +#include "tm.h"
81220 +#include "toplev.h"
81221 +#include "function.h"
81222 +#include "tree-flow.h"
81223 +#include "plugin.h"
81224 +#include "diagnostic.h"
81225 +//#include "c-tree.h"
81226 +
81227 +#define C_TYPE_FIELDS_READONLY(TYPE) TREE_LANG_FLAG_1(TYPE)
81228 +
81229 +int plugin_is_GPL_compatible;
81230 +
81231 +static struct plugin_info const_plugin_info = {
81232 + .version = "20110826",
81233 + .help = "no-constify\tturn off constification\n",
81234 +};
81235 +
81236 +static void constify_type(tree type);
81237 +static bool walk_struct(tree node);
81238 +
81239 +static tree deconstify_type(tree old_type)
81240 +{
81241 + tree new_type, field;
81242 +
81243 + new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
81244 + TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
81245 + for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
81246 + DECL_FIELD_CONTEXT(field) = new_type;
81247 + TYPE_READONLY(new_type) = 0;
81248 + C_TYPE_FIELDS_READONLY(new_type) = 0;
81249 + return new_type;
81250 +}
81251 +
81252 +static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
81253 +{
81254 + tree type;
81255 +
81256 + *no_add_attrs = true;
81257 + if (TREE_CODE(*node) == FUNCTION_DECL) {
81258 + error("%qE attribute does not apply to functions", name);
81259 + return NULL_TREE;
81260 + }
81261 +
81262 + if (TREE_CODE(*node) == VAR_DECL) {
81263 + error("%qE attribute does not apply to variables", name);
81264 + return NULL_TREE;
81265 + }
81266 +
81267 + if (TYPE_P(*node)) {
81268 + if (TREE_CODE(*node) == RECORD_TYPE || TREE_CODE(*node) == UNION_TYPE)
81269 + *no_add_attrs = false;
81270 + else
81271 + error("%qE attribute applies to struct and union types only", name);
81272 + return NULL_TREE;
81273 + }
81274 +
81275 + type = TREE_TYPE(*node);
81276 +
81277 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE) {
81278 + error("%qE attribute applies to struct and union types only", name);
81279 + return NULL_TREE;
81280 + }
81281 +
81282 + if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(type))) {
81283 + error("%qE attribute is already applied to the type", name);
81284 + return NULL_TREE;
81285 + }
81286 +
81287 + if (TREE_CODE(*node) == TYPE_DECL && !TYPE_READONLY(type)) {
81288 + error("%qE attribute used on type that is not constified", name);
81289 + return NULL_TREE;
81290 + }
81291 +
81292 + if (TREE_CODE(*node) == TYPE_DECL) {
81293 + TREE_TYPE(*node) = deconstify_type(type);
81294 + TREE_READONLY(*node) = 0;
81295 + return NULL_TREE;
81296 + }
81297 +
81298 + return NULL_TREE;
81299 +}
81300 +
81301 +static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
81302 +{
81303 + *no_add_attrs = true;
81304 + if (!TYPE_P(*node)) {
81305 + error("%qE attribute applies to types only", name);
81306 + return NULL_TREE;
81307 + }
81308 +
81309 + if (TREE_CODE(*node) != RECORD_TYPE && TREE_CODE(*node) != UNION_TYPE) {
81310 + error("%qE attribute applies to struct and union types only", name);
81311 + return NULL_TREE;
81312 + }
81313 +
81314 + *no_add_attrs = false;
81315 + constify_type(*node);
81316 + return NULL_TREE;
81317 +}
81318 +
81319 +static struct attribute_spec no_const_attr = {
81320 + .name = "no_const",
81321 + .min_length = 0,
81322 + .max_length = 0,
81323 + .decl_required = false,
81324 + .type_required = false,
81325 + .function_type_required = false,
81326 + .handler = handle_no_const_attribute
81327 +};
81328 +
81329 +static struct attribute_spec do_const_attr = {
81330 + .name = "do_const",
81331 + .min_length = 0,
81332 + .max_length = 0,
81333 + .decl_required = false,
81334 + .type_required = false,
81335 + .function_type_required = false,
81336 + .handler = handle_do_const_attribute
81337 +};
81338 +
81339 +static void register_attributes(void *event_data, void *data)
81340 +{
81341 + register_attribute(&no_const_attr);
81342 + register_attribute(&do_const_attr);
81343 +}
81344 +
81345 +static void constify_type(tree type)
81346 +{
81347 + TYPE_READONLY(type) = 1;
81348 + C_TYPE_FIELDS_READONLY(type) = 1;
81349 +}
81350 +
81351 +static bool is_fptr(tree field)
81352 +{
81353 + tree ptr = TREE_TYPE(field);
81354 +
81355 + if (TREE_CODE(ptr) != POINTER_TYPE)
81356 + return false;
81357 +
81358 + return TREE_CODE(TREE_TYPE(ptr)) == FUNCTION_TYPE;
81359 +}
81360 +
81361 +static bool walk_struct(tree node)
81362 +{
81363 + tree field;
81364 +
81365 + if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node)))
81366 + return false;
81367 +
81368 + if (TYPE_FIELDS(node) == NULL_TREE)
81369 + return false;
81370 +
81371 + for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
81372 + tree type = TREE_TYPE(field);
81373 + enum tree_code code = TREE_CODE(type);
81374 + if (code == RECORD_TYPE || code == UNION_TYPE) {
81375 + if (!(walk_struct(type)))
81376 + return false;
81377 + } else if (!is_fptr(field) && !TREE_READONLY(field))
81378 + return false;
81379 + }
81380 + return true;
81381 +}
81382 +
81383 +static void finish_type(void *event_data, void *data)
81384 +{
81385 + tree type = (tree)event_data;
81386 +
81387 + if (type == NULL_TREE)
81388 + return;
81389 +
81390 + if (TYPE_READONLY(type))
81391 + return;
81392 +
81393 + if (walk_struct(type))
81394 + constify_type(type);
81395 +}
81396 +
81397 +static unsigned int check_local_variables(void);
81398 +
81399 +struct gimple_opt_pass pass_local_variable = {
81400 + {
81401 + .type = GIMPLE_PASS,
81402 + .name = "check_local_variables",
81403 + .gate = NULL,
81404 + .execute = check_local_variables,
81405 + .sub = NULL,
81406 + .next = NULL,
81407 + .static_pass_number = 0,
81408 + .tv_id = TV_NONE,
81409 + .properties_required = 0,
81410 + .properties_provided = 0,
81411 + .properties_destroyed = 0,
81412 + .todo_flags_start = 0,
81413 + .todo_flags_finish = 0
81414 + }
81415 +};
81416 +
81417 +static unsigned int check_local_variables(void)
81418 +{
81419 + tree var;
81420 + referenced_var_iterator rvi;
81421 +
81422 +#if __GNUC__ == 4 && __GNUC_MINOR__ == 5
81423 + FOR_EACH_REFERENCED_VAR(var, rvi) {
81424 +#else
81425 + FOR_EACH_REFERENCED_VAR(cfun, var, rvi) {
81426 +#endif
81427 + tree type = TREE_TYPE(var);
81428 +
81429 + if (!DECL_P(var) || TREE_STATIC(var) || DECL_EXTERNAL(var))
81430 + continue;
81431 +
81432 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
81433 + continue;
81434 +
81435 + if (!TYPE_READONLY(type))
81436 + continue;
81437 +
81438 +// if (lookup_attribute("no_const", DECL_ATTRIBUTES(var)))
81439 +// continue;
81440 +
81441 +// if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type)))
81442 +// continue;
81443 +
81444 + if (walk_struct(type)) {
81445 + error("constified variable %qE cannot be local", var);
81446 + return 1;
81447 + }
81448 + }
81449 + return 0;
81450 +}
81451 +
81452 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
81453 +{
81454 + const char * const plugin_name = plugin_info->base_name;
81455 + const int argc = plugin_info->argc;
81456 + const struct plugin_argument * const argv = plugin_info->argv;
81457 + int i;
81458 + bool constify = true;
81459 +
81460 + struct register_pass_info local_variable_pass_info = {
81461 + .pass = &pass_local_variable.pass,
81462 + .reference_pass_name = "*referenced_vars",
81463 + .ref_pass_instance_number = 0,
81464 + .pos_op = PASS_POS_INSERT_AFTER
81465 + };
81466 +
81467 + if (!plugin_default_version_check(version, &gcc_version)) {
81468 + error(G_("incompatible gcc/plugin versions"));
81469 + return 1;
81470 + }
81471 +
81472 + for (i = 0; i < argc; ++i) {
81473 + if (!(strcmp(argv[i].key, "no-constify"))) {
81474 + constify = false;
81475 + continue;
81476 + }
81477 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
81478 + }
81479 +
81480 + register_callback(plugin_name, PLUGIN_INFO, NULL, &const_plugin_info);
81481 + if (constify) {
81482 + register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
81483 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &local_variable_pass_info);
81484 + }
81485 + register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
81486 +
81487 + return 0;
81488 +}
81489 diff -urNp linux-2.6.32.46/tools/gcc/kallocstat_plugin.c linux-2.6.32.46/tools/gcc/kallocstat_plugin.c
81490 --- linux-2.6.32.46/tools/gcc/kallocstat_plugin.c 1969-12-31 19:00:00.000000000 -0500
81491 +++ linux-2.6.32.46/tools/gcc/kallocstat_plugin.c 2011-10-06 09:37:16.000000000 -0400
81492 @@ -0,0 +1,165 @@
81493 +/*
81494 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
81495 + * Licensed under the GPL v2
81496 + *
81497 + * Note: the choice of the license means that the compilation process is
81498 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
81499 + * but for the kernel it doesn't matter since it doesn't link against
81500 + * any of the gcc libraries
81501 + *
81502 + * gcc plugin to find the distribution of k*alloc sizes
81503 + *
81504 + * TODO:
81505 + *
81506 + * BUGS:
81507 + * - none known
81508 + */
81509 +#include "gcc-plugin.h"
81510 +#include "config.h"
81511 +#include "system.h"
81512 +#include "coretypes.h"
81513 +#include "tree.h"
81514 +#include "tree-pass.h"
81515 +#include "intl.h"
81516 +#include "plugin-version.h"
81517 +#include "tm.h"
81518 +#include "toplev.h"
81519 +#include "basic-block.h"
81520 +#include "gimple.h"
81521 +//#include "expr.h" where are you...
81522 +#include "diagnostic.h"
81523 +#include "rtl.h"
81524 +#include "emit-rtl.h"
81525 +#include "function.h"
81526 +
81527 +extern void print_gimple_stmt(FILE *, gimple, int, int);
81528 +
81529 +int plugin_is_GPL_compatible;
81530 +
81531 +static const char * const kalloc_functions[] = {
81532 + "__kmalloc",
81533 + "kmalloc",
81534 + "kmalloc_large",
81535 + "kmalloc_node",
81536 + "kmalloc_order",
81537 + "kmalloc_order_trace",
81538 + "kmalloc_slab",
81539 + "kzalloc",
81540 + "kzalloc_node",
81541 +};
81542 +
81543 +static struct plugin_info kallocstat_plugin_info = {
81544 + .version = "201109121100",
81545 +};
81546 +
81547 +static unsigned int execute_kallocstat(void);
81548 +
81549 +static struct gimple_opt_pass kallocstat_pass = {
81550 + .pass = {
81551 + .type = GIMPLE_PASS,
81552 + .name = "kallocstat",
81553 + .gate = NULL,
81554 + .execute = execute_kallocstat,
81555 + .sub = NULL,
81556 + .next = NULL,
81557 + .static_pass_number = 0,
81558 + .tv_id = TV_NONE,
81559 + .properties_required = 0,
81560 + .properties_provided = 0,
81561 + .properties_destroyed = 0,
81562 + .todo_flags_start = 0,
81563 + .todo_flags_finish = 0
81564 + }
81565 +};
81566 +
81567 +static bool is_kalloc(const char *fnname)
81568 +{
81569 + size_t i;
81570 +
81571 + for (i = 0; i < ARRAY_SIZE(kalloc_functions); i++)
81572 + if (!strcmp(fnname, kalloc_functions[i]))
81573 + return true;
81574 + return false;
81575 +}
81576 +
81577 +static unsigned int execute_kallocstat(void)
81578 +{
81579 + basic_block bb;
81580 +
81581 + // 1. loop through BBs and GIMPLE statements
81582 + FOR_EACH_BB(bb) {
81583 + gimple_stmt_iterator gsi;
81584 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
81585 + // gimple match:
81586 + tree fndecl, size;
81587 + gimple call_stmt;
81588 + const char *fnname;
81589 +
81590 + // is it a call
81591 + call_stmt = gsi_stmt(gsi);
81592 + if (!is_gimple_call(call_stmt))
81593 + continue;
81594 + fndecl = gimple_call_fndecl(call_stmt);
81595 + if (fndecl == NULL_TREE)
81596 + continue;
81597 + if (TREE_CODE(fndecl) != FUNCTION_DECL)
81598 + continue;
81599 +
81600 + // is it a call to k*alloc
81601 + fnname = IDENTIFIER_POINTER(DECL_NAME(fndecl));
81602 + if (!is_kalloc(fnname))
81603 + continue;
81604 +
81605 + // is the size arg the result of a simple const assignment
81606 + size = gimple_call_arg(call_stmt, 0);
81607 + while (true) {
81608 + gimple def_stmt;
81609 + expanded_location xloc;
81610 + size_t size_val;
81611 +
81612 + if (TREE_CODE(size) != SSA_NAME)
81613 + break;
81614 + def_stmt = SSA_NAME_DEF_STMT(size);
81615 + if (!def_stmt || !is_gimple_assign(def_stmt))
81616 + break;
81617 + if (gimple_num_ops(def_stmt) != 2)
81618 + break;
81619 + size = gimple_assign_rhs1(def_stmt);
81620 + if (!TREE_CONSTANT(size))
81621 + continue;
81622 + xloc = expand_location(gimple_location(def_stmt));
81623 + if (!xloc.file)
81624 + xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
81625 + size_val = TREE_INT_CST_LOW(size);
81626 + fprintf(stderr, "kallocsize: %8zu %8zx %s %s:%u\n", size_val, size_val, fnname, xloc.file, xloc.line);
81627 + break;
81628 + }
81629 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
81630 +//debug_tree(gimple_call_fn(call_stmt));
81631 +//print_node(stderr, "pax", fndecl, 4);
81632 + }
81633 + }
81634 +
81635 + return 0;
81636 +}
81637 +
81638 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
81639 +{
81640 + const char * const plugin_name = plugin_info->base_name;
81641 + struct register_pass_info kallocstat_pass_info = {
81642 + .pass = &kallocstat_pass.pass,
81643 + .reference_pass_name = "ssa",
81644 + .ref_pass_instance_number = 0,
81645 + .pos_op = PASS_POS_INSERT_AFTER
81646 + };
81647 +
81648 + if (!plugin_default_version_check(version, &gcc_version)) {
81649 + error(G_("incompatible gcc/plugin versions"));
81650 + return 1;
81651 + }
81652 +
81653 + register_callback(plugin_name, PLUGIN_INFO, NULL, &kallocstat_plugin_info);
81654 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kallocstat_pass_info);
81655 +
81656 + return 0;
81657 +}
81658 diff -urNp linux-2.6.32.46/tools/gcc/kernexec_plugin.c linux-2.6.32.46/tools/gcc/kernexec_plugin.c
81659 --- linux-2.6.32.46/tools/gcc/kernexec_plugin.c 1969-12-31 19:00:00.000000000 -0500
81660 +++ linux-2.6.32.46/tools/gcc/kernexec_plugin.c 2011-10-06 09:37:16.000000000 -0400
81661 @@ -0,0 +1,273 @@
81662 +/*
81663 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
81664 + * Licensed under the GPL v2
81665 + *
81666 + * Note: the choice of the license means that the compilation process is
81667 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
81668 + * but for the kernel it doesn't matter since it doesn't link against
81669 + * any of the gcc libraries
81670 + *
81671 + * gcc plugin to make KERNEXEC/amd64 almost as good as it is on i386
81672 + *
81673 + * TODO:
81674 + *
81675 + * BUGS:
81676 + * - none known
81677 + */
81678 +#include "gcc-plugin.h"
81679 +#include "config.h"
81680 +#include "system.h"
81681 +#include "coretypes.h"
81682 +#include "tree.h"
81683 +#include "tree-pass.h"
81684 +#include "intl.h"
81685 +#include "plugin-version.h"
81686 +#include "tm.h"
81687 +#include "toplev.h"
81688 +#include "basic-block.h"
81689 +#include "gimple.h"
81690 +//#include "expr.h" where are you...
81691 +#include "diagnostic.h"
81692 +#include "rtl.h"
81693 +#include "emit-rtl.h"
81694 +#include "function.h"
81695 +#include "tree-flow.h"
81696 +
81697 +extern void print_gimple_stmt(FILE *, gimple, int, int);
81698 +extern rtx emit_move_insn(rtx x, rtx y);
81699 +
81700 +int plugin_is_GPL_compatible;
81701 +
81702 +static struct plugin_info kernexec_plugin_info = {
81703 + .version = "201110032145",
81704 +};
81705 +
81706 +static unsigned int execute_kernexec_fptr(void);
81707 +static unsigned int execute_kernexec_retaddr(void);
81708 +static bool kernexec_cmodel_check(void);
81709 +
81710 +static struct gimple_opt_pass kernexec_fptr_pass = {
81711 + .pass = {
81712 + .type = GIMPLE_PASS,
81713 + .name = "kernexec_fptr",
81714 + .gate = kernexec_cmodel_check,
81715 + .execute = execute_kernexec_fptr,
81716 + .sub = NULL,
81717 + .next = NULL,
81718 + .static_pass_number = 0,
81719 + .tv_id = TV_NONE,
81720 + .properties_required = 0,
81721 + .properties_provided = 0,
81722 + .properties_destroyed = 0,
81723 + .todo_flags_start = 0,
81724 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
81725 + }
81726 +};
81727 +
81728 +static struct rtl_opt_pass kernexec_retaddr_pass = {
81729 + .pass = {
81730 + .type = RTL_PASS,
81731 + .name = "kernexec_retaddr",
81732 + .gate = kernexec_cmodel_check,
81733 + .execute = execute_kernexec_retaddr,
81734 + .sub = NULL,
81735 + .next = NULL,
81736 + .static_pass_number = 0,
81737 + .tv_id = TV_NONE,
81738 + .properties_required = 0,
81739 + .properties_provided = 0,
81740 + .properties_destroyed = 0,
81741 + .todo_flags_start = 0,
81742 + .todo_flags_finish = TODO_dump_func | TODO_ggc_collect
81743 + }
81744 +};
81745 +
81746 +static bool kernexec_cmodel_check(void)
81747 +{
81748 + tree section;
81749 +
81750 + if (ix86_cmodel != CM_KERNEL)
81751 + return false;
81752 +
81753 + section = lookup_attribute("__section__", DECL_ATTRIBUTES(current_function_decl));
81754 + if (!section || !TREE_VALUE(section))
81755 + return true;
81756 +
81757 + section = TREE_VALUE(TREE_VALUE(section));
81758 + if (strncmp(TREE_STRING_POINTER(section), ".vsyscall_", 10))
81759 + return true;
81760 +
81761 + return false;
81762 +}
81763 +
81764 +/*
81765 + * add special KERNEXEC instrumentation: force MSB of fptr to 1, which will produce
81766 + * a non-canonical address from a userland ptr and will just trigger a GPF on dereference
81767 + */
81768 +static void kernexec_instrument_fptr(gimple_stmt_iterator gsi)
81769 +{
81770 + gimple assign_intptr, assign_new_fptr, call_stmt;
81771 + tree intptr, old_fptr, new_fptr, kernexec_mask;
81772 +
81773 + call_stmt = gsi_stmt(gsi);
81774 + old_fptr = gimple_call_fn(call_stmt);
81775 +
81776 + // create temporary unsigned long variable used for bitops and cast fptr to it
81777 + intptr = create_tmp_var(long_unsigned_type_node, NULL);
81778 + add_referenced_var(intptr);
81779 + mark_sym_for_renaming(intptr);
81780 + assign_intptr = gimple_build_assign(intptr, fold_convert(long_unsigned_type_node, old_fptr));
81781 + update_stmt(assign_intptr);
81782 + gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT);
81783 +
81784 + // apply logical or to temporary unsigned long and bitmask
81785 + kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0x8000000000000000LL);
81786 +// kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0xffffffff80000000LL);
81787 + assign_intptr = gimple_build_assign(intptr, fold_build2(BIT_IOR_EXPR, long_long_unsigned_type_node, intptr, kernexec_mask));
81788 + update_stmt(assign_intptr);
81789 + gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT);
81790 +
81791 + // cast temporary unsigned long back to a temporary fptr variable
81792 + new_fptr = create_tmp_var(TREE_TYPE(old_fptr), NULL);
81793 + add_referenced_var(new_fptr);
81794 + mark_sym_for_renaming(new_fptr);
81795 + assign_new_fptr = gimple_build_assign(new_fptr, fold_convert(TREE_TYPE(old_fptr), intptr));
81796 + update_stmt(assign_new_fptr);
81797 + gsi_insert_before(&gsi, assign_new_fptr, GSI_SAME_STMT);
81798 +
81799 + // replace call stmt fn with the new fptr
81800 + gimple_call_set_fn(call_stmt, new_fptr);
81801 + update_stmt(call_stmt);
81802 +}
81803 +
81804 +/*
81805 + * find all C level function pointer dereferences and forcibly set the highest bit of the pointer
81806 + */
81807 +static unsigned int execute_kernexec_fptr(void)
81808 +{
81809 + basic_block bb;
81810 + gimple_stmt_iterator gsi;
81811 +
81812 + // 1. loop through BBs and GIMPLE statements
81813 + FOR_EACH_BB(bb) {
81814 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
81815 + // gimple match: h_1 = get_fptr (); D.2709_3 = h_1 (x_2(D));
81816 + tree fn;
81817 + gimple call_stmt;
81818 +
81819 + // is it a call ...
81820 + call_stmt = gsi_stmt(gsi);
81821 + if (!is_gimple_call(call_stmt))
81822 + continue;
81823 + fn = gimple_call_fn(call_stmt);
81824 + if (TREE_CODE(fn) == ADDR_EXPR)
81825 + continue;
81826 + if (TREE_CODE(fn) != SSA_NAME)
81827 + gcc_unreachable();
81828 +
81829 + // ... through a function pointer
81830 + fn = SSA_NAME_VAR(fn);
81831 + if (TREE_CODE(fn) != VAR_DECL && TREE_CODE(fn) != PARM_DECL)
81832 + continue;
81833 + fn = TREE_TYPE(fn);
81834 + if (TREE_CODE(fn) != POINTER_TYPE)
81835 + continue;
81836 + fn = TREE_TYPE(fn);
81837 + if (TREE_CODE(fn) != FUNCTION_TYPE)
81838 + continue;
81839 +
81840 + kernexec_instrument_fptr(gsi);
81841 +
81842 +//debug_tree(gimple_call_fn(call_stmt));
81843 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
81844 + }
81845 + }
81846 +
81847 + return 0;
81848 +}
81849 +
81850 +// add special KERNEXEC instrumentation: btsq $63,(%rsp) just before retn
81851 +static void kernexec_instrument_retaddr(rtx insn)
81852 +{
81853 + rtx btsq;
81854 + rtvec argvec, constraintvec, labelvec;
81855 + int line;
81856 +
81857 + // create asm volatile("btsq $63,(%%rsp)":::)
81858 + argvec = rtvec_alloc(0);
81859 + constraintvec = rtvec_alloc(0);
81860 + labelvec = rtvec_alloc(0);
81861 + line = expand_location(RTL_LOCATION(insn)).line;
81862 + btsq = gen_rtx_ASM_OPERANDS(VOIDmode, "btsq $63,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
81863 + MEM_VOLATILE_P(btsq) = 1;
81864 + RTX_FRAME_RELATED_P(btsq) = 1;
81865 + emit_insn_before(btsq, insn);
81866 +}
81867 +
81868 +/*
81869 + * find all asm level function returns and forcibly set the highest bit of the return address
81870 + */
81871 +static unsigned int execute_kernexec_retaddr(void)
81872 +{
81873 + rtx insn;
81874 +
81875 + // 1. find function returns
81876 + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
81877 + // rtl match: (jump_insn 41 40 42 2 (return) fptr.c:42 634 {return_internal} (nil))
81878 + // (jump_insn 12 9 11 2 (parallel [ (return) (unspec [ (0) ] UNSPEC_REP) ]) fptr.c:46 635 {return_internal_long} (nil))
81879 + rtx body;
81880 +
81881 + // is it a retn
81882 + if (!JUMP_P(insn))
81883 + continue;
81884 + body = PATTERN(insn);
81885 + if (GET_CODE(body) == PARALLEL)
81886 + body = XVECEXP(body, 0, 0);
81887 + if (GET_CODE(body) != RETURN)
81888 + continue;
81889 + kernexec_instrument_retaddr(insn);
81890 + }
81891 +
81892 +// print_simple_rtl(stderr, get_insns());
81893 +// print_rtl(stderr, get_insns());
81894 +
81895 + return 0;
81896 +}
81897 +
81898 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
81899 +{
81900 + const char * const plugin_name = plugin_info->base_name;
81901 + const int argc = plugin_info->argc;
81902 + const struct plugin_argument * const argv = plugin_info->argv;
81903 + int i;
81904 + struct register_pass_info kernexec_fptr_pass_info = {
81905 + .pass = &kernexec_fptr_pass.pass,
81906 + .reference_pass_name = "ssa",
81907 + .ref_pass_instance_number = 0,
81908 + .pos_op = PASS_POS_INSERT_AFTER
81909 + };
81910 + struct register_pass_info kernexec_retaddr_pass_info = {
81911 + .pass = &kernexec_retaddr_pass.pass,
81912 + .reference_pass_name = "pro_and_epilogue",
81913 + .ref_pass_instance_number = 0,
81914 + .pos_op = PASS_POS_INSERT_AFTER
81915 + };
81916 +
81917 + if (!plugin_default_version_check(version, &gcc_version)) {
81918 + error(G_("incompatible gcc/plugin versions"));
81919 + return 1;
81920 + }
81921 +
81922 + register_callback(plugin_name, PLUGIN_INFO, NULL, &kernexec_plugin_info);
81923 +
81924 + for (i = 0; i < argc; ++i)
81925 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
81926 +
81927 + if (TARGET_64BIT == 0)
81928 + return 0;
81929 +
81930 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_fptr_pass_info);
81931 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_retaddr_pass_info);
81932 +
81933 + return 0;
81934 +}
81935 diff -urNp linux-2.6.32.46/tools/gcc/Makefile linux-2.6.32.46/tools/gcc/Makefile
81936 --- linux-2.6.32.46/tools/gcc/Makefile 1969-12-31 19:00:00.000000000 -0500
81937 +++ linux-2.6.32.46/tools/gcc/Makefile 2011-10-06 09:37:14.000000000 -0400
81938 @@ -0,0 +1,21 @@
81939 +#CC := gcc
81940 +#PLUGIN_SOURCE_FILES := pax_plugin.c
81941 +#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
81942 +GCCPLUGINS_DIR := $(shell $(HOSTCC) -print-file-name=plugin)
81943 +#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W
81944 +
81945 +HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include
81946 +
81947 +hostlibs-y := constify_plugin.so
81948 +hostlibs-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so
81949 +hostlibs-$(CONFIG_KALLOCSTAT_PLUGIN) += kallocstat_plugin.so
81950 +hostlibs-$(CONFIG_PAX_KERNEXEC_PLUGIN) += kernexec_plugin.so
81951 +hostlibs-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so
81952 +
81953 +always := $(hostlibs-y)
81954 +
81955 +stackleak_plugin-objs := stackleak_plugin.o
81956 +constify_plugin-objs := constify_plugin.o
81957 +kallocstat_plugin-objs := kallocstat_plugin.o
81958 +kernexec_plugin-objs := kernexec_plugin.o
81959 +checker_plugin-objs := checker_plugin.o
81960 diff -urNp linux-2.6.32.46/tools/gcc/stackleak_plugin.c linux-2.6.32.46/tools/gcc/stackleak_plugin.c
81961 --- linux-2.6.32.46/tools/gcc/stackleak_plugin.c 1969-12-31 19:00:00.000000000 -0500
81962 +++ linux-2.6.32.46/tools/gcc/stackleak_plugin.c 2011-10-06 09:37:14.000000000 -0400
81963 @@ -0,0 +1,251 @@
81964 +/*
81965 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
81966 + * Licensed under the GPL v2
81967 + *
81968 + * Note: the choice of the license means that the compilation process is
81969 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
81970 + * but for the kernel it doesn't matter since it doesn't link against
81971 + * any of the gcc libraries
81972 + *
81973 + * gcc plugin to help implement various PaX features
81974 + *
81975 + * - track lowest stack pointer
81976 + *
81977 + * TODO:
81978 + * - initialize all local variables
81979 + *
81980 + * BUGS:
81981 + * - none known
81982 + */
81983 +#include "gcc-plugin.h"
81984 +#include "config.h"
81985 +#include "system.h"
81986 +#include "coretypes.h"
81987 +#include "tree.h"
81988 +#include "tree-pass.h"
81989 +#include "intl.h"
81990 +#include "plugin-version.h"
81991 +#include "tm.h"
81992 +#include "toplev.h"
81993 +#include "basic-block.h"
81994 +#include "gimple.h"
81995 +//#include "expr.h" where are you...
81996 +#include "diagnostic.h"
81997 +#include "rtl.h"
81998 +#include "emit-rtl.h"
81999 +#include "function.h"
82000 +
82001 +int plugin_is_GPL_compatible;
82002 +
82003 +static int track_frame_size = -1;
82004 +static const char track_function[] = "pax_track_stack";
82005 +static bool init_locals;
82006 +
82007 +static struct plugin_info stackleak_plugin_info = {
82008 + .version = "201109112100",
82009 + .help = "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
82010 +// "initialize-locals\t\tforcibly initialize all stack frames\n"
82011 +};
82012 +
82013 +static bool gate_stackleak_track_stack(void);
82014 +static unsigned int execute_stackleak_tree_instrument(void);
82015 +static unsigned int execute_stackleak_final(void);
82016 +
82017 +static struct gimple_opt_pass stackleak_tree_instrument_pass = {
82018 + .pass = {
82019 + .type = GIMPLE_PASS,
82020 + .name = "stackleak_tree_instrument",
82021 + .gate = gate_stackleak_track_stack,
82022 + .execute = execute_stackleak_tree_instrument,
82023 + .sub = NULL,
82024 + .next = NULL,
82025 + .static_pass_number = 0,
82026 + .tv_id = TV_NONE,
82027 + .properties_required = PROP_gimple_leh | PROP_cfg,
82028 + .properties_provided = 0,
82029 + .properties_destroyed = 0,
82030 + .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
82031 + .todo_flags_finish = TODO_verify_stmts | TODO_dump_func
82032 + }
82033 +};
82034 +
82035 +static struct rtl_opt_pass stackleak_final_rtl_opt_pass = {
82036 + .pass = {
82037 + .type = RTL_PASS,
82038 + .name = "stackleak_final",
82039 + .gate = gate_stackleak_track_stack,
82040 + .execute = execute_stackleak_final,
82041 + .sub = NULL,
82042 + .next = NULL,
82043 + .static_pass_number = 0,
82044 + .tv_id = TV_NONE,
82045 + .properties_required = 0,
82046 + .properties_provided = 0,
82047 + .properties_destroyed = 0,
82048 + .todo_flags_start = 0,
82049 + .todo_flags_finish = TODO_dump_func
82050 + }
82051 +};
82052 +
82053 +static bool gate_stackleak_track_stack(void)
82054 +{
82055 + return track_frame_size >= 0;
82056 +}
82057 +
82058 +static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi, bool before)
82059 +{
82060 + gimple call;
82061 + tree fndecl, type;
82062 +
82063 + // insert call to void pax_track_stack(void)
82064 + type = build_function_type_list(void_type_node, NULL_TREE);
82065 + fndecl = build_fn_decl(track_function, type);
82066 + DECL_ASSEMBLER_NAME(fndecl); // for LTO
82067 + call = gimple_build_call(fndecl, 0);
82068 + if (before)
82069 + gsi_insert_before(gsi, call, GSI_CONTINUE_LINKING);
82070 + else
82071 + gsi_insert_after(gsi, call, GSI_CONTINUE_LINKING);
82072 +}
82073 +
82074 +static unsigned int execute_stackleak_tree_instrument(void)
82075 +{
82076 + basic_block bb, entry_bb;
82077 + gimple_stmt_iterator gsi;
82078 + bool prologue_instrumented = false;
82079 +
82080 + entry_bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb;
82081 +
82082 + // 1. loop through BBs and GIMPLE statements
82083 + FOR_EACH_BB(bb) {
82084 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
82085 + // gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
82086 + tree fndecl;
82087 + gimple stmt = gsi_stmt(gsi);
82088 +
82089 + if (!is_gimple_call(stmt))
82090 + continue;
82091 + fndecl = gimple_call_fndecl(stmt);
82092 + if (!fndecl)
82093 + continue;
82094 + if (TREE_CODE(fndecl) != FUNCTION_DECL)
82095 + continue;
82096 + if (!DECL_BUILT_IN(fndecl))
82097 + continue;
82098 + if (DECL_BUILT_IN_CLASS(fndecl) != BUILT_IN_NORMAL)
82099 + continue;
82100 + if (DECL_FUNCTION_CODE(fndecl) != BUILT_IN_ALLOCA)
82101 + continue;
82102 +
82103 + // 2. insert track call after each __builtin_alloca call
82104 + stackleak_add_instrumentation(&gsi, false);
82105 + if (bb == entry_bb)
82106 + prologue_instrumented = true;
82107 +// print_node(stderr, "pax", fndecl, 4);
82108 + }
82109 + }
82110 +
82111 + // 3. insert track call at the beginning
82112 + if (!prologue_instrumented) {
82113 + gsi = gsi_start_bb(entry_bb);
82114 + stackleak_add_instrumentation(&gsi, true);
82115 + }
82116 +
82117 + return 0;
82118 +}
82119 +
82120 +static unsigned int execute_stackleak_final(void)
82121 +{
82122 + rtx insn;
82123 +
82124 + if (cfun->calls_alloca)
82125 + return 0;
82126 +
82127 + // keep calls only if function frame is big enough
82128 + if (get_frame_size() >= track_frame_size)
82129 + return 0;
82130 +
82131 + // 1. find pax_track_stack calls
82132 + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
82133 + // rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
82134 + rtx body;
82135 +
82136 + if (!CALL_P(insn))
82137 + continue;
82138 + body = PATTERN(insn);
82139 + if (GET_CODE(body) != CALL)
82140 + continue;
82141 + body = XEXP(body, 0);
82142 + if (GET_CODE(body) != MEM)
82143 + continue;
82144 + body = XEXP(body, 0);
82145 + if (GET_CODE(body) != SYMBOL_REF)
82146 + continue;
82147 + if (strcmp(XSTR(body, 0), track_function))
82148 + continue;
82149 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
82150 + // 2. delete call
82151 + delete_insn_and_edges(insn);
82152 + }
82153 +
82154 +// print_simple_rtl(stderr, get_insns());
82155 +// print_rtl(stderr, get_insns());
82156 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
82157 +
82158 + return 0;
82159 +}
82160 +
82161 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
82162 +{
82163 + const char * const plugin_name = plugin_info->base_name;
82164 + const int argc = plugin_info->argc;
82165 + const struct plugin_argument * const argv = plugin_info->argv;
82166 + int i;
82167 + struct register_pass_info stackleak_tree_instrument_pass_info = {
82168 + .pass = &stackleak_tree_instrument_pass.pass,
82169 +// .reference_pass_name = "tree_profile",
82170 + .reference_pass_name = "optimized",
82171 + .ref_pass_instance_number = 0,
82172 + .pos_op = PASS_POS_INSERT_AFTER
82173 + };
82174 + struct register_pass_info stackleak_final_pass_info = {
82175 + .pass = &stackleak_final_rtl_opt_pass.pass,
82176 + .reference_pass_name = "final",
82177 + .ref_pass_instance_number = 0,
82178 + .pos_op = PASS_POS_INSERT_BEFORE
82179 + };
82180 +
82181 + if (!plugin_default_version_check(version, &gcc_version)) {
82182 + error(G_("incompatible gcc/plugin versions"));
82183 + return 1;
82184 + }
82185 +
82186 + register_callback(plugin_name, PLUGIN_INFO, NULL, &stackleak_plugin_info);
82187 +
82188 + for (i = 0; i < argc; ++i) {
82189 + if (!strcmp(argv[i].key, "track-lowest-sp")) {
82190 + if (!argv[i].value) {
82191 + error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
82192 + continue;
82193 + }
82194 + track_frame_size = atoi(argv[i].value);
82195 + if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
82196 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
82197 + continue;
82198 + }
82199 + if (!strcmp(argv[i].key, "initialize-locals")) {
82200 + if (argv[i].value) {
82201 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
82202 + continue;
82203 + }
82204 + init_locals = true;
82205 + continue;
82206 + }
82207 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
82208 + }
82209 +
82210 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
82211 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
82212 +
82213 + return 0;
82214 +}
82215 diff -urNp linux-2.6.32.46/usr/gen_init_cpio.c linux-2.6.32.46/usr/gen_init_cpio.c
82216 --- linux-2.6.32.46/usr/gen_init_cpio.c 2011-03-27 14:31:47.000000000 -0400
82217 +++ linux-2.6.32.46/usr/gen_init_cpio.c 2011-04-17 15:56:46.000000000 -0400
82218 @@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name,
82219 int retval;
82220 int rc = -1;
82221 int namesize;
82222 - int i;
82223 + unsigned int i;
82224
82225 mode |= S_IFREG;
82226
82227 @@ -383,9 +383,10 @@ static char *cpio_replace_env(char *new_
82228 *env_var = *expanded = '\0';
82229 strncat(env_var, start + 2, end - start - 2);
82230 strncat(expanded, new_location, start - new_location);
82231 - strncat(expanded, getenv(env_var), PATH_MAX);
82232 - strncat(expanded, end + 1, PATH_MAX);
82233 + strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
82234 + strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
82235 strncpy(new_location, expanded, PATH_MAX);
82236 + new_location[PATH_MAX] = 0;
82237 } else
82238 break;
82239 }
82240 diff -urNp linux-2.6.32.46/virt/kvm/kvm_main.c linux-2.6.32.46/virt/kvm/kvm_main.c
82241 --- linux-2.6.32.46/virt/kvm/kvm_main.c 2011-03-27 14:31:47.000000000 -0400
82242 +++ linux-2.6.32.46/virt/kvm/kvm_main.c 2011-08-05 20:33:55.000000000 -0400
82243 @@ -2494,7 +2494,7 @@ asmlinkage void kvm_handle_fault_on_rebo
82244 if (kvm_rebooting)
82245 /* spin while reset goes on */
82246 while (true)
82247 - ;
82248 + cpu_relax();
82249 /* Fault while not rebooting. We want the trace. */
82250 BUG();
82251 }
82252 @@ -2714,7 +2714,7 @@ static void kvm_sched_out(struct preempt
82253 kvm_arch_vcpu_put(vcpu);
82254 }
82255
82256 -int kvm_init(void *opaque, unsigned int vcpu_size,
82257 +int kvm_init(const void *opaque, unsigned int vcpu_size,
82258 struct module *module)
82259 {
82260 int r;
82261 @@ -2767,15 +2767,17 @@ int kvm_init(void *opaque, unsigned int
82262 /* A kmem cache lets us meet the alignment requirements of fx_save. */
82263 kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size,
82264 __alignof__(struct kvm_vcpu),
82265 - 0, NULL);
82266 + SLAB_USERCOPY, NULL);
82267 if (!kvm_vcpu_cache) {
82268 r = -ENOMEM;
82269 goto out_free_5;
82270 }
82271
82272 - kvm_chardev_ops.owner = module;
82273 - kvm_vm_fops.owner = module;
82274 - kvm_vcpu_fops.owner = module;
82275 + pax_open_kernel();
82276 + *(void **)&kvm_chardev_ops.owner = module;
82277 + *(void **)&kvm_vm_fops.owner = module;
82278 + *(void **)&kvm_vcpu_fops.owner = module;
82279 + pax_close_kernel();
82280
82281 r = misc_register(&kvm_dev);
82282 if (r) {
Unofficial grsecurity patch archive (https://github.com/slashbeast/grsecurity-scrape)