]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blob - test/grsecurity-2.2.2-2.6.32.49-201111262001.patch
projects / thirdparty / grsecurity-scrape.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-2.2.2-2.6.32.49-201111262001.patch
1 diff -urNp linux-2.6.32.49/arch/alpha/include/asm/elf.h linux-2.6.32.49/arch/alpha/include/asm/elf.h
2 --- linux-2.6.32.49/arch/alpha/include/asm/elf.h 2011-11-08 19:02:43.000000000 -0500
3 +++ linux-2.6.32.49/arch/alpha/include/asm/elf.h 2011-11-15 19:59:42.000000000 -0500
4 @@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
5
6 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
7
8 +#ifdef CONFIG_PAX_ASLR
9 +#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
10 +
11 +#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
12 +#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
13 +#endif
14 +
15 /* $0 is set by ld.so to a pointer to a function which might be
16 registered using atexit. This provides a mean for the dynamic
17 linker to call DT_FINI functions for shared libraries that have
18 diff -urNp linux-2.6.32.49/arch/alpha/include/asm/pgtable.h linux-2.6.32.49/arch/alpha/include/asm/pgtable.h
19 --- linux-2.6.32.49/arch/alpha/include/asm/pgtable.h 2011-11-08 19:02:43.000000000 -0500
20 +++ linux-2.6.32.49/arch/alpha/include/asm/pgtable.h 2011-11-15 19:59:42.000000000 -0500
21 @@ -101,6 +101,17 @@ struct vm_area_struct;
22 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
23 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
24 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
25 +
26 +#ifdef CONFIG_PAX_PAGEEXEC
27 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
28 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
29 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
30 +#else
31 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
32 +# define PAGE_COPY_NOEXEC PAGE_COPY
33 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
34 +#endif
35 +
36 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
37
38 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
39 diff -urNp linux-2.6.32.49/arch/alpha/kernel/module.c linux-2.6.32.49/arch/alpha/kernel/module.c
40 --- linux-2.6.32.49/arch/alpha/kernel/module.c 2011-11-08 19:02:43.000000000 -0500
41 +++ linux-2.6.32.49/arch/alpha/kernel/module.c 2011-11-15 19:59:42.000000000 -0500
42 @@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs,
43
44 /* The small sections were sorted to the end of the segment.
45 The following should definitely cover them. */
46 - gp = (u64)me->module_core + me->core_size - 0x8000;
47 + gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
48 got = sechdrs[me->arch.gotsecindex].sh_addr;
49
50 for (i = 0; i < n; i++) {
51 diff -urNp linux-2.6.32.49/arch/alpha/kernel/osf_sys.c linux-2.6.32.49/arch/alpha/kernel/osf_sys.c
52 --- linux-2.6.32.49/arch/alpha/kernel/osf_sys.c 2011-11-08 19:02:43.000000000 -0500
53 +++ linux-2.6.32.49/arch/alpha/kernel/osf_sys.c 2011-11-15 19:59:42.000000000 -0500
54 @@ -1172,7 +1172,7 @@ arch_get_unmapped_area_1(unsigned long a
55 /* At this point: (!vma || addr < vma->vm_end). */
56 if (limit - len < addr)
57 return -ENOMEM;
58 - if (!vma || addr + len <= vma->vm_start)
59 + if (check_heap_stack_gap(vma, addr, len))
60 return addr;
61 addr = vma->vm_end;
62 vma = vma->vm_next;
63 @@ -1208,6 +1208,10 @@ arch_get_unmapped_area(struct file *filp
64 merely specific addresses, but regions of memory -- perhaps
65 this feature should be incorporated into all ports? */
66
67 +#ifdef CONFIG_PAX_RANDMMAP
68 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
69 +#endif
70 +
71 if (addr) {
72 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
73 if (addr != (unsigned long) -ENOMEM)
74 @@ -1215,8 +1219,8 @@ arch_get_unmapped_area(struct file *filp
75 }
76
77 /* Next, try allocating at TASK_UNMAPPED_BASE. */
78 - addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
79 - len, limit);
80 + addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
81 +
82 if (addr != (unsigned long) -ENOMEM)
83 return addr;
84
85 diff -urNp linux-2.6.32.49/arch/alpha/mm/fault.c linux-2.6.32.49/arch/alpha/mm/fault.c
86 --- linux-2.6.32.49/arch/alpha/mm/fault.c 2011-11-08 19:02:43.000000000 -0500
87 +++ linux-2.6.32.49/arch/alpha/mm/fault.c 2011-11-18 18:01:52.000000000 -0500
88 @@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
89 __reload_thread(pcb);
90 }
91
92 +#ifdef CONFIG_PAX_PAGEEXEC
93 +/*
94 + * PaX: decide what to do with offenders (regs->pc = fault address)
95 + *
96 + * returns 1 when task should be killed
97 + * 2 when patched PLT trampoline was detected
98 + * 3 when unpatched PLT trampoline was detected
99 + */
100 +static int pax_handle_fetch_fault(struct pt_regs *regs)
101 +{
102 +
103 +#ifdef CONFIG_PAX_EMUPLT
104 + int err;
105 +
106 + do { /* PaX: patched PLT emulation #1 */
107 + unsigned int ldah, ldq, jmp;
108 +
109 + err = get_user(ldah, (unsigned int *)regs->pc);
110 + err |= get_user(ldq, (unsigned int *)(regs->pc+4));
111 + err |= get_user(jmp, (unsigned int *)(regs->pc+8));
112 +
113 + if (err)
114 + break;
115 +
116 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
117 + (ldq & 0xFFFF0000U) == 0xA77B0000U &&
118 + jmp == 0x6BFB0000U)
119 + {
120 + unsigned long r27, addr;
121 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
122 + unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
123 +
124 + addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
125 + err = get_user(r27, (unsigned long *)addr);
126 + if (err)
127 + break;
128 +
129 + regs->r27 = r27;
130 + regs->pc = r27;
131 + return 2;
132 + }
133 + } while (0);
134 +
135 + do { /* PaX: patched PLT emulation #2 */
136 + unsigned int ldah, lda, br;
137 +
138 + err = get_user(ldah, (unsigned int *)regs->pc);
139 + err |= get_user(lda, (unsigned int *)(regs->pc+4));
140 + err |= get_user(br, (unsigned int *)(regs->pc+8));
141 +
142 + if (err)
143 + break;
144 +
145 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
146 + (lda & 0xFFFF0000U) == 0xA77B0000U &&
147 + (br & 0xFFE00000U) == 0xC3E00000U)
148 + {
149 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
150 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
151 + unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
152 +
153 + regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
154 + regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
155 + return 2;
156 + }
157 + } while (0);
158 +
159 + do { /* PaX: unpatched PLT emulation */
160 + unsigned int br;
161 +
162 + err = get_user(br, (unsigned int *)regs->pc);
163 +
164 + if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
165 + unsigned int br2, ldq, nop, jmp;
166 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
167 +
168 + addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
169 + err = get_user(br2, (unsigned int *)addr);
170 + err |= get_user(ldq, (unsigned int *)(addr+4));
171 + err |= get_user(nop, (unsigned int *)(addr+8));
172 + err |= get_user(jmp, (unsigned int *)(addr+12));
173 + err |= get_user(resolver, (unsigned long *)(addr+16));
174 +
175 + if (err)
176 + break;
177 +
178 + if (br2 == 0xC3600000U &&
179 + ldq == 0xA77B000CU &&
180 + nop == 0x47FF041FU &&
181 + jmp == 0x6B7B0000U)
182 + {
183 + regs->r28 = regs->pc+4;
184 + regs->r27 = addr+16;
185 + regs->pc = resolver;
186 + return 3;
187 + }
188 + }
189 + } while (0);
190 +#endif
191 +
192 + return 1;
193 +}
194 +
195 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
196 +{
197 + unsigned long i;
198 +
199 + printk(KERN_ERR "PAX: bytes at PC: ");
200 + for (i = 0; i < 5; i++) {
201 + unsigned int c;
202 + if (get_user(c, (unsigned int *)pc+i))
203 + printk(KERN_CONT "???????? ");
204 + else
205 + printk(KERN_CONT "%08x ", c);
206 + }
207 + printk("\n");
208 +}
209 +#endif
210
211 /*
212 * This routine handles page faults. It determines the address,
213 @@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
214 good_area:
215 si_code = SEGV_ACCERR;
216 if (cause < 0) {
217 - if (!(vma->vm_flags & VM_EXEC))
218 + if (!(vma->vm_flags & VM_EXEC)) {
219 +
220 +#ifdef CONFIG_PAX_PAGEEXEC
221 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
222 + goto bad_area;
223 +
224 + up_read(&mm->mmap_sem);
225 + switch (pax_handle_fetch_fault(regs)) {
226 +
227 +#ifdef CONFIG_PAX_EMUPLT
228 + case 2:
229 + case 3:
230 + return;
231 +#endif
232 +
233 + }
234 + pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
235 + do_group_exit(SIGKILL);
236 +#else
237 goto bad_area;
238 +#endif
239 +
240 + }
241 } else if (!cause) {
242 /* Allow reads even for write-only mappings */
243 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
244 diff -urNp linux-2.6.32.49/arch/arm/include/asm/elf.h linux-2.6.32.49/arch/arm/include/asm/elf.h
245 --- linux-2.6.32.49/arch/arm/include/asm/elf.h 2011-11-08 19:02:43.000000000 -0500
246 +++ linux-2.6.32.49/arch/arm/include/asm/elf.h 2011-11-15 19:59:42.000000000 -0500
247 @@ -109,7 +109,14 @@ int dump_task_regs(struct task_struct *t
248 the loader. We need to make sure that it is out of the way of the program
249 that it will "exec", and that there is sufficient room for the brk. */
250
251 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
252 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
253 +
254 +#ifdef CONFIG_PAX_ASLR
255 +#define PAX_ELF_ET_DYN_BASE 0x00008000UL
256 +
257 +#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
258 +#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
259 +#endif
260
261 /* When the program starts, a1 contains a pointer to a function to be
262 registered with atexit, as per the SVR4 ABI. A value of 0 means we
263 diff -urNp linux-2.6.32.49/arch/arm/include/asm/kmap_types.h linux-2.6.32.49/arch/arm/include/asm/kmap_types.h
264 --- linux-2.6.32.49/arch/arm/include/asm/kmap_types.h 2011-11-08 19:02:43.000000000 -0500
265 +++ linux-2.6.32.49/arch/arm/include/asm/kmap_types.h 2011-11-15 19:59:42.000000000 -0500
266 @@ -19,6 +19,7 @@ enum km_type {
267 KM_SOFTIRQ0,
268 KM_SOFTIRQ1,
269 KM_L2_CACHE,
270 + KM_CLEARPAGE,
271 KM_TYPE_NR
272 };
273
274 diff -urNp linux-2.6.32.49/arch/arm/include/asm/uaccess.h linux-2.6.32.49/arch/arm/include/asm/uaccess.h
275 --- linux-2.6.32.49/arch/arm/include/asm/uaccess.h 2011-11-08 19:02:43.000000000 -0500
276 +++ linux-2.6.32.49/arch/arm/include/asm/uaccess.h 2011-11-15 19:59:42.000000000 -0500
277 @@ -22,6 +22,8 @@
278 #define VERIFY_READ 0
279 #define VERIFY_WRITE 1
280
281 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
282 +
283 /*
284 * The exception table consists of pairs of addresses: the first is the
285 * address of an instruction that is allowed to fault, and the second is
286 @@ -387,8 +389,23 @@ do { \
287
288
289 #ifdef CONFIG_MMU
290 -extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
291 -extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
292 +extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
293 +extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
294 +
295 +static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
296 +{
297 + if (!__builtin_constant_p(n))
298 + check_object_size(to, n, false);
299 + return ___copy_from_user(to, from, n);
300 +}
301 +
302 +static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
303 +{
304 + if (!__builtin_constant_p(n))
305 + check_object_size(from, n, true);
306 + return ___copy_to_user(to, from, n);
307 +}
308 +
309 extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
310 extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
311 extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
312 @@ -403,6 +420,9 @@ extern unsigned long __must_check __strn
313
314 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
315 {
316 + if ((long)n < 0)
317 + return n;
318 +
319 if (access_ok(VERIFY_READ, from, n))
320 n = __copy_from_user(to, from, n);
321 else /* security hole - plug it */
322 @@ -412,6 +432,9 @@ static inline unsigned long __must_check
323
324 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
325 {
326 + if ((long)n < 0)
327 + return n;
328 +
329 if (access_ok(VERIFY_WRITE, to, n))
330 n = __copy_to_user(to, from, n);
331 return n;
332 diff -urNp linux-2.6.32.49/arch/arm/kernel/armksyms.c linux-2.6.32.49/arch/arm/kernel/armksyms.c
333 --- linux-2.6.32.49/arch/arm/kernel/armksyms.c 2011-11-08 19:02:43.000000000 -0500
334 +++ linux-2.6.32.49/arch/arm/kernel/armksyms.c 2011-11-15 19:59:42.000000000 -0500
335 @@ -118,8 +118,8 @@ EXPORT_SYMBOL(__strncpy_from_user);
336 #ifdef CONFIG_MMU
337 EXPORT_SYMBOL(copy_page);
338
339 -EXPORT_SYMBOL(__copy_from_user);
340 -EXPORT_SYMBOL(__copy_to_user);
341 +EXPORT_SYMBOL(___copy_from_user);
342 +EXPORT_SYMBOL(___copy_to_user);
343 EXPORT_SYMBOL(__clear_user);
344
345 EXPORT_SYMBOL(__get_user_1);
346 diff -urNp linux-2.6.32.49/arch/arm/kernel/kgdb.c linux-2.6.32.49/arch/arm/kernel/kgdb.c
347 --- linux-2.6.32.49/arch/arm/kernel/kgdb.c 2011-11-08 19:02:43.000000000 -0500
348 +++ linux-2.6.32.49/arch/arm/kernel/kgdb.c 2011-11-15 19:59:42.000000000 -0500
349 @@ -190,7 +190,7 @@ void kgdb_arch_exit(void)
350 * and we handle the normal undef case within the do_undefinstr
351 * handler.
352 */
353 -struct kgdb_arch arch_kgdb_ops = {
354 +const struct kgdb_arch arch_kgdb_ops = {
355 #ifndef __ARMEB__
356 .gdb_bpt_instr = {0xfe, 0xde, 0xff, 0xe7}
357 #else /* ! __ARMEB__ */
358 diff -urNp linux-2.6.32.49/arch/arm/kernel/traps.c linux-2.6.32.49/arch/arm/kernel/traps.c
359 --- linux-2.6.32.49/arch/arm/kernel/traps.c 2011-11-08 19:02:43.000000000 -0500
360 +++ linux-2.6.32.49/arch/arm/kernel/traps.c 2011-11-15 19:59:42.000000000 -0500
361 @@ -247,6 +247,8 @@ static void __die(const char *str, int e
362
363 DEFINE_SPINLOCK(die_lock);
364
365 +extern void gr_handle_kernel_exploit(void);
366 +
367 /*
368 * This function is protected against re-entrancy.
369 */
370 @@ -271,6 +273,8 @@ NORET_TYPE void die(const char *str, str
371 if (panic_on_oops)
372 panic("Fatal exception");
373
374 + gr_handle_kernel_exploit();
375 +
376 do_exit(SIGSEGV);
377 }
378
379 diff -urNp linux-2.6.32.49/arch/arm/lib/copy_from_user.S linux-2.6.32.49/arch/arm/lib/copy_from_user.S
380 --- linux-2.6.32.49/arch/arm/lib/copy_from_user.S 2011-11-08 19:02:43.000000000 -0500
381 +++ linux-2.6.32.49/arch/arm/lib/copy_from_user.S 2011-11-15 19:59:42.000000000 -0500
382 @@ -16,7 +16,7 @@
383 /*
384 * Prototype:
385 *
386 - * size_t __copy_from_user(void *to, const void *from, size_t n)
387 + * size_t ___copy_from_user(void *to, const void *from, size_t n)
388 *
389 * Purpose:
390 *
391 @@ -84,11 +84,11 @@
392
393 .text
394
395 -ENTRY(__copy_from_user)
396 +ENTRY(___copy_from_user)
397
398 #include "copy_template.S"
399
400 -ENDPROC(__copy_from_user)
401 +ENDPROC(___copy_from_user)
402
403 .section .fixup,"ax"
404 .align 0
405 diff -urNp linux-2.6.32.49/arch/arm/lib/copy_to_user.S linux-2.6.32.49/arch/arm/lib/copy_to_user.S
406 --- linux-2.6.32.49/arch/arm/lib/copy_to_user.S 2011-11-08 19:02:43.000000000 -0500
407 +++ linux-2.6.32.49/arch/arm/lib/copy_to_user.S 2011-11-15 19:59:42.000000000 -0500
408 @@ -16,7 +16,7 @@
409 /*
410 * Prototype:
411 *
412 - * size_t __copy_to_user(void *to, const void *from, size_t n)
413 + * size_t ___copy_to_user(void *to, const void *from, size_t n)
414 *
415 * Purpose:
416 *
417 @@ -88,11 +88,11 @@
418 .text
419
420 ENTRY(__copy_to_user_std)
421 -WEAK(__copy_to_user)
422 +WEAK(___copy_to_user)
423
424 #include "copy_template.S"
425
426 -ENDPROC(__copy_to_user)
427 +ENDPROC(___copy_to_user)
428
429 .section .fixup,"ax"
430 .align 0
431 diff -urNp linux-2.6.32.49/arch/arm/lib/uaccess.S linux-2.6.32.49/arch/arm/lib/uaccess.S
432 --- linux-2.6.32.49/arch/arm/lib/uaccess.S 2011-11-08 19:02:43.000000000 -0500
433 +++ linux-2.6.32.49/arch/arm/lib/uaccess.S 2011-11-15 19:59:42.000000000 -0500
434 @@ -19,7 +19,7 @@
435
436 #define PAGE_SHIFT 12
437
438 -/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
439 +/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n)
440 * Purpose : copy a block to user memory from kernel memory
441 * Params : to - user memory
442 * : from - kernel memory
443 @@ -39,7 +39,7 @@ USER( strgtbt r3, [r0], #1) @ May fau
444 sub r2, r2, ip
445 b .Lc2u_dest_aligned
446
447 -ENTRY(__copy_to_user)
448 +ENTRY(___copy_to_user)
449 stmfd sp!, {r2, r4 - r7, lr}
450 cmp r2, #4
451 blt .Lc2u_not_enough
452 @@ -277,14 +277,14 @@ USER( strgebt r3, [r0], #1) @ May fau
453 ldrgtb r3, [r1], #0
454 USER( strgtbt r3, [r0], #1) @ May fault
455 b .Lc2u_finished
456 -ENDPROC(__copy_to_user)
457 +ENDPROC(___copy_to_user)
458
459 .section .fixup,"ax"
460 .align 0
461 9001: ldmfd sp!, {r0, r4 - r7, pc}
462 .previous
463
464 -/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
465 +/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n);
466 * Purpose : copy a block from user memory to kernel memory
467 * Params : to - kernel memory
468 * : from - user memory
469 @@ -303,7 +303,7 @@ USER( ldrgtbt r3, [r1], #1) @ May fau
470 sub r2, r2, ip
471 b .Lcfu_dest_aligned
472
473 -ENTRY(__copy_from_user)
474 +ENTRY(___copy_from_user)
475 stmfd sp!, {r0, r2, r4 - r7, lr}
476 cmp r2, #4
477 blt .Lcfu_not_enough
478 @@ -543,7 +543,7 @@ USER( ldrgebt r3, [r1], #1) @ May fau
479 USER( ldrgtbt r3, [r1], #1) @ May fault
480 strgtb r3, [r0], #1
481 b .Lcfu_finished
482 -ENDPROC(__copy_from_user)
483 +ENDPROC(___copy_from_user)
484
485 .section .fixup,"ax"
486 .align 0
487 diff -urNp linux-2.6.32.49/arch/arm/lib/uaccess_with_memcpy.c linux-2.6.32.49/arch/arm/lib/uaccess_with_memcpy.c
488 --- linux-2.6.32.49/arch/arm/lib/uaccess_with_memcpy.c 2011-11-08 19:02:43.000000000 -0500
489 +++ linux-2.6.32.49/arch/arm/lib/uaccess_with_memcpy.c 2011-11-15 19:59:42.000000000 -0500
490 @@ -97,7 +97,7 @@ out:
491 }
492
493 unsigned long
494 -__copy_to_user(void __user *to, const void *from, unsigned long n)
495 +___copy_to_user(void __user *to, const void *from, unsigned long n)
496 {
497 /*
498 * This test is stubbed out of the main function above to keep
499 diff -urNp linux-2.6.32.49/arch/arm/mach-at91/pm.c linux-2.6.32.49/arch/arm/mach-at91/pm.c
500 --- linux-2.6.32.49/arch/arm/mach-at91/pm.c 2011-11-08 19:02:43.000000000 -0500
501 +++ linux-2.6.32.49/arch/arm/mach-at91/pm.c 2011-11-15 19:59:42.000000000 -0500
502 @@ -348,7 +348,7 @@ static void at91_pm_end(void)
503 }
504
505
506 -static struct platform_suspend_ops at91_pm_ops ={
507 +static const struct platform_suspend_ops at91_pm_ops ={
508 .valid = at91_pm_valid_state,
509 .begin = at91_pm_begin,
510 .enter = at91_pm_enter,
511 diff -urNp linux-2.6.32.49/arch/arm/mach-omap1/pm.c linux-2.6.32.49/arch/arm/mach-omap1/pm.c
512 --- linux-2.6.32.49/arch/arm/mach-omap1/pm.c 2011-11-08 19:02:43.000000000 -0500
513 +++ linux-2.6.32.49/arch/arm/mach-omap1/pm.c 2011-11-15 19:59:42.000000000 -0500
514 @@ -647,7 +647,7 @@ static struct irqaction omap_wakeup_irq
515
516
517
518 -static struct platform_suspend_ops omap_pm_ops ={
519 +static const struct platform_suspend_ops omap_pm_ops ={
520 .prepare = omap_pm_prepare,
521 .enter = omap_pm_enter,
522 .finish = omap_pm_finish,
523 diff -urNp linux-2.6.32.49/arch/arm/mach-omap2/pm24xx.c linux-2.6.32.49/arch/arm/mach-omap2/pm24xx.c
524 --- linux-2.6.32.49/arch/arm/mach-omap2/pm24xx.c 2011-11-08 19:02:43.000000000 -0500
525 +++ linux-2.6.32.49/arch/arm/mach-omap2/pm24xx.c 2011-11-15 19:59:42.000000000 -0500
526 @@ -326,7 +326,7 @@ static void omap2_pm_finish(void)
527 enable_hlt();
528 }
529
530 -static struct platform_suspend_ops omap_pm_ops = {
531 +static const struct platform_suspend_ops omap_pm_ops = {
532 .prepare = omap2_pm_prepare,
533 .enter = omap2_pm_enter,
534 .finish = omap2_pm_finish,
535 diff -urNp linux-2.6.32.49/arch/arm/mach-omap2/pm34xx.c linux-2.6.32.49/arch/arm/mach-omap2/pm34xx.c
536 --- linux-2.6.32.49/arch/arm/mach-omap2/pm34xx.c 2011-11-08 19:02:43.000000000 -0500
537 +++ linux-2.6.32.49/arch/arm/mach-omap2/pm34xx.c 2011-11-15 19:59:42.000000000 -0500
538 @@ -401,7 +401,7 @@ static void omap3_pm_end(void)
539 return;
540 }
541
542 -static struct platform_suspend_ops omap_pm_ops = {
543 +static const struct platform_suspend_ops omap_pm_ops = {
544 .begin = omap3_pm_begin,
545 .end = omap3_pm_end,
546 .prepare = omap3_pm_prepare,
547 diff -urNp linux-2.6.32.49/arch/arm/mach-pnx4008/pm.c linux-2.6.32.49/arch/arm/mach-pnx4008/pm.c
548 --- linux-2.6.32.49/arch/arm/mach-pnx4008/pm.c 2011-11-08 19:02:43.000000000 -0500
549 +++ linux-2.6.32.49/arch/arm/mach-pnx4008/pm.c 2011-11-15 19:59:42.000000000 -0500
550 @@ -116,7 +116,7 @@ static int pnx4008_pm_valid(suspend_stat
551 (state == PM_SUSPEND_MEM);
552 }
553
554 -static struct platform_suspend_ops pnx4008_pm_ops = {
555 +static const struct platform_suspend_ops pnx4008_pm_ops = {
556 .enter = pnx4008_pm_enter,
557 .valid = pnx4008_pm_valid,
558 };
559 diff -urNp linux-2.6.32.49/arch/arm/mach-pxa/pm.c linux-2.6.32.49/arch/arm/mach-pxa/pm.c
560 --- linux-2.6.32.49/arch/arm/mach-pxa/pm.c 2011-11-08 19:02:43.000000000 -0500
561 +++ linux-2.6.32.49/arch/arm/mach-pxa/pm.c 2011-11-15 19:59:42.000000000 -0500
562 @@ -95,7 +95,7 @@ void pxa_pm_finish(void)
563 pxa_cpu_pm_fns->finish();
564 }
565
566 -static struct platform_suspend_ops pxa_pm_ops = {
567 +static const struct platform_suspend_ops pxa_pm_ops = {
568 .valid = pxa_pm_valid,
569 .enter = pxa_pm_enter,
570 .prepare = pxa_pm_prepare,
571 diff -urNp linux-2.6.32.49/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.32.49/arch/arm/mach-pxa/sharpsl_pm.c
572 --- linux-2.6.32.49/arch/arm/mach-pxa/sharpsl_pm.c 2011-11-08 19:02:43.000000000 -0500
573 +++ linux-2.6.32.49/arch/arm/mach-pxa/sharpsl_pm.c 2011-11-15 19:59:42.000000000 -0500
574 @@ -891,7 +891,7 @@ static void sharpsl_apm_get_power_status
575 }
576
577 #ifdef CONFIG_PM
578 -static struct platform_suspend_ops sharpsl_pm_ops = {
579 +static const struct platform_suspend_ops sharpsl_pm_ops = {
580 .prepare = pxa_pm_prepare,
581 .finish = pxa_pm_finish,
582 .enter = corgi_pxa_pm_enter,
583 diff -urNp linux-2.6.32.49/arch/arm/mach-sa1100/pm.c linux-2.6.32.49/arch/arm/mach-sa1100/pm.c
584 --- linux-2.6.32.49/arch/arm/mach-sa1100/pm.c 2011-11-08 19:02:43.000000000 -0500
585 +++ linux-2.6.32.49/arch/arm/mach-sa1100/pm.c 2011-11-15 19:59:42.000000000 -0500
586 @@ -120,7 +120,7 @@ unsigned long sleep_phys_sp(void *sp)
587 return virt_to_phys(sp);
588 }
589
590 -static struct platform_suspend_ops sa11x0_pm_ops = {
591 +static const struct platform_suspend_ops sa11x0_pm_ops = {
592 .enter = sa11x0_pm_enter,
593 .valid = suspend_valid_only_mem,
594 };
595 diff -urNp linux-2.6.32.49/arch/arm/mm/fault.c linux-2.6.32.49/arch/arm/mm/fault.c
596 --- linux-2.6.32.49/arch/arm/mm/fault.c 2011-11-08 19:02:43.000000000 -0500
597 +++ linux-2.6.32.49/arch/arm/mm/fault.c 2011-11-18 18:01:52.000000000 -0500
598 @@ -166,6 +166,13 @@ __do_user_fault(struct task_struct *tsk,
599 }
600 #endif
601
602 +#ifdef CONFIG_PAX_PAGEEXEC
603 + if (fsr & FSR_LNX_PF) {
604 + pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
605 + do_group_exit(SIGKILL);
606 + }
607 +#endif
608 +
609 tsk->thread.address = addr;
610 tsk->thread.error_code = fsr;
611 tsk->thread.trap_no = 14;
612 @@ -357,6 +364,33 @@ do_page_fault(unsigned long addr, unsign
613 }
614 #endif /* CONFIG_MMU */
615
616 +#ifdef CONFIG_PAX_PAGEEXEC
617 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
618 +{
619 + long i;
620 +
621 + printk(KERN_ERR "PAX: bytes at PC: ");
622 + for (i = 0; i < 20; i++) {
623 + unsigned char c;
624 + if (get_user(c, (__force unsigned char __user *)pc+i))
625 + printk(KERN_CONT "?? ");
626 + else
627 + printk(KERN_CONT "%02x ", c);
628 + }
629 + printk("\n");
630 +
631 + printk(KERN_ERR "PAX: bytes at SP-4: ");
632 + for (i = -1; i < 20; i++) {
633 + unsigned long c;
634 + if (get_user(c, (__force unsigned long __user *)sp+i))
635 + printk(KERN_CONT "???????? ");
636 + else
637 + printk(KERN_CONT "%08lx ", c);
638 + }
639 + printk("\n");
640 +}
641 +#endif
642 +
643 /*
644 * First Level Translation Fault Handler
645 *
646 diff -urNp linux-2.6.32.49/arch/arm/mm/mmap.c linux-2.6.32.49/arch/arm/mm/mmap.c
647 --- linux-2.6.32.49/arch/arm/mm/mmap.c 2011-11-08 19:02:43.000000000 -0500
648 +++ linux-2.6.32.49/arch/arm/mm/mmap.c 2011-11-15 19:59:42.000000000 -0500
649 @@ -63,6 +63,10 @@ arch_get_unmapped_area(struct file *filp
650 if (len > TASK_SIZE)
651 return -ENOMEM;
652
653 +#ifdef CONFIG_PAX_RANDMMAP
654 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
655 +#endif
656 +
657 if (addr) {
658 if (do_align)
659 addr = COLOUR_ALIGN(addr, pgoff);
660 @@ -70,15 +74,14 @@ arch_get_unmapped_area(struct file *filp
661 addr = PAGE_ALIGN(addr);
662
663 vma = find_vma(mm, addr);
664 - if (TASK_SIZE - len >= addr &&
665 - (!vma || addr + len <= vma->vm_start))
666 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
667 return addr;
668 }
669 if (len > mm->cached_hole_size) {
670 - start_addr = addr = mm->free_area_cache;
671 + start_addr = addr = mm->free_area_cache;
672 } else {
673 - start_addr = addr = TASK_UNMAPPED_BASE;
674 - mm->cached_hole_size = 0;
675 + start_addr = addr = mm->mmap_base;
676 + mm->cached_hole_size = 0;
677 }
678
679 full_search:
680 @@ -94,14 +97,14 @@ full_search:
681 * Start a new search - just in case we missed
682 * some holes.
683 */
684 - if (start_addr != TASK_UNMAPPED_BASE) {
685 - start_addr = addr = TASK_UNMAPPED_BASE;
686 + if (start_addr != mm->mmap_base) {
687 + start_addr = addr = mm->mmap_base;
688 mm->cached_hole_size = 0;
689 goto full_search;
690 }
691 return -ENOMEM;
692 }
693 - if (!vma || addr + len <= vma->vm_start) {
694 + if (check_heap_stack_gap(vma, addr, len)) {
695 /*
696 * Remember the place where we stopped the search:
697 */
698 diff -urNp linux-2.6.32.49/arch/arm/plat-s3c/pm.c linux-2.6.32.49/arch/arm/plat-s3c/pm.c
699 --- linux-2.6.32.49/arch/arm/plat-s3c/pm.c 2011-11-08 19:02:43.000000000 -0500
700 +++ linux-2.6.32.49/arch/arm/plat-s3c/pm.c 2011-11-15 19:59:42.000000000 -0500
701 @@ -355,7 +355,7 @@ static void s3c_pm_finish(void)
702 s3c_pm_check_cleanup();
703 }
704
705 -static struct platform_suspend_ops s3c_pm_ops = {
706 +static const struct platform_suspend_ops s3c_pm_ops = {
707 .enter = s3c_pm_enter,
708 .prepare = s3c_pm_prepare,
709 .finish = s3c_pm_finish,
710 diff -urNp linux-2.6.32.49/arch/avr32/include/asm/elf.h linux-2.6.32.49/arch/avr32/include/asm/elf.h
711 --- linux-2.6.32.49/arch/avr32/include/asm/elf.h 2011-11-08 19:02:43.000000000 -0500
712 +++ linux-2.6.32.49/arch/avr32/include/asm/elf.h 2011-11-15 19:59:42.000000000 -0500
713 @@ -85,8 +85,14 @@ typedef struct user_fpu_struct elf_fpreg
714 the loader. We need to make sure that it is out of the way of the program
715 that it will "exec", and that there is sufficient room for the brk. */
716
717 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
718 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
719
720 +#ifdef CONFIG_PAX_ASLR
721 +#define PAX_ELF_ET_DYN_BASE 0x00001000UL
722 +
723 +#define PAX_DELTA_MMAP_LEN 15
724 +#define PAX_DELTA_STACK_LEN 15
725 +#endif
726
727 /* This yields a mask that user programs can use to figure out what
728 instruction set this CPU supports. This could be done in user space,
729 diff -urNp linux-2.6.32.49/arch/avr32/include/asm/kmap_types.h linux-2.6.32.49/arch/avr32/include/asm/kmap_types.h
730 --- linux-2.6.32.49/arch/avr32/include/asm/kmap_types.h 2011-11-08 19:02:43.000000000 -0500
731 +++ linux-2.6.32.49/arch/avr32/include/asm/kmap_types.h 2011-11-15 19:59:42.000000000 -0500
732 @@ -22,7 +22,8 @@ D(10) KM_IRQ0,
733 D(11) KM_IRQ1,
734 D(12) KM_SOFTIRQ0,
735 D(13) KM_SOFTIRQ1,
736 -D(14) KM_TYPE_NR
737 +D(14) KM_CLEARPAGE,
738 +D(15) KM_TYPE_NR
739 };
740
741 #undef D
742 diff -urNp linux-2.6.32.49/arch/avr32/mach-at32ap/pm.c linux-2.6.32.49/arch/avr32/mach-at32ap/pm.c
743 --- linux-2.6.32.49/arch/avr32/mach-at32ap/pm.c 2011-11-08 19:02:43.000000000 -0500
744 +++ linux-2.6.32.49/arch/avr32/mach-at32ap/pm.c 2011-11-15 19:59:42.000000000 -0500
745 @@ -176,7 +176,7 @@ out:
746 return 0;
747 }
748
749 -static struct platform_suspend_ops avr32_pm_ops = {
750 +static const struct platform_suspend_ops avr32_pm_ops = {
751 .valid = avr32_pm_valid_state,
752 .enter = avr32_pm_enter,
753 };
754 diff -urNp linux-2.6.32.49/arch/avr32/mm/fault.c linux-2.6.32.49/arch/avr32/mm/fault.c
755 --- linux-2.6.32.49/arch/avr32/mm/fault.c 2011-11-08 19:02:43.000000000 -0500
756 +++ linux-2.6.32.49/arch/avr32/mm/fault.c 2011-11-18 18:01:52.000000000 -0500
757 @@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
758
759 int exception_trace = 1;
760
761 +#ifdef CONFIG_PAX_PAGEEXEC
762 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
763 +{
764 + unsigned long i;
765 +
766 + printk(KERN_ERR "PAX: bytes at PC: ");
767 + for (i = 0; i < 20; i++) {
768 + unsigned char c;
769 + if (get_user(c, (unsigned char *)pc+i))
770 + printk(KERN_CONT "???????? ");
771 + else
772 + printk(KERN_CONT "%02x ", c);
773 + }
774 + printk("\n");
775 +}
776 +#endif
777 +
778 /*
779 * This routine handles page faults. It determines the address and the
780 * problem, and then passes it off to one of the appropriate routines.
781 @@ -157,6 +174,16 @@ bad_area:
782 up_read(&mm->mmap_sem);
783
784 if (user_mode(regs)) {
785 +
786 +#ifdef CONFIG_PAX_PAGEEXEC
787 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
788 + if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
789 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
790 + do_group_exit(SIGKILL);
791 + }
792 + }
793 +#endif
794 +
795 if (exception_trace && printk_ratelimit())
796 printk("%s%s[%d]: segfault at %08lx pc %08lx "
797 "sp %08lx ecr %lu\n",
798 diff -urNp linux-2.6.32.49/arch/blackfin/kernel/kgdb.c linux-2.6.32.49/arch/blackfin/kernel/kgdb.c
799 --- linux-2.6.32.49/arch/blackfin/kernel/kgdb.c 2011-11-08 19:02:43.000000000 -0500
800 +++ linux-2.6.32.49/arch/blackfin/kernel/kgdb.c 2011-11-15 19:59:42.000000000 -0500
801 @@ -428,7 +428,7 @@ int kgdb_arch_handle_exception(int vecto
802 return -1; /* this means that we do not want to exit from the handler */
803 }
804
805 -struct kgdb_arch arch_kgdb_ops = {
806 +const struct kgdb_arch arch_kgdb_ops = {
807 .gdb_bpt_instr = {0xa1},
808 #ifdef CONFIG_SMP
809 .flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
810 diff -urNp linux-2.6.32.49/arch/blackfin/mach-common/pm.c linux-2.6.32.49/arch/blackfin/mach-common/pm.c
811 --- linux-2.6.32.49/arch/blackfin/mach-common/pm.c 2011-11-08 19:02:43.000000000 -0500
812 +++ linux-2.6.32.49/arch/blackfin/mach-common/pm.c 2011-11-15 19:59:42.000000000 -0500
813 @@ -255,7 +255,7 @@ static int bfin_pm_enter(suspend_state_t
814 return 0;
815 }
816
817 -struct platform_suspend_ops bfin_pm_ops = {
818 +const struct platform_suspend_ops bfin_pm_ops = {
819 .enter = bfin_pm_enter,
820 .valid = bfin_pm_valid,
821 };
822 diff -urNp linux-2.6.32.49/arch/frv/include/asm/kmap_types.h linux-2.6.32.49/arch/frv/include/asm/kmap_types.h
823 --- linux-2.6.32.49/arch/frv/include/asm/kmap_types.h 2011-11-08 19:02:43.000000000 -0500
824 +++ linux-2.6.32.49/arch/frv/include/asm/kmap_types.h 2011-11-15 19:59:42.000000000 -0500
825 @@ -23,6 +23,7 @@ enum km_type {
826 KM_IRQ1,
827 KM_SOFTIRQ0,
828 KM_SOFTIRQ1,
829 + KM_CLEARPAGE,
830 KM_TYPE_NR
831 };
832
833 diff -urNp linux-2.6.32.49/arch/frv/mm/elf-fdpic.c linux-2.6.32.49/arch/frv/mm/elf-fdpic.c
834 --- linux-2.6.32.49/arch/frv/mm/elf-fdpic.c 2011-11-08 19:02:43.000000000 -0500
835 +++ linux-2.6.32.49/arch/frv/mm/elf-fdpic.c 2011-11-15 19:59:42.000000000 -0500
836 @@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(str
837 if (addr) {
838 addr = PAGE_ALIGN(addr);
839 vma = find_vma(current->mm, addr);
840 - if (TASK_SIZE - len >= addr &&
841 - (!vma || addr + len <= vma->vm_start))
842 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
843 goto success;
844 }
845
846 @@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(str
847 for (; vma; vma = vma->vm_next) {
848 if (addr > limit)
849 break;
850 - if (addr + len <= vma->vm_start)
851 + if (check_heap_stack_gap(vma, addr, len))
852 goto success;
853 addr = vma->vm_end;
854 }
855 @@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(str
856 for (; vma; vma = vma->vm_next) {
857 if (addr > limit)
858 break;
859 - if (addr + len <= vma->vm_start)
860 + if (check_heap_stack_gap(vma, addr, len))
861 goto success;
862 addr = vma->vm_end;
863 }
864 diff -urNp linux-2.6.32.49/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.32.49/arch/ia64/hp/common/hwsw_iommu.c
865 --- linux-2.6.32.49/arch/ia64/hp/common/hwsw_iommu.c 2011-11-08 19:02:43.000000000 -0500
866 +++ linux-2.6.32.49/arch/ia64/hp/common/hwsw_iommu.c 2011-11-15 19:59:42.000000000 -0500
867 @@ -17,7 +17,7 @@
868 #include <linux/swiotlb.h>
869 #include <asm/machvec.h>
870
871 -extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
872 +extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
873
874 /* swiotlb declarations & definitions: */
875 extern int swiotlb_late_init_with_default_size (size_t size);
876 @@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
877 !sba_dma_ops.dma_supported(dev, *dev->dma_mask);
878 }
879
880 -struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
881 +const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
882 {
883 if (use_swiotlb(dev))
884 return &swiotlb_dma_ops;
885 diff -urNp linux-2.6.32.49/arch/ia64/hp/common/sba_iommu.c linux-2.6.32.49/arch/ia64/hp/common/sba_iommu.c
886 --- linux-2.6.32.49/arch/ia64/hp/common/sba_iommu.c 2011-11-08 19:02:43.000000000 -0500
887 +++ linux-2.6.32.49/arch/ia64/hp/common/sba_iommu.c 2011-11-15 19:59:42.000000000 -0500
888 @@ -2097,7 +2097,7 @@ static struct acpi_driver acpi_sba_ioc_d
889 },
890 };
891
892 -extern struct dma_map_ops swiotlb_dma_ops;
893 +extern const struct dma_map_ops swiotlb_dma_ops;
894
895 static int __init
896 sba_init(void)
897 @@ -2211,7 +2211,7 @@ sba_page_override(char *str)
898
899 __setup("sbapagesize=",sba_page_override);
900
901 -struct dma_map_ops sba_dma_ops = {
902 +const struct dma_map_ops sba_dma_ops = {
903 .alloc_coherent = sba_alloc_coherent,
904 .free_coherent = sba_free_coherent,
905 .map_page = sba_map_page,
906 diff -urNp linux-2.6.32.49/arch/ia64/ia32/binfmt_elf32.c linux-2.6.32.49/arch/ia64/ia32/binfmt_elf32.c
907 --- linux-2.6.32.49/arch/ia64/ia32/binfmt_elf32.c 2011-11-08 19:02:43.000000000 -0500
908 +++ linux-2.6.32.49/arch/ia64/ia32/binfmt_elf32.c 2011-11-15 19:59:42.000000000 -0500
909 @@ -45,6 +45,13 @@ randomize_stack_top(unsigned long stack_
910
911 #define elf_read_implies_exec(ex, have_pt_gnu_stack) (!(have_pt_gnu_stack))
912
913 +#ifdef CONFIG_PAX_ASLR
914 +#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
915 +
916 +#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
917 +#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
918 +#endif
919 +
920 /* Ugly but avoids duplication */
921 #include "../../../fs/binfmt_elf.c"
922
923 diff -urNp linux-2.6.32.49/arch/ia64/ia32/ia32priv.h linux-2.6.32.49/arch/ia64/ia32/ia32priv.h
924 --- linux-2.6.32.49/arch/ia64/ia32/ia32priv.h 2011-11-08 19:02:43.000000000 -0500
925 +++ linux-2.6.32.49/arch/ia64/ia32/ia32priv.h 2011-11-15 19:59:42.000000000 -0500
926 @@ -296,7 +296,14 @@ typedef struct compat_siginfo {
927 #define ELF_DATA ELFDATA2LSB
928 #define ELF_ARCH EM_386
929
930 -#define IA32_STACK_TOP IA32_PAGE_OFFSET
931 +#ifdef CONFIG_PAX_RANDUSTACK
932 +#define __IA32_DELTA_STACK (current->mm->delta_stack)
933 +#else
934 +#define __IA32_DELTA_STACK 0UL
935 +#endif
936 +
937 +#define IA32_STACK_TOP (IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
938 +
939 #define IA32_GATE_OFFSET IA32_PAGE_OFFSET
940 #define IA32_GATE_END IA32_PAGE_OFFSET + PAGE_SIZE
941
942 diff -urNp linux-2.6.32.49/arch/ia64/include/asm/dma-mapping.h linux-2.6.32.49/arch/ia64/include/asm/dma-mapping.h
943 --- linux-2.6.32.49/arch/ia64/include/asm/dma-mapping.h 2011-11-08 19:02:43.000000000 -0500
944 +++ linux-2.6.32.49/arch/ia64/include/asm/dma-mapping.h 2011-11-15 19:59:42.000000000 -0500
945 @@ -12,7 +12,7 @@
946
947 #define ARCH_HAS_DMA_GET_REQUIRED_MASK
948
949 -extern struct dma_map_ops *dma_ops;
950 +extern const struct dma_map_ops *dma_ops;
951 extern struct ia64_machine_vector ia64_mv;
952 extern void set_iommu_machvec(void);
953
954 @@ -24,7 +24,7 @@ extern void machvec_dma_sync_sg(struct d
955 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
956 dma_addr_t *daddr, gfp_t gfp)
957 {
958 - struct dma_map_ops *ops = platform_dma_get_ops(dev);
959 + const struct dma_map_ops *ops = platform_dma_get_ops(dev);
960 void *caddr;
961
962 caddr = ops->alloc_coherent(dev, size, daddr, gfp);
963 @@ -35,7 +35,7 @@ static inline void *dma_alloc_coherent(s
964 static inline void dma_free_coherent(struct device *dev, size_t size,
965 void *caddr, dma_addr_t daddr)
966 {
967 - struct dma_map_ops *ops = platform_dma_get_ops(dev);
968 + const struct dma_map_ops *ops = platform_dma_get_ops(dev);
969 debug_dma_free_coherent(dev, size, caddr, daddr);
970 ops->free_coherent(dev, size, caddr, daddr);
971 }
972 @@ -49,13 +49,13 @@ static inline void dma_free_coherent(str
973
974 static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
975 {
976 - struct dma_map_ops *ops = platform_dma_get_ops(dev);
977 + const struct dma_map_ops *ops = platform_dma_get_ops(dev);
978 return ops->mapping_error(dev, daddr);
979 }
980
981 static inline int dma_supported(struct device *dev, u64 mask)
982 {
983 - struct dma_map_ops *ops = platform_dma_get_ops(dev);
984 + const struct dma_map_ops *ops = platform_dma_get_ops(dev);
985 return ops->dma_supported(dev, mask);
986 }
987
988 diff -urNp linux-2.6.32.49/arch/ia64/include/asm/elf.h linux-2.6.32.49/arch/ia64/include/asm/elf.h
989 --- linux-2.6.32.49/arch/ia64/include/asm/elf.h 2011-11-08 19:02:43.000000000 -0500
990 +++ linux-2.6.32.49/arch/ia64/include/asm/elf.h 2011-11-15 19:59:42.000000000 -0500
991 @@ -43,6 +43,13 @@
992 */
993 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
994
995 +#ifdef CONFIG_PAX_ASLR
996 +#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
997 +
998 +#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
999 +#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1000 +#endif
1001 +
1002 #define PT_IA_64_UNWIND 0x70000001
1003
1004 /* IA-64 relocations: */
1005 diff -urNp linux-2.6.32.49/arch/ia64/include/asm/machvec.h linux-2.6.32.49/arch/ia64/include/asm/machvec.h
1006 --- linux-2.6.32.49/arch/ia64/include/asm/machvec.h 2011-11-08 19:02:43.000000000 -0500
1007 +++ linux-2.6.32.49/arch/ia64/include/asm/machvec.h 2011-11-15 19:59:42.000000000 -0500
1008 @@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
1009 /* DMA-mapping interface: */
1010 typedef void ia64_mv_dma_init (void);
1011 typedef u64 ia64_mv_dma_get_required_mask (struct device *);
1012 -typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1013 +typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1014
1015 /*
1016 * WARNING: The legacy I/O space is _architected_. Platforms are
1017 @@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
1018 # endif /* CONFIG_IA64_GENERIC */
1019
1020 extern void swiotlb_dma_init(void);
1021 -extern struct dma_map_ops *dma_get_ops(struct device *);
1022 +extern const struct dma_map_ops *dma_get_ops(struct device *);
1023
1024 /*
1025 * Define default versions so we can extend machvec for new platforms without having
1026 diff -urNp linux-2.6.32.49/arch/ia64/include/asm/pgtable.h linux-2.6.32.49/arch/ia64/include/asm/pgtable.h
1027 --- linux-2.6.32.49/arch/ia64/include/asm/pgtable.h 2011-11-08 19:02:43.000000000 -0500
1028 +++ linux-2.6.32.49/arch/ia64/include/asm/pgtable.h 2011-11-15 19:59:42.000000000 -0500
1029 @@ -12,7 +12,7 @@
1030 * David Mosberger-Tang <davidm@hpl.hp.com>
1031 */
1032
1033 -
1034 +#include <linux/const.h>
1035 #include <asm/mman.h>
1036 #include <asm/page.h>
1037 #include <asm/processor.h>
1038 @@ -143,6 +143,17 @@
1039 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1040 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1041 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
1042 +
1043 +#ifdef CONFIG_PAX_PAGEEXEC
1044 +# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
1045 +# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1046 +# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1047 +#else
1048 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
1049 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
1050 +# define PAGE_COPY_NOEXEC PAGE_COPY
1051 +#endif
1052 +
1053 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
1054 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
1055 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
1056 diff -urNp linux-2.6.32.49/arch/ia64/include/asm/spinlock.h linux-2.6.32.49/arch/ia64/include/asm/spinlock.h
1057 --- linux-2.6.32.49/arch/ia64/include/asm/spinlock.h 2011-11-08 19:02:43.000000000 -0500
1058 +++ linux-2.6.32.49/arch/ia64/include/asm/spinlock.h 2011-11-15 19:59:42.000000000 -0500
1059 @@ -72,7 +72,7 @@ static __always_inline void __ticket_spi
1060 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
1061
1062 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
1063 - ACCESS_ONCE(*p) = (tmp + 2) & ~1;
1064 + ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
1065 }
1066
1067 static __always_inline void __ticket_spin_unlock_wait(raw_spinlock_t *lock)
1068 diff -urNp linux-2.6.32.49/arch/ia64/include/asm/uaccess.h linux-2.6.32.49/arch/ia64/include/asm/uaccess.h
1069 --- linux-2.6.32.49/arch/ia64/include/asm/uaccess.h 2011-11-08 19:02:43.000000000 -0500
1070 +++ linux-2.6.32.49/arch/ia64/include/asm/uaccess.h 2011-11-15 19:59:42.000000000 -0500
1071 @@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
1072 const void *__cu_from = (from); \
1073 long __cu_len = (n); \
1074 \
1075 - if (__access_ok(__cu_to, __cu_len, get_fs())) \
1076 + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
1077 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
1078 __cu_len; \
1079 })
1080 @@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
1081 long __cu_len = (n); \
1082 \
1083 __chk_user_ptr(__cu_from); \
1084 - if (__access_ok(__cu_from, __cu_len, get_fs())) \
1085 + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
1086 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
1087 __cu_len; \
1088 })
1089 diff -urNp linux-2.6.32.49/arch/ia64/kernel/dma-mapping.c linux-2.6.32.49/arch/ia64/kernel/dma-mapping.c
1090 --- linux-2.6.32.49/arch/ia64/kernel/dma-mapping.c 2011-11-08 19:02:43.000000000 -0500
1091 +++ linux-2.6.32.49/arch/ia64/kernel/dma-mapping.c 2011-11-15 19:59:42.000000000 -0500
1092 @@ -3,7 +3,7 @@
1093 /* Set this to 1 if there is a HW IOMMU in the system */
1094 int iommu_detected __read_mostly;
1095
1096 -struct dma_map_ops *dma_ops;
1097 +const struct dma_map_ops *dma_ops;
1098 EXPORT_SYMBOL(dma_ops);
1099
1100 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
1101 @@ -16,7 +16,7 @@ static int __init dma_init(void)
1102 }
1103 fs_initcall(dma_init);
1104
1105 -struct dma_map_ops *dma_get_ops(struct device *dev)
1106 +const struct dma_map_ops *dma_get_ops(struct device *dev)
1107 {
1108 return dma_ops;
1109 }
1110 diff -urNp linux-2.6.32.49/arch/ia64/kernel/module.c linux-2.6.32.49/arch/ia64/kernel/module.c
1111 --- linux-2.6.32.49/arch/ia64/kernel/module.c 2011-11-08 19:02:43.000000000 -0500
1112 +++ linux-2.6.32.49/arch/ia64/kernel/module.c 2011-11-15 19:59:42.000000000 -0500
1113 @@ -315,8 +315,7 @@ module_alloc (unsigned long size)
1114 void
1115 module_free (struct module *mod, void *module_region)
1116 {
1117 - if (mod && mod->arch.init_unw_table &&
1118 - module_region == mod->module_init) {
1119 + if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
1120 unw_remove_unwind_table(mod->arch.init_unw_table);
1121 mod->arch.init_unw_table = NULL;
1122 }
1123 @@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
1124 }
1125
1126 static inline int
1127 +in_init_rx (const struct module *mod, uint64_t addr)
1128 +{
1129 + return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
1130 +}
1131 +
1132 +static inline int
1133 +in_init_rw (const struct module *mod, uint64_t addr)
1134 +{
1135 + return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
1136 +}
1137 +
1138 +static inline int
1139 in_init (const struct module *mod, uint64_t addr)
1140 {
1141 - return addr - (uint64_t) mod->module_init < mod->init_size;
1142 + return in_init_rx(mod, addr) || in_init_rw(mod, addr);
1143 +}
1144 +
1145 +static inline int
1146 +in_core_rx (const struct module *mod, uint64_t addr)
1147 +{
1148 + return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
1149 +}
1150 +
1151 +static inline int
1152 +in_core_rw (const struct module *mod, uint64_t addr)
1153 +{
1154 + return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
1155 }
1156
1157 static inline int
1158 in_core (const struct module *mod, uint64_t addr)
1159 {
1160 - return addr - (uint64_t) mod->module_core < mod->core_size;
1161 + return in_core_rx(mod, addr) || in_core_rw(mod, addr);
1162 }
1163
1164 static inline int
1165 @@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
1166 break;
1167
1168 case RV_BDREL:
1169 - val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
1170 + if (in_init_rx(mod, val))
1171 + val -= (uint64_t) mod->module_init_rx;
1172 + else if (in_init_rw(mod, val))
1173 + val -= (uint64_t) mod->module_init_rw;
1174 + else if (in_core_rx(mod, val))
1175 + val -= (uint64_t) mod->module_core_rx;
1176 + else if (in_core_rw(mod, val))
1177 + val -= (uint64_t) mod->module_core_rw;
1178 break;
1179
1180 case RV_LTV:
1181 @@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
1182 * addresses have been selected...
1183 */
1184 uint64_t gp;
1185 - if (mod->core_size > MAX_LTOFF)
1186 + if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
1187 /*
1188 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
1189 * at the end of the module.
1190 */
1191 - gp = mod->core_size - MAX_LTOFF / 2;
1192 + gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
1193 else
1194 - gp = mod->core_size / 2;
1195 - gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
1196 + gp = (mod->core_size_rx + mod->core_size_rw) / 2;
1197 + gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
1198 mod->arch.gp = gp;
1199 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
1200 }
1201 diff -urNp linux-2.6.32.49/arch/ia64/kernel/pci-dma.c linux-2.6.32.49/arch/ia64/kernel/pci-dma.c
1202 --- linux-2.6.32.49/arch/ia64/kernel/pci-dma.c 2011-11-08 19:02:43.000000000 -0500
1203 +++ linux-2.6.32.49/arch/ia64/kernel/pci-dma.c 2011-11-15 19:59:42.000000000 -0500
1204 @@ -43,7 +43,7 @@ struct device fallback_dev = {
1205 .dma_mask = &fallback_dev.coherent_dma_mask,
1206 };
1207
1208 -extern struct dma_map_ops intel_dma_ops;
1209 +extern const struct dma_map_ops intel_dma_ops;
1210
1211 static int __init pci_iommu_init(void)
1212 {
1213 @@ -96,15 +96,34 @@ int iommu_dma_supported(struct device *d
1214 }
1215 EXPORT_SYMBOL(iommu_dma_supported);
1216
1217 +extern void *intel_alloc_coherent(struct device *hwdev, size_t size, dma_addr_t *dma_handle, gfp_t flags);
1218 +extern void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr, dma_addr_t dma_handle);
1219 +extern int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems, enum dma_data_direction dir, struct dma_attrs *attrs);
1220 +extern void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist, int nelems, enum dma_data_direction dir, struct dma_attrs *attrs);
1221 +extern dma_addr_t intel_map_page(struct device *dev, struct page *page, unsigned long offset, size_t size, enum dma_data_direction dir, struct dma_attrs *attrs);
1222 +extern void intel_unmap_page(struct device *dev, dma_addr_t dev_addr, size_t size, enum dma_data_direction dir, struct dma_attrs *attrs);
1223 +extern int intel_mapping_error(struct device *dev, dma_addr_t dma_addr);
1224 +
1225 +static const struct dma_map_ops intel_iommu_dma_ops = {
1226 + /* from drivers/pci/intel-iommu.c:intel_dma_ops */
1227 + .alloc_coherent = intel_alloc_coherent,
1228 + .free_coherent = intel_free_coherent,
1229 + .map_sg = intel_map_sg,
1230 + .unmap_sg = intel_unmap_sg,
1231 + .map_page = intel_map_page,
1232 + .unmap_page = intel_unmap_page,
1233 + .mapping_error = intel_mapping_error,
1234 +
1235 + .sync_single_for_cpu = machvec_dma_sync_single,
1236 + .sync_sg_for_cpu = machvec_dma_sync_sg,
1237 + .sync_single_for_device = machvec_dma_sync_single,
1238 + .sync_sg_for_device = machvec_dma_sync_sg,
1239 + .dma_supported = iommu_dma_supported,
1240 +};
1241 +
1242 void __init pci_iommu_alloc(void)
1243 {
1244 - dma_ops = &intel_dma_ops;
1245 -
1246 - dma_ops->sync_single_for_cpu = machvec_dma_sync_single;
1247 - dma_ops->sync_sg_for_cpu = machvec_dma_sync_sg;
1248 - dma_ops->sync_single_for_device = machvec_dma_sync_single;
1249 - dma_ops->sync_sg_for_device = machvec_dma_sync_sg;
1250 - dma_ops->dma_supported = iommu_dma_supported;
1251 + dma_ops = &intel_iommu_dma_ops;
1252
1253 /*
1254 * The order of these functions is important for
1255 diff -urNp linux-2.6.32.49/arch/ia64/kernel/pci-swiotlb.c linux-2.6.32.49/arch/ia64/kernel/pci-swiotlb.c
1256 --- linux-2.6.32.49/arch/ia64/kernel/pci-swiotlb.c 2011-11-08 19:02:43.000000000 -0500
1257 +++ linux-2.6.32.49/arch/ia64/kernel/pci-swiotlb.c 2011-11-15 19:59:42.000000000 -0500
1258 @@ -21,7 +21,7 @@ static void *ia64_swiotlb_alloc_coherent
1259 return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
1260 }
1261
1262 -struct dma_map_ops swiotlb_dma_ops = {
1263 +const struct dma_map_ops swiotlb_dma_ops = {
1264 .alloc_coherent = ia64_swiotlb_alloc_coherent,
1265 .free_coherent = swiotlb_free_coherent,
1266 .map_page = swiotlb_map_page,
1267 diff -urNp linux-2.6.32.49/arch/ia64/kernel/sys_ia64.c linux-2.6.32.49/arch/ia64/kernel/sys_ia64.c
1268 --- linux-2.6.32.49/arch/ia64/kernel/sys_ia64.c 2011-11-08 19:02:43.000000000 -0500
1269 +++ linux-2.6.32.49/arch/ia64/kernel/sys_ia64.c 2011-11-15 19:59:42.000000000 -0500
1270 @@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
1271 if (REGION_NUMBER(addr) == RGN_HPAGE)
1272 addr = 0;
1273 #endif
1274 +
1275 +#ifdef CONFIG_PAX_RANDMMAP
1276 + if (mm->pax_flags & MF_PAX_RANDMMAP)
1277 + addr = mm->free_area_cache;
1278 + else
1279 +#endif
1280 +
1281 if (!addr)
1282 addr = mm->free_area_cache;
1283
1284 @@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *fil
1285 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
1286 /* At this point: (!vma || addr < vma->vm_end). */
1287 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
1288 - if (start_addr != TASK_UNMAPPED_BASE) {
1289 + if (start_addr != mm->mmap_base) {
1290 /* Start a new search --- just in case we missed some holes. */
1291 - addr = TASK_UNMAPPED_BASE;
1292 + addr = mm->mmap_base;
1293 goto full_search;
1294 }
1295 return -ENOMEM;
1296 }
1297 - if (!vma || addr + len <= vma->vm_start) {
1298 + if (check_heap_stack_gap(vma, addr, len)) {
1299 /* Remember the address where we stopped this search: */
1300 mm->free_area_cache = addr + len;
1301 return addr;
1302 diff -urNp linux-2.6.32.49/arch/ia64/kernel/topology.c linux-2.6.32.49/arch/ia64/kernel/topology.c
1303 --- linux-2.6.32.49/arch/ia64/kernel/topology.c 2011-11-08 19:02:43.000000000 -0500
1304 +++ linux-2.6.32.49/arch/ia64/kernel/topology.c 2011-11-15 19:59:42.000000000 -0500
1305 @@ -282,7 +282,7 @@ static ssize_t cache_show(struct kobject
1306 return ret;
1307 }
1308
1309 -static struct sysfs_ops cache_sysfs_ops = {
1310 +static const struct sysfs_ops cache_sysfs_ops = {
1311 .show = cache_show
1312 };
1313
1314 diff -urNp linux-2.6.32.49/arch/ia64/kernel/vmlinux.lds.S linux-2.6.32.49/arch/ia64/kernel/vmlinux.lds.S
1315 --- linux-2.6.32.49/arch/ia64/kernel/vmlinux.lds.S 2011-11-08 19:02:43.000000000 -0500
1316 +++ linux-2.6.32.49/arch/ia64/kernel/vmlinux.lds.S 2011-11-15 19:59:42.000000000 -0500
1317 @@ -190,7 +190,7 @@ SECTIONS
1318 /* Per-cpu data: */
1319 . = ALIGN(PERCPU_PAGE_SIZE);
1320 PERCPU_VADDR(PERCPU_ADDR, :percpu)
1321 - __phys_per_cpu_start = __per_cpu_load;
1322 + __phys_per_cpu_start = per_cpu_load;
1323 . = __phys_per_cpu_start + PERCPU_PAGE_SIZE; /* ensure percpu data fits
1324 * into percpu page size
1325 */
1326 diff -urNp linux-2.6.32.49/arch/ia64/mm/fault.c linux-2.6.32.49/arch/ia64/mm/fault.c
1327 --- linux-2.6.32.49/arch/ia64/mm/fault.c 2011-11-08 19:02:43.000000000 -0500
1328 +++ linux-2.6.32.49/arch/ia64/mm/fault.c 2011-11-18 18:01:52.000000000 -0500
1329 @@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned
1330 return pte_present(pte);
1331 }
1332
1333 +#ifdef CONFIG_PAX_PAGEEXEC
1334 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1335 +{
1336 + unsigned long i;
1337 +
1338 + printk(KERN_ERR "PAX: bytes at PC: ");
1339 + for (i = 0; i < 8; i++) {
1340 + unsigned int c;
1341 + if (get_user(c, (unsigned int *)pc+i))
1342 + printk(KERN_CONT "???????? ");
1343 + else
1344 + printk(KERN_CONT "%08x ", c);
1345 + }
1346 + printk("\n");
1347 +}
1348 +#endif
1349 +
1350 void __kprobes
1351 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1352 {
1353 @@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
1354 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1355 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1356
1357 - if ((vma->vm_flags & mask) != mask)
1358 + if ((vma->vm_flags & mask) != mask) {
1359 +
1360 +#ifdef CONFIG_PAX_PAGEEXEC
1361 + if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1362 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1363 + goto bad_area;
1364 +
1365 + up_read(&mm->mmap_sem);
1366 + pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1367 + do_group_exit(SIGKILL);
1368 + }
1369 +#endif
1370 +
1371 goto bad_area;
1372
1373 + }
1374 +
1375 survive:
1376 /*
1377 * If for any reason at all we couldn't handle the fault, make
1378 diff -urNp linux-2.6.32.49/arch/ia64/mm/hugetlbpage.c linux-2.6.32.49/arch/ia64/mm/hugetlbpage.c
1379 --- linux-2.6.32.49/arch/ia64/mm/hugetlbpage.c 2011-11-08 19:02:43.000000000 -0500
1380 +++ linux-2.6.32.49/arch/ia64/mm/hugetlbpage.c 2011-11-15 19:59:42.000000000 -0500
1381 @@ -172,7 +172,7 @@ unsigned long hugetlb_get_unmapped_area(
1382 /* At this point: (!vmm || addr < vmm->vm_end). */
1383 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
1384 return -ENOMEM;
1385 - if (!vmm || (addr + len) <= vmm->vm_start)
1386 + if (check_heap_stack_gap(vmm, addr, len))
1387 return addr;
1388 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
1389 }
1390 diff -urNp linux-2.6.32.49/arch/ia64/mm/init.c linux-2.6.32.49/arch/ia64/mm/init.c
1391 --- linux-2.6.32.49/arch/ia64/mm/init.c 2011-11-08 19:02:43.000000000 -0500
1392 +++ linux-2.6.32.49/arch/ia64/mm/init.c 2011-11-15 19:59:42.000000000 -0500
1393 @@ -122,6 +122,19 @@ ia64_init_addr_space (void)
1394 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1395 vma->vm_end = vma->vm_start + PAGE_SIZE;
1396 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1397 +
1398 +#ifdef CONFIG_PAX_PAGEEXEC
1399 + if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1400 + vma->vm_flags &= ~VM_EXEC;
1401 +
1402 +#ifdef CONFIG_PAX_MPROTECT
1403 + if (current->mm->pax_flags & MF_PAX_MPROTECT)
1404 + vma->vm_flags &= ~VM_MAYEXEC;
1405 +#endif
1406 +
1407 + }
1408 +#endif
1409 +
1410 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1411 down_write(&current->mm->mmap_sem);
1412 if (insert_vm_struct(current->mm, vma)) {
1413 diff -urNp linux-2.6.32.49/arch/ia64/sn/pci/pci_dma.c linux-2.6.32.49/arch/ia64/sn/pci/pci_dma.c
1414 --- linux-2.6.32.49/arch/ia64/sn/pci/pci_dma.c 2011-11-08 19:02:43.000000000 -0500
1415 +++ linux-2.6.32.49/arch/ia64/sn/pci/pci_dma.c 2011-11-15 19:59:42.000000000 -0500
1416 @@ -464,7 +464,7 @@ int sn_pci_legacy_write(struct pci_bus *
1417 return ret;
1418 }
1419
1420 -static struct dma_map_ops sn_dma_ops = {
1421 +static const struct dma_map_ops sn_dma_ops = {
1422 .alloc_coherent = sn_dma_alloc_coherent,
1423 .free_coherent = sn_dma_free_coherent,
1424 .map_page = sn_dma_map_page,
1425 diff -urNp linux-2.6.32.49/arch/m32r/lib/usercopy.c linux-2.6.32.49/arch/m32r/lib/usercopy.c
1426 --- linux-2.6.32.49/arch/m32r/lib/usercopy.c 2011-11-08 19:02:43.000000000 -0500
1427 +++ linux-2.6.32.49/arch/m32r/lib/usercopy.c 2011-11-15 19:59:42.000000000 -0500
1428 @@ -14,6 +14,9 @@
1429 unsigned long
1430 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1431 {
1432 + if ((long)n < 0)
1433 + return n;
1434 +
1435 prefetch(from);
1436 if (access_ok(VERIFY_WRITE, to, n))
1437 __copy_user(to,from,n);
1438 @@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to,
1439 unsigned long
1440 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1441 {
1442 + if ((long)n < 0)
1443 + return n;
1444 +
1445 prefetchw(to);
1446 if (access_ok(VERIFY_READ, from, n))
1447 __copy_user_zeroing(to,from,n);
1448 diff -urNp linux-2.6.32.49/arch/mips/alchemy/devboards/pm.c linux-2.6.32.49/arch/mips/alchemy/devboards/pm.c
1449 --- linux-2.6.32.49/arch/mips/alchemy/devboards/pm.c 2011-11-08 19:02:43.000000000 -0500
1450 +++ linux-2.6.32.49/arch/mips/alchemy/devboards/pm.c 2011-11-15 19:59:42.000000000 -0500
1451 @@ -78,7 +78,7 @@ static void db1x_pm_end(void)
1452
1453 }
1454
1455 -static struct platform_suspend_ops db1x_pm_ops = {
1456 +static const struct platform_suspend_ops db1x_pm_ops = {
1457 .valid = suspend_valid_only_mem,
1458 .begin = db1x_pm_begin,
1459 .enter = db1x_pm_enter,
1460 diff -urNp linux-2.6.32.49/arch/mips/include/asm/elf.h linux-2.6.32.49/arch/mips/include/asm/elf.h
1461 --- linux-2.6.32.49/arch/mips/include/asm/elf.h 2011-11-08 19:02:43.000000000 -0500
1462 +++ linux-2.6.32.49/arch/mips/include/asm/elf.h 2011-11-15 19:59:42.000000000 -0500
1463 @@ -368,4 +368,11 @@ extern int dump_task_fpu(struct task_str
1464 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1465 #endif
1466
1467 +#ifdef CONFIG_PAX_ASLR
1468 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
1469 +
1470 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1471 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1472 +#endif
1473 +
1474 #endif /* _ASM_ELF_H */
1475 diff -urNp linux-2.6.32.49/arch/mips/include/asm/page.h linux-2.6.32.49/arch/mips/include/asm/page.h
1476 --- linux-2.6.32.49/arch/mips/include/asm/page.h 2011-11-08 19:02:43.000000000 -0500
1477 +++ linux-2.6.32.49/arch/mips/include/asm/page.h 2011-11-15 19:59:42.000000000 -0500
1478 @@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
1479 #ifdef CONFIG_CPU_MIPS32
1480 typedef struct { unsigned long pte_low, pte_high; } pte_t;
1481 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
1482 - #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
1483 + #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
1484 #else
1485 typedef struct { unsigned long long pte; } pte_t;
1486 #define pte_val(x) ((x).pte)
1487 diff -urNp linux-2.6.32.49/arch/mips/include/asm/reboot.h linux-2.6.32.49/arch/mips/include/asm/reboot.h
1488 --- linux-2.6.32.49/arch/mips/include/asm/reboot.h 2011-11-08 19:02:43.000000000 -0500
1489 +++ linux-2.6.32.49/arch/mips/include/asm/reboot.h 2011-11-15 19:59:42.000000000 -0500
1490 @@ -9,7 +9,7 @@
1491 #ifndef _ASM_REBOOT_H
1492 #define _ASM_REBOOT_H
1493
1494 -extern void (*_machine_restart)(char *command);
1495 -extern void (*_machine_halt)(void);
1496 +extern void (*__noreturn _machine_restart)(char *command);
1497 +extern void (*__noreturn _machine_halt)(void);
1498
1499 #endif /* _ASM_REBOOT_H */
1500 diff -urNp linux-2.6.32.49/arch/mips/include/asm/system.h linux-2.6.32.49/arch/mips/include/asm/system.h
1501 --- linux-2.6.32.49/arch/mips/include/asm/system.h 2011-11-08 19:02:43.000000000 -0500
1502 +++ linux-2.6.32.49/arch/mips/include/asm/system.h 2011-11-15 19:59:42.000000000 -0500
1503 @@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
1504 */
1505 #define __ARCH_WANT_UNLOCKED_CTXSW
1506
1507 -extern unsigned long arch_align_stack(unsigned long sp);
1508 +#define arch_align_stack(x) ((x) & ~0xfUL)
1509
1510 #endif /* _ASM_SYSTEM_H */
1511 diff -urNp linux-2.6.32.49/arch/mips/kernel/binfmt_elfn32.c linux-2.6.32.49/arch/mips/kernel/binfmt_elfn32.c
1512 --- linux-2.6.32.49/arch/mips/kernel/binfmt_elfn32.c 2011-11-08 19:02:43.000000000 -0500
1513 +++ linux-2.6.32.49/arch/mips/kernel/binfmt_elfn32.c 2011-11-15 19:59:42.000000000 -0500
1514 @@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
1515 #undef ELF_ET_DYN_BASE
1516 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1517
1518 +#ifdef CONFIG_PAX_ASLR
1519 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
1520 +
1521 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1522 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1523 +#endif
1524 +
1525 #include <asm/processor.h>
1526 #include <linux/module.h>
1527 #include <linux/elfcore.h>
1528 diff -urNp linux-2.6.32.49/arch/mips/kernel/binfmt_elfo32.c linux-2.6.32.49/arch/mips/kernel/binfmt_elfo32.c
1529 --- linux-2.6.32.49/arch/mips/kernel/binfmt_elfo32.c 2011-11-08 19:02:43.000000000 -0500
1530 +++ linux-2.6.32.49/arch/mips/kernel/binfmt_elfo32.c 2011-11-15 19:59:42.000000000 -0500
1531 @@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
1532 #undef ELF_ET_DYN_BASE
1533 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1534
1535 +#ifdef CONFIG_PAX_ASLR
1536 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
1537 +
1538 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1539 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1540 +#endif
1541 +
1542 #include <asm/processor.h>
1543
1544 /*
1545 diff -urNp linux-2.6.32.49/arch/mips/kernel/kgdb.c linux-2.6.32.49/arch/mips/kernel/kgdb.c
1546 --- linux-2.6.32.49/arch/mips/kernel/kgdb.c 2011-11-08 19:02:43.000000000 -0500
1547 +++ linux-2.6.32.49/arch/mips/kernel/kgdb.c 2011-11-15 19:59:42.000000000 -0500
1548 @@ -245,6 +245,7 @@ int kgdb_arch_handle_exception(int vecto
1549 return -1;
1550 }
1551
1552 +/* cannot be const */
1553 struct kgdb_arch arch_kgdb_ops;
1554
1555 /*
1556 diff -urNp linux-2.6.32.49/arch/mips/kernel/process.c linux-2.6.32.49/arch/mips/kernel/process.c
1557 --- linux-2.6.32.49/arch/mips/kernel/process.c 2011-11-08 19:02:43.000000000 -0500
1558 +++ linux-2.6.32.49/arch/mips/kernel/process.c 2011-11-15 19:59:42.000000000 -0500
1559 @@ -470,15 +470,3 @@ unsigned long get_wchan(struct task_stru
1560 out:
1561 return pc;
1562 }
1563 -
1564 -/*
1565 - * Don't forget that the stack pointer must be aligned on a 8 bytes
1566 - * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
1567 - */
1568 -unsigned long arch_align_stack(unsigned long sp)
1569 -{
1570 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
1571 - sp -= get_random_int() & ~PAGE_MASK;
1572 -
1573 - return sp & ALMASK;
1574 -}
1575 diff -urNp linux-2.6.32.49/arch/mips/kernel/reset.c linux-2.6.32.49/arch/mips/kernel/reset.c
1576 --- linux-2.6.32.49/arch/mips/kernel/reset.c 2011-11-08 19:02:43.000000000 -0500
1577 +++ linux-2.6.32.49/arch/mips/kernel/reset.c 2011-11-15 19:59:42.000000000 -0500
1578 @@ -19,8 +19,8 @@
1579 * So handle all using function pointers to machine specific
1580 * functions.
1581 */
1582 -void (*_machine_restart)(char *command);
1583 -void (*_machine_halt)(void);
1584 +void (*__noreturn _machine_restart)(char *command);
1585 +void (*__noreturn _machine_halt)(void);
1586 void (*pm_power_off)(void);
1587
1588 EXPORT_SYMBOL(pm_power_off);
1589 @@ -29,16 +29,19 @@ void machine_restart(char *command)
1590 {
1591 if (_machine_restart)
1592 _machine_restart(command);
1593 + BUG();
1594 }
1595
1596 void machine_halt(void)
1597 {
1598 if (_machine_halt)
1599 _machine_halt();
1600 + BUG();
1601 }
1602
1603 void machine_power_off(void)
1604 {
1605 if (pm_power_off)
1606 pm_power_off();
1607 + BUG();
1608 }
1609 diff -urNp linux-2.6.32.49/arch/mips/kernel/syscall.c linux-2.6.32.49/arch/mips/kernel/syscall.c
1610 --- linux-2.6.32.49/arch/mips/kernel/syscall.c 2011-11-08 19:02:43.000000000 -0500
1611 +++ linux-2.6.32.49/arch/mips/kernel/syscall.c 2011-11-15 19:59:42.000000000 -0500
1612 @@ -102,17 +102,21 @@ unsigned long arch_get_unmapped_area(str
1613 do_color_align = 0;
1614 if (filp || (flags & MAP_SHARED))
1615 do_color_align = 1;
1616 +
1617 +#ifdef CONFIG_PAX_RANDMMAP
1618 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
1619 +#endif
1620 +
1621 if (addr) {
1622 if (do_color_align)
1623 addr = COLOUR_ALIGN(addr, pgoff);
1624 else
1625 addr = PAGE_ALIGN(addr);
1626 vmm = find_vma(current->mm, addr);
1627 - if (task_size - len >= addr &&
1628 - (!vmm || addr + len <= vmm->vm_start))
1629 + if (task_size - len >= addr && check_heap_stack_gap(vmm, addr, len))
1630 return addr;
1631 }
1632 - addr = TASK_UNMAPPED_BASE;
1633 + addr = current->mm->mmap_base;
1634 if (do_color_align)
1635 addr = COLOUR_ALIGN(addr, pgoff);
1636 else
1637 @@ -122,7 +126,7 @@ unsigned long arch_get_unmapped_area(str
1638 /* At this point: (!vmm || addr < vmm->vm_end). */
1639 if (task_size - len < addr)
1640 return -ENOMEM;
1641 - if (!vmm || addr + len <= vmm->vm_start)
1642 + if (check_heap_stack_gap(vmm, addr, len))
1643 return addr;
1644 addr = vmm->vm_end;
1645 if (do_color_align)
1646 diff -urNp linux-2.6.32.49/arch/mips/Makefile linux-2.6.32.49/arch/mips/Makefile
1647 --- linux-2.6.32.49/arch/mips/Makefile 2011-11-08 19:02:43.000000000 -0500
1648 +++ linux-2.6.32.49/arch/mips/Makefile 2011-11-15 19:59:42.000000000 -0500
1649 @@ -51,6 +51,8 @@ endif
1650 cflags-y := -ffunction-sections
1651 cflags-y += $(call cc-option, -mno-check-zero-division)
1652
1653 +cflags-y += -Wno-sign-compare -Wno-extra
1654 +
1655 ifdef CONFIG_32BIT
1656 ld-emul = $(32bit-emul)
1657 vmlinux-32 = vmlinux
1658 diff -urNp linux-2.6.32.49/arch/mips/mm/fault.c linux-2.6.32.49/arch/mips/mm/fault.c
1659 --- linux-2.6.32.49/arch/mips/mm/fault.c 2011-11-08 19:02:43.000000000 -0500
1660 +++ linux-2.6.32.49/arch/mips/mm/fault.c 2011-11-18 18:01:52.000000000 -0500
1661 @@ -26,6 +26,23 @@
1662 #include <asm/ptrace.h>
1663 #include <asm/highmem.h> /* For VMALLOC_END */
1664
1665 +#ifdef CONFIG_PAX_PAGEEXEC
1666 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1667 +{
1668 + unsigned long i;
1669 +
1670 + printk(KERN_ERR "PAX: bytes at PC: ");
1671 + for (i = 0; i < 5; i++) {
1672 + unsigned int c;
1673 + if (get_user(c, (unsigned int *)pc+i))
1674 + printk(KERN_CONT "???????? ");
1675 + else
1676 + printk(KERN_CONT "%08x ", c);
1677 + }
1678 + printk("\n");
1679 +}
1680 +#endif
1681 +
1682 /*
1683 * This routine handles page faults. It determines the address,
1684 * and the problem, and then passes it off to one of the appropriate
1685 diff -urNp linux-2.6.32.49/arch/parisc/include/asm/elf.h linux-2.6.32.49/arch/parisc/include/asm/elf.h
1686 --- linux-2.6.32.49/arch/parisc/include/asm/elf.h 2011-11-08 19:02:43.000000000 -0500
1687 +++ linux-2.6.32.49/arch/parisc/include/asm/elf.h 2011-11-15 19:59:42.000000000 -0500
1688 @@ -343,6 +343,13 @@ struct pt_regs; /* forward declaration..
1689
1690 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
1691
1692 +#ifdef CONFIG_PAX_ASLR
1693 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
1694 +
1695 +#define PAX_DELTA_MMAP_LEN 16
1696 +#define PAX_DELTA_STACK_LEN 16
1697 +#endif
1698 +
1699 /* This yields a mask that user programs can use to figure out what
1700 instruction set this CPU supports. This could be done in user space,
1701 but it's not easy, and we've already done it here. */
1702 diff -urNp linux-2.6.32.49/arch/parisc/include/asm/pgtable.h linux-2.6.32.49/arch/parisc/include/asm/pgtable.h
1703 --- linux-2.6.32.49/arch/parisc/include/asm/pgtable.h 2011-11-08 19:02:43.000000000 -0500
1704 +++ linux-2.6.32.49/arch/parisc/include/asm/pgtable.h 2011-11-15 19:59:42.000000000 -0500
1705 @@ -207,6 +207,17 @@
1706 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
1707 #define PAGE_COPY PAGE_EXECREAD
1708 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
1709 +
1710 +#ifdef CONFIG_PAX_PAGEEXEC
1711 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
1712 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1713 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1714 +#else
1715 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
1716 +# define PAGE_COPY_NOEXEC PAGE_COPY
1717 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
1718 +#endif
1719 +
1720 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
1721 #define PAGE_KERNEL_RO __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
1722 #define PAGE_KERNEL_UNC __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
1723 diff -urNp linux-2.6.32.49/arch/parisc/kernel/module.c linux-2.6.32.49/arch/parisc/kernel/module.c
1724 --- linux-2.6.32.49/arch/parisc/kernel/module.c 2011-11-08 19:02:43.000000000 -0500
1725 +++ linux-2.6.32.49/arch/parisc/kernel/module.c 2011-11-15 19:59:42.000000000 -0500
1726 @@ -95,16 +95,38 @@
1727
1728 /* three functions to determine where in the module core
1729 * or init pieces the location is */
1730 +static inline int in_init_rx(struct module *me, void *loc)
1731 +{
1732 + return (loc >= me->module_init_rx &&
1733 + loc < (me->module_init_rx + me->init_size_rx));
1734 +}
1735 +
1736 +static inline int in_init_rw(struct module *me, void *loc)
1737 +{
1738 + return (loc >= me->module_init_rw &&
1739 + loc < (me->module_init_rw + me->init_size_rw));
1740 +}
1741 +
1742 static inline int in_init(struct module *me, void *loc)
1743 {
1744 - return (loc >= me->module_init &&
1745 - loc <= (me->module_init + me->init_size));
1746 + return in_init_rx(me, loc) || in_init_rw(me, loc);
1747 +}
1748 +
1749 +static inline int in_core_rx(struct module *me, void *loc)
1750 +{
1751 + return (loc >= me->module_core_rx &&
1752 + loc < (me->module_core_rx + me->core_size_rx));
1753 +}
1754 +
1755 +static inline int in_core_rw(struct module *me, void *loc)
1756 +{
1757 + return (loc >= me->module_core_rw &&
1758 + loc < (me->module_core_rw + me->core_size_rw));
1759 }
1760
1761 static inline int in_core(struct module *me, void *loc)
1762 {
1763 - return (loc >= me->module_core &&
1764 - loc <= (me->module_core + me->core_size));
1765 + return in_core_rx(me, loc) || in_core_rw(me, loc);
1766 }
1767
1768 static inline int in_local(struct module *me, void *loc)
1769 @@ -364,13 +386,13 @@ int module_frob_arch_sections(CONST Elf_
1770 }
1771
1772 /* align things a bit */
1773 - me->core_size = ALIGN(me->core_size, 16);
1774 - me->arch.got_offset = me->core_size;
1775 - me->core_size += gots * sizeof(struct got_entry);
1776 -
1777 - me->core_size = ALIGN(me->core_size, 16);
1778 - me->arch.fdesc_offset = me->core_size;
1779 - me->core_size += fdescs * sizeof(Elf_Fdesc);
1780 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
1781 + me->arch.got_offset = me->core_size_rw;
1782 + me->core_size_rw += gots * sizeof(struct got_entry);
1783 +
1784 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
1785 + me->arch.fdesc_offset = me->core_size_rw;
1786 + me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
1787
1788 me->arch.got_max = gots;
1789 me->arch.fdesc_max = fdescs;
1790 @@ -388,7 +410,7 @@ static Elf64_Word get_got(struct module
1791
1792 BUG_ON(value == 0);
1793
1794 - got = me->module_core + me->arch.got_offset;
1795 + got = me->module_core_rw + me->arch.got_offset;
1796 for (i = 0; got[i].addr; i++)
1797 if (got[i].addr == value)
1798 goto out;
1799 @@ -406,7 +428,7 @@ static Elf64_Word get_got(struct module
1800 #ifdef CONFIG_64BIT
1801 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
1802 {
1803 - Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
1804 + Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
1805
1806 if (!value) {
1807 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
1808 @@ -424,7 +446,7 @@ static Elf_Addr get_fdesc(struct module
1809
1810 /* Create new one */
1811 fdesc->addr = value;
1812 - fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1813 + fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1814 return (Elf_Addr)fdesc;
1815 }
1816 #endif /* CONFIG_64BIT */
1817 @@ -848,7 +870,7 @@ register_unwind_table(struct module *me,
1818
1819 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
1820 end = table + sechdrs[me->arch.unwind_section].sh_size;
1821 - gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1822 + gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1823
1824 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
1825 me->arch.unwind_section, table, end, gp);
1826 diff -urNp linux-2.6.32.49/arch/parisc/kernel/sys_parisc.c linux-2.6.32.49/arch/parisc/kernel/sys_parisc.c
1827 --- linux-2.6.32.49/arch/parisc/kernel/sys_parisc.c 2011-11-08 19:02:43.000000000 -0500
1828 +++ linux-2.6.32.49/arch/parisc/kernel/sys_parisc.c 2011-11-15 19:59:42.000000000 -0500
1829 @@ -43,7 +43,7 @@ static unsigned long get_unshared_area(u
1830 /* At this point: (!vma || addr < vma->vm_end). */
1831 if (TASK_SIZE - len < addr)
1832 return -ENOMEM;
1833 - if (!vma || addr + len <= vma->vm_start)
1834 + if (check_heap_stack_gap(vma, addr, len))
1835 return addr;
1836 addr = vma->vm_end;
1837 }
1838 @@ -79,7 +79,7 @@ static unsigned long get_shared_area(str
1839 /* At this point: (!vma || addr < vma->vm_end). */
1840 if (TASK_SIZE - len < addr)
1841 return -ENOMEM;
1842 - if (!vma || addr + len <= vma->vm_start)
1843 + if (check_heap_stack_gap(vma, addr, len))
1844 return addr;
1845 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
1846 if (addr < vma->vm_end) /* handle wraparound */
1847 @@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
1848 if (flags & MAP_FIXED)
1849 return addr;
1850 if (!addr)
1851 - addr = TASK_UNMAPPED_BASE;
1852 + addr = current->mm->mmap_base;
1853
1854 if (filp) {
1855 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
1856 diff -urNp linux-2.6.32.49/arch/parisc/kernel/traps.c linux-2.6.32.49/arch/parisc/kernel/traps.c
1857 --- linux-2.6.32.49/arch/parisc/kernel/traps.c 2011-11-08 19:02:43.000000000 -0500
1858 +++ linux-2.6.32.49/arch/parisc/kernel/traps.c 2011-11-15 19:59:42.000000000 -0500
1859 @@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
1860
1861 down_read(&current->mm->mmap_sem);
1862 vma = find_vma(current->mm,regs->iaoq[0]);
1863 - if (vma && (regs->iaoq[0] >= vma->vm_start)
1864 - && (vma->vm_flags & VM_EXEC)) {
1865 -
1866 + if (vma && (regs->iaoq[0] >= vma->vm_start)) {
1867 fault_address = regs->iaoq[0];
1868 fault_space = regs->iasq[0];
1869
1870 diff -urNp linux-2.6.32.49/arch/parisc/mm/fault.c linux-2.6.32.49/arch/parisc/mm/fault.c
1871 --- linux-2.6.32.49/arch/parisc/mm/fault.c 2011-11-08 19:02:43.000000000 -0500
1872 +++ linux-2.6.32.49/arch/parisc/mm/fault.c 2011-11-18 18:01:52.000000000 -0500
1873 @@ -15,6 +15,7 @@
1874 #include <linux/sched.h>
1875 #include <linux/interrupt.h>
1876 #include <linux/module.h>
1877 +#include <linux/unistd.h>
1878
1879 #include <asm/uaccess.h>
1880 #include <asm/traps.h>
1881 @@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
1882 static unsigned long
1883 parisc_acctyp(unsigned long code, unsigned int inst)
1884 {
1885 - if (code == 6 || code == 16)
1886 + if (code == 6 || code == 7 || code == 16)
1887 return VM_EXEC;
1888
1889 switch (inst & 0xf0000000) {
1890 @@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
1891 }
1892 #endif
1893
1894 +#ifdef CONFIG_PAX_PAGEEXEC
1895 +/*
1896 + * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
1897 + *
1898 + * returns 1 when task should be killed
1899 + * 2 when rt_sigreturn trampoline was detected
1900 + * 3 when unpatched PLT trampoline was detected
1901 + */
1902 +static int pax_handle_fetch_fault(struct pt_regs *regs)
1903 +{
1904 +
1905 +#ifdef CONFIG_PAX_EMUPLT
1906 + int err;
1907 +
1908 + do { /* PaX: unpatched PLT emulation */
1909 + unsigned int bl, depwi;
1910 +
1911 + err = get_user(bl, (unsigned int *)instruction_pointer(regs));
1912 + err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
1913 +
1914 + if (err)
1915 + break;
1916 +
1917 + if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
1918 + unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
1919 +
1920 + err = get_user(ldw, (unsigned int *)addr);
1921 + err |= get_user(bv, (unsigned int *)(addr+4));
1922 + err |= get_user(ldw2, (unsigned int *)(addr+8));
1923 +
1924 + if (err)
1925 + break;
1926 +
1927 + if (ldw == 0x0E801096U &&
1928 + bv == 0xEAC0C000U &&
1929 + ldw2 == 0x0E881095U)
1930 + {
1931 + unsigned int resolver, map;
1932 +
1933 + err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
1934 + err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
1935 + if (err)
1936 + break;
1937 +
1938 + regs->gr[20] = instruction_pointer(regs)+8;
1939 + regs->gr[21] = map;
1940 + regs->gr[22] = resolver;
1941 + regs->iaoq[0] = resolver | 3UL;
1942 + regs->iaoq[1] = regs->iaoq[0] + 4;
1943 + return 3;
1944 + }
1945 + }
1946 + } while (0);
1947 +#endif
1948 +
1949 +#ifdef CONFIG_PAX_EMUTRAMP
1950 +
1951 +#ifndef CONFIG_PAX_EMUSIGRT
1952 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
1953 + return 1;
1954 +#endif
1955 +
1956 + do { /* PaX: rt_sigreturn emulation */
1957 + unsigned int ldi1, ldi2, bel, nop;
1958 +
1959 + err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
1960 + err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
1961 + err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
1962 + err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
1963 +
1964 + if (err)
1965 + break;
1966 +
1967 + if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
1968 + ldi2 == 0x3414015AU &&
1969 + bel == 0xE4008200U &&
1970 + nop == 0x08000240U)
1971 + {
1972 + regs->gr[25] = (ldi1 & 2) >> 1;
1973 + regs->gr[20] = __NR_rt_sigreturn;
1974 + regs->gr[31] = regs->iaoq[1] + 16;
1975 + regs->sr[0] = regs->iasq[1];
1976 + regs->iaoq[0] = 0x100UL;
1977 + regs->iaoq[1] = regs->iaoq[0] + 4;
1978 + regs->iasq[0] = regs->sr[2];
1979 + regs->iasq[1] = regs->sr[2];
1980 + return 2;
1981 + }
1982 + } while (0);
1983 +#endif
1984 +
1985 + return 1;
1986 +}
1987 +
1988 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1989 +{
1990 + unsigned long i;
1991 +
1992 + printk(KERN_ERR "PAX: bytes at PC: ");
1993 + for (i = 0; i < 5; i++) {
1994 + unsigned int c;
1995 + if (get_user(c, (unsigned int *)pc+i))
1996 + printk(KERN_CONT "???????? ");
1997 + else
1998 + printk(KERN_CONT "%08x ", c);
1999 + }
2000 + printk("\n");
2001 +}
2002 +#endif
2003 +
2004 int fixup_exception(struct pt_regs *regs)
2005 {
2006 const struct exception_table_entry *fix;
2007 @@ -192,8 +303,33 @@ good_area:
2008
2009 acc_type = parisc_acctyp(code,regs->iir);
2010
2011 - if ((vma->vm_flags & acc_type) != acc_type)
2012 + if ((vma->vm_flags & acc_type) != acc_type) {
2013 +
2014 +#ifdef CONFIG_PAX_PAGEEXEC
2015 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
2016 + (address & ~3UL) == instruction_pointer(regs))
2017 + {
2018 + up_read(&mm->mmap_sem);
2019 + switch (pax_handle_fetch_fault(regs)) {
2020 +
2021 +#ifdef CONFIG_PAX_EMUPLT
2022 + case 3:
2023 + return;
2024 +#endif
2025 +
2026 +#ifdef CONFIG_PAX_EMUTRAMP
2027 + case 2:
2028 + return;
2029 +#endif
2030 +
2031 + }
2032 + pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
2033 + do_group_exit(SIGKILL);
2034 + }
2035 +#endif
2036 +
2037 goto bad_area;
2038 + }
2039
2040 /*
2041 * If for any reason at all we couldn't handle the fault, make
2042 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/device.h linux-2.6.32.49/arch/powerpc/include/asm/device.h
2043 --- linux-2.6.32.49/arch/powerpc/include/asm/device.h 2011-11-08 19:02:43.000000000 -0500
2044 +++ linux-2.6.32.49/arch/powerpc/include/asm/device.h 2011-11-15 19:59:42.000000000 -0500
2045 @@ -14,7 +14,7 @@ struct dev_archdata {
2046 struct device_node *of_node;
2047
2048 /* DMA operations on that device */
2049 - struct dma_map_ops *dma_ops;
2050 + const struct dma_map_ops *dma_ops;
2051
2052 /*
2053 * When an iommu is in use, dma_data is used as a ptr to the base of the
2054 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/dma-mapping.h linux-2.6.32.49/arch/powerpc/include/asm/dma-mapping.h
2055 --- linux-2.6.32.49/arch/powerpc/include/asm/dma-mapping.h 2011-11-08 19:02:43.000000000 -0500
2056 +++ linux-2.6.32.49/arch/powerpc/include/asm/dma-mapping.h 2011-11-15 19:59:42.000000000 -0500
2057 @@ -69,9 +69,9 @@ static inline unsigned long device_to_ma
2058 #ifdef CONFIG_PPC64
2059 extern struct dma_map_ops dma_iommu_ops;
2060 #endif
2061 -extern struct dma_map_ops dma_direct_ops;
2062 +extern const struct dma_map_ops dma_direct_ops;
2063
2064 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
2065 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
2066 {
2067 /* We don't handle the NULL dev case for ISA for now. We could
2068 * do it via an out of line call but it is not needed for now. The
2069 @@ -84,7 +84,7 @@ static inline struct dma_map_ops *get_dm
2070 return dev->archdata.dma_ops;
2071 }
2072
2073 -static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
2074 +static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
2075 {
2076 dev->archdata.dma_ops = ops;
2077 }
2078 @@ -118,7 +118,7 @@ static inline void set_dma_offset(struct
2079
2080 static inline int dma_supported(struct device *dev, u64 mask)
2081 {
2082 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
2083 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2084
2085 if (unlikely(dma_ops == NULL))
2086 return 0;
2087 @@ -132,7 +132,7 @@ static inline int dma_supported(struct d
2088
2089 static inline int dma_set_mask(struct device *dev, u64 dma_mask)
2090 {
2091 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
2092 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2093
2094 if (unlikely(dma_ops == NULL))
2095 return -EIO;
2096 @@ -147,7 +147,7 @@ static inline int dma_set_mask(struct de
2097 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
2098 dma_addr_t *dma_handle, gfp_t flag)
2099 {
2100 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
2101 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2102 void *cpu_addr;
2103
2104 BUG_ON(!dma_ops);
2105 @@ -162,7 +162,7 @@ static inline void *dma_alloc_coherent(s
2106 static inline void dma_free_coherent(struct device *dev, size_t size,
2107 void *cpu_addr, dma_addr_t dma_handle)
2108 {
2109 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
2110 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2111
2112 BUG_ON(!dma_ops);
2113
2114 @@ -173,7 +173,7 @@ static inline void dma_free_coherent(str
2115
2116 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
2117 {
2118 - struct dma_map_ops *dma_ops = get_dma_ops(dev);
2119 + const struct dma_map_ops *dma_ops = get_dma_ops(dev);
2120
2121 if (dma_ops->mapping_error)
2122 return dma_ops->mapping_error(dev, dma_addr);
2123 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/elf.h linux-2.6.32.49/arch/powerpc/include/asm/elf.h
2124 --- linux-2.6.32.49/arch/powerpc/include/asm/elf.h 2011-11-08 19:02:43.000000000 -0500
2125 +++ linux-2.6.32.49/arch/powerpc/include/asm/elf.h 2011-11-15 19:59:42.000000000 -0500
2126 @@ -179,8 +179,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
2127 the loader. We need to make sure that it is out of the way of the program
2128 that it will "exec", and that there is sufficient room for the brk. */
2129
2130 -extern unsigned long randomize_et_dyn(unsigned long base);
2131 -#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
2132 +#define ELF_ET_DYN_BASE (0x20000000)
2133 +
2134 +#ifdef CONFIG_PAX_ASLR
2135 +#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
2136 +
2137 +#ifdef __powerpc64__
2138 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 16 : 28)
2139 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 16 : 28)
2140 +#else
2141 +#define PAX_DELTA_MMAP_LEN 15
2142 +#define PAX_DELTA_STACK_LEN 15
2143 +#endif
2144 +#endif
2145
2146 /*
2147 * Our registers are always unsigned longs, whether we're a 32 bit
2148 @@ -275,9 +286,6 @@ extern int arch_setup_additional_pages(s
2149 (0x7ff >> (PAGE_SHIFT - 12)) : \
2150 (0x3ffff >> (PAGE_SHIFT - 12)))
2151
2152 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2153 -#define arch_randomize_brk arch_randomize_brk
2154 -
2155 #endif /* __KERNEL__ */
2156
2157 /*
2158 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/iommu.h linux-2.6.32.49/arch/powerpc/include/asm/iommu.h
2159 --- linux-2.6.32.49/arch/powerpc/include/asm/iommu.h 2011-11-08 19:02:43.000000000 -0500
2160 +++ linux-2.6.32.49/arch/powerpc/include/asm/iommu.h 2011-11-15 19:59:42.000000000 -0500
2161 @@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
2162 extern void iommu_init_early_dart(void);
2163 extern void iommu_init_early_pasemi(void);
2164
2165 +/* dma-iommu.c */
2166 +extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
2167 +
2168 #ifdef CONFIG_PCI
2169 extern void pci_iommu_init(void);
2170 extern void pci_direct_iommu_init(void);
2171 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/kmap_types.h linux-2.6.32.49/arch/powerpc/include/asm/kmap_types.h
2172 --- linux-2.6.32.49/arch/powerpc/include/asm/kmap_types.h 2011-11-08 19:02:43.000000000 -0500
2173 +++ linux-2.6.32.49/arch/powerpc/include/asm/kmap_types.h 2011-11-15 19:59:42.000000000 -0500
2174 @@ -26,6 +26,7 @@ enum km_type {
2175 KM_SOFTIRQ1,
2176 KM_PPC_SYNC_PAGE,
2177 KM_PPC_SYNC_ICACHE,
2178 + KM_CLEARPAGE,
2179 KM_TYPE_NR
2180 };
2181
2182 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/page_64.h linux-2.6.32.49/arch/powerpc/include/asm/page_64.h
2183 --- linux-2.6.32.49/arch/powerpc/include/asm/page_64.h 2011-11-08 19:02:43.000000000 -0500
2184 +++ linux-2.6.32.49/arch/powerpc/include/asm/page_64.h 2011-11-15 19:59:42.000000000 -0500
2185 @@ -180,15 +180,18 @@ do { \
2186 * stack by default, so in the absense of a PT_GNU_STACK program header
2187 * we turn execute permission off.
2188 */
2189 -#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
2190 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2191 +#define VM_STACK_DEFAULT_FLAGS32 \
2192 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
2193 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2194
2195 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
2196 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2197
2198 +#ifndef CONFIG_PAX_PAGEEXEC
2199 #define VM_STACK_DEFAULT_FLAGS \
2200 (test_thread_flag(TIF_32BIT) ? \
2201 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
2202 +#endif
2203
2204 #include <asm-generic/getorder.h>
2205
2206 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/page.h linux-2.6.32.49/arch/powerpc/include/asm/page.h
2207 --- linux-2.6.32.49/arch/powerpc/include/asm/page.h 2011-11-08 19:02:43.000000000 -0500
2208 +++ linux-2.6.32.49/arch/powerpc/include/asm/page.h 2011-11-15 19:59:42.000000000 -0500
2209 @@ -116,8 +116,9 @@ extern phys_addr_t kernstart_addr;
2210 * and needs to be executable. This means the whole heap ends
2211 * up being executable.
2212 */
2213 -#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
2214 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2215 +#define VM_DATA_DEFAULT_FLAGS32 \
2216 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
2217 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2218
2219 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
2220 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
2221 @@ -145,6 +146,9 @@ extern phys_addr_t kernstart_addr;
2222 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
2223 #endif
2224
2225 +#define ktla_ktva(addr) (addr)
2226 +#define ktva_ktla(addr) (addr)
2227 +
2228 #ifndef __ASSEMBLY__
2229
2230 #undef STRICT_MM_TYPECHECKS
2231 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/pci.h linux-2.6.32.49/arch/powerpc/include/asm/pci.h
2232 --- linux-2.6.32.49/arch/powerpc/include/asm/pci.h 2011-11-08 19:02:43.000000000 -0500
2233 +++ linux-2.6.32.49/arch/powerpc/include/asm/pci.h 2011-11-15 19:59:42.000000000 -0500
2234 @@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
2235 }
2236
2237 #ifdef CONFIG_PCI
2238 -extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
2239 -extern struct dma_map_ops *get_pci_dma_ops(void);
2240 +extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
2241 +extern const struct dma_map_ops *get_pci_dma_ops(void);
2242 #else /* CONFIG_PCI */
2243 #define set_pci_dma_ops(d)
2244 #define get_pci_dma_ops() NULL
2245 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/pgtable.h linux-2.6.32.49/arch/powerpc/include/asm/pgtable.h
2246 --- linux-2.6.32.49/arch/powerpc/include/asm/pgtable.h 2011-11-08 19:02:43.000000000 -0500
2247 +++ linux-2.6.32.49/arch/powerpc/include/asm/pgtable.h 2011-11-15 19:59:42.000000000 -0500
2248 @@ -2,6 +2,7 @@
2249 #define _ASM_POWERPC_PGTABLE_H
2250 #ifdef __KERNEL__
2251
2252 +#include <linux/const.h>
2253 #ifndef __ASSEMBLY__
2254 #include <asm/processor.h> /* For TASK_SIZE */
2255 #include <asm/mmu.h>
2256 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/pte-hash32.h linux-2.6.32.49/arch/powerpc/include/asm/pte-hash32.h
2257 --- linux-2.6.32.49/arch/powerpc/include/asm/pte-hash32.h 2011-11-08 19:02:43.000000000 -0500
2258 +++ linux-2.6.32.49/arch/powerpc/include/asm/pte-hash32.h 2011-11-15 19:59:42.000000000 -0500
2259 @@ -21,6 +21,7 @@
2260 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
2261 #define _PAGE_USER 0x004 /* usermode access allowed */
2262 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
2263 +#define _PAGE_EXEC _PAGE_GUARDED
2264 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
2265 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
2266 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
2267 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/ptrace.h linux-2.6.32.49/arch/powerpc/include/asm/ptrace.h
2268 --- linux-2.6.32.49/arch/powerpc/include/asm/ptrace.h 2011-11-08 19:02:43.000000000 -0500
2269 +++ linux-2.6.32.49/arch/powerpc/include/asm/ptrace.h 2011-11-15 19:59:42.000000000 -0500
2270 @@ -103,7 +103,7 @@ extern unsigned long profile_pc(struct p
2271 } while(0)
2272
2273 struct task_struct;
2274 -extern unsigned long ptrace_get_reg(struct task_struct *task, int regno);
2275 +extern unsigned long ptrace_get_reg(struct task_struct *task, unsigned int regno);
2276 extern int ptrace_put_reg(struct task_struct *task, int regno,
2277 unsigned long data);
2278
2279 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/reg.h linux-2.6.32.49/arch/powerpc/include/asm/reg.h
2280 --- linux-2.6.32.49/arch/powerpc/include/asm/reg.h 2011-11-08 19:02:43.000000000 -0500
2281 +++ linux-2.6.32.49/arch/powerpc/include/asm/reg.h 2011-11-15 19:59:42.000000000 -0500
2282 @@ -191,6 +191,7 @@
2283 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
2284 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
2285 #define DSISR_NOHPTE 0x40000000 /* no translation found */
2286 +#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
2287 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
2288 #define DSISR_ISSTORE 0x02000000 /* access was a store */
2289 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
2290 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/swiotlb.h linux-2.6.32.49/arch/powerpc/include/asm/swiotlb.h
2291 --- linux-2.6.32.49/arch/powerpc/include/asm/swiotlb.h 2011-11-08 19:02:43.000000000 -0500
2292 +++ linux-2.6.32.49/arch/powerpc/include/asm/swiotlb.h 2011-11-15 19:59:42.000000000 -0500
2293 @@ -13,7 +13,7 @@
2294
2295 #include <linux/swiotlb.h>
2296
2297 -extern struct dma_map_ops swiotlb_dma_ops;
2298 +extern const struct dma_map_ops swiotlb_dma_ops;
2299
2300 static inline void dma_mark_clean(void *addr, size_t size) {}
2301
2302 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/system.h linux-2.6.32.49/arch/powerpc/include/asm/system.h
2303 --- linux-2.6.32.49/arch/powerpc/include/asm/system.h 2011-11-08 19:02:43.000000000 -0500
2304 +++ linux-2.6.32.49/arch/powerpc/include/asm/system.h 2011-11-15 19:59:42.000000000 -0500
2305 @@ -531,7 +531,7 @@ __cmpxchg_local(volatile void *ptr, unsi
2306 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
2307 #endif
2308
2309 -extern unsigned long arch_align_stack(unsigned long sp);
2310 +#define arch_align_stack(x) ((x) & ~0xfUL)
2311
2312 /* Used in very early kernel initialization. */
2313 extern unsigned long reloc_offset(void);
2314 diff -urNp linux-2.6.32.49/arch/powerpc/include/asm/uaccess.h linux-2.6.32.49/arch/powerpc/include/asm/uaccess.h
2315 --- linux-2.6.32.49/arch/powerpc/include/asm/uaccess.h 2011-11-08 19:02:43.000000000 -0500
2316 +++ linux-2.6.32.49/arch/powerpc/include/asm/uaccess.h 2011-11-15 19:59:42.000000000 -0500
2317 @@ -13,6 +13,8 @@
2318 #define VERIFY_READ 0
2319 #define VERIFY_WRITE 1
2320
2321 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
2322 +
2323 /*
2324 * The fs value determines whether argument validity checking should be
2325 * performed or not. If get_fs() == USER_DS, checking is performed, with
2326 @@ -327,52 +329,6 @@ do { \
2327 extern unsigned long __copy_tofrom_user(void __user *to,
2328 const void __user *from, unsigned long size);
2329
2330 -#ifndef __powerpc64__
2331 -
2332 -static inline unsigned long copy_from_user(void *to,
2333 - const void __user *from, unsigned long n)
2334 -{
2335 - unsigned long over;
2336 -
2337 - if (access_ok(VERIFY_READ, from, n))
2338 - return __copy_tofrom_user((__force void __user *)to, from, n);
2339 - if ((unsigned long)from < TASK_SIZE) {
2340 - over = (unsigned long)from + n - TASK_SIZE;
2341 - return __copy_tofrom_user((__force void __user *)to, from,
2342 - n - over) + over;
2343 - }
2344 - return n;
2345 -}
2346 -
2347 -static inline unsigned long copy_to_user(void __user *to,
2348 - const void *from, unsigned long n)
2349 -{
2350 - unsigned long over;
2351 -
2352 - if (access_ok(VERIFY_WRITE, to, n))
2353 - return __copy_tofrom_user(to, (__force void __user *)from, n);
2354 - if ((unsigned long)to < TASK_SIZE) {
2355 - over = (unsigned long)to + n - TASK_SIZE;
2356 - return __copy_tofrom_user(to, (__force void __user *)from,
2357 - n - over) + over;
2358 - }
2359 - return n;
2360 -}
2361 -
2362 -#else /* __powerpc64__ */
2363 -
2364 -#define __copy_in_user(to, from, size) \
2365 - __copy_tofrom_user((to), (from), (size))
2366 -
2367 -extern unsigned long copy_from_user(void *to, const void __user *from,
2368 - unsigned long n);
2369 -extern unsigned long copy_to_user(void __user *to, const void *from,
2370 - unsigned long n);
2371 -extern unsigned long copy_in_user(void __user *to, const void __user *from,
2372 - unsigned long n);
2373 -
2374 -#endif /* __powerpc64__ */
2375 -
2376 static inline unsigned long __copy_from_user_inatomic(void *to,
2377 const void __user *from, unsigned long n)
2378 {
2379 @@ -396,6 +352,10 @@ static inline unsigned long __copy_from_
2380 if (ret == 0)
2381 return 0;
2382 }
2383 +
2384 + if (!__builtin_constant_p(n))
2385 + check_object_size(to, n, false);
2386 +
2387 return __copy_tofrom_user((__force void __user *)to, from, n);
2388 }
2389
2390 @@ -422,6 +382,10 @@ static inline unsigned long __copy_to_us
2391 if (ret == 0)
2392 return 0;
2393 }
2394 +
2395 + if (!__builtin_constant_p(n))
2396 + check_object_size(from, n, true);
2397 +
2398 return __copy_tofrom_user(to, (__force const void __user *)from, n);
2399 }
2400
2401 @@ -439,6 +403,92 @@ static inline unsigned long __copy_to_us
2402 return __copy_to_user_inatomic(to, from, size);
2403 }
2404
2405 +#ifndef __powerpc64__
2406 +
2407 +static inline unsigned long __must_check copy_from_user(void *to,
2408 + const void __user *from, unsigned long n)
2409 +{
2410 + unsigned long over;
2411 +
2412 + if ((long)n < 0)
2413 + return n;
2414 +
2415 + if (access_ok(VERIFY_READ, from, n)) {
2416 + if (!__builtin_constant_p(n))
2417 + check_object_size(to, n, false);
2418 + return __copy_tofrom_user((__force void __user *)to, from, n);
2419 + }
2420 + if ((unsigned long)from < TASK_SIZE) {
2421 + over = (unsigned long)from + n - TASK_SIZE;
2422 + if (!__builtin_constant_p(n - over))
2423 + check_object_size(to, n - over, false);
2424 + return __copy_tofrom_user((__force void __user *)to, from,
2425 + n - over) + over;
2426 + }
2427 + return n;
2428 +}
2429 +
2430 +static inline unsigned long __must_check copy_to_user(void __user *to,
2431 + const void *from, unsigned long n)
2432 +{
2433 + unsigned long over;
2434 +
2435 + if ((long)n < 0)
2436 + return n;
2437 +
2438 + if (access_ok(VERIFY_WRITE, to, n)) {
2439 + if (!__builtin_constant_p(n))
2440 + check_object_size(from, n, true);
2441 + return __copy_tofrom_user(to, (__force void __user *)from, n);
2442 + }
2443 + if ((unsigned long)to < TASK_SIZE) {
2444 + over = (unsigned long)to + n - TASK_SIZE;
2445 + if (!__builtin_constant_p(n))
2446 + check_object_size(from, n - over, true);
2447 + return __copy_tofrom_user(to, (__force void __user *)from,
2448 + n - over) + over;
2449 + }
2450 + return n;
2451 +}
2452 +
2453 +#else /* __powerpc64__ */
2454 +
2455 +#define __copy_in_user(to, from, size) \
2456 + __copy_tofrom_user((to), (from), (size))
2457 +
2458 +static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
2459 +{
2460 + if ((long)n < 0 || n > INT_MAX)
2461 + return n;
2462 +
2463 + if (!__builtin_constant_p(n))
2464 + check_object_size(to, n, false);
2465 +
2466 + if (likely(access_ok(VERIFY_READ, from, n)))
2467 + n = __copy_from_user(to, from, n);
2468 + else
2469 + memset(to, 0, n);
2470 + return n;
2471 +}
2472 +
2473 +static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
2474 +{
2475 + if ((long)n < 0 || n > INT_MAX)
2476 + return n;
2477 +
2478 + if (likely(access_ok(VERIFY_WRITE, to, n))) {
2479 + if (!__builtin_constant_p(n))
2480 + check_object_size(from, n, true);
2481 + n = __copy_to_user(to, from, n);
2482 + }
2483 + return n;
2484 +}
2485 +
2486 +extern unsigned long copy_in_user(void __user *to, const void __user *from,
2487 + unsigned long n);
2488 +
2489 +#endif /* __powerpc64__ */
2490 +
2491 extern unsigned long __clear_user(void __user *addr, unsigned long size);
2492
2493 static inline unsigned long clear_user(void __user *addr, unsigned long size)
2494 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/cacheinfo.c linux-2.6.32.49/arch/powerpc/kernel/cacheinfo.c
2495 --- linux-2.6.32.49/arch/powerpc/kernel/cacheinfo.c 2011-11-08 19:02:43.000000000 -0500
2496 +++ linux-2.6.32.49/arch/powerpc/kernel/cacheinfo.c 2011-11-15 19:59:42.000000000 -0500
2497 @@ -642,7 +642,7 @@ static struct kobj_attribute *cache_inde
2498 &cache_assoc_attr,
2499 };
2500
2501 -static struct sysfs_ops cache_index_ops = {
2502 +static const struct sysfs_ops cache_index_ops = {
2503 .show = cache_index_show,
2504 };
2505
2506 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/dma.c linux-2.6.32.49/arch/powerpc/kernel/dma.c
2507 --- linux-2.6.32.49/arch/powerpc/kernel/dma.c 2011-11-08 19:02:43.000000000 -0500
2508 +++ linux-2.6.32.49/arch/powerpc/kernel/dma.c 2011-11-15 19:59:42.000000000 -0500
2509 @@ -134,7 +134,7 @@ static inline void dma_direct_sync_singl
2510 }
2511 #endif
2512
2513 -struct dma_map_ops dma_direct_ops = {
2514 +const struct dma_map_ops dma_direct_ops = {
2515 .alloc_coherent = dma_direct_alloc_coherent,
2516 .free_coherent = dma_direct_free_coherent,
2517 .map_sg = dma_direct_map_sg,
2518 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/dma-iommu.c linux-2.6.32.49/arch/powerpc/kernel/dma-iommu.c
2519 --- linux-2.6.32.49/arch/powerpc/kernel/dma-iommu.c 2011-11-08 19:02:43.000000000 -0500
2520 +++ linux-2.6.32.49/arch/powerpc/kernel/dma-iommu.c 2011-11-15 19:59:42.000000000 -0500
2521 @@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
2522 }
2523
2524 /* We support DMA to/from any memory page via the iommu */
2525 -static int dma_iommu_dma_supported(struct device *dev, u64 mask)
2526 +int dma_iommu_dma_supported(struct device *dev, u64 mask)
2527 {
2528 struct iommu_table *tbl = get_iommu_table_base(dev);
2529
2530 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.32.49/arch/powerpc/kernel/dma-swiotlb.c
2531 --- linux-2.6.32.49/arch/powerpc/kernel/dma-swiotlb.c 2011-11-08 19:02:43.000000000 -0500
2532 +++ linux-2.6.32.49/arch/powerpc/kernel/dma-swiotlb.c 2011-11-15 19:59:42.000000000 -0500
2533 @@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
2534 * map_page, and unmap_page on highmem, use normal dma_ops
2535 * for everything else.
2536 */
2537 -struct dma_map_ops swiotlb_dma_ops = {
2538 +const struct dma_map_ops swiotlb_dma_ops = {
2539 .alloc_coherent = dma_direct_alloc_coherent,
2540 .free_coherent = dma_direct_free_coherent,
2541 .map_sg = swiotlb_map_sg_attrs,
2542 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/exceptions-64e.S linux-2.6.32.49/arch/powerpc/kernel/exceptions-64e.S
2543 --- linux-2.6.32.49/arch/powerpc/kernel/exceptions-64e.S 2011-11-08 19:02:43.000000000 -0500
2544 +++ linux-2.6.32.49/arch/powerpc/kernel/exceptions-64e.S 2011-11-15 19:59:42.000000000 -0500
2545 @@ -455,6 +455,7 @@ storage_fault_common:
2546 std r14,_DAR(r1)
2547 std r15,_DSISR(r1)
2548 addi r3,r1,STACK_FRAME_OVERHEAD
2549 + bl .save_nvgprs
2550 mr r4,r14
2551 mr r5,r15
2552 ld r14,PACA_EXGEN+EX_R14(r13)
2553 @@ -464,8 +465,7 @@ storage_fault_common:
2554 cmpdi r3,0
2555 bne- 1f
2556 b .ret_from_except_lite
2557 -1: bl .save_nvgprs
2558 - mr r5,r3
2559 +1: mr r5,r3
2560 addi r3,r1,STACK_FRAME_OVERHEAD
2561 ld r4,_DAR(r1)
2562 bl .bad_page_fault
2563 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/exceptions-64s.S linux-2.6.32.49/arch/powerpc/kernel/exceptions-64s.S
2564 --- linux-2.6.32.49/arch/powerpc/kernel/exceptions-64s.S 2011-11-08 19:02:43.000000000 -0500
2565 +++ linux-2.6.32.49/arch/powerpc/kernel/exceptions-64s.S 2011-11-15 19:59:42.000000000 -0500
2566 @@ -818,10 +818,10 @@ handle_page_fault:
2567 11: ld r4,_DAR(r1)
2568 ld r5,_DSISR(r1)
2569 addi r3,r1,STACK_FRAME_OVERHEAD
2570 + bl .save_nvgprs
2571 bl .do_page_fault
2572 cmpdi r3,0
2573 beq+ 13f
2574 - bl .save_nvgprs
2575 mr r5,r3
2576 addi r3,r1,STACK_FRAME_OVERHEAD
2577 lwz r4,_DAR(r1)
2578 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/ibmebus.c linux-2.6.32.49/arch/powerpc/kernel/ibmebus.c
2579 --- linux-2.6.32.49/arch/powerpc/kernel/ibmebus.c 2011-11-08 19:02:43.000000000 -0500
2580 +++ linux-2.6.32.49/arch/powerpc/kernel/ibmebus.c 2011-11-15 19:59:42.000000000 -0500
2581 @@ -127,7 +127,7 @@ static int ibmebus_dma_supported(struct
2582 return 1;
2583 }
2584
2585 -static struct dma_map_ops ibmebus_dma_ops = {
2586 +static const struct dma_map_ops ibmebus_dma_ops = {
2587 .alloc_coherent = ibmebus_alloc_coherent,
2588 .free_coherent = ibmebus_free_coherent,
2589 .map_sg = ibmebus_map_sg,
2590 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/kgdb.c linux-2.6.32.49/arch/powerpc/kernel/kgdb.c
2591 --- linux-2.6.32.49/arch/powerpc/kernel/kgdb.c 2011-11-08 19:02:43.000000000 -0500
2592 +++ linux-2.6.32.49/arch/powerpc/kernel/kgdb.c 2011-11-15 19:59:42.000000000 -0500
2593 @@ -126,7 +126,7 @@ static int kgdb_handle_breakpoint(struct
2594 if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
2595 return 0;
2596
2597 - if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
2598 + if (*(u32 *) (regs->nip) == *(const u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
2599 regs->nip += 4;
2600
2601 return 1;
2602 @@ -353,7 +353,7 @@ int kgdb_arch_handle_exception(int vecto
2603 /*
2604 * Global data
2605 */
2606 -struct kgdb_arch arch_kgdb_ops = {
2607 +const struct kgdb_arch arch_kgdb_ops = {
2608 .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
2609 };
2610
2611 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/module_32.c linux-2.6.32.49/arch/powerpc/kernel/module_32.c
2612 --- linux-2.6.32.49/arch/powerpc/kernel/module_32.c 2011-11-08 19:02:43.000000000 -0500
2613 +++ linux-2.6.32.49/arch/powerpc/kernel/module_32.c 2011-11-15 19:59:42.000000000 -0500
2614 @@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
2615 me->arch.core_plt_section = i;
2616 }
2617 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
2618 - printk("Module doesn't contain .plt or .init.plt sections.\n");
2619 + printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
2620 return -ENOEXEC;
2621 }
2622
2623 @@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
2624
2625 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
2626 /* Init, or core PLT? */
2627 - if (location >= mod->module_core
2628 - && location < mod->module_core + mod->core_size)
2629 + if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
2630 + (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
2631 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
2632 - else
2633 + else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
2634 + (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
2635 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
2636 + else {
2637 + printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
2638 + return ~0UL;
2639 + }
2640
2641 /* Find this entry, or if that fails, the next avail. entry */
2642 while (entry->jump[0]) {
2643 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/module.c linux-2.6.32.49/arch/powerpc/kernel/module.c
2644 --- linux-2.6.32.49/arch/powerpc/kernel/module.c 2011-11-08 19:02:43.000000000 -0500
2645 +++ linux-2.6.32.49/arch/powerpc/kernel/module.c 2011-11-15 19:59:42.000000000 -0500
2646 @@ -31,11 +31,24 @@
2647
2648 LIST_HEAD(module_bug_list);
2649
2650 +#ifdef CONFIG_PAX_KERNEXEC
2651 void *module_alloc(unsigned long size)
2652 {
2653 if (size == 0)
2654 return NULL;
2655
2656 + return vmalloc(size);
2657 +}
2658 +
2659 +void *module_alloc_exec(unsigned long size)
2660 +#else
2661 +void *module_alloc(unsigned long size)
2662 +#endif
2663 +
2664 +{
2665 + if (size == 0)
2666 + return NULL;
2667 +
2668 return vmalloc_exec(size);
2669 }
2670
2671 @@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
2672 vfree(module_region);
2673 }
2674
2675 +#ifdef CONFIG_PAX_KERNEXEC
2676 +void module_free_exec(struct module *mod, void *module_region)
2677 +{
2678 + module_free(mod, module_region);
2679 +}
2680 +#endif
2681 +
2682 static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
2683 const Elf_Shdr *sechdrs,
2684 const char *name)
2685 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/pci-common.c linux-2.6.32.49/arch/powerpc/kernel/pci-common.c
2686 --- linux-2.6.32.49/arch/powerpc/kernel/pci-common.c 2011-11-08 19:02:43.000000000 -0500
2687 +++ linux-2.6.32.49/arch/powerpc/kernel/pci-common.c 2011-11-15 19:59:42.000000000 -0500
2688 @@ -50,14 +50,14 @@ resource_size_t isa_mem_base;
2689 unsigned int ppc_pci_flags = 0;
2690
2691
2692 -static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
2693 +static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
2694
2695 -void set_pci_dma_ops(struct dma_map_ops *dma_ops)
2696 +void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
2697 {
2698 pci_dma_ops = dma_ops;
2699 }
2700
2701 -struct dma_map_ops *get_pci_dma_ops(void)
2702 +const struct dma_map_ops *get_pci_dma_ops(void)
2703 {
2704 return pci_dma_ops;
2705 }
2706 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/process.c linux-2.6.32.49/arch/powerpc/kernel/process.c
2707 --- linux-2.6.32.49/arch/powerpc/kernel/process.c 2011-11-08 19:02:43.000000000 -0500
2708 +++ linux-2.6.32.49/arch/powerpc/kernel/process.c 2011-11-15 19:59:42.000000000 -0500
2709 @@ -539,8 +539,8 @@ void show_regs(struct pt_regs * regs)
2710 * Lookup NIP late so we have the best change of getting the
2711 * above info out without failing
2712 */
2713 - printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
2714 - printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
2715 + printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
2716 + printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
2717 #endif
2718 show_stack(current, (unsigned long *) regs->gpr[1]);
2719 if (!user_mode(regs))
2720 @@ -1034,10 +1034,10 @@ void show_stack(struct task_struct *tsk,
2721 newsp = stack[0];
2722 ip = stack[STACK_FRAME_LR_SAVE];
2723 if (!firstframe || ip != lr) {
2724 - printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
2725 + printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
2726 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
2727 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
2728 - printk(" (%pS)",
2729 + printk(" (%pA)",
2730 (void *)current->ret_stack[curr_frame].ret);
2731 curr_frame--;
2732 }
2733 @@ -1057,7 +1057,7 @@ void show_stack(struct task_struct *tsk,
2734 struct pt_regs *regs = (struct pt_regs *)
2735 (sp + STACK_FRAME_OVERHEAD);
2736 lr = regs->link;
2737 - printk("--- Exception: %lx at %pS\n LR = %pS\n",
2738 + printk("--- Exception: %lx at %pA\n LR = %pA\n",
2739 regs->trap, (void *)regs->nip, (void *)lr);
2740 firstframe = 1;
2741 }
2742 @@ -1134,58 +1134,3 @@ void thread_info_cache_init(void)
2743 }
2744
2745 #endif /* THREAD_SHIFT < PAGE_SHIFT */
2746 -
2747 -unsigned long arch_align_stack(unsigned long sp)
2748 -{
2749 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2750 - sp -= get_random_int() & ~PAGE_MASK;
2751 - return sp & ~0xf;
2752 -}
2753 -
2754 -static inline unsigned long brk_rnd(void)
2755 -{
2756 - unsigned long rnd = 0;
2757 -
2758 - /* 8MB for 32bit, 1GB for 64bit */
2759 - if (is_32bit_task())
2760 - rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
2761 - else
2762 - rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
2763 -
2764 - return rnd << PAGE_SHIFT;
2765 -}
2766 -
2767 -unsigned long arch_randomize_brk(struct mm_struct *mm)
2768 -{
2769 - unsigned long base = mm->brk;
2770 - unsigned long ret;
2771 -
2772 -#ifdef CONFIG_PPC_STD_MMU_64
2773 - /*
2774 - * If we are using 1TB segments and we are allowed to randomise
2775 - * the heap, we can put it above 1TB so it is backed by a 1TB
2776 - * segment. Otherwise the heap will be in the bottom 1TB
2777 - * which always uses 256MB segments and this may result in a
2778 - * performance penalty.
2779 - */
2780 - if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
2781 - base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
2782 -#endif
2783 -
2784 - ret = PAGE_ALIGN(base + brk_rnd());
2785 -
2786 - if (ret < mm->brk)
2787 - return mm->brk;
2788 -
2789 - return ret;
2790 -}
2791 -
2792 -unsigned long randomize_et_dyn(unsigned long base)
2793 -{
2794 - unsigned long ret = PAGE_ALIGN(base + brk_rnd());
2795 -
2796 - if (ret < base)
2797 - return base;
2798 -
2799 - return ret;
2800 -}
2801 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/ptrace.c linux-2.6.32.49/arch/powerpc/kernel/ptrace.c
2802 --- linux-2.6.32.49/arch/powerpc/kernel/ptrace.c 2011-11-08 19:02:43.000000000 -0500
2803 +++ linux-2.6.32.49/arch/powerpc/kernel/ptrace.c 2011-11-15 19:59:42.000000000 -0500
2804 @@ -86,7 +86,7 @@ static int set_user_trap(struct task_str
2805 /*
2806 * Get contents of register REGNO in task TASK.
2807 */
2808 -unsigned long ptrace_get_reg(struct task_struct *task, int regno)
2809 +unsigned long ptrace_get_reg(struct task_struct *task, unsigned int regno)
2810 {
2811 if (task->thread.regs == NULL)
2812 return -EIO;
2813 @@ -894,7 +894,7 @@ long arch_ptrace(struct task_struct *chi
2814
2815 CHECK_FULL_REGS(child->thread.regs);
2816 if (index < PT_FPR0) {
2817 - tmp = ptrace_get_reg(child, (int) index);
2818 + tmp = ptrace_get_reg(child, index);
2819 } else {
2820 flush_fp_to_thread(child);
2821 tmp = ((unsigned long *)child->thread.fpr)
2822 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/signal_32.c linux-2.6.32.49/arch/powerpc/kernel/signal_32.c
2823 --- linux-2.6.32.49/arch/powerpc/kernel/signal_32.c 2011-11-08 19:02:43.000000000 -0500
2824 +++ linux-2.6.32.49/arch/powerpc/kernel/signal_32.c 2011-11-15 19:59:42.000000000 -0500
2825 @@ -857,7 +857,7 @@ int handle_rt_signal32(unsigned long sig
2826 /* Save user registers on the stack */
2827 frame = &rt_sf->uc.uc_mcontext;
2828 addr = frame;
2829 - if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
2830 + if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2831 if (save_user_regs(regs, frame, 0, 1))
2832 goto badframe;
2833 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
2834 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/signal_64.c linux-2.6.32.49/arch/powerpc/kernel/signal_64.c
2835 --- linux-2.6.32.49/arch/powerpc/kernel/signal_64.c 2011-11-08 19:02:43.000000000 -0500
2836 +++ linux-2.6.32.49/arch/powerpc/kernel/signal_64.c 2011-11-15 19:59:42.000000000 -0500
2837 @@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
2838 current->thread.fpscr.val = 0;
2839
2840 /* Set up to return from userspace. */
2841 - if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
2842 + if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2843 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
2844 } else {
2845 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
2846 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/sys_ppc32.c linux-2.6.32.49/arch/powerpc/kernel/sys_ppc32.c
2847 --- linux-2.6.32.49/arch/powerpc/kernel/sys_ppc32.c 2011-11-08 19:02:43.000000000 -0500
2848 +++ linux-2.6.32.49/arch/powerpc/kernel/sys_ppc32.c 2011-11-15 19:59:42.000000000 -0500
2849 @@ -563,10 +563,10 @@ asmlinkage long compat_sys_sysctl(struct
2850 if (oldlenp) {
2851 if (!error) {
2852 if (get_user(oldlen, oldlenp) ||
2853 - put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)))
2854 + put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)) ||
2855 + copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused)))
2856 error = -EFAULT;
2857 }
2858 - copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
2859 }
2860 return error;
2861 }
2862 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/traps.c linux-2.6.32.49/arch/powerpc/kernel/traps.c
2863 --- linux-2.6.32.49/arch/powerpc/kernel/traps.c 2011-11-08 19:02:43.000000000 -0500
2864 +++ linux-2.6.32.49/arch/powerpc/kernel/traps.c 2011-11-15 19:59:42.000000000 -0500
2865 @@ -99,6 +99,8 @@ static void pmac_backlight_unblank(void)
2866 static inline void pmac_backlight_unblank(void) { }
2867 #endif
2868
2869 +extern void gr_handle_kernel_exploit(void);
2870 +
2871 int die(const char *str, struct pt_regs *regs, long err)
2872 {
2873 static struct {
2874 @@ -168,6 +170,8 @@ int die(const char *str, struct pt_regs
2875 if (panic_on_oops)
2876 panic("Fatal exception");
2877
2878 + gr_handle_kernel_exploit();
2879 +
2880 oops_exit();
2881 do_exit(err);
2882
2883 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/vdso.c linux-2.6.32.49/arch/powerpc/kernel/vdso.c
2884 --- linux-2.6.32.49/arch/powerpc/kernel/vdso.c 2011-11-08 19:02:43.000000000 -0500
2885 +++ linux-2.6.32.49/arch/powerpc/kernel/vdso.c 2011-11-15 19:59:42.000000000 -0500
2886 @@ -36,6 +36,7 @@
2887 #include <asm/firmware.h>
2888 #include <asm/vdso.h>
2889 #include <asm/vdso_datapage.h>
2890 +#include <asm/mman.h>
2891
2892 #include "setup.h"
2893
2894 @@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
2895 vdso_base = VDSO32_MBASE;
2896 #endif
2897
2898 - current->mm->context.vdso_base = 0;
2899 + current->mm->context.vdso_base = ~0UL;
2900
2901 /* vDSO has a problem and was disabled, just don't "enable" it for the
2902 * process
2903 @@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
2904 vdso_base = get_unmapped_area(NULL, vdso_base,
2905 (vdso_pages << PAGE_SHIFT) +
2906 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
2907 - 0, 0);
2908 + 0, MAP_PRIVATE | MAP_EXECUTABLE);
2909 if (IS_ERR_VALUE(vdso_base)) {
2910 rc = vdso_base;
2911 goto fail_mmapsem;
2912 diff -urNp linux-2.6.32.49/arch/powerpc/kernel/vio.c linux-2.6.32.49/arch/powerpc/kernel/vio.c
2913 --- linux-2.6.32.49/arch/powerpc/kernel/vio.c 2011-11-08 19:02:43.000000000 -0500
2914 +++ linux-2.6.32.49/arch/powerpc/kernel/vio.c 2011-11-15 19:59:42.000000000 -0500
2915 @@ -601,11 +601,12 @@ static void vio_dma_iommu_unmap_sg(struc
2916 vio_cmo_dealloc(viodev, alloc_size);
2917 }
2918
2919 -struct dma_map_ops vio_dma_mapping_ops = {
2920 +static const struct dma_map_ops vio_dma_mapping_ops = {
2921 .alloc_coherent = vio_dma_iommu_alloc_coherent,
2922 .free_coherent = vio_dma_iommu_free_coherent,
2923 .map_sg = vio_dma_iommu_map_sg,
2924 .unmap_sg = vio_dma_iommu_unmap_sg,
2925 + .dma_supported = dma_iommu_dma_supported,
2926 .map_page = vio_dma_iommu_map_page,
2927 .unmap_page = vio_dma_iommu_unmap_page,
2928
2929 @@ -857,7 +858,6 @@ static void vio_cmo_bus_remove(struct vi
2930
2931 static void vio_cmo_set_dma_ops(struct vio_dev *viodev)
2932 {
2933 - vio_dma_mapping_ops.dma_supported = dma_iommu_ops.dma_supported;
2934 viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
2935 }
2936
2937 diff -urNp linux-2.6.32.49/arch/powerpc/lib/usercopy_64.c linux-2.6.32.49/arch/powerpc/lib/usercopy_64.c
2938 --- linux-2.6.32.49/arch/powerpc/lib/usercopy_64.c 2011-11-08 19:02:43.000000000 -0500
2939 +++ linux-2.6.32.49/arch/powerpc/lib/usercopy_64.c 2011-11-15 19:59:42.000000000 -0500
2940 @@ -9,22 +9,6 @@
2941 #include <linux/module.h>
2942 #include <asm/uaccess.h>
2943
2944 -unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
2945 -{
2946 - if (likely(access_ok(VERIFY_READ, from, n)))
2947 - n = __copy_from_user(to, from, n);
2948 - else
2949 - memset(to, 0, n);
2950 - return n;
2951 -}
2952 -
2953 -unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
2954 -{
2955 - if (likely(access_ok(VERIFY_WRITE, to, n)))
2956 - n = __copy_to_user(to, from, n);
2957 - return n;
2958 -}
2959 -
2960 unsigned long copy_in_user(void __user *to, const void __user *from,
2961 unsigned long n)
2962 {
2963 @@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
2964 return n;
2965 }
2966
2967 -EXPORT_SYMBOL(copy_from_user);
2968 -EXPORT_SYMBOL(copy_to_user);
2969 EXPORT_SYMBOL(copy_in_user);
2970
2971 diff -urNp linux-2.6.32.49/arch/powerpc/Makefile linux-2.6.32.49/arch/powerpc/Makefile
2972 --- linux-2.6.32.49/arch/powerpc/Makefile 2011-11-08 19:02:43.000000000 -0500
2973 +++ linux-2.6.32.49/arch/powerpc/Makefile 2011-11-15 19:59:42.000000000 -0500
2974 @@ -74,6 +74,8 @@ KBUILD_AFLAGS += -Iarch/$(ARCH)
2975 KBUILD_CFLAGS += -msoft-float -pipe -Iarch/$(ARCH) $(CFLAGS-y)
2976 CPP = $(CC) -E $(KBUILD_CFLAGS)
2977
2978 +cflags-y += -Wno-sign-compare -Wno-extra
2979 +
2980 CHECKFLAGS += -m$(CONFIG_WORD_SIZE) -D__powerpc__ -D__powerpc$(CONFIG_WORD_SIZE)__
2981
2982 ifeq ($(CONFIG_PPC64),y)
2983 diff -urNp linux-2.6.32.49/arch/powerpc/mm/fault.c linux-2.6.32.49/arch/powerpc/mm/fault.c
2984 --- linux-2.6.32.49/arch/powerpc/mm/fault.c 2011-11-08 19:02:43.000000000 -0500
2985 +++ linux-2.6.32.49/arch/powerpc/mm/fault.c 2011-11-18 18:01:52.000000000 -0500
2986 @@ -30,6 +30,10 @@
2987 #include <linux/kprobes.h>
2988 #include <linux/kdebug.h>
2989 #include <linux/perf_event.h>
2990 +#include <linux/slab.h>
2991 +#include <linux/pagemap.h>
2992 +#include <linux/compiler.h>
2993 +#include <linux/unistd.h>
2994
2995 #include <asm/firmware.h>
2996 #include <asm/page.h>
2997 @@ -40,6 +44,7 @@
2998 #include <asm/uaccess.h>
2999 #include <asm/tlbflush.h>
3000 #include <asm/siginfo.h>
3001 +#include <asm/ptrace.h>
3002
3003
3004 #ifdef CONFIG_KPROBES
3005 @@ -64,6 +69,33 @@ static inline int notify_page_fault(stru
3006 }
3007 #endif
3008
3009 +#ifdef CONFIG_PAX_PAGEEXEC
3010 +/*
3011 + * PaX: decide what to do with offenders (regs->nip = fault address)
3012 + *
3013 + * returns 1 when task should be killed
3014 + */
3015 +static int pax_handle_fetch_fault(struct pt_regs *regs)
3016 +{
3017 + return 1;
3018 +}
3019 +
3020 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
3021 +{
3022 + unsigned long i;
3023 +
3024 + printk(KERN_ERR "PAX: bytes at PC: ");
3025 + for (i = 0; i < 5; i++) {
3026 + unsigned int c;
3027 + if (get_user(c, (unsigned int __user *)pc+i))
3028 + printk(KERN_CONT "???????? ");
3029 + else
3030 + printk(KERN_CONT "%08x ", c);
3031 + }
3032 + printk("\n");
3033 +}
3034 +#endif
3035 +
3036 /*
3037 * Check whether the instruction at regs->nip is a store using
3038 * an update addressing form which will update r1.
3039 @@ -134,7 +166,7 @@ int __kprobes do_page_fault(struct pt_re
3040 * indicate errors in DSISR but can validly be set in SRR1.
3041 */
3042 if (trap == 0x400)
3043 - error_code &= 0x48200000;
3044 + error_code &= 0x58200000;
3045 else
3046 is_write = error_code & DSISR_ISSTORE;
3047 #else
3048 @@ -250,7 +282,7 @@ good_area:
3049 * "undefined". Of those that can be set, this is the only
3050 * one which seems bad.
3051 */
3052 - if (error_code & 0x10000000)
3053 + if (error_code & DSISR_GUARDED)
3054 /* Guarded storage error. */
3055 goto bad_area;
3056 #endif /* CONFIG_8xx */
3057 @@ -265,7 +297,7 @@ good_area:
3058 * processors use the same I/D cache coherency mechanism
3059 * as embedded.
3060 */
3061 - if (error_code & DSISR_PROTFAULT)
3062 + if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
3063 goto bad_area;
3064 #endif /* CONFIG_PPC_STD_MMU */
3065
3066 @@ -335,6 +367,23 @@ bad_area:
3067 bad_area_nosemaphore:
3068 /* User mode accesses cause a SIGSEGV */
3069 if (user_mode(regs)) {
3070 +
3071 +#ifdef CONFIG_PAX_PAGEEXEC
3072 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
3073 +#ifdef CONFIG_PPC_STD_MMU
3074 + if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
3075 +#else
3076 + if (is_exec && regs->nip == address) {
3077 +#endif
3078 + switch (pax_handle_fetch_fault(regs)) {
3079 + }
3080 +
3081 + pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
3082 + do_group_exit(SIGKILL);
3083 + }
3084 + }
3085 +#endif
3086 +
3087 _exception(SIGSEGV, regs, code, address);
3088 return 0;
3089 }
3090 diff -urNp linux-2.6.32.49/arch/powerpc/mm/mem.c linux-2.6.32.49/arch/powerpc/mm/mem.c
3091 --- linux-2.6.32.49/arch/powerpc/mm/mem.c 2011-11-08 19:02:43.000000000 -0500
3092 +++ linux-2.6.32.49/arch/powerpc/mm/mem.c 2011-11-15 19:59:42.000000000 -0500
3093 @@ -250,7 +250,7 @@ static int __init mark_nonram_nosave(voi
3094 {
3095 unsigned long lmb_next_region_start_pfn,
3096 lmb_region_max_pfn;
3097 - int i;
3098 + unsigned int i;
3099
3100 for (i = 0; i < lmb.memory.cnt - 1; i++) {
3101 lmb_region_max_pfn =
3102 diff -urNp linux-2.6.32.49/arch/powerpc/mm/mmap_64.c linux-2.6.32.49/arch/powerpc/mm/mmap_64.c
3103 --- linux-2.6.32.49/arch/powerpc/mm/mmap_64.c 2011-11-08 19:02:43.000000000 -0500
3104 +++ linux-2.6.32.49/arch/powerpc/mm/mmap_64.c 2011-11-15 19:59:42.000000000 -0500
3105 @@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
3106 */
3107 if (mmap_is_legacy()) {
3108 mm->mmap_base = TASK_UNMAPPED_BASE;
3109 +
3110 +#ifdef CONFIG_PAX_RANDMMAP
3111 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3112 + mm->mmap_base += mm->delta_mmap;
3113 +#endif
3114 +
3115 mm->get_unmapped_area = arch_get_unmapped_area;
3116 mm->unmap_area = arch_unmap_area;
3117 } else {
3118 mm->mmap_base = mmap_base();
3119 +
3120 +#ifdef CONFIG_PAX_RANDMMAP
3121 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3122 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3123 +#endif
3124 +
3125 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
3126 mm->unmap_area = arch_unmap_area_topdown;
3127 }
3128 diff -urNp linux-2.6.32.49/arch/powerpc/mm/slice.c linux-2.6.32.49/arch/powerpc/mm/slice.c
3129 --- linux-2.6.32.49/arch/powerpc/mm/slice.c 2011-11-08 19:02:43.000000000 -0500
3130 +++ linux-2.6.32.49/arch/powerpc/mm/slice.c 2011-11-15 19:59:42.000000000 -0500
3131 @@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
3132 if ((mm->task_size - len) < addr)
3133 return 0;
3134 vma = find_vma(mm, addr);
3135 - return (!vma || (addr + len) <= vma->vm_start);
3136 + return check_heap_stack_gap(vma, addr, len);
3137 }
3138
3139 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
3140 @@ -256,7 +256,7 @@ full_search:
3141 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
3142 continue;
3143 }
3144 - if (!vma || addr + len <= vma->vm_start) {
3145 + if (check_heap_stack_gap(vma, addr, len)) {
3146 /*
3147 * Remember the place where we stopped the search:
3148 */
3149 @@ -313,10 +313,14 @@ static unsigned long slice_find_area_top
3150 }
3151 }
3152
3153 - addr = mm->mmap_base;
3154 - while (addr > len) {
3155 + if (mm->mmap_base < len)
3156 + addr = -ENOMEM;
3157 + else
3158 + addr = mm->mmap_base - len;
3159 +
3160 + while (!IS_ERR_VALUE(addr)) {
3161 /* Go down by chunk size */
3162 - addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
3163 + addr = _ALIGN_DOWN(addr, 1ul << pshift);
3164
3165 /* Check for hit with different page size */
3166 mask = slice_range_to_mask(addr, len);
3167 @@ -336,7 +340,7 @@ static unsigned long slice_find_area_top
3168 * return with success:
3169 */
3170 vma = find_vma(mm, addr);
3171 - if (!vma || (addr + len) <= vma->vm_start) {
3172 + if (check_heap_stack_gap(vma, addr, len)) {
3173 /* remember the address as a hint for next time */
3174 if (use_cache)
3175 mm->free_area_cache = addr;
3176 @@ -348,7 +352,7 @@ static unsigned long slice_find_area_top
3177 mm->cached_hole_size = vma->vm_start - addr;
3178
3179 /* try just below the current vma->vm_start */
3180 - addr = vma->vm_start;
3181 + addr = skip_heap_stack_gap(vma, len);
3182 }
3183
3184 /*
3185 @@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(un
3186 if (fixed && addr > (mm->task_size - len))
3187 return -EINVAL;
3188
3189 +#ifdef CONFIG_PAX_RANDMMAP
3190 + if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
3191 + addr = 0;
3192 +#endif
3193 +
3194 /* If hint, make sure it matches our alignment restrictions */
3195 if (!fixed && addr) {
3196 addr = _ALIGN_UP(addr, 1ul << pshift);
3197 diff -urNp linux-2.6.32.49/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.32.49/arch/powerpc/platforms/52xx/lite5200_pm.c
3198 --- linux-2.6.32.49/arch/powerpc/platforms/52xx/lite5200_pm.c 2011-11-08 19:02:43.000000000 -0500
3199 +++ linux-2.6.32.49/arch/powerpc/platforms/52xx/lite5200_pm.c 2011-11-15 19:59:42.000000000 -0500
3200 @@ -235,7 +235,7 @@ static void lite5200_pm_end(void)
3201 lite5200_pm_target_state = PM_SUSPEND_ON;
3202 }
3203
3204 -static struct platform_suspend_ops lite5200_pm_ops = {
3205 +static const struct platform_suspend_ops lite5200_pm_ops = {
3206 .valid = lite5200_pm_valid,
3207 .begin = lite5200_pm_begin,
3208 .prepare = lite5200_pm_prepare,
3209 diff -urNp linux-2.6.32.49/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.32.49/arch/powerpc/platforms/52xx/mpc52xx_pm.c
3210 --- linux-2.6.32.49/arch/powerpc/platforms/52xx/mpc52xx_pm.c 2011-11-08 19:02:43.000000000 -0500
3211 +++ linux-2.6.32.49/arch/powerpc/platforms/52xx/mpc52xx_pm.c 2011-11-15 19:59:42.000000000 -0500
3212 @@ -180,7 +180,7 @@ void mpc52xx_pm_finish(void)
3213 iounmap(mbar);
3214 }
3215
3216 -static struct platform_suspend_ops mpc52xx_pm_ops = {
3217 +static const struct platform_suspend_ops mpc52xx_pm_ops = {
3218 .valid = mpc52xx_pm_valid,
3219 .prepare = mpc52xx_pm_prepare,
3220 .enter = mpc52xx_pm_enter,
3221 diff -urNp linux-2.6.32.49/arch/powerpc/platforms/83xx/suspend.c linux-2.6.32.49/arch/powerpc/platforms/83xx/suspend.c
3222 --- linux-2.6.32.49/arch/powerpc/platforms/83xx/suspend.c 2011-11-08 19:02:43.000000000 -0500
3223 +++ linux-2.6.32.49/arch/powerpc/platforms/83xx/suspend.c 2011-11-15 19:59:42.000000000 -0500
3224 @@ -273,7 +273,7 @@ static int mpc83xx_is_pci_agent(void)
3225 return ret;
3226 }
3227
3228 -static struct platform_suspend_ops mpc83xx_suspend_ops = {
3229 +static const struct platform_suspend_ops mpc83xx_suspend_ops = {
3230 .valid = mpc83xx_suspend_valid,
3231 .begin = mpc83xx_suspend_begin,
3232 .enter = mpc83xx_suspend_enter,
3233 diff -urNp linux-2.6.32.49/arch/powerpc/platforms/cell/iommu.c linux-2.6.32.49/arch/powerpc/platforms/cell/iommu.c
3234 --- linux-2.6.32.49/arch/powerpc/platforms/cell/iommu.c 2011-11-08 19:02:43.000000000 -0500
3235 +++ linux-2.6.32.49/arch/powerpc/platforms/cell/iommu.c 2011-11-15 19:59:42.000000000 -0500
3236 @@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
3237
3238 static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
3239
3240 -struct dma_map_ops dma_iommu_fixed_ops = {
3241 +const struct dma_map_ops dma_iommu_fixed_ops = {
3242 .alloc_coherent = dma_fixed_alloc_coherent,
3243 .free_coherent = dma_fixed_free_coherent,
3244 .map_sg = dma_fixed_map_sg,
3245 diff -urNp linux-2.6.32.49/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.32.49/arch/powerpc/platforms/ps3/system-bus.c
3246 --- linux-2.6.32.49/arch/powerpc/platforms/ps3/system-bus.c 2011-11-08 19:02:43.000000000 -0500
3247 +++ linux-2.6.32.49/arch/powerpc/platforms/ps3/system-bus.c 2011-11-15 19:59:42.000000000 -0500
3248 @@ -694,7 +694,7 @@ static int ps3_dma_supported(struct devi
3249 return mask >= DMA_BIT_MASK(32);
3250 }
3251
3252 -static struct dma_map_ops ps3_sb_dma_ops = {
3253 +static const struct dma_map_ops ps3_sb_dma_ops = {
3254 .alloc_coherent = ps3_alloc_coherent,
3255 .free_coherent = ps3_free_coherent,
3256 .map_sg = ps3_sb_map_sg,
3257 @@ -704,7 +704,7 @@ static struct dma_map_ops ps3_sb_dma_ops
3258 .unmap_page = ps3_unmap_page,
3259 };
3260
3261 -static struct dma_map_ops ps3_ioc0_dma_ops = {
3262 +static const struct dma_map_ops ps3_ioc0_dma_ops = {
3263 .alloc_coherent = ps3_alloc_coherent,
3264 .free_coherent = ps3_free_coherent,
3265 .map_sg = ps3_ioc0_map_sg,
3266 diff -urNp linux-2.6.32.49/arch/powerpc/platforms/pseries/Kconfig linux-2.6.32.49/arch/powerpc/platforms/pseries/Kconfig
3267 --- linux-2.6.32.49/arch/powerpc/platforms/pseries/Kconfig 2011-11-08 19:02:43.000000000 -0500
3268 +++ linux-2.6.32.49/arch/powerpc/platforms/pseries/Kconfig 2011-11-15 19:59:42.000000000 -0500
3269 @@ -2,6 +2,8 @@ config PPC_PSERIES
3270 depends on PPC64 && PPC_BOOK3S
3271 bool "IBM pSeries & new (POWER5-based) iSeries"
3272 select MPIC
3273 + select PCI_MSI
3274 + select XICS
3275 select PPC_I8259
3276 select PPC_RTAS
3277 select RTAS_ERROR_LOGGING
3278 diff -urNp linux-2.6.32.49/arch/s390/include/asm/elf.h linux-2.6.32.49/arch/s390/include/asm/elf.h
3279 --- linux-2.6.32.49/arch/s390/include/asm/elf.h 2011-11-08 19:02:43.000000000 -0500
3280 +++ linux-2.6.32.49/arch/s390/include/asm/elf.h 2011-11-15 19:59:42.000000000 -0500
3281 @@ -164,6 +164,13 @@ extern unsigned int vdso_enabled;
3282 that it will "exec", and that there is sufficient room for the brk. */
3283 #define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
3284
3285 +#ifdef CONFIG_PAX_ASLR
3286 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
3287 +
3288 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
3289 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
3290 +#endif
3291 +
3292 /* This yields a mask that user programs can use to figure out what
3293 instruction set this CPU supports. */
3294
3295 diff -urNp linux-2.6.32.49/arch/s390/include/asm/setup.h linux-2.6.32.49/arch/s390/include/asm/setup.h
3296 --- linux-2.6.32.49/arch/s390/include/asm/setup.h 2011-11-08 19:02:43.000000000 -0500
3297 +++ linux-2.6.32.49/arch/s390/include/asm/setup.h 2011-11-15 19:59:42.000000000 -0500
3298 @@ -50,13 +50,13 @@ extern unsigned long memory_end;
3299 void detect_memory_layout(struct mem_chunk chunk[]);
3300
3301 #ifdef CONFIG_S390_SWITCH_AMODE
3302 -extern unsigned int switch_amode;
3303 +#define switch_amode (1)
3304 #else
3305 #define switch_amode (0)
3306 #endif
3307
3308 #ifdef CONFIG_S390_EXEC_PROTECT
3309 -extern unsigned int s390_noexec;
3310 +#define s390_noexec (1)
3311 #else
3312 #define s390_noexec (0)
3313 #endif
3314 diff -urNp linux-2.6.32.49/arch/s390/include/asm/uaccess.h linux-2.6.32.49/arch/s390/include/asm/uaccess.h
3315 --- linux-2.6.32.49/arch/s390/include/asm/uaccess.h 2011-11-08 19:02:43.000000000 -0500
3316 +++ linux-2.6.32.49/arch/s390/include/asm/uaccess.h 2011-11-15 19:59:42.000000000 -0500
3317 @@ -232,6 +232,10 @@ static inline unsigned long __must_check
3318 copy_to_user(void __user *to, const void *from, unsigned long n)
3319 {
3320 might_fault();
3321 +
3322 + if ((long)n < 0)
3323 + return n;
3324 +
3325 if (access_ok(VERIFY_WRITE, to, n))
3326 n = __copy_to_user(to, from, n);
3327 return n;
3328 @@ -257,6 +261,9 @@ copy_to_user(void __user *to, const void
3329 static inline unsigned long __must_check
3330 __copy_from_user(void *to, const void __user *from, unsigned long n)
3331 {
3332 + if ((long)n < 0)
3333 + return n;
3334 +
3335 if (__builtin_constant_p(n) && (n <= 256))
3336 return uaccess.copy_from_user_small(n, from, to);
3337 else
3338 @@ -283,6 +290,10 @@ static inline unsigned long __must_check
3339 copy_from_user(void *to, const void __user *from, unsigned long n)
3340 {
3341 might_fault();
3342 +
3343 + if ((long)n < 0)
3344 + return n;
3345 +
3346 if (access_ok(VERIFY_READ, from, n))
3347 n = __copy_from_user(to, from, n);
3348 else
3349 diff -urNp linux-2.6.32.49/arch/s390/Kconfig linux-2.6.32.49/arch/s390/Kconfig
3350 --- linux-2.6.32.49/arch/s390/Kconfig 2011-11-08 19:02:43.000000000 -0500
3351 +++ linux-2.6.32.49/arch/s390/Kconfig 2011-11-15 19:59:42.000000000 -0500
3352 @@ -194,28 +194,26 @@ config AUDIT_ARCH
3353
3354 config S390_SWITCH_AMODE
3355 bool "Switch kernel/user addressing modes"
3356 + default y
3357 help
3358 This option allows to switch the addressing modes of kernel and user
3359 - space. The kernel parameter switch_amode=on will enable this feature,
3360 - default is disabled. Enabling this (via kernel parameter) on machines
3361 - earlier than IBM System z9-109 EC/BC will reduce system performance.
3362 + space. Enabling this on machines earlier than IBM System z9-109 EC/BC
3363 + will reduce system performance.
3364
3365 Note that this option will also be selected by selecting the execute
3366 - protection option below. Enabling the execute protection via the
3367 - noexec kernel parameter will also switch the addressing modes,
3368 - independent of the switch_amode kernel parameter.
3369 + protection option below. Enabling the execute protection will also
3370 + switch the addressing modes, independent of this option.
3371
3372
3373 config S390_EXEC_PROTECT
3374 bool "Data execute protection"
3375 + default y
3376 select S390_SWITCH_AMODE
3377 help
3378 This option allows to enable a buffer overflow protection for user
3379 space programs and it also selects the addressing mode option above.
3380 - The kernel parameter noexec=on will enable this feature and also
3381 - switch the addressing modes, default is disabled. Enabling this (via
3382 - kernel parameter) on machines earlier than IBM System z9-109 EC/BC
3383 - will reduce system performance.
3384 + Enabling this on machines earlier than IBM System z9-109 EC/BC will
3385 + reduce system performance.
3386
3387 comment "Code generation options"
3388
3389 diff -urNp linux-2.6.32.49/arch/s390/kernel/module.c linux-2.6.32.49/arch/s390/kernel/module.c
3390 --- linux-2.6.32.49/arch/s390/kernel/module.c 2011-11-08 19:02:43.000000000 -0500
3391 +++ linux-2.6.32.49/arch/s390/kernel/module.c 2011-11-15 19:59:42.000000000 -0500
3392 @@ -166,11 +166,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
3393
3394 /* Increase core size by size of got & plt and set start
3395 offsets for got and plt. */
3396 - me->core_size = ALIGN(me->core_size, 4);
3397 - me->arch.got_offset = me->core_size;
3398 - me->core_size += me->arch.got_size;
3399 - me->arch.plt_offset = me->core_size;
3400 - me->core_size += me->arch.plt_size;
3401 + me->core_size_rw = ALIGN(me->core_size_rw, 4);
3402 + me->arch.got_offset = me->core_size_rw;
3403 + me->core_size_rw += me->arch.got_size;
3404 + me->arch.plt_offset = me->core_size_rx;
3405 + me->core_size_rx += me->arch.plt_size;
3406 return 0;
3407 }
3408
3409 @@ -256,7 +256,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3410 if (info->got_initialized == 0) {
3411 Elf_Addr *gotent;
3412
3413 - gotent = me->module_core + me->arch.got_offset +
3414 + gotent = me->module_core_rw + me->arch.got_offset +
3415 info->got_offset;
3416 *gotent = val;
3417 info->got_initialized = 1;
3418 @@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3419 else if (r_type == R_390_GOTENT ||
3420 r_type == R_390_GOTPLTENT)
3421 *(unsigned int *) loc =
3422 - (val + (Elf_Addr) me->module_core - loc) >> 1;
3423 + (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
3424 else if (r_type == R_390_GOT64 ||
3425 r_type == R_390_GOTPLT64)
3426 *(unsigned long *) loc = val;
3427 @@ -294,7 +294,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3428 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
3429 if (info->plt_initialized == 0) {
3430 unsigned int *ip;
3431 - ip = me->module_core + me->arch.plt_offset +
3432 + ip = me->module_core_rx + me->arch.plt_offset +
3433 info->plt_offset;
3434 #ifndef CONFIG_64BIT
3435 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
3436 @@ -319,7 +319,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3437 val - loc + 0xffffUL < 0x1ffffeUL) ||
3438 (r_type == R_390_PLT32DBL &&
3439 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
3440 - val = (Elf_Addr) me->module_core +
3441 + val = (Elf_Addr) me->module_core_rx +
3442 me->arch.plt_offset +
3443 info->plt_offset;
3444 val += rela->r_addend - loc;
3445 @@ -341,7 +341,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3446 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
3447 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
3448 val = val + rela->r_addend -
3449 - ((Elf_Addr) me->module_core + me->arch.got_offset);
3450 + ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
3451 if (r_type == R_390_GOTOFF16)
3452 *(unsigned short *) loc = val;
3453 else if (r_type == R_390_GOTOFF32)
3454 @@ -351,7 +351,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
3455 break;
3456 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
3457 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
3458 - val = (Elf_Addr) me->module_core + me->arch.got_offset +
3459 + val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
3460 rela->r_addend - loc;
3461 if (r_type == R_390_GOTPC)
3462 *(unsigned int *) loc = val;
3463 diff -urNp linux-2.6.32.49/arch/s390/kernel/setup.c linux-2.6.32.49/arch/s390/kernel/setup.c
3464 --- linux-2.6.32.49/arch/s390/kernel/setup.c 2011-11-08 19:02:43.000000000 -0500
3465 +++ linux-2.6.32.49/arch/s390/kernel/setup.c 2011-11-15 19:59:42.000000000 -0500
3466 @@ -306,9 +306,6 @@ static int __init early_parse_mem(char *
3467 early_param("mem", early_parse_mem);
3468
3469 #ifdef CONFIG_S390_SWITCH_AMODE
3470 -unsigned int switch_amode = 0;
3471 -EXPORT_SYMBOL_GPL(switch_amode);
3472 -
3473 static int set_amode_and_uaccess(unsigned long user_amode,
3474 unsigned long user32_amode)
3475 {
3476 @@ -334,17 +331,6 @@ static int set_amode_and_uaccess(unsigne
3477 return 0;
3478 }
3479 }
3480 -
3481 -/*
3482 - * Switch kernel/user addressing modes?
3483 - */
3484 -static int __init early_parse_switch_amode(char *p)
3485 -{
3486 - switch_amode = 1;
3487 - return 0;
3488 -}
3489 -early_param("switch_amode", early_parse_switch_amode);
3490 -
3491 #else /* CONFIG_S390_SWITCH_AMODE */
3492 static inline int set_amode_and_uaccess(unsigned long user_amode,
3493 unsigned long user32_amode)
3494 @@ -353,24 +339,6 @@ static inline int set_amode_and_uaccess(
3495 }
3496 #endif /* CONFIG_S390_SWITCH_AMODE */
3497
3498 -#ifdef CONFIG_S390_EXEC_PROTECT
3499 -unsigned int s390_noexec = 0;
3500 -EXPORT_SYMBOL_GPL(s390_noexec);
3501 -
3502 -/*
3503 - * Enable execute protection?
3504 - */
3505 -static int __init early_parse_noexec(char *p)
3506 -{
3507 - if (!strncmp(p, "off", 3))
3508 - return 0;
3509 - switch_amode = 1;
3510 - s390_noexec = 1;
3511 - return 0;
3512 -}
3513 -early_param("noexec", early_parse_noexec);
3514 -#endif /* CONFIG_S390_EXEC_PROTECT */
3515 -
3516 static void setup_addressing_mode(void)
3517 {
3518 if (s390_noexec) {
3519 diff -urNp linux-2.6.32.49/arch/s390/mm/mmap.c linux-2.6.32.49/arch/s390/mm/mmap.c
3520 --- linux-2.6.32.49/arch/s390/mm/mmap.c 2011-11-08 19:02:43.000000000 -0500
3521 +++ linux-2.6.32.49/arch/s390/mm/mmap.c 2011-11-15 19:59:42.000000000 -0500
3522 @@ -78,10 +78,22 @@ void arch_pick_mmap_layout(struct mm_str
3523 */
3524 if (mmap_is_legacy()) {
3525 mm->mmap_base = TASK_UNMAPPED_BASE;
3526 +
3527 +#ifdef CONFIG_PAX_RANDMMAP
3528 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3529 + mm->mmap_base += mm->delta_mmap;
3530 +#endif
3531 +
3532 mm->get_unmapped_area = arch_get_unmapped_area;
3533 mm->unmap_area = arch_unmap_area;
3534 } else {
3535 mm->mmap_base = mmap_base();
3536 +
3537 +#ifdef CONFIG_PAX_RANDMMAP
3538 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3539 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3540 +#endif
3541 +
3542 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
3543 mm->unmap_area = arch_unmap_area_topdown;
3544 }
3545 @@ -153,10 +165,22 @@ void arch_pick_mmap_layout(struct mm_str
3546 */
3547 if (mmap_is_legacy()) {
3548 mm->mmap_base = TASK_UNMAPPED_BASE;
3549 +
3550 +#ifdef CONFIG_PAX_RANDMMAP
3551 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3552 + mm->mmap_base += mm->delta_mmap;
3553 +#endif
3554 +
3555 mm->get_unmapped_area = s390_get_unmapped_area;
3556 mm->unmap_area = arch_unmap_area;
3557 } else {
3558 mm->mmap_base = mmap_base();
3559 +
3560 +#ifdef CONFIG_PAX_RANDMMAP
3561 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3562 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3563 +#endif
3564 +
3565 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
3566 mm->unmap_area = arch_unmap_area_topdown;
3567 }
3568 diff -urNp linux-2.6.32.49/arch/score/include/asm/system.h linux-2.6.32.49/arch/score/include/asm/system.h
3569 --- linux-2.6.32.49/arch/score/include/asm/system.h 2011-11-08 19:02:43.000000000 -0500
3570 +++ linux-2.6.32.49/arch/score/include/asm/system.h 2011-11-15 19:59:42.000000000 -0500
3571 @@ -17,7 +17,7 @@ do { \
3572 #define finish_arch_switch(prev) do {} while (0)
3573
3574 typedef void (*vi_handler_t)(void);
3575 -extern unsigned long arch_align_stack(unsigned long sp);
3576 +#define arch_align_stack(x) (x)
3577
3578 #define mb() barrier()
3579 #define rmb() barrier()
3580 diff -urNp linux-2.6.32.49/arch/score/kernel/process.c linux-2.6.32.49/arch/score/kernel/process.c
3581 --- linux-2.6.32.49/arch/score/kernel/process.c 2011-11-08 19:02:43.000000000 -0500
3582 +++ linux-2.6.32.49/arch/score/kernel/process.c 2011-11-15 19:59:42.000000000 -0500
3583 @@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_stru
3584
3585 return task_pt_regs(task)->cp0_epc;
3586 }
3587 -
3588 -unsigned long arch_align_stack(unsigned long sp)
3589 -{
3590 - return sp;
3591 -}
3592 diff -urNp linux-2.6.32.49/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.32.49/arch/sh/boards/mach-hp6xx/pm.c
3593 --- linux-2.6.32.49/arch/sh/boards/mach-hp6xx/pm.c 2011-11-08 19:02:43.000000000 -0500
3594 +++ linux-2.6.32.49/arch/sh/boards/mach-hp6xx/pm.c 2011-11-15 19:59:42.000000000 -0500
3595 @@ -143,7 +143,7 @@ static int hp6x0_pm_enter(suspend_state_
3596 return 0;
3597 }
3598
3599 -static struct platform_suspend_ops hp6x0_pm_ops = {
3600 +static const struct platform_suspend_ops hp6x0_pm_ops = {
3601 .enter = hp6x0_pm_enter,
3602 .valid = suspend_valid_only_mem,
3603 };
3604 diff -urNp linux-2.6.32.49/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.32.49/arch/sh/kernel/cpu/sh4/sq.c
3605 --- linux-2.6.32.49/arch/sh/kernel/cpu/sh4/sq.c 2011-11-08 19:02:43.000000000 -0500
3606 +++ linux-2.6.32.49/arch/sh/kernel/cpu/sh4/sq.c 2011-11-15 19:59:42.000000000 -0500
3607 @@ -327,7 +327,7 @@ static struct attribute *sq_sysfs_attrs[
3608 NULL,
3609 };
3610
3611 -static struct sysfs_ops sq_sysfs_ops = {
3612 +static const struct sysfs_ops sq_sysfs_ops = {
3613 .show = sq_sysfs_show,
3614 .store = sq_sysfs_store,
3615 };
3616 diff -urNp linux-2.6.32.49/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.32.49/arch/sh/kernel/cpu/shmobile/pm.c
3617 --- linux-2.6.32.49/arch/sh/kernel/cpu/shmobile/pm.c 2011-11-08 19:02:43.000000000 -0500
3618 +++ linux-2.6.32.49/arch/sh/kernel/cpu/shmobile/pm.c 2011-11-15 19:59:42.000000000 -0500
3619 @@ -58,7 +58,7 @@ static int sh_pm_enter(suspend_state_t s
3620 return 0;
3621 }
3622
3623 -static struct platform_suspend_ops sh_pm_ops = {
3624 +static const struct platform_suspend_ops sh_pm_ops = {
3625 .enter = sh_pm_enter,
3626 .valid = suspend_valid_only_mem,
3627 };
3628 diff -urNp linux-2.6.32.49/arch/sh/kernel/kgdb.c linux-2.6.32.49/arch/sh/kernel/kgdb.c
3629 --- linux-2.6.32.49/arch/sh/kernel/kgdb.c 2011-11-08 19:02:43.000000000 -0500
3630 +++ linux-2.6.32.49/arch/sh/kernel/kgdb.c 2011-11-15 19:59:42.000000000 -0500
3631 @@ -271,7 +271,7 @@ void kgdb_arch_exit(void)
3632 {
3633 }
3634
3635 -struct kgdb_arch arch_kgdb_ops = {
3636 +const struct kgdb_arch arch_kgdb_ops = {
3637 /* Breakpoint instruction: trapa #0x3c */
3638 #ifdef CONFIG_CPU_LITTLE_ENDIAN
3639 .gdb_bpt_instr = { 0x3c, 0xc3 },
3640 diff -urNp linux-2.6.32.49/arch/sh/mm/mmap.c linux-2.6.32.49/arch/sh/mm/mmap.c
3641 --- linux-2.6.32.49/arch/sh/mm/mmap.c 2011-11-08 19:02:43.000000000 -0500
3642 +++ linux-2.6.32.49/arch/sh/mm/mmap.c 2011-11-15 19:59:42.000000000 -0500
3643 @@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(str
3644 addr = PAGE_ALIGN(addr);
3645
3646 vma = find_vma(mm, addr);
3647 - if (TASK_SIZE - len >= addr &&
3648 - (!vma || addr + len <= vma->vm_start))
3649 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
3650 return addr;
3651 }
3652
3653 @@ -106,7 +105,7 @@ full_search:
3654 }
3655 return -ENOMEM;
3656 }
3657 - if (likely(!vma || addr + len <= vma->vm_start)) {
3658 + if (likely(check_heap_stack_gap(vma, addr, len))) {
3659 /*
3660 * Remember the place where we stopped the search:
3661 */
3662 @@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct fi
3663 addr = PAGE_ALIGN(addr);
3664
3665 vma = find_vma(mm, addr);
3666 - if (TASK_SIZE - len >= addr &&
3667 - (!vma || addr + len <= vma->vm_start))
3668 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
3669 return addr;
3670 }
3671
3672 @@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct fi
3673 /* make sure it can fit in the remaining address space */
3674 if (likely(addr > len)) {
3675 vma = find_vma(mm, addr-len);
3676 - if (!vma || addr <= vma->vm_start) {
3677 + if (check_heap_stack_gap(vma, addr - len, len)) {
3678 /* remember the address as a hint for next time */
3679 return (mm->free_area_cache = addr-len);
3680 }
3681 @@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct fi
3682 if (unlikely(mm->mmap_base < len))
3683 goto bottomup;
3684
3685 - addr = mm->mmap_base-len;
3686 - if (do_colour_align)
3687 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3688 + addr = mm->mmap_base - len;
3689
3690 do {
3691 + if (do_colour_align)
3692 + addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3693 /*
3694 * Lookup failure means no vma is above this address,
3695 * else if new region fits below vma->vm_start,
3696 * return with success:
3697 */
3698 vma = find_vma(mm, addr);
3699 - if (likely(!vma || addr+len <= vma->vm_start)) {
3700 + if (likely(check_heap_stack_gap(vma, addr, len))) {
3701 /* remember the address as a hint for next time */
3702 return (mm->free_area_cache = addr);
3703 }
3704 @@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct fi
3705 mm->cached_hole_size = vma->vm_start - addr;
3706
3707 /* try just below the current vma->vm_start */
3708 - addr = vma->vm_start-len;
3709 - if (do_colour_align)
3710 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3711 - } while (likely(len < vma->vm_start));
3712 + addr = skip_heap_stack_gap(vma, len);
3713 + } while (!IS_ERR_VALUE(addr));
3714
3715 bottomup:
3716 /*
3717 diff -urNp linux-2.6.32.49/arch/sparc/include/asm/atomic_64.h linux-2.6.32.49/arch/sparc/include/asm/atomic_64.h
3718 --- linux-2.6.32.49/arch/sparc/include/asm/atomic_64.h 2011-11-08 19:02:43.000000000 -0500
3719 +++ linux-2.6.32.49/arch/sparc/include/asm/atomic_64.h 2011-11-15 19:59:42.000000000 -0500
3720 @@ -14,18 +14,40 @@
3721 #define ATOMIC64_INIT(i) { (i) }
3722
3723 #define atomic_read(v) ((v)->counter)
3724 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
3725 +{
3726 + return v->counter;
3727 +}
3728 #define atomic64_read(v) ((v)->counter)
3729 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
3730 +{
3731 + return v->counter;
3732 +}
3733
3734 #define atomic_set(v, i) (((v)->counter) = i)
3735 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
3736 +{
3737 + v->counter = i;
3738 +}
3739 #define atomic64_set(v, i) (((v)->counter) = i)
3740 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
3741 +{
3742 + v->counter = i;
3743 +}
3744
3745 extern void atomic_add(int, atomic_t *);
3746 +extern void atomic_add_unchecked(int, atomic_unchecked_t *);
3747 extern void atomic64_add(long, atomic64_t *);
3748 +extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
3749 extern void atomic_sub(int, atomic_t *);
3750 +extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
3751 extern void atomic64_sub(long, atomic64_t *);
3752 +extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
3753
3754 extern int atomic_add_ret(int, atomic_t *);
3755 +extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
3756 extern long atomic64_add_ret(long, atomic64_t *);
3757 +extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
3758 extern int atomic_sub_ret(int, atomic_t *);
3759 extern long atomic64_sub_ret(long, atomic64_t *);
3760
3761 @@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomi
3762 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
3763
3764 #define atomic_inc_return(v) atomic_add_ret(1, v)
3765 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
3766 +{
3767 + return atomic_add_ret_unchecked(1, v);
3768 +}
3769 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
3770 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
3771 +{
3772 + return atomic64_add_ret_unchecked(1, v);
3773 +}
3774
3775 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
3776 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
3777
3778 #define atomic_add_return(i, v) atomic_add_ret(i, v)
3779 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
3780 +{
3781 + return atomic_add_ret_unchecked(i, v);
3782 +}
3783 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
3784 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
3785 +{
3786 + return atomic64_add_ret_unchecked(i, v);
3787 +}
3788
3789 /*
3790 * atomic_inc_and_test - increment and test
3791 @@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomi
3792 * other cases.
3793 */
3794 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
3795 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
3796 +{
3797 + return atomic_inc_return_unchecked(v) == 0;
3798 +}
3799 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
3800
3801 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
3802 @@ -59,30 +101,65 @@ extern long atomic64_sub_ret(long, atomi
3803 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
3804
3805 #define atomic_inc(v) atomic_add(1, v)
3806 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
3807 +{
3808 + atomic_add_unchecked(1, v);
3809 +}
3810 #define atomic64_inc(v) atomic64_add(1, v)
3811 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
3812 +{
3813 + atomic64_add_unchecked(1, v);
3814 +}
3815
3816 #define atomic_dec(v) atomic_sub(1, v)
3817 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
3818 +{
3819 + atomic_sub_unchecked(1, v);
3820 +}
3821 #define atomic64_dec(v) atomic64_sub(1, v)
3822 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
3823 +{
3824 + atomic64_sub_unchecked(1, v);
3825 +}
3826
3827 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
3828 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
3829
3830 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
3831 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
3832 +{
3833 + return cmpxchg(&v->counter, old, new);
3834 +}
3835 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
3836 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
3837 +{
3838 + return xchg(&v->counter, new);
3839 +}
3840
3841 static inline int atomic_add_unless(atomic_t *v, int a, int u)
3842 {
3843 - int c, old;
3844 + int c, old, new;
3845 c = atomic_read(v);
3846 for (;;) {
3847 - if (unlikely(c == (u)))
3848 + if (unlikely(c == u))
3849 break;
3850 - old = atomic_cmpxchg((v), c, c + (a));
3851 +
3852 + asm volatile("addcc %2, %0, %0\n"
3853 +
3854 +#ifdef CONFIG_PAX_REFCOUNT
3855 + "tvs %%icc, 6\n"
3856 +#endif
3857 +
3858 + : "=r" (new)
3859 + : "0" (c), "ir" (a)
3860 + : "cc");
3861 +
3862 + old = atomic_cmpxchg(v, c, new);
3863 if (likely(old == c))
3864 break;
3865 c = old;
3866 }
3867 - return c != (u);
3868 + return c != u;
3869 }
3870
3871 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
3872 @@ -90,20 +167,35 @@ static inline int atomic_add_unless(atom
3873 #define atomic64_cmpxchg(v, o, n) \
3874 ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
3875 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
3876 +static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
3877 +{
3878 + return xchg(&v->counter, new);
3879 +}
3880
3881 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
3882 {
3883 - long c, old;
3884 + long c, old, new;
3885 c = atomic64_read(v);
3886 for (;;) {
3887 - if (unlikely(c == (u)))
3888 + if (unlikely(c == u))
3889 break;
3890 - old = atomic64_cmpxchg((v), c, c + (a));
3891 +
3892 + asm volatile("addcc %2, %0, %0\n"
3893 +
3894 +#ifdef CONFIG_PAX_REFCOUNT
3895 + "tvs %%xcc, 6\n"
3896 +#endif
3897 +
3898 + : "=r" (new)
3899 + : "0" (c), "ir" (a)
3900 + : "cc");
3901 +
3902 + old = atomic64_cmpxchg(v, c, new);
3903 if (likely(old == c))
3904 break;
3905 c = old;
3906 }
3907 - return c != (u);
3908 + return c != u;
3909 }
3910
3911 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
3912 diff -urNp linux-2.6.32.49/arch/sparc/include/asm/cache.h linux-2.6.32.49/arch/sparc/include/asm/cache.h
3913 --- linux-2.6.32.49/arch/sparc/include/asm/cache.h 2011-11-08 19:02:43.000000000 -0500
3914 +++ linux-2.6.32.49/arch/sparc/include/asm/cache.h 2011-11-15 19:59:42.000000000 -0500
3915 @@ -8,7 +8,7 @@
3916 #define _SPARC_CACHE_H
3917
3918 #define L1_CACHE_SHIFT 5
3919 -#define L1_CACHE_BYTES 32
3920 +#define L1_CACHE_BYTES 32UL
3921 #define L1_CACHE_ALIGN(x) ((((x)+(L1_CACHE_BYTES-1))&~(L1_CACHE_BYTES-1)))
3922
3923 #ifdef CONFIG_SPARC32
3924 diff -urNp linux-2.6.32.49/arch/sparc/include/asm/dma-mapping.h linux-2.6.32.49/arch/sparc/include/asm/dma-mapping.h
3925 --- linux-2.6.32.49/arch/sparc/include/asm/dma-mapping.h 2011-11-08 19:02:43.000000000 -0500
3926 +++ linux-2.6.32.49/arch/sparc/include/asm/dma-mapping.h 2011-11-15 19:59:42.000000000 -0500
3927 @@ -14,10 +14,10 @@ extern int dma_set_mask(struct device *d
3928 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
3929 #define dma_is_consistent(d, h) (1)
3930
3931 -extern struct dma_map_ops *dma_ops, pci32_dma_ops;
3932 +extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
3933 extern struct bus_type pci_bus_type;
3934
3935 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
3936 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
3937 {
3938 #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
3939 if (dev->bus == &pci_bus_type)
3940 @@ -31,7 +31,7 @@ static inline struct dma_map_ops *get_dm
3941 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
3942 dma_addr_t *dma_handle, gfp_t flag)
3943 {
3944 - struct dma_map_ops *ops = get_dma_ops(dev);
3945 + const struct dma_map_ops *ops = get_dma_ops(dev);
3946 void *cpu_addr;
3947
3948 cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
3949 @@ -42,7 +42,7 @@ static inline void *dma_alloc_coherent(s
3950 static inline void dma_free_coherent(struct device *dev, size_t size,
3951 void *cpu_addr, dma_addr_t dma_handle)
3952 {
3953 - struct dma_map_ops *ops = get_dma_ops(dev);
3954 + const struct dma_map_ops *ops = get_dma_ops(dev);
3955
3956 debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
3957 ops->free_coherent(dev, size, cpu_addr, dma_handle);
3958 diff -urNp linux-2.6.32.49/arch/sparc/include/asm/elf_32.h linux-2.6.32.49/arch/sparc/include/asm/elf_32.h
3959 --- linux-2.6.32.49/arch/sparc/include/asm/elf_32.h 2011-11-08 19:02:43.000000000 -0500
3960 +++ linux-2.6.32.49/arch/sparc/include/asm/elf_32.h 2011-11-15 19:59:42.000000000 -0500
3961 @@ -116,6 +116,13 @@ typedef struct {
3962
3963 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
3964
3965 +#ifdef CONFIG_PAX_ASLR
3966 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
3967 +
3968 +#define PAX_DELTA_MMAP_LEN 16
3969 +#define PAX_DELTA_STACK_LEN 16
3970 +#endif
3971 +
3972 /* This yields a mask that user programs can use to figure out what
3973 instruction set this cpu supports. This can NOT be done in userspace
3974 on Sparc. */
3975 diff -urNp linux-2.6.32.49/arch/sparc/include/asm/elf_64.h linux-2.6.32.49/arch/sparc/include/asm/elf_64.h
3976 --- linux-2.6.32.49/arch/sparc/include/asm/elf_64.h 2011-11-08 19:02:43.000000000 -0500
3977 +++ linux-2.6.32.49/arch/sparc/include/asm/elf_64.h 2011-11-15 19:59:42.000000000 -0500
3978 @@ -163,6 +163,12 @@ typedef struct {
3979 #define ELF_ET_DYN_BASE 0x0000010000000000UL
3980 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
3981
3982 +#ifdef CONFIG_PAX_ASLR
3983 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
3984 +
3985 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
3986 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
3987 +#endif
3988
3989 /* This yields a mask that user programs can use to figure out what
3990 instruction set this cpu supports. */
3991 diff -urNp linux-2.6.32.49/arch/sparc/include/asm/pgtable_32.h linux-2.6.32.49/arch/sparc/include/asm/pgtable_32.h
3992 --- linux-2.6.32.49/arch/sparc/include/asm/pgtable_32.h 2011-11-08 19:02:43.000000000 -0500
3993 +++ linux-2.6.32.49/arch/sparc/include/asm/pgtable_32.h 2011-11-15 19:59:42.000000000 -0500
3994 @@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
3995 BTFIXUPDEF_INT(page_none)
3996 BTFIXUPDEF_INT(page_copy)
3997 BTFIXUPDEF_INT(page_readonly)
3998 +
3999 +#ifdef CONFIG_PAX_PAGEEXEC
4000 +BTFIXUPDEF_INT(page_shared_noexec)
4001 +BTFIXUPDEF_INT(page_copy_noexec)
4002 +BTFIXUPDEF_INT(page_readonly_noexec)
4003 +#endif
4004 +
4005 BTFIXUPDEF_INT(page_kernel)
4006
4007 #define PMD_SHIFT SUN4C_PMD_SHIFT
4008 @@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
4009 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
4010 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
4011
4012 +#ifdef CONFIG_PAX_PAGEEXEC
4013 +extern pgprot_t PAGE_SHARED_NOEXEC;
4014 +# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
4015 +# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
4016 +#else
4017 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
4018 +# define PAGE_COPY_NOEXEC PAGE_COPY
4019 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
4020 +#endif
4021 +
4022 extern unsigned long page_kernel;
4023
4024 #ifdef MODULE
4025 diff -urNp linux-2.6.32.49/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.32.49/arch/sparc/include/asm/pgtsrmmu.h
4026 --- linux-2.6.32.49/arch/sparc/include/asm/pgtsrmmu.h 2011-11-08 19:02:43.000000000 -0500
4027 +++ linux-2.6.32.49/arch/sparc/include/asm/pgtsrmmu.h 2011-11-15 19:59:42.000000000 -0500
4028 @@ -115,6 +115,13 @@
4029 SRMMU_EXEC | SRMMU_REF)
4030 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
4031 SRMMU_EXEC | SRMMU_REF)
4032 +
4033 +#ifdef CONFIG_PAX_PAGEEXEC
4034 +#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
4035 +#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
4036 +#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
4037 +#endif
4038 +
4039 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
4040 SRMMU_DIRTY | SRMMU_REF)
4041
4042 diff -urNp linux-2.6.32.49/arch/sparc/include/asm/spinlock_64.h linux-2.6.32.49/arch/sparc/include/asm/spinlock_64.h
4043 --- linux-2.6.32.49/arch/sparc/include/asm/spinlock_64.h 2011-11-08 19:02:43.000000000 -0500
4044 +++ linux-2.6.32.49/arch/sparc/include/asm/spinlock_64.h 2011-11-15 19:59:42.000000000 -0500
4045 @@ -92,14 +92,19 @@ static inline void __raw_spin_lock_flags
4046
4047 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
4048
4049 -static void inline arch_read_lock(raw_rwlock_t *lock)
4050 +static inline void arch_read_lock(raw_rwlock_t *lock)
4051 {
4052 unsigned long tmp1, tmp2;
4053
4054 __asm__ __volatile__ (
4055 "1: ldsw [%2], %0\n"
4056 " brlz,pn %0, 2f\n"
4057 -"4: add %0, 1, %1\n"
4058 +"4: addcc %0, 1, %1\n"
4059 +
4060 +#ifdef CONFIG_PAX_REFCOUNT
4061 +" tvs %%icc, 6\n"
4062 +#endif
4063 +
4064 " cas [%2], %0, %1\n"
4065 " cmp %0, %1\n"
4066 " bne,pn %%icc, 1b\n"
4067 @@ -112,10 +117,10 @@ static void inline arch_read_lock(raw_rw
4068 " .previous"
4069 : "=&r" (tmp1), "=&r" (tmp2)
4070 : "r" (lock)
4071 - : "memory");
4072 + : "memory", "cc");
4073 }
4074
4075 -static int inline arch_read_trylock(raw_rwlock_t *lock)
4076 +static inline int arch_read_trylock(raw_rwlock_t *lock)
4077 {
4078 int tmp1, tmp2;
4079
4080 @@ -123,7 +128,12 @@ static int inline arch_read_trylock(raw_
4081 "1: ldsw [%2], %0\n"
4082 " brlz,a,pn %0, 2f\n"
4083 " mov 0, %0\n"
4084 -" add %0, 1, %1\n"
4085 +" addcc %0, 1, %1\n"
4086 +
4087 +#ifdef CONFIG_PAX_REFCOUNT
4088 +" tvs %%icc, 6\n"
4089 +#endif
4090 +
4091 " cas [%2], %0, %1\n"
4092 " cmp %0, %1\n"
4093 " bne,pn %%icc, 1b\n"
4094 @@ -136,13 +146,18 @@ static int inline arch_read_trylock(raw_
4095 return tmp1;
4096 }
4097
4098 -static void inline arch_read_unlock(raw_rwlock_t *lock)
4099 +static inline void arch_read_unlock(raw_rwlock_t *lock)
4100 {
4101 unsigned long tmp1, tmp2;
4102
4103 __asm__ __volatile__(
4104 "1: lduw [%2], %0\n"
4105 -" sub %0, 1, %1\n"
4106 +" subcc %0, 1, %1\n"
4107 +
4108 +#ifdef CONFIG_PAX_REFCOUNT
4109 +" tvs %%icc, 6\n"
4110 +#endif
4111 +
4112 " cas [%2], %0, %1\n"
4113 " cmp %0, %1\n"
4114 " bne,pn %%xcc, 1b\n"
4115 @@ -152,7 +167,7 @@ static void inline arch_read_unlock(raw_
4116 : "memory");
4117 }
4118
4119 -static void inline arch_write_lock(raw_rwlock_t *lock)
4120 +static inline void arch_write_lock(raw_rwlock_t *lock)
4121 {
4122 unsigned long mask, tmp1, tmp2;
4123
4124 @@ -177,7 +192,7 @@ static void inline arch_write_lock(raw_r
4125 : "memory");
4126 }
4127
4128 -static void inline arch_write_unlock(raw_rwlock_t *lock)
4129 +static inline void arch_write_unlock(raw_rwlock_t *lock)
4130 {
4131 __asm__ __volatile__(
4132 " stw %%g0, [%0]"
4133 @@ -186,7 +201,7 @@ static void inline arch_write_unlock(raw
4134 : "memory");
4135 }
4136
4137 -static int inline arch_write_trylock(raw_rwlock_t *lock)
4138 +static inline int arch_write_trylock(raw_rwlock_t *lock)
4139 {
4140 unsigned long mask, tmp1, tmp2, result;
4141
4142 diff -urNp linux-2.6.32.49/arch/sparc/include/asm/thread_info_32.h linux-2.6.32.49/arch/sparc/include/asm/thread_info_32.h
4143 --- linux-2.6.32.49/arch/sparc/include/asm/thread_info_32.h 2011-11-08 19:02:43.000000000 -0500
4144 +++ linux-2.6.32.49/arch/sparc/include/asm/thread_info_32.h 2011-11-15 19:59:42.000000000 -0500
4145 @@ -50,6 +50,8 @@ struct thread_info {
4146 unsigned long w_saved;
4147
4148 struct restart_block restart_block;
4149 +
4150 + unsigned long lowest_stack;
4151 };
4152
4153 /*
4154 diff -urNp linux-2.6.32.49/arch/sparc/include/asm/thread_info_64.h linux-2.6.32.49/arch/sparc/include/asm/thread_info_64.h
4155 --- linux-2.6.32.49/arch/sparc/include/asm/thread_info_64.h 2011-11-08 19:02:43.000000000 -0500
4156 +++ linux-2.6.32.49/arch/sparc/include/asm/thread_info_64.h 2011-11-15 19:59:42.000000000 -0500
4157 @@ -68,6 +68,8 @@ struct thread_info {
4158 struct pt_regs *kern_una_regs;
4159 unsigned int kern_una_insn;
4160
4161 + unsigned long lowest_stack;
4162 +
4163 unsigned long fpregs[0] __attribute__ ((aligned(64)));
4164 };
4165
4166 diff -urNp linux-2.6.32.49/arch/sparc/include/asm/uaccess_32.h linux-2.6.32.49/arch/sparc/include/asm/uaccess_32.h
4167 --- linux-2.6.32.49/arch/sparc/include/asm/uaccess_32.h 2011-11-08 19:02:43.000000000 -0500
4168 +++ linux-2.6.32.49/arch/sparc/include/asm/uaccess_32.h 2011-11-15 19:59:42.000000000 -0500
4169 @@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
4170
4171 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
4172 {
4173 - if (n && __access_ok((unsigned long) to, n))
4174 + if ((long)n < 0)
4175 + return n;
4176 +
4177 + if (n && __access_ok((unsigned long) to, n)) {
4178 + if (!__builtin_constant_p(n))
4179 + check_object_size(from, n, true);
4180 return __copy_user(to, (__force void __user *) from, n);
4181 - else
4182 + } else
4183 return n;
4184 }
4185
4186 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
4187 {
4188 + if ((long)n < 0)
4189 + return n;
4190 +
4191 + if (!__builtin_constant_p(n))
4192 + check_object_size(from, n, true);
4193 +
4194 return __copy_user(to, (__force void __user *) from, n);
4195 }
4196
4197 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
4198 {
4199 - if (n && __access_ok((unsigned long) from, n))
4200 + if ((long)n < 0)
4201 + return n;
4202 +
4203 + if (n && __access_ok((unsigned long) from, n)) {
4204 + if (!__builtin_constant_p(n))
4205 + check_object_size(to, n, false);
4206 return __copy_user((__force void __user *) to, from, n);
4207 - else
4208 + } else
4209 return n;
4210 }
4211
4212 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
4213 {
4214 + if ((long)n < 0)
4215 + return n;
4216 +
4217 return __copy_user((__force void __user *) to, from, n);
4218 }
4219
4220 diff -urNp linux-2.6.32.49/arch/sparc/include/asm/uaccess_64.h linux-2.6.32.49/arch/sparc/include/asm/uaccess_64.h
4221 --- linux-2.6.32.49/arch/sparc/include/asm/uaccess_64.h 2011-11-08 19:02:43.000000000 -0500
4222 +++ linux-2.6.32.49/arch/sparc/include/asm/uaccess_64.h 2011-11-15 19:59:42.000000000 -0500
4223 @@ -9,6 +9,7 @@
4224 #include <linux/compiler.h>
4225 #include <linux/string.h>
4226 #include <linux/thread_info.h>
4227 +#include <linux/kernel.h>
4228 #include <asm/asi.h>
4229 #include <asm/system.h>
4230 #include <asm/spitfire.h>
4231 @@ -212,8 +213,15 @@ extern unsigned long copy_from_user_fixu
4232 static inline unsigned long __must_check
4233 copy_from_user(void *to, const void __user *from, unsigned long size)
4234 {
4235 - unsigned long ret = ___copy_from_user(to, from, size);
4236 + unsigned long ret;
4237
4238 + if ((long)size < 0 || size > INT_MAX)
4239 + return size;
4240 +
4241 + if (!__builtin_constant_p(size))
4242 + check_object_size(to, size, false);
4243 +
4244 + ret = ___copy_from_user(to, from, size);
4245 if (unlikely(ret))
4246 ret = copy_from_user_fixup(to, from, size);
4247 return ret;
4248 @@ -228,8 +236,15 @@ extern unsigned long copy_to_user_fixup(
4249 static inline unsigned long __must_check
4250 copy_to_user(void __user *to, const void *from, unsigned long size)
4251 {
4252 - unsigned long ret = ___copy_to_user(to, from, size);
4253 + unsigned long ret;
4254 +
4255 + if ((long)size < 0 || size > INT_MAX)
4256 + return size;
4257 +
4258 + if (!__builtin_constant_p(size))
4259 + check_object_size(from, size, true);
4260
4261 + ret = ___copy_to_user(to, from, size);
4262 if (unlikely(ret))
4263 ret = copy_to_user_fixup(to, from, size);
4264 return ret;
4265 diff -urNp linux-2.6.32.49/arch/sparc/include/asm/uaccess.h linux-2.6.32.49/arch/sparc/include/asm/uaccess.h
4266 --- linux-2.6.32.49/arch/sparc/include/asm/uaccess.h 2011-11-08 19:02:43.000000000 -0500
4267 +++ linux-2.6.32.49/arch/sparc/include/asm/uaccess.h 2011-11-15 19:59:42.000000000 -0500
4268 @@ -1,5 +1,13 @@
4269 #ifndef ___ASM_SPARC_UACCESS_H
4270 #define ___ASM_SPARC_UACCESS_H
4271 +
4272 +#ifdef __KERNEL__
4273 +#ifndef __ASSEMBLY__
4274 +#include <linux/types.h>
4275 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
4276 +#endif
4277 +#endif
4278 +
4279 #if defined(__sparc__) && defined(__arch64__)
4280 #include <asm/uaccess_64.h>
4281 #else
4282 diff -urNp linux-2.6.32.49/arch/sparc/kernel/iommu.c linux-2.6.32.49/arch/sparc/kernel/iommu.c
4283 --- linux-2.6.32.49/arch/sparc/kernel/iommu.c 2011-11-08 19:02:43.000000000 -0500
4284 +++ linux-2.6.32.49/arch/sparc/kernel/iommu.c 2011-11-15 19:59:42.000000000 -0500
4285 @@ -826,7 +826,7 @@ static void dma_4u_sync_sg_for_cpu(struc
4286 spin_unlock_irqrestore(&iommu->lock, flags);
4287 }
4288
4289 -static struct dma_map_ops sun4u_dma_ops = {
4290 +static const struct dma_map_ops sun4u_dma_ops = {
4291 .alloc_coherent = dma_4u_alloc_coherent,
4292 .free_coherent = dma_4u_free_coherent,
4293 .map_page = dma_4u_map_page,
4294 @@ -837,7 +837,7 @@ static struct dma_map_ops sun4u_dma_ops
4295 .sync_sg_for_cpu = dma_4u_sync_sg_for_cpu,
4296 };
4297
4298 -struct dma_map_ops *dma_ops = &sun4u_dma_ops;
4299 +const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
4300 EXPORT_SYMBOL(dma_ops);
4301
4302 extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
4303 diff -urNp linux-2.6.32.49/arch/sparc/kernel/ioport.c linux-2.6.32.49/arch/sparc/kernel/ioport.c
4304 --- linux-2.6.32.49/arch/sparc/kernel/ioport.c 2011-11-08 19:02:43.000000000 -0500
4305 +++ linux-2.6.32.49/arch/sparc/kernel/ioport.c 2011-11-15 19:59:42.000000000 -0500
4306 @@ -392,7 +392,7 @@ static void sbus_sync_sg_for_device(stru
4307 BUG();
4308 }
4309
4310 -struct dma_map_ops sbus_dma_ops = {
4311 +const struct dma_map_ops sbus_dma_ops = {
4312 .alloc_coherent = sbus_alloc_coherent,
4313 .free_coherent = sbus_free_coherent,
4314 .map_page = sbus_map_page,
4315 @@ -403,7 +403,7 @@ struct dma_map_ops sbus_dma_ops = {
4316 .sync_sg_for_device = sbus_sync_sg_for_device,
4317 };
4318
4319 -struct dma_map_ops *dma_ops = &sbus_dma_ops;
4320 +const struct dma_map_ops *dma_ops = &sbus_dma_ops;
4321 EXPORT_SYMBOL(dma_ops);
4322
4323 static int __init sparc_register_ioport(void)
4324 @@ -640,7 +640,7 @@ static void pci32_sync_sg_for_device(str
4325 }
4326 }
4327
4328 -struct dma_map_ops pci32_dma_ops = {
4329 +const struct dma_map_ops pci32_dma_ops = {
4330 .alloc_coherent = pci32_alloc_coherent,
4331 .free_coherent = pci32_free_coherent,
4332 .map_page = pci32_map_page,
4333 diff -urNp linux-2.6.32.49/arch/sparc/kernel/kgdb_32.c linux-2.6.32.49/arch/sparc/kernel/kgdb_32.c
4334 --- linux-2.6.32.49/arch/sparc/kernel/kgdb_32.c 2011-11-08 19:02:43.000000000 -0500
4335 +++ linux-2.6.32.49/arch/sparc/kernel/kgdb_32.c 2011-11-15 19:59:42.000000000 -0500
4336 @@ -158,7 +158,7 @@ void kgdb_arch_exit(void)
4337 {
4338 }
4339
4340 -struct kgdb_arch arch_kgdb_ops = {
4341 +const struct kgdb_arch arch_kgdb_ops = {
4342 /* Breakpoint instruction: ta 0x7d */
4343 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x7d },
4344 };
4345 diff -urNp linux-2.6.32.49/arch/sparc/kernel/kgdb_64.c linux-2.6.32.49/arch/sparc/kernel/kgdb_64.c
4346 --- linux-2.6.32.49/arch/sparc/kernel/kgdb_64.c 2011-11-08 19:02:43.000000000 -0500
4347 +++ linux-2.6.32.49/arch/sparc/kernel/kgdb_64.c 2011-11-15 19:59:42.000000000 -0500
4348 @@ -180,7 +180,7 @@ void kgdb_arch_exit(void)
4349 {
4350 }
4351
4352 -struct kgdb_arch arch_kgdb_ops = {
4353 +const struct kgdb_arch arch_kgdb_ops = {
4354 /* Breakpoint instruction: ta 0x72 */
4355 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x72 },
4356 };
4357 diff -urNp linux-2.6.32.49/arch/sparc/kernel/Makefile linux-2.6.32.49/arch/sparc/kernel/Makefile
4358 --- linux-2.6.32.49/arch/sparc/kernel/Makefile 2011-11-08 19:02:43.000000000 -0500
4359 +++ linux-2.6.32.49/arch/sparc/kernel/Makefile 2011-11-15 19:59:42.000000000 -0500
4360 @@ -3,7 +3,7 @@
4361 #
4362
4363 asflags-y := -ansi
4364 -ccflags-y := -Werror
4365 +#ccflags-y := -Werror
4366
4367 extra-y := head_$(BITS).o
4368 extra-y += init_task.o
4369 diff -urNp linux-2.6.32.49/arch/sparc/kernel/pci_sun4v.c linux-2.6.32.49/arch/sparc/kernel/pci_sun4v.c
4370 --- linux-2.6.32.49/arch/sparc/kernel/pci_sun4v.c 2011-11-08 19:02:43.000000000 -0500
4371 +++ linux-2.6.32.49/arch/sparc/kernel/pci_sun4v.c 2011-11-15 19:59:42.000000000 -0500
4372 @@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
4373 spin_unlock_irqrestore(&iommu->lock, flags);
4374 }
4375
4376 -static struct dma_map_ops sun4v_dma_ops = {
4377 +static const struct dma_map_ops sun4v_dma_ops = {
4378 .alloc_coherent = dma_4v_alloc_coherent,
4379 .free_coherent = dma_4v_free_coherent,
4380 .map_page = dma_4v_map_page,
4381 diff -urNp linux-2.6.32.49/arch/sparc/kernel/process_32.c linux-2.6.32.49/arch/sparc/kernel/process_32.c
4382 --- linux-2.6.32.49/arch/sparc/kernel/process_32.c 2011-11-08 19:02:43.000000000 -0500
4383 +++ linux-2.6.32.49/arch/sparc/kernel/process_32.c 2011-11-15 19:59:42.000000000 -0500
4384 @@ -196,7 +196,7 @@ void __show_backtrace(unsigned long fp)
4385 rw->ins[4], rw->ins[5],
4386 rw->ins[6],
4387 rw->ins[7]);
4388 - printk("%pS\n", (void *) rw->ins[7]);
4389 + printk("%pA\n", (void *) rw->ins[7]);
4390 rw = (struct reg_window32 *) rw->ins[6];
4391 }
4392 spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
4393 @@ -263,14 +263,14 @@ void show_regs(struct pt_regs *r)
4394
4395 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
4396 r->psr, r->pc, r->npc, r->y, print_tainted());
4397 - printk("PC: <%pS>\n", (void *) r->pc);
4398 + printk("PC: <%pA>\n", (void *) r->pc);
4399 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
4400 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
4401 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
4402 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
4403 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
4404 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
4405 - printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
4406 + printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
4407
4408 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
4409 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
4410 @@ -305,7 +305,7 @@ void show_stack(struct task_struct *tsk,
4411 rw = (struct reg_window32 *) fp;
4412 pc = rw->ins[7];
4413 printk("[%08lx : ", pc);
4414 - printk("%pS ] ", (void *) pc);
4415 + printk("%pA ] ", (void *) pc);
4416 fp = rw->ins[6];
4417 } while (++count < 16);
4418 printk("\n");
4419 diff -urNp linux-2.6.32.49/arch/sparc/kernel/process_64.c linux-2.6.32.49/arch/sparc/kernel/process_64.c
4420 --- linux-2.6.32.49/arch/sparc/kernel/process_64.c 2011-11-08 19:02:43.000000000 -0500
4421 +++ linux-2.6.32.49/arch/sparc/kernel/process_64.c 2011-11-15 19:59:42.000000000 -0500
4422 @@ -180,14 +180,14 @@ static void show_regwindow(struct pt_reg
4423 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
4424 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
4425 if (regs->tstate & TSTATE_PRIV)
4426 - printk("I7: <%pS>\n", (void *) rwk->ins[7]);
4427 + printk("I7: <%pA>\n", (void *) rwk->ins[7]);
4428 }
4429
4430 void show_regs(struct pt_regs *regs)
4431 {
4432 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
4433 regs->tpc, regs->tnpc, regs->y, print_tainted());
4434 - printk("TPC: <%pS>\n", (void *) regs->tpc);
4435 + printk("TPC: <%pA>\n", (void *) regs->tpc);
4436 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
4437 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
4438 regs->u_regs[3]);
4439 @@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
4440 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
4441 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
4442 regs->u_regs[15]);
4443 - printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
4444 + printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
4445 show_regwindow(regs);
4446 }
4447
4448 @@ -284,7 +284,7 @@ void arch_trigger_all_cpu_backtrace(void
4449 ((tp && tp->task) ? tp->task->pid : -1));
4450
4451 if (gp->tstate & TSTATE_PRIV) {
4452 - printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
4453 + printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
4454 (void *) gp->tpc,
4455 (void *) gp->o7,
4456 (void *) gp->i7,
4457 diff -urNp linux-2.6.32.49/arch/sparc/kernel/sys_sparc_32.c linux-2.6.32.49/arch/sparc/kernel/sys_sparc_32.c
4458 --- linux-2.6.32.49/arch/sparc/kernel/sys_sparc_32.c 2011-11-08 19:02:43.000000000 -0500
4459 +++ linux-2.6.32.49/arch/sparc/kernel/sys_sparc_32.c 2011-11-15 19:59:42.000000000 -0500
4460 @@ -57,7 +57,7 @@ unsigned long arch_get_unmapped_area(str
4461 if (ARCH_SUN4C && len > 0x20000000)
4462 return -ENOMEM;
4463 if (!addr)
4464 - addr = TASK_UNMAPPED_BASE;
4465 + addr = current->mm->mmap_base;
4466
4467 if (flags & MAP_SHARED)
4468 addr = COLOUR_ALIGN(addr);
4469 @@ -72,7 +72,7 @@ unsigned long arch_get_unmapped_area(str
4470 }
4471 if (TASK_SIZE - PAGE_SIZE - len < addr)
4472 return -ENOMEM;
4473 - if (!vmm || addr + len <= vmm->vm_start)
4474 + if (check_heap_stack_gap(vmm, addr, len))
4475 return addr;
4476 addr = vmm->vm_end;
4477 if (flags & MAP_SHARED)
4478 diff -urNp linux-2.6.32.49/arch/sparc/kernel/sys_sparc_64.c linux-2.6.32.49/arch/sparc/kernel/sys_sparc_64.c
4479 --- linux-2.6.32.49/arch/sparc/kernel/sys_sparc_64.c 2011-11-08 19:02:43.000000000 -0500
4480 +++ linux-2.6.32.49/arch/sparc/kernel/sys_sparc_64.c 2011-11-15 19:59:42.000000000 -0500
4481 @@ -125,7 +125,7 @@ unsigned long arch_get_unmapped_area(str
4482 /* We do not accept a shared mapping if it would violate
4483 * cache aliasing constraints.
4484 */
4485 - if ((flags & MAP_SHARED) &&
4486 + if ((filp || (flags & MAP_SHARED)) &&
4487 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
4488 return -EINVAL;
4489 return addr;
4490 @@ -140,6 +140,10 @@ unsigned long arch_get_unmapped_area(str
4491 if (filp || (flags & MAP_SHARED))
4492 do_color_align = 1;
4493
4494 +#ifdef CONFIG_PAX_RANDMMAP
4495 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
4496 +#endif
4497 +
4498 if (addr) {
4499 if (do_color_align)
4500 addr = COLOUR_ALIGN(addr, pgoff);
4501 @@ -147,15 +151,14 @@ unsigned long arch_get_unmapped_area(str
4502 addr = PAGE_ALIGN(addr);
4503
4504 vma = find_vma(mm, addr);
4505 - if (task_size - len >= addr &&
4506 - (!vma || addr + len <= vma->vm_start))
4507 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
4508 return addr;
4509 }
4510
4511 if (len > mm->cached_hole_size) {
4512 - start_addr = addr = mm->free_area_cache;
4513 + start_addr = addr = mm->free_area_cache;
4514 } else {
4515 - start_addr = addr = TASK_UNMAPPED_BASE;
4516 + start_addr = addr = mm->mmap_base;
4517 mm->cached_hole_size = 0;
4518 }
4519
4520 @@ -175,14 +178,14 @@ full_search:
4521 vma = find_vma(mm, VA_EXCLUDE_END);
4522 }
4523 if (unlikely(task_size < addr)) {
4524 - if (start_addr != TASK_UNMAPPED_BASE) {
4525 - start_addr = addr = TASK_UNMAPPED_BASE;
4526 + if (start_addr != mm->mmap_base) {
4527 + start_addr = addr = mm->mmap_base;
4528 mm->cached_hole_size = 0;
4529 goto full_search;
4530 }
4531 return -ENOMEM;
4532 }
4533 - if (likely(!vma || addr + len <= vma->vm_start)) {
4534 + if (likely(check_heap_stack_gap(vma, addr, len))) {
4535 /*
4536 * Remember the place where we stopped the search:
4537 */
4538 @@ -216,7 +219,7 @@ arch_get_unmapped_area_topdown(struct fi
4539 /* We do not accept a shared mapping if it would violate
4540 * cache aliasing constraints.
4541 */
4542 - if ((flags & MAP_SHARED) &&
4543 + if ((filp || (flags & MAP_SHARED)) &&
4544 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
4545 return -EINVAL;
4546 return addr;
4547 @@ -237,8 +240,7 @@ arch_get_unmapped_area_topdown(struct fi
4548 addr = PAGE_ALIGN(addr);
4549
4550 vma = find_vma(mm, addr);
4551 - if (task_size - len >= addr &&
4552 - (!vma || addr + len <= vma->vm_start))
4553 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
4554 return addr;
4555 }
4556
4557 @@ -259,7 +261,7 @@ arch_get_unmapped_area_topdown(struct fi
4558 /* make sure it can fit in the remaining address space */
4559 if (likely(addr > len)) {
4560 vma = find_vma(mm, addr-len);
4561 - if (!vma || addr <= vma->vm_start) {
4562 + if (check_heap_stack_gap(vma, addr - len, len)) {
4563 /* remember the address as a hint for next time */
4564 return (mm->free_area_cache = addr-len);
4565 }
4566 @@ -268,18 +270,18 @@ arch_get_unmapped_area_topdown(struct fi
4567 if (unlikely(mm->mmap_base < len))
4568 goto bottomup;
4569
4570 - addr = mm->mmap_base-len;
4571 - if (do_color_align)
4572 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4573 + addr = mm->mmap_base - len;
4574
4575 do {
4576 + if (do_color_align)
4577 + addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4578 /*
4579 * Lookup failure means no vma is above this address,
4580 * else if new region fits below vma->vm_start,
4581 * return with success:
4582 */
4583 vma = find_vma(mm, addr);
4584 - if (likely(!vma || addr+len <= vma->vm_start)) {
4585 + if (likely(check_heap_stack_gap(vma, addr, len))) {
4586 /* remember the address as a hint for next time */
4587 return (mm->free_area_cache = addr);
4588 }
4589 @@ -289,10 +291,8 @@ arch_get_unmapped_area_topdown(struct fi
4590 mm->cached_hole_size = vma->vm_start - addr;
4591
4592 /* try just below the current vma->vm_start */
4593 - addr = vma->vm_start-len;
4594 - if (do_color_align)
4595 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
4596 - } while (likely(len < vma->vm_start));
4597 + addr = skip_heap_stack_gap(vma, len);
4598 + } while (!IS_ERR_VALUE(addr));
4599
4600 bottomup:
4601 /*
4602 @@ -384,6 +384,12 @@ void arch_pick_mmap_layout(struct mm_str
4603 current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY ||
4604 sysctl_legacy_va_layout) {
4605 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
4606 +
4607 +#ifdef CONFIG_PAX_RANDMMAP
4608 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4609 + mm->mmap_base += mm->delta_mmap;
4610 +#endif
4611 +
4612 mm->get_unmapped_area = arch_get_unmapped_area;
4613 mm->unmap_area = arch_unmap_area;
4614 } else {
4615 @@ -398,6 +404,12 @@ void arch_pick_mmap_layout(struct mm_str
4616 gap = (task_size / 6 * 5);
4617
4618 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
4619 +
4620 +#ifdef CONFIG_PAX_RANDMMAP
4621 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4622 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4623 +#endif
4624 +
4625 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4626 mm->unmap_area = arch_unmap_area_topdown;
4627 }
4628 diff -urNp linux-2.6.32.49/arch/sparc/kernel/traps_32.c linux-2.6.32.49/arch/sparc/kernel/traps_32.c
4629 --- linux-2.6.32.49/arch/sparc/kernel/traps_32.c 2011-11-08 19:02:43.000000000 -0500
4630 +++ linux-2.6.32.49/arch/sparc/kernel/traps_32.c 2011-11-15 19:59:42.000000000 -0500
4631 @@ -44,6 +44,8 @@ static void instruction_dump(unsigned lo
4632 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
4633 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
4634
4635 +extern void gr_handle_kernel_exploit(void);
4636 +
4637 void die_if_kernel(char *str, struct pt_regs *regs)
4638 {
4639 static int die_counter;
4640 @@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_
4641 count++ < 30 &&
4642 (((unsigned long) rw) >= PAGE_OFFSET) &&
4643 !(((unsigned long) rw) & 0x7)) {
4644 - printk("Caller[%08lx]: %pS\n", rw->ins[7],
4645 + printk("Caller[%08lx]: %pA\n", rw->ins[7],
4646 (void *) rw->ins[7]);
4647 rw = (struct reg_window32 *)rw->ins[6];
4648 }
4649 }
4650 printk("Instruction DUMP:");
4651 instruction_dump ((unsigned long *) regs->pc);
4652 - if(regs->psr & PSR_PS)
4653 + if(regs->psr & PSR_PS) {
4654 + gr_handle_kernel_exploit();
4655 do_exit(SIGKILL);
4656 + }
4657 do_exit(SIGSEGV);
4658 }
4659
4660 diff -urNp linux-2.6.32.49/arch/sparc/kernel/traps_64.c linux-2.6.32.49/arch/sparc/kernel/traps_64.c
4661 --- linux-2.6.32.49/arch/sparc/kernel/traps_64.c 2011-11-08 19:02:43.000000000 -0500
4662 +++ linux-2.6.32.49/arch/sparc/kernel/traps_64.c 2011-11-15 19:59:42.000000000 -0500
4663 @@ -73,7 +73,7 @@ static void dump_tl1_traplog(struct tl1_
4664 i + 1,
4665 p->trapstack[i].tstate, p->trapstack[i].tpc,
4666 p->trapstack[i].tnpc, p->trapstack[i].tt);
4667 - printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
4668 + printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
4669 }
4670 }
4671
4672 @@ -93,6 +93,12 @@ void bad_trap(struct pt_regs *regs, long
4673
4674 lvl -= 0x100;
4675 if (regs->tstate & TSTATE_PRIV) {
4676 +
4677 +#ifdef CONFIG_PAX_REFCOUNT
4678 + if (lvl == 6)
4679 + pax_report_refcount_overflow(regs);
4680 +#endif
4681 +
4682 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
4683 die_if_kernel(buffer, regs);
4684 }
4685 @@ -111,11 +117,16 @@ void bad_trap(struct pt_regs *regs, long
4686 void bad_trap_tl1(struct pt_regs *regs, long lvl)
4687 {
4688 char buffer[32];
4689 -
4690 +
4691 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
4692 0, lvl, SIGTRAP) == NOTIFY_STOP)
4693 return;
4694
4695 +#ifdef CONFIG_PAX_REFCOUNT
4696 + if (lvl == 6)
4697 + pax_report_refcount_overflow(regs);
4698 +#endif
4699 +
4700 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
4701
4702 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
4703 @@ -1139,7 +1150,7 @@ static void cheetah_log_errors(struct pt
4704 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
4705 printk("%s" "ERROR(%d): ",
4706 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
4707 - printk("TPC<%pS>\n", (void *) regs->tpc);
4708 + printk("TPC<%pA>\n", (void *) regs->tpc);
4709 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
4710 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
4711 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
4712 @@ -1746,7 +1757,7 @@ void cheetah_plus_parity_error(int type,
4713 smp_processor_id(),
4714 (type & 0x1) ? 'I' : 'D',
4715 regs->tpc);
4716 - printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
4717 + printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
4718 panic("Irrecoverable Cheetah+ parity error.");
4719 }
4720
4721 @@ -1754,7 +1765,7 @@ void cheetah_plus_parity_error(int type,
4722 smp_processor_id(),
4723 (type & 0x1) ? 'I' : 'D',
4724 regs->tpc);
4725 - printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
4726 + printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
4727 }
4728
4729 struct sun4v_error_entry {
4730 @@ -1961,9 +1972,9 @@ void sun4v_itlb_error_report(struct pt_r
4731
4732 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
4733 regs->tpc, tl);
4734 - printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
4735 + printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
4736 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
4737 - printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
4738 + printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
4739 (void *) regs->u_regs[UREG_I7]);
4740 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
4741 "pte[%lx] error[%lx]\n",
4742 @@ -1985,9 +1996,9 @@ void sun4v_dtlb_error_report(struct pt_r
4743
4744 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
4745 regs->tpc, tl);
4746 - printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
4747 + printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
4748 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
4749 - printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
4750 + printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
4751 (void *) regs->u_regs[UREG_I7]);
4752 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
4753 "pte[%lx] error[%lx]\n",
4754 @@ -2191,7 +2202,7 @@ void show_stack(struct task_struct *tsk,
4755 fp = (unsigned long)sf->fp + STACK_BIAS;
4756 }
4757
4758 - printk(" [%016lx] %pS\n", pc, (void *) pc);
4759 + printk(" [%016lx] %pA\n", pc, (void *) pc);
4760 } while (++count < 16);
4761 }
4762
4763 @@ -2233,6 +2244,8 @@ static inline struct reg_window *kernel_
4764 return (struct reg_window *) (fp + STACK_BIAS);
4765 }
4766
4767 +extern void gr_handle_kernel_exploit(void);
4768 +
4769 void die_if_kernel(char *str, struct pt_regs *regs)
4770 {
4771 static int die_counter;
4772 @@ -2260,7 +2273,7 @@ void die_if_kernel(char *str, struct pt_
4773 while (rw &&
4774 count++ < 30&&
4775 is_kernel_stack(current, rw)) {
4776 - printk("Caller[%016lx]: %pS\n", rw->ins[7],
4777 + printk("Caller[%016lx]: %pA\n", rw->ins[7],
4778 (void *) rw->ins[7]);
4779
4780 rw = kernel_stack_up(rw);
4781 @@ -2273,8 +2286,11 @@ void die_if_kernel(char *str, struct pt_
4782 }
4783 user_instruction_dump ((unsigned int __user *) regs->tpc);
4784 }
4785 - if (regs->tstate & TSTATE_PRIV)
4786 + if (regs->tstate & TSTATE_PRIV) {
4787 + gr_handle_kernel_exploit();
4788 do_exit(SIGKILL);
4789 + }
4790 +
4791 do_exit(SIGSEGV);
4792 }
4793 EXPORT_SYMBOL(die_if_kernel);
4794 diff -urNp linux-2.6.32.49/arch/sparc/kernel/una_asm_64.S linux-2.6.32.49/arch/sparc/kernel/una_asm_64.S
4795 --- linux-2.6.32.49/arch/sparc/kernel/una_asm_64.S 2011-11-08 19:02:43.000000000 -0500
4796 +++ linux-2.6.32.49/arch/sparc/kernel/una_asm_64.S 2011-11-15 19:59:42.000000000 -0500
4797 @@ -127,7 +127,7 @@ do_int_load:
4798 wr %o5, 0x0, %asi
4799 retl
4800 mov 0, %o0
4801 - .size __do_int_load, .-__do_int_load
4802 + .size do_int_load, .-do_int_load
4803
4804 .section __ex_table,"a"
4805 .word 4b, __retl_efault
4806 diff -urNp linux-2.6.32.49/arch/sparc/kernel/unaligned_64.c linux-2.6.32.49/arch/sparc/kernel/unaligned_64.c
4807 --- linux-2.6.32.49/arch/sparc/kernel/unaligned_64.c 2011-11-08 19:02:43.000000000 -0500
4808 +++ linux-2.6.32.49/arch/sparc/kernel/unaligned_64.c 2011-11-15 19:59:42.000000000 -0500
4809 @@ -288,7 +288,7 @@ static void log_unaligned(struct pt_regs
4810 if (count < 5) {
4811 last_time = jiffies;
4812 count++;
4813 - printk("Kernel unaligned access at TPC[%lx] %pS\n",
4814 + printk("Kernel unaligned access at TPC[%lx] %pA\n",
4815 regs->tpc, (void *) regs->tpc);
4816 }
4817 }
4818 diff -urNp linux-2.6.32.49/arch/sparc/lib/atomic_64.S linux-2.6.32.49/arch/sparc/lib/atomic_64.S
4819 --- linux-2.6.32.49/arch/sparc/lib/atomic_64.S 2011-11-08 19:02:43.000000000 -0500
4820 +++ linux-2.6.32.49/arch/sparc/lib/atomic_64.S 2011-11-15 19:59:42.000000000 -0500
4821 @@ -18,7 +18,12 @@
4822 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
4823 BACKOFF_SETUP(%o2)
4824 1: lduw [%o1], %g1
4825 - add %g1, %o0, %g7
4826 + addcc %g1, %o0, %g7
4827 +
4828 +#ifdef CONFIG_PAX_REFCOUNT
4829 + tvs %icc, 6
4830 +#endif
4831 +
4832 cas [%o1], %g1, %g7
4833 cmp %g1, %g7
4834 bne,pn %icc, 2f
4835 @@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
4836 2: BACKOFF_SPIN(%o2, %o3, 1b)
4837 .size atomic_add, .-atomic_add
4838
4839 + .globl atomic_add_unchecked
4840 + .type atomic_add_unchecked,#function
4841 +atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4842 + BACKOFF_SETUP(%o2)
4843 +1: lduw [%o1], %g1
4844 + add %g1, %o0, %g7
4845 + cas [%o1], %g1, %g7
4846 + cmp %g1, %g7
4847 + bne,pn %icc, 2f
4848 + nop
4849 + retl
4850 + nop
4851 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4852 + .size atomic_add_unchecked, .-atomic_add_unchecked
4853 +
4854 .globl atomic_sub
4855 .type atomic_sub,#function
4856 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4857 BACKOFF_SETUP(%o2)
4858 1: lduw [%o1], %g1
4859 - sub %g1, %o0, %g7
4860 + subcc %g1, %o0, %g7
4861 +
4862 +#ifdef CONFIG_PAX_REFCOUNT
4863 + tvs %icc, 6
4864 +#endif
4865 +
4866 cas [%o1], %g1, %g7
4867 cmp %g1, %g7
4868 bne,pn %icc, 2f
4869 @@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
4870 2: BACKOFF_SPIN(%o2, %o3, 1b)
4871 .size atomic_sub, .-atomic_sub
4872
4873 + .globl atomic_sub_unchecked
4874 + .type atomic_sub_unchecked,#function
4875 +atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
4876 + BACKOFF_SETUP(%o2)
4877 +1: lduw [%o1], %g1
4878 + sub %g1, %o0, %g7
4879 + cas [%o1], %g1, %g7
4880 + cmp %g1, %g7
4881 + bne,pn %icc, 2f
4882 + nop
4883 + retl
4884 + nop
4885 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4886 + .size atomic_sub_unchecked, .-atomic_sub_unchecked
4887 +
4888 .globl atomic_add_ret
4889 .type atomic_add_ret,#function
4890 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
4891 BACKOFF_SETUP(%o2)
4892 1: lduw [%o1], %g1
4893 - add %g1, %o0, %g7
4894 + addcc %g1, %o0, %g7
4895 +
4896 +#ifdef CONFIG_PAX_REFCOUNT
4897 + tvs %icc, 6
4898 +#endif
4899 +
4900 cas [%o1], %g1, %g7
4901 cmp %g1, %g7
4902 bne,pn %icc, 2f
4903 @@ -59,12 +104,33 @@ atomic_add_ret: /* %o0 = increment, %o1
4904 2: BACKOFF_SPIN(%o2, %o3, 1b)
4905 .size atomic_add_ret, .-atomic_add_ret
4906
4907 + .globl atomic_add_ret_unchecked
4908 + .type atomic_add_ret_unchecked,#function
4909 +atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4910 + BACKOFF_SETUP(%o2)
4911 +1: lduw [%o1], %g1
4912 + addcc %g1, %o0, %g7
4913 + cas [%o1], %g1, %g7
4914 + cmp %g1, %g7
4915 + bne,pn %icc, 2f
4916 + add %g7, %o0, %g7
4917 + sra %g7, 0, %o0
4918 + retl
4919 + nop
4920 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4921 + .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
4922 +
4923 .globl atomic_sub_ret
4924 .type atomic_sub_ret,#function
4925 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4926 BACKOFF_SETUP(%o2)
4927 1: lduw [%o1], %g1
4928 - sub %g1, %o0, %g7
4929 + subcc %g1, %o0, %g7
4930 +
4931 +#ifdef CONFIG_PAX_REFCOUNT
4932 + tvs %icc, 6
4933 +#endif
4934 +
4935 cas [%o1], %g1, %g7
4936 cmp %g1, %g7
4937 bne,pn %icc, 2f
4938 @@ -80,7 +146,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1
4939 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
4940 BACKOFF_SETUP(%o2)
4941 1: ldx [%o1], %g1
4942 - add %g1, %o0, %g7
4943 + addcc %g1, %o0, %g7
4944 +
4945 +#ifdef CONFIG_PAX_REFCOUNT
4946 + tvs %xcc, 6
4947 +#endif
4948 +
4949 casx [%o1], %g1, %g7
4950 cmp %g1, %g7
4951 bne,pn %xcc, 2f
4952 @@ -90,12 +161,32 @@ atomic64_add: /* %o0 = increment, %o1 =
4953 2: BACKOFF_SPIN(%o2, %o3, 1b)
4954 .size atomic64_add, .-atomic64_add
4955
4956 + .globl atomic64_add_unchecked
4957 + .type atomic64_add_unchecked,#function
4958 +atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4959 + BACKOFF_SETUP(%o2)
4960 +1: ldx [%o1], %g1
4961 + addcc %g1, %o0, %g7
4962 + casx [%o1], %g1, %g7
4963 + cmp %g1, %g7
4964 + bne,pn %xcc, 2f
4965 + nop
4966 + retl
4967 + nop
4968 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4969 + .size atomic64_add_unchecked, .-atomic64_add_unchecked
4970 +
4971 .globl atomic64_sub
4972 .type atomic64_sub,#function
4973 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
4974 BACKOFF_SETUP(%o2)
4975 1: ldx [%o1], %g1
4976 - sub %g1, %o0, %g7
4977 + subcc %g1, %o0, %g7
4978 +
4979 +#ifdef CONFIG_PAX_REFCOUNT
4980 + tvs %xcc, 6
4981 +#endif
4982 +
4983 casx [%o1], %g1, %g7
4984 cmp %g1, %g7
4985 bne,pn %xcc, 2f
4986 @@ -105,12 +196,32 @@ atomic64_sub: /* %o0 = decrement, %o1 =
4987 2: BACKOFF_SPIN(%o2, %o3, 1b)
4988 .size atomic64_sub, .-atomic64_sub
4989
4990 + .globl atomic64_sub_unchecked
4991 + .type atomic64_sub_unchecked,#function
4992 +atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
4993 + BACKOFF_SETUP(%o2)
4994 +1: ldx [%o1], %g1
4995 + subcc %g1, %o0, %g7
4996 + casx [%o1], %g1, %g7
4997 + cmp %g1, %g7
4998 + bne,pn %xcc, 2f
4999 + nop
5000 + retl
5001 + nop
5002 +2: BACKOFF_SPIN(%o2, %o3, 1b)
5003 + .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
5004 +
5005 .globl atomic64_add_ret
5006 .type atomic64_add_ret,#function
5007 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
5008 BACKOFF_SETUP(%o2)
5009 1: ldx [%o1], %g1
5010 - add %g1, %o0, %g7
5011 + addcc %g1, %o0, %g7
5012 +
5013 +#ifdef CONFIG_PAX_REFCOUNT
5014 + tvs %xcc, 6
5015 +#endif
5016 +
5017 casx [%o1], %g1, %g7
5018 cmp %g1, %g7
5019 bne,pn %xcc, 2f
5020 @@ -121,12 +232,33 @@ atomic64_add_ret: /* %o0 = increment, %o
5021 2: BACKOFF_SPIN(%o2, %o3, 1b)
5022 .size atomic64_add_ret, .-atomic64_add_ret
5023
5024 + .globl atomic64_add_ret_unchecked
5025 + .type atomic64_add_ret_unchecked,#function
5026 +atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
5027 + BACKOFF_SETUP(%o2)
5028 +1: ldx [%o1], %g1
5029 + addcc %g1, %o0, %g7
5030 + casx [%o1], %g1, %g7
5031 + cmp %g1, %g7
5032 + bne,pn %xcc, 2f
5033 + add %g7, %o0, %g7
5034 + mov %g7, %o0
5035 + retl
5036 + nop
5037 +2: BACKOFF_SPIN(%o2, %o3, 1b)
5038 + .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
5039 +
5040 .globl atomic64_sub_ret
5041 .type atomic64_sub_ret,#function
5042 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
5043 BACKOFF_SETUP(%o2)
5044 1: ldx [%o1], %g1
5045 - sub %g1, %o0, %g7
5046 + subcc %g1, %o0, %g7
5047 +
5048 +#ifdef CONFIG_PAX_REFCOUNT
5049 + tvs %xcc, 6
5050 +#endif
5051 +
5052 casx [%o1], %g1, %g7
5053 cmp %g1, %g7
5054 bne,pn %xcc, 2f
5055 diff -urNp linux-2.6.32.49/arch/sparc/lib/ksyms.c linux-2.6.32.49/arch/sparc/lib/ksyms.c
5056 --- linux-2.6.32.49/arch/sparc/lib/ksyms.c 2011-11-08 19:02:43.000000000 -0500
5057 +++ linux-2.6.32.49/arch/sparc/lib/ksyms.c 2011-11-15 19:59:42.000000000 -0500
5058 @@ -144,12 +144,18 @@ EXPORT_SYMBOL(__downgrade_write);
5059
5060 /* Atomic counter implementation. */
5061 EXPORT_SYMBOL(atomic_add);
5062 +EXPORT_SYMBOL(atomic_add_unchecked);
5063 EXPORT_SYMBOL(atomic_add_ret);
5064 +EXPORT_SYMBOL(atomic_add_ret_unchecked);
5065 EXPORT_SYMBOL(atomic_sub);
5066 +EXPORT_SYMBOL(atomic_sub_unchecked);
5067 EXPORT_SYMBOL(atomic_sub_ret);
5068 EXPORT_SYMBOL(atomic64_add);
5069 +EXPORT_SYMBOL(atomic64_add_unchecked);
5070 EXPORT_SYMBOL(atomic64_add_ret);
5071 +EXPORT_SYMBOL(atomic64_add_ret_unchecked);
5072 EXPORT_SYMBOL(atomic64_sub);
5073 +EXPORT_SYMBOL(atomic64_sub_unchecked);
5074 EXPORT_SYMBOL(atomic64_sub_ret);
5075
5076 /* Atomic bit operations. */
5077 diff -urNp linux-2.6.32.49/arch/sparc/lib/Makefile linux-2.6.32.49/arch/sparc/lib/Makefile
5078 --- linux-2.6.32.49/arch/sparc/lib/Makefile 2011-11-08 19:02:43.000000000 -0500
5079 +++ linux-2.6.32.49/arch/sparc/lib/Makefile 2011-11-15 19:59:42.000000000 -0500
5080 @@ -2,7 +2,7 @@
5081 #
5082
5083 asflags-y := -ansi -DST_DIV0=0x02
5084 -ccflags-y := -Werror
5085 +#ccflags-y := -Werror
5086
5087 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
5088 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
5089 diff -urNp linux-2.6.32.49/arch/sparc/lib/rwsem_64.S linux-2.6.32.49/arch/sparc/lib/rwsem_64.S
5090 --- linux-2.6.32.49/arch/sparc/lib/rwsem_64.S 2011-11-08 19:02:43.000000000 -0500
5091 +++ linux-2.6.32.49/arch/sparc/lib/rwsem_64.S 2011-11-15 19:59:42.000000000 -0500
5092 @@ -11,7 +11,12 @@
5093 .globl __down_read
5094 __down_read:
5095 1: lduw [%o0], %g1
5096 - add %g1, 1, %g7
5097 + addcc %g1, 1, %g7
5098 +
5099 +#ifdef CONFIG_PAX_REFCOUNT
5100 + tvs %icc, 6
5101 +#endif
5102 +
5103 cas [%o0], %g1, %g7
5104 cmp %g1, %g7
5105 bne,pn %icc, 1b
5106 @@ -33,7 +38,12 @@ __down_read:
5107 .globl __down_read_trylock
5108 __down_read_trylock:
5109 1: lduw [%o0], %g1
5110 - add %g1, 1, %g7
5111 + addcc %g1, 1, %g7
5112 +
5113 +#ifdef CONFIG_PAX_REFCOUNT
5114 + tvs %icc, 6
5115 +#endif
5116 +
5117 cmp %g7, 0
5118 bl,pn %icc, 2f
5119 mov 0, %o1
5120 @@ -51,7 +61,12 @@ __down_write:
5121 or %g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
5122 1:
5123 lduw [%o0], %g3
5124 - add %g3, %g1, %g7
5125 + addcc %g3, %g1, %g7
5126 +
5127 +#ifdef CONFIG_PAX_REFCOUNT
5128 + tvs %icc, 6
5129 +#endif
5130 +
5131 cas [%o0], %g3, %g7
5132 cmp %g3, %g7
5133 bne,pn %icc, 1b
5134 @@ -77,7 +92,12 @@ __down_write_trylock:
5135 cmp %g3, 0
5136 bne,pn %icc, 2f
5137 mov 0, %o1
5138 - add %g3, %g1, %g7
5139 + addcc %g3, %g1, %g7
5140 +
5141 +#ifdef CONFIG_PAX_REFCOUNT
5142 + tvs %icc, 6
5143 +#endif
5144 +
5145 cas [%o0], %g3, %g7
5146 cmp %g3, %g7
5147 bne,pn %icc, 1b
5148 @@ -90,7 +110,12 @@ __down_write_trylock:
5149 __up_read:
5150 1:
5151 lduw [%o0], %g1
5152 - sub %g1, 1, %g7
5153 + subcc %g1, 1, %g7
5154 +
5155 +#ifdef CONFIG_PAX_REFCOUNT
5156 + tvs %icc, 6
5157 +#endif
5158 +
5159 cas [%o0], %g1, %g7
5160 cmp %g1, %g7
5161 bne,pn %icc, 1b
5162 @@ -118,7 +143,12 @@ __up_write:
5163 or %g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
5164 1:
5165 lduw [%o0], %g3
5166 - sub %g3, %g1, %g7
5167 + subcc %g3, %g1, %g7
5168 +
5169 +#ifdef CONFIG_PAX_REFCOUNT
5170 + tvs %icc, 6
5171 +#endif
5172 +
5173 cas [%o0], %g3, %g7
5174 cmp %g3, %g7
5175 bne,pn %icc, 1b
5176 @@ -143,7 +173,12 @@ __downgrade_write:
5177 or %g1, %lo(RWSEM_WAITING_BIAS), %g1
5178 1:
5179 lduw [%o0], %g3
5180 - sub %g3, %g1, %g7
5181 + subcc %g3, %g1, %g7
5182 +
5183 +#ifdef CONFIG_PAX_REFCOUNT
5184 + tvs %icc, 6
5185 +#endif
5186 +
5187 cas [%o0], %g3, %g7
5188 cmp %g3, %g7
5189 bne,pn %icc, 1b
5190 diff -urNp linux-2.6.32.49/arch/sparc/Makefile linux-2.6.32.49/arch/sparc/Makefile
5191 --- linux-2.6.32.49/arch/sparc/Makefile 2011-11-08 19:02:43.000000000 -0500
5192 +++ linux-2.6.32.49/arch/sparc/Makefile 2011-11-15 19:59:42.000000000 -0500
5193 @@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc
5194 # Export what is needed by arch/sparc/boot/Makefile
5195 export VMLINUX_INIT VMLINUX_MAIN
5196 VMLINUX_INIT := $(head-y) $(init-y)
5197 -VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
5198 +VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
5199 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
5200 VMLINUX_MAIN += $(drivers-y) $(net-y)
5201
5202 diff -urNp linux-2.6.32.49/arch/sparc/mm/fault_32.c linux-2.6.32.49/arch/sparc/mm/fault_32.c
5203 --- linux-2.6.32.49/arch/sparc/mm/fault_32.c 2011-11-08 19:02:43.000000000 -0500
5204 +++ linux-2.6.32.49/arch/sparc/mm/fault_32.c 2011-11-18 18:01:52.000000000 -0500
5205 @@ -21,6 +21,9 @@
5206 #include <linux/interrupt.h>
5207 #include <linux/module.h>
5208 #include <linux/kdebug.h>
5209 +#include <linux/slab.h>
5210 +#include <linux/pagemap.h>
5211 +#include <linux/compiler.h>
5212
5213 #include <asm/system.h>
5214 #include <asm/page.h>
5215 @@ -167,6 +170,267 @@ static unsigned long compute_si_addr(str
5216 return safe_compute_effective_address(regs, insn);
5217 }
5218
5219 +#ifdef CONFIG_PAX_PAGEEXEC
5220 +#ifdef CONFIG_PAX_DLRESOLVE
5221 +static void pax_emuplt_close(struct vm_area_struct *vma)
5222 +{
5223 + vma->vm_mm->call_dl_resolve = 0UL;
5224 +}
5225 +
5226 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
5227 +{
5228 + unsigned int *kaddr;
5229 +
5230 + vmf->page = alloc_page(GFP_HIGHUSER);
5231 + if (!vmf->page)
5232 + return VM_FAULT_OOM;
5233 +
5234 + kaddr = kmap(vmf->page);
5235 + memset(kaddr, 0, PAGE_SIZE);
5236 + kaddr[0] = 0x9DE3BFA8U; /* save */
5237 + flush_dcache_page(vmf->page);
5238 + kunmap(vmf->page);
5239 + return VM_FAULT_MAJOR;
5240 +}
5241 +
5242 +static const struct vm_operations_struct pax_vm_ops = {
5243 + .close = pax_emuplt_close,
5244 + .fault = pax_emuplt_fault
5245 +};
5246 +
5247 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
5248 +{
5249 + int ret;
5250 +
5251 + vma->vm_mm = current->mm;
5252 + vma->vm_start = addr;
5253 + vma->vm_end = addr + PAGE_SIZE;
5254 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
5255 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
5256 + vma->vm_ops = &pax_vm_ops;
5257 +
5258 + ret = insert_vm_struct(current->mm, vma);
5259 + if (ret)
5260 + return ret;
5261 +
5262 + ++current->mm->total_vm;
5263 + return 0;
5264 +}
5265 +#endif
5266 +
5267 +/*
5268 + * PaX: decide what to do with offenders (regs->pc = fault address)
5269 + *
5270 + * returns 1 when task should be killed
5271 + * 2 when patched PLT trampoline was detected
5272 + * 3 when unpatched PLT trampoline was detected
5273 + */
5274 +static int pax_handle_fetch_fault(struct pt_regs *regs)
5275 +{
5276 +
5277 +#ifdef CONFIG_PAX_EMUPLT
5278 + int err;
5279 +
5280 + do { /* PaX: patched PLT emulation #1 */
5281 + unsigned int sethi1, sethi2, jmpl;
5282 +
5283 + err = get_user(sethi1, (unsigned int *)regs->pc);
5284 + err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
5285 + err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
5286 +
5287 + if (err)
5288 + break;
5289 +
5290 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
5291 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
5292 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
5293 + {
5294 + unsigned int addr;
5295 +
5296 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
5297 + addr = regs->u_regs[UREG_G1];
5298 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
5299 + regs->pc = addr;
5300 + regs->npc = addr+4;
5301 + return 2;
5302 + }
5303 + } while (0);
5304 +
5305 + { /* PaX: patched PLT emulation #2 */
5306 + unsigned int ba;
5307 +
5308 + err = get_user(ba, (unsigned int *)regs->pc);
5309 +
5310 + if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
5311 + unsigned int addr;
5312 +
5313 + addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
5314 + regs->pc = addr;
5315 + regs->npc = addr+4;
5316 + return 2;
5317 + }
5318 + }
5319 +
5320 + do { /* PaX: patched PLT emulation #3 */
5321 + unsigned int sethi, jmpl, nop;
5322 +
5323 + err = get_user(sethi, (unsigned int *)regs->pc);
5324 + err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
5325 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
5326 +
5327 + if (err)
5328 + break;
5329 +
5330 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5331 + (jmpl & 0xFFFFE000U) == 0x81C06000U &&
5332 + nop == 0x01000000U)
5333 + {
5334 + unsigned int addr;
5335 +
5336 + addr = (sethi & 0x003FFFFFU) << 10;
5337 + regs->u_regs[UREG_G1] = addr;
5338 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
5339 + regs->pc = addr;
5340 + regs->npc = addr+4;
5341 + return 2;
5342 + }
5343 + } while (0);
5344 +
5345 + do { /* PaX: unpatched PLT emulation step 1 */
5346 + unsigned int sethi, ba, nop;
5347 +
5348 + err = get_user(sethi, (unsigned int *)regs->pc);
5349 + err |= get_user(ba, (unsigned int *)(regs->pc+4));
5350 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
5351 +
5352 + if (err)
5353 + break;
5354 +
5355 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5356 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
5357 + nop == 0x01000000U)
5358 + {
5359 + unsigned int addr, save, call;
5360 +
5361 + if ((ba & 0xFFC00000U) == 0x30800000U)
5362 + addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
5363 + else
5364 + addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
5365 +
5366 + err = get_user(save, (unsigned int *)addr);
5367 + err |= get_user(call, (unsigned int *)(addr+4));
5368 + err |= get_user(nop, (unsigned int *)(addr+8));
5369 + if (err)
5370 + break;
5371 +
5372 +#ifdef CONFIG_PAX_DLRESOLVE
5373 + if (save == 0x9DE3BFA8U &&
5374 + (call & 0xC0000000U) == 0x40000000U &&
5375 + nop == 0x01000000U)
5376 + {
5377 + struct vm_area_struct *vma;
5378 + unsigned long call_dl_resolve;
5379 +
5380 + down_read(&current->mm->mmap_sem);
5381 + call_dl_resolve = current->mm->call_dl_resolve;
5382 + up_read(&current->mm->mmap_sem);
5383 + if (likely(call_dl_resolve))
5384 + goto emulate;
5385 +
5386 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
5387 +
5388 + down_write(&current->mm->mmap_sem);
5389 + if (current->mm->call_dl_resolve) {
5390 + call_dl_resolve = current->mm->call_dl_resolve;
5391 + up_write(&current->mm->mmap_sem);
5392 + if (vma)
5393 + kmem_cache_free(vm_area_cachep, vma);
5394 + goto emulate;
5395 + }
5396 +
5397 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
5398 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
5399 + up_write(&current->mm->mmap_sem);
5400 + if (vma)
5401 + kmem_cache_free(vm_area_cachep, vma);
5402 + return 1;
5403 + }
5404 +
5405 + if (pax_insert_vma(vma, call_dl_resolve)) {
5406 + up_write(&current->mm->mmap_sem);
5407 + kmem_cache_free(vm_area_cachep, vma);
5408 + return 1;
5409 + }
5410 +
5411 + current->mm->call_dl_resolve = call_dl_resolve;
5412 + up_write(&current->mm->mmap_sem);
5413 +
5414 +emulate:
5415 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5416 + regs->pc = call_dl_resolve;
5417 + regs->npc = addr+4;
5418 + return 3;
5419 + }
5420 +#endif
5421 +
5422 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
5423 + if ((save & 0xFFC00000U) == 0x05000000U &&
5424 + (call & 0xFFFFE000U) == 0x85C0A000U &&
5425 + nop == 0x01000000U)
5426 + {
5427 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5428 + regs->u_regs[UREG_G2] = addr + 4;
5429 + addr = (save & 0x003FFFFFU) << 10;
5430 + addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
5431 + regs->pc = addr;
5432 + regs->npc = addr+4;
5433 + return 3;
5434 + }
5435 + }
5436 + } while (0);
5437 +
5438 + do { /* PaX: unpatched PLT emulation step 2 */
5439 + unsigned int save, call, nop;
5440 +
5441 + err = get_user(save, (unsigned int *)(regs->pc-4));
5442 + err |= get_user(call, (unsigned int *)regs->pc);
5443 + err |= get_user(nop, (unsigned int *)(regs->pc+4));
5444 + if (err)
5445 + break;
5446 +
5447 + if (save == 0x9DE3BFA8U &&
5448 + (call & 0xC0000000U) == 0x40000000U &&
5449 + nop == 0x01000000U)
5450 + {
5451 + unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
5452 +
5453 + regs->u_regs[UREG_RETPC] = regs->pc;
5454 + regs->pc = dl_resolve;
5455 + regs->npc = dl_resolve+4;
5456 + return 3;
5457 + }
5458 + } while (0);
5459 +#endif
5460 +
5461 + return 1;
5462 +}
5463 +
5464 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
5465 +{
5466 + unsigned long i;
5467 +
5468 + printk(KERN_ERR "PAX: bytes at PC: ");
5469 + for (i = 0; i < 8; i++) {
5470 + unsigned int c;
5471 + if (get_user(c, (unsigned int *)pc+i))
5472 + printk(KERN_CONT "???????? ");
5473 + else
5474 + printk(KERN_CONT "%08x ", c);
5475 + }
5476 + printk("\n");
5477 +}
5478 +#endif
5479 +
5480 asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
5481 unsigned long address)
5482 {
5483 @@ -231,6 +495,24 @@ good_area:
5484 if(!(vma->vm_flags & VM_WRITE))
5485 goto bad_area;
5486 } else {
5487 +
5488 +#ifdef CONFIG_PAX_PAGEEXEC
5489 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
5490 + up_read(&mm->mmap_sem);
5491 + switch (pax_handle_fetch_fault(regs)) {
5492 +
5493 +#ifdef CONFIG_PAX_EMUPLT
5494 + case 2:
5495 + case 3:
5496 + return;
5497 +#endif
5498 +
5499 + }
5500 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
5501 + do_group_exit(SIGKILL);
5502 + }
5503 +#endif
5504 +
5505 /* Allow reads even for write-only mappings */
5506 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
5507 goto bad_area;
5508 diff -urNp linux-2.6.32.49/arch/sparc/mm/fault_64.c linux-2.6.32.49/arch/sparc/mm/fault_64.c
5509 --- linux-2.6.32.49/arch/sparc/mm/fault_64.c 2011-11-08 19:02:43.000000000 -0500
5510 +++ linux-2.6.32.49/arch/sparc/mm/fault_64.c 2011-11-18 18:01:52.000000000 -0500
5511 @@ -20,6 +20,9 @@
5512 #include <linux/kprobes.h>
5513 #include <linux/kdebug.h>
5514 #include <linux/percpu.h>
5515 +#include <linux/slab.h>
5516 +#include <linux/pagemap.h>
5517 +#include <linux/compiler.h>
5518
5519 #include <asm/page.h>
5520 #include <asm/pgtable.h>
5521 @@ -78,7 +81,7 @@ static void bad_kernel_pc(struct pt_regs
5522 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
5523 regs->tpc);
5524 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
5525 - printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
5526 + printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
5527 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
5528 dump_stack();
5529 unhandled_fault(regs->tpc, current, regs);
5530 @@ -249,6 +252,456 @@ static void noinline bogus_32bit_fault_a
5531 show_regs(regs);
5532 }
5533
5534 +#ifdef CONFIG_PAX_PAGEEXEC
5535 +#ifdef CONFIG_PAX_DLRESOLVE
5536 +static void pax_emuplt_close(struct vm_area_struct *vma)
5537 +{
5538 + vma->vm_mm->call_dl_resolve = 0UL;
5539 +}
5540 +
5541 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
5542 +{
5543 + unsigned int *kaddr;
5544 +
5545 + vmf->page = alloc_page(GFP_HIGHUSER);
5546 + if (!vmf->page)
5547 + return VM_FAULT_OOM;
5548 +
5549 + kaddr = kmap(vmf->page);
5550 + memset(kaddr, 0, PAGE_SIZE);
5551 + kaddr[0] = 0x9DE3BFA8U; /* save */
5552 + flush_dcache_page(vmf->page);
5553 + kunmap(vmf->page);
5554 + return VM_FAULT_MAJOR;
5555 +}
5556 +
5557 +static const struct vm_operations_struct pax_vm_ops = {
5558 + .close = pax_emuplt_close,
5559 + .fault = pax_emuplt_fault
5560 +};
5561 +
5562 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
5563 +{
5564 + int ret;
5565 +
5566 + vma->vm_mm = current->mm;
5567 + vma->vm_start = addr;
5568 + vma->vm_end = addr + PAGE_SIZE;
5569 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
5570 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
5571 + vma->vm_ops = &pax_vm_ops;
5572 +
5573 + ret = insert_vm_struct(current->mm, vma);
5574 + if (ret)
5575 + return ret;
5576 +
5577 + ++current->mm->total_vm;
5578 + return 0;
5579 +}
5580 +#endif
5581 +
5582 +/*
5583 + * PaX: decide what to do with offenders (regs->tpc = fault address)
5584 + *
5585 + * returns 1 when task should be killed
5586 + * 2 when patched PLT trampoline was detected
5587 + * 3 when unpatched PLT trampoline was detected
5588 + */
5589 +static int pax_handle_fetch_fault(struct pt_regs *regs)
5590 +{
5591 +
5592 +#ifdef CONFIG_PAX_EMUPLT
5593 + int err;
5594 +
5595 + do { /* PaX: patched PLT emulation #1 */
5596 + unsigned int sethi1, sethi2, jmpl;
5597 +
5598 + err = get_user(sethi1, (unsigned int *)regs->tpc);
5599 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
5600 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
5601 +
5602 + if (err)
5603 + break;
5604 +
5605 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
5606 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
5607 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
5608 + {
5609 + unsigned long addr;
5610 +
5611 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
5612 + addr = regs->u_regs[UREG_G1];
5613 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5614 +
5615 + if (test_thread_flag(TIF_32BIT))
5616 + addr &= 0xFFFFFFFFUL;
5617 +
5618 + regs->tpc = addr;
5619 + regs->tnpc = addr+4;
5620 + return 2;
5621 + }
5622 + } while (0);
5623 +
5624 + { /* PaX: patched PLT emulation #2 */
5625 + unsigned int ba;
5626 +
5627 + err = get_user(ba, (unsigned int *)regs->tpc);
5628 +
5629 + if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
5630 + unsigned long addr;
5631 +
5632 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
5633 +
5634 + if (test_thread_flag(TIF_32BIT))
5635 + addr &= 0xFFFFFFFFUL;
5636 +
5637 + regs->tpc = addr;
5638 + regs->tnpc = addr+4;
5639 + return 2;
5640 + }
5641 + }
5642 +
5643 + do { /* PaX: patched PLT emulation #3 */
5644 + unsigned int sethi, jmpl, nop;
5645 +
5646 + err = get_user(sethi, (unsigned int *)regs->tpc);
5647 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
5648 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5649 +
5650 + if (err)
5651 + break;
5652 +
5653 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5654 + (jmpl & 0xFFFFE000U) == 0x81C06000U &&
5655 + nop == 0x01000000U)
5656 + {
5657 + unsigned long addr;
5658 +
5659 + addr = (sethi & 0x003FFFFFU) << 10;
5660 + regs->u_regs[UREG_G1] = addr;
5661 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5662 +
5663 + if (test_thread_flag(TIF_32BIT))
5664 + addr &= 0xFFFFFFFFUL;
5665 +
5666 + regs->tpc = addr;
5667 + regs->tnpc = addr+4;
5668 + return 2;
5669 + }
5670 + } while (0);
5671 +
5672 + do { /* PaX: patched PLT emulation #4 */
5673 + unsigned int sethi, mov1, call, mov2;
5674 +
5675 + err = get_user(sethi, (unsigned int *)regs->tpc);
5676 + err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
5677 + err |= get_user(call, (unsigned int *)(regs->tpc+8));
5678 + err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
5679 +
5680 + if (err)
5681 + break;
5682 +
5683 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5684 + mov1 == 0x8210000FU &&
5685 + (call & 0xC0000000U) == 0x40000000U &&
5686 + mov2 == 0x9E100001U)
5687 + {
5688 + unsigned long addr;
5689 +
5690 + regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
5691 + addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
5692 +
5693 + if (test_thread_flag(TIF_32BIT))
5694 + addr &= 0xFFFFFFFFUL;
5695 +
5696 + regs->tpc = addr;
5697 + regs->tnpc = addr+4;
5698 + return 2;
5699 + }
5700 + } while (0);
5701 +
5702 + do { /* PaX: patched PLT emulation #5 */
5703 + unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
5704 +
5705 + err = get_user(sethi, (unsigned int *)regs->tpc);
5706 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
5707 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
5708 + err |= get_user(or1, (unsigned int *)(regs->tpc+12));
5709 + err |= get_user(or2, (unsigned int *)(regs->tpc+16));
5710 + err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
5711 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
5712 + err |= get_user(nop, (unsigned int *)(regs->tpc+28));
5713 +
5714 + if (err)
5715 + break;
5716 +
5717 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5718 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
5719 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5720 + (or1 & 0xFFFFE000U) == 0x82106000U &&
5721 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
5722 + sllx == 0x83287020U &&
5723 + jmpl == 0x81C04005U &&
5724 + nop == 0x01000000U)
5725 + {
5726 + unsigned long addr;
5727 +
5728 + regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
5729 + regs->u_regs[UREG_G1] <<= 32;
5730 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
5731 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
5732 + regs->tpc = addr;
5733 + regs->tnpc = addr+4;
5734 + return 2;
5735 + }
5736 + } while (0);
5737 +
5738 + do { /* PaX: patched PLT emulation #6 */
5739 + unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
5740 +
5741 + err = get_user(sethi, (unsigned int *)regs->tpc);
5742 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
5743 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
5744 + err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
5745 + err |= get_user(or, (unsigned int *)(regs->tpc+16));
5746 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
5747 + err |= get_user(nop, (unsigned int *)(regs->tpc+24));
5748 +
5749 + if (err)
5750 + break;
5751 +
5752 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5753 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
5754 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5755 + sllx == 0x83287020U &&
5756 + (or & 0xFFFFE000U) == 0x8A116000U &&
5757 + jmpl == 0x81C04005U &&
5758 + nop == 0x01000000U)
5759 + {
5760 + unsigned long addr;
5761 +
5762 + regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
5763 + regs->u_regs[UREG_G1] <<= 32;
5764 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
5765 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
5766 + regs->tpc = addr;
5767 + regs->tnpc = addr+4;
5768 + return 2;
5769 + }
5770 + } while (0);
5771 +
5772 + do { /* PaX: unpatched PLT emulation step 1 */
5773 + unsigned int sethi, ba, nop;
5774 +
5775 + err = get_user(sethi, (unsigned int *)regs->tpc);
5776 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
5777 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5778 +
5779 + if (err)
5780 + break;
5781 +
5782 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5783 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
5784 + nop == 0x01000000U)
5785 + {
5786 + unsigned long addr;
5787 + unsigned int save, call;
5788 + unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
5789 +
5790 + if ((ba & 0xFFC00000U) == 0x30800000U)
5791 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
5792 + else
5793 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
5794 +
5795 + if (test_thread_flag(TIF_32BIT))
5796 + addr &= 0xFFFFFFFFUL;
5797 +
5798 + err = get_user(save, (unsigned int *)addr);
5799 + err |= get_user(call, (unsigned int *)(addr+4));
5800 + err |= get_user(nop, (unsigned int *)(addr+8));
5801 + if (err)
5802 + break;
5803 +
5804 +#ifdef CONFIG_PAX_DLRESOLVE
5805 + if (save == 0x9DE3BFA8U &&
5806 + (call & 0xC0000000U) == 0x40000000U &&
5807 + nop == 0x01000000U)
5808 + {
5809 + struct vm_area_struct *vma;
5810 + unsigned long call_dl_resolve;
5811 +
5812 + down_read(&current->mm->mmap_sem);
5813 + call_dl_resolve = current->mm->call_dl_resolve;
5814 + up_read(&current->mm->mmap_sem);
5815 + if (likely(call_dl_resolve))
5816 + goto emulate;
5817 +
5818 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
5819 +
5820 + down_write(&current->mm->mmap_sem);
5821 + if (current->mm->call_dl_resolve) {
5822 + call_dl_resolve = current->mm->call_dl_resolve;
5823 + up_write(&current->mm->mmap_sem);
5824 + if (vma)
5825 + kmem_cache_free(vm_area_cachep, vma);
5826 + goto emulate;
5827 + }
5828 +
5829 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
5830 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
5831 + up_write(&current->mm->mmap_sem);
5832 + if (vma)
5833 + kmem_cache_free(vm_area_cachep, vma);
5834 + return 1;
5835 + }
5836 +
5837 + if (pax_insert_vma(vma, call_dl_resolve)) {
5838 + up_write(&current->mm->mmap_sem);
5839 + kmem_cache_free(vm_area_cachep, vma);
5840 + return 1;
5841 + }
5842 +
5843 + current->mm->call_dl_resolve = call_dl_resolve;
5844 + up_write(&current->mm->mmap_sem);
5845 +
5846 +emulate:
5847 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5848 + regs->tpc = call_dl_resolve;
5849 + regs->tnpc = addr+4;
5850 + return 3;
5851 + }
5852 +#endif
5853 +
5854 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
5855 + if ((save & 0xFFC00000U) == 0x05000000U &&
5856 + (call & 0xFFFFE000U) == 0x85C0A000U &&
5857 + nop == 0x01000000U)
5858 + {
5859 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5860 + regs->u_regs[UREG_G2] = addr + 4;
5861 + addr = (save & 0x003FFFFFU) << 10;
5862 + addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
5863 +
5864 + if (test_thread_flag(TIF_32BIT))
5865 + addr &= 0xFFFFFFFFUL;
5866 +
5867 + regs->tpc = addr;
5868 + regs->tnpc = addr+4;
5869 + return 3;
5870 + }
5871 +
5872 + /* PaX: 64-bit PLT stub */
5873 + err = get_user(sethi1, (unsigned int *)addr);
5874 + err |= get_user(sethi2, (unsigned int *)(addr+4));
5875 + err |= get_user(or1, (unsigned int *)(addr+8));
5876 + err |= get_user(or2, (unsigned int *)(addr+12));
5877 + err |= get_user(sllx, (unsigned int *)(addr+16));
5878 + err |= get_user(add, (unsigned int *)(addr+20));
5879 + err |= get_user(jmpl, (unsigned int *)(addr+24));
5880 + err |= get_user(nop, (unsigned int *)(addr+28));
5881 + if (err)
5882 + break;
5883 +
5884 + if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
5885 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
5886 + (or1 & 0xFFFFE000U) == 0x88112000U &&
5887 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
5888 + sllx == 0x89293020U &&
5889 + add == 0x8A010005U &&
5890 + jmpl == 0x89C14000U &&
5891 + nop == 0x01000000U)
5892 + {
5893 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
5894 + regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
5895 + regs->u_regs[UREG_G4] <<= 32;
5896 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
5897 + regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
5898 + regs->u_regs[UREG_G4] = addr + 24;
5899 + addr = regs->u_regs[UREG_G5];
5900 + regs->tpc = addr;
5901 + regs->tnpc = addr+4;
5902 + return 3;
5903 + }
5904 + }
5905 + } while (0);
5906 +
5907 +#ifdef CONFIG_PAX_DLRESOLVE
5908 + do { /* PaX: unpatched PLT emulation step 2 */
5909 + unsigned int save, call, nop;
5910 +
5911 + err = get_user(save, (unsigned int *)(regs->tpc-4));
5912 + err |= get_user(call, (unsigned int *)regs->tpc);
5913 + err |= get_user(nop, (unsigned int *)(regs->tpc+4));
5914 + if (err)
5915 + break;
5916 +
5917 + if (save == 0x9DE3BFA8U &&
5918 + (call & 0xC0000000U) == 0x40000000U &&
5919 + nop == 0x01000000U)
5920 + {
5921 + unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
5922 +
5923 + if (test_thread_flag(TIF_32BIT))
5924 + dl_resolve &= 0xFFFFFFFFUL;
5925 +
5926 + regs->u_regs[UREG_RETPC] = regs->tpc;
5927 + regs->tpc = dl_resolve;
5928 + regs->tnpc = dl_resolve+4;
5929 + return 3;
5930 + }
5931 + } while (0);
5932 +#endif
5933 +
5934 + do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
5935 + unsigned int sethi, ba, nop;
5936 +
5937 + err = get_user(sethi, (unsigned int *)regs->tpc);
5938 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
5939 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
5940 +
5941 + if (err)
5942 + break;
5943 +
5944 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
5945 + (ba & 0xFFF00000U) == 0x30600000U &&
5946 + nop == 0x01000000U)
5947 + {
5948 + unsigned long addr;
5949 +
5950 + addr = (sethi & 0x003FFFFFU) << 10;
5951 + regs->u_regs[UREG_G1] = addr;
5952 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
5953 +
5954 + if (test_thread_flag(TIF_32BIT))
5955 + addr &= 0xFFFFFFFFUL;
5956 +
5957 + regs->tpc = addr;
5958 + regs->tnpc = addr+4;
5959 + return 2;
5960 + }
5961 + } while (0);
5962 +
5963 +#endif
5964 +
5965 + return 1;
5966 +}
5967 +
5968 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
5969 +{
5970 + unsigned long i;
5971 +
5972 + printk(KERN_ERR "PAX: bytes at PC: ");
5973 + for (i = 0; i < 8; i++) {
5974 + unsigned int c;
5975 + if (get_user(c, (unsigned int *)pc+i))
5976 + printk(KERN_CONT "???????? ");
5977 + else
5978 + printk(KERN_CONT "%08x ", c);
5979 + }
5980 + printk("\n");
5981 +}
5982 +#endif
5983 +
5984 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
5985 {
5986 struct mm_struct *mm = current->mm;
5987 @@ -315,6 +768,29 @@ asmlinkage void __kprobes do_sparc64_fau
5988 if (!vma)
5989 goto bad_area;
5990
5991 +#ifdef CONFIG_PAX_PAGEEXEC
5992 + /* PaX: detect ITLB misses on non-exec pages */
5993 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
5994 + !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
5995 + {
5996 + if (address != regs->tpc)
5997 + goto good_area;
5998 +
5999 + up_read(&mm->mmap_sem);
6000 + switch (pax_handle_fetch_fault(regs)) {
6001 +
6002 +#ifdef CONFIG_PAX_EMUPLT
6003 + case 2:
6004 + case 3:
6005 + return;
6006 +#endif
6007 +
6008 + }
6009 + pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
6010 + do_group_exit(SIGKILL);
6011 + }
6012 +#endif
6013 +
6014 /* Pure DTLB misses do not tell us whether the fault causing
6015 * load/store/atomic was a write or not, it only says that there
6016 * was no match. So in such a case we (carefully) read the
6017 diff -urNp linux-2.6.32.49/arch/sparc/mm/hugetlbpage.c linux-2.6.32.49/arch/sparc/mm/hugetlbpage.c
6018 --- linux-2.6.32.49/arch/sparc/mm/hugetlbpage.c 2011-11-08 19:02:43.000000000 -0500
6019 +++ linux-2.6.32.49/arch/sparc/mm/hugetlbpage.c 2011-11-15 19:59:42.000000000 -0500
6020 @@ -69,7 +69,7 @@ full_search:
6021 }
6022 return -ENOMEM;
6023 }
6024 - if (likely(!vma || addr + len <= vma->vm_start)) {
6025 + if (likely(check_heap_stack_gap(vma, addr, len))) {
6026 /*
6027 * Remember the place where we stopped the search:
6028 */
6029 @@ -108,7 +108,7 @@ hugetlb_get_unmapped_area_topdown(struct
6030 /* make sure it can fit in the remaining address space */
6031 if (likely(addr > len)) {
6032 vma = find_vma(mm, addr-len);
6033 - if (!vma || addr <= vma->vm_start) {
6034 + if (check_heap_stack_gap(vma, addr - len, len)) {
6035 /* remember the address as a hint for next time */
6036 return (mm->free_area_cache = addr-len);
6037 }
6038 @@ -117,16 +117,17 @@ hugetlb_get_unmapped_area_topdown(struct
6039 if (unlikely(mm->mmap_base < len))
6040 goto bottomup;
6041
6042 - addr = (mm->mmap_base-len) & HPAGE_MASK;
6043 + addr = mm->mmap_base - len;
6044
6045 do {
6046 + addr &= HPAGE_MASK;
6047 /*
6048 * Lookup failure means no vma is above this address,
6049 * else if new region fits below vma->vm_start,
6050 * return with success:
6051 */
6052 vma = find_vma(mm, addr);
6053 - if (likely(!vma || addr+len <= vma->vm_start)) {
6054 + if (likely(check_heap_stack_gap(vma, addr, len))) {
6055 /* remember the address as a hint for next time */
6056 return (mm->free_area_cache = addr);
6057 }
6058 @@ -136,8 +137,8 @@ hugetlb_get_unmapped_area_topdown(struct
6059 mm->cached_hole_size = vma->vm_start - addr;
6060
6061 /* try just below the current vma->vm_start */
6062 - addr = (vma->vm_start-len) & HPAGE_MASK;
6063 - } while (likely(len < vma->vm_start));
6064 + addr = skip_heap_stack_gap(vma, len);
6065 + } while (!IS_ERR_VALUE(addr));
6066
6067 bottomup:
6068 /*
6069 @@ -183,8 +184,7 @@ hugetlb_get_unmapped_area(struct file *f
6070 if (addr) {
6071 addr = ALIGN(addr, HPAGE_SIZE);
6072 vma = find_vma(mm, addr);
6073 - if (task_size - len >= addr &&
6074 - (!vma || addr + len <= vma->vm_start))
6075 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
6076 return addr;
6077 }
6078 if (mm->get_unmapped_area == arch_get_unmapped_area)
6079 diff -urNp linux-2.6.32.49/arch/sparc/mm/init_32.c linux-2.6.32.49/arch/sparc/mm/init_32.c
6080 --- linux-2.6.32.49/arch/sparc/mm/init_32.c 2011-11-08 19:02:43.000000000 -0500
6081 +++ linux-2.6.32.49/arch/sparc/mm/init_32.c 2011-11-15 19:59:42.000000000 -0500
6082 @@ -317,6 +317,9 @@ extern void device_scan(void);
6083 pgprot_t PAGE_SHARED __read_mostly;
6084 EXPORT_SYMBOL(PAGE_SHARED);
6085
6086 +pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
6087 +EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
6088 +
6089 void __init paging_init(void)
6090 {
6091 switch(sparc_cpu_model) {
6092 @@ -345,17 +348,17 @@ void __init paging_init(void)
6093
6094 /* Initialize the protection map with non-constant, MMU dependent values. */
6095 protection_map[0] = PAGE_NONE;
6096 - protection_map[1] = PAGE_READONLY;
6097 - protection_map[2] = PAGE_COPY;
6098 - protection_map[3] = PAGE_COPY;
6099 + protection_map[1] = PAGE_READONLY_NOEXEC;
6100 + protection_map[2] = PAGE_COPY_NOEXEC;
6101 + protection_map[3] = PAGE_COPY_NOEXEC;
6102 protection_map[4] = PAGE_READONLY;
6103 protection_map[5] = PAGE_READONLY;
6104 protection_map[6] = PAGE_COPY;
6105 protection_map[7] = PAGE_COPY;
6106 protection_map[8] = PAGE_NONE;
6107 - protection_map[9] = PAGE_READONLY;
6108 - protection_map[10] = PAGE_SHARED;
6109 - protection_map[11] = PAGE_SHARED;
6110 + protection_map[9] = PAGE_READONLY_NOEXEC;
6111 + protection_map[10] = PAGE_SHARED_NOEXEC;
6112 + protection_map[11] = PAGE_SHARED_NOEXEC;
6113 protection_map[12] = PAGE_READONLY;
6114 protection_map[13] = PAGE_READONLY;
6115 protection_map[14] = PAGE_SHARED;
6116 diff -urNp linux-2.6.32.49/arch/sparc/mm/Makefile linux-2.6.32.49/arch/sparc/mm/Makefile
6117 --- linux-2.6.32.49/arch/sparc/mm/Makefile 2011-11-08 19:02:43.000000000 -0500
6118 +++ linux-2.6.32.49/arch/sparc/mm/Makefile 2011-11-15 19:59:42.000000000 -0500
6119 @@ -2,7 +2,7 @@
6120 #
6121
6122 asflags-y := -ansi
6123 -ccflags-y := -Werror
6124 +#ccflags-y := -Werror
6125
6126 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
6127 obj-y += fault_$(BITS).o
6128 diff -urNp linux-2.6.32.49/arch/sparc/mm/srmmu.c linux-2.6.32.49/arch/sparc/mm/srmmu.c
6129 --- linux-2.6.32.49/arch/sparc/mm/srmmu.c 2011-11-08 19:02:43.000000000 -0500
6130 +++ linux-2.6.32.49/arch/sparc/mm/srmmu.c 2011-11-15 19:59:42.000000000 -0500
6131 @@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
6132 PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
6133 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
6134 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
6135 +
6136 +#ifdef CONFIG_PAX_PAGEEXEC
6137 + PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
6138 + BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
6139 + BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
6140 +#endif
6141 +
6142 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
6143 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
6144
6145 diff -urNp linux-2.6.32.49/arch/um/include/asm/kmap_types.h linux-2.6.32.49/arch/um/include/asm/kmap_types.h
6146 --- linux-2.6.32.49/arch/um/include/asm/kmap_types.h 2011-11-08 19:02:43.000000000 -0500
6147 +++ linux-2.6.32.49/arch/um/include/asm/kmap_types.h 2011-11-15 19:59:42.000000000 -0500
6148 @@ -23,6 +23,7 @@ enum km_type {
6149 KM_IRQ1,
6150 KM_SOFTIRQ0,
6151 KM_SOFTIRQ1,
6152 + KM_CLEARPAGE,
6153 KM_TYPE_NR
6154 };
6155
6156 diff -urNp linux-2.6.32.49/arch/um/include/asm/page.h linux-2.6.32.49/arch/um/include/asm/page.h
6157 --- linux-2.6.32.49/arch/um/include/asm/page.h 2011-11-08 19:02:43.000000000 -0500
6158 +++ linux-2.6.32.49/arch/um/include/asm/page.h 2011-11-15 19:59:42.000000000 -0500
6159 @@ -14,6 +14,9 @@
6160 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
6161 #define PAGE_MASK (~(PAGE_SIZE-1))
6162
6163 +#define ktla_ktva(addr) (addr)
6164 +#define ktva_ktla(addr) (addr)
6165 +
6166 #ifndef __ASSEMBLY__
6167
6168 struct page;
6169 diff -urNp linux-2.6.32.49/arch/um/kernel/process.c linux-2.6.32.49/arch/um/kernel/process.c
6170 --- linux-2.6.32.49/arch/um/kernel/process.c 2011-11-08 19:02:43.000000000 -0500
6171 +++ linux-2.6.32.49/arch/um/kernel/process.c 2011-11-15 19:59:42.000000000 -0500
6172 @@ -393,22 +393,6 @@ int singlestepping(void * t)
6173 return 2;
6174 }
6175
6176 -/*
6177 - * Only x86 and x86_64 have an arch_align_stack().
6178 - * All other arches have "#define arch_align_stack(x) (x)"
6179 - * in their asm/system.h
6180 - * As this is included in UML from asm-um/system-generic.h,
6181 - * we can use it to behave as the subarch does.
6182 - */
6183 -#ifndef arch_align_stack
6184 -unsigned long arch_align_stack(unsigned long sp)
6185 -{
6186 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
6187 - sp -= get_random_int() % 8192;
6188 - return sp & ~0xf;
6189 -}
6190 -#endif
6191 -
6192 unsigned long get_wchan(struct task_struct *p)
6193 {
6194 unsigned long stack_page, sp, ip;
6195 diff -urNp linux-2.6.32.49/arch/um/Makefile linux-2.6.32.49/arch/um/Makefile
6196 --- linux-2.6.32.49/arch/um/Makefile 2011-11-08 19:02:43.000000000 -0500
6197 +++ linux-2.6.32.49/arch/um/Makefile 2011-11-18 18:01:52.000000000 -0500
6198 @@ -49,6 +49,10 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINE
6199 $(patsubst -I%,,$(KBUILD_CFLAGS)))) $(ARCH_INCLUDE) $(MODE_INCLUDE) \
6200 $(filter -I%,$(CFLAGS)) -D_FILE_OFFSET_BITS=64
6201
6202 +ifdef CONSTIFY_PLUGIN
6203 +USER_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
6204 +endif
6205 +
6206 include $(srctree)/$(ARCH_DIR)/Makefile-$(SUBARCH)
6207
6208 #This will adjust *FLAGS accordingly to the platform.
6209 diff -urNp linux-2.6.32.49/arch/um/sys-i386/shared/sysdep/system.h linux-2.6.32.49/arch/um/sys-i386/shared/sysdep/system.h
6210 --- linux-2.6.32.49/arch/um/sys-i386/shared/sysdep/system.h 2011-11-08 19:02:43.000000000 -0500
6211 +++ linux-2.6.32.49/arch/um/sys-i386/shared/sysdep/system.h 2011-11-18 18:01:52.000000000 -0500
6212 @@ -17,7 +17,7 @@
6213 # define AT_VECTOR_SIZE_ARCH 1
6214 #endif
6215
6216 -extern unsigned long arch_align_stack(unsigned long sp);
6217 +#define arch_align_stack(x) ((x) & ~0xfUL)
6218
6219 void default_idle(void);
6220
6221 diff -urNp linux-2.6.32.49/arch/um/sys-i386/syscalls.c linux-2.6.32.49/arch/um/sys-i386/syscalls.c
6222 --- linux-2.6.32.49/arch/um/sys-i386/syscalls.c 2011-11-08 19:02:43.000000000 -0500
6223 +++ linux-2.6.32.49/arch/um/sys-i386/syscalls.c 2011-11-15 19:59:42.000000000 -0500
6224 @@ -11,6 +11,21 @@
6225 #include "asm/uaccess.h"
6226 #include "asm/unistd.h"
6227
6228 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
6229 +{
6230 + unsigned long pax_task_size = TASK_SIZE;
6231 +
6232 +#ifdef CONFIG_PAX_SEGMEXEC
6233 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
6234 + pax_task_size = SEGMEXEC_TASK_SIZE;
6235 +#endif
6236 +
6237 + if (len > pax_task_size || addr > pax_task_size - len)
6238 + return -EINVAL;
6239 +
6240 + return 0;
6241 +}
6242 +
6243 /*
6244 * Perform the select(nd, in, out, ex, tv) and mmap() system
6245 * calls. Linux/i386 didn't use to be able to handle more than
6246 diff -urNp linux-2.6.32.49/arch/um/sys-x86_64/shared/sysdep/system.h linux-2.6.32.49/arch/um/sys-x86_64/shared/sysdep/system.h
6247 --- linux-2.6.32.49/arch/um/sys-x86_64/shared/sysdep/system.h 2011-11-08 19:02:43.000000000 -0500
6248 +++ linux-2.6.32.49/arch/um/sys-x86_64/shared/sysdep/system.h 2011-11-18 18:01:52.000000000 -0500
6249 @@ -17,7 +17,7 @@
6250 # define AT_VECTOR_SIZE_ARCH 1
6251 #endif
6252
6253 -extern unsigned long arch_align_stack(unsigned long sp);
6254 +#define arch_align_stack(x) ((x) & ~0xfUL)
6255
6256 void default_idle(void);
6257
6258 diff -urNp linux-2.6.32.49/arch/x86/boot/bitops.h linux-2.6.32.49/arch/x86/boot/bitops.h
6259 --- linux-2.6.32.49/arch/x86/boot/bitops.h 2011-11-08 19:02:43.000000000 -0500
6260 +++ linux-2.6.32.49/arch/x86/boot/bitops.h 2011-11-15 19:59:42.000000000 -0500
6261 @@ -26,7 +26,7 @@ static inline int variable_test_bit(int
6262 u8 v;
6263 const u32 *p = (const u32 *)addr;
6264
6265 - asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
6266 + asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
6267 return v;
6268 }
6269
6270 @@ -37,7 +37,7 @@ static inline int variable_test_bit(int
6271
6272 static inline void set_bit(int nr, void *addr)
6273 {
6274 - asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
6275 + asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
6276 }
6277
6278 #endif /* BOOT_BITOPS_H */
6279 diff -urNp linux-2.6.32.49/arch/x86/boot/boot.h linux-2.6.32.49/arch/x86/boot/boot.h
6280 --- linux-2.6.32.49/arch/x86/boot/boot.h 2011-11-08 19:02:43.000000000 -0500
6281 +++ linux-2.6.32.49/arch/x86/boot/boot.h 2011-11-15 19:59:42.000000000 -0500
6282 @@ -82,7 +82,7 @@ static inline void io_delay(void)
6283 static inline u16 ds(void)
6284 {
6285 u16 seg;
6286 - asm("movw %%ds,%0" : "=rm" (seg));
6287 + asm volatile("movw %%ds,%0" : "=rm" (seg));
6288 return seg;
6289 }
6290
6291 @@ -178,7 +178,7 @@ static inline void wrgs32(u32 v, addr_t
6292 static inline int memcmp(const void *s1, const void *s2, size_t len)
6293 {
6294 u8 diff;
6295 - asm("repe; cmpsb; setnz %0"
6296 + asm volatile("repe; cmpsb; setnz %0"
6297 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
6298 return diff;
6299 }
6300 diff -urNp linux-2.6.32.49/arch/x86/boot/compressed/head_32.S linux-2.6.32.49/arch/x86/boot/compressed/head_32.S
6301 --- linux-2.6.32.49/arch/x86/boot/compressed/head_32.S 2011-11-08 19:02:43.000000000 -0500
6302 +++ linux-2.6.32.49/arch/x86/boot/compressed/head_32.S 2011-11-15 19:59:42.000000000 -0500
6303 @@ -76,7 +76,7 @@ ENTRY(startup_32)
6304 notl %eax
6305 andl %eax, %ebx
6306 #else
6307 - movl $LOAD_PHYSICAL_ADDR, %ebx
6308 + movl $____LOAD_PHYSICAL_ADDR, %ebx
6309 #endif
6310
6311 /* Target address to relocate to for decompression */
6312 @@ -149,7 +149,7 @@ relocated:
6313 * and where it was actually loaded.
6314 */
6315 movl %ebp, %ebx
6316 - subl $LOAD_PHYSICAL_ADDR, %ebx
6317 + subl $____LOAD_PHYSICAL_ADDR, %ebx
6318 jz 2f /* Nothing to be done if loaded at compiled addr. */
6319 /*
6320 * Process relocations.
6321 @@ -157,8 +157,7 @@ relocated:
6322
6323 1: subl $4, %edi
6324 movl (%edi), %ecx
6325 - testl %ecx, %ecx
6326 - jz 2f
6327 + jecxz 2f
6328 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
6329 jmp 1b
6330 2:
6331 diff -urNp linux-2.6.32.49/arch/x86/boot/compressed/head_64.S linux-2.6.32.49/arch/x86/boot/compressed/head_64.S
6332 --- linux-2.6.32.49/arch/x86/boot/compressed/head_64.S 2011-11-08 19:02:43.000000000 -0500
6333 +++ linux-2.6.32.49/arch/x86/boot/compressed/head_64.S 2011-11-15 19:59:42.000000000 -0500
6334 @@ -91,7 +91,7 @@ ENTRY(startup_32)
6335 notl %eax
6336 andl %eax, %ebx
6337 #else
6338 - movl $LOAD_PHYSICAL_ADDR, %ebx
6339 + movl $____LOAD_PHYSICAL_ADDR, %ebx
6340 #endif
6341
6342 /* Target address to relocate to for decompression */
6343 @@ -183,7 +183,7 @@ no_longmode:
6344 hlt
6345 jmp 1b
6346
6347 -#include "../../kernel/verify_cpu_64.S"
6348 +#include "../../kernel/verify_cpu.S"
6349
6350 /*
6351 * Be careful here startup_64 needs to be at a predictable
6352 @@ -234,7 +234,7 @@ ENTRY(startup_64)
6353 notq %rax
6354 andq %rax, %rbp
6355 #else
6356 - movq $LOAD_PHYSICAL_ADDR, %rbp
6357 + movq $____LOAD_PHYSICAL_ADDR, %rbp
6358 #endif
6359
6360 /* Target address to relocate to for decompression */
6361 diff -urNp linux-2.6.32.49/arch/x86/boot/compressed/Makefile linux-2.6.32.49/arch/x86/boot/compressed/Makefile
6362 --- linux-2.6.32.49/arch/x86/boot/compressed/Makefile 2011-11-08 19:02:43.000000000 -0500
6363 +++ linux-2.6.32.49/arch/x86/boot/compressed/Makefile 2011-11-15 19:59:42.000000000 -0500
6364 @@ -13,6 +13,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=smal
6365 KBUILD_CFLAGS += $(cflags-y)
6366 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
6367 KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
6368 +ifdef CONSTIFY_PLUGIN
6369 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
6370 +endif
6371
6372 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
6373 GCOV_PROFILE := n
6374 diff -urNp linux-2.6.32.49/arch/x86/boot/compressed/misc.c linux-2.6.32.49/arch/x86/boot/compressed/misc.c
6375 --- linux-2.6.32.49/arch/x86/boot/compressed/misc.c 2011-11-08 19:02:43.000000000 -0500
6376 +++ linux-2.6.32.49/arch/x86/boot/compressed/misc.c 2011-11-15 19:59:42.000000000 -0500
6377 @@ -288,7 +288,7 @@ static void parse_elf(void *output)
6378 case PT_LOAD:
6379 #ifdef CONFIG_RELOCATABLE
6380 dest = output;
6381 - dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
6382 + dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
6383 #else
6384 dest = (void *)(phdr->p_paddr);
6385 #endif
6386 @@ -335,7 +335,7 @@ asmlinkage void decompress_kernel(void *
6387 error("Destination address too large");
6388 #endif
6389 #ifndef CONFIG_RELOCATABLE
6390 - if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
6391 + if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
6392 error("Wrong destination address");
6393 #endif
6394
6395 diff -urNp linux-2.6.32.49/arch/x86/boot/compressed/mkpiggy.c linux-2.6.32.49/arch/x86/boot/compressed/mkpiggy.c
6396 --- linux-2.6.32.49/arch/x86/boot/compressed/mkpiggy.c 2011-11-08 19:02:43.000000000 -0500
6397 +++ linux-2.6.32.49/arch/x86/boot/compressed/mkpiggy.c 2011-11-15 19:59:42.000000000 -0500
6398 @@ -74,7 +74,7 @@ int main(int argc, char *argv[])
6399
6400 offs = (olen > ilen) ? olen - ilen : 0;
6401 offs += olen >> 12; /* Add 8 bytes for each 32K block */
6402 - offs += 32*1024 + 18; /* Add 32K + 18 bytes slack */
6403 + offs += 64*1024; /* Add 64K bytes slack */
6404 offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
6405
6406 printf(".section \".rodata.compressed\",\"a\",@progbits\n");
6407 diff -urNp linux-2.6.32.49/arch/x86/boot/compressed/relocs.c linux-2.6.32.49/arch/x86/boot/compressed/relocs.c
6408 --- linux-2.6.32.49/arch/x86/boot/compressed/relocs.c 2011-11-08 19:02:43.000000000 -0500
6409 +++ linux-2.6.32.49/arch/x86/boot/compressed/relocs.c 2011-11-15 19:59:42.000000000 -0500
6410 @@ -10,8 +10,11 @@
6411 #define USE_BSD
6412 #include <endian.h>
6413
6414 +#include "../../../../include/linux/autoconf.h"
6415 +
6416 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
6417 static Elf32_Ehdr ehdr;
6418 +static Elf32_Phdr *phdr;
6419 static unsigned long reloc_count, reloc_idx;
6420 static unsigned long *relocs;
6421
6422 @@ -37,7 +40,7 @@ static const char* safe_abs_relocs[] = {
6423
6424 static int is_safe_abs_reloc(const char* sym_name)
6425 {
6426 - int i;
6427 + unsigned int i;
6428
6429 for (i = 0; i < ARRAY_SIZE(safe_abs_relocs); i++) {
6430 if (!strcmp(sym_name, safe_abs_relocs[i]))
6431 @@ -245,9 +248,39 @@ static void read_ehdr(FILE *fp)
6432 }
6433 }
6434
6435 +static void read_phdrs(FILE *fp)
6436 +{
6437 + unsigned int i;
6438 +
6439 + phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
6440 + if (!phdr) {
6441 + die("Unable to allocate %d program headers\n",
6442 + ehdr.e_phnum);
6443 + }
6444 + if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
6445 + die("Seek to %d failed: %s\n",
6446 + ehdr.e_phoff, strerror(errno));
6447 + }
6448 + if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
6449 + die("Cannot read ELF program headers: %s\n",
6450 + strerror(errno));
6451 + }
6452 + for(i = 0; i < ehdr.e_phnum; i++) {
6453 + phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
6454 + phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
6455 + phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
6456 + phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
6457 + phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
6458 + phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
6459 + phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
6460 + phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
6461 + }
6462 +
6463 +}
6464 +
6465 static void read_shdrs(FILE *fp)
6466 {
6467 - int i;
6468 + unsigned int i;
6469 Elf32_Shdr shdr;
6470
6471 secs = calloc(ehdr.e_shnum, sizeof(struct section));
6472 @@ -282,7 +315,7 @@ static void read_shdrs(FILE *fp)
6473
6474 static void read_strtabs(FILE *fp)
6475 {
6476 - int i;
6477 + unsigned int i;
6478 for (i = 0; i < ehdr.e_shnum; i++) {
6479 struct section *sec = &secs[i];
6480 if (sec->shdr.sh_type != SHT_STRTAB) {
6481 @@ -307,7 +340,7 @@ static void read_strtabs(FILE *fp)
6482
6483 static void read_symtabs(FILE *fp)
6484 {
6485 - int i,j;
6486 + unsigned int i,j;
6487 for (i = 0; i < ehdr.e_shnum; i++) {
6488 struct section *sec = &secs[i];
6489 if (sec->shdr.sh_type != SHT_SYMTAB) {
6490 @@ -340,7 +373,9 @@ static void read_symtabs(FILE *fp)
6491
6492 static void read_relocs(FILE *fp)
6493 {
6494 - int i,j;
6495 + unsigned int i,j;
6496 + uint32_t base;
6497 +
6498 for (i = 0; i < ehdr.e_shnum; i++) {
6499 struct section *sec = &secs[i];
6500 if (sec->shdr.sh_type != SHT_REL) {
6501 @@ -360,9 +395,18 @@ static void read_relocs(FILE *fp)
6502 die("Cannot read symbol table: %s\n",
6503 strerror(errno));
6504 }
6505 + base = 0;
6506 + for (j = 0; j < ehdr.e_phnum; j++) {
6507 + if (phdr[j].p_type != PT_LOAD )
6508 + continue;
6509 + if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
6510 + continue;
6511 + base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
6512 + break;
6513 + }
6514 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
6515 Elf32_Rel *rel = &sec->reltab[j];
6516 - rel->r_offset = elf32_to_cpu(rel->r_offset);
6517 + rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
6518 rel->r_info = elf32_to_cpu(rel->r_info);
6519 }
6520 }
6521 @@ -371,14 +415,14 @@ static void read_relocs(FILE *fp)
6522
6523 static void print_absolute_symbols(void)
6524 {
6525 - int i;
6526 + unsigned int i;
6527 printf("Absolute symbols\n");
6528 printf(" Num: Value Size Type Bind Visibility Name\n");
6529 for (i = 0; i < ehdr.e_shnum; i++) {
6530 struct section *sec = &secs[i];
6531 char *sym_strtab;
6532 Elf32_Sym *sh_symtab;
6533 - int j;
6534 + unsigned int j;
6535
6536 if (sec->shdr.sh_type != SHT_SYMTAB) {
6537 continue;
6538 @@ -406,14 +450,14 @@ static void print_absolute_symbols(void)
6539
6540 static void print_absolute_relocs(void)
6541 {
6542 - int i, printed = 0;
6543 + unsigned int i, printed = 0;
6544
6545 for (i = 0; i < ehdr.e_shnum; i++) {
6546 struct section *sec = &secs[i];
6547 struct section *sec_applies, *sec_symtab;
6548 char *sym_strtab;
6549 Elf32_Sym *sh_symtab;
6550 - int j;
6551 + unsigned int j;
6552 if (sec->shdr.sh_type != SHT_REL) {
6553 continue;
6554 }
6555 @@ -474,13 +518,13 @@ static void print_absolute_relocs(void)
6556
6557 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
6558 {
6559 - int i;
6560 + unsigned int i;
6561 /* Walk through the relocations */
6562 for (i = 0; i < ehdr.e_shnum; i++) {
6563 char *sym_strtab;
6564 Elf32_Sym *sh_symtab;
6565 struct section *sec_applies, *sec_symtab;
6566 - int j;
6567 + unsigned int j;
6568 struct section *sec = &secs[i];
6569
6570 if (sec->shdr.sh_type != SHT_REL) {
6571 @@ -504,6 +548,21 @@ static void walk_relocs(void (*visit)(El
6572 if (sym->st_shndx == SHN_ABS) {
6573 continue;
6574 }
6575 + /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
6576 + if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
6577 + continue;
6578 +
6579 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
6580 + /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
6581 + if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
6582 + continue;
6583 + if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
6584 + continue;
6585 + if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
6586 + continue;
6587 + if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
6588 + continue;
6589 +#endif
6590 if (r_type == R_386_NONE || r_type == R_386_PC32) {
6591 /*
6592 * NONE can be ignored and and PC relative
6593 @@ -541,7 +600,7 @@ static int cmp_relocs(const void *va, co
6594
6595 static void emit_relocs(int as_text)
6596 {
6597 - int i;
6598 + unsigned int i;
6599 /* Count how many relocations I have and allocate space for them. */
6600 reloc_count = 0;
6601 walk_relocs(count_reloc);
6602 @@ -634,6 +693,7 @@ int main(int argc, char **argv)
6603 fname, strerror(errno));
6604 }
6605 read_ehdr(fp);
6606 + read_phdrs(fp);
6607 read_shdrs(fp);
6608 read_strtabs(fp);
6609 read_symtabs(fp);
6610 diff -urNp linux-2.6.32.49/arch/x86/boot/cpucheck.c linux-2.6.32.49/arch/x86/boot/cpucheck.c
6611 --- linux-2.6.32.49/arch/x86/boot/cpucheck.c 2011-11-08 19:02:43.000000000 -0500
6612 +++ linux-2.6.32.49/arch/x86/boot/cpucheck.c 2011-11-15 19:59:42.000000000 -0500
6613 @@ -74,7 +74,7 @@ static int has_fpu(void)
6614 u16 fcw = -1, fsw = -1;
6615 u32 cr0;
6616
6617 - asm("movl %%cr0,%0" : "=r" (cr0));
6618 + asm volatile("movl %%cr0,%0" : "=r" (cr0));
6619 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
6620 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
6621 asm volatile("movl %0,%%cr0" : : "r" (cr0));
6622 @@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
6623 {
6624 u32 f0, f1;
6625
6626 - asm("pushfl ; "
6627 + asm volatile("pushfl ; "
6628 "pushfl ; "
6629 "popl %0 ; "
6630 "movl %0,%1 ; "
6631 @@ -115,7 +115,7 @@ static void get_flags(void)
6632 set_bit(X86_FEATURE_FPU, cpu.flags);
6633
6634 if (has_eflag(X86_EFLAGS_ID)) {
6635 - asm("cpuid"
6636 + asm volatile("cpuid"
6637 : "=a" (max_intel_level),
6638 "=b" (cpu_vendor[0]),
6639 "=d" (cpu_vendor[1]),
6640 @@ -124,7 +124,7 @@ static void get_flags(void)
6641
6642 if (max_intel_level >= 0x00000001 &&
6643 max_intel_level <= 0x0000ffff) {
6644 - asm("cpuid"
6645 + asm volatile("cpuid"
6646 : "=a" (tfms),
6647 "=c" (cpu.flags[4]),
6648 "=d" (cpu.flags[0])
6649 @@ -136,7 +136,7 @@ static void get_flags(void)
6650 cpu.model += ((tfms >> 16) & 0xf) << 4;
6651 }
6652
6653 - asm("cpuid"
6654 + asm volatile("cpuid"
6655 : "=a" (max_amd_level)
6656 : "a" (0x80000000)
6657 : "ebx", "ecx", "edx");
6658 @@ -144,7 +144,7 @@ static void get_flags(void)
6659 if (max_amd_level >= 0x80000001 &&
6660 max_amd_level <= 0x8000ffff) {
6661 u32 eax = 0x80000001;
6662 - asm("cpuid"
6663 + asm volatile("cpuid"
6664 : "+a" (eax),
6665 "=c" (cpu.flags[6]),
6666 "=d" (cpu.flags[1])
6667 @@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
6668 u32 ecx = MSR_K7_HWCR;
6669 u32 eax, edx;
6670
6671 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6672 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6673 eax &= ~(1 << 15);
6674 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6675 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6676
6677 get_flags(); /* Make sure it really did something */
6678 err = check_flags();
6679 @@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
6680 u32 ecx = MSR_VIA_FCR;
6681 u32 eax, edx;
6682
6683 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6684 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6685 eax |= (1<<1)|(1<<7);
6686 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6687 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6688
6689 set_bit(X86_FEATURE_CX8, cpu.flags);
6690 err = check_flags();
6691 @@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
6692 u32 eax, edx;
6693 u32 level = 1;
6694
6695 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6696 - asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
6697 - asm("cpuid"
6698 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
6699 + asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
6700 + asm volatile("cpuid"
6701 : "+a" (level), "=d" (cpu.flags[0])
6702 : : "ecx", "ebx");
6703 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6704 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
6705
6706 err = check_flags();
6707 }
6708 diff -urNp linux-2.6.32.49/arch/x86/boot/header.S linux-2.6.32.49/arch/x86/boot/header.S
6709 --- linux-2.6.32.49/arch/x86/boot/header.S 2011-11-08 19:02:43.000000000 -0500
6710 +++ linux-2.6.32.49/arch/x86/boot/header.S 2011-11-15 19:59:42.000000000 -0500
6711 @@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical
6712 # single linked list of
6713 # struct setup_data
6714
6715 -pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
6716 +pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
6717
6718 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
6719 #define VO_INIT_SIZE (VO__end - VO__text)
6720 diff -urNp linux-2.6.32.49/arch/x86/boot/Makefile linux-2.6.32.49/arch/x86/boot/Makefile
6721 --- linux-2.6.32.49/arch/x86/boot/Makefile 2011-11-08 19:02:43.000000000 -0500
6722 +++ linux-2.6.32.49/arch/x86/boot/Makefile 2011-11-15 19:59:42.000000000 -0500
6723 @@ -69,6 +69,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os
6724 $(call cc-option, -fno-stack-protector) \
6725 $(call cc-option, -mpreferred-stack-boundary=2)
6726 KBUILD_CFLAGS += $(call cc-option, -m32)
6727 +ifdef CONSTIFY_PLUGIN
6728 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
6729 +endif
6730 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
6731 GCOV_PROFILE := n
6732
6733 diff -urNp linux-2.6.32.49/arch/x86/boot/memory.c linux-2.6.32.49/arch/x86/boot/memory.c
6734 --- linux-2.6.32.49/arch/x86/boot/memory.c 2011-11-08 19:02:43.000000000 -0500
6735 +++ linux-2.6.32.49/arch/x86/boot/memory.c 2011-11-15 19:59:42.000000000 -0500
6736 @@ -19,7 +19,7 @@
6737
6738 static int detect_memory_e820(void)
6739 {
6740 - int count = 0;
6741 + unsigned int count = 0;
6742 struct biosregs ireg, oreg;
6743 struct e820entry *desc = boot_params.e820_map;
6744 static struct e820entry buf; /* static so it is zeroed */
6745 diff -urNp linux-2.6.32.49/arch/x86/boot/video.c linux-2.6.32.49/arch/x86/boot/video.c
6746 --- linux-2.6.32.49/arch/x86/boot/video.c 2011-11-08 19:02:43.000000000 -0500
6747 +++ linux-2.6.32.49/arch/x86/boot/video.c 2011-11-15 19:59:42.000000000 -0500
6748 @@ -90,7 +90,7 @@ static void store_mode_params(void)
6749 static unsigned int get_entry(void)
6750 {
6751 char entry_buf[4];
6752 - int i, len = 0;
6753 + unsigned int i, len = 0;
6754 int key;
6755 unsigned int v;
6756
6757 diff -urNp linux-2.6.32.49/arch/x86/boot/video-vesa.c linux-2.6.32.49/arch/x86/boot/video-vesa.c
6758 --- linux-2.6.32.49/arch/x86/boot/video-vesa.c 2011-11-08 19:02:43.000000000 -0500
6759 +++ linux-2.6.32.49/arch/x86/boot/video-vesa.c 2011-11-15 19:59:42.000000000 -0500
6760 @@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
6761
6762 boot_params.screen_info.vesapm_seg = oreg.es;
6763 boot_params.screen_info.vesapm_off = oreg.di;
6764 + boot_params.screen_info.vesapm_size = oreg.cx;
6765 }
6766
6767 /*
6768 diff -urNp linux-2.6.32.49/arch/x86/crypto/aes-x86_64-asm_64.S linux-2.6.32.49/arch/x86/crypto/aes-x86_64-asm_64.S
6769 --- linux-2.6.32.49/arch/x86/crypto/aes-x86_64-asm_64.S 2011-11-08 19:02:43.000000000 -0500
6770 +++ linux-2.6.32.49/arch/x86/crypto/aes-x86_64-asm_64.S 2011-11-15 19:59:42.000000000 -0500
6771 @@ -8,6 +8,8 @@
6772 * including this sentence is retained in full.
6773 */
6774
6775 +#include <asm/alternative-asm.h>
6776 +
6777 .extern crypto_ft_tab
6778 .extern crypto_it_tab
6779 .extern crypto_fl_tab
6780 @@ -71,6 +73,8 @@ FUNC: movq r1,r2; \
6781 je B192; \
6782 leaq 32(r9),r9;
6783
6784 +#define ret pax_force_retaddr; ret
6785 +
6786 #define epilogue(r1,r2,r3,r4,r5,r6,r7,r8,r9) \
6787 movq r1,r2; \
6788 movq r3,r4; \
6789 diff -urNp linux-2.6.32.49/arch/x86/crypto/salsa20-x86_64-asm_64.S linux-2.6.32.49/arch/x86/crypto/salsa20-x86_64-asm_64.S
6790 --- linux-2.6.32.49/arch/x86/crypto/salsa20-x86_64-asm_64.S 2011-11-08 19:02:43.000000000 -0500
6791 +++ linux-2.6.32.49/arch/x86/crypto/salsa20-x86_64-asm_64.S 2011-11-15 19:59:42.000000000 -0500
6792 @@ -1,3 +1,5 @@
6793 +#include <asm/alternative-asm.h>
6794 +
6795 # enter ECRYPT_encrypt_bytes
6796 .text
6797 .p2align 5
6798 @@ -790,6 +792,7 @@ ECRYPT_encrypt_bytes:
6799 add %r11,%rsp
6800 mov %rdi,%rax
6801 mov %rsi,%rdx
6802 + pax_force_retaddr
6803 ret
6804 # bytesatleast65:
6805 ._bytesatleast65:
6806 @@ -891,6 +894,7 @@ ECRYPT_keysetup:
6807 add %r11,%rsp
6808 mov %rdi,%rax
6809 mov %rsi,%rdx
6810 + pax_force_retaddr
6811 ret
6812 # enter ECRYPT_ivsetup
6813 .text
6814 @@ -917,4 +921,5 @@ ECRYPT_ivsetup:
6815 add %r11,%rsp
6816 mov %rdi,%rax
6817 mov %rsi,%rdx
6818 + pax_force_retaddr
6819 ret
6820 diff -urNp linux-2.6.32.49/arch/x86/crypto/twofish-x86_64-asm_64.S linux-2.6.32.49/arch/x86/crypto/twofish-x86_64-asm_64.S
6821 --- linux-2.6.32.49/arch/x86/crypto/twofish-x86_64-asm_64.S 2011-11-08 19:02:43.000000000 -0500
6822 +++ linux-2.6.32.49/arch/x86/crypto/twofish-x86_64-asm_64.S 2011-11-15 19:59:42.000000000 -0500
6823 @@ -21,6 +21,7 @@
6824 .text
6825
6826 #include <asm/asm-offsets.h>
6827 +#include <asm/alternative-asm.h>
6828
6829 #define a_offset 0
6830 #define b_offset 4
6831 @@ -269,6 +270,7 @@ twofish_enc_blk:
6832
6833 popq R1
6834 movq $1,%rax
6835 + pax_force_retaddr
6836 ret
6837
6838 twofish_dec_blk:
6839 @@ -321,4 +323,5 @@ twofish_dec_blk:
6840
6841 popq R1
6842 movq $1,%rax
6843 + pax_force_retaddr
6844 ret
6845 diff -urNp linux-2.6.32.49/arch/x86/ia32/ia32_aout.c linux-2.6.32.49/arch/x86/ia32/ia32_aout.c
6846 --- linux-2.6.32.49/arch/x86/ia32/ia32_aout.c 2011-11-08 19:02:43.000000000 -0500
6847 +++ linux-2.6.32.49/arch/x86/ia32/ia32_aout.c 2011-11-15 19:59:42.000000000 -0500
6848 @@ -169,6 +169,8 @@ static int aout_core_dump(long signr, st
6849 unsigned long dump_start, dump_size;
6850 struct user32 dump;
6851
6852 + memset(&dump, 0, sizeof(dump));
6853 +
6854 fs = get_fs();
6855 set_fs(KERNEL_DS);
6856 has_dumped = 1;
6857 @@ -218,12 +220,6 @@ static int aout_core_dump(long signr, st
6858 dump_size = dump.u_ssize << PAGE_SHIFT;
6859 DUMP_WRITE(dump_start, dump_size);
6860 }
6861 - /*
6862 - * Finally dump the task struct. Not be used by gdb, but
6863 - * could be useful
6864 - */
6865 - set_fs(KERNEL_DS);
6866 - DUMP_WRITE(current, sizeof(*current));
6867 end_coredump:
6868 set_fs(fs);
6869 return has_dumped;
6870 diff -urNp linux-2.6.32.49/arch/x86/ia32/ia32entry.S linux-2.6.32.49/arch/x86/ia32/ia32entry.S
6871 --- linux-2.6.32.49/arch/x86/ia32/ia32entry.S 2011-11-08 19:02:43.000000000 -0500
6872 +++ linux-2.6.32.49/arch/x86/ia32/ia32entry.S 2011-11-18 18:01:52.000000000 -0500
6873 @@ -13,7 +13,9 @@
6874 #include <asm/thread_info.h>
6875 #include <asm/segment.h>
6876 #include <asm/irqflags.h>
6877 +#include <asm/pgtable.h>
6878 #include <linux/linkage.h>
6879 +#include <asm/alternative-asm.h>
6880
6881 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
6882 #include <linux/elf-em.h>
6883 @@ -93,6 +95,29 @@ ENTRY(native_irq_enable_sysexit)
6884 ENDPROC(native_irq_enable_sysexit)
6885 #endif
6886
6887 + .macro pax_enter_kernel_user
6888 +#ifdef CONFIG_PAX_MEMORY_UDEREF
6889 + call pax_enter_kernel_user
6890 +#endif
6891 + .endm
6892 +
6893 + .macro pax_exit_kernel_user
6894 +#ifdef CONFIG_PAX_MEMORY_UDEREF
6895 + call pax_exit_kernel_user
6896 +#endif
6897 +#ifdef CONFIG_PAX_RANDKSTACK
6898 + pushq %rax
6899 + call pax_randomize_kstack
6900 + popq %rax
6901 +#endif
6902 + .endm
6903 +
6904 +.macro pax_erase_kstack
6905 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
6906 + call pax_erase_kstack
6907 +#endif
6908 +.endm
6909 +
6910 /*
6911 * 32bit SYSENTER instruction entry.
6912 *
6913 @@ -119,7 +144,7 @@ ENTRY(ia32_sysenter_target)
6914 CFI_REGISTER rsp,rbp
6915 SWAPGS_UNSAFE_STACK
6916 movq PER_CPU_VAR(kernel_stack), %rsp
6917 - addq $(KERNEL_STACK_OFFSET),%rsp
6918 + pax_enter_kernel_user
6919 /*
6920 * No need to follow this irqs on/off section: the syscall
6921 * disabled irqs, here we enable it straight after entry:
6922 @@ -135,7 +160,8 @@ ENTRY(ia32_sysenter_target)
6923 pushfq
6924 CFI_ADJUST_CFA_OFFSET 8
6925 /*CFI_REL_OFFSET rflags,0*/
6926 - movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
6927 + GET_THREAD_INFO(%r10)
6928 + movl TI_sysenter_return(%r10), %r10d
6929 CFI_REGISTER rip,r10
6930 pushq $__USER32_CS
6931 CFI_ADJUST_CFA_OFFSET 8
6932 @@ -150,6 +176,12 @@ ENTRY(ia32_sysenter_target)
6933 SAVE_ARGS 0,0,1
6934 /* no need to do an access_ok check here because rbp has been
6935 32bit zero extended */
6936 +
6937 +#ifdef CONFIG_PAX_MEMORY_UDEREF
6938 + mov $PAX_USER_SHADOW_BASE,%r10
6939 + add %r10,%rbp
6940 +#endif
6941 +
6942 1: movl (%rbp),%ebp
6943 .section __ex_table,"a"
6944 .quad 1b,ia32_badarg
6945 @@ -172,6 +204,8 @@ sysenter_dispatch:
6946 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
6947 jnz sysexit_audit
6948 sysexit_from_sys_call:
6949 + pax_exit_kernel_user
6950 + pax_erase_kstack
6951 andl $~TS_COMPAT,TI_status(%r10)
6952 /* clear IF, that popfq doesn't enable interrupts early */
6953 andl $~0x200,EFLAGS-R11(%rsp)
6954 @@ -200,6 +234,9 @@ sysexit_from_sys_call:
6955 movl %eax,%esi /* 2nd arg: syscall number */
6956 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
6957 call audit_syscall_entry
6958 +
6959 + pax_erase_kstack
6960 +
6961 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
6962 cmpq $(IA32_NR_syscalls-1),%rax
6963 ja ia32_badsys
6964 @@ -252,6 +289,9 @@ sysenter_tracesys:
6965 movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
6966 movq %rsp,%rdi /* &pt_regs -> arg1 */
6967 call syscall_trace_enter
6968 +
6969 + pax_erase_kstack
6970 +
6971 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
6972 RESTORE_REST
6973 cmpq $(IA32_NR_syscalls-1),%rax
6974 @@ -283,19 +323,24 @@ ENDPROC(ia32_sysenter_target)
6975 ENTRY(ia32_cstar_target)
6976 CFI_STARTPROC32 simple
6977 CFI_SIGNAL_FRAME
6978 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
6979 + CFI_DEF_CFA rsp,0
6980 CFI_REGISTER rip,rcx
6981 /*CFI_REGISTER rflags,r11*/
6982 SWAPGS_UNSAFE_STACK
6983 movl %esp,%r8d
6984 CFI_REGISTER rsp,r8
6985 movq PER_CPU_VAR(kernel_stack),%rsp
6986 +
6987 +#ifdef CONFIG_PAX_MEMORY_UDEREF
6988 + pax_enter_kernel_user
6989 +#endif
6990 +
6991 /*
6992 * No need to follow this irqs on/off section: the syscall
6993 * disabled irqs and here we enable it straight after entry:
6994 */
6995 ENABLE_INTERRUPTS(CLBR_NONE)
6996 - SAVE_ARGS 8,1,1
6997 + SAVE_ARGS 8*6,1,1
6998 movl %eax,%eax /* zero extension */
6999 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
7000 movq %rcx,RIP-ARGOFFSET(%rsp)
7001 @@ -311,6 +356,12 @@ ENTRY(ia32_cstar_target)
7002 /* no need to do an access_ok check here because r8 has been
7003 32bit zero extended */
7004 /* hardware stack frame is complete now */
7005 +
7006 +#ifdef CONFIG_PAX_MEMORY_UDEREF
7007 + mov $PAX_USER_SHADOW_BASE,%r10
7008 + add %r10,%r8
7009 +#endif
7010 +
7011 1: movl (%r8),%r9d
7012 .section __ex_table,"a"
7013 .quad 1b,ia32_badarg
7014 @@ -333,6 +384,8 @@ cstar_dispatch:
7015 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
7016 jnz sysretl_audit
7017 sysretl_from_sys_call:
7018 + pax_exit_kernel_user
7019 + pax_erase_kstack
7020 andl $~TS_COMPAT,TI_status(%r10)
7021 RESTORE_ARGS 1,-ARG_SKIP,1,1,1
7022 movl RIP-ARGOFFSET(%rsp),%ecx
7023 @@ -370,6 +423,9 @@ cstar_tracesys:
7024 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
7025 movq %rsp,%rdi /* &pt_regs -> arg1 */
7026 call syscall_trace_enter
7027 +
7028 + pax_erase_kstack
7029 +
7030 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
7031 RESTORE_REST
7032 xchgl %ebp,%r9d
7033 @@ -415,6 +471,7 @@ ENTRY(ia32_syscall)
7034 CFI_REL_OFFSET rip,RIP-RIP
7035 PARAVIRT_ADJUST_EXCEPTION_FRAME
7036 SWAPGS
7037 + pax_enter_kernel_user
7038 /*
7039 * No need to follow this irqs on/off section: the syscall
7040 * disabled irqs and here we enable it straight after entry:
7041 @@ -448,6 +505,9 @@ ia32_tracesys:
7042 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
7043 movq %rsp,%rdi /* &pt_regs -> arg1 */
7044 call syscall_trace_enter
7045 +
7046 + pax_erase_kstack
7047 +
7048 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
7049 RESTORE_REST
7050 cmpq $(IA32_NR_syscalls-1),%rax
7051 @@ -462,6 +522,7 @@ ia32_badsys:
7052
7053 quiet_ni_syscall:
7054 movq $-ENOSYS,%rax
7055 + pax_force_retaddr
7056 ret
7057 CFI_ENDPROC
7058
7059 diff -urNp linux-2.6.32.49/arch/x86/ia32/ia32_signal.c linux-2.6.32.49/arch/x86/ia32/ia32_signal.c
7060 --- linux-2.6.32.49/arch/x86/ia32/ia32_signal.c 2011-11-08 19:02:43.000000000 -0500
7061 +++ linux-2.6.32.49/arch/x86/ia32/ia32_signal.c 2011-11-15 19:59:42.000000000 -0500
7062 @@ -167,7 +167,7 @@ asmlinkage long sys32_sigaltstack(const
7063 }
7064 seg = get_fs();
7065 set_fs(KERNEL_DS);
7066 - ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp);
7067 + ret = do_sigaltstack(uss_ptr ? (const stack_t __force_user *)&uss : NULL, (stack_t __force_user *)&uoss, regs->sp);
7068 set_fs(seg);
7069 if (ret >= 0 && uoss_ptr) {
7070 if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)))
7071 @@ -374,7 +374,7 @@ static int ia32_setup_sigcontext(struct
7072 */
7073 static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
7074 size_t frame_size,
7075 - void **fpstate)
7076 + void __user **fpstate)
7077 {
7078 unsigned long sp;
7079
7080 @@ -395,7 +395,7 @@ static void __user *get_sigframe(struct
7081
7082 if (used_math()) {
7083 sp = sp - sig_xstate_ia32_size;
7084 - *fpstate = (struct _fpstate_ia32 *) sp;
7085 + *fpstate = (struct _fpstate_ia32 __user *) sp;
7086 if (save_i387_xstate_ia32(*fpstate) < 0)
7087 return (void __user *) -1L;
7088 }
7089 @@ -403,7 +403,7 @@ static void __user *get_sigframe(struct
7090 sp -= frame_size;
7091 /* Align the stack pointer according to the i386 ABI,
7092 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
7093 - sp = ((sp + 4) & -16ul) - 4;
7094 + sp = ((sp - 12) & -16ul) - 4;
7095 return (void __user *) sp;
7096 }
7097
7098 @@ -461,7 +461,7 @@ int ia32_setup_frame(int sig, struct k_s
7099 * These are actually not used anymore, but left because some
7100 * gdb versions depend on them as a marker.
7101 */
7102 - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
7103 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
7104 } put_user_catch(err);
7105
7106 if (err)
7107 @@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct
7108 0xb8,
7109 __NR_ia32_rt_sigreturn,
7110 0x80cd,
7111 - 0,
7112 + 0
7113 };
7114
7115 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
7116 @@ -533,16 +533,18 @@ int ia32_setup_rt_frame(int sig, struct
7117
7118 if (ka->sa.sa_flags & SA_RESTORER)
7119 restorer = ka->sa.sa_restorer;
7120 + else if (current->mm->context.vdso)
7121 + /* Return stub is in 32bit vsyscall page */
7122 + restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
7123 else
7124 - restorer = VDSO32_SYMBOL(current->mm->context.vdso,
7125 - rt_sigreturn);
7126 + restorer = &frame->retcode;
7127 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
7128
7129 /*
7130 * Not actually used anymore, but left because some gdb
7131 * versions need it.
7132 */
7133 - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
7134 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
7135 } put_user_catch(err);
7136
7137 if (err)
7138 diff -urNp linux-2.6.32.49/arch/x86/ia32/sys_ia32.c linux-2.6.32.49/arch/x86/ia32/sys_ia32.c
7139 --- linux-2.6.32.49/arch/x86/ia32/sys_ia32.c 2011-11-08 19:02:43.000000000 -0500
7140 +++ linux-2.6.32.49/arch/x86/ia32/sys_ia32.c 2011-11-15 19:59:42.000000000 -0500
7141 @@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsign
7142 */
7143 static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
7144 {
7145 - typeof(ubuf->st_uid) uid = 0;
7146 - typeof(ubuf->st_gid) gid = 0;
7147 + typeof(((struct stat64 *)0)->st_uid) uid = 0;
7148 + typeof(((struct stat64 *)0)->st_gid) gid = 0;
7149 SET_UID(uid, stat->uid);
7150 SET_GID(gid, stat->gid);
7151 if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) ||
7152 @@ -308,8 +308,8 @@ asmlinkage long sys32_rt_sigprocmask(int
7153 }
7154 set_fs(KERNEL_DS);
7155 ret = sys_rt_sigprocmask(how,
7156 - set ? (sigset_t __user *)&s : NULL,
7157 - oset ? (sigset_t __user *)&s : NULL,
7158 + set ? (sigset_t __force_user *)&s : NULL,
7159 + oset ? (sigset_t __force_user *)&s : NULL,
7160 sigsetsize);
7161 set_fs(old_fs);
7162 if (ret)
7163 @@ -371,7 +371,7 @@ asmlinkage long sys32_sched_rr_get_inter
7164 mm_segment_t old_fs = get_fs();
7165
7166 set_fs(KERNEL_DS);
7167 - ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t);
7168 + ret = sys_sched_rr_get_interval(pid, (struct timespec __force_user *)&t);
7169 set_fs(old_fs);
7170 if (put_compat_timespec(&t, interval))
7171 return -EFAULT;
7172 @@ -387,7 +387,7 @@ asmlinkage long sys32_rt_sigpending(comp
7173 mm_segment_t old_fs = get_fs();
7174
7175 set_fs(KERNEL_DS);
7176 - ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize);
7177 + ret = sys_rt_sigpending((sigset_t __force_user *)&s, sigsetsize);
7178 set_fs(old_fs);
7179 if (!ret) {
7180 switch (_NSIG_WORDS) {
7181 @@ -412,7 +412,7 @@ asmlinkage long sys32_rt_sigqueueinfo(in
7182 if (copy_siginfo_from_user32(&info, uinfo))
7183 return -EFAULT;
7184 set_fs(KERNEL_DS);
7185 - ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __user *)&info);
7186 + ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __force_user *)&info);
7187 set_fs(old_fs);
7188 return ret;
7189 }
7190 @@ -513,7 +513,7 @@ asmlinkage long sys32_sendfile(int out_f
7191 return -EFAULT;
7192
7193 set_fs(KERNEL_DS);
7194 - ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __user *)&of : NULL,
7195 + ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __force_user *)&of : NULL,
7196 count);
7197 set_fs(old_fs);
7198
7199 diff -urNp linux-2.6.32.49/arch/x86/include/asm/alternative-asm.h linux-2.6.32.49/arch/x86/include/asm/alternative-asm.h
7200 --- linux-2.6.32.49/arch/x86/include/asm/alternative-asm.h 2011-11-08 19:02:43.000000000 -0500
7201 +++ linux-2.6.32.49/arch/x86/include/asm/alternative-asm.h 2011-11-15 19:59:42.000000000 -0500
7202 @@ -19,4 +19,18 @@
7203 .endm
7204 #endif
7205
7206 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
7207 + .macro pax_force_retaddr rip=0
7208 + btsq $63,\rip(%rsp)
7209 + .endm
7210 + .macro pax_force_fptr ptr
7211 + btsq $63,\ptr
7212 + .endm
7213 +#else
7214 + .macro pax_force_retaddr rip=0
7215 + .endm
7216 + .macro pax_force_fptr ptr
7217 + .endm
7218 +#endif
7219 +
7220 #endif /* __ASSEMBLY__ */
7221 diff -urNp linux-2.6.32.49/arch/x86/include/asm/alternative.h linux-2.6.32.49/arch/x86/include/asm/alternative.h
7222 --- linux-2.6.32.49/arch/x86/include/asm/alternative.h 2011-11-08 19:02:43.000000000 -0500
7223 +++ linux-2.6.32.49/arch/x86/include/asm/alternative.h 2011-11-15 19:59:42.000000000 -0500
7224 @@ -85,7 +85,7 @@ static inline void alternatives_smp_swit
7225 " .byte 662b-661b\n" /* sourcelen */ \
7226 " .byte 664f-663f\n" /* replacementlen */ \
7227 ".previous\n" \
7228 - ".section .altinstr_replacement, \"ax\"\n" \
7229 + ".section .altinstr_replacement, \"a\"\n" \
7230 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
7231 ".previous"
7232
7233 diff -urNp linux-2.6.32.49/arch/x86/include/asm/apic.h linux-2.6.32.49/arch/x86/include/asm/apic.h
7234 --- linux-2.6.32.49/arch/x86/include/asm/apic.h 2011-11-08 19:02:43.000000000 -0500
7235 +++ linux-2.6.32.49/arch/x86/include/asm/apic.h 2011-11-15 19:59:42.000000000 -0500
7236 @@ -46,7 +46,7 @@ static inline void generic_apic_probe(vo
7237
7238 #ifdef CONFIG_X86_LOCAL_APIC
7239
7240 -extern unsigned int apic_verbosity;
7241 +extern int apic_verbosity;
7242 extern int local_apic_timer_c2_ok;
7243
7244 extern int disable_apic;
7245 diff -urNp linux-2.6.32.49/arch/x86/include/asm/apm.h linux-2.6.32.49/arch/x86/include/asm/apm.h
7246 --- linux-2.6.32.49/arch/x86/include/asm/apm.h 2011-11-08 19:02:43.000000000 -0500
7247 +++ linux-2.6.32.49/arch/x86/include/asm/apm.h 2011-11-15 19:59:42.000000000 -0500
7248 @@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
7249 __asm__ __volatile__(APM_DO_ZERO_SEGS
7250 "pushl %%edi\n\t"
7251 "pushl %%ebp\n\t"
7252 - "lcall *%%cs:apm_bios_entry\n\t"
7253 + "lcall *%%ss:apm_bios_entry\n\t"
7254 "setc %%al\n\t"
7255 "popl %%ebp\n\t"
7256 "popl %%edi\n\t"
7257 @@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
7258 __asm__ __volatile__(APM_DO_ZERO_SEGS
7259 "pushl %%edi\n\t"
7260 "pushl %%ebp\n\t"
7261 - "lcall *%%cs:apm_bios_entry\n\t"
7262 + "lcall *%%ss:apm_bios_entry\n\t"
7263 "setc %%bl\n\t"
7264 "popl %%ebp\n\t"
7265 "popl %%edi\n\t"
7266 diff -urNp linux-2.6.32.49/arch/x86/include/asm/atomic_32.h linux-2.6.32.49/arch/x86/include/asm/atomic_32.h
7267 --- linux-2.6.32.49/arch/x86/include/asm/atomic_32.h 2011-11-08 19:02:43.000000000 -0500
7268 +++ linux-2.6.32.49/arch/x86/include/asm/atomic_32.h 2011-11-15 19:59:42.000000000 -0500
7269 @@ -25,6 +25,17 @@ static inline int atomic_read(const atom
7270 }
7271
7272 /**
7273 + * atomic_read_unchecked - read atomic variable
7274 + * @v: pointer of type atomic_unchecked_t
7275 + *
7276 + * Atomically reads the value of @v.
7277 + */
7278 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
7279 +{
7280 + return v->counter;
7281 +}
7282 +
7283 +/**
7284 * atomic_set - set atomic variable
7285 * @v: pointer of type atomic_t
7286 * @i: required value
7287 @@ -37,6 +48,18 @@ static inline void atomic_set(atomic_t *
7288 }
7289
7290 /**
7291 + * atomic_set_unchecked - set atomic variable
7292 + * @v: pointer of type atomic_unchecked_t
7293 + * @i: required value
7294 + *
7295 + * Atomically sets the value of @v to @i.
7296 + */
7297 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
7298 +{
7299 + v->counter = i;
7300 +}
7301 +
7302 +/**
7303 * atomic_add - add integer to atomic variable
7304 * @i: integer value to add
7305 * @v: pointer of type atomic_t
7306 @@ -45,7 +68,29 @@ static inline void atomic_set(atomic_t *
7307 */
7308 static inline void atomic_add(int i, atomic_t *v)
7309 {
7310 - asm volatile(LOCK_PREFIX "addl %1,%0"
7311 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
7312 +
7313 +#ifdef CONFIG_PAX_REFCOUNT
7314 + "jno 0f\n"
7315 + LOCK_PREFIX "subl %1,%0\n"
7316 + "int $4\n0:\n"
7317 + _ASM_EXTABLE(0b, 0b)
7318 +#endif
7319 +
7320 + : "+m" (v->counter)
7321 + : "ir" (i));
7322 +}
7323 +
7324 +/**
7325 + * atomic_add_unchecked - add integer to atomic variable
7326 + * @i: integer value to add
7327 + * @v: pointer of type atomic_unchecked_t
7328 + *
7329 + * Atomically adds @i to @v.
7330 + */
7331 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
7332 +{
7333 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
7334 : "+m" (v->counter)
7335 : "ir" (i));
7336 }
7337 @@ -59,7 +104,29 @@ static inline void atomic_add(int i, ato
7338 */
7339 static inline void atomic_sub(int i, atomic_t *v)
7340 {
7341 - asm volatile(LOCK_PREFIX "subl %1,%0"
7342 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
7343 +
7344 +#ifdef CONFIG_PAX_REFCOUNT
7345 + "jno 0f\n"
7346 + LOCK_PREFIX "addl %1,%0\n"
7347 + "int $4\n0:\n"
7348 + _ASM_EXTABLE(0b, 0b)
7349 +#endif
7350 +
7351 + : "+m" (v->counter)
7352 + : "ir" (i));
7353 +}
7354 +
7355 +/**
7356 + * atomic_sub_unchecked - subtract integer from atomic variable
7357 + * @i: integer value to subtract
7358 + * @v: pointer of type atomic_unchecked_t
7359 + *
7360 + * Atomically subtracts @i from @v.
7361 + */
7362 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
7363 +{
7364 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
7365 : "+m" (v->counter)
7366 : "ir" (i));
7367 }
7368 @@ -77,7 +144,16 @@ static inline int atomic_sub_and_test(in
7369 {
7370 unsigned char c;
7371
7372 - asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
7373 + asm volatile(LOCK_PREFIX "subl %2,%0\n"
7374 +
7375 +#ifdef CONFIG_PAX_REFCOUNT
7376 + "jno 0f\n"
7377 + LOCK_PREFIX "addl %2,%0\n"
7378 + "int $4\n0:\n"
7379 + _ASM_EXTABLE(0b, 0b)
7380 +#endif
7381 +
7382 + "sete %1\n"
7383 : "+m" (v->counter), "=qm" (c)
7384 : "ir" (i) : "memory");
7385 return c;
7386 @@ -91,7 +167,27 @@ static inline int atomic_sub_and_test(in
7387 */
7388 static inline void atomic_inc(atomic_t *v)
7389 {
7390 - asm volatile(LOCK_PREFIX "incl %0"
7391 + asm volatile(LOCK_PREFIX "incl %0\n"
7392 +
7393 +#ifdef CONFIG_PAX_REFCOUNT
7394 + "jno 0f\n"
7395 + LOCK_PREFIX "decl %0\n"
7396 + "int $4\n0:\n"
7397 + _ASM_EXTABLE(0b, 0b)
7398 +#endif
7399 +
7400 + : "+m" (v->counter));
7401 +}
7402 +
7403 +/**
7404 + * atomic_inc_unchecked - increment atomic variable
7405 + * @v: pointer of type atomic_unchecked_t
7406 + *
7407 + * Atomically increments @v by 1.
7408 + */
7409 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
7410 +{
7411 + asm volatile(LOCK_PREFIX "incl %0\n"
7412 : "+m" (v->counter));
7413 }
7414
7415 @@ -103,7 +199,27 @@ static inline void atomic_inc(atomic_t *
7416 */
7417 static inline void atomic_dec(atomic_t *v)
7418 {
7419 - asm volatile(LOCK_PREFIX "decl %0"
7420 + asm volatile(LOCK_PREFIX "decl %0\n"
7421 +
7422 +#ifdef CONFIG_PAX_REFCOUNT
7423 + "jno 0f\n"
7424 + LOCK_PREFIX "incl %0\n"
7425 + "int $4\n0:\n"
7426 + _ASM_EXTABLE(0b, 0b)
7427 +#endif
7428 +
7429 + : "+m" (v->counter));
7430 +}
7431 +
7432 +/**
7433 + * atomic_dec_unchecked - decrement atomic variable
7434 + * @v: pointer of type atomic_unchecked_t
7435 + *
7436 + * Atomically decrements @v by 1.
7437 + */
7438 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
7439 +{
7440 + asm volatile(LOCK_PREFIX "decl %0\n"
7441 : "+m" (v->counter));
7442 }
7443
7444 @@ -119,7 +235,16 @@ static inline int atomic_dec_and_test(at
7445 {
7446 unsigned char c;
7447
7448 - asm volatile(LOCK_PREFIX "decl %0; sete %1"
7449 + asm volatile(LOCK_PREFIX "decl %0\n"
7450 +
7451 +#ifdef CONFIG_PAX_REFCOUNT
7452 + "jno 0f\n"
7453 + LOCK_PREFIX "incl %0\n"
7454 + "int $4\n0:\n"
7455 + _ASM_EXTABLE(0b, 0b)
7456 +#endif
7457 +
7458 + "sete %1\n"
7459 : "+m" (v->counter), "=qm" (c)
7460 : : "memory");
7461 return c != 0;
7462 @@ -137,7 +262,35 @@ static inline int atomic_inc_and_test(at
7463 {
7464 unsigned char c;
7465
7466 - asm volatile(LOCK_PREFIX "incl %0; sete %1"
7467 + asm volatile(LOCK_PREFIX "incl %0\n"
7468 +
7469 +#ifdef CONFIG_PAX_REFCOUNT
7470 + "jno 0f\n"
7471 + LOCK_PREFIX "decl %0\n"
7472 + "into\n0:\n"
7473 + _ASM_EXTABLE(0b, 0b)
7474 +#endif
7475 +
7476 + "sete %1\n"
7477 + : "+m" (v->counter), "=qm" (c)
7478 + : : "memory");
7479 + return c != 0;
7480 +}
7481 +
7482 +/**
7483 + * atomic_inc_and_test_unchecked - increment and test
7484 + * @v: pointer of type atomic_unchecked_t
7485 + *
7486 + * Atomically increments @v by 1
7487 + * and returns true if the result is zero, or false for all
7488 + * other cases.
7489 + */
7490 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
7491 +{
7492 + unsigned char c;
7493 +
7494 + asm volatile(LOCK_PREFIX "incl %0\n"
7495 + "sete %1\n"
7496 : "+m" (v->counter), "=qm" (c)
7497 : : "memory");
7498 return c != 0;
7499 @@ -156,7 +309,16 @@ static inline int atomic_add_negative(in
7500 {
7501 unsigned char c;
7502
7503 - asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
7504 + asm volatile(LOCK_PREFIX "addl %2,%0\n"
7505 +
7506 +#ifdef CONFIG_PAX_REFCOUNT
7507 + "jno 0f\n"
7508 + LOCK_PREFIX "subl %2,%0\n"
7509 + "int $4\n0:\n"
7510 + _ASM_EXTABLE(0b, 0b)
7511 +#endif
7512 +
7513 + "sets %1\n"
7514 : "+m" (v->counter), "=qm" (c)
7515 : "ir" (i) : "memory");
7516 return c;
7517 @@ -179,6 +341,46 @@ static inline int atomic_add_return(int
7518 #endif
7519 /* Modern 486+ processor */
7520 __i = i;
7521 + asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
7522 +
7523 +#ifdef CONFIG_PAX_REFCOUNT
7524 + "jno 0f\n"
7525 + "movl %0, %1\n"
7526 + "int $4\n0:\n"
7527 + _ASM_EXTABLE(0b, 0b)
7528 +#endif
7529 +
7530 + : "+r" (i), "+m" (v->counter)
7531 + : : "memory");
7532 + return i + __i;
7533 +
7534 +#ifdef CONFIG_M386
7535 +no_xadd: /* Legacy 386 processor */
7536 + local_irq_save(flags);
7537 + __i = atomic_read(v);
7538 + atomic_set(v, i + __i);
7539 + local_irq_restore(flags);
7540 + return i + __i;
7541 +#endif
7542 +}
7543 +
7544 +/**
7545 + * atomic_add_return_unchecked - add integer and return
7546 + * @v: pointer of type atomic_unchecked_t
7547 + * @i: integer value to add
7548 + *
7549 + * Atomically adds @i to @v and returns @i + @v
7550 + */
7551 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
7552 +{
7553 + int __i;
7554 +#ifdef CONFIG_M386
7555 + unsigned long flags;
7556 + if (unlikely(boot_cpu_data.x86 <= 3))
7557 + goto no_xadd;
7558 +#endif
7559 + /* Modern 486+ processor */
7560 + __i = i;
7561 asm volatile(LOCK_PREFIX "xaddl %0, %1"
7562 : "+r" (i), "+m" (v->counter)
7563 : : "memory");
7564 @@ -211,11 +413,21 @@ static inline int atomic_cmpxchg(atomic_
7565 return cmpxchg(&v->counter, old, new);
7566 }
7567
7568 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
7569 +{
7570 + return cmpxchg(&v->counter, old, new);
7571 +}
7572 +
7573 static inline int atomic_xchg(atomic_t *v, int new)
7574 {
7575 return xchg(&v->counter, new);
7576 }
7577
7578 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
7579 +{
7580 + return xchg(&v->counter, new);
7581 +}
7582 +
7583 /**
7584 * atomic_add_unless - add unless the number is already a given value
7585 * @v: pointer of type atomic_t
7586 @@ -227,22 +439,39 @@ static inline int atomic_xchg(atomic_t *
7587 */
7588 static inline int atomic_add_unless(atomic_t *v, int a, int u)
7589 {
7590 - int c, old;
7591 + int c, old, new;
7592 c = atomic_read(v);
7593 for (;;) {
7594 - if (unlikely(c == (u)))
7595 + if (unlikely(c == u))
7596 break;
7597 - old = atomic_cmpxchg((v), c, c + (a));
7598 +
7599 + asm volatile("addl %2,%0\n"
7600 +
7601 +#ifdef CONFIG_PAX_REFCOUNT
7602 + "jno 0f\n"
7603 + "subl %2,%0\n"
7604 + "int $4\n0:\n"
7605 + _ASM_EXTABLE(0b, 0b)
7606 +#endif
7607 +
7608 + : "=r" (new)
7609 + : "0" (c), "ir" (a));
7610 +
7611 + old = atomic_cmpxchg(v, c, new);
7612 if (likely(old == c))
7613 break;
7614 c = old;
7615 }
7616 - return c != (u);
7617 + return c != u;
7618 }
7619
7620 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
7621
7622 #define atomic_inc_return(v) (atomic_add_return(1, v))
7623 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
7624 +{
7625 + return atomic_add_return_unchecked(1, v);
7626 +}
7627 #define atomic_dec_return(v) (atomic_sub_return(1, v))
7628
7629 /* These are x86-specific, used by some header files */
7630 @@ -266,9 +495,18 @@ typedef struct {
7631 u64 __aligned(8) counter;
7632 } atomic64_t;
7633
7634 +#ifdef CONFIG_PAX_REFCOUNT
7635 +typedef struct {
7636 + u64 __aligned(8) counter;
7637 +} atomic64_unchecked_t;
7638 +#else
7639 +typedef atomic64_t atomic64_unchecked_t;
7640 +#endif
7641 +
7642 #define ATOMIC64_INIT(val) { (val) }
7643
7644 extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
7645 +extern u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old_val, u64 new_val);
7646
7647 /**
7648 * atomic64_xchg - xchg atomic64 variable
7649 @@ -279,6 +517,7 @@ extern u64 atomic64_cmpxchg(atomic64_t *
7650 * the old value.
7651 */
7652 extern u64 atomic64_xchg(atomic64_t *ptr, u64 new_val);
7653 +extern u64 atomic64_xchg_unchecked(atomic64_unchecked_t *ptr, u64 new_val);
7654
7655 /**
7656 * atomic64_set - set atomic64 variable
7657 @@ -290,6 +529,15 @@ extern u64 atomic64_xchg(atomic64_t *ptr
7658 extern void atomic64_set(atomic64_t *ptr, u64 new_val);
7659
7660 /**
7661 + * atomic64_unchecked_set - set atomic64 variable
7662 + * @ptr: pointer to type atomic64_unchecked_t
7663 + * @new_val: value to assign
7664 + *
7665 + * Atomically sets the value of @ptr to @new_val.
7666 + */
7667 +extern void atomic64_set_unchecked(atomic64_unchecked_t *ptr, u64 new_val);
7668 +
7669 +/**
7670 * atomic64_read - read atomic64 variable
7671 * @ptr: pointer to type atomic64_t
7672 *
7673 @@ -317,7 +565,33 @@ static inline u64 atomic64_read(atomic64
7674 return res;
7675 }
7676
7677 -extern u64 atomic64_read(atomic64_t *ptr);
7678 +/**
7679 + * atomic64_read_unchecked - read atomic64 variable
7680 + * @ptr: pointer to type atomic64_unchecked_t
7681 + *
7682 + * Atomically reads the value of @ptr and returns it.
7683 + */
7684 +static inline u64 atomic64_read_unchecked(atomic64_unchecked_t *ptr)
7685 +{
7686 + u64 res;
7687 +
7688 + /*
7689 + * Note, we inline this atomic64_unchecked_t primitive because
7690 + * it only clobbers EAX/EDX and leaves the others
7691 + * untouched. We also (somewhat subtly) rely on the
7692 + * fact that cmpxchg8b returns the current 64-bit value
7693 + * of the memory location we are touching:
7694 + */
7695 + asm volatile(
7696 + "mov %%ebx, %%eax\n\t"
7697 + "mov %%ecx, %%edx\n\t"
7698 + LOCK_PREFIX "cmpxchg8b %1\n"
7699 + : "=&A" (res)
7700 + : "m" (*ptr)
7701 + );
7702 +
7703 + return res;
7704 +}
7705
7706 /**
7707 * atomic64_add_return - add and return
7708 @@ -332,8 +606,11 @@ extern u64 atomic64_add_return(u64 delta
7709 * Other variants with different arithmetic operators:
7710 */
7711 extern u64 atomic64_sub_return(u64 delta, atomic64_t *ptr);
7712 +extern u64 atomic64_sub_return_unchecked(u64 delta, atomic64_unchecked_t *ptr);
7713 extern u64 atomic64_inc_return(atomic64_t *ptr);
7714 +extern u64 atomic64_inc_return_unchecked(atomic64_unchecked_t *ptr);
7715 extern u64 atomic64_dec_return(atomic64_t *ptr);
7716 +extern u64 atomic64_dec_return_unchecked(atomic64_unchecked_t *ptr);
7717
7718 /**
7719 * atomic64_add - add integer to atomic64 variable
7720 @@ -345,6 +622,15 @@ extern u64 atomic64_dec_return(atomic64_
7721 extern void atomic64_add(u64 delta, atomic64_t *ptr);
7722
7723 /**
7724 + * atomic64_add_unchecked - add integer to atomic64 variable
7725 + * @delta: integer value to add
7726 + * @ptr: pointer to type atomic64_unchecked_t
7727 + *
7728 + * Atomically adds @delta to @ptr.
7729 + */
7730 +extern void atomic64_add_unchecked(u64 delta, atomic64_unchecked_t *ptr);
7731 +
7732 +/**
7733 * atomic64_sub - subtract the atomic64 variable
7734 * @delta: integer value to subtract
7735 * @ptr: pointer to type atomic64_t
7736 @@ -354,6 +640,15 @@ extern void atomic64_add(u64 delta, atom
7737 extern void atomic64_sub(u64 delta, atomic64_t *ptr);
7738
7739 /**
7740 + * atomic64_sub_unchecked - subtract the atomic64 variable
7741 + * @delta: integer value to subtract
7742 + * @ptr: pointer to type atomic64_unchecked_t
7743 + *
7744 + * Atomically subtracts @delta from @ptr.
7745 + */
7746 +extern void atomic64_sub_unchecked(u64 delta, atomic64_unchecked_t *ptr);
7747 +
7748 +/**
7749 * atomic64_sub_and_test - subtract value from variable and test result
7750 * @delta: integer value to subtract
7751 * @ptr: pointer to type atomic64_t
7752 @@ -373,6 +668,14 @@ extern int atomic64_sub_and_test(u64 del
7753 extern void atomic64_inc(atomic64_t *ptr);
7754
7755 /**
7756 + * atomic64_inc_unchecked - increment atomic64 variable
7757 + * @ptr: pointer to type atomic64_unchecked_t
7758 + *
7759 + * Atomically increments @ptr by 1.
7760 + */
7761 +extern void atomic64_inc_unchecked(atomic64_unchecked_t *ptr);
7762 +
7763 +/**
7764 * atomic64_dec - decrement atomic64 variable
7765 * @ptr: pointer to type atomic64_t
7766 *
7767 @@ -381,6 +684,14 @@ extern void atomic64_inc(atomic64_t *ptr
7768 extern void atomic64_dec(atomic64_t *ptr);
7769
7770 /**
7771 + * atomic64_dec_unchecked - decrement atomic64 variable
7772 + * @ptr: pointer to type atomic64_unchecked_t
7773 + *
7774 + * Atomically decrements @ptr by 1.
7775 + */
7776 +extern void atomic64_dec_unchecked(atomic64_unchecked_t *ptr);
7777 +
7778 +/**
7779 * atomic64_dec_and_test - decrement and test
7780 * @ptr: pointer to type atomic64_t
7781 *
7782 diff -urNp linux-2.6.32.49/arch/x86/include/asm/atomic_64.h linux-2.6.32.49/arch/x86/include/asm/atomic_64.h
7783 --- linux-2.6.32.49/arch/x86/include/asm/atomic_64.h 2011-11-08 19:02:43.000000000 -0500
7784 +++ linux-2.6.32.49/arch/x86/include/asm/atomic_64.h 2011-11-15 19:59:42.000000000 -0500
7785 @@ -24,6 +24,17 @@ static inline int atomic_read(const atom
7786 }
7787
7788 /**
7789 + * atomic_read_unchecked - read atomic variable
7790 + * @v: pointer of type atomic_unchecked_t
7791 + *
7792 + * Atomically reads the value of @v.
7793 + */
7794 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
7795 +{
7796 + return v->counter;
7797 +}
7798 +
7799 +/**
7800 * atomic_set - set atomic variable
7801 * @v: pointer of type atomic_t
7802 * @i: required value
7803 @@ -36,6 +47,18 @@ static inline void atomic_set(atomic_t *
7804 }
7805
7806 /**
7807 + * atomic_set_unchecked - set atomic variable
7808 + * @v: pointer of type atomic_unchecked_t
7809 + * @i: required value
7810 + *
7811 + * Atomically sets the value of @v to @i.
7812 + */
7813 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
7814 +{
7815 + v->counter = i;
7816 +}
7817 +
7818 +/**
7819 * atomic_add - add integer to atomic variable
7820 * @i: integer value to add
7821 * @v: pointer of type atomic_t
7822 @@ -44,7 +67,29 @@ static inline void atomic_set(atomic_t *
7823 */
7824 static inline void atomic_add(int i, atomic_t *v)
7825 {
7826 - asm volatile(LOCK_PREFIX "addl %1,%0"
7827 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
7828 +
7829 +#ifdef CONFIG_PAX_REFCOUNT
7830 + "jno 0f\n"
7831 + LOCK_PREFIX "subl %1,%0\n"
7832 + "int $4\n0:\n"
7833 + _ASM_EXTABLE(0b, 0b)
7834 +#endif
7835 +
7836 + : "=m" (v->counter)
7837 + : "ir" (i), "m" (v->counter));
7838 +}
7839 +
7840 +/**
7841 + * atomic_add_unchecked - add integer to atomic variable
7842 + * @i: integer value to add
7843 + * @v: pointer of type atomic_unchecked_t
7844 + *
7845 + * Atomically adds @i to @v.
7846 + */
7847 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
7848 +{
7849 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
7850 : "=m" (v->counter)
7851 : "ir" (i), "m" (v->counter));
7852 }
7853 @@ -58,7 +103,29 @@ static inline void atomic_add(int i, ato
7854 */
7855 static inline void atomic_sub(int i, atomic_t *v)
7856 {
7857 - asm volatile(LOCK_PREFIX "subl %1,%0"
7858 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
7859 +
7860 +#ifdef CONFIG_PAX_REFCOUNT
7861 + "jno 0f\n"
7862 + LOCK_PREFIX "addl %1,%0\n"
7863 + "int $4\n0:\n"
7864 + _ASM_EXTABLE(0b, 0b)
7865 +#endif
7866 +
7867 + : "=m" (v->counter)
7868 + : "ir" (i), "m" (v->counter));
7869 +}
7870 +
7871 +/**
7872 + * atomic_sub_unchecked - subtract the atomic variable
7873 + * @i: integer value to subtract
7874 + * @v: pointer of type atomic_unchecked_t
7875 + *
7876 + * Atomically subtracts @i from @v.
7877 + */
7878 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
7879 +{
7880 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
7881 : "=m" (v->counter)
7882 : "ir" (i), "m" (v->counter));
7883 }
7884 @@ -76,7 +143,16 @@ static inline int atomic_sub_and_test(in
7885 {
7886 unsigned char c;
7887
7888 - asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
7889 + asm volatile(LOCK_PREFIX "subl %2,%0\n"
7890 +
7891 +#ifdef CONFIG_PAX_REFCOUNT
7892 + "jno 0f\n"
7893 + LOCK_PREFIX "addl %2,%0\n"
7894 + "int $4\n0:\n"
7895 + _ASM_EXTABLE(0b, 0b)
7896 +#endif
7897 +
7898 + "sete %1\n"
7899 : "=m" (v->counter), "=qm" (c)
7900 : "ir" (i), "m" (v->counter) : "memory");
7901 return c;
7902 @@ -90,7 +166,28 @@ static inline int atomic_sub_and_test(in
7903 */
7904 static inline void atomic_inc(atomic_t *v)
7905 {
7906 - asm volatile(LOCK_PREFIX "incl %0"
7907 + asm volatile(LOCK_PREFIX "incl %0\n"
7908 +
7909 +#ifdef CONFIG_PAX_REFCOUNT
7910 + "jno 0f\n"
7911 + LOCK_PREFIX "decl %0\n"
7912 + "int $4\n0:\n"
7913 + _ASM_EXTABLE(0b, 0b)
7914 +#endif
7915 +
7916 + : "=m" (v->counter)
7917 + : "m" (v->counter));
7918 +}
7919 +
7920 +/**
7921 + * atomic_inc_unchecked - increment atomic variable
7922 + * @v: pointer of type atomic_unchecked_t
7923 + *
7924 + * Atomically increments @v by 1.
7925 + */
7926 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
7927 +{
7928 + asm volatile(LOCK_PREFIX "incl %0\n"
7929 : "=m" (v->counter)
7930 : "m" (v->counter));
7931 }
7932 @@ -103,7 +200,28 @@ static inline void atomic_inc(atomic_t *
7933 */
7934 static inline void atomic_dec(atomic_t *v)
7935 {
7936 - asm volatile(LOCK_PREFIX "decl %0"
7937 + asm volatile(LOCK_PREFIX "decl %0\n"
7938 +
7939 +#ifdef CONFIG_PAX_REFCOUNT
7940 + "jno 0f\n"
7941 + LOCK_PREFIX "incl %0\n"
7942 + "int $4\n0:\n"
7943 + _ASM_EXTABLE(0b, 0b)
7944 +#endif
7945 +
7946 + : "=m" (v->counter)
7947 + : "m" (v->counter));
7948 +}
7949 +
7950 +/**
7951 + * atomic_dec_unchecked - decrement atomic variable
7952 + * @v: pointer of type atomic_unchecked_t
7953 + *
7954 + * Atomically decrements @v by 1.
7955 + */
7956 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
7957 +{
7958 + asm volatile(LOCK_PREFIX "decl %0\n"
7959 : "=m" (v->counter)
7960 : "m" (v->counter));
7961 }
7962 @@ -120,7 +238,16 @@ static inline int atomic_dec_and_test(at
7963 {
7964 unsigned char c;
7965
7966 - asm volatile(LOCK_PREFIX "decl %0; sete %1"
7967 + asm volatile(LOCK_PREFIX "decl %0\n"
7968 +
7969 +#ifdef CONFIG_PAX_REFCOUNT
7970 + "jno 0f\n"
7971 + LOCK_PREFIX "incl %0\n"
7972 + "int $4\n0:\n"
7973 + _ASM_EXTABLE(0b, 0b)
7974 +#endif
7975 +
7976 + "sete %1\n"
7977 : "=m" (v->counter), "=qm" (c)
7978 : "m" (v->counter) : "memory");
7979 return c != 0;
7980 @@ -138,7 +265,35 @@ static inline int atomic_inc_and_test(at
7981 {
7982 unsigned char c;
7983
7984 - asm volatile(LOCK_PREFIX "incl %0; sete %1"
7985 + asm volatile(LOCK_PREFIX "incl %0\n"
7986 +
7987 +#ifdef CONFIG_PAX_REFCOUNT
7988 + "jno 0f\n"
7989 + LOCK_PREFIX "decl %0\n"
7990 + "int $4\n0:\n"
7991 + _ASM_EXTABLE(0b, 0b)
7992 +#endif
7993 +
7994 + "sete %1\n"
7995 + : "=m" (v->counter), "=qm" (c)
7996 + : "m" (v->counter) : "memory");
7997 + return c != 0;
7998 +}
7999 +
8000 +/**
8001 + * atomic_inc_and_test_unchecked - increment and test
8002 + * @v: pointer of type atomic_unchecked_t
8003 + *
8004 + * Atomically increments @v by 1
8005 + * and returns true if the result is zero, or false for all
8006 + * other cases.
8007 + */
8008 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
8009 +{
8010 + unsigned char c;
8011 +
8012 + asm volatile(LOCK_PREFIX "incl %0\n"
8013 + "sete %1\n"
8014 : "=m" (v->counter), "=qm" (c)
8015 : "m" (v->counter) : "memory");
8016 return c != 0;
8017 @@ -157,7 +312,16 @@ static inline int atomic_add_negative(in
8018 {
8019 unsigned char c;
8020
8021 - asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
8022 + asm volatile(LOCK_PREFIX "addl %2,%0\n"
8023 +
8024 +#ifdef CONFIG_PAX_REFCOUNT
8025 + "jno 0f\n"
8026 + LOCK_PREFIX "subl %2,%0\n"
8027 + "int $4\n0:\n"
8028 + _ASM_EXTABLE(0b, 0b)
8029 +#endif
8030 +
8031 + "sets %1\n"
8032 : "=m" (v->counter), "=qm" (c)
8033 : "ir" (i), "m" (v->counter) : "memory");
8034 return c;
8035 @@ -173,7 +337,31 @@ static inline int atomic_add_negative(in
8036 static inline int atomic_add_return(int i, atomic_t *v)
8037 {
8038 int __i = i;
8039 - asm volatile(LOCK_PREFIX "xaddl %0, %1"
8040 + asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
8041 +
8042 +#ifdef CONFIG_PAX_REFCOUNT
8043 + "jno 0f\n"
8044 + "movl %0, %1\n"
8045 + "int $4\n0:\n"
8046 + _ASM_EXTABLE(0b, 0b)
8047 +#endif
8048 +
8049 + : "+r" (i), "+m" (v->counter)
8050 + : : "memory");
8051 + return i + __i;
8052 +}
8053 +
8054 +/**
8055 + * atomic_add_return_unchecked - add and return
8056 + * @i: integer value to add
8057 + * @v: pointer of type atomic_unchecked_t
8058 + *
8059 + * Atomically adds @i to @v and returns @i + @v
8060 + */
8061 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
8062 +{
8063 + int __i = i;
8064 + asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
8065 : "+r" (i), "+m" (v->counter)
8066 : : "memory");
8067 return i + __i;
8068 @@ -185,6 +373,10 @@ static inline int atomic_sub_return(int
8069 }
8070
8071 #define atomic_inc_return(v) (atomic_add_return(1, v))
8072 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
8073 +{
8074 + return atomic_add_return_unchecked(1, v);
8075 +}
8076 #define atomic_dec_return(v) (atomic_sub_return(1, v))
8077
8078 /* The 64-bit atomic type */
8079 @@ -204,6 +396,18 @@ static inline long atomic64_read(const a
8080 }
8081
8082 /**
8083 + * atomic64_read_unchecked - read atomic64 variable
8084 + * @v: pointer of type atomic64_unchecked_t
8085 + *
8086 + * Atomically reads the value of @v.
8087 + * Doesn't imply a read memory barrier.
8088 + */
8089 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
8090 +{
8091 + return v->counter;
8092 +}
8093 +
8094 +/**
8095 * atomic64_set - set atomic64 variable
8096 * @v: pointer to type atomic64_t
8097 * @i: required value
8098 @@ -216,6 +420,18 @@ static inline void atomic64_set(atomic64
8099 }
8100
8101 /**
8102 + * atomic64_set_unchecked - set atomic64 variable
8103 + * @v: pointer to type atomic64_unchecked_t
8104 + * @i: required value
8105 + *
8106 + * Atomically sets the value of @v to @i.
8107 + */
8108 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
8109 +{
8110 + v->counter = i;
8111 +}
8112 +
8113 +/**
8114 * atomic64_add - add integer to atomic64 variable
8115 * @i: integer value to add
8116 * @v: pointer to type atomic64_t
8117 @@ -224,6 +440,28 @@ static inline void atomic64_set(atomic64
8118 */
8119 static inline void atomic64_add(long i, atomic64_t *v)
8120 {
8121 + asm volatile(LOCK_PREFIX "addq %1,%0\n"
8122 +
8123 +#ifdef CONFIG_PAX_REFCOUNT
8124 + "jno 0f\n"
8125 + LOCK_PREFIX "subq %1,%0\n"
8126 + "int $4\n0:\n"
8127 + _ASM_EXTABLE(0b, 0b)
8128 +#endif
8129 +
8130 + : "=m" (v->counter)
8131 + : "er" (i), "m" (v->counter));
8132 +}
8133 +
8134 +/**
8135 + * atomic64_add_unchecked - add integer to atomic64 variable
8136 + * @i: integer value to add
8137 + * @v: pointer to type atomic64_unchecked_t
8138 + *
8139 + * Atomically adds @i to @v.
8140 + */
8141 +static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
8142 +{
8143 asm volatile(LOCK_PREFIX "addq %1,%0"
8144 : "=m" (v->counter)
8145 : "er" (i), "m" (v->counter));
8146 @@ -238,7 +476,15 @@ static inline void atomic64_add(long i,
8147 */
8148 static inline void atomic64_sub(long i, atomic64_t *v)
8149 {
8150 - asm volatile(LOCK_PREFIX "subq %1,%0"
8151 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
8152 +
8153 +#ifdef CONFIG_PAX_REFCOUNT
8154 + "jno 0f\n"
8155 + LOCK_PREFIX "addq %1,%0\n"
8156 + "int $4\n0:\n"
8157 + _ASM_EXTABLE(0b, 0b)
8158 +#endif
8159 +
8160 : "=m" (v->counter)
8161 : "er" (i), "m" (v->counter));
8162 }
8163 @@ -256,7 +502,16 @@ static inline int atomic64_sub_and_test(
8164 {
8165 unsigned char c;
8166
8167 - asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
8168 + asm volatile(LOCK_PREFIX "subq %2,%0\n"
8169 +
8170 +#ifdef CONFIG_PAX_REFCOUNT
8171 + "jno 0f\n"
8172 + LOCK_PREFIX "addq %2,%0\n"
8173 + "int $4\n0:\n"
8174 + _ASM_EXTABLE(0b, 0b)
8175 +#endif
8176 +
8177 + "sete %1\n"
8178 : "=m" (v->counter), "=qm" (c)
8179 : "er" (i), "m" (v->counter) : "memory");
8180 return c;
8181 @@ -270,6 +525,27 @@ static inline int atomic64_sub_and_test(
8182 */
8183 static inline void atomic64_inc(atomic64_t *v)
8184 {
8185 + asm volatile(LOCK_PREFIX "incq %0\n"
8186 +
8187 +#ifdef CONFIG_PAX_REFCOUNT
8188 + "jno 0f\n"
8189 + LOCK_PREFIX "decq %0\n"
8190 + "int $4\n0:\n"
8191 + _ASM_EXTABLE(0b, 0b)
8192 +#endif
8193 +
8194 + : "=m" (v->counter)
8195 + : "m" (v->counter));
8196 +}
8197 +
8198 +/**
8199 + * atomic64_inc_unchecked - increment atomic64 variable
8200 + * @v: pointer to type atomic64_unchecked_t
8201 + *
8202 + * Atomically increments @v by 1.
8203 + */
8204 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
8205 +{
8206 asm volatile(LOCK_PREFIX "incq %0"
8207 : "=m" (v->counter)
8208 : "m" (v->counter));
8209 @@ -283,7 +559,28 @@ static inline void atomic64_inc(atomic64
8210 */
8211 static inline void atomic64_dec(atomic64_t *v)
8212 {
8213 - asm volatile(LOCK_PREFIX "decq %0"
8214 + asm volatile(LOCK_PREFIX "decq %0\n"
8215 +
8216 +#ifdef CONFIG_PAX_REFCOUNT
8217 + "jno 0f\n"
8218 + LOCK_PREFIX "incq %0\n"
8219 + "int $4\n0:\n"
8220 + _ASM_EXTABLE(0b, 0b)
8221 +#endif
8222 +
8223 + : "=m" (v->counter)
8224 + : "m" (v->counter));
8225 +}
8226 +
8227 +/**
8228 + * atomic64_dec_unchecked - decrement atomic64 variable
8229 + * @v: pointer to type atomic64_t
8230 + *
8231 + * Atomically decrements @v by 1.
8232 + */
8233 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
8234 +{
8235 + asm volatile(LOCK_PREFIX "decq %0\n"
8236 : "=m" (v->counter)
8237 : "m" (v->counter));
8238 }
8239 @@ -300,7 +597,16 @@ static inline int atomic64_dec_and_test(
8240 {
8241 unsigned char c;
8242
8243 - asm volatile(LOCK_PREFIX "decq %0; sete %1"
8244 + asm volatile(LOCK_PREFIX "decq %0\n"
8245 +
8246 +#ifdef CONFIG_PAX_REFCOUNT
8247 + "jno 0f\n"
8248 + LOCK_PREFIX "incq %0\n"
8249 + "int $4\n0:\n"
8250 + _ASM_EXTABLE(0b, 0b)
8251 +#endif
8252 +
8253 + "sete %1\n"
8254 : "=m" (v->counter), "=qm" (c)
8255 : "m" (v->counter) : "memory");
8256 return c != 0;
8257 @@ -318,7 +624,16 @@ static inline int atomic64_inc_and_test(
8258 {
8259 unsigned char c;
8260
8261 - asm volatile(LOCK_PREFIX "incq %0; sete %1"
8262 + asm volatile(LOCK_PREFIX "incq %0\n"
8263 +
8264 +#ifdef CONFIG_PAX_REFCOUNT
8265 + "jno 0f\n"
8266 + LOCK_PREFIX "decq %0\n"
8267 + "int $4\n0:\n"
8268 + _ASM_EXTABLE(0b, 0b)
8269 +#endif
8270 +
8271 + "sete %1\n"
8272 : "=m" (v->counter), "=qm" (c)
8273 : "m" (v->counter) : "memory");
8274 return c != 0;
8275 @@ -337,7 +652,16 @@ static inline int atomic64_add_negative(
8276 {
8277 unsigned char c;
8278
8279 - asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
8280 + asm volatile(LOCK_PREFIX "addq %2,%0\n"
8281 +
8282 +#ifdef CONFIG_PAX_REFCOUNT
8283 + "jno 0f\n"
8284 + LOCK_PREFIX "subq %2,%0\n"
8285 + "int $4\n0:\n"
8286 + _ASM_EXTABLE(0b, 0b)
8287 +#endif
8288 +
8289 + "sets %1\n"
8290 : "=m" (v->counter), "=qm" (c)
8291 : "er" (i), "m" (v->counter) : "memory");
8292 return c;
8293 @@ -353,7 +677,31 @@ static inline int atomic64_add_negative(
8294 static inline long atomic64_add_return(long i, atomic64_t *v)
8295 {
8296 long __i = i;
8297 - asm volatile(LOCK_PREFIX "xaddq %0, %1;"
8298 + asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
8299 +
8300 +#ifdef CONFIG_PAX_REFCOUNT
8301 + "jno 0f\n"
8302 + "movq %0, %1\n"
8303 + "int $4\n0:\n"
8304 + _ASM_EXTABLE(0b, 0b)
8305 +#endif
8306 +
8307 + : "+r" (i), "+m" (v->counter)
8308 + : : "memory");
8309 + return i + __i;
8310 +}
8311 +
8312 +/**
8313 + * atomic64_add_return_unchecked - add and return
8314 + * @i: integer value to add
8315 + * @v: pointer to type atomic64_unchecked_t
8316 + *
8317 + * Atomically adds @i to @v and returns @i + @v
8318 + */
8319 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
8320 +{
8321 + long __i = i;
8322 + asm volatile(LOCK_PREFIX "xaddq %0, %1"
8323 : "+r" (i), "+m" (v->counter)
8324 : : "memory");
8325 return i + __i;
8326 @@ -365,6 +713,10 @@ static inline long atomic64_sub_return(l
8327 }
8328
8329 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
8330 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
8331 +{
8332 + return atomic64_add_return_unchecked(1, v);
8333 +}
8334 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
8335
8336 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
8337 @@ -372,21 +724,41 @@ static inline long atomic64_cmpxchg(atom
8338 return cmpxchg(&v->counter, old, new);
8339 }
8340
8341 +static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
8342 +{
8343 + return cmpxchg(&v->counter, old, new);
8344 +}
8345 +
8346 static inline long atomic64_xchg(atomic64_t *v, long new)
8347 {
8348 return xchg(&v->counter, new);
8349 }
8350
8351 +static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
8352 +{
8353 + return xchg(&v->counter, new);
8354 +}
8355 +
8356 static inline long atomic_cmpxchg(atomic_t *v, int old, int new)
8357 {
8358 return cmpxchg(&v->counter, old, new);
8359 }
8360
8361 +static inline long atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
8362 +{
8363 + return cmpxchg(&v->counter, old, new);
8364 +}
8365 +
8366 static inline long atomic_xchg(atomic_t *v, int new)
8367 {
8368 return xchg(&v->counter, new);
8369 }
8370
8371 +static inline long atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
8372 +{
8373 + return xchg(&v->counter, new);
8374 +}
8375 +
8376 /**
8377 * atomic_add_unless - add unless the number is a given value
8378 * @v: pointer of type atomic_t
8379 @@ -398,17 +770,30 @@ static inline long atomic_xchg(atomic_t
8380 */
8381 static inline int atomic_add_unless(atomic_t *v, int a, int u)
8382 {
8383 - int c, old;
8384 + int c, old, new;
8385 c = atomic_read(v);
8386 for (;;) {
8387 - if (unlikely(c == (u)))
8388 + if (unlikely(c == u))
8389 break;
8390 - old = atomic_cmpxchg((v), c, c + (a));
8391 +
8392 + asm volatile("addl %2,%0\n"
8393 +
8394 +#ifdef CONFIG_PAX_REFCOUNT
8395 + "jno 0f\n"
8396 + "subl %2,%0\n"
8397 + "int $4\n0:\n"
8398 + _ASM_EXTABLE(0b, 0b)
8399 +#endif
8400 +
8401 + : "=r" (new)
8402 + : "0" (c), "ir" (a));
8403 +
8404 + old = atomic_cmpxchg(v, c, new);
8405 if (likely(old == c))
8406 break;
8407 c = old;
8408 }
8409 - return c != (u);
8410 + return c != u;
8411 }
8412
8413 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
8414 @@ -424,17 +809,30 @@ static inline int atomic_add_unless(atom
8415 */
8416 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
8417 {
8418 - long c, old;
8419 + long c, old, new;
8420 c = atomic64_read(v);
8421 for (;;) {
8422 - if (unlikely(c == (u)))
8423 + if (unlikely(c == u))
8424 break;
8425 - old = atomic64_cmpxchg((v), c, c + (a));
8426 +
8427 + asm volatile("addq %2,%0\n"
8428 +
8429 +#ifdef CONFIG_PAX_REFCOUNT
8430 + "jno 0f\n"
8431 + "subq %2,%0\n"
8432 + "int $4\n0:\n"
8433 + _ASM_EXTABLE(0b, 0b)
8434 +#endif
8435 +
8436 + : "=r" (new)
8437 + : "0" (c), "er" (a));
8438 +
8439 + old = atomic64_cmpxchg(v, c, new);
8440 if (likely(old == c))
8441 break;
8442 c = old;
8443 }
8444 - return c != (u);
8445 + return c != u;
8446 }
8447
8448 /**
8449 diff -urNp linux-2.6.32.49/arch/x86/include/asm/bitops.h linux-2.6.32.49/arch/x86/include/asm/bitops.h
8450 --- linux-2.6.32.49/arch/x86/include/asm/bitops.h 2011-11-08 19:02:43.000000000 -0500
8451 +++ linux-2.6.32.49/arch/x86/include/asm/bitops.h 2011-11-15 19:59:42.000000000 -0500
8452 @@ -38,7 +38,7 @@
8453 * a mask operation on a byte.
8454 */
8455 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
8456 -#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
8457 +#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
8458 #define CONST_MASK(nr) (1 << ((nr) & 7))
8459
8460 /**
8461 diff -urNp linux-2.6.32.49/arch/x86/include/asm/boot.h linux-2.6.32.49/arch/x86/include/asm/boot.h
8462 --- linux-2.6.32.49/arch/x86/include/asm/boot.h 2011-11-08 19:02:43.000000000 -0500
8463 +++ linux-2.6.32.49/arch/x86/include/asm/boot.h 2011-11-15 19:59:42.000000000 -0500
8464 @@ -11,10 +11,15 @@
8465 #include <asm/pgtable_types.h>
8466
8467 /* Physical address where kernel should be loaded. */
8468 -#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
8469 +#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
8470 + (CONFIG_PHYSICAL_ALIGN - 1)) \
8471 & ~(CONFIG_PHYSICAL_ALIGN - 1))
8472
8473 +#ifndef __ASSEMBLY__
8474 +extern unsigned char __LOAD_PHYSICAL_ADDR[];
8475 +#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
8476 +#endif
8477 +
8478 /* Minimum kernel alignment, as a power of two */
8479 #ifdef CONFIG_X86_64
8480 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
8481 diff -urNp linux-2.6.32.49/arch/x86/include/asm/cacheflush.h linux-2.6.32.49/arch/x86/include/asm/cacheflush.h
8482 --- linux-2.6.32.49/arch/x86/include/asm/cacheflush.h 2011-11-08 19:02:43.000000000 -0500
8483 +++ linux-2.6.32.49/arch/x86/include/asm/cacheflush.h 2011-11-15 19:59:42.000000000 -0500
8484 @@ -60,7 +60,7 @@ PAGEFLAG(WC, WC)
8485 static inline unsigned long get_page_memtype(struct page *pg)
8486 {
8487 if (!PageUncached(pg) && !PageWC(pg))
8488 - return -1;
8489 + return ~0UL;
8490 else if (!PageUncached(pg) && PageWC(pg))
8491 return _PAGE_CACHE_WC;
8492 else if (PageUncached(pg) && !PageWC(pg))
8493 @@ -85,7 +85,7 @@ static inline void set_page_memtype(stru
8494 SetPageWC(pg);
8495 break;
8496 default:
8497 - case -1:
8498 + case ~0UL:
8499 ClearPageUncached(pg);
8500 ClearPageWC(pg);
8501 break;
8502 diff -urNp linux-2.6.32.49/arch/x86/include/asm/cache.h linux-2.6.32.49/arch/x86/include/asm/cache.h
8503 --- linux-2.6.32.49/arch/x86/include/asm/cache.h 2011-11-08 19:02:43.000000000 -0500
8504 +++ linux-2.6.32.49/arch/x86/include/asm/cache.h 2011-11-15 19:59:42.000000000 -0500
8505 @@ -5,9 +5,10 @@
8506
8507 /* L1 cache line size */
8508 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
8509 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
8510 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
8511
8512 #define __read_mostly __attribute__((__section__(".data.read_mostly")))
8513 +#define __read_only __attribute__((__section__(".data.read_only")))
8514
8515 #ifdef CONFIG_X86_VSMP
8516 /* vSMP Internode cacheline shift */
8517 diff -urNp linux-2.6.32.49/arch/x86/include/asm/calling.h linux-2.6.32.49/arch/x86/include/asm/calling.h
8518 --- linux-2.6.32.49/arch/x86/include/asm/calling.h 2011-11-08 19:02:43.000000000 -0500
8519 +++ linux-2.6.32.49/arch/x86/include/asm/calling.h 2011-11-15 19:59:42.000000000 -0500
8520 @@ -52,32 +52,32 @@ For 32-bit we have the following convent
8521 * for assembly code:
8522 */
8523
8524 -#define R15 0
8525 -#define R14 8
8526 -#define R13 16
8527 -#define R12 24
8528 -#define RBP 32
8529 -#define RBX 40
8530 +#define R15 (0)
8531 +#define R14 (8)
8532 +#define R13 (16)
8533 +#define R12 (24)
8534 +#define RBP (32)
8535 +#define RBX (40)
8536
8537 /* arguments: interrupts/non tracing syscalls only save up to here: */
8538 -#define R11 48
8539 -#define R10 56
8540 -#define R9 64
8541 -#define R8 72
8542 -#define RAX 80
8543 -#define RCX 88
8544 -#define RDX 96
8545 -#define RSI 104
8546 -#define RDI 112
8547 -#define ORIG_RAX 120 /* + error_code */
8548 +#define R11 (48)
8549 +#define R10 (56)
8550 +#define R9 (64)
8551 +#define R8 (72)
8552 +#define RAX (80)
8553 +#define RCX (88)
8554 +#define RDX (96)
8555 +#define RSI (104)
8556 +#define RDI (112)
8557 +#define ORIG_RAX (120) /* + error_code */
8558 /* end of arguments */
8559
8560 /* cpu exception frame or undefined in case of fast syscall: */
8561 -#define RIP 128
8562 -#define CS 136
8563 -#define EFLAGS 144
8564 -#define RSP 152
8565 -#define SS 160
8566 +#define RIP (128)
8567 +#define CS (136)
8568 +#define EFLAGS (144)
8569 +#define RSP (152)
8570 +#define SS (160)
8571
8572 #define ARGOFFSET R11
8573 #define SWFRAME ORIG_RAX
8574 diff -urNp linux-2.6.32.49/arch/x86/include/asm/checksum_32.h linux-2.6.32.49/arch/x86/include/asm/checksum_32.h
8575 --- linux-2.6.32.49/arch/x86/include/asm/checksum_32.h 2011-11-08 19:02:43.000000000 -0500
8576 +++ linux-2.6.32.49/arch/x86/include/asm/checksum_32.h 2011-11-15 19:59:42.000000000 -0500
8577 @@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
8578 int len, __wsum sum,
8579 int *src_err_ptr, int *dst_err_ptr);
8580
8581 +asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
8582 + int len, __wsum sum,
8583 + int *src_err_ptr, int *dst_err_ptr);
8584 +
8585 +asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
8586 + int len, __wsum sum,
8587 + int *src_err_ptr, int *dst_err_ptr);
8588 +
8589 /*
8590 * Note: when you get a NULL pointer exception here this means someone
8591 * passed in an incorrect kernel address to one of these functions.
8592 @@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
8593 int *err_ptr)
8594 {
8595 might_sleep();
8596 - return csum_partial_copy_generic((__force void *)src, dst,
8597 + return csum_partial_copy_generic_from_user((__force void *)src, dst,
8598 len, sum, err_ptr, NULL);
8599 }
8600
8601 @@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
8602 {
8603 might_sleep();
8604 if (access_ok(VERIFY_WRITE, dst, len))
8605 - return csum_partial_copy_generic(src, (__force void *)dst,
8606 + return csum_partial_copy_generic_to_user(src, (__force void *)dst,
8607 len, sum, NULL, err_ptr);
8608
8609 if (len)
8610 diff -urNp linux-2.6.32.49/arch/x86/include/asm/desc_defs.h linux-2.6.32.49/arch/x86/include/asm/desc_defs.h
8611 --- linux-2.6.32.49/arch/x86/include/asm/desc_defs.h 2011-11-08 19:02:43.000000000 -0500
8612 +++ linux-2.6.32.49/arch/x86/include/asm/desc_defs.h 2011-11-15 19:59:42.000000000 -0500
8613 @@ -31,6 +31,12 @@ struct desc_struct {
8614 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
8615 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
8616 };
8617 + struct {
8618 + u16 offset_low;
8619 + u16 seg;
8620 + unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
8621 + unsigned offset_high: 16;
8622 + } gate;
8623 };
8624 } __attribute__((packed));
8625
8626 diff -urNp linux-2.6.32.49/arch/x86/include/asm/desc.h linux-2.6.32.49/arch/x86/include/asm/desc.h
8627 --- linux-2.6.32.49/arch/x86/include/asm/desc.h 2011-11-08 19:02:43.000000000 -0500
8628 +++ linux-2.6.32.49/arch/x86/include/asm/desc.h 2011-11-15 19:59:42.000000000 -0500
8629 @@ -4,6 +4,7 @@
8630 #include <asm/desc_defs.h>
8631 #include <asm/ldt.h>
8632 #include <asm/mmu.h>
8633 +#include <asm/pgtable.h>
8634 #include <linux/smp.h>
8635
8636 static inline void fill_ldt(struct desc_struct *desc,
8637 @@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
8638 desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
8639 desc->type = (info->read_exec_only ^ 1) << 1;
8640 desc->type |= info->contents << 2;
8641 + desc->type |= info->seg_not_present ^ 1;
8642 desc->s = 1;
8643 desc->dpl = 0x3;
8644 desc->p = info->seg_not_present ^ 1;
8645 @@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
8646 }
8647
8648 extern struct desc_ptr idt_descr;
8649 -extern gate_desc idt_table[];
8650 -
8651 -struct gdt_page {
8652 - struct desc_struct gdt[GDT_ENTRIES];
8653 -} __attribute__((aligned(PAGE_SIZE)));
8654 -DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
8655 +extern gate_desc idt_table[256];
8656
8657 +extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
8658 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
8659 {
8660 - return per_cpu(gdt_page, cpu).gdt;
8661 + return cpu_gdt_table[cpu];
8662 }
8663
8664 #ifdef CONFIG_X86_64
8665 @@ -65,9 +63,14 @@ static inline void pack_gate(gate_desc *
8666 unsigned long base, unsigned dpl, unsigned flags,
8667 unsigned short seg)
8668 {
8669 - gate->a = (seg << 16) | (base & 0xffff);
8670 - gate->b = (base & 0xffff0000) |
8671 - (((0x80 | type | (dpl << 5)) & 0xff) << 8);
8672 + gate->gate.offset_low = base;
8673 + gate->gate.seg = seg;
8674 + gate->gate.reserved = 0;
8675 + gate->gate.type = type;
8676 + gate->gate.s = 0;
8677 + gate->gate.dpl = dpl;
8678 + gate->gate.p = 1;
8679 + gate->gate.offset_high = base >> 16;
8680 }
8681
8682 #endif
8683 @@ -115,13 +118,17 @@ static inline void paravirt_free_ldt(str
8684 static inline void native_write_idt_entry(gate_desc *idt, int entry,
8685 const gate_desc *gate)
8686 {
8687 + pax_open_kernel();
8688 memcpy(&idt[entry], gate, sizeof(*gate));
8689 + pax_close_kernel();
8690 }
8691
8692 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
8693 const void *desc)
8694 {
8695 + pax_open_kernel();
8696 memcpy(&ldt[entry], desc, 8);
8697 + pax_close_kernel();
8698 }
8699
8700 static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
8701 @@ -139,7 +146,10 @@ static inline void native_write_gdt_entr
8702 size = sizeof(struct desc_struct);
8703 break;
8704 }
8705 +
8706 + pax_open_kernel();
8707 memcpy(&gdt[entry], desc, size);
8708 + pax_close_kernel();
8709 }
8710
8711 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
8712 @@ -211,7 +221,9 @@ static inline void native_set_ldt(const
8713
8714 static inline void native_load_tr_desc(void)
8715 {
8716 + pax_open_kernel();
8717 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
8718 + pax_close_kernel();
8719 }
8720
8721 static inline void native_load_gdt(const struct desc_ptr *dtr)
8722 @@ -246,8 +258,10 @@ static inline void native_load_tls(struc
8723 unsigned int i;
8724 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
8725
8726 + pax_open_kernel();
8727 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
8728 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
8729 + pax_close_kernel();
8730 }
8731
8732 #define _LDT_empty(info) \
8733 @@ -309,7 +323,7 @@ static inline void set_desc_limit(struct
8734 desc->limit = (limit >> 16) & 0xf;
8735 }
8736
8737 -static inline void _set_gate(int gate, unsigned type, void *addr,
8738 +static inline void _set_gate(int gate, unsigned type, const void *addr,
8739 unsigned dpl, unsigned ist, unsigned seg)
8740 {
8741 gate_desc s;
8742 @@ -327,7 +341,7 @@ static inline void _set_gate(int gate, u
8743 * Pentium F0 0F bugfix can have resulted in the mapped
8744 * IDT being write-protected.
8745 */
8746 -static inline void set_intr_gate(unsigned int n, void *addr)
8747 +static inline void set_intr_gate(unsigned int n, const void *addr)
8748 {
8749 BUG_ON((unsigned)n > 0xFF);
8750 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
8751 @@ -356,19 +370,19 @@ static inline void alloc_intr_gate(unsig
8752 /*
8753 * This routine sets up an interrupt gate at directory privilege level 3.
8754 */
8755 -static inline void set_system_intr_gate(unsigned int n, void *addr)
8756 +static inline void set_system_intr_gate(unsigned int n, const void *addr)
8757 {
8758 BUG_ON((unsigned)n > 0xFF);
8759 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
8760 }
8761
8762 -static inline void set_system_trap_gate(unsigned int n, void *addr)
8763 +static inline void set_system_trap_gate(unsigned int n, const void *addr)
8764 {
8765 BUG_ON((unsigned)n > 0xFF);
8766 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
8767 }
8768
8769 -static inline void set_trap_gate(unsigned int n, void *addr)
8770 +static inline void set_trap_gate(unsigned int n, const void *addr)
8771 {
8772 BUG_ON((unsigned)n > 0xFF);
8773 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
8774 @@ -377,19 +391,31 @@ static inline void set_trap_gate(unsigne
8775 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
8776 {
8777 BUG_ON((unsigned)n > 0xFF);
8778 - _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
8779 + _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
8780 }
8781
8782 -static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
8783 +static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
8784 {
8785 BUG_ON((unsigned)n > 0xFF);
8786 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
8787 }
8788
8789 -static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
8790 +static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
8791 {
8792 BUG_ON((unsigned)n > 0xFF);
8793 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
8794 }
8795
8796 +#ifdef CONFIG_X86_32
8797 +static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
8798 +{
8799 + struct desc_struct d;
8800 +
8801 + if (likely(limit))
8802 + limit = (limit - 1UL) >> PAGE_SHIFT;
8803 + pack_descriptor(&d, base, limit, 0xFB, 0xC);
8804 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
8805 +}
8806 +#endif
8807 +
8808 #endif /* _ASM_X86_DESC_H */
8809 diff -urNp linux-2.6.32.49/arch/x86/include/asm/device.h linux-2.6.32.49/arch/x86/include/asm/device.h
8810 --- linux-2.6.32.49/arch/x86/include/asm/device.h 2011-11-08 19:02:43.000000000 -0500
8811 +++ linux-2.6.32.49/arch/x86/include/asm/device.h 2011-11-15 19:59:42.000000000 -0500
8812 @@ -6,7 +6,7 @@ struct dev_archdata {
8813 void *acpi_handle;
8814 #endif
8815 #ifdef CONFIG_X86_64
8816 -struct dma_map_ops *dma_ops;
8817 + const struct dma_map_ops *dma_ops;
8818 #endif
8819 #ifdef CONFIG_DMAR
8820 void *iommu; /* hook for IOMMU specific extension */
8821 diff -urNp linux-2.6.32.49/arch/x86/include/asm/dma-mapping.h linux-2.6.32.49/arch/x86/include/asm/dma-mapping.h
8822 --- linux-2.6.32.49/arch/x86/include/asm/dma-mapping.h 2011-11-08 19:02:43.000000000 -0500
8823 +++ linux-2.6.32.49/arch/x86/include/asm/dma-mapping.h 2011-11-15 19:59:42.000000000 -0500
8824 @@ -25,9 +25,9 @@ extern int iommu_merge;
8825 extern struct device x86_dma_fallback_dev;
8826 extern int panic_on_overflow;
8827
8828 -extern struct dma_map_ops *dma_ops;
8829 +extern const struct dma_map_ops *dma_ops;
8830
8831 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
8832 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
8833 {
8834 #ifdef CONFIG_X86_32
8835 return dma_ops;
8836 @@ -44,7 +44,7 @@ static inline struct dma_map_ops *get_dm
8837 /* Make sure we keep the same behaviour */
8838 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
8839 {
8840 - struct dma_map_ops *ops = get_dma_ops(dev);
8841 + const struct dma_map_ops *ops = get_dma_ops(dev);
8842 if (ops->mapping_error)
8843 return ops->mapping_error(dev, dma_addr);
8844
8845 @@ -122,7 +122,7 @@ static inline void *
8846 dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
8847 gfp_t gfp)
8848 {
8849 - struct dma_map_ops *ops = get_dma_ops(dev);
8850 + const struct dma_map_ops *ops = get_dma_ops(dev);
8851 void *memory;
8852
8853 gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
8854 @@ -149,7 +149,7 @@ dma_alloc_coherent(struct device *dev, s
8855 static inline void dma_free_coherent(struct device *dev, size_t size,
8856 void *vaddr, dma_addr_t bus)
8857 {
8858 - struct dma_map_ops *ops = get_dma_ops(dev);
8859 + const struct dma_map_ops *ops = get_dma_ops(dev);
8860
8861 WARN_ON(irqs_disabled()); /* for portability */
8862
8863 diff -urNp linux-2.6.32.49/arch/x86/include/asm/e820.h linux-2.6.32.49/arch/x86/include/asm/e820.h
8864 --- linux-2.6.32.49/arch/x86/include/asm/e820.h 2011-11-08 19:02:43.000000000 -0500
8865 +++ linux-2.6.32.49/arch/x86/include/asm/e820.h 2011-11-15 19:59:42.000000000 -0500
8866 @@ -133,7 +133,7 @@ extern char *default_machine_specific_me
8867 #define ISA_END_ADDRESS 0x100000
8868 #define is_ISA_range(s, e) ((s) >= ISA_START_ADDRESS && (e) < ISA_END_ADDRESS)
8869
8870 -#define BIOS_BEGIN 0x000a0000
8871 +#define BIOS_BEGIN 0x000c0000
8872 #define BIOS_END 0x00100000
8873
8874 #ifdef __KERNEL__
8875 diff -urNp linux-2.6.32.49/arch/x86/include/asm/elf.h linux-2.6.32.49/arch/x86/include/asm/elf.h
8876 --- linux-2.6.32.49/arch/x86/include/asm/elf.h 2011-11-08 19:02:43.000000000 -0500
8877 +++ linux-2.6.32.49/arch/x86/include/asm/elf.h 2011-11-15 19:59:42.000000000 -0500
8878 @@ -257,7 +257,25 @@ extern int force_personality32;
8879 the loader. We need to make sure that it is out of the way of the program
8880 that it will "exec", and that there is sufficient room for the brk. */
8881
8882 +#ifdef CONFIG_PAX_SEGMEXEC
8883 +#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
8884 +#else
8885 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
8886 +#endif
8887 +
8888 +#ifdef CONFIG_PAX_ASLR
8889 +#ifdef CONFIG_X86_32
8890 +#define PAX_ELF_ET_DYN_BASE 0x10000000UL
8891 +
8892 +#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
8893 +#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
8894 +#else
8895 +#define PAX_ELF_ET_DYN_BASE 0x400000UL
8896 +
8897 +#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
8898 +#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
8899 +#endif
8900 +#endif
8901
8902 /* This yields a mask that user programs can use to figure out what
8903 instruction set this CPU supports. This could be done in user space,
8904 @@ -310,9 +328,7 @@ do { \
8905
8906 #define ARCH_DLINFO \
8907 do { \
8908 - if (vdso_enabled) \
8909 - NEW_AUX_ENT(AT_SYSINFO_EHDR, \
8910 - (unsigned long)current->mm->context.vdso); \
8911 + NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
8912 } while (0)
8913
8914 #define AT_SYSINFO 32
8915 @@ -323,7 +339,7 @@ do { \
8916
8917 #endif /* !CONFIG_X86_32 */
8918
8919 -#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
8920 +#define VDSO_CURRENT_BASE (current->mm->context.vdso)
8921
8922 #define VDSO_ENTRY \
8923 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
8924 @@ -337,7 +353,4 @@ extern int arch_setup_additional_pages(s
8925 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
8926 #define compat_arch_setup_additional_pages syscall32_setup_pages
8927
8928 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
8929 -#define arch_randomize_brk arch_randomize_brk
8930 -
8931 #endif /* _ASM_X86_ELF_H */
8932 diff -urNp linux-2.6.32.49/arch/x86/include/asm/emergency-restart.h linux-2.6.32.49/arch/x86/include/asm/emergency-restart.h
8933 --- linux-2.6.32.49/arch/x86/include/asm/emergency-restart.h 2011-11-08 19:02:43.000000000 -0500
8934 +++ linux-2.6.32.49/arch/x86/include/asm/emergency-restart.h 2011-11-15 19:59:42.000000000 -0500
8935 @@ -15,6 +15,6 @@ enum reboot_type {
8936
8937 extern enum reboot_type reboot_type;
8938
8939 -extern void machine_emergency_restart(void);
8940 +extern void machine_emergency_restart(void) __noreturn;
8941
8942 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
8943 diff -urNp linux-2.6.32.49/arch/x86/include/asm/futex.h linux-2.6.32.49/arch/x86/include/asm/futex.h
8944 --- linux-2.6.32.49/arch/x86/include/asm/futex.h 2011-11-08 19:02:43.000000000 -0500
8945 +++ linux-2.6.32.49/arch/x86/include/asm/futex.h 2011-11-15 19:59:42.000000000 -0500
8946 @@ -12,16 +12,18 @@
8947 #include <asm/system.h>
8948
8949 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
8950 + typecheck(u32 __user *, uaddr); \
8951 asm volatile("1:\t" insn "\n" \
8952 "2:\t.section .fixup,\"ax\"\n" \
8953 "3:\tmov\t%3, %1\n" \
8954 "\tjmp\t2b\n" \
8955 "\t.previous\n" \
8956 _ASM_EXTABLE(1b, 3b) \
8957 - : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
8958 + : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr))\
8959 : "i" (-EFAULT), "0" (oparg), "1" (0))
8960
8961 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
8962 + typecheck(u32 __user *, uaddr); \
8963 asm volatile("1:\tmovl %2, %0\n" \
8964 "\tmovl\t%0, %3\n" \
8965 "\t" insn "\n" \
8966 @@ -34,10 +36,10 @@
8967 _ASM_EXTABLE(1b, 4b) \
8968 _ASM_EXTABLE(2b, 4b) \
8969 : "=&a" (oldval), "=&r" (ret), \
8970 - "+m" (*uaddr), "=&r" (tem) \
8971 + "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \
8972 : "r" (oparg), "i" (-EFAULT), "1" (0))
8973
8974 -static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
8975 +static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
8976 {
8977 int op = (encoded_op >> 28) & 7;
8978 int cmp = (encoded_op >> 24) & 15;
8979 @@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser
8980
8981 switch (op) {
8982 case FUTEX_OP_SET:
8983 - __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
8984 + __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
8985 break;
8986 case FUTEX_OP_ADD:
8987 - __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
8988 + __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
8989 uaddr, oparg);
8990 break;
8991 case FUTEX_OP_OR:
8992 @@ -109,7 +111,7 @@ static inline int futex_atomic_op_inuser
8993 return ret;
8994 }
8995
8996 -static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
8997 +static inline int futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval,
8998 int newval)
8999 {
9000
9001 @@ -119,16 +121,16 @@ static inline int futex_atomic_cmpxchg_i
9002 return -ENOSYS;
9003 #endif
9004
9005 - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
9006 + if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
9007 return -EFAULT;
9008
9009 - asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
9010 + asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %3, %1\n"
9011 "2:\t.section .fixup, \"ax\"\n"
9012 "3:\tmov %2, %0\n"
9013 "\tjmp 2b\n"
9014 "\t.previous\n"
9015 _ASM_EXTABLE(1b, 3b)
9016 - : "=a" (oldval), "+m" (*uaddr)
9017 + : "=a" (oldval), "+m" (*(u32 *)____m(uaddr))
9018 : "i" (-EFAULT), "r" (newval), "0" (oldval)
9019 : "memory"
9020 );
9021 diff -urNp linux-2.6.32.49/arch/x86/include/asm/hw_irq.h linux-2.6.32.49/arch/x86/include/asm/hw_irq.h
9022 --- linux-2.6.32.49/arch/x86/include/asm/hw_irq.h 2011-11-08 19:02:43.000000000 -0500
9023 +++ linux-2.6.32.49/arch/x86/include/asm/hw_irq.h 2011-11-15 19:59:42.000000000 -0500
9024 @@ -92,8 +92,8 @@ extern void setup_ioapic_dest(void);
9025 extern void enable_IO_APIC(void);
9026
9027 /* Statistics */
9028 -extern atomic_t irq_err_count;
9029 -extern atomic_t irq_mis_count;
9030 +extern atomic_unchecked_t irq_err_count;
9031 +extern atomic_unchecked_t irq_mis_count;
9032
9033 /* EISA */
9034 extern void eisa_set_level_irq(unsigned int irq);
9035 diff -urNp linux-2.6.32.49/arch/x86/include/asm/i387.h linux-2.6.32.49/arch/x86/include/asm/i387.h
9036 --- linux-2.6.32.49/arch/x86/include/asm/i387.h 2011-11-08 19:02:43.000000000 -0500
9037 +++ linux-2.6.32.49/arch/x86/include/asm/i387.h 2011-11-15 19:59:42.000000000 -0500
9038 @@ -60,6 +60,11 @@ static inline int fxrstor_checking(struc
9039 {
9040 int err;
9041
9042 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9043 + if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
9044 + fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
9045 +#endif
9046 +
9047 asm volatile("1: rex64/fxrstor (%[fx])\n\t"
9048 "2:\n"
9049 ".section .fixup,\"ax\"\n"
9050 @@ -105,6 +110,11 @@ static inline int fxsave_user(struct i38
9051 {
9052 int err;
9053
9054 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9055 + if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
9056 + fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
9057 +#endif
9058 +
9059 asm volatile("1: rex64/fxsave (%[fx])\n\t"
9060 "2:\n"
9061 ".section .fixup,\"ax\"\n"
9062 @@ -195,13 +205,8 @@ static inline int fxrstor_checking(struc
9063 }
9064
9065 /* We need a safe address that is cheap to find and that is already
9066 - in L1 during context switch. The best choices are unfortunately
9067 - different for UP and SMP */
9068 -#ifdef CONFIG_SMP
9069 -#define safe_address (__per_cpu_offset[0])
9070 -#else
9071 -#define safe_address (kstat_cpu(0).cpustat.user)
9072 -#endif
9073 + in L1 during context switch. */
9074 +#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
9075
9076 /*
9077 * These must be called with preempt disabled
9078 @@ -291,7 +296,7 @@ static inline void kernel_fpu_begin(void
9079 struct thread_info *me = current_thread_info();
9080 preempt_disable();
9081 if (me->status & TS_USEDFPU)
9082 - __save_init_fpu(me->task);
9083 + __save_init_fpu(current);
9084 else
9085 clts();
9086 }
9087 diff -urNp linux-2.6.32.49/arch/x86/include/asm/io_32.h linux-2.6.32.49/arch/x86/include/asm/io_32.h
9088 --- linux-2.6.32.49/arch/x86/include/asm/io_32.h 2011-11-08 19:02:43.000000000 -0500
9089 +++ linux-2.6.32.49/arch/x86/include/asm/io_32.h 2011-11-15 19:59:42.000000000 -0500
9090 @@ -3,6 +3,7 @@
9091
9092 #include <linux/string.h>
9093 #include <linux/compiler.h>
9094 +#include <asm/processor.h>
9095
9096 /*
9097 * This file contains the definitions for the x86 IO instructions
9098 @@ -42,6 +43,17 @@
9099
9100 #ifdef __KERNEL__
9101
9102 +#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
9103 +static inline int valid_phys_addr_range(unsigned long addr, size_t count)
9104 +{
9105 + return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9106 +}
9107 +
9108 +static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
9109 +{
9110 + return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9111 +}
9112 +
9113 #include <asm-generic/iomap.h>
9114
9115 #include <linux/vmalloc.h>
9116 diff -urNp linux-2.6.32.49/arch/x86/include/asm/io_64.h linux-2.6.32.49/arch/x86/include/asm/io_64.h
9117 --- linux-2.6.32.49/arch/x86/include/asm/io_64.h 2011-11-08 19:02:43.000000000 -0500
9118 +++ linux-2.6.32.49/arch/x86/include/asm/io_64.h 2011-11-15 19:59:42.000000000 -0500
9119 @@ -140,6 +140,17 @@ __OUTS(l)
9120
9121 #include <linux/vmalloc.h>
9122
9123 +#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
9124 +static inline int valid_phys_addr_range(unsigned long addr, size_t count)
9125 +{
9126 + return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9127 +}
9128 +
9129 +static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
9130 +{
9131 + return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9132 +}
9133 +
9134 #include <asm-generic/iomap.h>
9135
9136 void __memcpy_fromio(void *, unsigned long, unsigned);
9137 diff -urNp linux-2.6.32.49/arch/x86/include/asm/iommu.h linux-2.6.32.49/arch/x86/include/asm/iommu.h
9138 --- linux-2.6.32.49/arch/x86/include/asm/iommu.h 2011-11-08 19:02:43.000000000 -0500
9139 +++ linux-2.6.32.49/arch/x86/include/asm/iommu.h 2011-11-15 19:59:42.000000000 -0500
9140 @@ -3,7 +3,7 @@
9141
9142 extern void pci_iommu_shutdown(void);
9143 extern void no_iommu_init(void);
9144 -extern struct dma_map_ops nommu_dma_ops;
9145 +extern const struct dma_map_ops nommu_dma_ops;
9146 extern int force_iommu, no_iommu;
9147 extern int iommu_detected;
9148 extern int iommu_pass_through;
9149 diff -urNp linux-2.6.32.49/arch/x86/include/asm/irqflags.h linux-2.6.32.49/arch/x86/include/asm/irqflags.h
9150 --- linux-2.6.32.49/arch/x86/include/asm/irqflags.h 2011-11-08 19:02:43.000000000 -0500
9151 +++ linux-2.6.32.49/arch/x86/include/asm/irqflags.h 2011-11-15 19:59:42.000000000 -0500
9152 @@ -142,6 +142,11 @@ static inline unsigned long __raw_local_
9153 sti; \
9154 sysexit
9155
9156 +#define GET_CR0_INTO_RDI mov %cr0, %rdi
9157 +#define SET_RDI_INTO_CR0 mov %rdi, %cr0
9158 +#define GET_CR3_INTO_RDI mov %cr3, %rdi
9159 +#define SET_RDI_INTO_CR3 mov %rdi, %cr3
9160 +
9161 #else
9162 #define INTERRUPT_RETURN iret
9163 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
9164 diff -urNp linux-2.6.32.49/arch/x86/include/asm/kprobes.h linux-2.6.32.49/arch/x86/include/asm/kprobes.h
9165 --- linux-2.6.32.49/arch/x86/include/asm/kprobes.h 2011-11-08 19:02:43.000000000 -0500
9166 +++ linux-2.6.32.49/arch/x86/include/asm/kprobes.h 2011-11-15 19:59:42.000000000 -0500
9167 @@ -34,13 +34,8 @@ typedef u8 kprobe_opcode_t;
9168 #define BREAKPOINT_INSTRUCTION 0xcc
9169 #define RELATIVEJUMP_INSTRUCTION 0xe9
9170 #define MAX_INSN_SIZE 16
9171 -#define MAX_STACK_SIZE 64
9172 -#define MIN_STACK_SIZE(ADDR) \
9173 - (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
9174 - THREAD_SIZE - (unsigned long)(ADDR))) \
9175 - ? (MAX_STACK_SIZE) \
9176 - : (((unsigned long)current_thread_info()) + \
9177 - THREAD_SIZE - (unsigned long)(ADDR)))
9178 +#define MAX_STACK_SIZE 64UL
9179 +#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
9180
9181 #define flush_insn_slot(p) do { } while (0)
9182
9183 diff -urNp linux-2.6.32.49/arch/x86/include/asm/kvm_host.h linux-2.6.32.49/arch/x86/include/asm/kvm_host.h
9184 --- linux-2.6.32.49/arch/x86/include/asm/kvm_host.h 2011-11-08 19:02:43.000000000 -0500
9185 +++ linux-2.6.32.49/arch/x86/include/asm/kvm_host.h 2011-11-15 19:59:42.000000000 -0500
9186 @@ -534,9 +534,9 @@ struct kvm_x86_ops {
9187 bool (*gb_page_enable)(void);
9188
9189 const struct trace_print_flags *exit_reasons_str;
9190 -};
9191 +} __do_const;
9192
9193 -extern struct kvm_x86_ops *kvm_x86_ops;
9194 +extern const struct kvm_x86_ops *kvm_x86_ops;
9195
9196 int kvm_mmu_module_init(void);
9197 void kvm_mmu_module_exit(void);
9198 diff -urNp linux-2.6.32.49/arch/x86/include/asm/local.h linux-2.6.32.49/arch/x86/include/asm/local.h
9199 --- linux-2.6.32.49/arch/x86/include/asm/local.h 2011-11-08 19:02:43.000000000 -0500
9200 +++ linux-2.6.32.49/arch/x86/include/asm/local.h 2011-11-15 19:59:42.000000000 -0500
9201 @@ -18,26 +18,58 @@ typedef struct {
9202
9203 static inline void local_inc(local_t *l)
9204 {
9205 - asm volatile(_ASM_INC "%0"
9206 + asm volatile(_ASM_INC "%0\n"
9207 +
9208 +#ifdef CONFIG_PAX_REFCOUNT
9209 + "jno 0f\n"
9210 + _ASM_DEC "%0\n"
9211 + "int $4\n0:\n"
9212 + _ASM_EXTABLE(0b, 0b)
9213 +#endif
9214 +
9215 : "+m" (l->a.counter));
9216 }
9217
9218 static inline void local_dec(local_t *l)
9219 {
9220 - asm volatile(_ASM_DEC "%0"
9221 + asm volatile(_ASM_DEC "%0\n"
9222 +
9223 +#ifdef CONFIG_PAX_REFCOUNT
9224 + "jno 0f\n"
9225 + _ASM_INC "%0\n"
9226 + "int $4\n0:\n"
9227 + _ASM_EXTABLE(0b, 0b)
9228 +#endif
9229 +
9230 : "+m" (l->a.counter));
9231 }
9232
9233 static inline void local_add(long i, local_t *l)
9234 {
9235 - asm volatile(_ASM_ADD "%1,%0"
9236 + asm volatile(_ASM_ADD "%1,%0\n"
9237 +
9238 +#ifdef CONFIG_PAX_REFCOUNT
9239 + "jno 0f\n"
9240 + _ASM_SUB "%1,%0\n"
9241 + "int $4\n0:\n"
9242 + _ASM_EXTABLE(0b, 0b)
9243 +#endif
9244 +
9245 : "+m" (l->a.counter)
9246 : "ir" (i));
9247 }
9248
9249 static inline void local_sub(long i, local_t *l)
9250 {
9251 - asm volatile(_ASM_SUB "%1,%0"
9252 + asm volatile(_ASM_SUB "%1,%0\n"
9253 +
9254 +#ifdef CONFIG_PAX_REFCOUNT
9255 + "jno 0f\n"
9256 + _ASM_ADD "%1,%0\n"
9257 + "int $4\n0:\n"
9258 + _ASM_EXTABLE(0b, 0b)
9259 +#endif
9260 +
9261 : "+m" (l->a.counter)
9262 : "ir" (i));
9263 }
9264 @@ -55,7 +87,16 @@ static inline int local_sub_and_test(lon
9265 {
9266 unsigned char c;
9267
9268 - asm volatile(_ASM_SUB "%2,%0; sete %1"
9269 + asm volatile(_ASM_SUB "%2,%0\n"
9270 +
9271 +#ifdef CONFIG_PAX_REFCOUNT
9272 + "jno 0f\n"
9273 + _ASM_ADD "%2,%0\n"
9274 + "int $4\n0:\n"
9275 + _ASM_EXTABLE(0b, 0b)
9276 +#endif
9277 +
9278 + "sete %1\n"
9279 : "+m" (l->a.counter), "=qm" (c)
9280 : "ir" (i) : "memory");
9281 return c;
9282 @@ -73,7 +114,16 @@ static inline int local_dec_and_test(loc
9283 {
9284 unsigned char c;
9285
9286 - asm volatile(_ASM_DEC "%0; sete %1"
9287 + asm volatile(_ASM_DEC "%0\n"
9288 +
9289 +#ifdef CONFIG_PAX_REFCOUNT
9290 + "jno 0f\n"
9291 + _ASM_INC "%0\n"
9292 + "int $4\n0:\n"
9293 + _ASM_EXTABLE(0b, 0b)
9294 +#endif
9295 +
9296 + "sete %1\n"
9297 : "+m" (l->a.counter), "=qm" (c)
9298 : : "memory");
9299 return c != 0;
9300 @@ -91,7 +141,16 @@ static inline int local_inc_and_test(loc
9301 {
9302 unsigned char c;
9303
9304 - asm volatile(_ASM_INC "%0; sete %1"
9305 + asm volatile(_ASM_INC "%0\n"
9306 +
9307 +#ifdef CONFIG_PAX_REFCOUNT
9308 + "jno 0f\n"
9309 + _ASM_DEC "%0\n"
9310 + "int $4\n0:\n"
9311 + _ASM_EXTABLE(0b, 0b)
9312 +#endif
9313 +
9314 + "sete %1\n"
9315 : "+m" (l->a.counter), "=qm" (c)
9316 : : "memory");
9317 return c != 0;
9318 @@ -110,7 +169,16 @@ static inline int local_add_negative(lon
9319 {
9320 unsigned char c;
9321
9322 - asm volatile(_ASM_ADD "%2,%0; sets %1"
9323 + asm volatile(_ASM_ADD "%2,%0\n"
9324 +
9325 +#ifdef CONFIG_PAX_REFCOUNT
9326 + "jno 0f\n"
9327 + _ASM_SUB "%2,%0\n"
9328 + "int $4\n0:\n"
9329 + _ASM_EXTABLE(0b, 0b)
9330 +#endif
9331 +
9332 + "sets %1\n"
9333 : "+m" (l->a.counter), "=qm" (c)
9334 : "ir" (i) : "memory");
9335 return c;
9336 @@ -133,7 +201,15 @@ static inline long local_add_return(long
9337 #endif
9338 /* Modern 486+ processor */
9339 __i = i;
9340 - asm volatile(_ASM_XADD "%0, %1;"
9341 + asm volatile(_ASM_XADD "%0, %1\n"
9342 +
9343 +#ifdef CONFIG_PAX_REFCOUNT
9344 + "jno 0f\n"
9345 + _ASM_MOV "%0,%1\n"
9346 + "int $4\n0:\n"
9347 + _ASM_EXTABLE(0b, 0b)
9348 +#endif
9349 +
9350 : "+r" (i), "+m" (l->a.counter)
9351 : : "memory");
9352 return i + __i;
9353 diff -urNp linux-2.6.32.49/arch/x86/include/asm/microcode.h linux-2.6.32.49/arch/x86/include/asm/microcode.h
9354 --- linux-2.6.32.49/arch/x86/include/asm/microcode.h 2011-11-08 19:02:43.000000000 -0500
9355 +++ linux-2.6.32.49/arch/x86/include/asm/microcode.h 2011-11-15 19:59:42.000000000 -0500
9356 @@ -12,13 +12,13 @@ struct device;
9357 enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
9358
9359 struct microcode_ops {
9360 - enum ucode_state (*request_microcode_user) (int cpu,
9361 + enum ucode_state (* const request_microcode_user) (int cpu,
9362 const void __user *buf, size_t size);
9363
9364 - enum ucode_state (*request_microcode_fw) (int cpu,
9365 + enum ucode_state (* const request_microcode_fw) (int cpu,
9366 struct device *device);
9367
9368 - void (*microcode_fini_cpu) (int cpu);
9369 + void (* const microcode_fini_cpu) (int cpu);
9370
9371 /*
9372 * The generic 'microcode_core' part guarantees that
9373 @@ -38,18 +38,18 @@ struct ucode_cpu_info {
9374 extern struct ucode_cpu_info ucode_cpu_info[];
9375
9376 #ifdef CONFIG_MICROCODE_INTEL
9377 -extern struct microcode_ops * __init init_intel_microcode(void);
9378 +extern const struct microcode_ops * __init init_intel_microcode(void);
9379 #else
9380 -static inline struct microcode_ops * __init init_intel_microcode(void)
9381 +static inline const struct microcode_ops * __init init_intel_microcode(void)
9382 {
9383 return NULL;
9384 }
9385 #endif /* CONFIG_MICROCODE_INTEL */
9386
9387 #ifdef CONFIG_MICROCODE_AMD
9388 -extern struct microcode_ops * __init init_amd_microcode(void);
9389 +extern const struct microcode_ops * __init init_amd_microcode(void);
9390 #else
9391 -static inline struct microcode_ops * __init init_amd_microcode(void)
9392 +static inline const struct microcode_ops * __init init_amd_microcode(void)
9393 {
9394 return NULL;
9395 }
9396 diff -urNp linux-2.6.32.49/arch/x86/include/asm/mman.h linux-2.6.32.49/arch/x86/include/asm/mman.h
9397 --- linux-2.6.32.49/arch/x86/include/asm/mman.h 2011-11-08 19:02:43.000000000 -0500
9398 +++ linux-2.6.32.49/arch/x86/include/asm/mman.h 2011-11-15 19:59:42.000000000 -0500
9399 @@ -5,4 +5,14 @@
9400
9401 #include <asm-generic/mman.h>
9402
9403 +#ifdef __KERNEL__
9404 +#ifndef __ASSEMBLY__
9405 +#ifdef CONFIG_X86_32
9406 +#define arch_mmap_check i386_mmap_check
9407 +int i386_mmap_check(unsigned long addr, unsigned long len,
9408 + unsigned long flags);
9409 +#endif
9410 +#endif
9411 +#endif
9412 +
9413 #endif /* _ASM_X86_MMAN_H */
9414 diff -urNp linux-2.6.32.49/arch/x86/include/asm/mmu_context.h linux-2.6.32.49/arch/x86/include/asm/mmu_context.h
9415 --- linux-2.6.32.49/arch/x86/include/asm/mmu_context.h 2011-11-08 19:02:43.000000000 -0500
9416 +++ linux-2.6.32.49/arch/x86/include/asm/mmu_context.h 2011-11-15 19:59:42.000000000 -0500
9417 @@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *m
9418
9419 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
9420 {
9421 +
9422 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9423 + unsigned int i;
9424 + pgd_t *pgd;
9425 +
9426 + pax_open_kernel();
9427 + pgd = get_cpu_pgd(smp_processor_id());
9428 + for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
9429 + set_pgd_batched(pgd+i, native_make_pgd(0));
9430 + pax_close_kernel();
9431 +#endif
9432 +
9433 #ifdef CONFIG_SMP
9434 if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
9435 percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
9436 @@ -34,16 +46,30 @@ static inline void switch_mm(struct mm_s
9437 struct task_struct *tsk)
9438 {
9439 unsigned cpu = smp_processor_id();
9440 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)) && defined(CONFIG_SMP)
9441 + int tlbstate = TLBSTATE_OK;
9442 +#endif
9443
9444 if (likely(prev != next)) {
9445 #ifdef CONFIG_SMP
9446 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
9447 + tlbstate = percpu_read(cpu_tlbstate.state);
9448 +#endif
9449 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
9450 percpu_write(cpu_tlbstate.active_mm, next);
9451 #endif
9452 cpumask_set_cpu(cpu, mm_cpumask(next));
9453
9454 /* Re-load page tables */
9455 +#ifdef CONFIG_PAX_PER_CPU_PGD
9456 + pax_open_kernel();
9457 + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
9458 + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
9459 + pax_close_kernel();
9460 + load_cr3(get_cpu_pgd(cpu));
9461 +#else
9462 load_cr3(next->pgd);
9463 +#endif
9464
9465 /* stop flush ipis for the previous mm */
9466 cpumask_clear_cpu(cpu, mm_cpumask(prev));
9467 @@ -53,9 +79,38 @@ static inline void switch_mm(struct mm_s
9468 */
9469 if (unlikely(prev->context.ldt != next->context.ldt))
9470 load_LDT_nolock(&next->context);
9471 - }
9472 +
9473 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
9474 + if (!nx_enabled) {
9475 + smp_mb__before_clear_bit();
9476 + cpu_clear(cpu, prev->context.cpu_user_cs_mask);
9477 + smp_mb__after_clear_bit();
9478 + cpu_set(cpu, next->context.cpu_user_cs_mask);
9479 + }
9480 +#endif
9481 +
9482 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
9483 + if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
9484 + prev->context.user_cs_limit != next->context.user_cs_limit))
9485 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
9486 #ifdef CONFIG_SMP
9487 + else if (unlikely(tlbstate != TLBSTATE_OK))
9488 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
9489 +#endif
9490 +#endif
9491 +
9492 + }
9493 else {
9494 +
9495 +#ifdef CONFIG_PAX_PER_CPU_PGD
9496 + pax_open_kernel();
9497 + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
9498 + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
9499 + pax_close_kernel();
9500 + load_cr3(get_cpu_pgd(cpu));
9501 +#endif
9502 +
9503 +#ifdef CONFIG_SMP
9504 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
9505 BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
9506
9507 @@ -64,11 +119,28 @@ static inline void switch_mm(struct mm_s
9508 * tlb flush IPI delivery. We must reload CR3
9509 * to make sure to use no freed page tables.
9510 */
9511 +
9512 +#ifndef CONFIG_PAX_PER_CPU_PGD
9513 load_cr3(next->pgd);
9514 +#endif
9515 +
9516 load_LDT_nolock(&next->context);
9517 +
9518 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
9519 + if (!nx_enabled)
9520 + cpu_set(cpu, next->context.cpu_user_cs_mask);
9521 +#endif
9522 +
9523 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
9524 +#ifdef CONFIG_PAX_PAGEEXEC
9525 + if (!((next->pax_flags & MF_PAX_PAGEEXEC) && nx_enabled))
9526 +#endif
9527 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
9528 +#endif
9529 +
9530 }
9531 - }
9532 #endif
9533 + }
9534 }
9535
9536 #define activate_mm(prev, next) \
9537 diff -urNp linux-2.6.32.49/arch/x86/include/asm/mmu.h linux-2.6.32.49/arch/x86/include/asm/mmu.h
9538 --- linux-2.6.32.49/arch/x86/include/asm/mmu.h 2011-11-08 19:02:43.000000000 -0500
9539 +++ linux-2.6.32.49/arch/x86/include/asm/mmu.h 2011-11-15 19:59:42.000000000 -0500
9540 @@ -9,10 +9,23 @@
9541 * we put the segment information here.
9542 */
9543 typedef struct {
9544 - void *ldt;
9545 + struct desc_struct *ldt;
9546 int size;
9547 struct mutex lock;
9548 - void *vdso;
9549 + unsigned long vdso;
9550 +
9551 +#ifdef CONFIG_X86_32
9552 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
9553 + unsigned long user_cs_base;
9554 + unsigned long user_cs_limit;
9555 +
9556 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
9557 + cpumask_t cpu_user_cs_mask;
9558 +#endif
9559 +
9560 +#endif
9561 +#endif
9562 +
9563 } mm_context_t;
9564
9565 #ifdef CONFIG_SMP
9566 diff -urNp linux-2.6.32.49/arch/x86/include/asm/module.h linux-2.6.32.49/arch/x86/include/asm/module.h
9567 --- linux-2.6.32.49/arch/x86/include/asm/module.h 2011-11-08 19:02:43.000000000 -0500
9568 +++ linux-2.6.32.49/arch/x86/include/asm/module.h 2011-11-15 19:59:42.000000000 -0500
9569 @@ -5,6 +5,7 @@
9570
9571 #ifdef CONFIG_X86_64
9572 /* X86_64 does not define MODULE_PROC_FAMILY */
9573 +#define MODULE_PROC_FAMILY ""
9574 #elif defined CONFIG_M386
9575 #define MODULE_PROC_FAMILY "386 "
9576 #elif defined CONFIG_M486
9577 @@ -59,13 +60,24 @@
9578 #error unknown processor family
9579 #endif
9580
9581 -#ifdef CONFIG_X86_32
9582 -# ifdef CONFIG_4KSTACKS
9583 -# define MODULE_STACKSIZE "4KSTACKS "
9584 -# else
9585 -# define MODULE_STACKSIZE ""
9586 -# endif
9587 -# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE
9588 +#if defined(CONFIG_X86_32) && defined(CONFIG_4KSTACKS)
9589 +#define MODULE_STACKSIZE "4KSTACKS "
9590 +#else
9591 +#define MODULE_STACKSIZE ""
9592 +#endif
9593 +
9594 +#ifdef CONFIG_PAX_KERNEXEC
9595 +#define MODULE_PAX_KERNEXEC "KERNEXEC "
9596 +#else
9597 +#define MODULE_PAX_KERNEXEC ""
9598 #endif
9599
9600 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9601 +#define MODULE_PAX_UDEREF "UDEREF "
9602 +#else
9603 +#define MODULE_PAX_UDEREF ""
9604 +#endif
9605 +
9606 +#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
9607 +
9608 #endif /* _ASM_X86_MODULE_H */
9609 diff -urNp linux-2.6.32.49/arch/x86/include/asm/page_64_types.h linux-2.6.32.49/arch/x86/include/asm/page_64_types.h
9610 --- linux-2.6.32.49/arch/x86/include/asm/page_64_types.h 2011-11-08 19:02:43.000000000 -0500
9611 +++ linux-2.6.32.49/arch/x86/include/asm/page_64_types.h 2011-11-15 19:59:42.000000000 -0500
9612 @@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
9613
9614 /* duplicated to the one in bootmem.h */
9615 extern unsigned long max_pfn;
9616 -extern unsigned long phys_base;
9617 +extern const unsigned long phys_base;
9618
9619 extern unsigned long __phys_addr(unsigned long);
9620 #define __phys_reloc_hide(x) (x)
9621 diff -urNp linux-2.6.32.49/arch/x86/include/asm/paravirt.h linux-2.6.32.49/arch/x86/include/asm/paravirt.h
9622 --- linux-2.6.32.49/arch/x86/include/asm/paravirt.h 2011-11-08 19:02:43.000000000 -0500
9623 +++ linux-2.6.32.49/arch/x86/include/asm/paravirt.h 2011-11-15 19:59:42.000000000 -0500
9624 @@ -648,6 +648,18 @@ static inline void set_pgd(pgd_t *pgdp,
9625 val);
9626 }
9627
9628 +static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
9629 +{
9630 + pgdval_t val = native_pgd_val(pgd);
9631 +
9632 + if (sizeof(pgdval_t) > sizeof(long))
9633 + PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp,
9634 + val, (u64)val >> 32);
9635 + else
9636 + PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp,
9637 + val);
9638 +}
9639 +
9640 static inline void pgd_clear(pgd_t *pgdp)
9641 {
9642 set_pgd(pgdp, __pgd(0));
9643 @@ -729,6 +741,21 @@ static inline void __set_fixmap(unsigned
9644 pv_mmu_ops.set_fixmap(idx, phys, flags);
9645 }
9646
9647 +#ifdef CONFIG_PAX_KERNEXEC
9648 +static inline unsigned long pax_open_kernel(void)
9649 +{
9650 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
9651 +}
9652 +
9653 +static inline unsigned long pax_close_kernel(void)
9654 +{
9655 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
9656 +}
9657 +#else
9658 +static inline unsigned long pax_open_kernel(void) { return 0; }
9659 +static inline unsigned long pax_close_kernel(void) { return 0; }
9660 +#endif
9661 +
9662 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
9663
9664 static inline int __raw_spin_is_locked(struct raw_spinlock *lock)
9665 @@ -945,7 +972,7 @@ extern void default_banner(void);
9666
9667 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
9668 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
9669 -#define PARA_INDIRECT(addr) *%cs:addr
9670 +#define PARA_INDIRECT(addr) *%ss:addr
9671 #endif
9672
9673 #define INTERRUPT_RETURN \
9674 @@ -1022,6 +1049,21 @@ extern void default_banner(void);
9675 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
9676 CLBR_NONE, \
9677 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
9678 +
9679 +#define GET_CR0_INTO_RDI \
9680 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
9681 + mov %rax,%rdi
9682 +
9683 +#define SET_RDI_INTO_CR0 \
9684 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
9685 +
9686 +#define GET_CR3_INTO_RDI \
9687 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
9688 + mov %rax,%rdi
9689 +
9690 +#define SET_RDI_INTO_CR3 \
9691 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
9692 +
9693 #endif /* CONFIG_X86_32 */
9694
9695 #endif /* __ASSEMBLY__ */
9696 diff -urNp linux-2.6.32.49/arch/x86/include/asm/paravirt_types.h linux-2.6.32.49/arch/x86/include/asm/paravirt_types.h
9697 --- linux-2.6.32.49/arch/x86/include/asm/paravirt_types.h 2011-11-08 19:02:43.000000000 -0500
9698 +++ linux-2.6.32.49/arch/x86/include/asm/paravirt_types.h 2011-11-15 19:59:42.000000000 -0500
9699 @@ -78,19 +78,19 @@ struct pv_init_ops {
9700 */
9701 unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
9702 unsigned long addr, unsigned len);
9703 -};
9704 +} __no_const;
9705
9706
9707 struct pv_lazy_ops {
9708 /* Set deferred update mode, used for batching operations. */
9709 void (*enter)(void);
9710 void (*leave)(void);
9711 -};
9712 +} __no_const;
9713
9714 struct pv_time_ops {
9715 unsigned long long (*sched_clock)(void);
9716 unsigned long (*get_tsc_khz)(void);
9717 -};
9718 +} __no_const;
9719
9720 struct pv_cpu_ops {
9721 /* hooks for various privileged instructions */
9722 @@ -186,7 +186,7 @@ struct pv_cpu_ops {
9723
9724 void (*start_context_switch)(struct task_struct *prev);
9725 void (*end_context_switch)(struct task_struct *next);
9726 -};
9727 +} __no_const;
9728
9729 struct pv_irq_ops {
9730 /*
9731 @@ -217,7 +217,7 @@ struct pv_apic_ops {
9732 unsigned long start_eip,
9733 unsigned long start_esp);
9734 #endif
9735 -};
9736 +} __no_const;
9737
9738 struct pv_mmu_ops {
9739 unsigned long (*read_cr2)(void);
9740 @@ -301,6 +301,7 @@ struct pv_mmu_ops {
9741 struct paravirt_callee_save make_pud;
9742
9743 void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
9744 + void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval);
9745 #endif /* PAGETABLE_LEVELS == 4 */
9746 #endif /* PAGETABLE_LEVELS >= 3 */
9747
9748 @@ -316,6 +317,12 @@ struct pv_mmu_ops {
9749 an mfn. We can tell which is which from the index. */
9750 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
9751 phys_addr_t phys, pgprot_t flags);
9752 +
9753 +#ifdef CONFIG_PAX_KERNEXEC
9754 + unsigned long (*pax_open_kernel)(void);
9755 + unsigned long (*pax_close_kernel)(void);
9756 +#endif
9757 +
9758 };
9759
9760 struct raw_spinlock;
9761 @@ -326,7 +333,7 @@ struct pv_lock_ops {
9762 void (*spin_lock_flags)(struct raw_spinlock *lock, unsigned long flags);
9763 int (*spin_trylock)(struct raw_spinlock *lock);
9764 void (*spin_unlock)(struct raw_spinlock *lock);
9765 -};
9766 +} __no_const;
9767
9768 /* This contains all the paravirt structures: we get a convenient
9769 * number for each function using the offset which we use to indicate
9770 diff -urNp linux-2.6.32.49/arch/x86/include/asm/pci_x86.h linux-2.6.32.49/arch/x86/include/asm/pci_x86.h
9771 --- linux-2.6.32.49/arch/x86/include/asm/pci_x86.h 2011-11-08 19:02:43.000000000 -0500
9772 +++ linux-2.6.32.49/arch/x86/include/asm/pci_x86.h 2011-11-15 19:59:42.000000000 -0500
9773 @@ -89,16 +89,16 @@ extern int (*pcibios_enable_irq)(struct
9774 extern void (*pcibios_disable_irq)(struct pci_dev *dev);
9775
9776 struct pci_raw_ops {
9777 - int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
9778 + int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
9779 int reg, int len, u32 *val);
9780 - int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
9781 + int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
9782 int reg, int len, u32 val);
9783 };
9784
9785 -extern struct pci_raw_ops *raw_pci_ops;
9786 -extern struct pci_raw_ops *raw_pci_ext_ops;
9787 +extern const struct pci_raw_ops *raw_pci_ops;
9788 +extern const struct pci_raw_ops *raw_pci_ext_ops;
9789
9790 -extern struct pci_raw_ops pci_direct_conf1;
9791 +extern const struct pci_raw_ops pci_direct_conf1;
9792 extern bool port_cf9_safe;
9793
9794 /* arch_initcall level */
9795 diff -urNp linux-2.6.32.49/arch/x86/include/asm/percpu.h linux-2.6.32.49/arch/x86/include/asm/percpu.h
9796 --- linux-2.6.32.49/arch/x86/include/asm/percpu.h 2011-11-08 19:02:43.000000000 -0500
9797 +++ linux-2.6.32.49/arch/x86/include/asm/percpu.h 2011-11-15 19:59:42.000000000 -0500
9798 @@ -78,6 +78,7 @@ do { \
9799 if (0) { \
9800 T__ tmp__; \
9801 tmp__ = (val); \
9802 + (void)tmp__; \
9803 } \
9804 switch (sizeof(var)) { \
9805 case 1: \
9806 diff -urNp linux-2.6.32.49/arch/x86/include/asm/pgalloc.h linux-2.6.32.49/arch/x86/include/asm/pgalloc.h
9807 --- linux-2.6.32.49/arch/x86/include/asm/pgalloc.h 2011-11-08 19:02:43.000000000 -0500
9808 +++ linux-2.6.32.49/arch/x86/include/asm/pgalloc.h 2011-11-15 19:59:42.000000000 -0500
9809 @@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
9810 pmd_t *pmd, pte_t *pte)
9811 {
9812 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
9813 + set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
9814 +}
9815 +
9816 +static inline void pmd_populate_user(struct mm_struct *mm,
9817 + pmd_t *pmd, pte_t *pte)
9818 +{
9819 + paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
9820 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
9821 }
9822
9823 diff -urNp linux-2.6.32.49/arch/x86/include/asm/pgtable-2level.h linux-2.6.32.49/arch/x86/include/asm/pgtable-2level.h
9824 --- linux-2.6.32.49/arch/x86/include/asm/pgtable-2level.h 2011-11-08 19:02:43.000000000 -0500
9825 +++ linux-2.6.32.49/arch/x86/include/asm/pgtable-2level.h 2011-11-15 19:59:42.000000000 -0500
9826 @@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t
9827
9828 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9829 {
9830 + pax_open_kernel();
9831 *pmdp = pmd;
9832 + pax_close_kernel();
9833 }
9834
9835 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
9836 diff -urNp linux-2.6.32.49/arch/x86/include/asm/pgtable_32.h linux-2.6.32.49/arch/x86/include/asm/pgtable_32.h
9837 --- linux-2.6.32.49/arch/x86/include/asm/pgtable_32.h 2011-11-08 19:02:43.000000000 -0500
9838 +++ linux-2.6.32.49/arch/x86/include/asm/pgtable_32.h 2011-11-15 19:59:42.000000000 -0500
9839 @@ -26,9 +26,6 @@
9840 struct mm_struct;
9841 struct vm_area_struct;
9842
9843 -extern pgd_t swapper_pg_dir[1024];
9844 -extern pgd_t trampoline_pg_dir[1024];
9845 -
9846 static inline void pgtable_cache_init(void) { }
9847 static inline void check_pgt_cache(void) { }
9848 void paging_init(void);
9849 @@ -49,6 +46,12 @@ extern void set_pmd_pfn(unsigned long, u
9850 # include <asm/pgtable-2level.h>
9851 #endif
9852
9853 +extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
9854 +extern pgd_t trampoline_pg_dir[PTRS_PER_PGD];
9855 +#ifdef CONFIG_X86_PAE
9856 +extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
9857 +#endif
9858 +
9859 #if defined(CONFIG_HIGHPTE)
9860 #define __KM_PTE \
9861 (in_nmi() ? KM_NMI_PTE : \
9862 @@ -73,7 +76,9 @@ extern void set_pmd_pfn(unsigned long, u
9863 /* Clear a kernel PTE and flush it from the TLB */
9864 #define kpte_clear_flush(ptep, vaddr) \
9865 do { \
9866 + pax_open_kernel(); \
9867 pte_clear(&init_mm, (vaddr), (ptep)); \
9868 + pax_close_kernel(); \
9869 __flush_tlb_one((vaddr)); \
9870 } while (0)
9871
9872 @@ -85,6 +90,9 @@ do { \
9873
9874 #endif /* !__ASSEMBLY__ */
9875
9876 +#define HAVE_ARCH_UNMAPPED_AREA
9877 +#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
9878 +
9879 /*
9880 * kern_addr_valid() is (1) for FLATMEM and (0) for
9881 * SPARSEMEM and DISCONTIGMEM
9882 diff -urNp linux-2.6.32.49/arch/x86/include/asm/pgtable_32_types.h linux-2.6.32.49/arch/x86/include/asm/pgtable_32_types.h
9883 --- linux-2.6.32.49/arch/x86/include/asm/pgtable_32_types.h 2011-11-08 19:02:43.000000000 -0500
9884 +++ linux-2.6.32.49/arch/x86/include/asm/pgtable_32_types.h 2011-11-15 19:59:42.000000000 -0500
9885 @@ -8,7 +8,7 @@
9886 */
9887 #ifdef CONFIG_X86_PAE
9888 # include <asm/pgtable-3level_types.h>
9889 -# define PMD_SIZE (1UL << PMD_SHIFT)
9890 +# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
9891 # define PMD_MASK (~(PMD_SIZE - 1))
9892 #else
9893 # include <asm/pgtable-2level_types.h>
9894 @@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set
9895 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
9896 #endif
9897
9898 +#ifdef CONFIG_PAX_KERNEXEC
9899 +#ifndef __ASSEMBLY__
9900 +extern unsigned char MODULES_EXEC_VADDR[];
9901 +extern unsigned char MODULES_EXEC_END[];
9902 +#endif
9903 +#include <asm/boot.h>
9904 +#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
9905 +#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
9906 +#else
9907 +#define ktla_ktva(addr) (addr)
9908 +#define ktva_ktla(addr) (addr)
9909 +#endif
9910 +
9911 #define MODULES_VADDR VMALLOC_START
9912 #define MODULES_END VMALLOC_END
9913 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
9914 diff -urNp linux-2.6.32.49/arch/x86/include/asm/pgtable-3level.h linux-2.6.32.49/arch/x86/include/asm/pgtable-3level.h
9915 --- linux-2.6.32.49/arch/x86/include/asm/pgtable-3level.h 2011-11-08 19:02:43.000000000 -0500
9916 +++ linux-2.6.32.49/arch/x86/include/asm/pgtable-3level.h 2011-11-15 19:59:42.000000000 -0500
9917 @@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
9918
9919 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9920 {
9921 + pax_open_kernel();
9922 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
9923 + pax_close_kernel();
9924 }
9925
9926 static inline void native_set_pud(pud_t *pudp, pud_t pud)
9927 {
9928 + pax_open_kernel();
9929 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
9930 + pax_close_kernel();
9931 }
9932
9933 /*
9934 diff -urNp linux-2.6.32.49/arch/x86/include/asm/pgtable_64.h linux-2.6.32.49/arch/x86/include/asm/pgtable_64.h
9935 --- linux-2.6.32.49/arch/x86/include/asm/pgtable_64.h 2011-11-08 19:02:43.000000000 -0500
9936 +++ linux-2.6.32.49/arch/x86/include/asm/pgtable_64.h 2011-11-15 19:59:42.000000000 -0500
9937 @@ -16,10 +16,13 @@
9938
9939 extern pud_t level3_kernel_pgt[512];
9940 extern pud_t level3_ident_pgt[512];
9941 +extern pud_t level3_vmalloc_pgt[512];
9942 +extern pud_t level3_vmemmap_pgt[512];
9943 +extern pud_t level2_vmemmap_pgt[512];
9944 extern pmd_t level2_kernel_pgt[512];
9945 extern pmd_t level2_fixmap_pgt[512];
9946 -extern pmd_t level2_ident_pgt[512];
9947 -extern pgd_t init_level4_pgt[];
9948 +extern pmd_t level2_ident_pgt[512*2];
9949 +extern pgd_t init_level4_pgt[512];
9950
9951 #define swapper_pg_dir init_level4_pgt
9952
9953 @@ -74,7 +77,9 @@ static inline pte_t native_ptep_get_and_
9954
9955 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
9956 {
9957 + pax_open_kernel();
9958 *pmdp = pmd;
9959 + pax_close_kernel();
9960 }
9961
9962 static inline void native_pmd_clear(pmd_t *pmd)
9963 @@ -94,6 +99,13 @@ static inline void native_pud_clear(pud_
9964
9965 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
9966 {
9967 + pax_open_kernel();
9968 + *pgdp = pgd;
9969 + pax_close_kernel();
9970 +}
9971 +
9972 +static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
9973 +{
9974 *pgdp = pgd;
9975 }
9976
9977 diff -urNp linux-2.6.32.49/arch/x86/include/asm/pgtable_64_types.h linux-2.6.32.49/arch/x86/include/asm/pgtable_64_types.h
9978 --- linux-2.6.32.49/arch/x86/include/asm/pgtable_64_types.h 2011-11-08 19:02:43.000000000 -0500
9979 +++ linux-2.6.32.49/arch/x86/include/asm/pgtable_64_types.h 2011-11-15 19:59:42.000000000 -0500
9980 @@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
9981 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
9982 #define MODULES_END _AC(0xffffffffff000000, UL)
9983 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
9984 +#define MODULES_EXEC_VADDR MODULES_VADDR
9985 +#define MODULES_EXEC_END MODULES_END
9986 +
9987 +#define ktla_ktva(addr) (addr)
9988 +#define ktva_ktla(addr) (addr)
9989
9990 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
9991 diff -urNp linux-2.6.32.49/arch/x86/include/asm/pgtable.h linux-2.6.32.49/arch/x86/include/asm/pgtable.h
9992 --- linux-2.6.32.49/arch/x86/include/asm/pgtable.h 2011-11-08 19:02:43.000000000 -0500
9993 +++ linux-2.6.32.49/arch/x86/include/asm/pgtable.h 2011-11-15 19:59:42.000000000 -0500
9994 @@ -39,6 +39,7 @@ extern struct list_head pgd_list;
9995
9996 #ifndef __PAGETABLE_PUD_FOLDED
9997 #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
9998 +#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd)
9999 #define pgd_clear(pgd) native_pgd_clear(pgd)
10000 #endif
10001
10002 @@ -74,12 +75,51 @@ extern struct list_head pgd_list;
10003
10004 #define arch_end_context_switch(prev) do {} while(0)
10005
10006 +#define pax_open_kernel() native_pax_open_kernel()
10007 +#define pax_close_kernel() native_pax_close_kernel()
10008 #endif /* CONFIG_PARAVIRT */
10009
10010 +#define __HAVE_ARCH_PAX_OPEN_KERNEL
10011 +#define __HAVE_ARCH_PAX_CLOSE_KERNEL
10012 +
10013 +#ifdef CONFIG_PAX_KERNEXEC
10014 +static inline unsigned long native_pax_open_kernel(void)
10015 +{
10016 + unsigned long cr0;
10017 +
10018 + preempt_disable();
10019 + barrier();
10020 + cr0 = read_cr0() ^ X86_CR0_WP;
10021 + BUG_ON(unlikely(cr0 & X86_CR0_WP));
10022 + write_cr0(cr0);
10023 + return cr0 ^ X86_CR0_WP;
10024 +}
10025 +
10026 +static inline unsigned long native_pax_close_kernel(void)
10027 +{
10028 + unsigned long cr0;
10029 +
10030 + cr0 = read_cr0() ^ X86_CR0_WP;
10031 + BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
10032 + write_cr0(cr0);
10033 + barrier();
10034 + preempt_enable_no_resched();
10035 + return cr0 ^ X86_CR0_WP;
10036 +}
10037 +#else
10038 +static inline unsigned long native_pax_open_kernel(void) { return 0; }
10039 +static inline unsigned long native_pax_close_kernel(void) { return 0; }
10040 +#endif
10041 +
10042 /*
10043 * The following only work if pte_present() is true.
10044 * Undefined behaviour if not..
10045 */
10046 +static inline int pte_user(pte_t pte)
10047 +{
10048 + return pte_val(pte) & _PAGE_USER;
10049 +}
10050 +
10051 static inline int pte_dirty(pte_t pte)
10052 {
10053 return pte_flags(pte) & _PAGE_DIRTY;
10054 @@ -167,9 +207,29 @@ static inline pte_t pte_wrprotect(pte_t
10055 return pte_clear_flags(pte, _PAGE_RW);
10056 }
10057
10058 +static inline pte_t pte_mkread(pte_t pte)
10059 +{
10060 + return __pte(pte_val(pte) | _PAGE_USER);
10061 +}
10062 +
10063 static inline pte_t pte_mkexec(pte_t pte)
10064 {
10065 - return pte_clear_flags(pte, _PAGE_NX);
10066 +#ifdef CONFIG_X86_PAE
10067 + if (__supported_pte_mask & _PAGE_NX)
10068 + return pte_clear_flags(pte, _PAGE_NX);
10069 + else
10070 +#endif
10071 + return pte_set_flags(pte, _PAGE_USER);
10072 +}
10073 +
10074 +static inline pte_t pte_exprotect(pte_t pte)
10075 +{
10076 +#ifdef CONFIG_X86_PAE
10077 + if (__supported_pte_mask & _PAGE_NX)
10078 + return pte_set_flags(pte, _PAGE_NX);
10079 + else
10080 +#endif
10081 + return pte_clear_flags(pte, _PAGE_USER);
10082 }
10083
10084 static inline pte_t pte_mkdirty(pte_t pte)
10085 @@ -302,6 +362,15 @@ pte_t *populate_extra_pte(unsigned long
10086 #endif
10087
10088 #ifndef __ASSEMBLY__
10089 +
10090 +#ifdef CONFIG_PAX_PER_CPU_PGD
10091 +extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
10092 +static inline pgd_t *get_cpu_pgd(unsigned int cpu)
10093 +{
10094 + return cpu_pgd[cpu];
10095 +}
10096 +#endif
10097 +
10098 #include <linux/mm_types.h>
10099
10100 static inline int pte_none(pte_t pte)
10101 @@ -472,7 +541,7 @@ static inline pud_t *pud_offset(pgd_t *p
10102
10103 static inline int pgd_bad(pgd_t pgd)
10104 {
10105 - return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
10106 + return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
10107 }
10108
10109 static inline int pgd_none(pgd_t pgd)
10110 @@ -495,7 +564,12 @@ static inline int pgd_none(pgd_t pgd)
10111 * pgd_offset() returns a (pgd_t *)
10112 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
10113 */
10114 -#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
10115 +#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
10116 +
10117 +#ifdef CONFIG_PAX_PER_CPU_PGD
10118 +#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
10119 +#endif
10120 +
10121 /*
10122 * a shortcut which implies the use of the kernel's pgd, instead
10123 * of a process's
10124 @@ -506,6 +580,20 @@ static inline int pgd_none(pgd_t pgd)
10125 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
10126 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
10127
10128 +#ifdef CONFIG_X86_32
10129 +#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
10130 +#else
10131 +#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
10132 +#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
10133 +
10134 +#ifdef CONFIG_PAX_MEMORY_UDEREF
10135 +#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
10136 +#else
10137 +#define PAX_USER_SHADOW_BASE (_AC(0,UL))
10138 +#endif
10139 +
10140 +#endif
10141 +
10142 #ifndef __ASSEMBLY__
10143
10144 extern int direct_gbpages;
10145 @@ -611,11 +699,23 @@ static inline void ptep_set_wrprotect(st
10146 * dst and src can be on the same page, but the range must not overlap,
10147 * and must not cross a page boundary.
10148 */
10149 -static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
10150 +static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
10151 {
10152 - memcpy(dst, src, count * sizeof(pgd_t));
10153 + pax_open_kernel();
10154 + while (count--)
10155 + *dst++ = *src++;
10156 + pax_close_kernel();
10157 }
10158
10159 +#ifdef CONFIG_PAX_PER_CPU_PGD
10160 +extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
10161 +#endif
10162 +
10163 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10164 +extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
10165 +#else
10166 +static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
10167 +#endif
10168
10169 #include <asm-generic/pgtable.h>
10170 #endif /* __ASSEMBLY__ */
10171 diff -urNp linux-2.6.32.49/arch/x86/include/asm/pgtable_types.h linux-2.6.32.49/arch/x86/include/asm/pgtable_types.h
10172 --- linux-2.6.32.49/arch/x86/include/asm/pgtable_types.h 2011-11-08 19:02:43.000000000 -0500
10173 +++ linux-2.6.32.49/arch/x86/include/asm/pgtable_types.h 2011-11-15 19:59:42.000000000 -0500
10174 @@ -16,12 +16,11 @@
10175 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
10176 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
10177 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
10178 -#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
10179 +#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
10180 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
10181 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
10182 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
10183 -#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
10184 -#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
10185 +#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
10186 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
10187
10188 /* If _PAGE_BIT_PRESENT is clear, we use these: */
10189 @@ -39,7 +38,6 @@
10190 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
10191 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
10192 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
10193 -#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
10194 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
10195 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
10196 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
10197 @@ -55,8 +53,10 @@
10198
10199 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
10200 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
10201 -#else
10202 +#elif defined(CONFIG_KMEMCHECK)
10203 #define _PAGE_NX (_AT(pteval_t, 0))
10204 +#else
10205 +#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
10206 #endif
10207
10208 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
10209 @@ -93,6 +93,9 @@
10210 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
10211 _PAGE_ACCESSED)
10212
10213 +#define PAGE_READONLY_NOEXEC PAGE_READONLY
10214 +#define PAGE_SHARED_NOEXEC PAGE_SHARED
10215 +
10216 #define __PAGE_KERNEL_EXEC \
10217 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
10218 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
10219 @@ -103,8 +106,8 @@
10220 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
10221 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
10222 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
10223 -#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
10224 -#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
10225 +#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
10226 +#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
10227 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
10228 #define __PAGE_KERNEL_LARGE_NOCACHE (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
10229 #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE)
10230 @@ -163,8 +166,8 @@
10231 * bits are combined, this will alow user to access the high address mapped
10232 * VDSO in the presence of CONFIG_COMPAT_VDSO
10233 */
10234 -#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
10235 -#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
10236 +#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
10237 +#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
10238 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
10239 #endif
10240
10241 @@ -202,7 +205,17 @@ static inline pgdval_t pgd_flags(pgd_t p
10242 {
10243 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
10244 }
10245 +#endif
10246
10247 +#if PAGETABLE_LEVELS == 3
10248 +#include <asm-generic/pgtable-nopud.h>
10249 +#endif
10250 +
10251 +#if PAGETABLE_LEVELS == 2
10252 +#include <asm-generic/pgtable-nopmd.h>
10253 +#endif
10254 +
10255 +#ifndef __ASSEMBLY__
10256 #if PAGETABLE_LEVELS > 3
10257 typedef struct { pudval_t pud; } pud_t;
10258
10259 @@ -216,8 +229,6 @@ static inline pudval_t native_pud_val(pu
10260 return pud.pud;
10261 }
10262 #else
10263 -#include <asm-generic/pgtable-nopud.h>
10264 -
10265 static inline pudval_t native_pud_val(pud_t pud)
10266 {
10267 return native_pgd_val(pud.pgd);
10268 @@ -237,8 +248,6 @@ static inline pmdval_t native_pmd_val(pm
10269 return pmd.pmd;
10270 }
10271 #else
10272 -#include <asm-generic/pgtable-nopmd.h>
10273 -
10274 static inline pmdval_t native_pmd_val(pmd_t pmd)
10275 {
10276 return native_pgd_val(pmd.pud.pgd);
10277 @@ -278,7 +287,16 @@ typedef struct page *pgtable_t;
10278
10279 extern pteval_t __supported_pte_mask;
10280 extern void set_nx(void);
10281 +
10282 +#ifdef CONFIG_X86_32
10283 +#ifdef CONFIG_X86_PAE
10284 extern int nx_enabled;
10285 +#else
10286 +#define nx_enabled (0)
10287 +#endif
10288 +#else
10289 +#define nx_enabled (1)
10290 +#endif
10291
10292 #define pgprot_writecombine pgprot_writecombine
10293 extern pgprot_t pgprot_writecombine(pgprot_t prot);
10294 diff -urNp linux-2.6.32.49/arch/x86/include/asm/processor.h linux-2.6.32.49/arch/x86/include/asm/processor.h
10295 --- linux-2.6.32.49/arch/x86/include/asm/processor.h 2011-11-08 19:02:43.000000000 -0500
10296 +++ linux-2.6.32.49/arch/x86/include/asm/processor.h 2011-11-15 19:59:42.000000000 -0500
10297 @@ -272,7 +272,7 @@ struct tss_struct {
10298
10299 } ____cacheline_aligned;
10300
10301 -DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
10302 +extern struct tss_struct init_tss[NR_CPUS];
10303
10304 /*
10305 * Save the original ist values for checking stack pointers during debugging
10306 @@ -911,11 +911,18 @@ static inline void spin_lock_prefetch(co
10307 */
10308 #define TASK_SIZE PAGE_OFFSET
10309 #define TASK_SIZE_MAX TASK_SIZE
10310 +
10311 +#ifdef CONFIG_PAX_SEGMEXEC
10312 +#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
10313 +#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
10314 +#else
10315 #define STACK_TOP TASK_SIZE
10316 -#define STACK_TOP_MAX STACK_TOP
10317 +#endif
10318 +
10319 +#define STACK_TOP_MAX TASK_SIZE
10320
10321 #define INIT_THREAD { \
10322 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
10323 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
10324 .vm86_info = NULL, \
10325 .sysenter_cs = __KERNEL_CS, \
10326 .io_bitmap_ptr = NULL, \
10327 @@ -929,7 +936,7 @@ static inline void spin_lock_prefetch(co
10328 */
10329 #define INIT_TSS { \
10330 .x86_tss = { \
10331 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
10332 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
10333 .ss0 = __KERNEL_DS, \
10334 .ss1 = __KERNEL_CS, \
10335 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
10336 @@ -940,11 +947,7 @@ static inline void spin_lock_prefetch(co
10337 extern unsigned long thread_saved_pc(struct task_struct *tsk);
10338
10339 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
10340 -#define KSTK_TOP(info) \
10341 -({ \
10342 - unsigned long *__ptr = (unsigned long *)(info); \
10343 - (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
10344 -})
10345 +#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
10346
10347 /*
10348 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
10349 @@ -959,7 +962,7 @@ extern unsigned long thread_saved_pc(str
10350 #define task_pt_regs(task) \
10351 ({ \
10352 struct pt_regs *__regs__; \
10353 - __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
10354 + __regs__ = (struct pt_regs *)((task)->thread.sp0); \
10355 __regs__ - 1; \
10356 })
10357
10358 @@ -969,13 +972,13 @@ extern unsigned long thread_saved_pc(str
10359 /*
10360 * User space process size. 47bits minus one guard page.
10361 */
10362 -#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
10363 +#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
10364
10365 /* This decides where the kernel will search for a free chunk of vm
10366 * space during mmap's.
10367 */
10368 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
10369 - 0xc0000000 : 0xFFFFe000)
10370 + 0xc0000000 : 0xFFFFf000)
10371
10372 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
10373 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
10374 @@ -986,11 +989,11 @@ extern unsigned long thread_saved_pc(str
10375 #define STACK_TOP_MAX TASK_SIZE_MAX
10376
10377 #define INIT_THREAD { \
10378 - .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
10379 + .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
10380 }
10381
10382 #define INIT_TSS { \
10383 - .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
10384 + .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
10385 }
10386
10387 /*
10388 @@ -1012,6 +1015,10 @@ extern void start_thread(struct pt_regs
10389 */
10390 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
10391
10392 +#ifdef CONFIG_PAX_SEGMEXEC
10393 +#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
10394 +#endif
10395 +
10396 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
10397
10398 /* Get/set a process' ability to use the timestamp counter instruction */
10399 diff -urNp linux-2.6.32.49/arch/x86/include/asm/ptrace.h linux-2.6.32.49/arch/x86/include/asm/ptrace.h
10400 --- linux-2.6.32.49/arch/x86/include/asm/ptrace.h 2011-11-08 19:02:43.000000000 -0500
10401 +++ linux-2.6.32.49/arch/x86/include/asm/ptrace.h 2011-11-15 19:59:42.000000000 -0500
10402 @@ -151,28 +151,29 @@ static inline unsigned long regs_return_
10403 }
10404
10405 /*
10406 - * user_mode_vm(regs) determines whether a register set came from user mode.
10407 + * user_mode(regs) determines whether a register set came from user mode.
10408 * This is true if V8086 mode was enabled OR if the register set was from
10409 * protected mode with RPL-3 CS value. This tricky test checks that with
10410 * one comparison. Many places in the kernel can bypass this full check
10411 - * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
10412 + * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
10413 + * be used.
10414 */
10415 -static inline int user_mode(struct pt_regs *regs)
10416 +static inline int user_mode_novm(struct pt_regs *regs)
10417 {
10418 #ifdef CONFIG_X86_32
10419 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
10420 #else
10421 - return !!(regs->cs & 3);
10422 + return !!(regs->cs & SEGMENT_RPL_MASK);
10423 #endif
10424 }
10425
10426 -static inline int user_mode_vm(struct pt_regs *regs)
10427 +static inline int user_mode(struct pt_regs *regs)
10428 {
10429 #ifdef CONFIG_X86_32
10430 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
10431 USER_RPL;
10432 #else
10433 - return user_mode(regs);
10434 + return user_mode_novm(regs);
10435 #endif
10436 }
10437
10438 diff -urNp linux-2.6.32.49/arch/x86/include/asm/reboot.h linux-2.6.32.49/arch/x86/include/asm/reboot.h
10439 --- linux-2.6.32.49/arch/x86/include/asm/reboot.h 2011-11-08 19:02:43.000000000 -0500
10440 +++ linux-2.6.32.49/arch/x86/include/asm/reboot.h 2011-11-15 19:59:42.000000000 -0500
10441 @@ -6,19 +6,19 @@
10442 struct pt_regs;
10443
10444 struct machine_ops {
10445 - void (*restart)(char *cmd);
10446 - void (*halt)(void);
10447 - void (*power_off)(void);
10448 + void (* __noreturn restart)(char *cmd);
10449 + void (* __noreturn halt)(void);
10450 + void (* __noreturn power_off)(void);
10451 void (*shutdown)(void);
10452 void (*crash_shutdown)(struct pt_regs *);
10453 - void (*emergency_restart)(void);
10454 -};
10455 + void (* __noreturn emergency_restart)(void);
10456 +} __no_const;
10457
10458 extern struct machine_ops machine_ops;
10459
10460 void native_machine_crash_shutdown(struct pt_regs *regs);
10461 void native_machine_shutdown(void);
10462 -void machine_real_restart(const unsigned char *code, int length);
10463 +void machine_real_restart(const unsigned char *code, unsigned int length) __noreturn;
10464
10465 typedef void (*nmi_shootdown_cb)(int, struct die_args*);
10466 void nmi_shootdown_cpus(nmi_shootdown_cb callback);
10467 diff -urNp linux-2.6.32.49/arch/x86/include/asm/rwsem.h linux-2.6.32.49/arch/x86/include/asm/rwsem.h
10468 --- linux-2.6.32.49/arch/x86/include/asm/rwsem.h 2011-11-08 19:02:43.000000000 -0500
10469 +++ linux-2.6.32.49/arch/x86/include/asm/rwsem.h 2011-11-15 19:59:42.000000000 -0500
10470 @@ -118,6 +118,14 @@ static inline void __down_read(struct rw
10471 {
10472 asm volatile("# beginning down_read\n\t"
10473 LOCK_PREFIX _ASM_INC "(%1)\n\t"
10474 +
10475 +#ifdef CONFIG_PAX_REFCOUNT
10476 + "jno 0f\n"
10477 + LOCK_PREFIX _ASM_DEC "(%1)\n\t"
10478 + "int $4\n0:\n"
10479 + _ASM_EXTABLE(0b, 0b)
10480 +#endif
10481 +
10482 /* adds 0x00000001, returns the old value */
10483 " jns 1f\n"
10484 " call call_rwsem_down_read_failed\n"
10485 @@ -139,6 +147,14 @@ static inline int __down_read_trylock(st
10486 "1:\n\t"
10487 " mov %1,%2\n\t"
10488 " add %3,%2\n\t"
10489 +
10490 +#ifdef CONFIG_PAX_REFCOUNT
10491 + "jno 0f\n"
10492 + "sub %3,%2\n"
10493 + "int $4\n0:\n"
10494 + _ASM_EXTABLE(0b, 0b)
10495 +#endif
10496 +
10497 " jle 2f\n\t"
10498 LOCK_PREFIX " cmpxchg %2,%0\n\t"
10499 " jnz 1b\n\t"
10500 @@ -160,6 +176,14 @@ static inline void __down_write_nested(s
10501 tmp = RWSEM_ACTIVE_WRITE_BIAS;
10502 asm volatile("# beginning down_write\n\t"
10503 LOCK_PREFIX " xadd %1,(%2)\n\t"
10504 +
10505 +#ifdef CONFIG_PAX_REFCOUNT
10506 + "jno 0f\n"
10507 + "mov %1,(%2)\n"
10508 + "int $4\n0:\n"
10509 + _ASM_EXTABLE(0b, 0b)
10510 +#endif
10511 +
10512 /* subtract 0x0000ffff, returns the old value */
10513 " test %1,%1\n\t"
10514 /* was the count 0 before? */
10515 @@ -198,6 +222,14 @@ static inline void __up_read(struct rw_s
10516 rwsem_count_t tmp = -RWSEM_ACTIVE_READ_BIAS;
10517 asm volatile("# beginning __up_read\n\t"
10518 LOCK_PREFIX " xadd %1,(%2)\n\t"
10519 +
10520 +#ifdef CONFIG_PAX_REFCOUNT
10521 + "jno 0f\n"
10522 + "mov %1,(%2)\n"
10523 + "int $4\n0:\n"
10524 + _ASM_EXTABLE(0b, 0b)
10525 +#endif
10526 +
10527 /* subtracts 1, returns the old value */
10528 " jns 1f\n\t"
10529 " call call_rwsem_wake\n"
10530 @@ -216,6 +248,14 @@ static inline void __up_write(struct rw_
10531 rwsem_count_t tmp;
10532 asm volatile("# beginning __up_write\n\t"
10533 LOCK_PREFIX " xadd %1,(%2)\n\t"
10534 +
10535 +#ifdef CONFIG_PAX_REFCOUNT
10536 + "jno 0f\n"
10537 + "mov %1,(%2)\n"
10538 + "int $4\n0:\n"
10539 + _ASM_EXTABLE(0b, 0b)
10540 +#endif
10541 +
10542 /* tries to transition
10543 0xffff0001 -> 0x00000000 */
10544 " jz 1f\n"
10545 @@ -234,6 +274,14 @@ static inline void __downgrade_write(str
10546 {
10547 asm volatile("# beginning __downgrade_write\n\t"
10548 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
10549 +
10550 +#ifdef CONFIG_PAX_REFCOUNT
10551 + "jno 0f\n"
10552 + LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
10553 + "int $4\n0:\n"
10554 + _ASM_EXTABLE(0b, 0b)
10555 +#endif
10556 +
10557 /*
10558 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
10559 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
10560 @@ -253,7 +301,15 @@ static inline void __downgrade_write(str
10561 static inline void rwsem_atomic_add(rwsem_count_t delta,
10562 struct rw_semaphore *sem)
10563 {
10564 - asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
10565 + asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
10566 +
10567 +#ifdef CONFIG_PAX_REFCOUNT
10568 + "jno 0f\n"
10569 + LOCK_PREFIX _ASM_SUB "%1,%0\n"
10570 + "int $4\n0:\n"
10571 + _ASM_EXTABLE(0b, 0b)
10572 +#endif
10573 +
10574 : "+m" (sem->count)
10575 : "er" (delta));
10576 }
10577 @@ -266,7 +322,15 @@ static inline rwsem_count_t rwsem_atomic
10578 {
10579 rwsem_count_t tmp = delta;
10580
10581 - asm volatile(LOCK_PREFIX "xadd %0,%1"
10582 + asm volatile(LOCK_PREFIX "xadd %0,%1\n"
10583 +
10584 +#ifdef CONFIG_PAX_REFCOUNT
10585 + "jno 0f\n"
10586 + "mov %0,%1\n"
10587 + "int $4\n0:\n"
10588 + _ASM_EXTABLE(0b, 0b)
10589 +#endif
10590 +
10591 : "+r" (tmp), "+m" (sem->count)
10592 : : "memory");
10593
10594 diff -urNp linux-2.6.32.49/arch/x86/include/asm/segment.h linux-2.6.32.49/arch/x86/include/asm/segment.h
10595 --- linux-2.6.32.49/arch/x86/include/asm/segment.h 2011-11-08 19:02:43.000000000 -0500
10596 +++ linux-2.6.32.49/arch/x86/include/asm/segment.h 2011-11-15 19:59:42.000000000 -0500
10597 @@ -62,10 +62,15 @@
10598 * 26 - ESPFIX small SS
10599 * 27 - per-cpu [ offset to per-cpu data area ]
10600 * 28 - stack_canary-20 [ for stack protector ]
10601 - * 29 - unused
10602 - * 30 - unused
10603 + * 29 - PCI BIOS CS
10604 + * 30 - PCI BIOS DS
10605 * 31 - TSS for double fault handler
10606 */
10607 +#define GDT_ENTRY_KERNEXEC_EFI_CS (1)
10608 +#define GDT_ENTRY_KERNEXEC_EFI_DS (2)
10609 +#define __KERNEXEC_EFI_CS (GDT_ENTRY_KERNEXEC_EFI_CS*8)
10610 +#define __KERNEXEC_EFI_DS (GDT_ENTRY_KERNEXEC_EFI_DS*8)
10611 +
10612 #define GDT_ENTRY_TLS_MIN 6
10613 #define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)
10614
10615 @@ -77,6 +82,8 @@
10616
10617 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE + 0)
10618
10619 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
10620 +
10621 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE + 1)
10622
10623 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE + 4)
10624 @@ -88,7 +95,7 @@
10625 #define GDT_ENTRY_ESPFIX_SS (GDT_ENTRY_KERNEL_BASE + 14)
10626 #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)
10627
10628 -#define GDT_ENTRY_PERCPU (GDT_ENTRY_KERNEL_BASE + 15)
10629 +#define GDT_ENTRY_PERCPU (GDT_ENTRY_KERNEL_BASE + 15)
10630 #ifdef CONFIG_SMP
10631 #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8)
10632 #else
10633 @@ -102,6 +109,12 @@
10634 #define __KERNEL_STACK_CANARY 0
10635 #endif
10636
10637 +#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE + 17)
10638 +#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
10639 +
10640 +#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE + 18)
10641 +#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
10642 +
10643 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
10644
10645 /*
10646 @@ -139,7 +152,7 @@
10647 */
10648
10649 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
10650 -#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
10651 +#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
10652
10653
10654 #else
10655 @@ -163,6 +176,8 @@
10656 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
10657 #define __USER32_DS __USER_DS
10658
10659 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
10660 +
10661 #define GDT_ENTRY_TSS 8 /* needs two entries */
10662 #define GDT_ENTRY_LDT 10 /* needs two entries */
10663 #define GDT_ENTRY_TLS_MIN 12
10664 @@ -183,6 +198,7 @@
10665 #endif
10666
10667 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS * 8)
10668 +#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS * 8)
10669 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS * 8)
10670 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
10671 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
10672 diff -urNp linux-2.6.32.49/arch/x86/include/asm/smp.h linux-2.6.32.49/arch/x86/include/asm/smp.h
10673 --- linux-2.6.32.49/arch/x86/include/asm/smp.h 2011-11-08 19:02:43.000000000 -0500
10674 +++ linux-2.6.32.49/arch/x86/include/asm/smp.h 2011-11-15 19:59:42.000000000 -0500
10675 @@ -24,7 +24,7 @@ extern unsigned int num_processors;
10676 DECLARE_PER_CPU(cpumask_var_t, cpu_sibling_map);
10677 DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
10678 DECLARE_PER_CPU(u16, cpu_llc_id);
10679 -DECLARE_PER_CPU(int, cpu_number);
10680 +DECLARE_PER_CPU(unsigned int, cpu_number);
10681
10682 static inline struct cpumask *cpu_sibling_mask(int cpu)
10683 {
10684 @@ -40,10 +40,7 @@ DECLARE_EARLY_PER_CPU(u16, x86_cpu_to_ap
10685 DECLARE_EARLY_PER_CPU(u16, x86_bios_cpu_apicid);
10686
10687 /* Static state in head.S used to set up a CPU */
10688 -extern struct {
10689 - void *sp;
10690 - unsigned short ss;
10691 -} stack_start;
10692 +extern unsigned long stack_start; /* Initial stack pointer address */
10693
10694 struct smp_ops {
10695 void (*smp_prepare_boot_cpu)(void);
10696 @@ -60,7 +57,7 @@ struct smp_ops {
10697
10698 void (*send_call_func_ipi)(const struct cpumask *mask);
10699 void (*send_call_func_single_ipi)(int cpu);
10700 -};
10701 +} __no_const;
10702
10703 /* Globals due to paravirt */
10704 extern void set_cpu_sibling_map(int cpu);
10705 @@ -175,14 +172,8 @@ extern unsigned disabled_cpus __cpuinitd
10706 extern int safe_smp_processor_id(void);
10707
10708 #elif defined(CONFIG_X86_64_SMP)
10709 -#define raw_smp_processor_id() (percpu_read(cpu_number))
10710 -
10711 -#define stack_smp_processor_id() \
10712 -({ \
10713 - struct thread_info *ti; \
10714 - __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
10715 - ti->cpu; \
10716 -})
10717 +#define raw_smp_processor_id() (percpu_read(cpu_number))
10718 +#define stack_smp_processor_id() raw_smp_processor_id()
10719 #define safe_smp_processor_id() smp_processor_id()
10720
10721 #endif
10722 diff -urNp linux-2.6.32.49/arch/x86/include/asm/spinlock.h linux-2.6.32.49/arch/x86/include/asm/spinlock.h
10723 --- linux-2.6.32.49/arch/x86/include/asm/spinlock.h 2011-11-08 19:02:43.000000000 -0500
10724 +++ linux-2.6.32.49/arch/x86/include/asm/spinlock.h 2011-11-15 19:59:42.000000000 -0500
10725 @@ -249,6 +249,14 @@ static inline int __raw_write_can_lock(r
10726 static inline void __raw_read_lock(raw_rwlock_t *rw)
10727 {
10728 asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
10729 +
10730 +#ifdef CONFIG_PAX_REFCOUNT
10731 + "jno 0f\n"
10732 + LOCK_PREFIX " addl $1,(%0)\n"
10733 + "int $4\n0:\n"
10734 + _ASM_EXTABLE(0b, 0b)
10735 +#endif
10736 +
10737 "jns 1f\n"
10738 "call __read_lock_failed\n\t"
10739 "1:\n"
10740 @@ -258,6 +266,14 @@ static inline void __raw_read_lock(raw_r
10741 static inline void __raw_write_lock(raw_rwlock_t *rw)
10742 {
10743 asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
10744 +
10745 +#ifdef CONFIG_PAX_REFCOUNT
10746 + "jno 0f\n"
10747 + LOCK_PREFIX " addl %1,(%0)\n"
10748 + "int $4\n0:\n"
10749 + _ASM_EXTABLE(0b, 0b)
10750 +#endif
10751 +
10752 "jz 1f\n"
10753 "call __write_lock_failed\n\t"
10754 "1:\n"
10755 @@ -286,12 +302,29 @@ static inline int __raw_write_trylock(ra
10756
10757 static inline void __raw_read_unlock(raw_rwlock_t *rw)
10758 {
10759 - asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
10760 + asm volatile(LOCK_PREFIX "incl %0\n"
10761 +
10762 +#ifdef CONFIG_PAX_REFCOUNT
10763 + "jno 0f\n"
10764 + LOCK_PREFIX "decl %0\n"
10765 + "int $4\n0:\n"
10766 + _ASM_EXTABLE(0b, 0b)
10767 +#endif
10768 +
10769 + :"+m" (rw->lock) : : "memory");
10770 }
10771
10772 static inline void __raw_write_unlock(raw_rwlock_t *rw)
10773 {
10774 - asm volatile(LOCK_PREFIX "addl %1, %0"
10775 + asm volatile(LOCK_PREFIX "addl %1, %0\n"
10776 +
10777 +#ifdef CONFIG_PAX_REFCOUNT
10778 + "jno 0f\n"
10779 + LOCK_PREFIX "subl %1, %0\n"
10780 + "int $4\n0:\n"
10781 + _ASM_EXTABLE(0b, 0b)
10782 +#endif
10783 +
10784 : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
10785 }
10786
10787 diff -urNp linux-2.6.32.49/arch/x86/include/asm/stackprotector.h linux-2.6.32.49/arch/x86/include/asm/stackprotector.h
10788 --- linux-2.6.32.49/arch/x86/include/asm/stackprotector.h 2011-11-08 19:02:43.000000000 -0500
10789 +++ linux-2.6.32.49/arch/x86/include/asm/stackprotector.h 2011-11-15 19:59:42.000000000 -0500
10790 @@ -48,7 +48,7 @@
10791 * head_32 for boot CPU and setup_per_cpu_areas() for others.
10792 */
10793 #define GDT_STACK_CANARY_INIT \
10794 - [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
10795 + [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
10796
10797 /*
10798 * Initialize the stackprotector canary value.
10799 @@ -113,7 +113,7 @@ static inline void setup_stack_canary_se
10800
10801 static inline void load_stack_canary_segment(void)
10802 {
10803 -#ifdef CONFIG_X86_32
10804 +#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
10805 asm volatile ("mov %0, %%gs" : : "r" (0));
10806 #endif
10807 }
10808 diff -urNp linux-2.6.32.49/arch/x86/include/asm/system.h linux-2.6.32.49/arch/x86/include/asm/system.h
10809 --- linux-2.6.32.49/arch/x86/include/asm/system.h 2011-11-08 19:02:43.000000000 -0500
10810 +++ linux-2.6.32.49/arch/x86/include/asm/system.h 2011-11-15 19:59:42.000000000 -0500
10811 @@ -132,7 +132,7 @@ do { \
10812 "thread_return:\n\t" \
10813 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
10814 __switch_canary \
10815 - "movq %P[thread_info](%%rsi),%%r8\n\t" \
10816 + "movq "__percpu_arg([thread_info])",%%r8\n\t" \
10817 "movq %%rax,%%rdi\n\t" \
10818 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
10819 "jnz ret_from_fork\n\t" \
10820 @@ -143,7 +143,7 @@ do { \
10821 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
10822 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
10823 [_tif_fork] "i" (_TIF_FORK), \
10824 - [thread_info] "i" (offsetof(struct task_struct, stack)), \
10825 + [thread_info] "m" (per_cpu_var(current_tinfo)), \
10826 [current_task] "m" (per_cpu_var(current_task)) \
10827 __switch_canary_iparam \
10828 : "memory", "cc" __EXTRA_CLOBBER)
10829 @@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
10830 {
10831 unsigned long __limit;
10832 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
10833 - return __limit + 1;
10834 + return __limit;
10835 }
10836
10837 static inline void native_clts(void)
10838 @@ -340,12 +340,12 @@ void enable_hlt(void);
10839
10840 void cpu_idle_wait(void);
10841
10842 -extern unsigned long arch_align_stack(unsigned long sp);
10843 +#define arch_align_stack(x) ((x) & ~0xfUL)
10844 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
10845
10846 void default_idle(void);
10847
10848 -void stop_this_cpu(void *dummy);
10849 +void stop_this_cpu(void *dummy) __noreturn;
10850
10851 /*
10852 * Force strict CPU ordering.
10853 diff -urNp linux-2.6.32.49/arch/x86/include/asm/thread_info.h linux-2.6.32.49/arch/x86/include/asm/thread_info.h
10854 --- linux-2.6.32.49/arch/x86/include/asm/thread_info.h 2011-11-08 19:02:43.000000000 -0500
10855 +++ linux-2.6.32.49/arch/x86/include/asm/thread_info.h 2011-11-15 19:59:42.000000000 -0500
10856 @@ -10,6 +10,7 @@
10857 #include <linux/compiler.h>
10858 #include <asm/page.h>
10859 #include <asm/types.h>
10860 +#include <asm/percpu.h>
10861
10862 /*
10863 * low level task data that entry.S needs immediate access to
10864 @@ -24,7 +25,6 @@ struct exec_domain;
10865 #include <asm/atomic.h>
10866
10867 struct thread_info {
10868 - struct task_struct *task; /* main task structure */
10869 struct exec_domain *exec_domain; /* execution domain */
10870 __u32 flags; /* low level flags */
10871 __u32 status; /* thread synchronous flags */
10872 @@ -34,18 +34,12 @@ struct thread_info {
10873 mm_segment_t addr_limit;
10874 struct restart_block restart_block;
10875 void __user *sysenter_return;
10876 -#ifdef CONFIG_X86_32
10877 - unsigned long previous_esp; /* ESP of the previous stack in
10878 - case of nested (IRQ) stacks
10879 - */
10880 - __u8 supervisor_stack[0];
10881 -#endif
10882 + unsigned long lowest_stack;
10883 int uaccess_err;
10884 };
10885
10886 -#define INIT_THREAD_INFO(tsk) \
10887 +#define INIT_THREAD_INFO \
10888 { \
10889 - .task = &tsk, \
10890 .exec_domain = &default_exec_domain, \
10891 .flags = 0, \
10892 .cpu = 0, \
10893 @@ -56,7 +50,7 @@ struct thread_info {
10894 }, \
10895 }
10896
10897 -#define init_thread_info (init_thread_union.thread_info)
10898 +#define init_thread_info (init_thread_union.stack)
10899 #define init_stack (init_thread_union.stack)
10900
10901 #else /* !__ASSEMBLY__ */
10902 @@ -163,6 +157,23 @@ struct thread_info {
10903 #define alloc_thread_info(tsk) \
10904 ((struct thread_info *)__get_free_pages(THREAD_FLAGS, THREAD_ORDER))
10905
10906 +#ifdef __ASSEMBLY__
10907 +/* how to get the thread information struct from ASM */
10908 +#define GET_THREAD_INFO(reg) \
10909 + mov PER_CPU_VAR(current_tinfo), reg
10910 +
10911 +/* use this one if reg already contains %esp */
10912 +#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
10913 +#else
10914 +/* how to get the thread information struct from C */
10915 +DECLARE_PER_CPU(struct thread_info *, current_tinfo);
10916 +
10917 +static __always_inline struct thread_info *current_thread_info(void)
10918 +{
10919 + return percpu_read_stable(current_tinfo);
10920 +}
10921 +#endif
10922 +
10923 #ifdef CONFIG_X86_32
10924
10925 #define STACK_WARN (THREAD_SIZE/8)
10926 @@ -173,35 +184,13 @@ struct thread_info {
10927 */
10928 #ifndef __ASSEMBLY__
10929
10930 -
10931 /* how to get the current stack pointer from C */
10932 register unsigned long current_stack_pointer asm("esp") __used;
10933
10934 -/* how to get the thread information struct from C */
10935 -static inline struct thread_info *current_thread_info(void)
10936 -{
10937 - return (struct thread_info *)
10938 - (current_stack_pointer & ~(THREAD_SIZE - 1));
10939 -}
10940 -
10941 -#else /* !__ASSEMBLY__ */
10942 -
10943 -/* how to get the thread information struct from ASM */
10944 -#define GET_THREAD_INFO(reg) \
10945 - movl $-THREAD_SIZE, reg; \
10946 - andl %esp, reg
10947 -
10948 -/* use this one if reg already contains %esp */
10949 -#define GET_THREAD_INFO_WITH_ESP(reg) \
10950 - andl $-THREAD_SIZE, reg
10951 -
10952 #endif
10953
10954 #else /* X86_32 */
10955
10956 -#include <asm/percpu.h>
10957 -#define KERNEL_STACK_OFFSET (5*8)
10958 -
10959 /*
10960 * macros/functions for gaining access to the thread information structure
10961 * preempt_count needs to be 1 initially, until the scheduler is functional.
10962 @@ -209,21 +198,8 @@ static inline struct thread_info *curren
10963 #ifndef __ASSEMBLY__
10964 DECLARE_PER_CPU(unsigned long, kernel_stack);
10965
10966 -static inline struct thread_info *current_thread_info(void)
10967 -{
10968 - struct thread_info *ti;
10969 - ti = (void *)(percpu_read_stable(kernel_stack) +
10970 - KERNEL_STACK_OFFSET - THREAD_SIZE);
10971 - return ti;
10972 -}
10973 -
10974 -#else /* !__ASSEMBLY__ */
10975 -
10976 -/* how to get the thread information struct from ASM */
10977 -#define GET_THREAD_INFO(reg) \
10978 - movq PER_CPU_VAR(kernel_stack),reg ; \
10979 - subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
10980 -
10981 +/* how to get the current stack pointer from C */
10982 +register unsigned long current_stack_pointer asm("rsp") __used;
10983 #endif
10984
10985 #endif /* !X86_32 */
10986 @@ -260,5 +236,16 @@ extern void arch_task_cache_init(void);
10987 extern void free_thread_info(struct thread_info *ti);
10988 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
10989 #define arch_task_cache_init arch_task_cache_init
10990 +
10991 +#define __HAVE_THREAD_FUNCTIONS
10992 +#define task_thread_info(task) (&(task)->tinfo)
10993 +#define task_stack_page(task) ((task)->stack)
10994 +#define setup_thread_stack(p, org) do {} while (0)
10995 +#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
10996 +
10997 +#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
10998 +extern struct task_struct *alloc_task_struct(void);
10999 +extern void free_task_struct(struct task_struct *);
11000 +
11001 #endif
11002 #endif /* _ASM_X86_THREAD_INFO_H */
11003 diff -urNp linux-2.6.32.49/arch/x86/include/asm/uaccess_32.h linux-2.6.32.49/arch/x86/include/asm/uaccess_32.h
11004 --- linux-2.6.32.49/arch/x86/include/asm/uaccess_32.h 2011-11-08 19:02:43.000000000 -0500
11005 +++ linux-2.6.32.49/arch/x86/include/asm/uaccess_32.h 2011-11-15 19:59:42.000000000 -0500
11006 @@ -44,6 +44,11 @@ unsigned long __must_check __copy_from_u
11007 static __always_inline unsigned long __must_check
11008 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
11009 {
11010 + pax_track_stack();
11011 +
11012 + if ((long)n < 0)
11013 + return n;
11014 +
11015 if (__builtin_constant_p(n)) {
11016 unsigned long ret;
11017
11018 @@ -62,6 +67,8 @@ __copy_to_user_inatomic(void __user *to,
11019 return ret;
11020 }
11021 }
11022 + if (!__builtin_constant_p(n))
11023 + check_object_size(from, n, true);
11024 return __copy_to_user_ll(to, from, n);
11025 }
11026
11027 @@ -83,12 +90,16 @@ static __always_inline unsigned long __m
11028 __copy_to_user(void __user *to, const void *from, unsigned long n)
11029 {
11030 might_fault();
11031 +
11032 return __copy_to_user_inatomic(to, from, n);
11033 }
11034
11035 static __always_inline unsigned long
11036 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
11037 {
11038 + if ((long)n < 0)
11039 + return n;
11040 +
11041 /* Avoid zeroing the tail if the copy fails..
11042 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
11043 * but as the zeroing behaviour is only significant when n is not
11044 @@ -138,6 +149,12 @@ static __always_inline unsigned long
11045 __copy_from_user(void *to, const void __user *from, unsigned long n)
11046 {
11047 might_fault();
11048 +
11049 + pax_track_stack();
11050 +
11051 + if ((long)n < 0)
11052 + return n;
11053 +
11054 if (__builtin_constant_p(n)) {
11055 unsigned long ret;
11056
11057 @@ -153,6 +170,8 @@ __copy_from_user(void *to, const void __
11058 return ret;
11059 }
11060 }
11061 + if (!__builtin_constant_p(n))
11062 + check_object_size(to, n, false);
11063 return __copy_from_user_ll(to, from, n);
11064 }
11065
11066 @@ -160,6 +179,10 @@ static __always_inline unsigned long __c
11067 const void __user *from, unsigned long n)
11068 {
11069 might_fault();
11070 +
11071 + if ((long)n < 0)
11072 + return n;
11073 +
11074 if (__builtin_constant_p(n)) {
11075 unsigned long ret;
11076
11077 @@ -182,14 +205,62 @@ static __always_inline unsigned long
11078 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
11079 unsigned long n)
11080 {
11081 - return __copy_from_user_ll_nocache_nozero(to, from, n);
11082 + if ((long)n < 0)
11083 + return n;
11084 +
11085 + return __copy_from_user_ll_nocache_nozero(to, from, n);
11086 +}
11087 +
11088 +/**
11089 + * copy_to_user: - Copy a block of data into user space.
11090 + * @to: Destination address, in user space.
11091 + * @from: Source address, in kernel space.
11092 + * @n: Number of bytes to copy.
11093 + *
11094 + * Context: User context only. This function may sleep.
11095 + *
11096 + * Copy data from kernel space to user space.
11097 + *
11098 + * Returns number of bytes that could not be copied.
11099 + * On success, this will be zero.
11100 + */
11101 +static __always_inline unsigned long __must_check
11102 +copy_to_user(void __user *to, const void *from, unsigned long n)
11103 +{
11104 + if (access_ok(VERIFY_WRITE, to, n))
11105 + n = __copy_to_user(to, from, n);
11106 + return n;
11107 +}
11108 +
11109 +/**
11110 + * copy_from_user: - Copy a block of data from user space.
11111 + * @to: Destination address, in kernel space.
11112 + * @from: Source address, in user space.
11113 + * @n: Number of bytes to copy.
11114 + *
11115 + * Context: User context only. This function may sleep.
11116 + *
11117 + * Copy data from user space to kernel space.
11118 + *
11119 + * Returns number of bytes that could not be copied.
11120 + * On success, this will be zero.
11121 + *
11122 + * If some data could not be copied, this function will pad the copied
11123 + * data to the requested size using zero bytes.
11124 + */
11125 +static __always_inline unsigned long __must_check
11126 +copy_from_user(void *to, const void __user *from, unsigned long n)
11127 +{
11128 + if (access_ok(VERIFY_READ, from, n))
11129 + n = __copy_from_user(to, from, n);
11130 + else if ((long)n > 0) {
11131 + if (!__builtin_constant_p(n))
11132 + check_object_size(to, n, false);
11133 + memset(to, 0, n);
11134 + }
11135 + return n;
11136 }
11137
11138 -unsigned long __must_check copy_to_user(void __user *to,
11139 - const void *from, unsigned long n);
11140 -unsigned long __must_check copy_from_user(void *to,
11141 - const void __user *from,
11142 - unsigned long n);
11143 long __must_check strncpy_from_user(char *dst, const char __user *src,
11144 long count);
11145 long __must_check __strncpy_from_user(char *dst,
11146 diff -urNp linux-2.6.32.49/arch/x86/include/asm/uaccess_64.h linux-2.6.32.49/arch/x86/include/asm/uaccess_64.h
11147 --- linux-2.6.32.49/arch/x86/include/asm/uaccess_64.h 2011-11-08 19:02:43.000000000 -0500
11148 +++ linux-2.6.32.49/arch/x86/include/asm/uaccess_64.h 2011-11-15 19:59:42.000000000 -0500
11149 @@ -9,6 +9,9 @@
11150 #include <linux/prefetch.h>
11151 #include <linux/lockdep.h>
11152 #include <asm/page.h>
11153 +#include <asm/pgtable.h>
11154 +
11155 +#define set_fs(x) (current_thread_info()->addr_limit = (x))
11156
11157 /*
11158 * Copy To/From Userspace
11159 @@ -19,113 +22,203 @@ __must_check unsigned long
11160 copy_user_generic(void *to, const void *from, unsigned len);
11161
11162 __must_check unsigned long
11163 -copy_to_user(void __user *to, const void *from, unsigned len);
11164 -__must_check unsigned long
11165 -copy_from_user(void *to, const void __user *from, unsigned len);
11166 -__must_check unsigned long
11167 copy_in_user(void __user *to, const void __user *from, unsigned len);
11168
11169 static __always_inline __must_check
11170 -int __copy_from_user(void *dst, const void __user *src, unsigned size)
11171 +unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
11172 {
11173 - int ret = 0;
11174 + unsigned ret = 0;
11175
11176 might_fault();
11177 - if (!__builtin_constant_p(size))
11178 - return copy_user_generic(dst, (__force void *)src, size);
11179 +
11180 + if ((int)size < 0)
11181 + return size;
11182 +
11183 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11184 + if (!__access_ok(VERIFY_READ, src, size))
11185 + return size;
11186 +#endif
11187 +
11188 + if (!__builtin_constant_p(size)) {
11189 + check_object_size(dst, size, false);
11190 +
11191 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11192 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11193 + src += PAX_USER_SHADOW_BASE;
11194 +#endif
11195 +
11196 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
11197 + }
11198 switch (size) {
11199 - case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
11200 + case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
11201 ret, "b", "b", "=q", 1);
11202 return ret;
11203 - case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
11204 + case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
11205 ret, "w", "w", "=r", 2);
11206 return ret;
11207 - case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
11208 + case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
11209 ret, "l", "k", "=r", 4);
11210 return ret;
11211 - case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
11212 + case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11213 ret, "q", "", "=r", 8);
11214 return ret;
11215 case 10:
11216 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
11217 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11218 ret, "q", "", "=r", 10);
11219 if (unlikely(ret))
11220 return ret;
11221 __get_user_asm(*(u16 *)(8 + (char *)dst),
11222 - (u16 __user *)(8 + (char __user *)src),
11223 + (const u16 __user *)(8 + (const char __user *)src),
11224 ret, "w", "w", "=r", 2);
11225 return ret;
11226 case 16:
11227 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
11228 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11229 ret, "q", "", "=r", 16);
11230 if (unlikely(ret))
11231 return ret;
11232 __get_user_asm(*(u64 *)(8 + (char *)dst),
11233 - (u64 __user *)(8 + (char __user *)src),
11234 + (const u64 __user *)(8 + (const char __user *)src),
11235 ret, "q", "", "=r", 8);
11236 return ret;
11237 default:
11238 - return copy_user_generic(dst, (__force void *)src, size);
11239 +
11240 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11241 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11242 + src += PAX_USER_SHADOW_BASE;
11243 +#endif
11244 +
11245 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
11246 }
11247 }
11248
11249 static __always_inline __must_check
11250 -int __copy_to_user(void __user *dst, const void *src, unsigned size)
11251 +unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
11252 {
11253 - int ret = 0;
11254 + unsigned ret = 0;
11255
11256 might_fault();
11257 - if (!__builtin_constant_p(size))
11258 - return copy_user_generic((__force void *)dst, src, size);
11259 +
11260 + pax_track_stack();
11261 +
11262 + if ((int)size < 0)
11263 + return size;
11264 +
11265 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11266 + if (!__access_ok(VERIFY_WRITE, dst, size))
11267 + return size;
11268 +#endif
11269 +
11270 + if (!__builtin_constant_p(size)) {
11271 + check_object_size(src, size, true);
11272 +
11273 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11274 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11275 + dst += PAX_USER_SHADOW_BASE;
11276 +#endif
11277 +
11278 + return copy_user_generic((__force_kernel void *)dst, src, size);
11279 + }
11280 switch (size) {
11281 - case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
11282 + case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
11283 ret, "b", "b", "iq", 1);
11284 return ret;
11285 - case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
11286 + case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
11287 ret, "w", "w", "ir", 2);
11288 return ret;
11289 - case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
11290 + case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
11291 ret, "l", "k", "ir", 4);
11292 return ret;
11293 - case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
11294 + case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11295 ret, "q", "", "er", 8);
11296 return ret;
11297 case 10:
11298 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11299 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11300 ret, "q", "", "er", 10);
11301 if (unlikely(ret))
11302 return ret;
11303 asm("":::"memory");
11304 - __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
11305 + __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
11306 ret, "w", "w", "ir", 2);
11307 return ret;
11308 case 16:
11309 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11310 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11311 ret, "q", "", "er", 16);
11312 if (unlikely(ret))
11313 return ret;
11314 asm("":::"memory");
11315 - __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
11316 + __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
11317 ret, "q", "", "er", 8);
11318 return ret;
11319 default:
11320 - return copy_user_generic((__force void *)dst, src, size);
11321 +
11322 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11323 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11324 + dst += PAX_USER_SHADOW_BASE;
11325 +#endif
11326 +
11327 + return copy_user_generic((__force_kernel void *)dst, src, size);
11328 + }
11329 +}
11330 +
11331 +static __always_inline __must_check
11332 +unsigned long copy_to_user(void __user *to, const void *from, unsigned len)
11333 +{
11334 + if (access_ok(VERIFY_WRITE, to, len))
11335 + len = __copy_to_user(to, from, len);
11336 + return len;
11337 +}
11338 +
11339 +static __always_inline __must_check
11340 +unsigned long copy_from_user(void *to, const void __user *from, unsigned len)
11341 +{
11342 + if ((int)len < 0)
11343 + return len;
11344 +
11345 + if (access_ok(VERIFY_READ, from, len))
11346 + len = __copy_from_user(to, from, len);
11347 + else if ((int)len > 0) {
11348 + if (!__builtin_constant_p(len))
11349 + check_object_size(to, len, false);
11350 + memset(to, 0, len);
11351 }
11352 + return len;
11353 }
11354
11355 static __always_inline __must_check
11356 -int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11357 +unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11358 {
11359 - int ret = 0;
11360 + unsigned ret = 0;
11361
11362 might_fault();
11363 - if (!__builtin_constant_p(size))
11364 - return copy_user_generic((__force void *)dst,
11365 - (__force void *)src, size);
11366 +
11367 + pax_track_stack();
11368 +
11369 + if ((int)size < 0)
11370 + return size;
11371 +
11372 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11373 + if (!__access_ok(VERIFY_READ, src, size))
11374 + return size;
11375 + if (!__access_ok(VERIFY_WRITE, dst, size))
11376 + return size;
11377 +#endif
11378 +
11379 + if (!__builtin_constant_p(size)) {
11380 +
11381 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11382 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11383 + src += PAX_USER_SHADOW_BASE;
11384 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11385 + dst += PAX_USER_SHADOW_BASE;
11386 +#endif
11387 +
11388 + return copy_user_generic((__force_kernel void *)dst,
11389 + (__force_kernel const void *)src, size);
11390 + }
11391 switch (size) {
11392 case 1: {
11393 u8 tmp;
11394 - __get_user_asm(tmp, (u8 __user *)src,
11395 + __get_user_asm(tmp, (const u8 __user *)src,
11396 ret, "b", "b", "=q", 1);
11397 if (likely(!ret))
11398 __put_user_asm(tmp, (u8 __user *)dst,
11399 @@ -134,7 +227,7 @@ int __copy_in_user(void __user *dst, con
11400 }
11401 case 2: {
11402 u16 tmp;
11403 - __get_user_asm(tmp, (u16 __user *)src,
11404 + __get_user_asm(tmp, (const u16 __user *)src,
11405 ret, "w", "w", "=r", 2);
11406 if (likely(!ret))
11407 __put_user_asm(tmp, (u16 __user *)dst,
11408 @@ -144,7 +237,7 @@ int __copy_in_user(void __user *dst, con
11409
11410 case 4: {
11411 u32 tmp;
11412 - __get_user_asm(tmp, (u32 __user *)src,
11413 + __get_user_asm(tmp, (const u32 __user *)src,
11414 ret, "l", "k", "=r", 4);
11415 if (likely(!ret))
11416 __put_user_asm(tmp, (u32 __user *)dst,
11417 @@ -153,7 +246,7 @@ int __copy_in_user(void __user *dst, con
11418 }
11419 case 8: {
11420 u64 tmp;
11421 - __get_user_asm(tmp, (u64 __user *)src,
11422 + __get_user_asm(tmp, (const u64 __user *)src,
11423 ret, "q", "", "=r", 8);
11424 if (likely(!ret))
11425 __put_user_asm(tmp, (u64 __user *)dst,
11426 @@ -161,8 +254,16 @@ int __copy_in_user(void __user *dst, con
11427 return ret;
11428 }
11429 default:
11430 - return copy_user_generic((__force void *)dst,
11431 - (__force void *)src, size);
11432 +
11433 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11434 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11435 + src += PAX_USER_SHADOW_BASE;
11436 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11437 + dst += PAX_USER_SHADOW_BASE;
11438 +#endif
11439 +
11440 + return copy_user_generic((__force_kernel void *)dst,
11441 + (__force_kernel const void *)src, size);
11442 }
11443 }
11444
11445 @@ -176,33 +277,75 @@ __must_check long strlen_user(const char
11446 __must_check unsigned long clear_user(void __user *mem, unsigned long len);
11447 __must_check unsigned long __clear_user(void __user *mem, unsigned long len);
11448
11449 -__must_check long __copy_from_user_inatomic(void *dst, const void __user *src,
11450 - unsigned size);
11451 +static __must_check __always_inline unsigned long
11452 +__copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
11453 +{
11454 + pax_track_stack();
11455 +
11456 + if ((int)size < 0)
11457 + return size;
11458 +
11459 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11460 + if (!__access_ok(VERIFY_READ, src, size))
11461 + return size;
11462 +
11463 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11464 + src += PAX_USER_SHADOW_BASE;
11465 +#endif
11466
11467 -static __must_check __always_inline int
11468 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
11469 +}
11470 +
11471 +static __must_check __always_inline unsigned long
11472 __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
11473 {
11474 - return copy_user_generic((__force void *)dst, src, size);
11475 + if ((int)size < 0)
11476 + return size;
11477 +
11478 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11479 + if (!__access_ok(VERIFY_WRITE, dst, size))
11480 + return size;
11481 +
11482 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11483 + dst += PAX_USER_SHADOW_BASE;
11484 +#endif
11485 +
11486 + return copy_user_generic((__force_kernel void *)dst, src, size);
11487 }
11488
11489 -extern long __copy_user_nocache(void *dst, const void __user *src,
11490 +extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
11491 unsigned size, int zerorest);
11492
11493 -static inline int
11494 -__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
11495 +static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
11496 {
11497 might_sleep();
11498 +
11499 + if ((int)size < 0)
11500 + return size;
11501 +
11502 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11503 + if (!__access_ok(VERIFY_READ, src, size))
11504 + return size;
11505 +#endif
11506 +
11507 return __copy_user_nocache(dst, src, size, 1);
11508 }
11509
11510 -static inline int
11511 -__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
11512 +static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
11513 unsigned size)
11514 {
11515 + if ((int)size < 0)
11516 + return size;
11517 +
11518 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11519 + if (!__access_ok(VERIFY_READ, src, size))
11520 + return size;
11521 +#endif
11522 +
11523 return __copy_user_nocache(dst, src, size, 0);
11524 }
11525
11526 -unsigned long
11527 -copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
11528 +extern unsigned long
11529 +copy_user_handle_tail(char __user *to, char __user *from, unsigned len, unsigned zerorest);
11530
11531 #endif /* _ASM_X86_UACCESS_64_H */
11532 diff -urNp linux-2.6.32.49/arch/x86/include/asm/uaccess.h linux-2.6.32.49/arch/x86/include/asm/uaccess.h
11533 --- linux-2.6.32.49/arch/x86/include/asm/uaccess.h 2011-11-08 19:02:43.000000000 -0500
11534 +++ linux-2.6.32.49/arch/x86/include/asm/uaccess.h 2011-11-15 19:59:42.000000000 -0500
11535 @@ -8,12 +8,15 @@
11536 #include <linux/thread_info.h>
11537 #include <linux/prefetch.h>
11538 #include <linux/string.h>
11539 +#include <linux/sched.h>
11540 #include <asm/asm.h>
11541 #include <asm/page.h>
11542
11543 #define VERIFY_READ 0
11544 #define VERIFY_WRITE 1
11545
11546 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
11547 +
11548 /*
11549 * The fs value determines whether argument validity checking should be
11550 * performed or not. If get_fs() == USER_DS, checking is performed, with
11551 @@ -29,7 +32,12 @@
11552
11553 #define get_ds() (KERNEL_DS)
11554 #define get_fs() (current_thread_info()->addr_limit)
11555 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
11556 +void __set_fs(mm_segment_t x);
11557 +void set_fs(mm_segment_t x);
11558 +#else
11559 #define set_fs(x) (current_thread_info()->addr_limit = (x))
11560 +#endif
11561
11562 #define segment_eq(a, b) ((a).seg == (b).seg)
11563
11564 @@ -77,7 +85,33 @@
11565 * checks that the pointer is in the user space range - after calling
11566 * this function, memory access functions may still return -EFAULT.
11567 */
11568 -#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
11569 +#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
11570 +#define access_ok(type, addr, size) \
11571 +({ \
11572 + long __size = size; \
11573 + unsigned long __addr = (unsigned long)addr; \
11574 + unsigned long __addr_ao = __addr & PAGE_MASK; \
11575 + unsigned long __end_ao = __addr + __size - 1; \
11576 + bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
11577 + if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
11578 + while(__addr_ao <= __end_ao) { \
11579 + char __c_ao; \
11580 + __addr_ao += PAGE_SIZE; \
11581 + if (__size > PAGE_SIZE) \
11582 + cond_resched(); \
11583 + if (__get_user(__c_ao, (char __user *)__addr)) \
11584 + break; \
11585 + if (type != VERIFY_WRITE) { \
11586 + __addr = __addr_ao; \
11587 + continue; \
11588 + } \
11589 + if (__put_user(__c_ao, (char __user *)__addr)) \
11590 + break; \
11591 + __addr = __addr_ao; \
11592 + } \
11593 + } \
11594 + __ret_ao; \
11595 +})
11596
11597 /*
11598 * The exception table consists of pairs of addresses: the first is the
11599 @@ -183,12 +217,20 @@ extern int __get_user_bad(void);
11600 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
11601 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
11602
11603 -
11604 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
11605 +#define __copyuser_seg "gs;"
11606 +#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
11607 +#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
11608 +#else
11609 +#define __copyuser_seg
11610 +#define __COPYUSER_SET_ES
11611 +#define __COPYUSER_RESTORE_ES
11612 +#endif
11613
11614 #ifdef CONFIG_X86_32
11615 #define __put_user_asm_u64(x, addr, err, errret) \
11616 - asm volatile("1: movl %%eax,0(%2)\n" \
11617 - "2: movl %%edx,4(%2)\n" \
11618 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
11619 + "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
11620 "3:\n" \
11621 ".section .fixup,\"ax\"\n" \
11622 "4: movl %3,%0\n" \
11623 @@ -200,8 +242,8 @@ extern int __get_user_bad(void);
11624 : "A" (x), "r" (addr), "i" (errret), "0" (err))
11625
11626 #define __put_user_asm_ex_u64(x, addr) \
11627 - asm volatile("1: movl %%eax,0(%1)\n" \
11628 - "2: movl %%edx,4(%1)\n" \
11629 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
11630 + "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
11631 "3:\n" \
11632 _ASM_EXTABLE(1b, 2b - 1b) \
11633 _ASM_EXTABLE(2b, 3b - 2b) \
11634 @@ -253,7 +295,7 @@ extern void __put_user_8(void);
11635 __typeof__(*(ptr)) __pu_val; \
11636 __chk_user_ptr(ptr); \
11637 might_fault(); \
11638 - __pu_val = x; \
11639 + __pu_val = (x); \
11640 switch (sizeof(*(ptr))) { \
11641 case 1: \
11642 __put_user_x(1, __pu_val, ptr, __ret_pu); \
11643 @@ -374,7 +416,7 @@ do { \
11644 } while (0)
11645
11646 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
11647 - asm volatile("1: mov"itype" %2,%"rtype"1\n" \
11648 + asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
11649 "2:\n" \
11650 ".section .fixup,\"ax\"\n" \
11651 "3: mov %3,%0\n" \
11652 @@ -382,7 +424,7 @@ do { \
11653 " jmp 2b\n" \
11654 ".previous\n" \
11655 _ASM_EXTABLE(1b, 3b) \
11656 - : "=r" (err), ltype(x) \
11657 + : "=r" (err), ltype (x) \
11658 : "m" (__m(addr)), "i" (errret), "0" (err))
11659
11660 #define __get_user_size_ex(x, ptr, size) \
11661 @@ -407,7 +449,7 @@ do { \
11662 } while (0)
11663
11664 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
11665 - asm volatile("1: mov"itype" %1,%"rtype"0\n" \
11666 + asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
11667 "2:\n" \
11668 _ASM_EXTABLE(1b, 2b - 1b) \
11669 : ltype(x) : "m" (__m(addr)))
11670 @@ -424,13 +466,24 @@ do { \
11671 int __gu_err; \
11672 unsigned long __gu_val; \
11673 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
11674 - (x) = (__force __typeof__(*(ptr)))__gu_val; \
11675 + (x) = (__typeof__(*(ptr)))__gu_val; \
11676 __gu_err; \
11677 })
11678
11679 /* FIXME: this hack is definitely wrong -AK */
11680 struct __large_struct { unsigned long buf[100]; };
11681 -#define __m(x) (*(struct __large_struct __user *)(x))
11682 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11683 +#define ____m(x) \
11684 +({ \
11685 + unsigned long ____x = (unsigned long)(x); \
11686 + if (____x < PAX_USER_SHADOW_BASE) \
11687 + ____x += PAX_USER_SHADOW_BASE; \
11688 + (void __user *)____x; \
11689 +})
11690 +#else
11691 +#define ____m(x) (x)
11692 +#endif
11693 +#define __m(x) (*(struct __large_struct __user *)____m(x))
11694
11695 /*
11696 * Tell gcc we read from memory instead of writing: this is because
11697 @@ -438,7 +491,7 @@ struct __large_struct { unsigned long bu
11698 * aliasing issues.
11699 */
11700 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
11701 - asm volatile("1: mov"itype" %"rtype"1,%2\n" \
11702 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
11703 "2:\n" \
11704 ".section .fixup,\"ax\"\n" \
11705 "3: mov %3,%0\n" \
11706 @@ -446,10 +499,10 @@ struct __large_struct { unsigned long bu
11707 ".previous\n" \
11708 _ASM_EXTABLE(1b, 3b) \
11709 : "=r"(err) \
11710 - : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
11711 + : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
11712
11713 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
11714 - asm volatile("1: mov"itype" %"rtype"0,%1\n" \
11715 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
11716 "2:\n" \
11717 _ASM_EXTABLE(1b, 2b - 1b) \
11718 : : ltype(x), "m" (__m(addr)))
11719 @@ -488,8 +541,12 @@ struct __large_struct { unsigned long bu
11720 * On error, the variable @x is set to zero.
11721 */
11722
11723 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11724 +#define __get_user(x, ptr) get_user((x), (ptr))
11725 +#else
11726 #define __get_user(x, ptr) \
11727 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
11728 +#endif
11729
11730 /**
11731 * __put_user: - Write a simple value into user space, with less checking.
11732 @@ -511,8 +568,12 @@ struct __large_struct { unsigned long bu
11733 * Returns zero on success, or -EFAULT on error.
11734 */
11735
11736 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11737 +#define __put_user(x, ptr) put_user((x), (ptr))
11738 +#else
11739 #define __put_user(x, ptr) \
11740 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
11741 +#endif
11742
11743 #define __get_user_unaligned __get_user
11744 #define __put_user_unaligned __put_user
11745 @@ -530,7 +591,7 @@ struct __large_struct { unsigned long bu
11746 #define get_user_ex(x, ptr) do { \
11747 unsigned long __gue_val; \
11748 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
11749 - (x) = (__force __typeof__(*(ptr)))__gue_val; \
11750 + (x) = (__typeof__(*(ptr)))__gue_val; \
11751 } while (0)
11752
11753 #ifdef CONFIG_X86_WP_WORKS_OK
11754 @@ -567,6 +628,7 @@ extern struct movsl_mask {
11755
11756 #define ARCH_HAS_NOCACHE_UACCESS 1
11757
11758 +#define ARCH_HAS_SORT_EXTABLE
11759 #ifdef CONFIG_X86_32
11760 # include "uaccess_32.h"
11761 #else
11762 diff -urNp linux-2.6.32.49/arch/x86/include/asm/vdso.h linux-2.6.32.49/arch/x86/include/asm/vdso.h
11763 --- linux-2.6.32.49/arch/x86/include/asm/vdso.h 2011-11-08 19:02:43.000000000 -0500
11764 +++ linux-2.6.32.49/arch/x86/include/asm/vdso.h 2011-11-15 19:59:42.000000000 -0500
11765 @@ -25,7 +25,7 @@ extern const char VDSO32_PRELINK[];
11766 #define VDSO32_SYMBOL(base, name) \
11767 ({ \
11768 extern const char VDSO32_##name[]; \
11769 - (void *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
11770 + (void __user *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
11771 })
11772 #endif
11773
11774 diff -urNp linux-2.6.32.49/arch/x86/include/asm/vgtod.h linux-2.6.32.49/arch/x86/include/asm/vgtod.h
11775 --- linux-2.6.32.49/arch/x86/include/asm/vgtod.h 2011-11-08 19:02:43.000000000 -0500
11776 +++ linux-2.6.32.49/arch/x86/include/asm/vgtod.h 2011-11-15 19:59:42.000000000 -0500
11777 @@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
11778 int sysctl_enabled;
11779 struct timezone sys_tz;
11780 struct { /* extract of a clocksource struct */
11781 + char name[8];
11782 cycle_t (*vread)(void);
11783 cycle_t cycle_last;
11784 cycle_t mask;
11785 diff -urNp linux-2.6.32.49/arch/x86/include/asm/vmi.h linux-2.6.32.49/arch/x86/include/asm/vmi.h
11786 --- linux-2.6.32.49/arch/x86/include/asm/vmi.h 2011-11-08 19:02:43.000000000 -0500
11787 +++ linux-2.6.32.49/arch/x86/include/asm/vmi.h 2011-11-15 19:59:42.000000000 -0500
11788 @@ -191,6 +191,7 @@ struct vrom_header {
11789 u8 reserved[96]; /* Reserved for headers */
11790 char vmi_init[8]; /* VMI_Init jump point */
11791 char get_reloc[8]; /* VMI_GetRelocationInfo jump point */
11792 + char rom_data[8048]; /* rest of the option ROM */
11793 } __attribute__((packed));
11794
11795 struct pnp_header {
11796 diff -urNp linux-2.6.32.49/arch/x86/include/asm/vmi_time.h linux-2.6.32.49/arch/x86/include/asm/vmi_time.h
11797 --- linux-2.6.32.49/arch/x86/include/asm/vmi_time.h 2011-11-08 19:02:43.000000000 -0500
11798 +++ linux-2.6.32.49/arch/x86/include/asm/vmi_time.h 2011-11-15 19:59:42.000000000 -0500
11799 @@ -43,7 +43,7 @@ extern struct vmi_timer_ops {
11800 int (*wallclock_updated)(void);
11801 void (*set_alarm)(u32 flags, u64 expiry, u64 period);
11802 void (*cancel_alarm)(u32 flags);
11803 -} vmi_timer_ops;
11804 +} __no_const vmi_timer_ops;
11805
11806 /* Prototypes */
11807 extern void __init vmi_time_init(void);
11808 diff -urNp linux-2.6.32.49/arch/x86/include/asm/vsyscall.h linux-2.6.32.49/arch/x86/include/asm/vsyscall.h
11809 --- linux-2.6.32.49/arch/x86/include/asm/vsyscall.h 2011-11-08 19:02:43.000000000 -0500
11810 +++ linux-2.6.32.49/arch/x86/include/asm/vsyscall.h 2011-11-15 19:59:42.000000000 -0500
11811 @@ -15,9 +15,10 @@ enum vsyscall_num {
11812
11813 #ifdef __KERNEL__
11814 #include <linux/seqlock.h>
11815 +#include <linux/getcpu.h>
11816 +#include <linux/time.h>
11817
11818 #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
11819 -#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
11820
11821 /* Definitions for CONFIG_GENERIC_TIME definitions */
11822 #define __section_vsyscall_gtod_data __attribute__ \
11823 @@ -31,7 +32,6 @@ enum vsyscall_num {
11824 #define VGETCPU_LSL 2
11825
11826 extern int __vgetcpu_mode;
11827 -extern volatile unsigned long __jiffies;
11828
11829 /* kernel space (writeable) */
11830 extern int vgetcpu_mode;
11831 @@ -39,6 +39,9 @@ extern struct timezone sys_tz;
11832
11833 extern void map_vsyscall(void);
11834
11835 +extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
11836 +extern time_t vtime(time_t *t);
11837 +extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
11838 #endif /* __KERNEL__ */
11839
11840 #endif /* _ASM_X86_VSYSCALL_H */
11841 diff -urNp linux-2.6.32.49/arch/x86/include/asm/x86_init.h linux-2.6.32.49/arch/x86/include/asm/x86_init.h
11842 --- linux-2.6.32.49/arch/x86/include/asm/x86_init.h 2011-11-08 19:02:43.000000000 -0500
11843 +++ linux-2.6.32.49/arch/x86/include/asm/x86_init.h 2011-11-15 19:59:42.000000000 -0500
11844 @@ -28,7 +28,7 @@ struct x86_init_mpparse {
11845 void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
11846 void (*find_smp_config)(unsigned int reserve);
11847 void (*get_smp_config)(unsigned int early);
11848 -};
11849 +} __no_const;
11850
11851 /**
11852 * struct x86_init_resources - platform specific resource related ops
11853 @@ -42,7 +42,7 @@ struct x86_init_resources {
11854 void (*probe_roms)(void);
11855 void (*reserve_resources)(void);
11856 char *(*memory_setup)(void);
11857 -};
11858 +} __no_const;
11859
11860 /**
11861 * struct x86_init_irqs - platform specific interrupt setup
11862 @@ -55,7 +55,7 @@ struct x86_init_irqs {
11863 void (*pre_vector_init)(void);
11864 void (*intr_init)(void);
11865 void (*trap_init)(void);
11866 -};
11867 +} __no_const;
11868
11869 /**
11870 * struct x86_init_oem - oem platform specific customizing functions
11871 @@ -65,7 +65,7 @@ struct x86_init_irqs {
11872 struct x86_init_oem {
11873 void (*arch_setup)(void);
11874 void (*banner)(void);
11875 -};
11876 +} __no_const;
11877
11878 /**
11879 * struct x86_init_paging - platform specific paging functions
11880 @@ -75,7 +75,7 @@ struct x86_init_oem {
11881 struct x86_init_paging {
11882 void (*pagetable_setup_start)(pgd_t *base);
11883 void (*pagetable_setup_done)(pgd_t *base);
11884 -};
11885 +} __no_const;
11886
11887 /**
11888 * struct x86_init_timers - platform specific timer setup
11889 @@ -88,7 +88,7 @@ struct x86_init_timers {
11890 void (*setup_percpu_clockev)(void);
11891 void (*tsc_pre_init)(void);
11892 void (*timer_init)(void);
11893 -};
11894 +} __no_const;
11895
11896 /**
11897 * struct x86_init_ops - functions for platform specific setup
11898 @@ -101,7 +101,7 @@ struct x86_init_ops {
11899 struct x86_init_oem oem;
11900 struct x86_init_paging paging;
11901 struct x86_init_timers timers;
11902 -};
11903 +} __no_const;
11904
11905 /**
11906 * struct x86_cpuinit_ops - platform specific cpu hotplug setups
11907 @@ -109,7 +109,7 @@ struct x86_init_ops {
11908 */
11909 struct x86_cpuinit_ops {
11910 void (*setup_percpu_clockev)(void);
11911 -};
11912 +} __no_const;
11913
11914 /**
11915 * struct x86_platform_ops - platform specific runtime functions
11916 @@ -121,7 +121,7 @@ struct x86_platform_ops {
11917 unsigned long (*calibrate_tsc)(void);
11918 unsigned long (*get_wallclock)(void);
11919 int (*set_wallclock)(unsigned long nowtime);
11920 -};
11921 +} __no_const;
11922
11923 extern struct x86_init_ops x86_init;
11924 extern struct x86_cpuinit_ops x86_cpuinit;
11925 diff -urNp linux-2.6.32.49/arch/x86/include/asm/xsave.h linux-2.6.32.49/arch/x86/include/asm/xsave.h
11926 --- linux-2.6.32.49/arch/x86/include/asm/xsave.h 2011-11-08 19:02:43.000000000 -0500
11927 +++ linux-2.6.32.49/arch/x86/include/asm/xsave.h 2011-11-15 19:59:42.000000000 -0500
11928 @@ -56,6 +56,12 @@ static inline int xrstor_checking(struct
11929 static inline int xsave_user(struct xsave_struct __user *buf)
11930 {
11931 int err;
11932 +
11933 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11934 + if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
11935 + buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
11936 +#endif
11937 +
11938 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x27\n"
11939 "2:\n"
11940 ".section .fixup,\"ax\"\n"
11941 @@ -78,10 +84,15 @@ static inline int xsave_user(struct xsav
11942 static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask)
11943 {
11944 int err;
11945 - struct xsave_struct *xstate = ((__force struct xsave_struct *)buf);
11946 + struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)buf);
11947 u32 lmask = mask;
11948 u32 hmask = mask >> 32;
11949
11950 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11951 + if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
11952 + xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
11953 +#endif
11954 +
11955 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
11956 "2:\n"
11957 ".section .fixup,\"ax\"\n"
11958 diff -urNp linux-2.6.32.49/arch/x86/Kconfig linux-2.6.32.49/arch/x86/Kconfig
11959 --- linux-2.6.32.49/arch/x86/Kconfig 2011-11-08 19:02:43.000000000 -0500
11960 +++ linux-2.6.32.49/arch/x86/Kconfig 2011-11-15 19:59:42.000000000 -0500
11961 @@ -223,7 +223,7 @@ config X86_TRAMPOLINE
11962
11963 config X86_32_LAZY_GS
11964 def_bool y
11965 - depends on X86_32 && !CC_STACKPROTECTOR
11966 + depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
11967
11968 config KTIME_SCALAR
11969 def_bool X86_32
11970 @@ -1008,7 +1008,7 @@ choice
11971
11972 config NOHIGHMEM
11973 bool "off"
11974 - depends on !X86_NUMAQ
11975 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
11976 ---help---
11977 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
11978 However, the address space of 32-bit x86 processors is only 4
11979 @@ -1045,7 +1045,7 @@ config NOHIGHMEM
11980
11981 config HIGHMEM4G
11982 bool "4GB"
11983 - depends on !X86_NUMAQ
11984 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
11985 ---help---
11986 Select this if you have a 32-bit processor and between 1 and 4
11987 gigabytes of physical RAM.
11988 @@ -1099,7 +1099,7 @@ config PAGE_OFFSET
11989 hex
11990 default 0xB0000000 if VMSPLIT_3G_OPT
11991 default 0x80000000 if VMSPLIT_2G
11992 - default 0x78000000 if VMSPLIT_2G_OPT
11993 + default 0x70000000 if VMSPLIT_2G_OPT
11994 default 0x40000000 if VMSPLIT_1G
11995 default 0xC0000000
11996 depends on X86_32
11997 @@ -1460,6 +1460,7 @@ config SECCOMP
11998
11999 config CC_STACKPROTECTOR
12000 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
12001 + depends on X86_64 || !PAX_MEMORY_UDEREF
12002 ---help---
12003 This option turns on the -fstack-protector GCC feature. This
12004 feature puts, at the beginning of functions, a canary value on
12005 @@ -1517,6 +1518,7 @@ config KEXEC_JUMP
12006 config PHYSICAL_START
12007 hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
12008 default "0x1000000"
12009 + range 0x400000 0x40000000
12010 ---help---
12011 This gives the physical address where the kernel is loaded.
12012
12013 @@ -1581,6 +1583,7 @@ config PHYSICAL_ALIGN
12014 hex
12015 prompt "Alignment value to which kernel should be aligned" if X86_32
12016 default "0x1000000"
12017 + range 0x400000 0x1000000 if PAX_KERNEXEC
12018 range 0x2000 0x1000000
12019 ---help---
12020 This value puts the alignment restrictions on physical address
12021 @@ -1612,9 +1615,10 @@ config HOTPLUG_CPU
12022 Say N if you want to disable CPU hotplug.
12023
12024 config COMPAT_VDSO
12025 - def_bool y
12026 + def_bool n
12027 prompt "Compat VDSO support"
12028 depends on X86_32 || IA32_EMULATION
12029 + depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
12030 ---help---
12031 Map the 32-bit VDSO to the predictable old-style address too.
12032 ---help---
12033 diff -urNp linux-2.6.32.49/arch/x86/Kconfig.cpu linux-2.6.32.49/arch/x86/Kconfig.cpu
12034 --- linux-2.6.32.49/arch/x86/Kconfig.cpu 2011-11-08 19:02:43.000000000 -0500
12035 +++ linux-2.6.32.49/arch/x86/Kconfig.cpu 2011-11-15 19:59:42.000000000 -0500
12036 @@ -340,7 +340,7 @@ config X86_PPRO_FENCE
12037
12038 config X86_F00F_BUG
12039 def_bool y
12040 - depends on M586MMX || M586TSC || M586 || M486 || M386
12041 + depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
12042
12043 config X86_WP_WORKS_OK
12044 def_bool y
12045 @@ -360,7 +360,7 @@ config X86_POPAD_OK
12046
12047 config X86_ALIGNMENT_16
12048 def_bool y
12049 - depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12050 + depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12051
12052 config X86_INTEL_USERCOPY
12053 def_bool y
12054 @@ -406,7 +406,7 @@ config X86_CMPXCHG64
12055 # generates cmov.
12056 config X86_CMOV
12057 def_bool y
12058 - depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
12059 + depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
12060
12061 config X86_MINIMUM_CPU_FAMILY
12062 int
12063 diff -urNp linux-2.6.32.49/arch/x86/Kconfig.debug linux-2.6.32.49/arch/x86/Kconfig.debug
12064 --- linux-2.6.32.49/arch/x86/Kconfig.debug 2011-11-08 19:02:43.000000000 -0500
12065 +++ linux-2.6.32.49/arch/x86/Kconfig.debug 2011-11-15 19:59:42.000000000 -0500
12066 @@ -99,7 +99,7 @@ config X86_PTDUMP
12067 config DEBUG_RODATA
12068 bool "Write protect kernel read-only data structures"
12069 default y
12070 - depends on DEBUG_KERNEL
12071 + depends on DEBUG_KERNEL && BROKEN
12072 ---help---
12073 Mark the kernel read-only data as write-protected in the pagetables,
12074 in order to catch accidental (and incorrect) writes to such const
12075 diff -urNp linux-2.6.32.49/arch/x86/kernel/acpi/realmode/Makefile linux-2.6.32.49/arch/x86/kernel/acpi/realmode/Makefile
12076 --- linux-2.6.32.49/arch/x86/kernel/acpi/realmode/Makefile 2011-11-08 19:02:43.000000000 -0500
12077 +++ linux-2.6.32.49/arch/x86/kernel/acpi/realmode/Makefile 2011-11-15 19:59:42.000000000 -0500
12078 @@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os
12079 $(call cc-option, -fno-stack-protector) \
12080 $(call cc-option, -mpreferred-stack-boundary=2)
12081 KBUILD_CFLAGS += $(call cc-option, -m32)
12082 +ifdef CONSTIFY_PLUGIN
12083 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
12084 +endif
12085 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
12086 GCOV_PROFILE := n
12087
12088 diff -urNp linux-2.6.32.49/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.32.49/arch/x86/kernel/acpi/realmode/wakeup.S
12089 --- linux-2.6.32.49/arch/x86/kernel/acpi/realmode/wakeup.S 2011-11-08 19:02:43.000000000 -0500
12090 +++ linux-2.6.32.49/arch/x86/kernel/acpi/realmode/wakeup.S 2011-11-15 19:59:42.000000000 -0500
12091 @@ -91,6 +91,9 @@ _start:
12092 /* Do any other stuff... */
12093
12094 #ifndef CONFIG_64BIT
12095 + /* Recheck NX bit overrides (64bit path does this in trampoline) */
12096 + call verify_cpu
12097 +
12098 /* This could also be done in C code... */
12099 movl pmode_cr3, %eax
12100 movl %eax, %cr3
12101 @@ -104,7 +107,7 @@ _start:
12102 movl %eax, %ecx
12103 orl %edx, %ecx
12104 jz 1f
12105 - movl $0xc0000080, %ecx
12106 + mov $MSR_EFER, %ecx
12107 wrmsr
12108 1:
12109
12110 @@ -114,6 +117,7 @@ _start:
12111 movl pmode_cr0, %eax
12112 movl %eax, %cr0
12113 jmp pmode_return
12114 +# include "../../verify_cpu.S"
12115 #else
12116 pushw $0
12117 pushw trampoline_segment
12118 diff -urNp linux-2.6.32.49/arch/x86/kernel/acpi/sleep.c linux-2.6.32.49/arch/x86/kernel/acpi/sleep.c
12119 --- linux-2.6.32.49/arch/x86/kernel/acpi/sleep.c 2011-11-08 19:02:43.000000000 -0500
12120 +++ linux-2.6.32.49/arch/x86/kernel/acpi/sleep.c 2011-11-15 19:59:42.000000000 -0500
12121 @@ -11,11 +11,12 @@
12122 #include <linux/cpumask.h>
12123 #include <asm/segment.h>
12124 #include <asm/desc.h>
12125 +#include <asm/e820.h>
12126
12127 #include "realmode/wakeup.h"
12128 #include "sleep.h"
12129
12130 -unsigned long acpi_wakeup_address;
12131 +unsigned long acpi_wakeup_address = 0x2000;
12132 unsigned long acpi_realmode_flags;
12133
12134 /* address in low memory of the wakeup routine. */
12135 @@ -98,9 +99,13 @@ int acpi_save_state_mem(void)
12136 #else /* CONFIG_64BIT */
12137 header->trampoline_segment = setup_trampoline() >> 4;
12138 #ifdef CONFIG_SMP
12139 - stack_start.sp = temp_stack + sizeof(temp_stack);
12140 + stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
12141 +
12142 + pax_open_kernel();
12143 early_gdt_descr.address =
12144 (unsigned long)get_cpu_gdt_table(smp_processor_id());
12145 + pax_close_kernel();
12146 +
12147 initial_gs = per_cpu_offset(smp_processor_id());
12148 #endif
12149 initial_code = (unsigned long)wakeup_long64;
12150 @@ -134,14 +139,8 @@ void __init acpi_reserve_bootmem(void)
12151 return;
12152 }
12153
12154 - acpi_realmode = (unsigned long)alloc_bootmem_low(WAKEUP_SIZE);
12155 -
12156 - if (!acpi_realmode) {
12157 - printk(KERN_ERR "ACPI: Cannot allocate lowmem, S3 disabled.\n");
12158 - return;
12159 - }
12160 -
12161 - acpi_wakeup_address = virt_to_phys((void *)acpi_realmode);
12162 + reserve_early(acpi_wakeup_address, acpi_wakeup_address + WAKEUP_SIZE, "ACPI Wakeup Code");
12163 + acpi_realmode = (unsigned long)__va(acpi_wakeup_address);;
12164 }
12165
12166
12167 diff -urNp linux-2.6.32.49/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.32.49/arch/x86/kernel/acpi/wakeup_32.S
12168 --- linux-2.6.32.49/arch/x86/kernel/acpi/wakeup_32.S 2011-11-08 19:02:43.000000000 -0500
12169 +++ linux-2.6.32.49/arch/x86/kernel/acpi/wakeup_32.S 2011-11-15 19:59:42.000000000 -0500
12170 @@ -30,13 +30,11 @@ wakeup_pmode_return:
12171 # and restore the stack ... but you need gdt for this to work
12172 movl saved_context_esp, %esp
12173
12174 - movl %cs:saved_magic, %eax
12175 - cmpl $0x12345678, %eax
12176 + cmpl $0x12345678, saved_magic
12177 jne bogus_magic
12178
12179 # jump to place where we left off
12180 - movl saved_eip, %eax
12181 - jmp *%eax
12182 + jmp *(saved_eip)
12183
12184 bogus_magic:
12185 jmp bogus_magic
12186 diff -urNp linux-2.6.32.49/arch/x86/kernel/alternative.c linux-2.6.32.49/arch/x86/kernel/alternative.c
12187 --- linux-2.6.32.49/arch/x86/kernel/alternative.c 2011-11-08 19:02:43.000000000 -0500
12188 +++ linux-2.6.32.49/arch/x86/kernel/alternative.c 2011-11-15 19:59:42.000000000 -0500
12189 @@ -407,7 +407,7 @@ void __init_or_module apply_paravirt(str
12190
12191 BUG_ON(p->len > MAX_PATCH_LEN);
12192 /* prep the buffer with the original instructions */
12193 - memcpy(insnbuf, p->instr, p->len);
12194 + memcpy(insnbuf, ktla_ktva(p->instr), p->len);
12195 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
12196 (unsigned long)p->instr, p->len);
12197
12198 @@ -475,7 +475,7 @@ void __init alternative_instructions(voi
12199 if (smp_alt_once)
12200 free_init_pages("SMP alternatives",
12201 (unsigned long)__smp_locks,
12202 - (unsigned long)__smp_locks_end);
12203 + PAGE_ALIGN((unsigned long)__smp_locks_end));
12204
12205 restart_nmi();
12206 }
12207 @@ -492,13 +492,17 @@ void __init alternative_instructions(voi
12208 * instructions. And on the local CPU you need to be protected again NMI or MCE
12209 * handlers seeing an inconsistent instruction while you patch.
12210 */
12211 -static void *__init_or_module text_poke_early(void *addr, const void *opcode,
12212 +static void *__kprobes text_poke_early(void *addr, const void *opcode,
12213 size_t len)
12214 {
12215 unsigned long flags;
12216 local_irq_save(flags);
12217 - memcpy(addr, opcode, len);
12218 +
12219 + pax_open_kernel();
12220 + memcpy(ktla_ktva(addr), opcode, len);
12221 sync_core();
12222 + pax_close_kernel();
12223 +
12224 local_irq_restore(flags);
12225 /* Could also do a CLFLUSH here to speed up CPU recovery; but
12226 that causes hangs on some VIA CPUs. */
12227 @@ -520,35 +524,21 @@ static void *__init_or_module text_poke_
12228 */
12229 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
12230 {
12231 - unsigned long flags;
12232 - char *vaddr;
12233 + unsigned char *vaddr = ktla_ktva(addr);
12234 struct page *pages[2];
12235 - int i;
12236 + size_t i;
12237
12238 if (!core_kernel_text((unsigned long)addr)) {
12239 - pages[0] = vmalloc_to_page(addr);
12240 - pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
12241 + pages[0] = vmalloc_to_page(vaddr);
12242 + pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
12243 } else {
12244 - pages[0] = virt_to_page(addr);
12245 + pages[0] = virt_to_page(vaddr);
12246 WARN_ON(!PageReserved(pages[0]));
12247 - pages[1] = virt_to_page(addr + PAGE_SIZE);
12248 + pages[1] = virt_to_page(vaddr + PAGE_SIZE);
12249 }
12250 BUG_ON(!pages[0]);
12251 - local_irq_save(flags);
12252 - set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
12253 - if (pages[1])
12254 - set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
12255 - vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
12256 - memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
12257 - clear_fixmap(FIX_TEXT_POKE0);
12258 - if (pages[1])
12259 - clear_fixmap(FIX_TEXT_POKE1);
12260 - local_flush_tlb();
12261 - sync_core();
12262 - /* Could also do a CLFLUSH here to speed up CPU recovery; but
12263 - that causes hangs on some VIA CPUs. */
12264 + text_poke_early(addr, opcode, len);
12265 for (i = 0; i < len; i++)
12266 - BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
12267 - local_irq_restore(flags);
12268 + BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
12269 return addr;
12270 }
12271 diff -urNp linux-2.6.32.49/arch/x86/kernel/amd_iommu.c linux-2.6.32.49/arch/x86/kernel/amd_iommu.c
12272 --- linux-2.6.32.49/arch/x86/kernel/amd_iommu.c 2011-11-08 19:02:43.000000000 -0500
12273 +++ linux-2.6.32.49/arch/x86/kernel/amd_iommu.c 2011-11-15 19:59:42.000000000 -0500
12274 @@ -2076,7 +2076,7 @@ static void prealloc_protection_domains(
12275 }
12276 }
12277
12278 -static struct dma_map_ops amd_iommu_dma_ops = {
12279 +static const struct dma_map_ops amd_iommu_dma_ops = {
12280 .alloc_coherent = alloc_coherent,
12281 .free_coherent = free_coherent,
12282 .map_page = map_page,
12283 diff -urNp linux-2.6.32.49/arch/x86/kernel/apic/apic.c linux-2.6.32.49/arch/x86/kernel/apic/apic.c
12284 --- linux-2.6.32.49/arch/x86/kernel/apic/apic.c 2011-11-08 19:02:43.000000000 -0500
12285 +++ linux-2.6.32.49/arch/x86/kernel/apic/apic.c 2011-11-15 19:59:42.000000000 -0500
12286 @@ -170,7 +170,7 @@ int first_system_vector = 0xfe;
12287 /*
12288 * Debug level, exported for io_apic.c
12289 */
12290 -unsigned int apic_verbosity;
12291 +int apic_verbosity;
12292
12293 int pic_mode;
12294
12295 @@ -1794,7 +1794,7 @@ void smp_error_interrupt(struct pt_regs
12296 apic_write(APIC_ESR, 0);
12297 v1 = apic_read(APIC_ESR);
12298 ack_APIC_irq();
12299 - atomic_inc(&irq_err_count);
12300 + atomic_inc_unchecked(&irq_err_count);
12301
12302 /*
12303 * Here is what the APIC error bits mean:
12304 @@ -2184,6 +2184,8 @@ static int __cpuinit apic_cluster_num(vo
12305 u16 *bios_cpu_apicid;
12306 DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
12307
12308 + pax_track_stack();
12309 +
12310 bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
12311 bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
12312
12313 diff -urNp linux-2.6.32.49/arch/x86/kernel/apic/io_apic.c linux-2.6.32.49/arch/x86/kernel/apic/io_apic.c
12314 --- linux-2.6.32.49/arch/x86/kernel/apic/io_apic.c 2011-11-08 19:02:43.000000000 -0500
12315 +++ linux-2.6.32.49/arch/x86/kernel/apic/io_apic.c 2011-11-15 19:59:42.000000000 -0500
12316 @@ -716,7 +716,7 @@ struct IO_APIC_route_entry **alloc_ioapi
12317 ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
12318 GFP_ATOMIC);
12319 if (!ioapic_entries)
12320 - return 0;
12321 + return NULL;
12322
12323 for (apic = 0; apic < nr_ioapics; apic++) {
12324 ioapic_entries[apic] =
12325 @@ -733,7 +733,7 @@ nomem:
12326 kfree(ioapic_entries[apic]);
12327 kfree(ioapic_entries);
12328
12329 - return 0;
12330 + return NULL;
12331 }
12332
12333 /*
12334 @@ -1150,7 +1150,7 @@ int IO_APIC_get_PCI_irq_vector(int bus,
12335 }
12336 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
12337
12338 -void lock_vector_lock(void)
12339 +void lock_vector_lock(void) __acquires(vector_lock)
12340 {
12341 /* Used to the online set of cpus does not change
12342 * during assign_irq_vector.
12343 @@ -1158,7 +1158,7 @@ void lock_vector_lock(void)
12344 spin_lock(&vector_lock);
12345 }
12346
12347 -void unlock_vector_lock(void)
12348 +void unlock_vector_lock(void) __releases(vector_lock)
12349 {
12350 spin_unlock(&vector_lock);
12351 }
12352 @@ -2542,7 +2542,7 @@ static void ack_apic_edge(unsigned int i
12353 ack_APIC_irq();
12354 }
12355
12356 -atomic_t irq_mis_count;
12357 +atomic_unchecked_t irq_mis_count;
12358
12359 static void ack_apic_level(unsigned int irq)
12360 {
12361 @@ -2626,7 +2626,7 @@ static void ack_apic_level(unsigned int
12362
12363 /* Tail end of version 0x11 I/O APIC bug workaround */
12364 if (!(v & (1 << (i & 0x1f)))) {
12365 - atomic_inc(&irq_mis_count);
12366 + atomic_inc_unchecked(&irq_mis_count);
12367 spin_lock(&ioapic_lock);
12368 __mask_and_edge_IO_APIC_irq(cfg);
12369 __unmask_and_level_IO_APIC_irq(cfg);
12370 diff -urNp linux-2.6.32.49/arch/x86/kernel/apm_32.c linux-2.6.32.49/arch/x86/kernel/apm_32.c
12371 --- linux-2.6.32.49/arch/x86/kernel/apm_32.c 2011-11-08 19:02:43.000000000 -0500
12372 +++ linux-2.6.32.49/arch/x86/kernel/apm_32.c 2011-11-15 19:59:42.000000000 -0500
12373 @@ -410,7 +410,7 @@ static DEFINE_SPINLOCK(user_list_lock);
12374 * This is for buggy BIOS's that refer to (real mode) segment 0x40
12375 * even though they are called in protected mode.
12376 */
12377 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
12378 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
12379 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
12380
12381 static const char driver_version[] = "1.16ac"; /* no spaces */
12382 @@ -588,7 +588,10 @@ static long __apm_bios_call(void *_call)
12383 BUG_ON(cpu != 0);
12384 gdt = get_cpu_gdt_table(cpu);
12385 save_desc_40 = gdt[0x40 / 8];
12386 +
12387 + pax_open_kernel();
12388 gdt[0x40 / 8] = bad_bios_desc;
12389 + pax_close_kernel();
12390
12391 apm_irq_save(flags);
12392 APM_DO_SAVE_SEGS;
12393 @@ -597,7 +600,11 @@ static long __apm_bios_call(void *_call)
12394 &call->esi);
12395 APM_DO_RESTORE_SEGS;
12396 apm_irq_restore(flags);
12397 +
12398 + pax_open_kernel();
12399 gdt[0x40 / 8] = save_desc_40;
12400 + pax_close_kernel();
12401 +
12402 put_cpu();
12403
12404 return call->eax & 0xff;
12405 @@ -664,7 +671,10 @@ static long __apm_bios_call_simple(void
12406 BUG_ON(cpu != 0);
12407 gdt = get_cpu_gdt_table(cpu);
12408 save_desc_40 = gdt[0x40 / 8];
12409 +
12410 + pax_open_kernel();
12411 gdt[0x40 / 8] = bad_bios_desc;
12412 + pax_close_kernel();
12413
12414 apm_irq_save(flags);
12415 APM_DO_SAVE_SEGS;
12416 @@ -672,7 +682,11 @@ static long __apm_bios_call_simple(void
12417 &call->eax);
12418 APM_DO_RESTORE_SEGS;
12419 apm_irq_restore(flags);
12420 +
12421 + pax_open_kernel();
12422 gdt[0x40 / 8] = save_desc_40;
12423 + pax_close_kernel();
12424 +
12425 put_cpu();
12426 return error;
12427 }
12428 @@ -975,7 +989,7 @@ recalc:
12429
12430 static void apm_power_off(void)
12431 {
12432 - unsigned char po_bios_call[] = {
12433 + const unsigned char po_bios_call[] = {
12434 0xb8, 0x00, 0x10, /* movw $0x1000,ax */
12435 0x8e, 0xd0, /* movw ax,ss */
12436 0xbc, 0x00, 0xf0, /* movw $0xf000,sp */
12437 @@ -2357,12 +2371,15 @@ static int __init apm_init(void)
12438 * code to that CPU.
12439 */
12440 gdt = get_cpu_gdt_table(0);
12441 +
12442 + pax_open_kernel();
12443 set_desc_base(&gdt[APM_CS >> 3],
12444 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
12445 set_desc_base(&gdt[APM_CS_16 >> 3],
12446 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
12447 set_desc_base(&gdt[APM_DS >> 3],
12448 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
12449 + pax_close_kernel();
12450
12451 proc_create("apm", 0, NULL, &apm_file_ops);
12452
12453 diff -urNp linux-2.6.32.49/arch/x86/kernel/asm-offsets_32.c linux-2.6.32.49/arch/x86/kernel/asm-offsets_32.c
12454 --- linux-2.6.32.49/arch/x86/kernel/asm-offsets_32.c 2011-11-08 19:02:43.000000000 -0500
12455 +++ linux-2.6.32.49/arch/x86/kernel/asm-offsets_32.c 2011-11-15 19:59:42.000000000 -0500
12456 @@ -51,7 +51,6 @@ void foo(void)
12457 OFFSET(CPUINFO_x86_vendor_id, cpuinfo_x86, x86_vendor_id);
12458 BLANK();
12459
12460 - OFFSET(TI_task, thread_info, task);
12461 OFFSET(TI_exec_domain, thread_info, exec_domain);
12462 OFFSET(TI_flags, thread_info, flags);
12463 OFFSET(TI_status, thread_info, status);
12464 @@ -60,6 +59,8 @@ void foo(void)
12465 OFFSET(TI_restart_block, thread_info, restart_block);
12466 OFFSET(TI_sysenter_return, thread_info, sysenter_return);
12467 OFFSET(TI_cpu, thread_info, cpu);
12468 + OFFSET(TI_lowest_stack, thread_info, lowest_stack);
12469 + DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
12470 BLANK();
12471
12472 OFFSET(GDS_size, desc_ptr, size);
12473 @@ -99,6 +100,7 @@ void foo(void)
12474
12475 DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
12476 DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
12477 + DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
12478 DEFINE(PTRS_PER_PTE, PTRS_PER_PTE);
12479 DEFINE(PTRS_PER_PMD, PTRS_PER_PMD);
12480 DEFINE(PTRS_PER_PGD, PTRS_PER_PGD);
12481 @@ -115,6 +117,11 @@ void foo(void)
12482 OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
12483 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
12484 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
12485 +
12486 +#ifdef CONFIG_PAX_KERNEXEC
12487 + OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
12488 +#endif
12489 +
12490 #endif
12491
12492 #ifdef CONFIG_XEN
12493 diff -urNp linux-2.6.32.49/arch/x86/kernel/asm-offsets_64.c linux-2.6.32.49/arch/x86/kernel/asm-offsets_64.c
12494 --- linux-2.6.32.49/arch/x86/kernel/asm-offsets_64.c 2011-11-08 19:02:43.000000000 -0500
12495 +++ linux-2.6.32.49/arch/x86/kernel/asm-offsets_64.c 2011-11-15 19:59:42.000000000 -0500
12496 @@ -44,6 +44,8 @@ int main(void)
12497 ENTRY(addr_limit);
12498 ENTRY(preempt_count);
12499 ENTRY(status);
12500 + ENTRY(lowest_stack);
12501 + DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
12502 #ifdef CONFIG_IA32_EMULATION
12503 ENTRY(sysenter_return);
12504 #endif
12505 @@ -63,6 +65,18 @@ int main(void)
12506 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
12507 OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
12508 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
12509 +
12510 +#ifdef CONFIG_PAX_KERNEXEC
12511 + OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
12512 + OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
12513 +#endif
12514 +
12515 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12516 + OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
12517 + OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
12518 + OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
12519 +#endif
12520 +
12521 #endif
12522
12523
12524 @@ -115,6 +129,7 @@ int main(void)
12525 ENTRY(cr8);
12526 BLANK();
12527 #undef ENTRY
12528 + DEFINE(TSS_size, sizeof(struct tss_struct));
12529 DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
12530 BLANK();
12531 DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
12532 @@ -130,6 +145,7 @@ int main(void)
12533
12534 BLANK();
12535 DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
12536 + DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
12537 #ifdef CONFIG_XEN
12538 BLANK();
12539 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
12540 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/amd.c linux-2.6.32.49/arch/x86/kernel/cpu/amd.c
12541 --- linux-2.6.32.49/arch/x86/kernel/cpu/amd.c 2011-11-08 19:02:43.000000000 -0500
12542 +++ linux-2.6.32.49/arch/x86/kernel/cpu/amd.c 2011-11-15 19:59:42.000000000 -0500
12543 @@ -602,7 +602,7 @@ static unsigned int __cpuinit amd_size_c
12544 unsigned int size)
12545 {
12546 /* AMD errata T13 (order #21922) */
12547 - if ((c->x86 == 6)) {
12548 + if (c->x86 == 6) {
12549 /* Duron Rev A0 */
12550 if (c->x86_model == 3 && c->x86_mask == 0)
12551 size = 64;
12552 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/common.c linux-2.6.32.49/arch/x86/kernel/cpu/common.c
12553 --- linux-2.6.32.49/arch/x86/kernel/cpu/common.c 2011-11-08 19:02:43.000000000 -0500
12554 +++ linux-2.6.32.49/arch/x86/kernel/cpu/common.c 2011-11-15 19:59:42.000000000 -0500
12555 @@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
12556
12557 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
12558
12559 -DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
12560 -#ifdef CONFIG_X86_64
12561 - /*
12562 - * We need valid kernel segments for data and code in long mode too
12563 - * IRET will check the segment types kkeil 2000/10/28
12564 - * Also sysret mandates a special GDT layout
12565 - *
12566 - * TLS descriptors are currently at a different place compared to i386.
12567 - * Hopefully nobody expects them at a fixed place (Wine?)
12568 - */
12569 - [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
12570 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
12571 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
12572 - [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
12573 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
12574 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
12575 -#else
12576 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
12577 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12578 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
12579 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
12580 - /*
12581 - * Segments used for calling PnP BIOS have byte granularity.
12582 - * They code segments and data segments have fixed 64k limits,
12583 - * the transfer segment sizes are set at run time.
12584 - */
12585 - /* 32-bit code */
12586 - [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
12587 - /* 16-bit code */
12588 - [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
12589 - /* 16-bit data */
12590 - [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
12591 - /* 16-bit data */
12592 - [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
12593 - /* 16-bit data */
12594 - [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
12595 - /*
12596 - * The APM segments have byte granularity and their bases
12597 - * are set at run time. All have 64k limits.
12598 - */
12599 - /* 32-bit code */
12600 - [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
12601 - /* 16-bit code */
12602 - [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
12603 - /* data */
12604 - [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
12605 -
12606 - [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12607 - [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12608 - GDT_STACK_CANARY_INIT
12609 -#endif
12610 -} };
12611 -EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
12612 -
12613 static int __init x86_xsave_setup(char *s)
12614 {
12615 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
12616 @@ -344,7 +290,7 @@ void switch_to_new_gdt(int cpu)
12617 {
12618 struct desc_ptr gdt_descr;
12619
12620 - gdt_descr.address = (long)get_cpu_gdt_table(cpu);
12621 + gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
12622 gdt_descr.size = GDT_SIZE - 1;
12623 load_gdt(&gdt_descr);
12624 /* Reload the per-cpu base */
12625 @@ -798,6 +744,10 @@ static void __cpuinit identify_cpu(struc
12626 /* Filter out anything that depends on CPUID levels we don't have */
12627 filter_cpuid_features(c, true);
12628
12629 +#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
12630 + setup_clear_cpu_cap(X86_FEATURE_SEP);
12631 +#endif
12632 +
12633 /* If the model name is still unset, do table lookup. */
12634 if (!c->x86_model_id[0]) {
12635 const char *p;
12636 @@ -980,6 +930,9 @@ static __init int setup_disablecpuid(cha
12637 }
12638 __setup("clearcpuid=", setup_disablecpuid);
12639
12640 +DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
12641 +EXPORT_PER_CPU_SYMBOL(current_tinfo);
12642 +
12643 #ifdef CONFIG_X86_64
12644 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
12645
12646 @@ -995,7 +948,7 @@ DEFINE_PER_CPU(struct task_struct *, cur
12647 EXPORT_PER_CPU_SYMBOL(current_task);
12648
12649 DEFINE_PER_CPU(unsigned long, kernel_stack) =
12650 - (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
12651 + (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
12652 EXPORT_PER_CPU_SYMBOL(kernel_stack);
12653
12654 DEFINE_PER_CPU(char *, irq_stack_ptr) =
12655 @@ -1060,7 +1013,7 @@ struct pt_regs * __cpuinit idle_regs(str
12656 {
12657 memset(regs, 0, sizeof(struct pt_regs));
12658 regs->fs = __KERNEL_PERCPU;
12659 - regs->gs = __KERNEL_STACK_CANARY;
12660 + savesegment(gs, regs->gs);
12661
12662 return regs;
12663 }
12664 @@ -1101,7 +1054,7 @@ void __cpuinit cpu_init(void)
12665 int i;
12666
12667 cpu = stack_smp_processor_id();
12668 - t = &per_cpu(init_tss, cpu);
12669 + t = init_tss + cpu;
12670 orig_ist = &per_cpu(orig_ist, cpu);
12671
12672 #ifdef CONFIG_NUMA
12673 @@ -1127,7 +1080,7 @@ void __cpuinit cpu_init(void)
12674 switch_to_new_gdt(cpu);
12675 loadsegment(fs, 0);
12676
12677 - load_idt((const struct desc_ptr *)&idt_descr);
12678 + load_idt(&idt_descr);
12679
12680 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
12681 syscall_init();
12682 @@ -1136,7 +1089,6 @@ void __cpuinit cpu_init(void)
12683 wrmsrl(MSR_KERNEL_GS_BASE, 0);
12684 barrier();
12685
12686 - check_efer();
12687 if (cpu != 0)
12688 enable_x2apic();
12689
12690 @@ -1199,7 +1151,7 @@ void __cpuinit cpu_init(void)
12691 {
12692 int cpu = smp_processor_id();
12693 struct task_struct *curr = current;
12694 - struct tss_struct *t = &per_cpu(init_tss, cpu);
12695 + struct tss_struct *t = init_tss + cpu;
12696 struct thread_struct *thread = &curr->thread;
12697
12698 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
12699 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/intel.c linux-2.6.32.49/arch/x86/kernel/cpu/intel.c
12700 --- linux-2.6.32.49/arch/x86/kernel/cpu/intel.c 2011-11-08 19:02:43.000000000 -0500
12701 +++ linux-2.6.32.49/arch/x86/kernel/cpu/intel.c 2011-11-15 19:59:42.000000000 -0500
12702 @@ -162,7 +162,7 @@ static void __cpuinit trap_init_f00f_bug
12703 * Update the IDT descriptor and reload the IDT so that
12704 * it uses the read-only mapped virtual address.
12705 */
12706 - idt_descr.address = fix_to_virt(FIX_F00F_IDT);
12707 + idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
12708 load_idt(&idt_descr);
12709 }
12710 #endif
12711 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.32.49/arch/x86/kernel/cpu/intel_cacheinfo.c
12712 --- linux-2.6.32.49/arch/x86/kernel/cpu/intel_cacheinfo.c 2011-11-08 19:02:43.000000000 -0500
12713 +++ linux-2.6.32.49/arch/x86/kernel/cpu/intel_cacheinfo.c 2011-11-15 19:59:42.000000000 -0500
12714 @@ -921,7 +921,7 @@ static ssize_t store(struct kobject *kob
12715 return ret;
12716 }
12717
12718 -static struct sysfs_ops sysfs_ops = {
12719 +static const struct sysfs_ops sysfs_ops = {
12720 .show = show,
12721 .store = store,
12722 };
12723 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/Makefile linux-2.6.32.49/arch/x86/kernel/cpu/Makefile
12724 --- linux-2.6.32.49/arch/x86/kernel/cpu/Makefile 2011-11-08 19:02:43.000000000 -0500
12725 +++ linux-2.6.32.49/arch/x86/kernel/cpu/Makefile 2011-11-15 19:59:42.000000000 -0500
12726 @@ -7,10 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
12727 CFLAGS_REMOVE_common.o = -pg
12728 endif
12729
12730 -# Make sure load_percpu_segment has no stackprotector
12731 -nostackp := $(call cc-option, -fno-stack-protector)
12732 -CFLAGS_common.o := $(nostackp)
12733 -
12734 obj-y := intel_cacheinfo.o addon_cpuid_features.o
12735 obj-y += proc.o capflags.o powerflags.o common.o
12736 obj-y += vmware.o hypervisor.o sched.o
12737 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.49/arch/x86/kernel/cpu/mcheck/mce_amd.c
12738 --- linux-2.6.32.49/arch/x86/kernel/cpu/mcheck/mce_amd.c 2011-11-08 19:02:43.000000000 -0500
12739 +++ linux-2.6.32.49/arch/x86/kernel/cpu/mcheck/mce_amd.c 2011-11-15 19:59:42.000000000 -0500
12740 @@ -385,7 +385,7 @@ static ssize_t store(struct kobject *kob
12741 return ret;
12742 }
12743
12744 -static struct sysfs_ops threshold_ops = {
12745 +static const struct sysfs_ops threshold_ops = {
12746 .show = show,
12747 .store = store,
12748 };
12749 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.49/arch/x86/kernel/cpu/mcheck/mce.c
12750 --- linux-2.6.32.49/arch/x86/kernel/cpu/mcheck/mce.c 2011-11-08 19:02:43.000000000 -0500
12751 +++ linux-2.6.32.49/arch/x86/kernel/cpu/mcheck/mce.c 2011-11-15 19:59:42.000000000 -0500
12752 @@ -43,6 +43,7 @@
12753 #include <asm/ipi.h>
12754 #include <asm/mce.h>
12755 #include <asm/msr.h>
12756 +#include <asm/local.h>
12757
12758 #include "mce-internal.h"
12759
12760 @@ -187,7 +188,7 @@ static void print_mce(struct mce *m)
12761 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
12762 m->cs, m->ip);
12763
12764 - if (m->cs == __KERNEL_CS)
12765 + if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
12766 print_symbol("{%s}", m->ip);
12767 pr_cont("\n");
12768 }
12769 @@ -221,10 +222,10 @@ static void print_mce_tail(void)
12770
12771 #define PANIC_TIMEOUT 5 /* 5 seconds */
12772
12773 -static atomic_t mce_paniced;
12774 +static atomic_unchecked_t mce_paniced;
12775
12776 static int fake_panic;
12777 -static atomic_t mce_fake_paniced;
12778 +static atomic_unchecked_t mce_fake_paniced;
12779
12780 /* Panic in progress. Enable interrupts and wait for final IPI */
12781 static void wait_for_panic(void)
12782 @@ -248,7 +249,7 @@ static void mce_panic(char *msg, struct
12783 /*
12784 * Make sure only one CPU runs in machine check panic
12785 */
12786 - if (atomic_inc_return(&mce_paniced) > 1)
12787 + if (atomic_inc_return_unchecked(&mce_paniced) > 1)
12788 wait_for_panic();
12789 barrier();
12790
12791 @@ -256,7 +257,7 @@ static void mce_panic(char *msg, struct
12792 console_verbose();
12793 } else {
12794 /* Don't log too much for fake panic */
12795 - if (atomic_inc_return(&mce_fake_paniced) > 1)
12796 + if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
12797 return;
12798 }
12799 print_mce_head();
12800 @@ -616,7 +617,7 @@ static int mce_timed_out(u64 *t)
12801 * might have been modified by someone else.
12802 */
12803 rmb();
12804 - if (atomic_read(&mce_paniced))
12805 + if (atomic_read_unchecked(&mce_paniced))
12806 wait_for_panic();
12807 if (!monarch_timeout)
12808 goto out;
12809 @@ -1429,14 +1430,14 @@ void __cpuinit mcheck_init(struct cpuinf
12810 */
12811
12812 static DEFINE_SPINLOCK(mce_state_lock);
12813 -static int open_count; /* #times opened */
12814 +static local_t open_count; /* #times opened */
12815 static int open_exclu; /* already open exclusive? */
12816
12817 static int mce_open(struct inode *inode, struct file *file)
12818 {
12819 spin_lock(&mce_state_lock);
12820
12821 - if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
12822 + if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
12823 spin_unlock(&mce_state_lock);
12824
12825 return -EBUSY;
12826 @@ -1444,7 +1445,7 @@ static int mce_open(struct inode *inode,
12827
12828 if (file->f_flags & O_EXCL)
12829 open_exclu = 1;
12830 - open_count++;
12831 + local_inc(&open_count);
12832
12833 spin_unlock(&mce_state_lock);
12834
12835 @@ -1455,7 +1456,7 @@ static int mce_release(struct inode *ino
12836 {
12837 spin_lock(&mce_state_lock);
12838
12839 - open_count--;
12840 + local_dec(&open_count);
12841 open_exclu = 0;
12842
12843 spin_unlock(&mce_state_lock);
12844 @@ -2082,7 +2083,7 @@ struct dentry *mce_get_debugfs_dir(void)
12845 static void mce_reset(void)
12846 {
12847 cpu_missing = 0;
12848 - atomic_set(&mce_fake_paniced, 0);
12849 + atomic_set_unchecked(&mce_fake_paniced, 0);
12850 atomic_set(&mce_executing, 0);
12851 atomic_set(&mce_callin, 0);
12852 atomic_set(&global_nwo, 0);
12853 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/mcheck/mce-inject.c linux-2.6.32.49/arch/x86/kernel/cpu/mcheck/mce-inject.c
12854 --- linux-2.6.32.49/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-11-08 19:02:43.000000000 -0500
12855 +++ linux-2.6.32.49/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-11-15 19:59:42.000000000 -0500
12856 @@ -211,7 +211,9 @@ static ssize_t mce_write(struct file *fi
12857 static int inject_init(void)
12858 {
12859 printk(KERN_INFO "Machine check injector initialized\n");
12860 - mce_chrdev_ops.write = mce_write;
12861 + pax_open_kernel();
12862 + *(void **)&mce_chrdev_ops.write = mce_write;
12863 + pax_close_kernel();
12864 register_die_notifier(&mce_raise_nb);
12865 return 0;
12866 }
12867 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/amd.c
12868 --- linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/amd.c 2011-11-08 19:02:43.000000000 -0500
12869 +++ linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/amd.c 2011-11-15 19:59:42.000000000 -0500
12870 @@ -108,7 +108,7 @@ amd_validate_add_page(unsigned long base
12871 return 0;
12872 }
12873
12874 -static struct mtrr_ops amd_mtrr_ops = {
12875 +static const struct mtrr_ops amd_mtrr_ops = {
12876 .vendor = X86_VENDOR_AMD,
12877 .set = amd_set_mtrr,
12878 .get = amd_get_mtrr,
12879 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/centaur.c
12880 --- linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/centaur.c 2011-11-08 19:02:43.000000000 -0500
12881 +++ linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/centaur.c 2011-11-15 19:59:42.000000000 -0500
12882 @@ -110,7 +110,7 @@ centaur_validate_add_page(unsigned long
12883 return 0;
12884 }
12885
12886 -static struct mtrr_ops centaur_mtrr_ops = {
12887 +static const struct mtrr_ops centaur_mtrr_ops = {
12888 .vendor = X86_VENDOR_CENTAUR,
12889 .set = centaur_set_mcr,
12890 .get = centaur_get_mcr,
12891 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/cyrix.c
12892 --- linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/cyrix.c 2011-11-08 19:02:43.000000000 -0500
12893 +++ linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/cyrix.c 2011-11-15 19:59:42.000000000 -0500
12894 @@ -265,7 +265,7 @@ static void cyrix_set_all(void)
12895 post_set();
12896 }
12897
12898 -static struct mtrr_ops cyrix_mtrr_ops = {
12899 +static const struct mtrr_ops cyrix_mtrr_ops = {
12900 .vendor = X86_VENDOR_CYRIX,
12901 .set_all = cyrix_set_all,
12902 .set = cyrix_set_arr,
12903 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/generic.c
12904 --- linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/generic.c 2011-11-08 19:02:43.000000000 -0500
12905 +++ linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/generic.c 2011-11-15 19:59:42.000000000 -0500
12906 @@ -752,7 +752,7 @@ int positive_have_wrcomb(void)
12907 /*
12908 * Generic structure...
12909 */
12910 -struct mtrr_ops generic_mtrr_ops = {
12911 +const struct mtrr_ops generic_mtrr_ops = {
12912 .use_intel_if = 1,
12913 .set_all = generic_set_all,
12914 .get = generic_get_mtrr,
12915 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/main.c
12916 --- linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/main.c 2011-11-08 19:02:43.000000000 -0500
12917 +++ linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/main.c 2011-11-15 19:59:42.000000000 -0500
12918 @@ -60,14 +60,14 @@ static DEFINE_MUTEX(mtrr_mutex);
12919 u64 size_or_mask, size_and_mask;
12920 static bool mtrr_aps_delayed_init;
12921
12922 -static struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
12923 +static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
12924
12925 -struct mtrr_ops *mtrr_if;
12926 +const struct mtrr_ops *mtrr_if;
12927
12928 static void set_mtrr(unsigned int reg, unsigned long base,
12929 unsigned long size, mtrr_type type);
12930
12931 -void set_mtrr_ops(struct mtrr_ops *ops)
12932 +void set_mtrr_ops(const struct mtrr_ops *ops)
12933 {
12934 if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
12935 mtrr_ops[ops->vendor] = ops;
12936 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/mtrr.h
12937 --- linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-11-08 19:02:43.000000000 -0500
12938 +++ linux-2.6.32.49/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-11-15 19:59:42.000000000 -0500
12939 @@ -25,14 +25,14 @@ struct mtrr_ops {
12940 int (*validate_add_page)(unsigned long base, unsigned long size,
12941 unsigned int type);
12942 int (*have_wrcomb)(void);
12943 -};
12944 +} __do_const;
12945
12946 extern int generic_get_free_region(unsigned long base, unsigned long size,
12947 int replace_reg);
12948 extern int generic_validate_add_page(unsigned long base, unsigned long size,
12949 unsigned int type);
12950
12951 -extern struct mtrr_ops generic_mtrr_ops;
12952 +extern const struct mtrr_ops generic_mtrr_ops;
12953
12954 extern int positive_have_wrcomb(void);
12955
12956 @@ -53,10 +53,10 @@ void fill_mtrr_var_range(unsigned int in
12957 u32 base_lo, u32 base_hi, u32 mask_lo, u32 mask_hi);
12958 void get_mtrr_state(void);
12959
12960 -extern void set_mtrr_ops(struct mtrr_ops *ops);
12961 +extern void set_mtrr_ops(const struct mtrr_ops *ops);
12962
12963 extern u64 size_or_mask, size_and_mask;
12964 -extern struct mtrr_ops *mtrr_if;
12965 +extern const struct mtrr_ops *mtrr_if;
12966
12967 #define is_cpu(vnd) (mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
12968 #define use_intel() (mtrr_if && mtrr_if->use_intel_if == 1)
12969 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.32.49/arch/x86/kernel/cpu/perfctr-watchdog.c
12970 --- linux-2.6.32.49/arch/x86/kernel/cpu/perfctr-watchdog.c 2011-11-08 19:02:43.000000000 -0500
12971 +++ linux-2.6.32.49/arch/x86/kernel/cpu/perfctr-watchdog.c 2011-11-15 19:59:42.000000000 -0500
12972 @@ -30,11 +30,11 @@ struct nmi_watchdog_ctlblk {
12973
12974 /* Interface defining a CPU specific perfctr watchdog */
12975 struct wd_ops {
12976 - int (*reserve)(void);
12977 - void (*unreserve)(void);
12978 - int (*setup)(unsigned nmi_hz);
12979 - void (*rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
12980 - void (*stop)(void);
12981 + int (* const reserve)(void);
12982 + void (* const unreserve)(void);
12983 + int (* const setup)(unsigned nmi_hz);
12984 + void (* const rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
12985 + void (* const stop)(void);
12986 unsigned perfctr;
12987 unsigned evntsel;
12988 u64 checkbit;
12989 @@ -645,6 +645,7 @@ static const struct wd_ops p4_wd_ops = {
12990 #define ARCH_PERFMON_NMI_EVENT_SEL ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
12991 #define ARCH_PERFMON_NMI_EVENT_UMASK ARCH_PERFMON_UNHALTED_CORE_CYCLES_UMASK
12992
12993 +/* cannot be const */
12994 static struct wd_ops intel_arch_wd_ops;
12995
12996 static int setup_intel_arch_watchdog(unsigned nmi_hz)
12997 @@ -697,6 +698,7 @@ static int setup_intel_arch_watchdog(uns
12998 return 1;
12999 }
13000
13001 +/* cannot be const */
13002 static struct wd_ops intel_arch_wd_ops __read_mostly = {
13003 .reserve = single_msr_reserve,
13004 .unreserve = single_msr_unreserve,
13005 diff -urNp linux-2.6.32.49/arch/x86/kernel/cpu/perf_event.c linux-2.6.32.49/arch/x86/kernel/cpu/perf_event.c
13006 --- linux-2.6.32.49/arch/x86/kernel/cpu/perf_event.c 2011-11-08 19:02:43.000000000 -0500
13007 +++ linux-2.6.32.49/arch/x86/kernel/cpu/perf_event.c 2011-11-15 19:59:42.000000000 -0500
13008 @@ -723,10 +723,10 @@ x86_perf_event_update(struct perf_event
13009 * count to the generic event atomically:
13010 */
13011 again:
13012 - prev_raw_count = atomic64_read(&hwc->prev_count);
13013 + prev_raw_count = atomic64_read_unchecked(&hwc->prev_count);
13014 rdmsrl(hwc->event_base + idx, new_raw_count);
13015
13016 - if (atomic64_cmpxchg(&hwc->prev_count, prev_raw_count,
13017 + if (atomic64_cmpxchg_unchecked(&hwc->prev_count, prev_raw_count,
13018 new_raw_count) != prev_raw_count)
13019 goto again;
13020
13021 @@ -741,7 +741,7 @@ again:
13022 delta = (new_raw_count << shift) - (prev_raw_count << shift);
13023 delta >>= shift;
13024
13025 - atomic64_add(delta, &event->count);
13026 + atomic64_add_unchecked(delta, &event->count);
13027 atomic64_sub(delta, &hwc->period_left);
13028
13029 return new_raw_count;
13030 @@ -1353,7 +1353,7 @@ x86_perf_event_set_period(struct perf_ev
13031 * The hw event starts counting from this event offset,
13032 * mark it to be able to extra future deltas:
13033 */
13034 - atomic64_set(&hwc->prev_count, (u64)-left);
13035 + atomic64_set_unchecked(&hwc->prev_count, (u64)-left);
13036
13037 err = checking_wrmsrl(hwc->event_base + idx,
13038 (u64)(-left) & x86_pmu.event_mask);
13039 @@ -2357,7 +2357,7 @@ perf_callchain_user(struct pt_regs *regs
13040 break;
13041
13042 callchain_store(entry, frame.return_address);
13043 - fp = frame.next_frame;
13044 + fp = (__force const void __user *)frame.next_frame;
13045 }
13046 }
13047
13048 diff -urNp linux-2.6.32.49/arch/x86/kernel/crash.c linux-2.6.32.49/arch/x86/kernel/crash.c
13049 --- linux-2.6.32.49/arch/x86/kernel/crash.c 2011-11-08 19:02:43.000000000 -0500
13050 +++ linux-2.6.32.49/arch/x86/kernel/crash.c 2011-11-15 19:59:42.000000000 -0500
13051 @@ -41,7 +41,7 @@ static void kdump_nmi_callback(int cpu,
13052 regs = args->regs;
13053
13054 #ifdef CONFIG_X86_32
13055 - if (!user_mode_vm(regs)) {
13056 + if (!user_mode(regs)) {
13057 crash_fixup_ss_esp(&fixed_regs, regs);
13058 regs = &fixed_regs;
13059 }
13060 diff -urNp linux-2.6.32.49/arch/x86/kernel/doublefault_32.c linux-2.6.32.49/arch/x86/kernel/doublefault_32.c
13061 --- linux-2.6.32.49/arch/x86/kernel/doublefault_32.c 2011-11-08 19:02:43.000000000 -0500
13062 +++ linux-2.6.32.49/arch/x86/kernel/doublefault_32.c 2011-11-15 19:59:42.000000000 -0500
13063 @@ -11,7 +11,7 @@
13064
13065 #define DOUBLEFAULT_STACKSIZE (1024)
13066 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
13067 -#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
13068 +#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
13069
13070 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
13071
13072 @@ -21,7 +21,7 @@ static void doublefault_fn(void)
13073 unsigned long gdt, tss;
13074
13075 store_gdt(&gdt_desc);
13076 - gdt = gdt_desc.address;
13077 + gdt = (unsigned long)gdt_desc.address;
13078
13079 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
13080
13081 @@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
13082 /* 0x2 bit is always set */
13083 .flags = X86_EFLAGS_SF | 0x2,
13084 .sp = STACK_START,
13085 - .es = __USER_DS,
13086 + .es = __KERNEL_DS,
13087 .cs = __KERNEL_CS,
13088 .ss = __KERNEL_DS,
13089 - .ds = __USER_DS,
13090 + .ds = __KERNEL_DS,
13091 .fs = __KERNEL_PERCPU,
13092
13093 .__cr3 = __pa_nodebug(swapper_pg_dir),
13094 diff -urNp linux-2.6.32.49/arch/x86/kernel/dumpstack_32.c linux-2.6.32.49/arch/x86/kernel/dumpstack_32.c
13095 --- linux-2.6.32.49/arch/x86/kernel/dumpstack_32.c 2011-11-08 19:02:43.000000000 -0500
13096 +++ linux-2.6.32.49/arch/x86/kernel/dumpstack_32.c 2011-11-18 18:10:09.000000000 -0500
13097 @@ -53,16 +53,12 @@ void dump_trace(struct task_struct *task
13098 #endif
13099
13100 for (;;) {
13101 - struct thread_info *context;
13102 + void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
13103 + bp = print_context_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
13104
13105 - context = (struct thread_info *)
13106 - ((unsigned long)stack & (~(THREAD_SIZE - 1)));
13107 - bp = print_context_stack(context, stack, bp, ops,
13108 - data, NULL, &graph);
13109 -
13110 - stack = (unsigned long *)context->previous_esp;
13111 - if (!stack)
13112 + if (stack_start == task_stack_page(task))
13113 break;
13114 + stack = *(unsigned long **)stack_start;
13115 if (ops->stack(data, "IRQ") < 0)
13116 break;
13117 touch_nmi_watchdog();
13118 @@ -112,11 +108,12 @@ void show_registers(struct pt_regs *regs
13119 * When in-kernel, we also print out the stack and code at the
13120 * time of the fault..
13121 */
13122 - if (!user_mode_vm(regs)) {
13123 + if (!user_mode(regs)) {
13124 unsigned int code_prologue = code_bytes * 43 / 64;
13125 unsigned int code_len = code_bytes;
13126 unsigned char c;
13127 u8 *ip;
13128 + unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
13129
13130 printk(KERN_EMERG "Stack:\n");
13131 show_stack_log_lvl(NULL, regs, &regs->sp,
13132 @@ -124,10 +121,10 @@ void show_registers(struct pt_regs *regs
13133
13134 printk(KERN_EMERG "Code: ");
13135
13136 - ip = (u8 *)regs->ip - code_prologue;
13137 + ip = (u8 *)regs->ip - code_prologue + cs_base;
13138 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
13139 /* try starting at IP */
13140 - ip = (u8 *)regs->ip;
13141 + ip = (u8 *)regs->ip + cs_base;
13142 code_len = code_len - code_prologue + 1;
13143 }
13144 for (i = 0; i < code_len; i++, ip++) {
13145 @@ -136,7 +133,7 @@ void show_registers(struct pt_regs *regs
13146 printk(" Bad EIP value.");
13147 break;
13148 }
13149 - if (ip == (u8 *)regs->ip)
13150 + if (ip == (u8 *)regs->ip + cs_base)
13151 printk("<%02x> ", c);
13152 else
13153 printk("%02x ", c);
13154 @@ -145,10 +142,23 @@ void show_registers(struct pt_regs *regs
13155 printk("\n");
13156 }
13157
13158 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13159 +void pax_check_alloca(unsigned long size)
13160 +{
13161 + unsigned long sp = (unsigned long)&sp, stack_left;
13162 +
13163 + /* all kernel stacks are of the same size */
13164 + stack_left = sp & (THREAD_SIZE - 1);
13165 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
13166 +}
13167 +EXPORT_SYMBOL(pax_check_alloca);
13168 +#endif
13169 +
13170 int is_valid_bugaddr(unsigned long ip)
13171 {
13172 unsigned short ud2;
13173
13174 + ip = ktla_ktva(ip);
13175 if (ip < PAGE_OFFSET)
13176 return 0;
13177 if (probe_kernel_address((unsigned short *)ip, ud2))
13178 diff -urNp linux-2.6.32.49/arch/x86/kernel/dumpstack_64.c linux-2.6.32.49/arch/x86/kernel/dumpstack_64.c
13179 --- linux-2.6.32.49/arch/x86/kernel/dumpstack_64.c 2011-11-08 19:02:43.000000000 -0500
13180 +++ linux-2.6.32.49/arch/x86/kernel/dumpstack_64.c 2011-11-18 18:01:52.000000000 -0500
13181 @@ -116,8 +116,8 @@ void dump_trace(struct task_struct *task
13182 unsigned long *irq_stack_end =
13183 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
13184 unsigned used = 0;
13185 - struct thread_info *tinfo;
13186 int graph = 0;
13187 + void *stack_start;
13188
13189 if (!task)
13190 task = current;
13191 @@ -146,10 +146,10 @@ void dump_trace(struct task_struct *task
13192 * current stack address. If the stacks consist of nested
13193 * exceptions
13194 */
13195 - tinfo = task_thread_info(task);
13196 for (;;) {
13197 char *id;
13198 unsigned long *estack_end;
13199 +
13200 estack_end = in_exception_stack(cpu, (unsigned long)stack,
13201 &used, &id);
13202
13203 @@ -157,7 +157,7 @@ void dump_trace(struct task_struct *task
13204 if (ops->stack(data, id) < 0)
13205 break;
13206
13207 - bp = print_context_stack(tinfo, stack, bp, ops,
13208 + bp = print_context_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
13209 data, estack_end, &graph);
13210 ops->stack(data, "<EOE>");
13211 /*
13212 @@ -176,7 +176,7 @@ void dump_trace(struct task_struct *task
13213 if (stack >= irq_stack && stack < irq_stack_end) {
13214 if (ops->stack(data, "IRQ") < 0)
13215 break;
13216 - bp = print_context_stack(tinfo, stack, bp,
13217 + bp = print_context_stack(task, irq_stack, stack, bp,
13218 ops, data, irq_stack_end, &graph);
13219 /*
13220 * We link to the next stack (which would be
13221 @@ -195,7 +195,8 @@ void dump_trace(struct task_struct *task
13222 /*
13223 * This handles the process stack:
13224 */
13225 - bp = print_context_stack(tinfo, stack, bp, ops, data, NULL, &graph);
13226 + stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
13227 + bp = print_context_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
13228 put_cpu();
13229 }
13230 EXPORT_SYMBOL(dump_trace);
13231 @@ -304,3 +305,50 @@ int is_valid_bugaddr(unsigned long ip)
13232 return ud2 == 0x0b0f;
13233 }
13234
13235 +
13236 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13237 +void pax_check_alloca(unsigned long size)
13238 +{
13239 + unsigned long sp = (unsigned long)&sp, stack_start, stack_end;
13240 + unsigned cpu, used;
13241 + char *id;
13242 +
13243 + /* check the process stack first */
13244 + stack_start = (unsigned long)task_stack_page(current);
13245 + stack_end = stack_start + THREAD_SIZE;
13246 + if (likely(stack_start <= sp && sp < stack_end)) {
13247 + unsigned long stack_left = sp & (THREAD_SIZE - 1);
13248 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
13249 + return;
13250 + }
13251 +
13252 + cpu = get_cpu();
13253 +
13254 + /* check the irq stacks */
13255 + stack_end = (unsigned long)per_cpu(irq_stack_ptr, cpu);
13256 + stack_start = stack_end - IRQ_STACK_SIZE;
13257 + if (stack_start <= sp && sp < stack_end) {
13258 + unsigned long stack_left = sp & (IRQ_STACK_SIZE - 1);
13259 + put_cpu();
13260 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
13261 + return;
13262 + }
13263 +
13264 + /* check the exception stacks */
13265 + used = 0;
13266 + stack_end = (unsigned long)in_exception_stack(cpu, sp, &used, &id);
13267 + stack_start = stack_end - EXCEPTION_STKSZ;
13268 + if (stack_end && stack_start <= sp && sp < stack_end) {
13269 + unsigned long stack_left = sp & (EXCEPTION_STKSZ - 1);
13270 + put_cpu();
13271 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
13272 + return;
13273 + }
13274 +
13275 + put_cpu();
13276 +
13277 + /* unknown stack */
13278 + BUG();
13279 +}
13280 +EXPORT_SYMBOL(pax_check_alloca);
13281 +#endif
13282 diff -urNp linux-2.6.32.49/arch/x86/kernel/dumpstack.c linux-2.6.32.49/arch/x86/kernel/dumpstack.c
13283 --- linux-2.6.32.49/arch/x86/kernel/dumpstack.c 2011-11-08 19:02:43.000000000 -0500
13284 +++ linux-2.6.32.49/arch/x86/kernel/dumpstack.c 2011-11-15 19:59:43.000000000 -0500
13285 @@ -2,6 +2,9 @@
13286 * Copyright (C) 1991, 1992 Linus Torvalds
13287 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
13288 */
13289 +#ifdef CONFIG_GRKERNSEC_HIDESYM
13290 +#define __INCLUDED_BY_HIDESYM 1
13291 +#endif
13292 #include <linux/kallsyms.h>
13293 #include <linux/kprobes.h>
13294 #include <linux/uaccess.h>
13295 @@ -28,7 +31,7 @@ static int die_counter;
13296
13297 void printk_address(unsigned long address, int reliable)
13298 {
13299 - printk(" [<%p>] %s%pS\n", (void *) address,
13300 + printk(" [<%p>] %s%pA\n", (void *) address,
13301 reliable ? "" : "? ", (void *) address);
13302 }
13303
13304 @@ -36,9 +39,8 @@ void printk_address(unsigned long addres
13305 static void
13306 print_ftrace_graph_addr(unsigned long addr, void *data,
13307 const struct stacktrace_ops *ops,
13308 - struct thread_info *tinfo, int *graph)
13309 + struct task_struct *task, int *graph)
13310 {
13311 - struct task_struct *task = tinfo->task;
13312 unsigned long ret_addr;
13313 int index = task->curr_ret_stack;
13314
13315 @@ -59,7 +61,7 @@ print_ftrace_graph_addr(unsigned long ad
13316 static inline void
13317 print_ftrace_graph_addr(unsigned long addr, void *data,
13318 const struct stacktrace_ops *ops,
13319 - struct thread_info *tinfo, int *graph)
13320 + struct task_struct *task, int *graph)
13321 { }
13322 #endif
13323
13324 @@ -70,10 +72,8 @@ print_ftrace_graph_addr(unsigned long ad
13325 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
13326 */
13327
13328 -static inline int valid_stack_ptr(struct thread_info *tinfo,
13329 - void *p, unsigned int size, void *end)
13330 +static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
13331 {
13332 - void *t = tinfo;
13333 if (end) {
13334 if (p < end && p >= (end-THREAD_SIZE))
13335 return 1;
13336 @@ -84,14 +84,14 @@ static inline int valid_stack_ptr(struct
13337 }
13338
13339 unsigned long
13340 -print_context_stack(struct thread_info *tinfo,
13341 +print_context_stack(struct task_struct *task, void *stack_start,
13342 unsigned long *stack, unsigned long bp,
13343 const struct stacktrace_ops *ops, void *data,
13344 unsigned long *end, int *graph)
13345 {
13346 struct stack_frame *frame = (struct stack_frame *)bp;
13347
13348 - while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
13349 + while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
13350 unsigned long addr;
13351
13352 addr = *stack;
13353 @@ -103,7 +103,7 @@ print_context_stack(struct thread_info *
13354 } else {
13355 ops->address(data, addr, 0);
13356 }
13357 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
13358 + print_ftrace_graph_addr(addr, data, ops, task, graph);
13359 }
13360 stack++;
13361 }
13362 @@ -180,7 +180,7 @@ void dump_stack(void)
13363 #endif
13364
13365 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
13366 - current->pid, current->comm, print_tainted(),
13367 + task_pid_nr(current), current->comm, print_tainted(),
13368 init_utsname()->release,
13369 (int)strcspn(init_utsname()->version, " "),
13370 init_utsname()->version);
13371 @@ -220,6 +220,8 @@ unsigned __kprobes long oops_begin(void)
13372 return flags;
13373 }
13374
13375 +extern void gr_handle_kernel_exploit(void);
13376 +
13377 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
13378 {
13379 if (regs && kexec_should_crash(current))
13380 @@ -241,7 +243,10 @@ void __kprobes oops_end(unsigned long fl
13381 panic("Fatal exception in interrupt");
13382 if (panic_on_oops)
13383 panic("Fatal exception");
13384 - do_exit(signr);
13385 +
13386 + gr_handle_kernel_exploit();
13387 +
13388 + do_group_exit(signr);
13389 }
13390
13391 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
13392 @@ -295,7 +300,7 @@ void die(const char *str, struct pt_regs
13393 unsigned long flags = oops_begin();
13394 int sig = SIGSEGV;
13395
13396 - if (!user_mode_vm(regs))
13397 + if (!user_mode(regs))
13398 report_bug(regs->ip, regs);
13399
13400 if (__die(str, regs, err))
13401 diff -urNp linux-2.6.32.49/arch/x86/kernel/dumpstack.h linux-2.6.32.49/arch/x86/kernel/dumpstack.h
13402 --- linux-2.6.32.49/arch/x86/kernel/dumpstack.h 2011-11-08 19:02:43.000000000 -0500
13403 +++ linux-2.6.32.49/arch/x86/kernel/dumpstack.h 2011-11-15 19:59:43.000000000 -0500
13404 @@ -15,7 +15,7 @@
13405 #endif
13406
13407 extern unsigned long
13408 -print_context_stack(struct thread_info *tinfo,
13409 +print_context_stack(struct task_struct *task, void *stack_start,
13410 unsigned long *stack, unsigned long bp,
13411 const struct stacktrace_ops *ops, void *data,
13412 unsigned long *end, int *graph);
13413 diff -urNp linux-2.6.32.49/arch/x86/kernel/e820.c linux-2.6.32.49/arch/x86/kernel/e820.c
13414 --- linux-2.6.32.49/arch/x86/kernel/e820.c 2011-11-08 19:02:43.000000000 -0500
13415 +++ linux-2.6.32.49/arch/x86/kernel/e820.c 2011-11-15 19:59:43.000000000 -0500
13416 @@ -733,7 +733,7 @@ struct early_res {
13417 };
13418 static struct early_res early_res[MAX_EARLY_RES] __initdata = {
13419 { 0, PAGE_SIZE, "BIOS data page" }, /* BIOS data page */
13420 - {}
13421 + { 0, 0, {0}, 0 }
13422 };
13423
13424 static int __init find_overlapped_early(u64 start, u64 end)
13425 diff -urNp linux-2.6.32.49/arch/x86/kernel/early_printk.c linux-2.6.32.49/arch/x86/kernel/early_printk.c
13426 --- linux-2.6.32.49/arch/x86/kernel/early_printk.c 2011-11-08 19:02:43.000000000 -0500
13427 +++ linux-2.6.32.49/arch/x86/kernel/early_printk.c 2011-11-15 19:59:43.000000000 -0500
13428 @@ -7,6 +7,7 @@
13429 #include <linux/pci_regs.h>
13430 #include <linux/pci_ids.h>
13431 #include <linux/errno.h>
13432 +#include <linux/sched.h>
13433 #include <asm/io.h>
13434 #include <asm/processor.h>
13435 #include <asm/fcntl.h>
13436 @@ -170,6 +171,8 @@ asmlinkage void early_printk(const char
13437 int n;
13438 va_list ap;
13439
13440 + pax_track_stack();
13441 +
13442 va_start(ap, fmt);
13443 n = vscnprintf(buf, sizeof(buf), fmt, ap);
13444 early_console->write(early_console, buf, n);
13445 diff -urNp linux-2.6.32.49/arch/x86/kernel/efi_32.c linux-2.6.32.49/arch/x86/kernel/efi_32.c
13446 --- linux-2.6.32.49/arch/x86/kernel/efi_32.c 2011-11-08 19:02:43.000000000 -0500
13447 +++ linux-2.6.32.49/arch/x86/kernel/efi_32.c 2011-11-15 19:59:43.000000000 -0500
13448 @@ -38,70 +38,56 @@
13449 */
13450
13451 static unsigned long efi_rt_eflags;
13452 -static pgd_t efi_bak_pg_dir_pointer[2];
13453 +static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
13454
13455 -void efi_call_phys_prelog(void)
13456 +void __init efi_call_phys_prelog(void)
13457 {
13458 - unsigned long cr4;
13459 - unsigned long temp;
13460 struct desc_ptr gdt_descr;
13461
13462 - local_irq_save(efi_rt_eflags);
13463 +#ifdef CONFIG_PAX_KERNEXEC
13464 + struct desc_struct d;
13465 +#endif
13466
13467 - /*
13468 - * If I don't have PAE, I should just duplicate two entries in page
13469 - * directory. If I have PAE, I just need to duplicate one entry in
13470 - * page directory.
13471 - */
13472 - cr4 = read_cr4_safe();
13473 + local_irq_save(efi_rt_eflags);
13474
13475 - if (cr4 & X86_CR4_PAE) {
13476 - efi_bak_pg_dir_pointer[0].pgd =
13477 - swapper_pg_dir[pgd_index(0)].pgd;
13478 - swapper_pg_dir[0].pgd =
13479 - swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
13480 - } else {
13481 - efi_bak_pg_dir_pointer[0].pgd =
13482 - swapper_pg_dir[pgd_index(0)].pgd;
13483 - efi_bak_pg_dir_pointer[1].pgd =
13484 - swapper_pg_dir[pgd_index(0x400000)].pgd;
13485 - swapper_pg_dir[pgd_index(0)].pgd =
13486 - swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
13487 - temp = PAGE_OFFSET + 0x400000;
13488 - swapper_pg_dir[pgd_index(0x400000)].pgd =
13489 - swapper_pg_dir[pgd_index(temp)].pgd;
13490 - }
13491 + clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
13492 + clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
13493 + min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
13494
13495 /*
13496 * After the lock is released, the original page table is restored.
13497 */
13498 __flush_tlb_all();
13499
13500 +#ifdef CONFIG_PAX_KERNEXEC
13501 + pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC);
13502 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
13503 + pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC);
13504 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
13505 +#endif
13506 +
13507 gdt_descr.address = __pa(get_cpu_gdt_table(0));
13508 gdt_descr.size = GDT_SIZE - 1;
13509 load_gdt(&gdt_descr);
13510 }
13511
13512 -void efi_call_phys_epilog(void)
13513 +void __init efi_call_phys_epilog(void)
13514 {
13515 - unsigned long cr4;
13516 struct desc_ptr gdt_descr;
13517
13518 +#ifdef CONFIG_PAX_KERNEXEC
13519 + struct desc_struct d;
13520 +
13521 + memset(&d, 0, sizeof d);
13522 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
13523 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
13524 +#endif
13525 +
13526 gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
13527 gdt_descr.size = GDT_SIZE - 1;
13528 load_gdt(&gdt_descr);
13529
13530 - cr4 = read_cr4_safe();
13531 -
13532 - if (cr4 & X86_CR4_PAE) {
13533 - swapper_pg_dir[pgd_index(0)].pgd =
13534 - efi_bak_pg_dir_pointer[0].pgd;
13535 - } else {
13536 - swapper_pg_dir[pgd_index(0)].pgd =
13537 - efi_bak_pg_dir_pointer[0].pgd;
13538 - swapper_pg_dir[pgd_index(0x400000)].pgd =
13539 - efi_bak_pg_dir_pointer[1].pgd;
13540 - }
13541 + clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
13542
13543 /*
13544 * After the lock is released, the original page table is restored.
13545 diff -urNp linux-2.6.32.49/arch/x86/kernel/efi_stub_32.S linux-2.6.32.49/arch/x86/kernel/efi_stub_32.S
13546 --- linux-2.6.32.49/arch/x86/kernel/efi_stub_32.S 2011-11-08 19:02:43.000000000 -0500
13547 +++ linux-2.6.32.49/arch/x86/kernel/efi_stub_32.S 2011-11-15 19:59:43.000000000 -0500
13548 @@ -6,7 +6,9 @@
13549 */
13550
13551 #include <linux/linkage.h>
13552 +#include <linux/init.h>
13553 #include <asm/page_types.h>
13554 +#include <asm/segment.h>
13555
13556 /*
13557 * efi_call_phys(void *, ...) is a function with variable parameters.
13558 @@ -20,7 +22,7 @@
13559 * service functions will comply with gcc calling convention, too.
13560 */
13561
13562 -.text
13563 +__INIT
13564 ENTRY(efi_call_phys)
13565 /*
13566 * 0. The function can only be called in Linux kernel. So CS has been
13567 @@ -36,9 +38,11 @@ ENTRY(efi_call_phys)
13568 * The mapping of lower virtual memory has been created in prelog and
13569 * epilog.
13570 */
13571 - movl $1f, %edx
13572 - subl $__PAGE_OFFSET, %edx
13573 - jmp *%edx
13574 + movl $(__KERNEXEC_EFI_DS), %edx
13575 + mov %edx, %ds
13576 + mov %edx, %es
13577 + mov %edx, %ss
13578 + ljmp $(__KERNEXEC_EFI_CS),$1f-__PAGE_OFFSET
13579 1:
13580
13581 /*
13582 @@ -47,14 +51,8 @@ ENTRY(efi_call_phys)
13583 * parameter 2, ..., param n. To make things easy, we save the return
13584 * address of efi_call_phys in a global variable.
13585 */
13586 - popl %edx
13587 - movl %edx, saved_return_addr
13588 - /* get the function pointer into ECX*/
13589 - popl %ecx
13590 - movl %ecx, efi_rt_function_ptr
13591 - movl $2f, %edx
13592 - subl $__PAGE_OFFSET, %edx
13593 - pushl %edx
13594 + popl (saved_return_addr)
13595 + popl (efi_rt_function_ptr)
13596
13597 /*
13598 * 3. Clear PG bit in %CR0.
13599 @@ -73,9 +71,8 @@ ENTRY(efi_call_phys)
13600 /*
13601 * 5. Call the physical function.
13602 */
13603 - jmp *%ecx
13604 + call *(efi_rt_function_ptr-__PAGE_OFFSET)
13605
13606 -2:
13607 /*
13608 * 6. After EFI runtime service returns, control will return to
13609 * following instruction. We'd better readjust stack pointer first.
13610 @@ -88,35 +85,32 @@ ENTRY(efi_call_phys)
13611 movl %cr0, %edx
13612 orl $0x80000000, %edx
13613 movl %edx, %cr0
13614 - jmp 1f
13615 -1:
13616 +
13617 /*
13618 * 8. Now restore the virtual mode from flat mode by
13619 * adding EIP with PAGE_OFFSET.
13620 */
13621 - movl $1f, %edx
13622 - jmp *%edx
13623 + ljmp $(__KERNEL_CS),$1f+__PAGE_OFFSET
13624 1:
13625 + movl $(__KERNEL_DS), %edx
13626 + mov %edx, %ds
13627 + mov %edx, %es
13628 + mov %edx, %ss
13629
13630 /*
13631 * 9. Balance the stack. And because EAX contain the return value,
13632 * we'd better not clobber it.
13633 */
13634 - leal efi_rt_function_ptr, %edx
13635 - movl (%edx), %ecx
13636 - pushl %ecx
13637 + pushl (efi_rt_function_ptr)
13638
13639 /*
13640 - * 10. Push the saved return address onto the stack and return.
13641 + * 10. Return to the saved return address.
13642 */
13643 - leal saved_return_addr, %edx
13644 - movl (%edx), %ecx
13645 - pushl %ecx
13646 - ret
13647 + jmpl *(saved_return_addr)
13648 ENDPROC(efi_call_phys)
13649 .previous
13650
13651 -.data
13652 +__INITDATA
13653 saved_return_addr:
13654 .long 0
13655 efi_rt_function_ptr:
13656 diff -urNp linux-2.6.32.49/arch/x86/kernel/efi_stub_64.S linux-2.6.32.49/arch/x86/kernel/efi_stub_64.S
13657 --- linux-2.6.32.49/arch/x86/kernel/efi_stub_64.S 2011-11-08 19:02:43.000000000 -0500
13658 +++ linux-2.6.32.49/arch/x86/kernel/efi_stub_64.S 2011-11-15 19:59:43.000000000 -0500
13659 @@ -7,6 +7,7 @@
13660 */
13661
13662 #include <linux/linkage.h>
13663 +#include <asm/alternative-asm.h>
13664
13665 #define SAVE_XMM \
13666 mov %rsp, %rax; \
13667 @@ -40,6 +41,7 @@ ENTRY(efi_call0)
13668 call *%rdi
13669 addq $32, %rsp
13670 RESTORE_XMM
13671 + pax_force_retaddr
13672 ret
13673 ENDPROC(efi_call0)
13674
13675 @@ -50,6 +52,7 @@ ENTRY(efi_call1)
13676 call *%rdi
13677 addq $32, %rsp
13678 RESTORE_XMM
13679 + pax_force_retaddr
13680 ret
13681 ENDPROC(efi_call1)
13682
13683 @@ -60,6 +63,7 @@ ENTRY(efi_call2)
13684 call *%rdi
13685 addq $32, %rsp
13686 RESTORE_XMM
13687 + pax_force_retaddr
13688 ret
13689 ENDPROC(efi_call2)
13690
13691 @@ -71,6 +75,7 @@ ENTRY(efi_call3)
13692 call *%rdi
13693 addq $32, %rsp
13694 RESTORE_XMM
13695 + pax_force_retaddr
13696 ret
13697 ENDPROC(efi_call3)
13698
13699 @@ -83,6 +88,7 @@ ENTRY(efi_call4)
13700 call *%rdi
13701 addq $32, %rsp
13702 RESTORE_XMM
13703 + pax_force_retaddr
13704 ret
13705 ENDPROC(efi_call4)
13706
13707 @@ -96,6 +102,7 @@ ENTRY(efi_call5)
13708 call *%rdi
13709 addq $48, %rsp
13710 RESTORE_XMM
13711 + pax_force_retaddr
13712 ret
13713 ENDPROC(efi_call5)
13714
13715 @@ -112,5 +119,6 @@ ENTRY(efi_call6)
13716 call *%rdi
13717 addq $48, %rsp
13718 RESTORE_XMM
13719 + pax_force_retaddr
13720 ret
13721 ENDPROC(efi_call6)
13722 diff -urNp linux-2.6.32.49/arch/x86/kernel/entry_32.S linux-2.6.32.49/arch/x86/kernel/entry_32.S
13723 --- linux-2.6.32.49/arch/x86/kernel/entry_32.S 2011-11-08 19:02:43.000000000 -0500
13724 +++ linux-2.6.32.49/arch/x86/kernel/entry_32.S 2011-11-18 18:01:52.000000000 -0500
13725 @@ -185,13 +185,146 @@
13726 /*CFI_REL_OFFSET gs, PT_GS*/
13727 .endm
13728 .macro SET_KERNEL_GS reg
13729 +
13730 +#ifdef CONFIG_CC_STACKPROTECTOR
13731 movl $(__KERNEL_STACK_CANARY), \reg
13732 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
13733 + movl $(__USER_DS), \reg
13734 +#else
13735 + xorl \reg, \reg
13736 +#endif
13737 +
13738 movl \reg, %gs
13739 .endm
13740
13741 #endif /* CONFIG_X86_32_LAZY_GS */
13742
13743 -.macro SAVE_ALL
13744 +.macro pax_enter_kernel
13745 +#ifdef CONFIG_PAX_KERNEXEC
13746 + call pax_enter_kernel
13747 +#endif
13748 +.endm
13749 +
13750 +.macro pax_exit_kernel
13751 +#ifdef CONFIG_PAX_KERNEXEC
13752 + call pax_exit_kernel
13753 +#endif
13754 +.endm
13755 +
13756 +#ifdef CONFIG_PAX_KERNEXEC
13757 +ENTRY(pax_enter_kernel)
13758 +#ifdef CONFIG_PARAVIRT
13759 + pushl %eax
13760 + pushl %ecx
13761 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
13762 + mov %eax, %esi
13763 +#else
13764 + mov %cr0, %esi
13765 +#endif
13766 + bts $16, %esi
13767 + jnc 1f
13768 + mov %cs, %esi
13769 + cmp $__KERNEL_CS, %esi
13770 + jz 3f
13771 + ljmp $__KERNEL_CS, $3f
13772 +1: ljmp $__KERNEXEC_KERNEL_CS, $2f
13773 +2:
13774 +#ifdef CONFIG_PARAVIRT
13775 + mov %esi, %eax
13776 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
13777 +#else
13778 + mov %esi, %cr0
13779 +#endif
13780 +3:
13781 +#ifdef CONFIG_PARAVIRT
13782 + popl %ecx
13783 + popl %eax
13784 +#endif
13785 + ret
13786 +ENDPROC(pax_enter_kernel)
13787 +
13788 +ENTRY(pax_exit_kernel)
13789 +#ifdef CONFIG_PARAVIRT
13790 + pushl %eax
13791 + pushl %ecx
13792 +#endif
13793 + mov %cs, %esi
13794 + cmp $__KERNEXEC_KERNEL_CS, %esi
13795 + jnz 2f
13796 +#ifdef CONFIG_PARAVIRT
13797 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
13798 + mov %eax, %esi
13799 +#else
13800 + mov %cr0, %esi
13801 +#endif
13802 + btr $16, %esi
13803 + ljmp $__KERNEL_CS, $1f
13804 +1:
13805 +#ifdef CONFIG_PARAVIRT
13806 + mov %esi, %eax
13807 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
13808 +#else
13809 + mov %esi, %cr0
13810 +#endif
13811 +2:
13812 +#ifdef CONFIG_PARAVIRT
13813 + popl %ecx
13814 + popl %eax
13815 +#endif
13816 + ret
13817 +ENDPROC(pax_exit_kernel)
13818 +#endif
13819 +
13820 +.macro pax_erase_kstack
13821 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13822 + call pax_erase_kstack
13823 +#endif
13824 +.endm
13825 +
13826 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13827 +/*
13828 + * ebp: thread_info
13829 + * ecx, edx: can be clobbered
13830 + */
13831 +ENTRY(pax_erase_kstack)
13832 + pushl %edi
13833 + pushl %eax
13834 +
13835 + mov TI_lowest_stack(%ebp), %edi
13836 + mov $-0xBEEF, %eax
13837 + std
13838 +
13839 +1: mov %edi, %ecx
13840 + and $THREAD_SIZE_asm - 1, %ecx
13841 + shr $2, %ecx
13842 + repne scasl
13843 + jecxz 2f
13844 +
13845 + cmp $2*16, %ecx
13846 + jc 2f
13847 +
13848 + mov $2*16, %ecx
13849 + repe scasl
13850 + jecxz 2f
13851 + jne 1b
13852 +
13853 +2: cld
13854 + mov %esp, %ecx
13855 + sub %edi, %ecx
13856 + shr $2, %ecx
13857 + rep stosl
13858 +
13859 + mov TI_task_thread_sp0(%ebp), %edi
13860 + sub $128, %edi
13861 + mov %edi, TI_lowest_stack(%ebp)
13862 +
13863 + popl %eax
13864 + popl %edi
13865 + ret
13866 +ENDPROC(pax_erase_kstack)
13867 +#endif
13868 +
13869 +.macro __SAVE_ALL _DS
13870 cld
13871 PUSH_GS
13872 pushl %fs
13873 @@ -224,7 +357,7 @@
13874 pushl %ebx
13875 CFI_ADJUST_CFA_OFFSET 4
13876 CFI_REL_OFFSET ebx, 0
13877 - movl $(__USER_DS), %edx
13878 + movl $\_DS, %edx
13879 movl %edx, %ds
13880 movl %edx, %es
13881 movl $(__KERNEL_PERCPU), %edx
13882 @@ -232,6 +365,15 @@
13883 SET_KERNEL_GS %edx
13884 .endm
13885
13886 +.macro SAVE_ALL
13887 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
13888 + __SAVE_ALL __KERNEL_DS
13889 + pax_enter_kernel
13890 +#else
13891 + __SAVE_ALL __USER_DS
13892 +#endif
13893 +.endm
13894 +
13895 .macro RESTORE_INT_REGS
13896 popl %ebx
13897 CFI_ADJUST_CFA_OFFSET -4
13898 @@ -331,7 +473,7 @@ ENTRY(ret_from_fork)
13899 CFI_ADJUST_CFA_OFFSET -4
13900 jmp syscall_exit
13901 CFI_ENDPROC
13902 -END(ret_from_fork)
13903 +ENDPROC(ret_from_fork)
13904
13905 /*
13906 * Return to user mode is not as complex as all this looks,
13907 @@ -352,7 +494,15 @@ check_userspace:
13908 movb PT_CS(%esp), %al
13909 andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
13910 cmpl $USER_RPL, %eax
13911 +
13912 +#ifdef CONFIG_PAX_KERNEXEC
13913 + jae resume_userspace
13914 +
13915 + PAX_EXIT_KERNEL
13916 + jmp resume_kernel
13917 +#else
13918 jb resume_kernel # not returning to v8086 or userspace
13919 +#endif
13920
13921 ENTRY(resume_userspace)
13922 LOCKDEP_SYS_EXIT
13923 @@ -364,8 +514,8 @@ ENTRY(resume_userspace)
13924 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
13925 # int/exception return?
13926 jne work_pending
13927 - jmp restore_all
13928 -END(ret_from_exception)
13929 + jmp restore_all_pax
13930 +ENDPROC(ret_from_exception)
13931
13932 #ifdef CONFIG_PREEMPT
13933 ENTRY(resume_kernel)
13934 @@ -380,7 +530,7 @@ need_resched:
13935 jz restore_all
13936 call preempt_schedule_irq
13937 jmp need_resched
13938 -END(resume_kernel)
13939 +ENDPROC(resume_kernel)
13940 #endif
13941 CFI_ENDPROC
13942
13943 @@ -414,25 +564,36 @@ sysenter_past_esp:
13944 /*CFI_REL_OFFSET cs, 0*/
13945 /*
13946 * Push current_thread_info()->sysenter_return to the stack.
13947 - * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
13948 - * pushed above; +8 corresponds to copy_thread's esp0 setting.
13949 */
13950 - pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
13951 + pushl $0
13952 CFI_ADJUST_CFA_OFFSET 4
13953 CFI_REL_OFFSET eip, 0
13954
13955 pushl %eax
13956 CFI_ADJUST_CFA_OFFSET 4
13957 SAVE_ALL
13958 + GET_THREAD_INFO(%ebp)
13959 + movl TI_sysenter_return(%ebp),%ebp
13960 + movl %ebp,PT_EIP(%esp)
13961 ENABLE_INTERRUPTS(CLBR_NONE)
13962
13963 /*
13964 * Load the potential sixth argument from user stack.
13965 * Careful about security.
13966 */
13967 + movl PT_OLDESP(%esp),%ebp
13968 +
13969 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13970 + mov PT_OLDSS(%esp),%ds
13971 +1: movl %ds:(%ebp),%ebp
13972 + push %ss
13973 + pop %ds
13974 +#else
13975 cmpl $__PAGE_OFFSET-3,%ebp
13976 jae syscall_fault
13977 1: movl (%ebp),%ebp
13978 +#endif
13979 +
13980 movl %ebp,PT_EBP(%esp)
13981 .section __ex_table,"a"
13982 .align 4
13983 @@ -455,12 +616,24 @@ sysenter_do_call:
13984 testl $_TIF_ALLWORK_MASK, %ecx
13985 jne sysexit_audit
13986 sysenter_exit:
13987 +
13988 +#ifdef CONFIG_PAX_RANDKSTACK
13989 + pushl_cfi %eax
13990 + movl %esp, %eax
13991 + call pax_randomize_kstack
13992 + popl_cfi %eax
13993 +#endif
13994 +
13995 + pax_erase_kstack
13996 +
13997 /* if something modifies registers it must also disable sysexit */
13998 movl PT_EIP(%esp), %edx
13999 movl PT_OLDESP(%esp), %ecx
14000 xorl %ebp,%ebp
14001 TRACE_IRQS_ON
14002 1: mov PT_FS(%esp), %fs
14003 +2: mov PT_DS(%esp), %ds
14004 +3: mov PT_ES(%esp), %es
14005 PTGS_TO_GS
14006 ENABLE_INTERRUPTS_SYSEXIT
14007
14008 @@ -477,6 +650,9 @@ sysenter_audit:
14009 movl %eax,%edx /* 2nd arg: syscall number */
14010 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
14011 call audit_syscall_entry
14012 +
14013 + pax_erase_kstack
14014 +
14015 pushl %ebx
14016 CFI_ADJUST_CFA_OFFSET 4
14017 movl PT_EAX(%esp),%eax /* reload syscall number */
14018 @@ -504,11 +680,17 @@ sysexit_audit:
14019
14020 CFI_ENDPROC
14021 .pushsection .fixup,"ax"
14022 -2: movl $0,PT_FS(%esp)
14023 +4: movl $0,PT_FS(%esp)
14024 + jmp 1b
14025 +5: movl $0,PT_DS(%esp)
14026 + jmp 1b
14027 +6: movl $0,PT_ES(%esp)
14028 jmp 1b
14029 .section __ex_table,"a"
14030 .align 4
14031 - .long 1b,2b
14032 + .long 1b,4b
14033 + .long 2b,5b
14034 + .long 3b,6b
14035 .popsection
14036 PTGS_TO_GS_EX
14037 ENDPROC(ia32_sysenter_target)
14038 @@ -538,6 +720,15 @@ syscall_exit:
14039 testl $_TIF_ALLWORK_MASK, %ecx # current->work
14040 jne syscall_exit_work
14041
14042 +restore_all_pax:
14043 +
14044 +#ifdef CONFIG_PAX_RANDKSTACK
14045 + movl %esp, %eax
14046 + call pax_randomize_kstack
14047 +#endif
14048 +
14049 + pax_erase_kstack
14050 +
14051 restore_all:
14052 TRACE_IRQS_IRET
14053 restore_all_notrace:
14054 @@ -602,10 +793,29 @@ ldt_ss:
14055 mov PT_OLDESP(%esp), %eax /* load userspace esp */
14056 mov %dx, %ax /* eax: new kernel esp */
14057 sub %eax, %edx /* offset (low word is 0) */
14058 - PER_CPU(gdt_page, %ebx)
14059 +#ifdef CONFIG_SMP
14060 + movl PER_CPU_VAR(cpu_number), %ebx
14061 + shll $PAGE_SHIFT_asm, %ebx
14062 + addl $cpu_gdt_table, %ebx
14063 +#else
14064 + movl $cpu_gdt_table, %ebx
14065 +#endif
14066 shr $16, %edx
14067 +
14068 +#ifdef CONFIG_PAX_KERNEXEC
14069 + mov %cr0, %esi
14070 + btr $16, %esi
14071 + mov %esi, %cr0
14072 +#endif
14073 +
14074 mov %dl, GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx) /* bits 16..23 */
14075 mov %dh, GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx) /* bits 24..31 */
14076 +
14077 +#ifdef CONFIG_PAX_KERNEXEC
14078 + bts $16, %esi
14079 + mov %esi, %cr0
14080 +#endif
14081 +
14082 pushl $__ESPFIX_SS
14083 CFI_ADJUST_CFA_OFFSET 4
14084 push %eax /* new kernel esp */
14085 @@ -636,36 +846,30 @@ work_resched:
14086 movl TI_flags(%ebp), %ecx
14087 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
14088 # than syscall tracing?
14089 - jz restore_all
14090 + jz restore_all_pax
14091 testb $_TIF_NEED_RESCHED, %cl
14092 jnz work_resched
14093
14094 work_notifysig: # deal with pending signals and
14095 # notify-resume requests
14096 + movl %esp, %eax
14097 #ifdef CONFIG_VM86
14098 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
14099 - movl %esp, %eax
14100 - jne work_notifysig_v86 # returning to kernel-space or
14101 + jz 1f # returning to kernel-space or
14102 # vm86-space
14103 - xorl %edx, %edx
14104 - call do_notify_resume
14105 - jmp resume_userspace_sig
14106
14107 - ALIGN
14108 -work_notifysig_v86:
14109 pushl %ecx # save ti_flags for do_notify_resume
14110 CFI_ADJUST_CFA_OFFSET 4
14111 call save_v86_state # %eax contains pt_regs pointer
14112 popl %ecx
14113 CFI_ADJUST_CFA_OFFSET -4
14114 movl %eax, %esp
14115 -#else
14116 - movl %esp, %eax
14117 +1:
14118 #endif
14119 xorl %edx, %edx
14120 call do_notify_resume
14121 jmp resume_userspace_sig
14122 -END(work_pending)
14123 +ENDPROC(work_pending)
14124
14125 # perform syscall exit tracing
14126 ALIGN
14127 @@ -673,11 +877,14 @@ syscall_trace_entry:
14128 movl $-ENOSYS,PT_EAX(%esp)
14129 movl %esp, %eax
14130 call syscall_trace_enter
14131 +
14132 + pax_erase_kstack
14133 +
14134 /* What it returned is what we'll actually use. */
14135 cmpl $(nr_syscalls), %eax
14136 jnae syscall_call
14137 jmp syscall_exit
14138 -END(syscall_trace_entry)
14139 +ENDPROC(syscall_trace_entry)
14140
14141 # perform syscall exit tracing
14142 ALIGN
14143 @@ -690,20 +897,24 @@ syscall_exit_work:
14144 movl %esp, %eax
14145 call syscall_trace_leave
14146 jmp resume_userspace
14147 -END(syscall_exit_work)
14148 +ENDPROC(syscall_exit_work)
14149 CFI_ENDPROC
14150
14151 RING0_INT_FRAME # can't unwind into user space anyway
14152 syscall_fault:
14153 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14154 + push %ss
14155 + pop %ds
14156 +#endif
14157 GET_THREAD_INFO(%ebp)
14158 movl $-EFAULT,PT_EAX(%esp)
14159 jmp resume_userspace
14160 -END(syscall_fault)
14161 +ENDPROC(syscall_fault)
14162
14163 syscall_badsys:
14164 movl $-ENOSYS,PT_EAX(%esp)
14165 jmp resume_userspace
14166 -END(syscall_badsys)
14167 +ENDPROC(syscall_badsys)
14168 CFI_ENDPROC
14169
14170 /*
14171 @@ -726,6 +937,33 @@ PTREGSCALL(rt_sigreturn)
14172 PTREGSCALL(vm86)
14173 PTREGSCALL(vm86old)
14174
14175 + ALIGN;
14176 +ENTRY(kernel_execve)
14177 + push %ebp
14178 + sub $PT_OLDSS+4,%esp
14179 + push %edi
14180 + push %ecx
14181 + push %eax
14182 + lea 3*4(%esp),%edi
14183 + mov $PT_OLDSS/4+1,%ecx
14184 + xorl %eax,%eax
14185 + rep stosl
14186 + pop %eax
14187 + pop %ecx
14188 + pop %edi
14189 + movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
14190 + mov %eax,PT_EBX(%esp)
14191 + mov %edx,PT_ECX(%esp)
14192 + mov %ecx,PT_EDX(%esp)
14193 + mov %esp,%eax
14194 + call sys_execve
14195 + GET_THREAD_INFO(%ebp)
14196 + test %eax,%eax
14197 + jz syscall_exit
14198 + add $PT_OLDSS+4,%esp
14199 + pop %ebp
14200 + ret
14201 +
14202 .macro FIXUP_ESPFIX_STACK
14203 /*
14204 * Switch back for ESPFIX stack to the normal zerobased stack
14205 @@ -735,7 +973,13 @@ PTREGSCALL(vm86old)
14206 * normal stack and adjusts ESP with the matching offset.
14207 */
14208 /* fixup the stack */
14209 - PER_CPU(gdt_page, %ebx)
14210 +#ifdef CONFIG_SMP
14211 + movl PER_CPU_VAR(cpu_number), %ebx
14212 + shll $PAGE_SHIFT_asm, %ebx
14213 + addl $cpu_gdt_table, %ebx
14214 +#else
14215 + movl $cpu_gdt_table, %ebx
14216 +#endif
14217 mov GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx), %al /* bits 16..23 */
14218 mov GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx), %ah /* bits 24..31 */
14219 shl $16, %eax
14220 @@ -793,7 +1037,7 @@ vector=vector+1
14221 .endr
14222 2: jmp common_interrupt
14223 .endr
14224 -END(irq_entries_start)
14225 +ENDPROC(irq_entries_start)
14226
14227 .previous
14228 END(interrupt)
14229 @@ -840,7 +1084,7 @@ ENTRY(coprocessor_error)
14230 CFI_ADJUST_CFA_OFFSET 4
14231 jmp error_code
14232 CFI_ENDPROC
14233 -END(coprocessor_error)
14234 +ENDPROC(coprocessor_error)
14235
14236 ENTRY(simd_coprocessor_error)
14237 RING0_INT_FRAME
14238 @@ -850,7 +1094,7 @@ ENTRY(simd_coprocessor_error)
14239 CFI_ADJUST_CFA_OFFSET 4
14240 jmp error_code
14241 CFI_ENDPROC
14242 -END(simd_coprocessor_error)
14243 +ENDPROC(simd_coprocessor_error)
14244
14245 ENTRY(device_not_available)
14246 RING0_INT_FRAME
14247 @@ -860,7 +1104,7 @@ ENTRY(device_not_available)
14248 CFI_ADJUST_CFA_OFFSET 4
14249 jmp error_code
14250 CFI_ENDPROC
14251 -END(device_not_available)
14252 +ENDPROC(device_not_available)
14253
14254 #ifdef CONFIG_PARAVIRT
14255 ENTRY(native_iret)
14256 @@ -869,12 +1113,12 @@ ENTRY(native_iret)
14257 .align 4
14258 .long native_iret, iret_exc
14259 .previous
14260 -END(native_iret)
14261 +ENDPROC(native_iret)
14262
14263 ENTRY(native_irq_enable_sysexit)
14264 sti
14265 sysexit
14266 -END(native_irq_enable_sysexit)
14267 +ENDPROC(native_irq_enable_sysexit)
14268 #endif
14269
14270 ENTRY(overflow)
14271 @@ -885,7 +1129,7 @@ ENTRY(overflow)
14272 CFI_ADJUST_CFA_OFFSET 4
14273 jmp error_code
14274 CFI_ENDPROC
14275 -END(overflow)
14276 +ENDPROC(overflow)
14277
14278 ENTRY(bounds)
14279 RING0_INT_FRAME
14280 @@ -895,7 +1139,7 @@ ENTRY(bounds)
14281 CFI_ADJUST_CFA_OFFSET 4
14282 jmp error_code
14283 CFI_ENDPROC
14284 -END(bounds)
14285 +ENDPROC(bounds)
14286
14287 ENTRY(invalid_op)
14288 RING0_INT_FRAME
14289 @@ -905,7 +1149,7 @@ ENTRY(invalid_op)
14290 CFI_ADJUST_CFA_OFFSET 4
14291 jmp error_code
14292 CFI_ENDPROC
14293 -END(invalid_op)
14294 +ENDPROC(invalid_op)
14295
14296 ENTRY(coprocessor_segment_overrun)
14297 RING0_INT_FRAME
14298 @@ -915,7 +1159,7 @@ ENTRY(coprocessor_segment_overrun)
14299 CFI_ADJUST_CFA_OFFSET 4
14300 jmp error_code
14301 CFI_ENDPROC
14302 -END(coprocessor_segment_overrun)
14303 +ENDPROC(coprocessor_segment_overrun)
14304
14305 ENTRY(invalid_TSS)
14306 RING0_EC_FRAME
14307 @@ -923,7 +1167,7 @@ ENTRY(invalid_TSS)
14308 CFI_ADJUST_CFA_OFFSET 4
14309 jmp error_code
14310 CFI_ENDPROC
14311 -END(invalid_TSS)
14312 +ENDPROC(invalid_TSS)
14313
14314 ENTRY(segment_not_present)
14315 RING0_EC_FRAME
14316 @@ -931,7 +1175,7 @@ ENTRY(segment_not_present)
14317 CFI_ADJUST_CFA_OFFSET 4
14318 jmp error_code
14319 CFI_ENDPROC
14320 -END(segment_not_present)
14321 +ENDPROC(segment_not_present)
14322
14323 ENTRY(stack_segment)
14324 RING0_EC_FRAME
14325 @@ -939,7 +1183,7 @@ ENTRY(stack_segment)
14326 CFI_ADJUST_CFA_OFFSET 4
14327 jmp error_code
14328 CFI_ENDPROC
14329 -END(stack_segment)
14330 +ENDPROC(stack_segment)
14331
14332 ENTRY(alignment_check)
14333 RING0_EC_FRAME
14334 @@ -947,7 +1191,7 @@ ENTRY(alignment_check)
14335 CFI_ADJUST_CFA_OFFSET 4
14336 jmp error_code
14337 CFI_ENDPROC
14338 -END(alignment_check)
14339 +ENDPROC(alignment_check)
14340
14341 ENTRY(divide_error)
14342 RING0_INT_FRAME
14343 @@ -957,7 +1201,7 @@ ENTRY(divide_error)
14344 CFI_ADJUST_CFA_OFFSET 4
14345 jmp error_code
14346 CFI_ENDPROC
14347 -END(divide_error)
14348 +ENDPROC(divide_error)
14349
14350 #ifdef CONFIG_X86_MCE
14351 ENTRY(machine_check)
14352 @@ -968,7 +1212,7 @@ ENTRY(machine_check)
14353 CFI_ADJUST_CFA_OFFSET 4
14354 jmp error_code
14355 CFI_ENDPROC
14356 -END(machine_check)
14357 +ENDPROC(machine_check)
14358 #endif
14359
14360 ENTRY(spurious_interrupt_bug)
14361 @@ -979,7 +1223,7 @@ ENTRY(spurious_interrupt_bug)
14362 CFI_ADJUST_CFA_OFFSET 4
14363 jmp error_code
14364 CFI_ENDPROC
14365 -END(spurious_interrupt_bug)
14366 +ENDPROC(spurious_interrupt_bug)
14367
14368 ENTRY(kernel_thread_helper)
14369 pushl $0 # fake return address for unwinder
14370 @@ -1095,7 +1339,7 @@ ENDPROC(xen_failsafe_callback)
14371
14372 ENTRY(mcount)
14373 ret
14374 -END(mcount)
14375 +ENDPROC(mcount)
14376
14377 ENTRY(ftrace_caller)
14378 cmpl $0, function_trace_stop
14379 @@ -1124,7 +1368,7 @@ ftrace_graph_call:
14380 .globl ftrace_stub
14381 ftrace_stub:
14382 ret
14383 -END(ftrace_caller)
14384 +ENDPROC(ftrace_caller)
14385
14386 #else /* ! CONFIG_DYNAMIC_FTRACE */
14387
14388 @@ -1160,7 +1404,7 @@ trace:
14389 popl %ecx
14390 popl %eax
14391 jmp ftrace_stub
14392 -END(mcount)
14393 +ENDPROC(mcount)
14394 #endif /* CONFIG_DYNAMIC_FTRACE */
14395 #endif /* CONFIG_FUNCTION_TRACER */
14396
14397 @@ -1181,7 +1425,7 @@ ENTRY(ftrace_graph_caller)
14398 popl %ecx
14399 popl %eax
14400 ret
14401 -END(ftrace_graph_caller)
14402 +ENDPROC(ftrace_graph_caller)
14403
14404 .globl return_to_handler
14405 return_to_handler:
14406 @@ -1198,7 +1442,6 @@ return_to_handler:
14407 ret
14408 #endif
14409
14410 -.section .rodata,"a"
14411 #include "syscall_table_32.S"
14412
14413 syscall_table_size=(.-sys_call_table)
14414 @@ -1255,15 +1498,18 @@ error_code:
14415 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
14416 REG_TO_PTGS %ecx
14417 SET_KERNEL_GS %ecx
14418 - movl $(__USER_DS), %ecx
14419 + movl $(__KERNEL_DS), %ecx
14420 movl %ecx, %ds
14421 movl %ecx, %es
14422 +
14423 + pax_enter_kernel
14424 +
14425 TRACE_IRQS_OFF
14426 movl %esp,%eax # pt_regs pointer
14427 call *%edi
14428 jmp ret_from_exception
14429 CFI_ENDPROC
14430 -END(page_fault)
14431 +ENDPROC(page_fault)
14432
14433 /*
14434 * Debug traps and NMI can happen at the one SYSENTER instruction
14435 @@ -1309,7 +1555,7 @@ debug_stack_correct:
14436 call do_debug
14437 jmp ret_from_exception
14438 CFI_ENDPROC
14439 -END(debug)
14440 +ENDPROC(debug)
14441
14442 /*
14443 * NMI is doubly nasty. It can happen _while_ we're handling
14444 @@ -1351,6 +1597,9 @@ nmi_stack_correct:
14445 xorl %edx,%edx # zero error code
14446 movl %esp,%eax # pt_regs pointer
14447 call do_nmi
14448 +
14449 + pax_exit_kernel
14450 +
14451 jmp restore_all_notrace
14452 CFI_ENDPROC
14453
14454 @@ -1391,12 +1640,15 @@ nmi_espfix_stack:
14455 FIXUP_ESPFIX_STACK # %eax == %esp
14456 xorl %edx,%edx # zero error code
14457 call do_nmi
14458 +
14459 + pax_exit_kernel
14460 +
14461 RESTORE_REGS
14462 lss 12+4(%esp), %esp # back to espfix stack
14463 CFI_ADJUST_CFA_OFFSET -24
14464 jmp irq_return
14465 CFI_ENDPROC
14466 -END(nmi)
14467 +ENDPROC(nmi)
14468
14469 ENTRY(int3)
14470 RING0_INT_FRAME
14471 @@ -1409,7 +1661,7 @@ ENTRY(int3)
14472 call do_int3
14473 jmp ret_from_exception
14474 CFI_ENDPROC
14475 -END(int3)
14476 +ENDPROC(int3)
14477
14478 ENTRY(general_protection)
14479 RING0_EC_FRAME
14480 @@ -1417,7 +1669,7 @@ ENTRY(general_protection)
14481 CFI_ADJUST_CFA_OFFSET 4
14482 jmp error_code
14483 CFI_ENDPROC
14484 -END(general_protection)
14485 +ENDPROC(general_protection)
14486
14487 /*
14488 * End of kprobes section
14489 diff -urNp linux-2.6.32.49/arch/x86/kernel/entry_64.S linux-2.6.32.49/arch/x86/kernel/entry_64.S
14490 --- linux-2.6.32.49/arch/x86/kernel/entry_64.S 2011-11-08 19:02:43.000000000 -0500
14491 +++ linux-2.6.32.49/arch/x86/kernel/entry_64.S 2011-11-18 18:01:52.000000000 -0500
14492 @@ -53,6 +53,8 @@
14493 #include <asm/paravirt.h>
14494 #include <asm/ftrace.h>
14495 #include <asm/percpu.h>
14496 +#include <asm/pgtable.h>
14497 +#include <asm/alternative-asm.h>
14498
14499 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
14500 #include <linux/elf-em.h>
14501 @@ -64,8 +66,9 @@
14502 #ifdef CONFIG_FUNCTION_TRACER
14503 #ifdef CONFIG_DYNAMIC_FTRACE
14504 ENTRY(mcount)
14505 + pax_force_retaddr
14506 retq
14507 -END(mcount)
14508 +ENDPROC(mcount)
14509
14510 ENTRY(ftrace_caller)
14511 cmpl $0, function_trace_stop
14512 @@ -88,8 +91,9 @@ GLOBAL(ftrace_graph_call)
14513 #endif
14514
14515 GLOBAL(ftrace_stub)
14516 + pax_force_retaddr
14517 retq
14518 -END(ftrace_caller)
14519 +ENDPROC(ftrace_caller)
14520
14521 #else /* ! CONFIG_DYNAMIC_FTRACE */
14522 ENTRY(mcount)
14523 @@ -108,6 +112,7 @@ ENTRY(mcount)
14524 #endif
14525
14526 GLOBAL(ftrace_stub)
14527 + pax_force_retaddr
14528 retq
14529
14530 trace:
14531 @@ -117,12 +122,13 @@ trace:
14532 movq 8(%rbp), %rsi
14533 subq $MCOUNT_INSN_SIZE, %rdi
14534
14535 + pax_force_fptr ftrace_trace_function
14536 call *ftrace_trace_function
14537
14538 MCOUNT_RESTORE_FRAME
14539
14540 jmp ftrace_stub
14541 -END(mcount)
14542 +ENDPROC(mcount)
14543 #endif /* CONFIG_DYNAMIC_FTRACE */
14544 #endif /* CONFIG_FUNCTION_TRACER */
14545
14546 @@ -142,8 +148,9 @@ ENTRY(ftrace_graph_caller)
14547
14548 MCOUNT_RESTORE_FRAME
14549
14550 + pax_force_retaddr
14551 retq
14552 -END(ftrace_graph_caller)
14553 +ENDPROC(ftrace_graph_caller)
14554
14555 GLOBAL(return_to_handler)
14556 subq $24, %rsp
14557 @@ -159,6 +166,7 @@ GLOBAL(return_to_handler)
14558 movq 8(%rsp), %rdx
14559 movq (%rsp), %rax
14560 addq $16, %rsp
14561 + pax_force_retaddr
14562 retq
14563 #endif
14564
14565 @@ -174,6 +182,269 @@ ENTRY(native_usergs_sysret64)
14566 ENDPROC(native_usergs_sysret64)
14567 #endif /* CONFIG_PARAVIRT */
14568
14569 + .macro ljmpq sel, off
14570 +#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
14571 + .byte 0x48; ljmp *1234f(%rip)
14572 + .pushsection .rodata
14573 + .align 16
14574 + 1234: .quad \off; .word \sel
14575 + .popsection
14576 +#else
14577 + pushq $\sel
14578 + pushq $\off
14579 + lretq
14580 +#endif
14581 + .endm
14582 +
14583 + .macro pax_enter_kernel
14584 +#ifdef CONFIG_PAX_KERNEXEC
14585 + call pax_enter_kernel
14586 +#endif
14587 + .endm
14588 +
14589 + .macro pax_exit_kernel
14590 +#ifdef CONFIG_PAX_KERNEXEC
14591 + call pax_exit_kernel
14592 +#endif
14593 + .endm
14594 +
14595 +#ifdef CONFIG_PAX_KERNEXEC
14596 +ENTRY(pax_enter_kernel)
14597 + pushq %rdi
14598 +
14599 +#ifdef CONFIG_PARAVIRT
14600 + PV_SAVE_REGS(CLBR_RDI)
14601 +#endif
14602 +
14603 + GET_CR0_INTO_RDI
14604 + bts $16,%rdi
14605 + jnc 1f
14606 + mov %cs,%edi
14607 + cmp $__KERNEL_CS,%edi
14608 + jz 3f
14609 + ljmpq __KERNEL_CS,3f
14610 +1: ljmpq __KERNEXEC_KERNEL_CS,2f
14611 +2: SET_RDI_INTO_CR0
14612 +3:
14613 +
14614 +#ifdef CONFIG_PARAVIRT
14615 + PV_RESTORE_REGS(CLBR_RDI)
14616 +#endif
14617 +
14618 + popq %rdi
14619 + pax_force_retaddr
14620 + retq
14621 +ENDPROC(pax_enter_kernel)
14622 +
14623 +ENTRY(pax_exit_kernel)
14624 + pushq %rdi
14625 +
14626 +#ifdef CONFIG_PARAVIRT
14627 + PV_SAVE_REGS(CLBR_RDI)
14628 +#endif
14629 +
14630 + mov %cs,%rdi
14631 + cmp $__KERNEXEC_KERNEL_CS,%edi
14632 + jnz 2f
14633 + GET_CR0_INTO_RDI
14634 + btr $16,%rdi
14635 + ljmpq __KERNEL_CS,1f
14636 +1: SET_RDI_INTO_CR0
14637 +2:
14638 +
14639 +#ifdef CONFIG_PARAVIRT
14640 + PV_RESTORE_REGS(CLBR_RDI);
14641 +#endif
14642 +
14643 + popq %rdi
14644 + pax_force_retaddr
14645 + retq
14646 +ENDPROC(pax_exit_kernel)
14647 +#endif
14648 +
14649 + .macro pax_enter_kernel_user
14650 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14651 + call pax_enter_kernel_user
14652 +#endif
14653 + .endm
14654 +
14655 + .macro pax_exit_kernel_user
14656 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14657 + call pax_exit_kernel_user
14658 +#endif
14659 +#ifdef CONFIG_PAX_RANDKSTACK
14660 + push %rax
14661 + call pax_randomize_kstack
14662 + pop %rax
14663 +#endif
14664 + .endm
14665 +
14666 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14667 +ENTRY(pax_enter_kernel_user)
14668 + pushq %rdi
14669 + pushq %rbx
14670 +
14671 +#ifdef CONFIG_PARAVIRT
14672 + PV_SAVE_REGS(CLBR_RDI)
14673 +#endif
14674 +
14675 + GET_CR3_INTO_RDI
14676 + mov %rdi,%rbx
14677 + add $__START_KERNEL_map,%rbx
14678 + sub phys_base(%rip),%rbx
14679 +
14680 +#ifdef CONFIG_PARAVIRT
14681 + pushq %rdi
14682 + cmpl $0, pv_info+PARAVIRT_enabled
14683 + jz 1f
14684 + i = 0
14685 + .rept USER_PGD_PTRS
14686 + mov i*8(%rbx),%rsi
14687 + mov $0,%sil
14688 + lea i*8(%rbx),%rdi
14689 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
14690 + i = i + 1
14691 + .endr
14692 + jmp 2f
14693 +1:
14694 +#endif
14695 +
14696 + i = 0
14697 + .rept USER_PGD_PTRS
14698 + movb $0,i*8(%rbx)
14699 + i = i + 1
14700 + .endr
14701 +
14702 +#ifdef CONFIG_PARAVIRT
14703 +2: popq %rdi
14704 +#endif
14705 + SET_RDI_INTO_CR3
14706 +
14707 +#ifdef CONFIG_PAX_KERNEXEC
14708 + GET_CR0_INTO_RDI
14709 + bts $16,%rdi
14710 + SET_RDI_INTO_CR0
14711 +#endif
14712 +
14713 +#ifdef CONFIG_PARAVIRT
14714 + PV_RESTORE_REGS(CLBR_RDI)
14715 +#endif
14716 +
14717 + popq %rbx
14718 + popq %rdi
14719 + pax_force_retaddr
14720 + retq
14721 +ENDPROC(pax_enter_kernel_user)
14722 +
14723 +ENTRY(pax_exit_kernel_user)
14724 + push %rdi
14725 +
14726 +#ifdef CONFIG_PARAVIRT
14727 + pushq %rbx
14728 + PV_SAVE_REGS(CLBR_RDI)
14729 +#endif
14730 +
14731 +#ifdef CONFIG_PAX_KERNEXEC
14732 + GET_CR0_INTO_RDI
14733 + btr $16,%rdi
14734 + SET_RDI_INTO_CR0
14735 +#endif
14736 +
14737 + GET_CR3_INTO_RDI
14738 + add $__START_KERNEL_map,%rdi
14739 + sub phys_base(%rip),%rdi
14740 +
14741 +#ifdef CONFIG_PARAVIRT
14742 + cmpl $0, pv_info+PARAVIRT_enabled
14743 + jz 1f
14744 + mov %rdi,%rbx
14745 + i = 0
14746 + .rept USER_PGD_PTRS
14747 + mov i*8(%rbx),%rsi
14748 + mov $0x67,%sil
14749 + lea i*8(%rbx),%rdi
14750 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
14751 + i = i + 1
14752 + .endr
14753 + jmp 2f
14754 +1:
14755 +#endif
14756 +
14757 + i = 0
14758 + .rept USER_PGD_PTRS
14759 + movb $0x67,i*8(%rdi)
14760 + i = i + 1
14761 + .endr
14762 +
14763 +#ifdef CONFIG_PARAVIRT
14764 +2: PV_RESTORE_REGS(CLBR_RDI)
14765 + popq %rbx
14766 +#endif
14767 +
14768 + popq %rdi
14769 + pax_force_retaddr
14770 + retq
14771 +ENDPROC(pax_exit_kernel_user)
14772 +#endif
14773 +
14774 +.macro pax_erase_kstack
14775 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14776 + call pax_erase_kstack
14777 +#endif
14778 +.endm
14779 +
14780 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14781 +/*
14782 + * r10: thread_info
14783 + * rcx, rdx: can be clobbered
14784 + */
14785 +ENTRY(pax_erase_kstack)
14786 + pushq %rdi
14787 + pushq %rax
14788 + pushq %r10
14789 +
14790 + GET_THREAD_INFO(%r10)
14791 + mov TI_lowest_stack(%r10), %rdi
14792 + mov $-0xBEEF, %rax
14793 + std
14794 +
14795 +1: mov %edi, %ecx
14796 + and $THREAD_SIZE_asm - 1, %ecx
14797 + shr $3, %ecx
14798 + repne scasq
14799 + jecxz 2f
14800 +
14801 + cmp $2*8, %ecx
14802 + jc 2f
14803 +
14804 + mov $2*8, %ecx
14805 + repe scasq
14806 + jecxz 2f
14807 + jne 1b
14808 +
14809 +2: cld
14810 + mov %esp, %ecx
14811 + sub %edi, %ecx
14812 +
14813 + cmp $THREAD_SIZE_asm, %rcx
14814 + jb 3f
14815 + ud2
14816 +3:
14817 +
14818 + shr $3, %ecx
14819 + rep stosq
14820 +
14821 + mov TI_task_thread_sp0(%r10), %rdi
14822 + sub $256, %rdi
14823 + mov %rdi, TI_lowest_stack(%r10)
14824 +
14825 + popq %r10
14826 + popq %rax
14827 + popq %rdi
14828 + pax_force_retaddr
14829 + ret
14830 +ENDPROC(pax_erase_kstack)
14831 +#endif
14832
14833 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
14834 #ifdef CONFIG_TRACE_IRQFLAGS
14835 @@ -317,7 +588,7 @@ ENTRY(save_args)
14836 leaq -ARGOFFSET+16(%rsp),%rdi /* arg1 for handler */
14837 movq_cfi rbp, 8 /* push %rbp */
14838 leaq 8(%rsp), %rbp /* mov %rsp, %ebp */
14839 - testl $3, CS(%rdi)
14840 + testb $3, CS(%rdi)
14841 je 1f
14842 SWAPGS
14843 /*
14844 @@ -337,9 +608,10 @@ ENTRY(save_args)
14845 * We entered an interrupt context - irqs are off:
14846 */
14847 2: TRACE_IRQS_OFF
14848 + pax_force_retaddr
14849 ret
14850 CFI_ENDPROC
14851 -END(save_args)
14852 +ENDPROC(save_args)
14853
14854 ENTRY(save_rest)
14855 PARTIAL_FRAME 1 REST_SKIP+8
14856 @@ -352,9 +624,10 @@ ENTRY(save_rest)
14857 movq_cfi r15, R15+16
14858 movq %r11, 8(%rsp) /* return address */
14859 FIXUP_TOP_OF_STACK %r11, 16
14860 + pax_force_retaddr
14861 ret
14862 CFI_ENDPROC
14863 -END(save_rest)
14864 +ENDPROC(save_rest)
14865
14866 /* save complete stack frame */
14867 .pushsection .kprobes.text, "ax"
14868 @@ -383,9 +656,10 @@ ENTRY(save_paranoid)
14869 js 1f /* negative -> in kernel */
14870 SWAPGS
14871 xorl %ebx,%ebx
14872 -1: ret
14873 +1: pax_force_retaddr
14874 + ret
14875 CFI_ENDPROC
14876 -END(save_paranoid)
14877 +ENDPROC(save_paranoid)
14878 .popsection
14879
14880 /*
14881 @@ -409,7 +683,7 @@ ENTRY(ret_from_fork)
14882
14883 RESTORE_REST
14884
14885 - testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14886 + testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14887 je int_ret_from_sys_call
14888
14889 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
14890 @@ -419,7 +693,7 @@ ENTRY(ret_from_fork)
14891 jmp ret_from_sys_call # go to the SYSRET fastpath
14892
14893 CFI_ENDPROC
14894 -END(ret_from_fork)
14895 +ENDPROC(ret_from_fork)
14896
14897 /*
14898 * System call entry. Upto 6 arguments in registers are supported.
14899 @@ -455,7 +729,7 @@ END(ret_from_fork)
14900 ENTRY(system_call)
14901 CFI_STARTPROC simple
14902 CFI_SIGNAL_FRAME
14903 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
14904 + CFI_DEF_CFA rsp,0
14905 CFI_REGISTER rip,rcx
14906 /*CFI_REGISTER rflags,r11*/
14907 SWAPGS_UNSAFE_STACK
14908 @@ -468,12 +742,13 @@ ENTRY(system_call_after_swapgs)
14909
14910 movq %rsp,PER_CPU_VAR(old_rsp)
14911 movq PER_CPU_VAR(kernel_stack),%rsp
14912 + pax_enter_kernel_user
14913 /*
14914 * No need to follow this irqs off/on section - it's straight
14915 * and short:
14916 */
14917 ENABLE_INTERRUPTS(CLBR_NONE)
14918 - SAVE_ARGS 8,1
14919 + SAVE_ARGS 8*6,1
14920 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
14921 movq %rcx,RIP-ARGOFFSET(%rsp)
14922 CFI_REL_OFFSET rip,RIP-ARGOFFSET
14923 @@ -502,6 +777,8 @@ sysret_check:
14924 andl %edi,%edx
14925 jnz sysret_careful
14926 CFI_REMEMBER_STATE
14927 + pax_exit_kernel_user
14928 + pax_erase_kstack
14929 /*
14930 * sysretq will re-enable interrupts:
14931 */
14932 @@ -562,6 +839,9 @@ auditsys:
14933 movq %rax,%rsi /* 2nd arg: syscall number */
14934 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
14935 call audit_syscall_entry
14936 +
14937 + pax_erase_kstack
14938 +
14939 LOAD_ARGS 0 /* reload call-clobbered registers */
14940 jmp system_call_fastpath
14941
14942 @@ -592,6 +872,9 @@ tracesys:
14943 FIXUP_TOP_OF_STACK %rdi
14944 movq %rsp,%rdi
14945 call syscall_trace_enter
14946 +
14947 + pax_erase_kstack
14948 +
14949 /*
14950 * Reload arg registers from stack in case ptrace changed them.
14951 * We don't reload %rax because syscall_trace_enter() returned
14952 @@ -613,7 +896,7 @@ tracesys:
14953 GLOBAL(int_ret_from_sys_call)
14954 DISABLE_INTERRUPTS(CLBR_NONE)
14955 TRACE_IRQS_OFF
14956 - testl $3,CS-ARGOFFSET(%rsp)
14957 + testb $3,CS-ARGOFFSET(%rsp)
14958 je retint_restore_args
14959 movl $_TIF_ALLWORK_MASK,%edi
14960 /* edi: mask to check */
14961 @@ -674,7 +957,7 @@ int_restore_rest:
14962 TRACE_IRQS_OFF
14963 jmp int_with_check
14964 CFI_ENDPROC
14965 -END(system_call)
14966 +ENDPROC(system_call)
14967
14968 /*
14969 * Certain special system calls that need to save a complete full stack frame.
14970 @@ -690,7 +973,7 @@ ENTRY(\label)
14971 call \func
14972 jmp ptregscall_common
14973 CFI_ENDPROC
14974 -END(\label)
14975 +ENDPROC(\label)
14976 .endm
14977
14978 PTREGSCALL stub_clone, sys_clone, %r8
14979 @@ -708,9 +991,10 @@ ENTRY(ptregscall_common)
14980 movq_cfi_restore R12+8, r12
14981 movq_cfi_restore RBP+8, rbp
14982 movq_cfi_restore RBX+8, rbx
14983 + pax_force_retaddr
14984 ret $REST_SKIP /* pop extended registers */
14985 CFI_ENDPROC
14986 -END(ptregscall_common)
14987 +ENDPROC(ptregscall_common)
14988
14989 ENTRY(stub_execve)
14990 CFI_STARTPROC
14991 @@ -726,7 +1010,7 @@ ENTRY(stub_execve)
14992 RESTORE_REST
14993 jmp int_ret_from_sys_call
14994 CFI_ENDPROC
14995 -END(stub_execve)
14996 +ENDPROC(stub_execve)
14997
14998 /*
14999 * sigreturn is special because it needs to restore all registers on return.
15000 @@ -744,7 +1028,7 @@ ENTRY(stub_rt_sigreturn)
15001 RESTORE_REST
15002 jmp int_ret_from_sys_call
15003 CFI_ENDPROC
15004 -END(stub_rt_sigreturn)
15005 +ENDPROC(stub_rt_sigreturn)
15006
15007 /*
15008 * Build the entry stubs and pointer table with some assembler magic.
15009 @@ -780,7 +1064,7 @@ vector=vector+1
15010 2: jmp common_interrupt
15011 .endr
15012 CFI_ENDPROC
15013 -END(irq_entries_start)
15014 +ENDPROC(irq_entries_start)
15015
15016 .previous
15017 END(interrupt)
15018 @@ -800,6 +1084,16 @@ END(interrupt)
15019 CFI_ADJUST_CFA_OFFSET 10*8
15020 call save_args
15021 PARTIAL_FRAME 0
15022 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15023 + testb $3, CS(%rdi)
15024 + jnz 1f
15025 + pax_enter_kernel
15026 + jmp 2f
15027 +1: pax_enter_kernel_user
15028 +2:
15029 +#else
15030 + pax_enter_kernel
15031 +#endif
15032 call \func
15033 .endm
15034
15035 @@ -822,7 +1116,7 @@ ret_from_intr:
15036 CFI_ADJUST_CFA_OFFSET -8
15037 exit_intr:
15038 GET_THREAD_INFO(%rcx)
15039 - testl $3,CS-ARGOFFSET(%rsp)
15040 + testb $3,CS-ARGOFFSET(%rsp)
15041 je retint_kernel
15042
15043 /* Interrupt came from user space */
15044 @@ -844,12 +1138,16 @@ retint_swapgs: /* return to user-space
15045 * The iretq could re-enable interrupts:
15046 */
15047 DISABLE_INTERRUPTS(CLBR_ANY)
15048 + pax_exit_kernel_user
15049 + pax_erase_kstack
15050 TRACE_IRQS_IRETQ
15051 SWAPGS
15052 jmp restore_args
15053
15054 retint_restore_args: /* return to kernel space */
15055 DISABLE_INTERRUPTS(CLBR_ANY)
15056 + pax_exit_kernel
15057 + pax_force_retaddr RIP-ARGOFFSET
15058 /*
15059 * The iretq could re-enable interrupts:
15060 */
15061 @@ -940,7 +1238,7 @@ ENTRY(retint_kernel)
15062 #endif
15063
15064 CFI_ENDPROC
15065 -END(common_interrupt)
15066 +ENDPROC(common_interrupt)
15067
15068 /*
15069 * APIC interrupts.
15070 @@ -953,7 +1251,7 @@ ENTRY(\sym)
15071 interrupt \do_sym
15072 jmp ret_from_intr
15073 CFI_ENDPROC
15074 -END(\sym)
15075 +ENDPROC(\sym)
15076 .endm
15077
15078 #ifdef CONFIG_SMP
15079 @@ -1032,12 +1330,22 @@ ENTRY(\sym)
15080 CFI_ADJUST_CFA_OFFSET 15*8
15081 call error_entry
15082 DEFAULT_FRAME 0
15083 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15084 + testb $3, CS(%rsp)
15085 + jnz 1f
15086 + pax_enter_kernel
15087 + jmp 2f
15088 +1: pax_enter_kernel_user
15089 +2:
15090 +#else
15091 + pax_enter_kernel
15092 +#endif
15093 movq %rsp,%rdi /* pt_regs pointer */
15094 xorl %esi,%esi /* no error code */
15095 call \do_sym
15096 jmp error_exit /* %ebx: no swapgs flag */
15097 CFI_ENDPROC
15098 -END(\sym)
15099 +ENDPROC(\sym)
15100 .endm
15101
15102 .macro paranoidzeroentry sym do_sym
15103 @@ -1049,12 +1357,22 @@ ENTRY(\sym)
15104 subq $15*8, %rsp
15105 call save_paranoid
15106 TRACE_IRQS_OFF
15107 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15108 + testb $3, CS(%rsp)
15109 + jnz 1f
15110 + pax_enter_kernel
15111 + jmp 2f
15112 +1: pax_enter_kernel_user
15113 +2:
15114 +#else
15115 + pax_enter_kernel
15116 +#endif
15117 movq %rsp,%rdi /* pt_regs pointer */
15118 xorl %esi,%esi /* no error code */
15119 call \do_sym
15120 jmp paranoid_exit /* %ebx: no swapgs flag */
15121 CFI_ENDPROC
15122 -END(\sym)
15123 +ENDPROC(\sym)
15124 .endm
15125
15126 .macro paranoidzeroentry_ist sym do_sym ist
15127 @@ -1066,15 +1384,30 @@ ENTRY(\sym)
15128 subq $15*8, %rsp
15129 call save_paranoid
15130 TRACE_IRQS_OFF
15131 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15132 + testb $3, CS(%rsp)
15133 + jnz 1f
15134 + pax_enter_kernel
15135 + jmp 2f
15136 +1: pax_enter_kernel_user
15137 +2:
15138 +#else
15139 + pax_enter_kernel
15140 +#endif
15141 movq %rsp,%rdi /* pt_regs pointer */
15142 xorl %esi,%esi /* no error code */
15143 - PER_CPU(init_tss, %rbp)
15144 +#ifdef CONFIG_SMP
15145 + imul $TSS_size, PER_CPU_VAR(cpu_number), %ebp
15146 + lea init_tss(%rbp), %rbp
15147 +#else
15148 + lea init_tss(%rip), %rbp
15149 +#endif
15150 subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
15151 call \do_sym
15152 addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
15153 jmp paranoid_exit /* %ebx: no swapgs flag */
15154 CFI_ENDPROC
15155 -END(\sym)
15156 +ENDPROC(\sym)
15157 .endm
15158
15159 .macro errorentry sym do_sym
15160 @@ -1085,13 +1418,23 @@ ENTRY(\sym)
15161 CFI_ADJUST_CFA_OFFSET 15*8
15162 call error_entry
15163 DEFAULT_FRAME 0
15164 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15165 + testb $3, CS(%rsp)
15166 + jnz 1f
15167 + pax_enter_kernel
15168 + jmp 2f
15169 +1: pax_enter_kernel_user
15170 +2:
15171 +#else
15172 + pax_enter_kernel
15173 +#endif
15174 movq %rsp,%rdi /* pt_regs pointer */
15175 movq ORIG_RAX(%rsp),%rsi /* get error code */
15176 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
15177 call \do_sym
15178 jmp error_exit /* %ebx: no swapgs flag */
15179 CFI_ENDPROC
15180 -END(\sym)
15181 +ENDPROC(\sym)
15182 .endm
15183
15184 /* error code is on the stack already */
15185 @@ -1104,13 +1447,23 @@ ENTRY(\sym)
15186 call save_paranoid
15187 DEFAULT_FRAME 0
15188 TRACE_IRQS_OFF
15189 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15190 + testb $3, CS(%rsp)
15191 + jnz 1f
15192 + pax_enter_kernel
15193 + jmp 2f
15194 +1: pax_enter_kernel_user
15195 +2:
15196 +#else
15197 + pax_enter_kernel
15198 +#endif
15199 movq %rsp,%rdi /* pt_regs pointer */
15200 movq ORIG_RAX(%rsp),%rsi /* get error code */
15201 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
15202 call \do_sym
15203 jmp paranoid_exit /* %ebx: no swapgs flag */
15204 CFI_ENDPROC
15205 -END(\sym)
15206 +ENDPROC(\sym)
15207 .endm
15208
15209 zeroentry divide_error do_divide_error
15210 @@ -1141,9 +1494,10 @@ gs_change:
15211 SWAPGS
15212 popf
15213 CFI_ADJUST_CFA_OFFSET -8
15214 + pax_force_retaddr
15215 ret
15216 CFI_ENDPROC
15217 -END(native_load_gs_index)
15218 +ENDPROC(native_load_gs_index)
15219
15220 .section __ex_table,"a"
15221 .align 8
15222 @@ -1195,9 +1549,10 @@ ENTRY(kernel_thread)
15223 */
15224 RESTORE_ALL
15225 UNFAKE_STACK_FRAME
15226 + pax_force_retaddr
15227 ret
15228 CFI_ENDPROC
15229 -END(kernel_thread)
15230 +ENDPROC(kernel_thread)
15231
15232 ENTRY(child_rip)
15233 pushq $0 # fake return address
15234 @@ -1208,13 +1563,14 @@ ENTRY(child_rip)
15235 */
15236 movq %rdi, %rax
15237 movq %rsi, %rdi
15238 + pax_force_fptr %rax
15239 call *%rax
15240 # exit
15241 mov %eax, %edi
15242 call do_exit
15243 ud2 # padding for call trace
15244 CFI_ENDPROC
15245 -END(child_rip)
15246 +ENDPROC(child_rip)
15247
15248 /*
15249 * execve(). This function needs to use IRET, not SYSRET, to set up all state properly.
15250 @@ -1243,9 +1599,10 @@ ENTRY(kernel_execve)
15251 je int_ret_from_sys_call
15252 RESTORE_ARGS
15253 UNFAKE_STACK_FRAME
15254 + pax_force_retaddr
15255 ret
15256 CFI_ENDPROC
15257 -END(kernel_execve)
15258 +ENDPROC(kernel_execve)
15259
15260 /* Call softirq on interrupt stack. Interrupts are off. */
15261 ENTRY(call_softirq)
15262 @@ -1263,9 +1620,10 @@ ENTRY(call_softirq)
15263 CFI_DEF_CFA_REGISTER rsp
15264 CFI_ADJUST_CFA_OFFSET -8
15265 decl PER_CPU_VAR(irq_count)
15266 + pax_force_retaddr
15267 ret
15268 CFI_ENDPROC
15269 -END(call_softirq)
15270 +ENDPROC(call_softirq)
15271
15272 #ifdef CONFIG_XEN
15273 zeroentry xen_hypervisor_callback xen_do_hypervisor_callback
15274 @@ -1303,7 +1661,7 @@ ENTRY(xen_do_hypervisor_callback) # do
15275 decl PER_CPU_VAR(irq_count)
15276 jmp error_exit
15277 CFI_ENDPROC
15278 -END(xen_do_hypervisor_callback)
15279 +ENDPROC(xen_do_hypervisor_callback)
15280
15281 /*
15282 * Hypervisor uses this for application faults while it executes.
15283 @@ -1362,7 +1720,7 @@ ENTRY(xen_failsafe_callback)
15284 SAVE_ALL
15285 jmp error_exit
15286 CFI_ENDPROC
15287 -END(xen_failsafe_callback)
15288 +ENDPROC(xen_failsafe_callback)
15289
15290 #endif /* CONFIG_XEN */
15291
15292 @@ -1405,16 +1763,31 @@ ENTRY(paranoid_exit)
15293 TRACE_IRQS_OFF
15294 testl %ebx,%ebx /* swapgs needed? */
15295 jnz paranoid_restore
15296 - testl $3,CS(%rsp)
15297 + testb $3,CS(%rsp)
15298 jnz paranoid_userspace
15299 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15300 + pax_exit_kernel
15301 + TRACE_IRQS_IRETQ 0
15302 + SWAPGS_UNSAFE_STACK
15303 + RESTORE_ALL 8
15304 + pax_force_retaddr
15305 + jmp irq_return
15306 +#endif
15307 paranoid_swapgs:
15308 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15309 + pax_exit_kernel_user
15310 +#else
15311 + pax_exit_kernel
15312 +#endif
15313 TRACE_IRQS_IRETQ 0
15314 SWAPGS_UNSAFE_STACK
15315 RESTORE_ALL 8
15316 jmp irq_return
15317 paranoid_restore:
15318 + pax_exit_kernel
15319 TRACE_IRQS_IRETQ 0
15320 RESTORE_ALL 8
15321 + pax_force_retaddr
15322 jmp irq_return
15323 paranoid_userspace:
15324 GET_THREAD_INFO(%rcx)
15325 @@ -1443,7 +1816,7 @@ paranoid_schedule:
15326 TRACE_IRQS_OFF
15327 jmp paranoid_userspace
15328 CFI_ENDPROC
15329 -END(paranoid_exit)
15330 +ENDPROC(paranoid_exit)
15331
15332 /*
15333 * Exception entry point. This expects an error code/orig_rax on the stack.
15334 @@ -1470,12 +1843,13 @@ ENTRY(error_entry)
15335 movq_cfi r14, R14+8
15336 movq_cfi r15, R15+8
15337 xorl %ebx,%ebx
15338 - testl $3,CS+8(%rsp)
15339 + testb $3,CS+8(%rsp)
15340 je error_kernelspace
15341 error_swapgs:
15342 SWAPGS
15343 error_sti:
15344 TRACE_IRQS_OFF
15345 + pax_force_retaddr
15346 ret
15347 CFI_ENDPROC
15348
15349 @@ -1497,7 +1871,7 @@ error_kernelspace:
15350 cmpq $gs_change,RIP+8(%rsp)
15351 je error_swapgs
15352 jmp error_sti
15353 -END(error_entry)
15354 +ENDPROC(error_entry)
15355
15356
15357 /* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */
15358 @@ -1517,7 +1891,7 @@ ENTRY(error_exit)
15359 jnz retint_careful
15360 jmp retint_swapgs
15361 CFI_ENDPROC
15362 -END(error_exit)
15363 +ENDPROC(error_exit)
15364
15365
15366 /* runs on exception stack */
15367 @@ -1529,6 +1903,16 @@ ENTRY(nmi)
15368 CFI_ADJUST_CFA_OFFSET 15*8
15369 call save_paranoid
15370 DEFAULT_FRAME 0
15371 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15372 + testb $3, CS(%rsp)
15373 + jnz 1f
15374 + pax_enter_kernel
15375 + jmp 2f
15376 +1: pax_enter_kernel_user
15377 +2:
15378 +#else
15379 + pax_enter_kernel
15380 +#endif
15381 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
15382 movq %rsp,%rdi
15383 movq $-1,%rsi
15384 @@ -1539,12 +1923,28 @@ ENTRY(nmi)
15385 DISABLE_INTERRUPTS(CLBR_NONE)
15386 testl %ebx,%ebx /* swapgs needed? */
15387 jnz nmi_restore
15388 - testl $3,CS(%rsp)
15389 + testb $3,CS(%rsp)
15390 jnz nmi_userspace
15391 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15392 + pax_exit_kernel
15393 + SWAPGS_UNSAFE_STACK
15394 + RESTORE_ALL 8
15395 + pax_force_retaddr
15396 + jmp irq_return
15397 +#endif
15398 nmi_swapgs:
15399 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15400 + pax_exit_kernel_user
15401 +#else
15402 + pax_exit_kernel
15403 +#endif
15404 SWAPGS_UNSAFE_STACK
15405 + RESTORE_ALL 8
15406 + jmp irq_return
15407 nmi_restore:
15408 + pax_exit_kernel
15409 RESTORE_ALL 8
15410 + pax_force_retaddr
15411 jmp irq_return
15412 nmi_userspace:
15413 GET_THREAD_INFO(%rcx)
15414 @@ -1573,14 +1973,14 @@ nmi_schedule:
15415 jmp paranoid_exit
15416 CFI_ENDPROC
15417 #endif
15418 -END(nmi)
15419 +ENDPROC(nmi)
15420
15421 ENTRY(ignore_sysret)
15422 CFI_STARTPROC
15423 mov $-ENOSYS,%eax
15424 sysret
15425 CFI_ENDPROC
15426 -END(ignore_sysret)
15427 +ENDPROC(ignore_sysret)
15428
15429 /*
15430 * End of kprobes section
15431 diff -urNp linux-2.6.32.49/arch/x86/kernel/ftrace.c linux-2.6.32.49/arch/x86/kernel/ftrace.c
15432 --- linux-2.6.32.49/arch/x86/kernel/ftrace.c 2011-11-08 19:02:43.000000000 -0500
15433 +++ linux-2.6.32.49/arch/x86/kernel/ftrace.c 2011-11-15 19:59:43.000000000 -0500
15434 @@ -103,7 +103,7 @@ static void *mod_code_ip; /* holds the
15435 static void *mod_code_newcode; /* holds the text to write to the IP */
15436
15437 static unsigned nmi_wait_count;
15438 -static atomic_t nmi_update_count = ATOMIC_INIT(0);
15439 +static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
15440
15441 int ftrace_arch_read_dyn_info(char *buf, int size)
15442 {
15443 @@ -111,7 +111,7 @@ int ftrace_arch_read_dyn_info(char *buf,
15444
15445 r = snprintf(buf, size, "%u %u",
15446 nmi_wait_count,
15447 - atomic_read(&nmi_update_count));
15448 + atomic_read_unchecked(&nmi_update_count));
15449 return r;
15450 }
15451
15452 @@ -149,8 +149,10 @@ void ftrace_nmi_enter(void)
15453 {
15454 if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
15455 smp_rmb();
15456 + pax_open_kernel();
15457 ftrace_mod_code();
15458 - atomic_inc(&nmi_update_count);
15459 + pax_close_kernel();
15460 + atomic_inc_unchecked(&nmi_update_count);
15461 }
15462 /* Must have previous changes seen before executions */
15463 smp_mb();
15464 @@ -215,7 +217,7 @@ do_ftrace_mod_code(unsigned long ip, voi
15465
15466
15467
15468 -static unsigned char ftrace_nop[MCOUNT_INSN_SIZE];
15469 +static unsigned char ftrace_nop[MCOUNT_INSN_SIZE] __read_only;
15470
15471 static unsigned char *ftrace_nop_replace(void)
15472 {
15473 @@ -228,6 +230,8 @@ ftrace_modify_code(unsigned long ip, uns
15474 {
15475 unsigned char replaced[MCOUNT_INSN_SIZE];
15476
15477 + ip = ktla_ktva(ip);
15478 +
15479 /*
15480 * Note: Due to modules and __init, code can
15481 * disappear and change, we need to protect against faulting
15482 @@ -284,7 +288,7 @@ int ftrace_update_ftrace_func(ftrace_fun
15483 unsigned char old[MCOUNT_INSN_SIZE], *new;
15484 int ret;
15485
15486 - memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
15487 + memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
15488 new = ftrace_call_replace(ip, (unsigned long)func);
15489 ret = ftrace_modify_code(ip, old, new);
15490
15491 @@ -337,15 +341,15 @@ int __init ftrace_dyn_arch_init(void *da
15492 switch (faulted) {
15493 case 0:
15494 pr_info("ftrace: converting mcount calls to 0f 1f 44 00 00\n");
15495 - memcpy(ftrace_nop, ftrace_test_p6nop, MCOUNT_INSN_SIZE);
15496 + memcpy(ftrace_nop, ktla_ktva(ftrace_test_p6nop), MCOUNT_INSN_SIZE);
15497 break;
15498 case 1:
15499 pr_info("ftrace: converting mcount calls to 66 66 66 66 90\n");
15500 - memcpy(ftrace_nop, ftrace_test_nop5, MCOUNT_INSN_SIZE);
15501 + memcpy(ftrace_nop, ktla_ktva(ftrace_test_nop5), MCOUNT_INSN_SIZE);
15502 break;
15503 case 2:
15504 pr_info("ftrace: converting mcount calls to jmp . + 5\n");
15505 - memcpy(ftrace_nop, ftrace_test_jmp, MCOUNT_INSN_SIZE);
15506 + memcpy(ftrace_nop, ktla_ktva(ftrace_test_jmp), MCOUNT_INSN_SIZE);
15507 break;
15508 }
15509
15510 @@ -366,6 +370,8 @@ static int ftrace_mod_jmp(unsigned long
15511 {
15512 unsigned char code[MCOUNT_INSN_SIZE];
15513
15514 + ip = ktla_ktva(ip);
15515 +
15516 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
15517 return -EFAULT;
15518
15519 diff -urNp linux-2.6.32.49/arch/x86/kernel/head32.c linux-2.6.32.49/arch/x86/kernel/head32.c
15520 --- linux-2.6.32.49/arch/x86/kernel/head32.c 2011-11-08 19:02:43.000000000 -0500
15521 +++ linux-2.6.32.49/arch/x86/kernel/head32.c 2011-11-15 19:59:43.000000000 -0500
15522 @@ -16,6 +16,7 @@
15523 #include <asm/apic.h>
15524 #include <asm/io_apic.h>
15525 #include <asm/bios_ebda.h>
15526 +#include <asm/boot.h>
15527
15528 static void __init i386_default_early_setup(void)
15529 {
15530 @@ -31,7 +32,7 @@ void __init i386_start_kernel(void)
15531 {
15532 reserve_trampoline_memory();
15533
15534 - reserve_early(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
15535 + reserve_early(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
15536
15537 #ifdef CONFIG_BLK_DEV_INITRD
15538 /* Reserve INITRD */
15539 diff -urNp linux-2.6.32.49/arch/x86/kernel/head_32.S linux-2.6.32.49/arch/x86/kernel/head_32.S
15540 --- linux-2.6.32.49/arch/x86/kernel/head_32.S 2011-11-08 19:02:43.000000000 -0500
15541 +++ linux-2.6.32.49/arch/x86/kernel/head_32.S 2011-11-15 19:59:43.000000000 -0500
15542 @@ -19,10 +19,17 @@
15543 #include <asm/setup.h>
15544 #include <asm/processor-flags.h>
15545 #include <asm/percpu.h>
15546 +#include <asm/msr-index.h>
15547
15548 /* Physical address */
15549 #define pa(X) ((X) - __PAGE_OFFSET)
15550
15551 +#ifdef CONFIG_PAX_KERNEXEC
15552 +#define ta(X) (X)
15553 +#else
15554 +#define ta(X) ((X) - __PAGE_OFFSET)
15555 +#endif
15556 +
15557 /*
15558 * References to members of the new_cpu_data structure.
15559 */
15560 @@ -52,11 +59,7 @@
15561 * and small than max_low_pfn, otherwise will waste some page table entries
15562 */
15563
15564 -#if PTRS_PER_PMD > 1
15565 -#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
15566 -#else
15567 -#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
15568 -#endif
15569 +#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
15570
15571 /* Enough space to fit pagetables for the low memory linear map */
15572 MAPPING_BEYOND_END = \
15573 @@ -73,6 +76,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
15574 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
15575
15576 /*
15577 + * Real beginning of normal "text" segment
15578 + */
15579 +ENTRY(stext)
15580 +ENTRY(_stext)
15581 +
15582 +/*
15583 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
15584 * %esi points to the real-mode code as a 32-bit pointer.
15585 * CS and DS must be 4 GB flat segments, but we don't depend on
15586 @@ -80,7 +89,16 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
15587 * can.
15588 */
15589 __HEAD
15590 +
15591 +#ifdef CONFIG_PAX_KERNEXEC
15592 + jmp startup_32
15593 +/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
15594 +.fill PAGE_SIZE-5,1,0xcc
15595 +#endif
15596 +
15597 ENTRY(startup_32)
15598 + movl pa(stack_start),%ecx
15599 +
15600 /* test KEEP_SEGMENTS flag to see if the bootloader is asking
15601 us to not reload segments */
15602 testb $(1<<6), BP_loadflags(%esi)
15603 @@ -95,7 +113,60 @@ ENTRY(startup_32)
15604 movl %eax,%es
15605 movl %eax,%fs
15606 movl %eax,%gs
15607 + movl %eax,%ss
15608 2:
15609 + leal -__PAGE_OFFSET(%ecx),%esp
15610 +
15611 +#ifdef CONFIG_SMP
15612 + movl $pa(cpu_gdt_table),%edi
15613 + movl $__per_cpu_load,%eax
15614 + movw %ax,__KERNEL_PERCPU + 2(%edi)
15615 + rorl $16,%eax
15616 + movb %al,__KERNEL_PERCPU + 4(%edi)
15617 + movb %ah,__KERNEL_PERCPU + 7(%edi)
15618 + movl $__per_cpu_end - 1,%eax
15619 + subl $__per_cpu_start,%eax
15620 + movw %ax,__KERNEL_PERCPU + 0(%edi)
15621 +#endif
15622 +
15623 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15624 + movl $NR_CPUS,%ecx
15625 + movl $pa(cpu_gdt_table),%edi
15626 +1:
15627 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
15628 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
15629 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
15630 + addl $PAGE_SIZE_asm,%edi
15631 + loop 1b
15632 +#endif
15633 +
15634 +#ifdef CONFIG_PAX_KERNEXEC
15635 + movl $pa(boot_gdt),%edi
15636 + movl $__LOAD_PHYSICAL_ADDR,%eax
15637 + movw %ax,__BOOT_CS + 2(%edi)
15638 + rorl $16,%eax
15639 + movb %al,__BOOT_CS + 4(%edi)
15640 + movb %ah,__BOOT_CS + 7(%edi)
15641 + rorl $16,%eax
15642 +
15643 + ljmp $(__BOOT_CS),$1f
15644 +1:
15645 +
15646 + movl $NR_CPUS,%ecx
15647 + movl $pa(cpu_gdt_table),%edi
15648 + addl $__PAGE_OFFSET,%eax
15649 +1:
15650 + movw %ax,__KERNEL_CS + 2(%edi)
15651 + movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
15652 + rorl $16,%eax
15653 + movb %al,__KERNEL_CS + 4(%edi)
15654 + movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
15655 + movb %ah,__KERNEL_CS + 7(%edi)
15656 + movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
15657 + rorl $16,%eax
15658 + addl $PAGE_SIZE_asm,%edi
15659 + loop 1b
15660 +#endif
15661
15662 /*
15663 * Clear BSS first so that there are no surprises...
15664 @@ -140,9 +211,7 @@ ENTRY(startup_32)
15665 cmpl $num_subarch_entries, %eax
15666 jae bad_subarch
15667
15668 - movl pa(subarch_entries)(,%eax,4), %eax
15669 - subl $__PAGE_OFFSET, %eax
15670 - jmp *%eax
15671 + jmp *pa(subarch_entries)(,%eax,4)
15672
15673 bad_subarch:
15674 WEAK(lguest_entry)
15675 @@ -154,10 +223,10 @@ WEAK(xen_entry)
15676 __INITDATA
15677
15678 subarch_entries:
15679 - .long default_entry /* normal x86/PC */
15680 - .long lguest_entry /* lguest hypervisor */
15681 - .long xen_entry /* Xen hypervisor */
15682 - .long default_entry /* Moorestown MID */
15683 + .long ta(default_entry) /* normal x86/PC */
15684 + .long ta(lguest_entry) /* lguest hypervisor */
15685 + .long ta(xen_entry) /* Xen hypervisor */
15686 + .long ta(default_entry) /* Moorestown MID */
15687 num_subarch_entries = (. - subarch_entries) / 4
15688 .previous
15689 #endif /* CONFIG_PARAVIRT */
15690 @@ -218,8 +287,11 @@ default_entry:
15691 movl %eax, pa(max_pfn_mapped)
15692
15693 /* Do early initialization of the fixmap area */
15694 - movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
15695 - movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
15696 +#ifdef CONFIG_COMPAT_VDSO
15697 + movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_pmd+0x1000*KPMDS-8)
15698 +#else
15699 + movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_pmd+0x1000*KPMDS-8)
15700 +#endif
15701 #else /* Not PAE */
15702
15703 page_pde_offset = (__PAGE_OFFSET >> 20);
15704 @@ -249,8 +321,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
15705 movl %eax, pa(max_pfn_mapped)
15706
15707 /* Do early initialization of the fixmap area */
15708 - movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
15709 - movl %eax,pa(swapper_pg_dir+0xffc)
15710 +#ifdef CONFIG_COMPAT_VDSO
15711 + movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_dir+0xffc)
15712 +#else
15713 + movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_dir+0xffc)
15714 +#endif
15715 #endif
15716 jmp 3f
15717 /*
15718 @@ -272,6 +347,9 @@ ENTRY(startup_32_smp)
15719 movl %eax,%es
15720 movl %eax,%fs
15721 movl %eax,%gs
15722 + movl pa(stack_start),%ecx
15723 + movl %eax,%ss
15724 + leal -__PAGE_OFFSET(%ecx),%esp
15725 #endif /* CONFIG_SMP */
15726 3:
15727
15728 @@ -297,6 +375,7 @@ ENTRY(startup_32_smp)
15729 orl %edx,%eax
15730 movl %eax,%cr4
15731
15732 +#ifdef CONFIG_X86_PAE
15733 btl $5, %eax # check if PAE is enabled
15734 jnc 6f
15735
15736 @@ -305,6 +384,10 @@ ENTRY(startup_32_smp)
15737 cpuid
15738 cmpl $0x80000000, %eax
15739 jbe 6f
15740 +
15741 + /* Clear bogus XD_DISABLE bits */
15742 + call verify_cpu
15743 +
15744 mov $0x80000001, %eax
15745 cpuid
15746 /* Execute Disable bit supported? */
15747 @@ -312,13 +395,17 @@ ENTRY(startup_32_smp)
15748 jnc 6f
15749
15750 /* Setup EFER (Extended Feature Enable Register) */
15751 - movl $0xc0000080, %ecx
15752 + movl $MSR_EFER, %ecx
15753 rdmsr
15754
15755 btsl $11, %eax
15756 /* Make changes effective */
15757 wrmsr
15758
15759 + btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
15760 + movl $1,pa(nx_enabled)
15761 +#endif
15762 +
15763 6:
15764
15765 /*
15766 @@ -331,8 +418,8 @@ ENTRY(startup_32_smp)
15767 movl %eax,%cr0 /* ..and set paging (PG) bit */
15768 ljmp $__BOOT_CS,$1f /* Clear prefetch and normalize %eip */
15769 1:
15770 - /* Set up the stack pointer */
15771 - lss stack_start,%esp
15772 + /* Shift the stack pointer to a virtual address */
15773 + addl $__PAGE_OFFSET, %esp
15774
15775 /*
15776 * Initialize eflags. Some BIOS's leave bits like NT set. This would
15777 @@ -344,9 +431,7 @@ ENTRY(startup_32_smp)
15778
15779 #ifdef CONFIG_SMP
15780 cmpb $0, ready
15781 - jz 1f /* Initial CPU cleans BSS */
15782 - jmp checkCPUtype
15783 -1:
15784 + jnz checkCPUtype
15785 #endif /* CONFIG_SMP */
15786
15787 /*
15788 @@ -424,7 +509,7 @@ is386: movl $2,%ecx # set MP
15789 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
15790 movl %eax,%ss # after changing gdt.
15791
15792 - movl $(__USER_DS),%eax # DS/ES contains default USER segment
15793 +# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
15794 movl %eax,%ds
15795 movl %eax,%es
15796
15797 @@ -438,15 +523,22 @@ is386: movl $2,%ecx # set MP
15798 */
15799 cmpb $0,ready
15800 jne 1f
15801 - movl $per_cpu__gdt_page,%eax
15802 + movl $cpu_gdt_table,%eax
15803 movl $per_cpu__stack_canary,%ecx
15804 +#ifdef CONFIG_SMP
15805 + addl $__per_cpu_load,%ecx
15806 +#endif
15807 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
15808 shrl $16, %ecx
15809 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
15810 movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
15811 1:
15812 -#endif
15813 movl $(__KERNEL_STACK_CANARY),%eax
15814 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
15815 + movl $(__USER_DS),%eax
15816 +#else
15817 + xorl %eax,%eax
15818 +#endif
15819 movl %eax,%gs
15820
15821 xorl %eax,%eax # Clear LDT
15822 @@ -454,14 +546,7 @@ is386: movl $2,%ecx # set MP
15823
15824 cld # gcc2 wants the direction flag cleared at all times
15825 pushl $0 # fake return address for unwinder
15826 -#ifdef CONFIG_SMP
15827 - movb ready, %cl
15828 movb $1, ready
15829 - cmpb $0,%cl # the first CPU calls start_kernel
15830 - je 1f
15831 - movl (stack_start), %esp
15832 -1:
15833 -#endif /* CONFIG_SMP */
15834 jmp *(initial_code)
15835
15836 /*
15837 @@ -546,22 +631,22 @@ early_page_fault:
15838 jmp early_fault
15839
15840 early_fault:
15841 - cld
15842 #ifdef CONFIG_PRINTK
15843 + cmpl $1,%ss:early_recursion_flag
15844 + je hlt_loop
15845 + incl %ss:early_recursion_flag
15846 + cld
15847 pusha
15848 movl $(__KERNEL_DS),%eax
15849 movl %eax,%ds
15850 movl %eax,%es
15851 - cmpl $2,early_recursion_flag
15852 - je hlt_loop
15853 - incl early_recursion_flag
15854 movl %cr2,%eax
15855 pushl %eax
15856 pushl %edx /* trapno */
15857 pushl $fault_msg
15858 call printk
15859 +; call dump_stack
15860 #endif
15861 - call dump_stack
15862 hlt_loop:
15863 hlt
15864 jmp hlt_loop
15865 @@ -569,8 +654,11 @@ hlt_loop:
15866 /* This is the default interrupt "handler" :-) */
15867 ALIGN
15868 ignore_int:
15869 - cld
15870 #ifdef CONFIG_PRINTK
15871 + cmpl $2,%ss:early_recursion_flag
15872 + je hlt_loop
15873 + incl %ss:early_recursion_flag
15874 + cld
15875 pushl %eax
15876 pushl %ecx
15877 pushl %edx
15878 @@ -579,9 +667,6 @@ ignore_int:
15879 movl $(__KERNEL_DS),%eax
15880 movl %eax,%ds
15881 movl %eax,%es
15882 - cmpl $2,early_recursion_flag
15883 - je hlt_loop
15884 - incl early_recursion_flag
15885 pushl 16(%esp)
15886 pushl 24(%esp)
15887 pushl 32(%esp)
15888 @@ -600,6 +685,8 @@ ignore_int:
15889 #endif
15890 iret
15891
15892 +#include "verify_cpu.S"
15893 +
15894 __REFDATA
15895 .align 4
15896 ENTRY(initial_code)
15897 @@ -610,31 +697,47 @@ ENTRY(initial_page_table)
15898 /*
15899 * BSS section
15900 */
15901 -__PAGE_ALIGNED_BSS
15902 - .align PAGE_SIZE_asm
15903 #ifdef CONFIG_X86_PAE
15904 +.section .swapper_pg_pmd,"a",@progbits
15905 swapper_pg_pmd:
15906 .fill 1024*KPMDS,4,0
15907 #else
15908 +.section .swapper_pg_dir,"a",@progbits
15909 ENTRY(swapper_pg_dir)
15910 .fill 1024,4,0
15911 #endif
15912 +.section .swapper_pg_fixmap,"a",@progbits
15913 swapper_pg_fixmap:
15914 .fill 1024,4,0
15915 #ifdef CONFIG_X86_TRAMPOLINE
15916 +.section .trampoline_pg_dir,"a",@progbits
15917 ENTRY(trampoline_pg_dir)
15918 +#ifdef CONFIG_X86_PAE
15919 + .fill 4,8,0
15920 +#else
15921 .fill 1024,4,0
15922 #endif
15923 +#endif
15924 +
15925 +.section .empty_zero_page,"a",@progbits
15926 ENTRY(empty_zero_page)
15927 .fill 4096,1,0
15928
15929 /*
15930 + * The IDT has to be page-aligned to simplify the Pentium
15931 + * F0 0F bug workaround.. We have a special link segment
15932 + * for this.
15933 + */
15934 +.section .idt,"a",@progbits
15935 +ENTRY(idt_table)
15936 + .fill 256,8,0
15937 +
15938 +/*
15939 * This starts the data section.
15940 */
15941 #ifdef CONFIG_X86_PAE
15942 -__PAGE_ALIGNED_DATA
15943 - /* Page-aligned for the benefit of paravirt? */
15944 - .align PAGE_SIZE_asm
15945 +.section .swapper_pg_dir,"a",@progbits
15946 +
15947 ENTRY(swapper_pg_dir)
15948 .long pa(swapper_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
15949 # if KPMDS == 3
15950 @@ -653,15 +756,24 @@ ENTRY(swapper_pg_dir)
15951 # error "Kernel PMDs should be 1, 2 or 3"
15952 # endif
15953 .align PAGE_SIZE_asm /* needs to be page-sized too */
15954 +
15955 +#ifdef CONFIG_PAX_PER_CPU_PGD
15956 +ENTRY(cpu_pgd)
15957 + .rept NR_CPUS
15958 + .fill 4,8,0
15959 + .endr
15960 +#endif
15961 +
15962 #endif
15963
15964 .data
15965 +.balign 4
15966 ENTRY(stack_start)
15967 - .long init_thread_union+THREAD_SIZE
15968 - .long __BOOT_DS
15969 + .long init_thread_union+THREAD_SIZE-8
15970
15971 ready: .byte 0
15972
15973 +.section .rodata,"a",@progbits
15974 early_recursion_flag:
15975 .long 0
15976
15977 @@ -697,7 +809,7 @@ fault_msg:
15978 .word 0 # 32 bit align gdt_desc.address
15979 boot_gdt_descr:
15980 .word __BOOT_DS+7
15981 - .long boot_gdt - __PAGE_OFFSET
15982 + .long pa(boot_gdt)
15983
15984 .word 0 # 32-bit align idt_desc.address
15985 idt_descr:
15986 @@ -708,7 +820,7 @@ idt_descr:
15987 .word 0 # 32 bit align gdt_desc.address
15988 ENTRY(early_gdt_descr)
15989 .word GDT_ENTRIES*8-1
15990 - .long per_cpu__gdt_page /* Overwritten for secondary CPUs */
15991 + .long cpu_gdt_table /* Overwritten for secondary CPUs */
15992
15993 /*
15994 * The boot_gdt must mirror the equivalent in setup.S and is
15995 @@ -717,5 +829,65 @@ ENTRY(early_gdt_descr)
15996 .align L1_CACHE_BYTES
15997 ENTRY(boot_gdt)
15998 .fill GDT_ENTRY_BOOT_CS,8,0
15999 - .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
16000 - .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
16001 + .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
16002 + .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
16003 +
16004 + .align PAGE_SIZE_asm
16005 +ENTRY(cpu_gdt_table)
16006 + .rept NR_CPUS
16007 + .quad 0x0000000000000000 /* NULL descriptor */
16008 + .quad 0x0000000000000000 /* 0x0b reserved */
16009 + .quad 0x0000000000000000 /* 0x13 reserved */
16010 + .quad 0x0000000000000000 /* 0x1b reserved */
16011 +
16012 +#ifdef CONFIG_PAX_KERNEXEC
16013 + .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
16014 +#else
16015 + .quad 0x0000000000000000 /* 0x20 unused */
16016 +#endif
16017 +
16018 + .quad 0x0000000000000000 /* 0x28 unused */
16019 + .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
16020 + .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
16021 + .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
16022 + .quad 0x0000000000000000 /* 0x4b reserved */
16023 + .quad 0x0000000000000000 /* 0x53 reserved */
16024 + .quad 0x0000000000000000 /* 0x5b reserved */
16025 +
16026 + .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
16027 + .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
16028 + .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
16029 + .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
16030 +
16031 + .quad 0x0000000000000000 /* 0x80 TSS descriptor */
16032 + .quad 0x0000000000000000 /* 0x88 LDT descriptor */
16033 +
16034 + /*
16035 + * Segments used for calling PnP BIOS have byte granularity.
16036 + * The code segments and data segments have fixed 64k limits,
16037 + * the transfer segment sizes are set at run time.
16038 + */
16039 + .quad 0x00409b000000ffff /* 0x90 32-bit code */
16040 + .quad 0x00009b000000ffff /* 0x98 16-bit code */
16041 + .quad 0x000093000000ffff /* 0xa0 16-bit data */
16042 + .quad 0x0000930000000000 /* 0xa8 16-bit data */
16043 + .quad 0x0000930000000000 /* 0xb0 16-bit data */
16044 +
16045 + /*
16046 + * The APM segments have byte granularity and their bases
16047 + * are set at run time. All have 64k limits.
16048 + */
16049 + .quad 0x00409b000000ffff /* 0xb8 APM CS code */
16050 + .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
16051 + .quad 0x004093000000ffff /* 0xc8 APM DS data */
16052 +
16053 + .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
16054 + .quad 0x0040930000000000 /* 0xd8 - PERCPU */
16055 + .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
16056 + .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
16057 + .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
16058 + .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
16059 +
16060 + /* Be sure this is zeroed to avoid false validations in Xen */
16061 + .fill PAGE_SIZE_asm - GDT_SIZE,1,0
16062 + .endr
16063 diff -urNp linux-2.6.32.49/arch/x86/kernel/head_64.S linux-2.6.32.49/arch/x86/kernel/head_64.S
16064 --- linux-2.6.32.49/arch/x86/kernel/head_64.S 2011-11-08 19:02:43.000000000 -0500
16065 +++ linux-2.6.32.49/arch/x86/kernel/head_64.S 2011-11-15 19:59:43.000000000 -0500
16066 @@ -19,6 +19,7 @@
16067 #include <asm/cache.h>
16068 #include <asm/processor-flags.h>
16069 #include <asm/percpu.h>
16070 +#include <asm/cpufeature.h>
16071
16072 #ifdef CONFIG_PARAVIRT
16073 #include <asm/asm-offsets.h>
16074 @@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
16075 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
16076 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
16077 L3_START_KERNEL = pud_index(__START_KERNEL_map)
16078 +L4_VMALLOC_START = pgd_index(VMALLOC_START)
16079 +L3_VMALLOC_START = pud_index(VMALLOC_START)
16080 +L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
16081 +L3_VMEMMAP_START = pud_index(VMEMMAP_START)
16082
16083 .text
16084 __HEAD
16085 @@ -85,35 +90,22 @@ startup_64:
16086 */
16087 addq %rbp, init_level4_pgt + 0(%rip)
16088 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
16089 + addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
16090 + addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
16091 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
16092
16093 addq %rbp, level3_ident_pgt + 0(%rip)
16094 +#ifndef CONFIG_XEN
16095 + addq %rbp, level3_ident_pgt + 8(%rip)
16096 +#endif
16097
16098 - addq %rbp, level3_kernel_pgt + (510*8)(%rip)
16099 - addq %rbp, level3_kernel_pgt + (511*8)(%rip)
16100 + addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
16101
16102 - addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
16103 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
16104 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
16105
16106 - /* Add an Identity mapping if I am above 1G */
16107 - leaq _text(%rip), %rdi
16108 - andq $PMD_PAGE_MASK, %rdi
16109 -
16110 - movq %rdi, %rax
16111 - shrq $PUD_SHIFT, %rax
16112 - andq $(PTRS_PER_PUD - 1), %rax
16113 - jz ident_complete
16114 -
16115 - leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
16116 - leaq level3_ident_pgt(%rip), %rbx
16117 - movq %rdx, 0(%rbx, %rax, 8)
16118 -
16119 - movq %rdi, %rax
16120 - shrq $PMD_SHIFT, %rax
16121 - andq $(PTRS_PER_PMD - 1), %rax
16122 - leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
16123 - leaq level2_spare_pgt(%rip), %rbx
16124 - movq %rdx, 0(%rbx, %rax, 8)
16125 -ident_complete:
16126 + addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
16127 + addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
16128
16129 /*
16130 * Fixup the kernel text+data virtual addresses. Note that
16131 @@ -161,8 +153,8 @@ ENTRY(secondary_startup_64)
16132 * after the boot processor executes this code.
16133 */
16134
16135 - /* Enable PAE mode and PGE */
16136 - movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
16137 + /* Enable PAE mode and PSE/PGE */
16138 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
16139 movq %rax, %cr4
16140
16141 /* Setup early boot stage 4 level pagetables. */
16142 @@ -184,9 +176,13 @@ ENTRY(secondary_startup_64)
16143 movl $MSR_EFER, %ecx
16144 rdmsr
16145 btsl $_EFER_SCE, %eax /* Enable System Call */
16146 - btl $20,%edi /* No Execute supported? */
16147 + btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
16148 jnc 1f
16149 btsl $_EFER_NX, %eax
16150 + leaq init_level4_pgt(%rip), %rdi
16151 + btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
16152 + btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
16153 + btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
16154 1: wrmsr /* Make changes effective */
16155
16156 /* Setup cr0 */
16157 @@ -262,16 +258,16 @@ ENTRY(secondary_startup_64)
16158 .quad x86_64_start_kernel
16159 ENTRY(initial_gs)
16160 .quad INIT_PER_CPU_VAR(irq_stack_union)
16161 - __FINITDATA
16162
16163 ENTRY(stack_start)
16164 .quad init_thread_union+THREAD_SIZE-8
16165 .word 0
16166 + __FINITDATA
16167
16168 bad_address:
16169 jmp bad_address
16170
16171 - .section ".init.text","ax"
16172 + __INIT
16173 #ifdef CONFIG_EARLY_PRINTK
16174 .globl early_idt_handlers
16175 early_idt_handlers:
16176 @@ -316,18 +312,23 @@ ENTRY(early_idt_handler)
16177 #endif /* EARLY_PRINTK */
16178 1: hlt
16179 jmp 1b
16180 + .previous
16181
16182 #ifdef CONFIG_EARLY_PRINTK
16183 + __INITDATA
16184 early_recursion_flag:
16185 .long 0
16186 + .previous
16187
16188 + .section .rodata,"a",@progbits
16189 early_idt_msg:
16190 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
16191 early_idt_ripmsg:
16192 .asciz "RIP %s\n"
16193 -#endif /* CONFIG_EARLY_PRINTK */
16194 .previous
16195 +#endif /* CONFIG_EARLY_PRINTK */
16196
16197 + .section .rodata,"a",@progbits
16198 #define NEXT_PAGE(name) \
16199 .balign PAGE_SIZE; \
16200 ENTRY(name)
16201 @@ -350,13 +351,36 @@ NEXT_PAGE(init_level4_pgt)
16202 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
16203 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
16204 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
16205 + .org init_level4_pgt + L4_VMALLOC_START*8, 0
16206 + .quad level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
16207 + .org init_level4_pgt + L4_VMEMMAP_START*8, 0
16208 + .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
16209 .org init_level4_pgt + L4_START_KERNEL*8, 0
16210 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
16211 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
16212
16213 +#ifdef CONFIG_PAX_PER_CPU_PGD
16214 +NEXT_PAGE(cpu_pgd)
16215 + .rept NR_CPUS
16216 + .fill 512,8,0
16217 + .endr
16218 +#endif
16219 +
16220 NEXT_PAGE(level3_ident_pgt)
16221 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
16222 +#ifdef CONFIG_XEN
16223 .fill 511,8,0
16224 +#else
16225 + .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
16226 + .fill 510,8,0
16227 +#endif
16228 +
16229 +NEXT_PAGE(level3_vmalloc_pgt)
16230 + .fill 512,8,0
16231 +
16232 +NEXT_PAGE(level3_vmemmap_pgt)
16233 + .fill L3_VMEMMAP_START,8,0
16234 + .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
16235
16236 NEXT_PAGE(level3_kernel_pgt)
16237 .fill L3_START_KERNEL,8,0
16238 @@ -364,20 +388,23 @@ NEXT_PAGE(level3_kernel_pgt)
16239 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
16240 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
16241
16242 +NEXT_PAGE(level2_vmemmap_pgt)
16243 + .fill 512,8,0
16244 +
16245 NEXT_PAGE(level2_fixmap_pgt)
16246 - .fill 506,8,0
16247 - .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
16248 - /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
16249 - .fill 5,8,0
16250 + .fill 507,8,0
16251 + .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
16252 + /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
16253 + .fill 4,8,0
16254
16255 -NEXT_PAGE(level1_fixmap_pgt)
16256 +NEXT_PAGE(level1_vsyscall_pgt)
16257 .fill 512,8,0
16258
16259 -NEXT_PAGE(level2_ident_pgt)
16260 - /* Since I easily can, map the first 1G.
16261 + /* Since I easily can, map the first 2G.
16262 * Don't set NX because code runs from these pages.
16263 */
16264 - PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
16265 +NEXT_PAGE(level2_ident_pgt)
16266 + PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
16267
16268 NEXT_PAGE(level2_kernel_pgt)
16269 /*
16270 @@ -390,33 +417,55 @@ NEXT_PAGE(level2_kernel_pgt)
16271 * If you want to increase this then increase MODULES_VADDR
16272 * too.)
16273 */
16274 - PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
16275 - KERNEL_IMAGE_SIZE/PMD_SIZE)
16276 -
16277 -NEXT_PAGE(level2_spare_pgt)
16278 - .fill 512, 8, 0
16279 + PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
16280
16281 #undef PMDS
16282 #undef NEXT_PAGE
16283
16284 - .data
16285 + .align PAGE_SIZE
16286 +ENTRY(cpu_gdt_table)
16287 + .rept NR_CPUS
16288 + .quad 0x0000000000000000 /* NULL descriptor */
16289 + .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
16290 + .quad 0x00af9b000000ffff /* __KERNEL_CS */
16291 + .quad 0x00cf93000000ffff /* __KERNEL_DS */
16292 + .quad 0x00cffb000000ffff /* __USER32_CS */
16293 + .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
16294 + .quad 0x00affb000000ffff /* __USER_CS */
16295 +
16296 +#ifdef CONFIG_PAX_KERNEXEC
16297 + .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
16298 +#else
16299 + .quad 0x0 /* unused */
16300 +#endif
16301 +
16302 + .quad 0,0 /* TSS */
16303 + .quad 0,0 /* LDT */
16304 + .quad 0,0,0 /* three TLS descriptors */
16305 + .quad 0x0000f40000000000 /* node/CPU stored in limit */
16306 + /* asm/segment.h:GDT_ENTRIES must match this */
16307 +
16308 + /* zero the remaining page */
16309 + .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
16310 + .endr
16311 +
16312 .align 16
16313 .globl early_gdt_descr
16314 early_gdt_descr:
16315 .word GDT_ENTRIES*8-1
16316 early_gdt_descr_base:
16317 - .quad INIT_PER_CPU_VAR(gdt_page)
16318 + .quad cpu_gdt_table
16319
16320 ENTRY(phys_base)
16321 /* This must match the first entry in level2_kernel_pgt */
16322 .quad 0x0000000000000000
16323
16324 #include "../../x86/xen/xen-head.S"
16325 -
16326 - .section .bss, "aw", @nobits
16327 +
16328 + .section .rodata,"a",@progbits
16329 .align L1_CACHE_BYTES
16330 ENTRY(idt_table)
16331 - .skip IDT_ENTRIES * 16
16332 + .fill 512,8,0
16333
16334 __PAGE_ALIGNED_BSS
16335 .align PAGE_SIZE
16336 diff -urNp linux-2.6.32.49/arch/x86/kernel/i386_ksyms_32.c linux-2.6.32.49/arch/x86/kernel/i386_ksyms_32.c
16337 --- linux-2.6.32.49/arch/x86/kernel/i386_ksyms_32.c 2011-11-08 19:02:43.000000000 -0500
16338 +++ linux-2.6.32.49/arch/x86/kernel/i386_ksyms_32.c 2011-11-15 19:59:43.000000000 -0500
16339 @@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
16340 EXPORT_SYMBOL(cmpxchg8b_emu);
16341 #endif
16342
16343 +EXPORT_SYMBOL_GPL(cpu_gdt_table);
16344 +
16345 /* Networking helper routines. */
16346 EXPORT_SYMBOL(csum_partial_copy_generic);
16347 +EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
16348 +EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
16349
16350 EXPORT_SYMBOL(__get_user_1);
16351 EXPORT_SYMBOL(__get_user_2);
16352 @@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
16353
16354 EXPORT_SYMBOL(csum_partial);
16355 EXPORT_SYMBOL(empty_zero_page);
16356 +
16357 +#ifdef CONFIG_PAX_KERNEXEC
16358 +EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
16359 +#endif
16360 diff -urNp linux-2.6.32.49/arch/x86/kernel/i8259.c linux-2.6.32.49/arch/x86/kernel/i8259.c
16361 --- linux-2.6.32.49/arch/x86/kernel/i8259.c 2011-11-08 19:02:43.000000000 -0500
16362 +++ linux-2.6.32.49/arch/x86/kernel/i8259.c 2011-11-15 19:59:43.000000000 -0500
16363 @@ -208,7 +208,7 @@ spurious_8259A_irq:
16364 "spurious 8259A interrupt: IRQ%d.\n", irq);
16365 spurious_irq_mask |= irqmask;
16366 }
16367 - atomic_inc(&irq_err_count);
16368 + atomic_inc_unchecked(&irq_err_count);
16369 /*
16370 * Theoretically we do not have to handle this IRQ,
16371 * but in Linux this does not cause problems and is
16372 diff -urNp linux-2.6.32.49/arch/x86/kernel/init_task.c linux-2.6.32.49/arch/x86/kernel/init_task.c
16373 --- linux-2.6.32.49/arch/x86/kernel/init_task.c 2011-11-08 19:02:43.000000000 -0500
16374 +++ linux-2.6.32.49/arch/x86/kernel/init_task.c 2011-11-15 19:59:43.000000000 -0500
16375 @@ -20,8 +20,7 @@ static struct sighand_struct init_sighan
16376 * way process stacks are handled. This is done by having a special
16377 * "init_task" linker map entry..
16378 */
16379 -union thread_union init_thread_union __init_task_data =
16380 - { INIT_THREAD_INFO(init_task) };
16381 +union thread_union init_thread_union __init_task_data;
16382
16383 /*
16384 * Initial task structure.
16385 @@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
16386 * section. Since TSS's are completely CPU-local, we want them
16387 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
16388 */
16389 -DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
16390 -
16391 +struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
16392 +EXPORT_SYMBOL(init_tss);
16393 diff -urNp linux-2.6.32.49/arch/x86/kernel/ioport.c linux-2.6.32.49/arch/x86/kernel/ioport.c
16394 --- linux-2.6.32.49/arch/x86/kernel/ioport.c 2011-11-08 19:02:43.000000000 -0500
16395 +++ linux-2.6.32.49/arch/x86/kernel/ioport.c 2011-11-15 19:59:43.000000000 -0500
16396 @@ -6,6 +6,7 @@
16397 #include <linux/sched.h>
16398 #include <linux/kernel.h>
16399 #include <linux/capability.h>
16400 +#include <linux/security.h>
16401 #include <linux/errno.h>
16402 #include <linux/types.h>
16403 #include <linux/ioport.h>
16404 @@ -41,6 +42,12 @@ asmlinkage long sys_ioperm(unsigned long
16405
16406 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
16407 return -EINVAL;
16408 +#ifdef CONFIG_GRKERNSEC_IO
16409 + if (turn_on && grsec_disable_privio) {
16410 + gr_handle_ioperm();
16411 + return -EPERM;
16412 + }
16413 +#endif
16414 if (turn_on && !capable(CAP_SYS_RAWIO))
16415 return -EPERM;
16416
16417 @@ -67,7 +74,7 @@ asmlinkage long sys_ioperm(unsigned long
16418 * because the ->io_bitmap_max value must match the bitmap
16419 * contents:
16420 */
16421 - tss = &per_cpu(init_tss, get_cpu());
16422 + tss = init_tss + get_cpu();
16423
16424 set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
16425
16426 @@ -111,6 +118,12 @@ static int do_iopl(unsigned int level, s
16427 return -EINVAL;
16428 /* Trying to gain more privileges? */
16429 if (level > old) {
16430 +#ifdef CONFIG_GRKERNSEC_IO
16431 + if (grsec_disable_privio) {
16432 + gr_handle_iopl();
16433 + return -EPERM;
16434 + }
16435 +#endif
16436 if (!capable(CAP_SYS_RAWIO))
16437 return -EPERM;
16438 }
16439 diff -urNp linux-2.6.32.49/arch/x86/kernel/irq_32.c linux-2.6.32.49/arch/x86/kernel/irq_32.c
16440 --- linux-2.6.32.49/arch/x86/kernel/irq_32.c 2011-11-08 19:02:43.000000000 -0500
16441 +++ linux-2.6.32.49/arch/x86/kernel/irq_32.c 2011-11-15 19:59:43.000000000 -0500
16442 @@ -35,7 +35,7 @@ static int check_stack_overflow(void)
16443 __asm__ __volatile__("andl %%esp,%0" :
16444 "=r" (sp) : "0" (THREAD_SIZE - 1));
16445
16446 - return sp < (sizeof(struct thread_info) + STACK_WARN);
16447 + return sp < STACK_WARN;
16448 }
16449
16450 static void print_stack_overflow(void)
16451 @@ -54,9 +54,9 @@ static inline void print_stack_overflow(
16452 * per-CPU IRQ handling contexts (thread information and stack)
16453 */
16454 union irq_ctx {
16455 - struct thread_info tinfo;
16456 - u32 stack[THREAD_SIZE/sizeof(u32)];
16457 -} __attribute__((aligned(PAGE_SIZE)));
16458 + unsigned long previous_esp;
16459 + u32 stack[THREAD_SIZE/sizeof(u32)];
16460 +} __attribute__((aligned(THREAD_SIZE)));
16461
16462 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
16463 static DEFINE_PER_CPU(union irq_ctx *, softirq_ctx);
16464 @@ -78,10 +78,9 @@ static void call_on_stack(void *func, vo
16465 static inline int
16466 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
16467 {
16468 - union irq_ctx *curctx, *irqctx;
16469 + union irq_ctx *irqctx;
16470 u32 *isp, arg1, arg2;
16471
16472 - curctx = (union irq_ctx *) current_thread_info();
16473 irqctx = __get_cpu_var(hardirq_ctx);
16474
16475 /*
16476 @@ -90,21 +89,16 @@ execute_on_irq_stack(int overflow, struc
16477 * handler) we can't do that and just have to keep using the
16478 * current stack (which is the irq stack already after all)
16479 */
16480 - if (unlikely(curctx == irqctx))
16481 + if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
16482 return 0;
16483
16484 /* build the stack frame on the IRQ stack */
16485 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
16486 - irqctx->tinfo.task = curctx->tinfo.task;
16487 - irqctx->tinfo.previous_esp = current_stack_pointer;
16488 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
16489 + irqctx->previous_esp = current_stack_pointer;
16490
16491 - /*
16492 - * Copy the softirq bits in preempt_count so that the
16493 - * softirq checks work in the hardirq context.
16494 - */
16495 - irqctx->tinfo.preempt_count =
16496 - (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
16497 - (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
16498 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16499 + __set_fs(MAKE_MM_SEG(0));
16500 +#endif
16501
16502 if (unlikely(overflow))
16503 call_on_stack(print_stack_overflow, isp);
16504 @@ -116,6 +110,11 @@ execute_on_irq_stack(int overflow, struc
16505 : "0" (irq), "1" (desc), "2" (isp),
16506 "D" (desc->handle_irq)
16507 : "memory", "cc", "ecx");
16508 +
16509 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16510 + __set_fs(current_thread_info()->addr_limit);
16511 +#endif
16512 +
16513 return 1;
16514 }
16515
16516 @@ -124,28 +123,11 @@ execute_on_irq_stack(int overflow, struc
16517 */
16518 void __cpuinit irq_ctx_init(int cpu)
16519 {
16520 - union irq_ctx *irqctx;
16521 -
16522 if (per_cpu(hardirq_ctx, cpu))
16523 return;
16524
16525 - irqctx = &per_cpu(hardirq_stack, cpu);
16526 - irqctx->tinfo.task = NULL;
16527 - irqctx->tinfo.exec_domain = NULL;
16528 - irqctx->tinfo.cpu = cpu;
16529 - irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
16530 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
16531 -
16532 - per_cpu(hardirq_ctx, cpu) = irqctx;
16533 -
16534 - irqctx = &per_cpu(softirq_stack, cpu);
16535 - irqctx->tinfo.task = NULL;
16536 - irqctx->tinfo.exec_domain = NULL;
16537 - irqctx->tinfo.cpu = cpu;
16538 - irqctx->tinfo.preempt_count = 0;
16539 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
16540 -
16541 - per_cpu(softirq_ctx, cpu) = irqctx;
16542 + per_cpu(hardirq_ctx, cpu) = &per_cpu(hardirq_stack, cpu);
16543 + per_cpu(softirq_ctx, cpu) = &per_cpu(softirq_stack, cpu);
16544
16545 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
16546 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
16547 @@ -159,7 +141,6 @@ void irq_ctx_exit(int cpu)
16548 asmlinkage void do_softirq(void)
16549 {
16550 unsigned long flags;
16551 - struct thread_info *curctx;
16552 union irq_ctx *irqctx;
16553 u32 *isp;
16554
16555 @@ -169,15 +150,22 @@ asmlinkage void do_softirq(void)
16556 local_irq_save(flags);
16557
16558 if (local_softirq_pending()) {
16559 - curctx = current_thread_info();
16560 irqctx = __get_cpu_var(softirq_ctx);
16561 - irqctx->tinfo.task = curctx->task;
16562 - irqctx->tinfo.previous_esp = current_stack_pointer;
16563 + irqctx->previous_esp = current_stack_pointer;
16564
16565 /* build the stack frame on the softirq stack */
16566 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
16567 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
16568 +
16569 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16570 + __set_fs(MAKE_MM_SEG(0));
16571 +#endif
16572
16573 call_on_stack(__do_softirq, isp);
16574 +
16575 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16576 + __set_fs(current_thread_info()->addr_limit);
16577 +#endif
16578 +
16579 /*
16580 * Shouldnt happen, we returned above if in_interrupt():
16581 */
16582 diff -urNp linux-2.6.32.49/arch/x86/kernel/irq.c linux-2.6.32.49/arch/x86/kernel/irq.c
16583 --- linux-2.6.32.49/arch/x86/kernel/irq.c 2011-11-08 19:02:43.000000000 -0500
16584 +++ linux-2.6.32.49/arch/x86/kernel/irq.c 2011-11-15 19:59:43.000000000 -0500
16585 @@ -15,7 +15,7 @@
16586 #include <asm/mce.h>
16587 #include <asm/hw_irq.h>
16588
16589 -atomic_t irq_err_count;
16590 +atomic_unchecked_t irq_err_count;
16591
16592 /* Function pointer for generic interrupt vector handling */
16593 void (*generic_interrupt_extension)(void) = NULL;
16594 @@ -114,9 +114,9 @@ static int show_other_interrupts(struct
16595 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
16596 seq_printf(p, " Machine check polls\n");
16597 #endif
16598 - seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
16599 + seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
16600 #if defined(CONFIG_X86_IO_APIC)
16601 - seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
16602 + seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
16603 #endif
16604 return 0;
16605 }
16606 @@ -209,10 +209,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
16607
16608 u64 arch_irq_stat(void)
16609 {
16610 - u64 sum = atomic_read(&irq_err_count);
16611 + u64 sum = atomic_read_unchecked(&irq_err_count);
16612
16613 #ifdef CONFIG_X86_IO_APIC
16614 - sum += atomic_read(&irq_mis_count);
16615 + sum += atomic_read_unchecked(&irq_mis_count);
16616 #endif
16617 return sum;
16618 }
16619 diff -urNp linux-2.6.32.49/arch/x86/kernel/kgdb.c linux-2.6.32.49/arch/x86/kernel/kgdb.c
16620 --- linux-2.6.32.49/arch/x86/kernel/kgdb.c 2011-11-08 19:02:43.000000000 -0500
16621 +++ linux-2.6.32.49/arch/x86/kernel/kgdb.c 2011-11-15 19:59:43.000000000 -0500
16622 @@ -390,13 +390,13 @@ int kgdb_arch_handle_exception(int e_vec
16623
16624 /* clear the trace bit */
16625 linux_regs->flags &= ~X86_EFLAGS_TF;
16626 - atomic_set(&kgdb_cpu_doing_single_step, -1);
16627 + atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
16628
16629 /* set the trace bit if we're stepping */
16630 if (remcomInBuffer[0] == 's') {
16631 linux_regs->flags |= X86_EFLAGS_TF;
16632 kgdb_single_step = 1;
16633 - atomic_set(&kgdb_cpu_doing_single_step,
16634 + atomic_set_unchecked(&kgdb_cpu_doing_single_step,
16635 raw_smp_processor_id());
16636 }
16637
16638 @@ -476,7 +476,7 @@ static int __kgdb_notify(struct die_args
16639 break;
16640
16641 case DIE_DEBUG:
16642 - if (atomic_read(&kgdb_cpu_doing_single_step) ==
16643 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) ==
16644 raw_smp_processor_id()) {
16645 if (user_mode(regs))
16646 return single_step_cont(regs, args);
16647 @@ -573,7 +573,7 @@ unsigned long kgdb_arch_pc(int exception
16648 return instruction_pointer(regs);
16649 }
16650
16651 -struct kgdb_arch arch_kgdb_ops = {
16652 +const struct kgdb_arch arch_kgdb_ops = {
16653 /* Breakpoint instruction: */
16654 .gdb_bpt_instr = { 0xcc },
16655 .flags = KGDB_HW_BREAKPOINT,
16656 diff -urNp linux-2.6.32.49/arch/x86/kernel/kprobes.c linux-2.6.32.49/arch/x86/kernel/kprobes.c
16657 --- linux-2.6.32.49/arch/x86/kernel/kprobes.c 2011-11-08 19:02:43.000000000 -0500
16658 +++ linux-2.6.32.49/arch/x86/kernel/kprobes.c 2011-11-18 18:01:52.000000000 -0500
16659 @@ -168,9 +168,13 @@ static void __kprobes set_jmp_op(void *f
16660 char op;
16661 s32 raddr;
16662 } __attribute__((packed)) * jop;
16663 - jop = (struct __arch_jmp_op *)from;
16664 +
16665 + jop = (struct __arch_jmp_op *)(ktla_ktva(from));
16666 +
16667 + pax_open_kernel();
16668 jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
16669 jop->op = RELATIVEJUMP_INSTRUCTION;
16670 + pax_close_kernel();
16671 }
16672
16673 /*
16674 @@ -195,7 +199,7 @@ static int __kprobes can_boost(kprobe_op
16675 kprobe_opcode_t opcode;
16676 kprobe_opcode_t *orig_opcodes = opcodes;
16677
16678 - if (search_exception_tables((unsigned long)opcodes))
16679 + if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
16680 return 0; /* Page fault may occur on this address. */
16681
16682 retry:
16683 @@ -339,7 +343,9 @@ static void __kprobes fix_riprel(struct
16684 disp = (u8 *) p->addr + *((s32 *) insn) -
16685 (u8 *) p->ainsn.insn;
16686 BUG_ON((s64) (s32) disp != disp); /* Sanity check. */
16687 + pax_open_kernel();
16688 *(s32 *)insn = (s32) disp;
16689 + pax_close_kernel();
16690 }
16691 }
16692 #endif
16693 @@ -347,16 +353,18 @@ static void __kprobes fix_riprel(struct
16694
16695 static void __kprobes arch_copy_kprobe(struct kprobe *p)
16696 {
16697 - memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
16698 + pax_open_kernel();
16699 + memcpy(p->ainsn.insn, ktla_ktva(p->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
16700 + pax_close_kernel();
16701
16702 fix_riprel(p);
16703
16704 - if (can_boost(p->addr))
16705 + if (can_boost(ktla_ktva(p->addr)))
16706 p->ainsn.boostable = 0;
16707 else
16708 p->ainsn.boostable = -1;
16709
16710 - p->opcode = *p->addr;
16711 + p->opcode = *(ktla_ktva(p->addr));
16712 }
16713
16714 int __kprobes arch_prepare_kprobe(struct kprobe *p)
16715 @@ -434,7 +442,7 @@ static void __kprobes prepare_singlestep
16716 if (p->opcode == BREAKPOINT_INSTRUCTION)
16717 regs->ip = (unsigned long)p->addr;
16718 else
16719 - regs->ip = (unsigned long)p->ainsn.insn;
16720 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
16721 }
16722
16723 void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
16724 @@ -455,7 +463,7 @@ static void __kprobes setup_singlestep(s
16725 if (p->ainsn.boostable == 1 && !p->post_handler) {
16726 /* Boost up -- we can execute copied instructions directly */
16727 reset_current_kprobe();
16728 - regs->ip = (unsigned long)p->ainsn.insn;
16729 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
16730 preempt_enable_no_resched();
16731 return;
16732 }
16733 @@ -525,7 +533,7 @@ static int __kprobes kprobe_handler(stru
16734 struct kprobe_ctlblk *kcb;
16735
16736 addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
16737 - if (*addr != BREAKPOINT_INSTRUCTION) {
16738 + if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
16739 /*
16740 * The breakpoint instruction was removed right
16741 * after we hit it. Another cpu has removed
16742 @@ -637,6 +645,9 @@ static void __used __kprobes kretprobe_t
16743 /* Skip orig_ax, ip, cs */
16744 " addq $24, %rsp\n"
16745 " popfq\n"
16746 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
16747 + " btsq $63,(%rsp)\n"
16748 +#endif
16749 #else
16750 " pushf\n"
16751 /*
16752 @@ -777,7 +788,7 @@ static void __kprobes resume_execution(s
16753 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
16754 {
16755 unsigned long *tos = stack_addr(regs);
16756 - unsigned long copy_ip = (unsigned long)p->ainsn.insn;
16757 + unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
16758 unsigned long orig_ip = (unsigned long)p->addr;
16759 kprobe_opcode_t *insn = p->ainsn.insn;
16760
16761 @@ -960,7 +971,7 @@ int __kprobes kprobe_exceptions_notify(s
16762 struct die_args *args = data;
16763 int ret = NOTIFY_DONE;
16764
16765 - if (args->regs && user_mode_vm(args->regs))
16766 + if (args->regs && user_mode(args->regs))
16767 return ret;
16768
16769 switch (val) {
16770 diff -urNp linux-2.6.32.49/arch/x86/kernel/kvm.c linux-2.6.32.49/arch/x86/kernel/kvm.c
16771 --- linux-2.6.32.49/arch/x86/kernel/kvm.c 2011-11-08 19:02:43.000000000 -0500
16772 +++ linux-2.6.32.49/arch/x86/kernel/kvm.c 2011-11-15 19:59:43.000000000 -0500
16773 @@ -216,6 +216,7 @@ static void __init paravirt_ops_setup(vo
16774 pv_mmu_ops.set_pud = kvm_set_pud;
16775 #if PAGETABLE_LEVELS == 4
16776 pv_mmu_ops.set_pgd = kvm_set_pgd;
16777 + pv_mmu_ops.set_pgd_batched = kvm_set_pgd;
16778 #endif
16779 #endif
16780 pv_mmu_ops.flush_tlb_user = kvm_flush_tlb;
16781 diff -urNp linux-2.6.32.49/arch/x86/kernel/ldt.c linux-2.6.32.49/arch/x86/kernel/ldt.c
16782 --- linux-2.6.32.49/arch/x86/kernel/ldt.c 2011-11-08 19:02:43.000000000 -0500
16783 +++ linux-2.6.32.49/arch/x86/kernel/ldt.c 2011-11-15 19:59:43.000000000 -0500
16784 @@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, i
16785 if (reload) {
16786 #ifdef CONFIG_SMP
16787 preempt_disable();
16788 - load_LDT(pc);
16789 + load_LDT_nolock(pc);
16790 if (!cpumask_equal(mm_cpumask(current->mm),
16791 cpumask_of(smp_processor_id())))
16792 smp_call_function(flush_ldt, current->mm, 1);
16793 preempt_enable();
16794 #else
16795 - load_LDT(pc);
16796 + load_LDT_nolock(pc);
16797 #endif
16798 }
16799 if (oldsize) {
16800 @@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t
16801 return err;
16802
16803 for (i = 0; i < old->size; i++)
16804 - write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
16805 + write_ldt_entry(new->ldt, i, old->ldt + i);
16806 return 0;
16807 }
16808
16809 @@ -115,6 +115,24 @@ int init_new_context(struct task_struct
16810 retval = copy_ldt(&mm->context, &old_mm->context);
16811 mutex_unlock(&old_mm->context.lock);
16812 }
16813 +
16814 + if (tsk == current) {
16815 + mm->context.vdso = 0;
16816 +
16817 +#ifdef CONFIG_X86_32
16818 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
16819 + mm->context.user_cs_base = 0UL;
16820 + mm->context.user_cs_limit = ~0UL;
16821 +
16822 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
16823 + cpus_clear(mm->context.cpu_user_cs_mask);
16824 +#endif
16825 +
16826 +#endif
16827 +#endif
16828 +
16829 + }
16830 +
16831 return retval;
16832 }
16833
16834 @@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, u
16835 }
16836 }
16837
16838 +#ifdef CONFIG_PAX_SEGMEXEC
16839 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
16840 + error = -EINVAL;
16841 + goto out_unlock;
16842 + }
16843 +#endif
16844 +
16845 fill_ldt(&ldt, &ldt_info);
16846 if (oldmode)
16847 ldt.avl = 0;
16848 diff -urNp linux-2.6.32.49/arch/x86/kernel/machine_kexec_32.c linux-2.6.32.49/arch/x86/kernel/machine_kexec_32.c
16849 --- linux-2.6.32.49/arch/x86/kernel/machine_kexec_32.c 2011-11-08 19:02:43.000000000 -0500
16850 +++ linux-2.6.32.49/arch/x86/kernel/machine_kexec_32.c 2011-11-15 19:59:43.000000000 -0500
16851 @@ -26,7 +26,7 @@
16852 #include <asm/system.h>
16853 #include <asm/cacheflush.h>
16854
16855 -static void set_idt(void *newidt, __u16 limit)
16856 +static void set_idt(struct desc_struct *newidt, __u16 limit)
16857 {
16858 struct desc_ptr curidt;
16859
16860 @@ -38,7 +38,7 @@ static void set_idt(void *newidt, __u16
16861 }
16862
16863
16864 -static void set_gdt(void *newgdt, __u16 limit)
16865 +static void set_gdt(struct desc_struct *newgdt, __u16 limit)
16866 {
16867 struct desc_ptr curgdt;
16868
16869 @@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
16870 }
16871
16872 control_page = page_address(image->control_code_page);
16873 - memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
16874 + memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
16875
16876 relocate_kernel_ptr = control_page;
16877 page_list[PA_CONTROL_PAGE] = __pa(control_page);
16878 diff -urNp linux-2.6.32.49/arch/x86/kernel/microcode_amd.c linux-2.6.32.49/arch/x86/kernel/microcode_amd.c
16879 --- linux-2.6.32.49/arch/x86/kernel/microcode_amd.c 2011-11-08 19:02:43.000000000 -0500
16880 +++ linux-2.6.32.49/arch/x86/kernel/microcode_amd.c 2011-11-15 19:59:43.000000000 -0500
16881 @@ -364,7 +364,7 @@ static void microcode_fini_cpu_amd(int c
16882 uci->mc = NULL;
16883 }
16884
16885 -static struct microcode_ops microcode_amd_ops = {
16886 +static const struct microcode_ops microcode_amd_ops = {
16887 .request_microcode_user = request_microcode_user,
16888 .request_microcode_fw = request_microcode_fw,
16889 .collect_cpu_info = collect_cpu_info_amd,
16890 @@ -372,7 +372,7 @@ static struct microcode_ops microcode_am
16891 .microcode_fini_cpu = microcode_fini_cpu_amd,
16892 };
16893
16894 -struct microcode_ops * __init init_amd_microcode(void)
16895 +const struct microcode_ops * __init init_amd_microcode(void)
16896 {
16897 return &microcode_amd_ops;
16898 }
16899 diff -urNp linux-2.6.32.49/arch/x86/kernel/microcode_core.c linux-2.6.32.49/arch/x86/kernel/microcode_core.c
16900 --- linux-2.6.32.49/arch/x86/kernel/microcode_core.c 2011-11-08 19:02:43.000000000 -0500
16901 +++ linux-2.6.32.49/arch/x86/kernel/microcode_core.c 2011-11-15 19:59:43.000000000 -0500
16902 @@ -90,7 +90,7 @@ MODULE_LICENSE("GPL");
16903
16904 #define MICROCODE_VERSION "2.00"
16905
16906 -static struct microcode_ops *microcode_ops;
16907 +static const struct microcode_ops *microcode_ops;
16908
16909 /*
16910 * Synchronization.
16911 diff -urNp linux-2.6.32.49/arch/x86/kernel/microcode_intel.c linux-2.6.32.49/arch/x86/kernel/microcode_intel.c
16912 --- linux-2.6.32.49/arch/x86/kernel/microcode_intel.c 2011-11-08 19:02:43.000000000 -0500
16913 +++ linux-2.6.32.49/arch/x86/kernel/microcode_intel.c 2011-11-15 19:59:43.000000000 -0500
16914 @@ -443,13 +443,13 @@ static enum ucode_state request_microcod
16915
16916 static int get_ucode_user(void *to, const void *from, size_t n)
16917 {
16918 - return copy_from_user(to, from, n);
16919 + return copy_from_user(to, (const void __force_user *)from, n);
16920 }
16921
16922 static enum ucode_state
16923 request_microcode_user(int cpu, const void __user *buf, size_t size)
16924 {
16925 - return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
16926 + return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user);
16927 }
16928
16929 static void microcode_fini_cpu(int cpu)
16930 @@ -460,7 +460,7 @@ static void microcode_fini_cpu(int cpu)
16931 uci->mc = NULL;
16932 }
16933
16934 -static struct microcode_ops microcode_intel_ops = {
16935 +static const struct microcode_ops microcode_intel_ops = {
16936 .request_microcode_user = request_microcode_user,
16937 .request_microcode_fw = request_microcode_fw,
16938 .collect_cpu_info = collect_cpu_info,
16939 @@ -468,7 +468,7 @@ static struct microcode_ops microcode_in
16940 .microcode_fini_cpu = microcode_fini_cpu,
16941 };
16942
16943 -struct microcode_ops * __init init_intel_microcode(void)
16944 +const struct microcode_ops * __init init_intel_microcode(void)
16945 {
16946 return &microcode_intel_ops;
16947 }
16948 diff -urNp linux-2.6.32.49/arch/x86/kernel/module.c linux-2.6.32.49/arch/x86/kernel/module.c
16949 --- linux-2.6.32.49/arch/x86/kernel/module.c 2011-11-08 19:02:43.000000000 -0500
16950 +++ linux-2.6.32.49/arch/x86/kernel/module.c 2011-11-15 19:59:43.000000000 -0500
16951 @@ -34,7 +34,7 @@
16952 #define DEBUGP(fmt...)
16953 #endif
16954
16955 -void *module_alloc(unsigned long size)
16956 +static void *__module_alloc(unsigned long size, pgprot_t prot)
16957 {
16958 struct vm_struct *area;
16959
16960 @@ -48,8 +48,18 @@ void *module_alloc(unsigned long size)
16961 if (!area)
16962 return NULL;
16963
16964 - return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM,
16965 - PAGE_KERNEL_EXEC);
16966 + return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot);
16967 +}
16968 +
16969 +void *module_alloc(unsigned long size)
16970 +{
16971 +
16972 +#ifdef CONFIG_PAX_KERNEXEC
16973 + return __module_alloc(size, PAGE_KERNEL);
16974 +#else
16975 + return __module_alloc(size, PAGE_KERNEL_EXEC);
16976 +#endif
16977 +
16978 }
16979
16980 /* Free memory returned from module_alloc */
16981 @@ -58,6 +68,40 @@ void module_free(struct module *mod, voi
16982 vfree(module_region);
16983 }
16984
16985 +#ifdef CONFIG_PAX_KERNEXEC
16986 +#ifdef CONFIG_X86_32
16987 +void *module_alloc_exec(unsigned long size)
16988 +{
16989 + struct vm_struct *area;
16990 +
16991 + if (size == 0)
16992 + return NULL;
16993 +
16994 + area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
16995 + return area ? area->addr : NULL;
16996 +}
16997 +EXPORT_SYMBOL(module_alloc_exec);
16998 +
16999 +void module_free_exec(struct module *mod, void *module_region)
17000 +{
17001 + vunmap(module_region);
17002 +}
17003 +EXPORT_SYMBOL(module_free_exec);
17004 +#else
17005 +void module_free_exec(struct module *mod, void *module_region)
17006 +{
17007 + module_free(mod, module_region);
17008 +}
17009 +EXPORT_SYMBOL(module_free_exec);
17010 +
17011 +void *module_alloc_exec(unsigned long size)
17012 +{
17013 + return __module_alloc(size, PAGE_KERNEL_RX);
17014 +}
17015 +EXPORT_SYMBOL(module_alloc_exec);
17016 +#endif
17017 +#endif
17018 +
17019 /* We don't need anything special. */
17020 int module_frob_arch_sections(Elf_Ehdr *hdr,
17021 Elf_Shdr *sechdrs,
17022 @@ -77,14 +121,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
17023 unsigned int i;
17024 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
17025 Elf32_Sym *sym;
17026 - uint32_t *location;
17027 + uint32_t *plocation, location;
17028
17029 DEBUGP("Applying relocate section %u to %u\n", relsec,
17030 sechdrs[relsec].sh_info);
17031 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
17032 /* This is where to make the change */
17033 - location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
17034 - + rel[i].r_offset;
17035 + plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
17036 + location = (uint32_t)plocation;
17037 + if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
17038 + plocation = ktla_ktva((void *)plocation);
17039 /* This is the symbol it is referring to. Note that all
17040 undefined symbols have been resolved. */
17041 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
17042 @@ -93,11 +139,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
17043 switch (ELF32_R_TYPE(rel[i].r_info)) {
17044 case R_386_32:
17045 /* We add the value into the location given */
17046 - *location += sym->st_value;
17047 + pax_open_kernel();
17048 + *plocation += sym->st_value;
17049 + pax_close_kernel();
17050 break;
17051 case R_386_PC32:
17052 /* Add the value, subtract its postition */
17053 - *location += sym->st_value - (uint32_t)location;
17054 + pax_open_kernel();
17055 + *plocation += sym->st_value - location;
17056 + pax_close_kernel();
17057 break;
17058 default:
17059 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
17060 @@ -153,21 +203,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
17061 case R_X86_64_NONE:
17062 break;
17063 case R_X86_64_64:
17064 + pax_open_kernel();
17065 *(u64 *)loc = val;
17066 + pax_close_kernel();
17067 break;
17068 case R_X86_64_32:
17069 + pax_open_kernel();
17070 *(u32 *)loc = val;
17071 + pax_close_kernel();
17072 if (val != *(u32 *)loc)
17073 goto overflow;
17074 break;
17075 case R_X86_64_32S:
17076 + pax_open_kernel();
17077 *(s32 *)loc = val;
17078 + pax_close_kernel();
17079 if ((s64)val != *(s32 *)loc)
17080 goto overflow;
17081 break;
17082 case R_X86_64_PC32:
17083 val -= (u64)loc;
17084 + pax_open_kernel();
17085 *(u32 *)loc = val;
17086 + pax_close_kernel();
17087 +
17088 #if 0
17089 if ((s64)val != *(s32 *)loc)
17090 goto overflow;
17091 diff -urNp linux-2.6.32.49/arch/x86/kernel/paravirt.c linux-2.6.32.49/arch/x86/kernel/paravirt.c
17092 --- linux-2.6.32.49/arch/x86/kernel/paravirt.c 2011-11-08 19:02:43.000000000 -0500
17093 +++ linux-2.6.32.49/arch/x86/kernel/paravirt.c 2011-11-15 19:59:43.000000000 -0500
17094 @@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
17095 {
17096 return x;
17097 }
17098 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
17099 +PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
17100 +#endif
17101
17102 void __init default_banner(void)
17103 {
17104 @@ -122,7 +125,7 @@ unsigned paravirt_patch_jmp(void *insnbu
17105 * corresponding structure. */
17106 static void *get_call_destination(u8 type)
17107 {
17108 - struct paravirt_patch_template tmpl = {
17109 + const struct paravirt_patch_template tmpl = {
17110 .pv_init_ops = pv_init_ops,
17111 .pv_time_ops = pv_time_ops,
17112 .pv_cpu_ops = pv_cpu_ops,
17113 @@ -133,6 +136,8 @@ static void *get_call_destination(u8 typ
17114 .pv_lock_ops = pv_lock_ops,
17115 #endif
17116 };
17117 +
17118 + pax_track_stack();
17119 return *((void **)&tmpl + type);
17120 }
17121
17122 @@ -145,15 +150,19 @@ unsigned paravirt_patch_default(u8 type,
17123 if (opfunc == NULL)
17124 /* If there's no function, patch it with a ud2a (BUG) */
17125 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
17126 - else if (opfunc == _paravirt_nop)
17127 + else if (opfunc == (void *)_paravirt_nop)
17128 /* If the operation is a nop, then nop the callsite */
17129 ret = paravirt_patch_nop();
17130
17131 /* identity functions just return their single argument */
17132 - else if (opfunc == _paravirt_ident_32)
17133 + else if (opfunc == (void *)_paravirt_ident_32)
17134 ret = paravirt_patch_ident_32(insnbuf, len);
17135 - else if (opfunc == _paravirt_ident_64)
17136 + else if (opfunc == (void *)_paravirt_ident_64)
17137 + ret = paravirt_patch_ident_64(insnbuf, len);
17138 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
17139 + else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
17140 ret = paravirt_patch_ident_64(insnbuf, len);
17141 +#endif
17142
17143 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
17144 type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
17145 @@ -178,7 +187,7 @@ unsigned paravirt_patch_insns(void *insn
17146 if (insn_len > len || start == NULL)
17147 insn_len = len;
17148 else
17149 - memcpy(insnbuf, start, insn_len);
17150 + memcpy(insnbuf, ktla_ktva(start), insn_len);
17151
17152 return insn_len;
17153 }
17154 @@ -294,22 +303,22 @@ void arch_flush_lazy_mmu_mode(void)
17155 preempt_enable();
17156 }
17157
17158 -struct pv_info pv_info = {
17159 +struct pv_info pv_info __read_only = {
17160 .name = "bare hardware",
17161 .paravirt_enabled = 0,
17162 .kernel_rpl = 0,
17163 .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
17164 };
17165
17166 -struct pv_init_ops pv_init_ops = {
17167 +struct pv_init_ops pv_init_ops __read_only = {
17168 .patch = native_patch,
17169 };
17170
17171 -struct pv_time_ops pv_time_ops = {
17172 +struct pv_time_ops pv_time_ops __read_only = {
17173 .sched_clock = native_sched_clock,
17174 };
17175
17176 -struct pv_irq_ops pv_irq_ops = {
17177 +struct pv_irq_ops pv_irq_ops __read_only = {
17178 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
17179 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
17180 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
17181 @@ -321,7 +330,7 @@ struct pv_irq_ops pv_irq_ops = {
17182 #endif
17183 };
17184
17185 -struct pv_cpu_ops pv_cpu_ops = {
17186 +struct pv_cpu_ops pv_cpu_ops __read_only = {
17187 .cpuid = native_cpuid,
17188 .get_debugreg = native_get_debugreg,
17189 .set_debugreg = native_set_debugreg,
17190 @@ -382,21 +391,26 @@ struct pv_cpu_ops pv_cpu_ops = {
17191 .end_context_switch = paravirt_nop,
17192 };
17193
17194 -struct pv_apic_ops pv_apic_ops = {
17195 +struct pv_apic_ops pv_apic_ops __read_only = {
17196 #ifdef CONFIG_X86_LOCAL_APIC
17197 .startup_ipi_hook = paravirt_nop,
17198 #endif
17199 };
17200
17201 -#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
17202 +#ifdef CONFIG_X86_32
17203 +#ifdef CONFIG_X86_PAE
17204 +/* 64-bit pagetable entries */
17205 +#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
17206 +#else
17207 /* 32-bit pagetable entries */
17208 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
17209 +#endif
17210 #else
17211 /* 64-bit pagetable entries */
17212 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
17213 #endif
17214
17215 -struct pv_mmu_ops pv_mmu_ops = {
17216 +struct pv_mmu_ops pv_mmu_ops __read_only = {
17217
17218 .read_cr2 = native_read_cr2,
17219 .write_cr2 = native_write_cr2,
17220 @@ -448,6 +462,7 @@ struct pv_mmu_ops pv_mmu_ops = {
17221 .make_pud = PTE_IDENT,
17222
17223 .set_pgd = native_set_pgd,
17224 + .set_pgd_batched = native_set_pgd_batched,
17225 #endif
17226 #endif /* PAGETABLE_LEVELS >= 3 */
17227
17228 @@ -467,6 +482,12 @@ struct pv_mmu_ops pv_mmu_ops = {
17229 },
17230
17231 .set_fixmap = native_set_fixmap,
17232 +
17233 +#ifdef CONFIG_PAX_KERNEXEC
17234 + .pax_open_kernel = native_pax_open_kernel,
17235 + .pax_close_kernel = native_pax_close_kernel,
17236 +#endif
17237 +
17238 };
17239
17240 EXPORT_SYMBOL_GPL(pv_time_ops);
17241 diff -urNp linux-2.6.32.49/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.32.49/arch/x86/kernel/paravirt-spinlocks.c
17242 --- linux-2.6.32.49/arch/x86/kernel/paravirt-spinlocks.c 2011-11-08 19:02:43.000000000 -0500
17243 +++ linux-2.6.32.49/arch/x86/kernel/paravirt-spinlocks.c 2011-11-15 19:59:43.000000000 -0500
17244 @@ -13,7 +13,7 @@ default_spin_lock_flags(raw_spinlock_t *
17245 __raw_spin_lock(lock);
17246 }
17247
17248 -struct pv_lock_ops pv_lock_ops = {
17249 +struct pv_lock_ops pv_lock_ops __read_only = {
17250 #ifdef CONFIG_SMP
17251 .spin_is_locked = __ticket_spin_is_locked,
17252 .spin_is_contended = __ticket_spin_is_contended,
17253 diff -urNp linux-2.6.32.49/arch/x86/kernel/pci-calgary_64.c linux-2.6.32.49/arch/x86/kernel/pci-calgary_64.c
17254 --- linux-2.6.32.49/arch/x86/kernel/pci-calgary_64.c 2011-11-08 19:02:43.000000000 -0500
17255 +++ linux-2.6.32.49/arch/x86/kernel/pci-calgary_64.c 2011-11-15 19:59:43.000000000 -0500
17256 @@ -477,7 +477,7 @@ static void calgary_free_coherent(struct
17257 free_pages((unsigned long)vaddr, get_order(size));
17258 }
17259
17260 -static struct dma_map_ops calgary_dma_ops = {
17261 +static const struct dma_map_ops calgary_dma_ops = {
17262 .alloc_coherent = calgary_alloc_coherent,
17263 .free_coherent = calgary_free_coherent,
17264 .map_sg = calgary_map_sg,
17265 diff -urNp linux-2.6.32.49/arch/x86/kernel/pci-dma.c linux-2.6.32.49/arch/x86/kernel/pci-dma.c
17266 --- linux-2.6.32.49/arch/x86/kernel/pci-dma.c 2011-11-08 19:02:43.000000000 -0500
17267 +++ linux-2.6.32.49/arch/x86/kernel/pci-dma.c 2011-11-15 19:59:43.000000000 -0500
17268 @@ -14,7 +14,7 @@
17269
17270 static int forbid_dac __read_mostly;
17271
17272 -struct dma_map_ops *dma_ops;
17273 +const struct dma_map_ops *dma_ops;
17274 EXPORT_SYMBOL(dma_ops);
17275
17276 static int iommu_sac_force __read_mostly;
17277 @@ -243,7 +243,7 @@ early_param("iommu", iommu_setup);
17278
17279 int dma_supported(struct device *dev, u64 mask)
17280 {
17281 - struct dma_map_ops *ops = get_dma_ops(dev);
17282 + const struct dma_map_ops *ops = get_dma_ops(dev);
17283
17284 #ifdef CONFIG_PCI
17285 if (mask > 0xffffffff && forbid_dac > 0) {
17286 diff -urNp linux-2.6.32.49/arch/x86/kernel/pci-gart_64.c linux-2.6.32.49/arch/x86/kernel/pci-gart_64.c
17287 --- linux-2.6.32.49/arch/x86/kernel/pci-gart_64.c 2011-11-08 19:02:43.000000000 -0500
17288 +++ linux-2.6.32.49/arch/x86/kernel/pci-gart_64.c 2011-11-15 19:59:43.000000000 -0500
17289 @@ -682,7 +682,7 @@ static __init int init_k8_gatt(struct ag
17290 return -1;
17291 }
17292
17293 -static struct dma_map_ops gart_dma_ops = {
17294 +static const struct dma_map_ops gart_dma_ops = {
17295 .map_sg = gart_map_sg,
17296 .unmap_sg = gart_unmap_sg,
17297 .map_page = gart_map_page,
17298 diff -urNp linux-2.6.32.49/arch/x86/kernel/pci-nommu.c linux-2.6.32.49/arch/x86/kernel/pci-nommu.c
17299 --- linux-2.6.32.49/arch/x86/kernel/pci-nommu.c 2011-11-08 19:02:43.000000000 -0500
17300 +++ linux-2.6.32.49/arch/x86/kernel/pci-nommu.c 2011-11-15 19:59:43.000000000 -0500
17301 @@ -94,7 +94,7 @@ static void nommu_sync_sg_for_device(str
17302 flush_write_buffers();
17303 }
17304
17305 -struct dma_map_ops nommu_dma_ops = {
17306 +const struct dma_map_ops nommu_dma_ops = {
17307 .alloc_coherent = dma_generic_alloc_coherent,
17308 .free_coherent = nommu_free_coherent,
17309 .map_sg = nommu_map_sg,
17310 diff -urNp linux-2.6.32.49/arch/x86/kernel/pci-swiotlb.c linux-2.6.32.49/arch/x86/kernel/pci-swiotlb.c
17311 --- linux-2.6.32.49/arch/x86/kernel/pci-swiotlb.c 2011-11-08 19:02:43.000000000 -0500
17312 +++ linux-2.6.32.49/arch/x86/kernel/pci-swiotlb.c 2011-11-15 19:59:43.000000000 -0500
17313 @@ -25,7 +25,7 @@ static void *x86_swiotlb_alloc_coherent(
17314 return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
17315 }
17316
17317 -static struct dma_map_ops swiotlb_dma_ops = {
17318 +static const struct dma_map_ops swiotlb_dma_ops = {
17319 .mapping_error = swiotlb_dma_mapping_error,
17320 .alloc_coherent = x86_swiotlb_alloc_coherent,
17321 .free_coherent = swiotlb_free_coherent,
17322 diff -urNp linux-2.6.32.49/arch/x86/kernel/process_32.c linux-2.6.32.49/arch/x86/kernel/process_32.c
17323 --- linux-2.6.32.49/arch/x86/kernel/process_32.c 2011-11-08 19:02:43.000000000 -0500
17324 +++ linux-2.6.32.49/arch/x86/kernel/process_32.c 2011-11-15 19:59:43.000000000 -0500
17325 @@ -67,6 +67,7 @@ asmlinkage void ret_from_fork(void) __as
17326 unsigned long thread_saved_pc(struct task_struct *tsk)
17327 {
17328 return ((unsigned long *)tsk->thread.sp)[3];
17329 +//XXX return tsk->thread.eip;
17330 }
17331
17332 #ifndef CONFIG_SMP
17333 @@ -129,15 +130,14 @@ void __show_regs(struct pt_regs *regs, i
17334 unsigned short ss, gs;
17335 const char *board;
17336
17337 - if (user_mode_vm(regs)) {
17338 + if (user_mode(regs)) {
17339 sp = regs->sp;
17340 ss = regs->ss & 0xffff;
17341 - gs = get_user_gs(regs);
17342 } else {
17343 sp = (unsigned long) (&regs->sp);
17344 savesegment(ss, ss);
17345 - savesegment(gs, gs);
17346 }
17347 + gs = get_user_gs(regs);
17348
17349 printk("\n");
17350
17351 @@ -210,10 +210,10 @@ int kernel_thread(int (*fn)(void *), voi
17352 regs.bx = (unsigned long) fn;
17353 regs.dx = (unsigned long) arg;
17354
17355 - regs.ds = __USER_DS;
17356 - regs.es = __USER_DS;
17357 + regs.ds = __KERNEL_DS;
17358 + regs.es = __KERNEL_DS;
17359 regs.fs = __KERNEL_PERCPU;
17360 - regs.gs = __KERNEL_STACK_CANARY;
17361 + savesegment(gs, regs.gs);
17362 regs.orig_ax = -1;
17363 regs.ip = (unsigned long) kernel_thread_helper;
17364 regs.cs = __KERNEL_CS | get_kernel_rpl();
17365 @@ -247,13 +247,14 @@ int copy_thread(unsigned long clone_flag
17366 struct task_struct *tsk;
17367 int err;
17368
17369 - childregs = task_pt_regs(p);
17370 + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
17371 *childregs = *regs;
17372 childregs->ax = 0;
17373 childregs->sp = sp;
17374
17375 p->thread.sp = (unsigned long) childregs;
17376 p->thread.sp0 = (unsigned long) (childregs+1);
17377 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
17378
17379 p->thread.ip = (unsigned long) ret_from_fork;
17380
17381 @@ -345,7 +346,7 @@ __switch_to(struct task_struct *prev_p,
17382 struct thread_struct *prev = &prev_p->thread,
17383 *next = &next_p->thread;
17384 int cpu = smp_processor_id();
17385 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
17386 + struct tss_struct *tss = init_tss + cpu;
17387 bool preload_fpu;
17388
17389 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
17390 @@ -380,6 +381,10 @@ __switch_to(struct task_struct *prev_p,
17391 */
17392 lazy_save_gs(prev->gs);
17393
17394 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17395 + __set_fs(task_thread_info(next_p)->addr_limit);
17396 +#endif
17397 +
17398 /*
17399 * Load the per-thread Thread-Local Storage descriptor.
17400 */
17401 @@ -415,6 +420,9 @@ __switch_to(struct task_struct *prev_p,
17402 */
17403 arch_end_context_switch(next_p);
17404
17405 + percpu_write(current_task, next_p);
17406 + percpu_write(current_tinfo, &next_p->tinfo);
17407 +
17408 if (preload_fpu)
17409 __math_state_restore();
17410
17411 @@ -424,8 +432,6 @@ __switch_to(struct task_struct *prev_p,
17412 if (prev->gs | next->gs)
17413 lazy_load_gs(next->gs);
17414
17415 - percpu_write(current_task, next_p);
17416 -
17417 return prev_p;
17418 }
17419
17420 @@ -495,4 +501,3 @@ unsigned long get_wchan(struct task_stru
17421 } while (count++ < 16);
17422 return 0;
17423 }
17424 -
17425 diff -urNp linux-2.6.32.49/arch/x86/kernel/process_64.c linux-2.6.32.49/arch/x86/kernel/process_64.c
17426 --- linux-2.6.32.49/arch/x86/kernel/process_64.c 2011-11-08 19:02:43.000000000 -0500
17427 +++ linux-2.6.32.49/arch/x86/kernel/process_64.c 2011-11-15 19:59:43.000000000 -0500
17428 @@ -91,7 +91,7 @@ static void __exit_idle(void)
17429 void exit_idle(void)
17430 {
17431 /* idle loop has pid 0 */
17432 - if (current->pid)
17433 + if (task_pid_nr(current))
17434 return;
17435 __exit_idle();
17436 }
17437 @@ -170,7 +170,7 @@ void __show_regs(struct pt_regs *regs, i
17438 if (!board)
17439 board = "";
17440 printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
17441 - current->pid, current->comm, print_tainted(),
17442 + task_pid_nr(current), current->comm, print_tainted(),
17443 init_utsname()->release,
17444 (int)strcspn(init_utsname()->version, " "),
17445 init_utsname()->version, board);
17446 @@ -280,8 +280,7 @@ int copy_thread(unsigned long clone_flag
17447 struct pt_regs *childregs;
17448 struct task_struct *me = current;
17449
17450 - childregs = ((struct pt_regs *)
17451 - (THREAD_SIZE + task_stack_page(p))) - 1;
17452 + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
17453 *childregs = *regs;
17454
17455 childregs->ax = 0;
17456 @@ -292,6 +291,7 @@ int copy_thread(unsigned long clone_flag
17457 p->thread.sp = (unsigned long) childregs;
17458 p->thread.sp0 = (unsigned long) (childregs+1);
17459 p->thread.usersp = me->thread.usersp;
17460 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
17461
17462 set_tsk_thread_flag(p, TIF_FORK);
17463
17464 @@ -379,7 +379,7 @@ __switch_to(struct task_struct *prev_p,
17465 struct thread_struct *prev = &prev_p->thread;
17466 struct thread_struct *next = &next_p->thread;
17467 int cpu = smp_processor_id();
17468 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
17469 + struct tss_struct *tss = init_tss + cpu;
17470 unsigned fsindex, gsindex;
17471 bool preload_fpu;
17472
17473 @@ -475,10 +475,9 @@ __switch_to(struct task_struct *prev_p,
17474 prev->usersp = percpu_read(old_rsp);
17475 percpu_write(old_rsp, next->usersp);
17476 percpu_write(current_task, next_p);
17477 + percpu_write(current_tinfo, &next_p->tinfo);
17478
17479 - percpu_write(kernel_stack,
17480 - (unsigned long)task_stack_page(next_p) +
17481 - THREAD_SIZE - KERNEL_STACK_OFFSET);
17482 + percpu_write(kernel_stack, next->sp0);
17483
17484 /*
17485 * Now maybe reload the debug registers and handle I/O bitmaps
17486 @@ -559,12 +558,11 @@ unsigned long get_wchan(struct task_stru
17487 if (!p || p == current || p->state == TASK_RUNNING)
17488 return 0;
17489 stack = (unsigned long)task_stack_page(p);
17490 - if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
17491 + if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
17492 return 0;
17493 fp = *(u64 *)(p->thread.sp);
17494 do {
17495 - if (fp < (unsigned long)stack ||
17496 - fp >= (unsigned long)stack+THREAD_SIZE)
17497 + if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
17498 return 0;
17499 ip = *(u64 *)(fp+8);
17500 if (!in_sched_functions(ip))
17501 diff -urNp linux-2.6.32.49/arch/x86/kernel/process.c linux-2.6.32.49/arch/x86/kernel/process.c
17502 --- linux-2.6.32.49/arch/x86/kernel/process.c 2011-11-08 19:02:43.000000000 -0500
17503 +++ linux-2.6.32.49/arch/x86/kernel/process.c 2011-11-15 19:59:43.000000000 -0500
17504 @@ -51,16 +51,33 @@ void free_thread_xstate(struct task_stru
17505
17506 void free_thread_info(struct thread_info *ti)
17507 {
17508 - free_thread_xstate(ti->task);
17509 free_pages((unsigned long)ti, get_order(THREAD_SIZE));
17510 }
17511
17512 +static struct kmem_cache *task_struct_cachep;
17513 +
17514 void arch_task_cache_init(void)
17515 {
17516 - task_xstate_cachep =
17517 - kmem_cache_create("task_xstate", xstate_size,
17518 + /* create a slab on which task_structs can be allocated */
17519 + task_struct_cachep =
17520 + kmem_cache_create("task_struct", sizeof(struct task_struct),
17521 + ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
17522 +
17523 + task_xstate_cachep =
17524 + kmem_cache_create("task_xstate", xstate_size,
17525 __alignof__(union thread_xstate),
17526 - SLAB_PANIC | SLAB_NOTRACK, NULL);
17527 + SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
17528 +}
17529 +
17530 +struct task_struct *alloc_task_struct(void)
17531 +{
17532 + return kmem_cache_alloc(task_struct_cachep, GFP_KERNEL);
17533 +}
17534 +
17535 +void free_task_struct(struct task_struct *task)
17536 +{
17537 + free_thread_xstate(task);
17538 + kmem_cache_free(task_struct_cachep, task);
17539 }
17540
17541 /*
17542 @@ -73,7 +90,7 @@ void exit_thread(void)
17543 unsigned long *bp = t->io_bitmap_ptr;
17544
17545 if (bp) {
17546 - struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
17547 + struct tss_struct *tss = init_tss + get_cpu();
17548
17549 t->io_bitmap_ptr = NULL;
17550 clear_thread_flag(TIF_IO_BITMAP);
17551 @@ -93,6 +110,9 @@ void flush_thread(void)
17552
17553 clear_tsk_thread_flag(tsk, TIF_DEBUG);
17554
17555 +#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
17556 + loadsegment(gs, 0);
17557 +#endif
17558 tsk->thread.debugreg0 = 0;
17559 tsk->thread.debugreg1 = 0;
17560 tsk->thread.debugreg2 = 0;
17561 @@ -307,7 +327,7 @@ void default_idle(void)
17562 EXPORT_SYMBOL(default_idle);
17563 #endif
17564
17565 -void stop_this_cpu(void *dummy)
17566 +__noreturn void stop_this_cpu(void *dummy)
17567 {
17568 local_irq_disable();
17569 /*
17570 @@ -568,16 +588,38 @@ static int __init idle_setup(char *str)
17571 }
17572 early_param("idle", idle_setup);
17573
17574 -unsigned long arch_align_stack(unsigned long sp)
17575 +#ifdef CONFIG_PAX_RANDKSTACK
17576 +void pax_randomize_kstack(struct pt_regs *regs)
17577 {
17578 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
17579 - sp -= get_random_int() % 8192;
17580 - return sp & ~0xf;
17581 -}
17582 + struct thread_struct *thread = &current->thread;
17583 + unsigned long time;
17584
17585 -unsigned long arch_randomize_brk(struct mm_struct *mm)
17586 -{
17587 - unsigned long range_end = mm->brk + 0x02000000;
17588 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
17589 + if (!randomize_va_space)
17590 + return;
17591 +
17592 + if (v8086_mode(regs))
17593 + return;
17594 +
17595 + rdtscl(time);
17596 +
17597 + /* P4 seems to return a 0 LSB, ignore it */
17598 +#ifdef CONFIG_MPENTIUM4
17599 + time &= 0x3EUL;
17600 + time <<= 2;
17601 +#elif defined(CONFIG_X86_64)
17602 + time &= 0xFUL;
17603 + time <<= 4;
17604 +#else
17605 + time &= 0x1FUL;
17606 + time <<= 3;
17607 +#endif
17608 +
17609 + thread->sp0 ^= time;
17610 + load_sp0(init_tss + smp_processor_id(), thread);
17611 +
17612 +#ifdef CONFIG_X86_64
17613 + percpu_write(kernel_stack, thread->sp0);
17614 +#endif
17615 }
17616 +#endif
17617
17618 diff -urNp linux-2.6.32.49/arch/x86/kernel/ptrace.c linux-2.6.32.49/arch/x86/kernel/ptrace.c
17619 --- linux-2.6.32.49/arch/x86/kernel/ptrace.c 2011-11-08 19:02:43.000000000 -0500
17620 +++ linux-2.6.32.49/arch/x86/kernel/ptrace.c 2011-11-15 19:59:43.000000000 -0500
17621 @@ -925,7 +925,7 @@ static const struct user_regset_view use
17622 long arch_ptrace(struct task_struct *child, long request, long addr, long data)
17623 {
17624 int ret;
17625 - unsigned long __user *datap = (unsigned long __user *)data;
17626 + unsigned long __user *datap = (__force unsigned long __user *)data;
17627
17628 switch (request) {
17629 /* read the word at location addr in the USER area. */
17630 @@ -1012,14 +1012,14 @@ long arch_ptrace(struct task_struct *chi
17631 if (addr < 0)
17632 return -EIO;
17633 ret = do_get_thread_area(child, addr,
17634 - (struct user_desc __user *) data);
17635 + (__force struct user_desc __user *) data);
17636 break;
17637
17638 case PTRACE_SET_THREAD_AREA:
17639 if (addr < 0)
17640 return -EIO;
17641 ret = do_set_thread_area(child, addr,
17642 - (struct user_desc __user *) data, 0);
17643 + (__force struct user_desc __user *) data, 0);
17644 break;
17645 #endif
17646
17647 @@ -1038,12 +1038,12 @@ long arch_ptrace(struct task_struct *chi
17648 #ifdef CONFIG_X86_PTRACE_BTS
17649 case PTRACE_BTS_CONFIG:
17650 ret = ptrace_bts_config
17651 - (child, data, (struct ptrace_bts_config __user *)addr);
17652 + (child, data, (__force struct ptrace_bts_config __user *)addr);
17653 break;
17654
17655 case PTRACE_BTS_STATUS:
17656 ret = ptrace_bts_status
17657 - (child, data, (struct ptrace_bts_config __user *)addr);
17658 + (child, data, (__force struct ptrace_bts_config __user *)addr);
17659 break;
17660
17661 case PTRACE_BTS_SIZE:
17662 @@ -1052,7 +1052,7 @@ long arch_ptrace(struct task_struct *chi
17663
17664 case PTRACE_BTS_GET:
17665 ret = ptrace_bts_read_record
17666 - (child, data, (struct bts_struct __user *) addr);
17667 + (child, data, (__force struct bts_struct __user *) addr);
17668 break;
17669
17670 case PTRACE_BTS_CLEAR:
17671 @@ -1061,7 +1061,7 @@ long arch_ptrace(struct task_struct *chi
17672
17673 case PTRACE_BTS_DRAIN:
17674 ret = ptrace_bts_drain
17675 - (child, data, (struct bts_struct __user *) addr);
17676 + (child, data, (__force struct bts_struct __user *) addr);
17677 break;
17678 #endif /* CONFIG_X86_PTRACE_BTS */
17679
17680 @@ -1450,7 +1450,7 @@ void send_sigtrap(struct task_struct *ts
17681 info.si_code = si_code;
17682
17683 /* User-mode ip? */
17684 - info.si_addr = user_mode_vm(regs) ? (void __user *) regs->ip : NULL;
17685 + info.si_addr = user_mode(regs) ? (__force void __user *) regs->ip : NULL;
17686
17687 /* Send us the fake SIGTRAP */
17688 force_sig_info(SIGTRAP, &info, tsk);
17689 @@ -1469,7 +1469,7 @@ void send_sigtrap(struct task_struct *ts
17690 * We must return the syscall number to actually look up in the table.
17691 * This can be -1L to skip running any syscall at all.
17692 */
17693 -asmregparm long syscall_trace_enter(struct pt_regs *regs)
17694 +long syscall_trace_enter(struct pt_regs *regs)
17695 {
17696 long ret = 0;
17697
17698 @@ -1514,7 +1514,7 @@ asmregparm long syscall_trace_enter(stru
17699 return ret ?: regs->orig_ax;
17700 }
17701
17702 -asmregparm void syscall_trace_leave(struct pt_regs *regs)
17703 +void syscall_trace_leave(struct pt_regs *regs)
17704 {
17705 if (unlikely(current->audit_context))
17706 audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
17707 diff -urNp linux-2.6.32.49/arch/x86/kernel/reboot.c linux-2.6.32.49/arch/x86/kernel/reboot.c
17708 --- linux-2.6.32.49/arch/x86/kernel/reboot.c 2011-11-08 19:02:43.000000000 -0500
17709 +++ linux-2.6.32.49/arch/x86/kernel/reboot.c 2011-11-15 19:59:43.000000000 -0500
17710 @@ -33,7 +33,7 @@ void (*pm_power_off)(void);
17711 EXPORT_SYMBOL(pm_power_off);
17712
17713 static const struct desc_ptr no_idt = {};
17714 -static int reboot_mode;
17715 +static unsigned short reboot_mode;
17716 enum reboot_type reboot_type = BOOT_KBD;
17717 int reboot_force;
17718
17719 @@ -292,12 +292,12 @@ core_initcall(reboot_init);
17720 controller to pulse the CPU reset line, which is more thorough, but
17721 doesn't work with at least one type of 486 motherboard. It is easy
17722 to stop this code working; hence the copious comments. */
17723 -static const unsigned long long
17724 -real_mode_gdt_entries [3] =
17725 +static struct desc_struct
17726 +real_mode_gdt_entries [3] __read_only =
17727 {
17728 - 0x0000000000000000ULL, /* Null descriptor */
17729 - 0x00009b000000ffffULL, /* 16-bit real-mode 64k code at 0x00000000 */
17730 - 0x000093000100ffffULL /* 16-bit real-mode 64k data at 0x00000100 */
17731 + GDT_ENTRY_INIT(0, 0, 0), /* Null descriptor */
17732 + GDT_ENTRY_INIT(0x9b, 0, 0xffff), /* 16-bit real-mode 64k code at 0x00000000 */
17733 + GDT_ENTRY_INIT(0x93, 0x100, 0xffff) /* 16-bit real-mode 64k data at 0x00000100 */
17734 };
17735
17736 static const struct desc_ptr
17737 @@ -346,7 +346,7 @@ static const unsigned char jump_to_bios
17738 * specified by the code and length parameters.
17739 * We assume that length will aways be less that 100!
17740 */
17741 -void machine_real_restart(const unsigned char *code, int length)
17742 +__noreturn void machine_real_restart(const unsigned char *code, unsigned int length)
17743 {
17744 local_irq_disable();
17745
17746 @@ -366,8 +366,8 @@ void machine_real_restart(const unsigned
17747 /* Remap the kernel at virtual address zero, as well as offset zero
17748 from the kernel segment. This assumes the kernel segment starts at
17749 virtual address PAGE_OFFSET. */
17750 - memcpy(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
17751 - sizeof(swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
17752 + clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
17753 + min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
17754
17755 /*
17756 * Use `swapper_pg_dir' as our page directory.
17757 @@ -379,16 +379,15 @@ void machine_real_restart(const unsigned
17758 boot)". This seems like a fairly standard thing that gets set by
17759 REBOOT.COM programs, and the previous reset routine did this
17760 too. */
17761 - *((unsigned short *)0x472) = reboot_mode;
17762 + *(unsigned short *)(__va(0x472)) = reboot_mode;
17763
17764 /* For the switch to real mode, copy some code to low memory. It has
17765 to be in the first 64k because it is running in 16-bit mode, and it
17766 has to have the same physical and virtual address, because it turns
17767 off paging. Copy it near the end of the first page, out of the way
17768 of BIOS variables. */
17769 - memcpy((void *)(0x1000 - sizeof(real_mode_switch) - 100),
17770 - real_mode_switch, sizeof (real_mode_switch));
17771 - memcpy((void *)(0x1000 - 100), code, length);
17772 + memcpy(__va(0x1000 - sizeof (real_mode_switch) - 100), real_mode_switch, sizeof (real_mode_switch));
17773 + memcpy(__va(0x1000 - 100), code, length);
17774
17775 /* Set up the IDT for real mode. */
17776 load_idt(&real_mode_idt);
17777 @@ -416,6 +415,7 @@ void machine_real_restart(const unsigned
17778 __asm__ __volatile__ ("ljmp $0x0008,%0"
17779 :
17780 : "i" ((void *)(0x1000 - sizeof (real_mode_switch) - 100)));
17781 + do { } while (1);
17782 }
17783 #ifdef CONFIG_APM_MODULE
17784 EXPORT_SYMBOL(machine_real_restart);
17785 @@ -544,7 +544,7 @@ void __attribute__((weak)) mach_reboot_f
17786 {
17787 }
17788
17789 -static void native_machine_emergency_restart(void)
17790 +__noreturn static void native_machine_emergency_restart(void)
17791 {
17792 int i;
17793
17794 @@ -659,13 +659,13 @@ void native_machine_shutdown(void)
17795 #endif
17796 }
17797
17798 -static void __machine_emergency_restart(int emergency)
17799 +static __noreturn void __machine_emergency_restart(int emergency)
17800 {
17801 reboot_emergency = emergency;
17802 machine_ops.emergency_restart();
17803 }
17804
17805 -static void native_machine_restart(char *__unused)
17806 +static __noreturn void native_machine_restart(char *__unused)
17807 {
17808 printk("machine restart\n");
17809
17810 @@ -674,7 +674,7 @@ static void native_machine_restart(char
17811 __machine_emergency_restart(0);
17812 }
17813
17814 -static void native_machine_halt(void)
17815 +static __noreturn void native_machine_halt(void)
17816 {
17817 /* stop other cpus and apics */
17818 machine_shutdown();
17819 @@ -685,7 +685,7 @@ static void native_machine_halt(void)
17820 stop_this_cpu(NULL);
17821 }
17822
17823 -static void native_machine_power_off(void)
17824 +__noreturn static void native_machine_power_off(void)
17825 {
17826 if (pm_power_off) {
17827 if (!reboot_force)
17828 @@ -694,6 +694,7 @@ static void native_machine_power_off(voi
17829 }
17830 /* a fallback in case there is no PM info available */
17831 tboot_shutdown(TB_SHUTDOWN_HALT);
17832 + do { } while (1);
17833 }
17834
17835 struct machine_ops machine_ops = {
17836 diff -urNp linux-2.6.32.49/arch/x86/kernel/setup.c linux-2.6.32.49/arch/x86/kernel/setup.c
17837 --- linux-2.6.32.49/arch/x86/kernel/setup.c 2011-11-08 19:02:43.000000000 -0500
17838 +++ linux-2.6.32.49/arch/x86/kernel/setup.c 2011-11-15 19:59:43.000000000 -0500
17839 @@ -783,14 +783,14 @@ void __init setup_arch(char **cmdline_p)
17840
17841 if (!boot_params.hdr.root_flags)
17842 root_mountflags &= ~MS_RDONLY;
17843 - init_mm.start_code = (unsigned long) _text;
17844 - init_mm.end_code = (unsigned long) _etext;
17845 + init_mm.start_code = ktla_ktva((unsigned long) _text);
17846 + init_mm.end_code = ktla_ktva((unsigned long) _etext);
17847 init_mm.end_data = (unsigned long) _edata;
17848 init_mm.brk = _brk_end;
17849
17850 - code_resource.start = virt_to_phys(_text);
17851 - code_resource.end = virt_to_phys(_etext)-1;
17852 - data_resource.start = virt_to_phys(_etext);
17853 + code_resource.start = virt_to_phys(ktla_ktva(_text));
17854 + code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
17855 + data_resource.start = virt_to_phys(_sdata);
17856 data_resource.end = virt_to_phys(_edata)-1;
17857 bss_resource.start = virt_to_phys(&__bss_start);
17858 bss_resource.end = virt_to_phys(&__bss_stop)-1;
17859 diff -urNp linux-2.6.32.49/arch/x86/kernel/setup_percpu.c linux-2.6.32.49/arch/x86/kernel/setup_percpu.c
17860 --- linux-2.6.32.49/arch/x86/kernel/setup_percpu.c 2011-11-08 19:02:43.000000000 -0500
17861 +++ linux-2.6.32.49/arch/x86/kernel/setup_percpu.c 2011-11-15 19:59:43.000000000 -0500
17862 @@ -25,19 +25,17 @@
17863 # define DBG(x...)
17864 #endif
17865
17866 -DEFINE_PER_CPU(int, cpu_number);
17867 +#ifdef CONFIG_SMP
17868 +DEFINE_PER_CPU(unsigned int, cpu_number);
17869 EXPORT_PER_CPU_SYMBOL(cpu_number);
17870 +#endif
17871
17872 -#ifdef CONFIG_X86_64
17873 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
17874 -#else
17875 -#define BOOT_PERCPU_OFFSET 0
17876 -#endif
17877
17878 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
17879 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
17880
17881 -unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
17882 +unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
17883 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
17884 };
17885 EXPORT_SYMBOL(__per_cpu_offset);
17886 @@ -159,10 +157,10 @@ static inline void setup_percpu_segment(
17887 {
17888 #ifdef CONFIG_X86_32
17889 struct desc_struct gdt;
17890 + unsigned long base = per_cpu_offset(cpu);
17891
17892 - pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
17893 - 0x2 | DESCTYPE_S, 0x8);
17894 - gdt.s = 1;
17895 + pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
17896 + 0x83 | DESCTYPE_S, 0xC);
17897 write_gdt_entry(get_cpu_gdt_table(cpu),
17898 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
17899 #endif
17900 @@ -212,6 +210,11 @@ void __init setup_per_cpu_areas(void)
17901 /* alrighty, percpu areas up and running */
17902 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
17903 for_each_possible_cpu(cpu) {
17904 +#ifdef CONFIG_CC_STACKPROTECTOR
17905 +#ifdef CONFIG_X86_32
17906 + unsigned long canary = per_cpu(stack_canary.canary, cpu);
17907 +#endif
17908 +#endif
17909 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
17910 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
17911 per_cpu(cpu_number, cpu) = cpu;
17912 @@ -239,6 +242,12 @@ void __init setup_per_cpu_areas(void)
17913 early_per_cpu_map(x86_cpu_to_node_map, cpu);
17914 #endif
17915 #endif
17916 +#ifdef CONFIG_CC_STACKPROTECTOR
17917 +#ifdef CONFIG_X86_32
17918 + if (!cpu)
17919 + per_cpu(stack_canary.canary, cpu) = canary;
17920 +#endif
17921 +#endif
17922 /*
17923 * Up to this point, the boot CPU has been using .data.init
17924 * area. Reload any changed state for the boot CPU.
17925 diff -urNp linux-2.6.32.49/arch/x86/kernel/signal.c linux-2.6.32.49/arch/x86/kernel/signal.c
17926 --- linux-2.6.32.49/arch/x86/kernel/signal.c 2011-11-08 19:02:43.000000000 -0500
17927 +++ linux-2.6.32.49/arch/x86/kernel/signal.c 2011-11-15 19:59:43.000000000 -0500
17928 @@ -197,7 +197,7 @@ static unsigned long align_sigframe(unsi
17929 * Align the stack pointer according to the i386 ABI,
17930 * i.e. so that on function entry ((sp + 4) & 15) == 0.
17931 */
17932 - sp = ((sp + 4) & -16ul) - 4;
17933 + sp = ((sp - 12) & -16ul) - 4;
17934 #else /* !CONFIG_X86_32 */
17935 sp = round_down(sp, 16) - 8;
17936 #endif
17937 @@ -248,11 +248,11 @@ get_sigframe(struct k_sigaction *ka, str
17938 * Return an always-bogus address instead so we will die with SIGSEGV.
17939 */
17940 if (onsigstack && !likely(on_sig_stack(sp)))
17941 - return (void __user *)-1L;
17942 + return (__force void __user *)-1L;
17943
17944 /* save i387 state */
17945 if (used_math() && save_i387_xstate(*fpstate) < 0)
17946 - return (void __user *)-1L;
17947 + return (__force void __user *)-1L;
17948
17949 return (void __user *)sp;
17950 }
17951 @@ -307,9 +307,9 @@ __setup_frame(int sig, struct k_sigactio
17952 }
17953
17954 if (current->mm->context.vdso)
17955 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
17956 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
17957 else
17958 - restorer = &frame->retcode;
17959 + restorer = (void __user *)&frame->retcode;
17960 if (ka->sa.sa_flags & SA_RESTORER)
17961 restorer = ka->sa.sa_restorer;
17962
17963 @@ -323,7 +323,7 @@ __setup_frame(int sig, struct k_sigactio
17964 * reasons and because gdb uses it as a signature to notice
17965 * signal handler stack frames.
17966 */
17967 - err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
17968 + err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
17969
17970 if (err)
17971 return -EFAULT;
17972 @@ -377,7 +377,10 @@ static int __setup_rt_frame(int sig, str
17973 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
17974
17975 /* Set up to return from userspace. */
17976 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
17977 + if (current->mm->context.vdso)
17978 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
17979 + else
17980 + restorer = (void __user *)&frame->retcode;
17981 if (ka->sa.sa_flags & SA_RESTORER)
17982 restorer = ka->sa.sa_restorer;
17983 put_user_ex(restorer, &frame->pretcode);
17984 @@ -389,7 +392,7 @@ static int __setup_rt_frame(int sig, str
17985 * reasons and because gdb uses it as a signature to notice
17986 * signal handler stack frames.
17987 */
17988 - put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
17989 + put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
17990 } put_user_catch(err);
17991
17992 if (err)
17993 @@ -782,6 +785,8 @@ static void do_signal(struct pt_regs *re
17994 int signr;
17995 sigset_t *oldset;
17996
17997 + pax_track_stack();
17998 +
17999 /*
18000 * We want the common case to go fast, which is why we may in certain
18001 * cases get here from kernel mode. Just return without doing anything
18002 @@ -789,7 +794,7 @@ static void do_signal(struct pt_regs *re
18003 * X86_32: vm86 regs switched out by assembly code before reaching
18004 * here, so testing against kernel CS suffices.
18005 */
18006 - if (!user_mode(regs))
18007 + if (!user_mode_novm(regs))
18008 return;
18009
18010 if (current_thread_info()->status & TS_RESTORE_SIGMASK)
18011 diff -urNp linux-2.6.32.49/arch/x86/kernel/smpboot.c linux-2.6.32.49/arch/x86/kernel/smpboot.c
18012 --- linux-2.6.32.49/arch/x86/kernel/smpboot.c 2011-11-08 19:02:43.000000000 -0500
18013 +++ linux-2.6.32.49/arch/x86/kernel/smpboot.c 2011-11-15 19:59:43.000000000 -0500
18014 @@ -94,14 +94,14 @@ static DEFINE_PER_CPU(struct task_struct
18015 */
18016 static DEFINE_MUTEX(x86_cpu_hotplug_driver_mutex);
18017
18018 -void cpu_hotplug_driver_lock()
18019 +void cpu_hotplug_driver_lock(void)
18020 {
18021 - mutex_lock(&x86_cpu_hotplug_driver_mutex);
18022 + mutex_lock(&x86_cpu_hotplug_driver_mutex);
18023 }
18024
18025 -void cpu_hotplug_driver_unlock()
18026 +void cpu_hotplug_driver_unlock(void)
18027 {
18028 - mutex_unlock(&x86_cpu_hotplug_driver_mutex);
18029 + mutex_unlock(&x86_cpu_hotplug_driver_mutex);
18030 }
18031
18032 ssize_t arch_cpu_probe(const char *buf, size_t count) { return -1; }
18033 @@ -625,7 +625,7 @@ wakeup_secondary_cpu_via_init(int phys_a
18034 * target processor state.
18035 */
18036 startup_ipi_hook(phys_apicid, (unsigned long) start_secondary,
18037 - (unsigned long)stack_start.sp);
18038 + stack_start);
18039
18040 /*
18041 * Run STARTUP IPI loop.
18042 @@ -743,6 +743,7 @@ static int __cpuinit do_boot_cpu(int api
18043 set_idle_for_cpu(cpu, c_idle.idle);
18044 do_rest:
18045 per_cpu(current_task, cpu) = c_idle.idle;
18046 + per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
18047 #ifdef CONFIG_X86_32
18048 /* Stack for startup_32 can be just as for start_secondary onwards */
18049 irq_ctx_init(cpu);
18050 @@ -750,13 +751,15 @@ do_rest:
18051 #else
18052 clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
18053 initial_gs = per_cpu_offset(cpu);
18054 - per_cpu(kernel_stack, cpu) =
18055 - (unsigned long)task_stack_page(c_idle.idle) -
18056 - KERNEL_STACK_OFFSET + THREAD_SIZE;
18057 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
18058 #endif
18059 +
18060 + pax_open_kernel();
18061 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
18062 + pax_close_kernel();
18063 +
18064 initial_code = (unsigned long)start_secondary;
18065 - stack_start.sp = (void *) c_idle.idle->thread.sp;
18066 + stack_start = c_idle.idle->thread.sp;
18067
18068 /* start_ip had better be page-aligned! */
18069 start_ip = setup_trampoline();
18070 @@ -891,6 +894,12 @@ int __cpuinit native_cpu_up(unsigned int
18071
18072 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
18073
18074 +#ifdef CONFIG_PAX_PER_CPU_PGD
18075 + clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
18076 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
18077 + KERNEL_PGD_PTRS);
18078 +#endif
18079 +
18080 err = do_boot_cpu(apicid, cpu);
18081
18082 if (err) {
18083 diff -urNp linux-2.6.32.49/arch/x86/kernel/step.c linux-2.6.32.49/arch/x86/kernel/step.c
18084 --- linux-2.6.32.49/arch/x86/kernel/step.c 2011-11-08 19:02:43.000000000 -0500
18085 +++ linux-2.6.32.49/arch/x86/kernel/step.c 2011-11-15 19:59:43.000000000 -0500
18086 @@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
18087 struct desc_struct *desc;
18088 unsigned long base;
18089
18090 - seg &= ~7UL;
18091 + seg >>= 3;
18092
18093 mutex_lock(&child->mm->context.lock);
18094 - if (unlikely((seg >> 3) >= child->mm->context.size))
18095 + if (unlikely(seg >= child->mm->context.size))
18096 addr = -1L; /* bogus selector, access would fault */
18097 else {
18098 desc = child->mm->context.ldt + seg;
18099 @@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struc
18100 addr += base;
18101 }
18102 mutex_unlock(&child->mm->context.lock);
18103 - }
18104 + } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
18105 + addr = ktla_ktva(addr);
18106
18107 return addr;
18108 }
18109 @@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct t
18110 unsigned char opcode[15];
18111 unsigned long addr = convert_ip_to_linear(child, regs);
18112
18113 + if (addr == -EINVAL)
18114 + return 0;
18115 +
18116 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
18117 for (i = 0; i < copied; i++) {
18118 switch (opcode[i]) {
18119 @@ -74,7 +78,7 @@ static int is_setting_trap_flag(struct t
18120
18121 #ifdef CONFIG_X86_64
18122 case 0x40 ... 0x4f:
18123 - if (regs->cs != __USER_CS)
18124 + if ((regs->cs & 0xffff) != __USER_CS)
18125 /* 32-bit mode: register increment */
18126 return 0;
18127 /* 64-bit mode: REX prefix */
18128 diff -urNp linux-2.6.32.49/arch/x86/kernel/syscall_table_32.S linux-2.6.32.49/arch/x86/kernel/syscall_table_32.S
18129 --- linux-2.6.32.49/arch/x86/kernel/syscall_table_32.S 2011-11-08 19:02:43.000000000 -0500
18130 +++ linux-2.6.32.49/arch/x86/kernel/syscall_table_32.S 2011-11-15 19:59:43.000000000 -0500
18131 @@ -1,3 +1,4 @@
18132 +.section .rodata,"a",@progbits
18133 ENTRY(sys_call_table)
18134 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
18135 .long sys_exit
18136 diff -urNp linux-2.6.32.49/arch/x86/kernel/sys_i386_32.c linux-2.6.32.49/arch/x86/kernel/sys_i386_32.c
18137 --- linux-2.6.32.49/arch/x86/kernel/sys_i386_32.c 2011-11-08 19:02:43.000000000 -0500
18138 +++ linux-2.6.32.49/arch/x86/kernel/sys_i386_32.c 2011-11-15 19:59:43.000000000 -0500
18139 @@ -24,6 +24,21 @@
18140
18141 #include <asm/syscalls.h>
18142
18143 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
18144 +{
18145 + unsigned long pax_task_size = TASK_SIZE;
18146 +
18147 +#ifdef CONFIG_PAX_SEGMEXEC
18148 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
18149 + pax_task_size = SEGMEXEC_TASK_SIZE;
18150 +#endif
18151 +
18152 + if (len > pax_task_size || addr > pax_task_size - len)
18153 + return -EINVAL;
18154 +
18155 + return 0;
18156 +}
18157 +
18158 /*
18159 * Perform the select(nd, in, out, ex, tv) and mmap() system
18160 * calls. Linux/i386 didn't use to be able to handle more than
18161 @@ -58,6 +73,212 @@ out:
18162 return err;
18163 }
18164
18165 +unsigned long
18166 +arch_get_unmapped_area(struct file *filp, unsigned long addr,
18167 + unsigned long len, unsigned long pgoff, unsigned long flags)
18168 +{
18169 + struct mm_struct *mm = current->mm;
18170 + struct vm_area_struct *vma;
18171 + unsigned long start_addr, pax_task_size = TASK_SIZE;
18172 +
18173 +#ifdef CONFIG_PAX_SEGMEXEC
18174 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
18175 + pax_task_size = SEGMEXEC_TASK_SIZE;
18176 +#endif
18177 +
18178 + pax_task_size -= PAGE_SIZE;
18179 +
18180 + if (len > pax_task_size)
18181 + return -ENOMEM;
18182 +
18183 + if (flags & MAP_FIXED)
18184 + return addr;
18185 +
18186 +#ifdef CONFIG_PAX_RANDMMAP
18187 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
18188 +#endif
18189 +
18190 + if (addr) {
18191 + addr = PAGE_ALIGN(addr);
18192 + if (pax_task_size - len >= addr) {
18193 + vma = find_vma(mm, addr);
18194 + if (check_heap_stack_gap(vma, addr, len))
18195 + return addr;
18196 + }
18197 + }
18198 + if (len > mm->cached_hole_size) {
18199 + start_addr = addr = mm->free_area_cache;
18200 + } else {
18201 + start_addr = addr = mm->mmap_base;
18202 + mm->cached_hole_size = 0;
18203 + }
18204 +
18205 +#ifdef CONFIG_PAX_PAGEEXEC
18206 + if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
18207 + start_addr = 0x00110000UL;
18208 +
18209 +#ifdef CONFIG_PAX_RANDMMAP
18210 + if (mm->pax_flags & MF_PAX_RANDMMAP)
18211 + start_addr += mm->delta_mmap & 0x03FFF000UL;
18212 +#endif
18213 +
18214 + if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
18215 + start_addr = addr = mm->mmap_base;
18216 + else
18217 + addr = start_addr;
18218 + }
18219 +#endif
18220 +
18221 +full_search:
18222 + for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
18223 + /* At this point: (!vma || addr < vma->vm_end). */
18224 + if (pax_task_size - len < addr) {
18225 + /*
18226 + * Start a new search - just in case we missed
18227 + * some holes.
18228 + */
18229 + if (start_addr != mm->mmap_base) {
18230 + start_addr = addr = mm->mmap_base;
18231 + mm->cached_hole_size = 0;
18232 + goto full_search;
18233 + }
18234 + return -ENOMEM;
18235 + }
18236 + if (check_heap_stack_gap(vma, addr, len))
18237 + break;
18238 + if (addr + mm->cached_hole_size < vma->vm_start)
18239 + mm->cached_hole_size = vma->vm_start - addr;
18240 + addr = vma->vm_end;
18241 + if (mm->start_brk <= addr && addr < mm->mmap_base) {
18242 + start_addr = addr = mm->mmap_base;
18243 + mm->cached_hole_size = 0;
18244 + goto full_search;
18245 + }
18246 + }
18247 +
18248 + /*
18249 + * Remember the place where we stopped the search:
18250 + */
18251 + mm->free_area_cache = addr + len;
18252 + return addr;
18253 +}
18254 +
18255 +unsigned long
18256 +arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
18257 + const unsigned long len, const unsigned long pgoff,
18258 + const unsigned long flags)
18259 +{
18260 + struct vm_area_struct *vma;
18261 + struct mm_struct *mm = current->mm;
18262 + unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
18263 +
18264 +#ifdef CONFIG_PAX_SEGMEXEC
18265 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
18266 + pax_task_size = SEGMEXEC_TASK_SIZE;
18267 +#endif
18268 +
18269 + pax_task_size -= PAGE_SIZE;
18270 +
18271 + /* requested length too big for entire address space */
18272 + if (len > pax_task_size)
18273 + return -ENOMEM;
18274 +
18275 + if (flags & MAP_FIXED)
18276 + return addr;
18277 +
18278 +#ifdef CONFIG_PAX_PAGEEXEC
18279 + if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
18280 + goto bottomup;
18281 +#endif
18282 +
18283 +#ifdef CONFIG_PAX_RANDMMAP
18284 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
18285 +#endif
18286 +
18287 + /* requesting a specific address */
18288 + if (addr) {
18289 + addr = PAGE_ALIGN(addr);
18290 + if (pax_task_size - len >= addr) {
18291 + vma = find_vma(mm, addr);
18292 + if (check_heap_stack_gap(vma, addr, len))
18293 + return addr;
18294 + }
18295 + }
18296 +
18297 + /* check if free_area_cache is useful for us */
18298 + if (len <= mm->cached_hole_size) {
18299 + mm->cached_hole_size = 0;
18300 + mm->free_area_cache = mm->mmap_base;
18301 + }
18302 +
18303 + /* either no address requested or can't fit in requested address hole */
18304 + addr = mm->free_area_cache;
18305 +
18306 + /* make sure it can fit in the remaining address space */
18307 + if (addr > len) {
18308 + vma = find_vma(mm, addr-len);
18309 + if (check_heap_stack_gap(vma, addr - len, len))
18310 + /* remember the address as a hint for next time */
18311 + return (mm->free_area_cache = addr-len);
18312 + }
18313 +
18314 + if (mm->mmap_base < len)
18315 + goto bottomup;
18316 +
18317 + addr = mm->mmap_base-len;
18318 +
18319 + do {
18320 + /*
18321 + * Lookup failure means no vma is above this address,
18322 + * else if new region fits below vma->vm_start,
18323 + * return with success:
18324 + */
18325 + vma = find_vma(mm, addr);
18326 + if (check_heap_stack_gap(vma, addr, len))
18327 + /* remember the address as a hint for next time */
18328 + return (mm->free_area_cache = addr);
18329 +
18330 + /* remember the largest hole we saw so far */
18331 + if (addr + mm->cached_hole_size < vma->vm_start)
18332 + mm->cached_hole_size = vma->vm_start - addr;
18333 +
18334 + /* try just below the current vma->vm_start */
18335 + addr = skip_heap_stack_gap(vma, len);
18336 + } while (!IS_ERR_VALUE(addr));
18337 +
18338 +bottomup:
18339 + /*
18340 + * A failed mmap() very likely causes application failure,
18341 + * so fall back to the bottom-up function here. This scenario
18342 + * can happen with large stack limits and large mmap()
18343 + * allocations.
18344 + */
18345 +
18346 +#ifdef CONFIG_PAX_SEGMEXEC
18347 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
18348 + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
18349 + else
18350 +#endif
18351 +
18352 + mm->mmap_base = TASK_UNMAPPED_BASE;
18353 +
18354 +#ifdef CONFIG_PAX_RANDMMAP
18355 + if (mm->pax_flags & MF_PAX_RANDMMAP)
18356 + mm->mmap_base += mm->delta_mmap;
18357 +#endif
18358 +
18359 + mm->free_area_cache = mm->mmap_base;
18360 + mm->cached_hole_size = ~0UL;
18361 + addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
18362 + /*
18363 + * Restore the topdown base:
18364 + */
18365 + mm->mmap_base = base;
18366 + mm->free_area_cache = base;
18367 + mm->cached_hole_size = ~0UL;
18368 +
18369 + return addr;
18370 +}
18371
18372 struct sel_arg_struct {
18373 unsigned long n;
18374 @@ -93,7 +314,7 @@ asmlinkage int sys_ipc(uint call, int fi
18375 return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
18376 case SEMTIMEDOP:
18377 return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
18378 - (const struct timespec __user *)fifth);
18379 + (__force const struct timespec __user *)fifth);
18380
18381 case SEMGET:
18382 return sys_semget(first, second, third);
18383 @@ -140,7 +361,7 @@ asmlinkage int sys_ipc(uint call, int fi
18384 ret = do_shmat(first, (char __user *) ptr, second, &raddr);
18385 if (ret)
18386 return ret;
18387 - return put_user(raddr, (ulong __user *) third);
18388 + return put_user(raddr, (__force ulong __user *) third);
18389 }
18390 case 1: /* iBCS2 emulator entry point */
18391 if (!segment_eq(get_fs(), get_ds()))
18392 @@ -207,17 +428,3 @@ asmlinkage int sys_olduname(struct oldol
18393
18394 return error;
18395 }
18396 -
18397 -
18398 -/*
18399 - * Do a system call from kernel instead of calling sys_execve so we
18400 - * end up with proper pt_regs.
18401 - */
18402 -int kernel_execve(const char *filename, char *const argv[], char *const envp[])
18403 -{
18404 - long __res;
18405 - asm volatile ("push %%ebx ; movl %2,%%ebx ; int $0x80 ; pop %%ebx"
18406 - : "=a" (__res)
18407 - : "0" (__NR_execve), "ri" (filename), "c" (argv), "d" (envp) : "memory");
18408 - return __res;
18409 -}
18410 diff -urNp linux-2.6.32.49/arch/x86/kernel/sys_x86_64.c linux-2.6.32.49/arch/x86/kernel/sys_x86_64.c
18411 --- linux-2.6.32.49/arch/x86/kernel/sys_x86_64.c 2011-11-08 19:02:43.000000000 -0500
18412 +++ linux-2.6.32.49/arch/x86/kernel/sys_x86_64.c 2011-11-15 19:59:43.000000000 -0500
18413 @@ -32,8 +32,8 @@ out:
18414 return error;
18415 }
18416
18417 -static void find_start_end(unsigned long flags, unsigned long *begin,
18418 - unsigned long *end)
18419 +static void find_start_end(struct mm_struct *mm, unsigned long flags,
18420 + unsigned long *begin, unsigned long *end)
18421 {
18422 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
18423 unsigned long new_begin;
18424 @@ -52,7 +52,7 @@ static void find_start_end(unsigned long
18425 *begin = new_begin;
18426 }
18427 } else {
18428 - *begin = TASK_UNMAPPED_BASE;
18429 + *begin = mm->mmap_base;
18430 *end = TASK_SIZE;
18431 }
18432 }
18433 @@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp
18434 if (flags & MAP_FIXED)
18435 return addr;
18436
18437 - find_start_end(flags, &begin, &end);
18438 + find_start_end(mm, flags, &begin, &end);
18439
18440 if (len > end)
18441 return -ENOMEM;
18442
18443 +#ifdef CONFIG_PAX_RANDMMAP
18444 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
18445 +#endif
18446 +
18447 if (addr) {
18448 addr = PAGE_ALIGN(addr);
18449 vma = find_vma(mm, addr);
18450 - if (end - len >= addr &&
18451 - (!vma || addr + len <= vma->vm_start))
18452 + if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
18453 return addr;
18454 }
18455 if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
18456 @@ -106,7 +109,7 @@ full_search:
18457 }
18458 return -ENOMEM;
18459 }
18460 - if (!vma || addr + len <= vma->vm_start) {
18461 + if (check_heap_stack_gap(vma, addr, len)) {
18462 /*
18463 * Remember the place where we stopped the search:
18464 */
18465 @@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct fi
18466 {
18467 struct vm_area_struct *vma;
18468 struct mm_struct *mm = current->mm;
18469 - unsigned long addr = addr0;
18470 + unsigned long base = mm->mmap_base, addr = addr0;
18471
18472 /* requested length too big for entire address space */
18473 if (len > TASK_SIZE)
18474 @@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct fi
18475 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
18476 goto bottomup;
18477
18478 +#ifdef CONFIG_PAX_RANDMMAP
18479 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
18480 +#endif
18481 +
18482 /* requesting a specific address */
18483 if (addr) {
18484 addr = PAGE_ALIGN(addr);
18485 - vma = find_vma(mm, addr);
18486 - if (TASK_SIZE - len >= addr &&
18487 - (!vma || addr + len <= vma->vm_start))
18488 - return addr;
18489 + if (TASK_SIZE - len >= addr) {
18490 + vma = find_vma(mm, addr);
18491 + if (check_heap_stack_gap(vma, addr, len))
18492 + return addr;
18493 + }
18494 }
18495
18496 /* check if free_area_cache is useful for us */
18497 @@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct fi
18498 /* make sure it can fit in the remaining address space */
18499 if (addr > len) {
18500 vma = find_vma(mm, addr-len);
18501 - if (!vma || addr <= vma->vm_start)
18502 + if (check_heap_stack_gap(vma, addr - len, len))
18503 /* remember the address as a hint for next time */
18504 return mm->free_area_cache = addr-len;
18505 }
18506 @@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct fi
18507 * return with success:
18508 */
18509 vma = find_vma(mm, addr);
18510 - if (!vma || addr+len <= vma->vm_start)
18511 + if (check_heap_stack_gap(vma, addr, len))
18512 /* remember the address as a hint for next time */
18513 return mm->free_area_cache = addr;
18514
18515 @@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct fi
18516 mm->cached_hole_size = vma->vm_start - addr;
18517
18518 /* try just below the current vma->vm_start */
18519 - addr = vma->vm_start-len;
18520 - } while (len < vma->vm_start);
18521 + addr = skip_heap_stack_gap(vma, len);
18522 + } while (!IS_ERR_VALUE(addr));
18523
18524 bottomup:
18525 /*
18526 @@ -198,13 +206,21 @@ bottomup:
18527 * can happen with large stack limits and large mmap()
18528 * allocations.
18529 */
18530 + mm->mmap_base = TASK_UNMAPPED_BASE;
18531 +
18532 +#ifdef CONFIG_PAX_RANDMMAP
18533 + if (mm->pax_flags & MF_PAX_RANDMMAP)
18534 + mm->mmap_base += mm->delta_mmap;
18535 +#endif
18536 +
18537 + mm->free_area_cache = mm->mmap_base;
18538 mm->cached_hole_size = ~0UL;
18539 - mm->free_area_cache = TASK_UNMAPPED_BASE;
18540 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
18541 /*
18542 * Restore the topdown base:
18543 */
18544 - mm->free_area_cache = mm->mmap_base;
18545 + mm->mmap_base = base;
18546 + mm->free_area_cache = base;
18547 mm->cached_hole_size = ~0UL;
18548
18549 return addr;
18550 diff -urNp linux-2.6.32.49/arch/x86/kernel/tboot.c linux-2.6.32.49/arch/x86/kernel/tboot.c
18551 --- linux-2.6.32.49/arch/x86/kernel/tboot.c 2011-11-08 19:02:43.000000000 -0500
18552 +++ linux-2.6.32.49/arch/x86/kernel/tboot.c 2011-11-15 19:59:43.000000000 -0500
18553 @@ -216,7 +216,7 @@ static int tboot_setup_sleep(void)
18554
18555 void tboot_shutdown(u32 shutdown_type)
18556 {
18557 - void (*shutdown)(void);
18558 + void (* __noreturn shutdown)(void);
18559
18560 if (!tboot_enabled())
18561 return;
18562 @@ -238,7 +238,7 @@ void tboot_shutdown(u32 shutdown_type)
18563
18564 switch_to_tboot_pt();
18565
18566 - shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
18567 + shutdown = (void *)tboot->shutdown_entry;
18568 shutdown();
18569
18570 /* should not reach here */
18571 @@ -295,7 +295,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1
18572 tboot_shutdown(acpi_shutdown_map[sleep_state]);
18573 }
18574
18575 -static atomic_t ap_wfs_count;
18576 +static atomic_unchecked_t ap_wfs_count;
18577
18578 static int tboot_wait_for_aps(int num_aps)
18579 {
18580 @@ -319,9 +319,9 @@ static int __cpuinit tboot_cpu_callback(
18581 {
18582 switch (action) {
18583 case CPU_DYING:
18584 - atomic_inc(&ap_wfs_count);
18585 + atomic_inc_unchecked(&ap_wfs_count);
18586 if (num_online_cpus() == 1)
18587 - if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
18588 + if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
18589 return NOTIFY_BAD;
18590 break;
18591 }
18592 @@ -340,7 +340,7 @@ static __init int tboot_late_init(void)
18593
18594 tboot_create_trampoline();
18595
18596 - atomic_set(&ap_wfs_count, 0);
18597 + atomic_set_unchecked(&ap_wfs_count, 0);
18598 register_hotcpu_notifier(&tboot_cpu_notifier);
18599 return 0;
18600 }
18601 diff -urNp linux-2.6.32.49/arch/x86/kernel/time.c linux-2.6.32.49/arch/x86/kernel/time.c
18602 --- linux-2.6.32.49/arch/x86/kernel/time.c 2011-11-08 19:02:43.000000000 -0500
18603 +++ linux-2.6.32.49/arch/x86/kernel/time.c 2011-11-15 19:59:43.000000000 -0500
18604 @@ -26,17 +26,13 @@
18605 int timer_ack;
18606 #endif
18607
18608 -#ifdef CONFIG_X86_64
18609 -volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
18610 -#endif
18611 -
18612 unsigned long profile_pc(struct pt_regs *regs)
18613 {
18614 unsigned long pc = instruction_pointer(regs);
18615
18616 - if (!user_mode_vm(regs) && in_lock_functions(pc)) {
18617 + if (!user_mode(regs) && in_lock_functions(pc)) {
18618 #ifdef CONFIG_FRAME_POINTER
18619 - return *(unsigned long *)(regs->bp + sizeof(long));
18620 + return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
18621 #else
18622 unsigned long *sp =
18623 (unsigned long *)kernel_stack_pointer(regs);
18624 @@ -45,11 +41,17 @@ unsigned long profile_pc(struct pt_regs
18625 * or above a saved flags. Eflags has bits 22-31 zero,
18626 * kernel addresses don't.
18627 */
18628 +
18629 +#ifdef CONFIG_PAX_KERNEXEC
18630 + return ktla_ktva(sp[0]);
18631 +#else
18632 if (sp[0] >> 22)
18633 return sp[0];
18634 if (sp[1] >> 22)
18635 return sp[1];
18636 #endif
18637 +
18638 +#endif
18639 }
18640 return pc;
18641 }
18642 diff -urNp linux-2.6.32.49/arch/x86/kernel/tls.c linux-2.6.32.49/arch/x86/kernel/tls.c
18643 --- linux-2.6.32.49/arch/x86/kernel/tls.c 2011-11-08 19:02:43.000000000 -0500
18644 +++ linux-2.6.32.49/arch/x86/kernel/tls.c 2011-11-15 19:59:43.000000000 -0500
18645 @@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
18646 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
18647 return -EINVAL;
18648
18649 +#ifdef CONFIG_PAX_SEGMEXEC
18650 + if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
18651 + return -EINVAL;
18652 +#endif
18653 +
18654 set_tls_desc(p, idx, &info, 1);
18655
18656 return 0;
18657 diff -urNp linux-2.6.32.49/arch/x86/kernel/trampoline_32.S linux-2.6.32.49/arch/x86/kernel/trampoline_32.S
18658 --- linux-2.6.32.49/arch/x86/kernel/trampoline_32.S 2011-11-08 19:02:43.000000000 -0500
18659 +++ linux-2.6.32.49/arch/x86/kernel/trampoline_32.S 2011-11-15 19:59:43.000000000 -0500
18660 @@ -32,6 +32,12 @@
18661 #include <asm/segment.h>
18662 #include <asm/page_types.h>
18663
18664 +#ifdef CONFIG_PAX_KERNEXEC
18665 +#define ta(X) (X)
18666 +#else
18667 +#define ta(X) ((X) - __PAGE_OFFSET)
18668 +#endif
18669 +
18670 /* We can free up trampoline after bootup if cpu hotplug is not supported. */
18671 __CPUINITRODATA
18672 .code16
18673 @@ -60,7 +66,7 @@ r_base = .
18674 inc %ax # protected mode (PE) bit
18675 lmsw %ax # into protected mode
18676 # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
18677 - ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
18678 + ljmpl $__BOOT_CS, $ta(startup_32_smp)
18679
18680 # These need to be in the same 64K segment as the above;
18681 # hence we don't use the boot_gdt_descr defined in head.S
18682 diff -urNp linux-2.6.32.49/arch/x86/kernel/trampoline_64.S linux-2.6.32.49/arch/x86/kernel/trampoline_64.S
18683 --- linux-2.6.32.49/arch/x86/kernel/trampoline_64.S 2011-11-08 19:02:43.000000000 -0500
18684 +++ linux-2.6.32.49/arch/x86/kernel/trampoline_64.S 2011-11-15 19:59:43.000000000 -0500
18685 @@ -91,7 +91,7 @@ startup_32:
18686 movl $__KERNEL_DS, %eax # Initialize the %ds segment register
18687 movl %eax, %ds
18688
18689 - movl $X86_CR4_PAE, %eax
18690 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
18691 movl %eax, %cr4 # Enable PAE mode
18692
18693 # Setup trampoline 4 level pagetables
18694 @@ -127,7 +127,7 @@ startup_64:
18695 no_longmode:
18696 hlt
18697 jmp no_longmode
18698 -#include "verify_cpu_64.S"
18699 +#include "verify_cpu.S"
18700
18701 # Careful these need to be in the same 64K segment as the above;
18702 tidt:
18703 @@ -138,7 +138,7 @@ tidt:
18704 # so the kernel can live anywhere
18705 .balign 4
18706 tgdt:
18707 - .short tgdt_end - tgdt # gdt limit
18708 + .short tgdt_end - tgdt - 1 # gdt limit
18709 .long tgdt - r_base
18710 .short 0
18711 .quad 0x00cf9b000000ffff # __KERNEL32_CS
18712 diff -urNp linux-2.6.32.49/arch/x86/kernel/traps.c linux-2.6.32.49/arch/x86/kernel/traps.c
18713 --- linux-2.6.32.49/arch/x86/kernel/traps.c 2011-11-08 19:02:43.000000000 -0500
18714 +++ linux-2.6.32.49/arch/x86/kernel/traps.c 2011-11-15 19:59:43.000000000 -0500
18715 @@ -69,12 +69,6 @@ asmlinkage int system_call(void);
18716
18717 /* Do we ignore FPU interrupts ? */
18718 char ignore_fpu_irq;
18719 -
18720 -/*
18721 - * The IDT has to be page-aligned to simplify the Pentium
18722 - * F0 0F bug workaround.
18723 - */
18724 -gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
18725 #endif
18726
18727 DECLARE_BITMAP(used_vectors, NR_VECTORS);
18728 @@ -112,19 +106,19 @@ static inline void preempt_conditional_c
18729 static inline void
18730 die_if_kernel(const char *str, struct pt_regs *regs, long err)
18731 {
18732 - if (!user_mode_vm(regs))
18733 + if (!user_mode(regs))
18734 die(str, regs, err);
18735 }
18736 #endif
18737
18738 static void __kprobes
18739 -do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
18740 +do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
18741 long error_code, siginfo_t *info)
18742 {
18743 struct task_struct *tsk = current;
18744
18745 #ifdef CONFIG_X86_32
18746 - if (regs->flags & X86_VM_MASK) {
18747 + if (v8086_mode(regs)) {
18748 /*
18749 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
18750 * On nmi (interrupt 2), do_trap should not be called.
18751 @@ -135,7 +129,7 @@ do_trap(int trapnr, int signr, char *str
18752 }
18753 #endif
18754
18755 - if (!user_mode(regs))
18756 + if (!user_mode_novm(regs))
18757 goto kernel_trap;
18758
18759 #ifdef CONFIG_X86_32
18760 @@ -158,7 +152,7 @@ trap_signal:
18761 printk_ratelimit()) {
18762 printk(KERN_INFO
18763 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
18764 - tsk->comm, tsk->pid, str,
18765 + tsk->comm, task_pid_nr(tsk), str,
18766 regs->ip, regs->sp, error_code);
18767 print_vma_addr(" in ", regs->ip);
18768 printk("\n");
18769 @@ -175,8 +169,20 @@ kernel_trap:
18770 if (!fixup_exception(regs)) {
18771 tsk->thread.error_code = error_code;
18772 tsk->thread.trap_no = trapnr;
18773 +
18774 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18775 + if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
18776 + str = "PAX: suspicious stack segment fault";
18777 +#endif
18778 +
18779 die(str, regs, error_code);
18780 }
18781 +
18782 +#ifdef CONFIG_PAX_REFCOUNT
18783 + if (trapnr == 4)
18784 + pax_report_refcount_overflow(regs);
18785 +#endif
18786 +
18787 return;
18788
18789 #ifdef CONFIG_X86_32
18790 @@ -265,14 +271,30 @@ do_general_protection(struct pt_regs *re
18791 conditional_sti(regs);
18792
18793 #ifdef CONFIG_X86_32
18794 - if (regs->flags & X86_VM_MASK)
18795 + if (v8086_mode(regs))
18796 goto gp_in_vm86;
18797 #endif
18798
18799 tsk = current;
18800 - if (!user_mode(regs))
18801 + if (!user_mode_novm(regs))
18802 goto gp_in_kernel;
18803
18804 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
18805 + if (!nx_enabled && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
18806 + struct mm_struct *mm = tsk->mm;
18807 + unsigned long limit;
18808 +
18809 + down_write(&mm->mmap_sem);
18810 + limit = mm->context.user_cs_limit;
18811 + if (limit < TASK_SIZE) {
18812 + track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
18813 + up_write(&mm->mmap_sem);
18814 + return;
18815 + }
18816 + up_write(&mm->mmap_sem);
18817 + }
18818 +#endif
18819 +
18820 tsk->thread.error_code = error_code;
18821 tsk->thread.trap_no = 13;
18822
18823 @@ -305,6 +327,13 @@ gp_in_kernel:
18824 if (notify_die(DIE_GPF, "general protection fault", regs,
18825 error_code, 13, SIGSEGV) == NOTIFY_STOP)
18826 return;
18827 +
18828 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18829 + if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
18830 + die("PAX: suspicious general protection fault", regs, error_code);
18831 + else
18832 +#endif
18833 +
18834 die("general protection fault", regs, error_code);
18835 }
18836
18837 @@ -435,6 +464,17 @@ static notrace __kprobes void default_do
18838 dotraplinkage notrace __kprobes void
18839 do_nmi(struct pt_regs *regs, long error_code)
18840 {
18841 +
18842 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18843 + if (!user_mode(regs)) {
18844 + unsigned long cs = regs->cs & 0xFFFF;
18845 + unsigned long ip = ktva_ktla(regs->ip);
18846 +
18847 + if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
18848 + regs->ip = ip;
18849 + }
18850 +#endif
18851 +
18852 nmi_enter();
18853
18854 inc_irq_stat(__nmi_count);
18855 @@ -558,7 +598,7 @@ dotraplinkage void __kprobes do_debug(st
18856 }
18857
18858 #ifdef CONFIG_X86_32
18859 - if (regs->flags & X86_VM_MASK)
18860 + if (v8086_mode(regs))
18861 goto debug_vm86;
18862 #endif
18863
18864 @@ -570,7 +610,7 @@ dotraplinkage void __kprobes do_debug(st
18865 * kernel space (but re-enable TF when returning to user mode).
18866 */
18867 if (condition & DR_STEP) {
18868 - if (!user_mode(regs))
18869 + if (!user_mode_novm(regs))
18870 goto clear_TF_reenable;
18871 }
18872
18873 @@ -757,7 +797,7 @@ do_simd_coprocessor_error(struct pt_regs
18874 * Handle strange cache flush from user space exception
18875 * in all other cases. This is undocumented behaviour.
18876 */
18877 - if (regs->flags & X86_VM_MASK) {
18878 + if (v8086_mode(regs)) {
18879 handle_vm86_fault((struct kernel_vm86_regs *)regs, error_code);
18880 return;
18881 }
18882 @@ -798,7 +838,7 @@ asmlinkage void __attribute__((weak)) sm
18883 void __math_state_restore(void)
18884 {
18885 struct thread_info *thread = current_thread_info();
18886 - struct task_struct *tsk = thread->task;
18887 + struct task_struct *tsk = current;
18888
18889 /*
18890 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
18891 @@ -825,8 +865,7 @@ void __math_state_restore(void)
18892 */
18893 asmlinkage void math_state_restore(void)
18894 {
18895 - struct thread_info *thread = current_thread_info();
18896 - struct task_struct *tsk = thread->task;
18897 + struct task_struct *tsk = current;
18898
18899 if (!tsk_used_math(tsk)) {
18900 local_irq_enable();
18901 diff -urNp linux-2.6.32.49/arch/x86/kernel/verify_cpu_64.S linux-2.6.32.49/arch/x86/kernel/verify_cpu_64.S
18902 --- linux-2.6.32.49/arch/x86/kernel/verify_cpu_64.S 2011-11-08 19:02:43.000000000 -0500
18903 +++ linux-2.6.32.49/arch/x86/kernel/verify_cpu_64.S 1969-12-31 19:00:00.000000000 -0500
18904 @@ -1,105 +0,0 @@
18905 -/*
18906 - *
18907 - * verify_cpu.S - Code for cpu long mode and SSE verification. This
18908 - * code has been borrowed from boot/setup.S and was introduced by
18909 - * Andi Kleen.
18910 - *
18911 - * Copyright (c) 2007 Andi Kleen (ak@suse.de)
18912 - * Copyright (c) 2007 Eric Biederman (ebiederm@xmission.com)
18913 - * Copyright (c) 2007 Vivek Goyal (vgoyal@in.ibm.com)
18914 - *
18915 - * This source code is licensed under the GNU General Public License,
18916 - * Version 2. See the file COPYING for more details.
18917 - *
18918 - * This is a common code for verification whether CPU supports
18919 - * long mode and SSE or not. It is not called directly instead this
18920 - * file is included at various places and compiled in that context.
18921 - * Following are the current usage.
18922 - *
18923 - * This file is included by both 16bit and 32bit code.
18924 - *
18925 - * arch/x86_64/boot/setup.S : Boot cpu verification (16bit)
18926 - * arch/x86_64/boot/compressed/head.S: Boot cpu verification (32bit)
18927 - * arch/x86_64/kernel/trampoline.S: secondary processor verfication (16bit)
18928 - * arch/x86_64/kernel/acpi/wakeup.S:Verfication at resume (16bit)
18929 - *
18930 - * verify_cpu, returns the status of cpu check in register %eax.
18931 - * 0: Success 1: Failure
18932 - *
18933 - * The caller needs to check for the error code and take the action
18934 - * appropriately. Either display a message or halt.
18935 - */
18936 -
18937 -#include <asm/cpufeature.h>
18938 -
18939 -verify_cpu:
18940 - pushfl # Save caller passed flags
18941 - pushl $0 # Kill any dangerous flags
18942 - popfl
18943 -
18944 - pushfl # standard way to check for cpuid
18945 - popl %eax
18946 - movl %eax,%ebx
18947 - xorl $0x200000,%eax
18948 - pushl %eax
18949 - popfl
18950 - pushfl
18951 - popl %eax
18952 - cmpl %eax,%ebx
18953 - jz verify_cpu_no_longmode # cpu has no cpuid
18954 -
18955 - movl $0x0,%eax # See if cpuid 1 is implemented
18956 - cpuid
18957 - cmpl $0x1,%eax
18958 - jb verify_cpu_no_longmode # no cpuid 1
18959 -
18960 - xor %di,%di
18961 - cmpl $0x68747541,%ebx # AuthenticAMD
18962 - jnz verify_cpu_noamd
18963 - cmpl $0x69746e65,%edx
18964 - jnz verify_cpu_noamd
18965 - cmpl $0x444d4163,%ecx
18966 - jnz verify_cpu_noamd
18967 - mov $1,%di # cpu is from AMD
18968 -
18969 -verify_cpu_noamd:
18970 - movl $0x1,%eax # Does the cpu have what it takes
18971 - cpuid
18972 - andl $REQUIRED_MASK0,%edx
18973 - xorl $REQUIRED_MASK0,%edx
18974 - jnz verify_cpu_no_longmode
18975 -
18976 - movl $0x80000000,%eax # See if extended cpuid is implemented
18977 - cpuid
18978 - cmpl $0x80000001,%eax
18979 - jb verify_cpu_no_longmode # no extended cpuid
18980 -
18981 - movl $0x80000001,%eax # Does the cpu have what it takes
18982 - cpuid
18983 - andl $REQUIRED_MASK1,%edx
18984 - xorl $REQUIRED_MASK1,%edx
18985 - jnz verify_cpu_no_longmode
18986 -
18987 -verify_cpu_sse_test:
18988 - movl $1,%eax
18989 - cpuid
18990 - andl $SSE_MASK,%edx
18991 - cmpl $SSE_MASK,%edx
18992 - je verify_cpu_sse_ok
18993 - test %di,%di
18994 - jz verify_cpu_no_longmode # only try to force SSE on AMD
18995 - movl $0xc0010015,%ecx # HWCR
18996 - rdmsr
18997 - btr $15,%eax # enable SSE
18998 - wrmsr
18999 - xor %di,%di # don't loop
19000 - jmp verify_cpu_sse_test # try again
19001 -
19002 -verify_cpu_no_longmode:
19003 - popfl # Restore caller passed flags
19004 - movl $1,%eax
19005 - ret
19006 -verify_cpu_sse_ok:
19007 - popfl # Restore caller passed flags
19008 - xorl %eax, %eax
19009 - ret
19010 diff -urNp linux-2.6.32.49/arch/x86/kernel/verify_cpu.S linux-2.6.32.49/arch/x86/kernel/verify_cpu.S
19011 --- linux-2.6.32.49/arch/x86/kernel/verify_cpu.S 1969-12-31 19:00:00.000000000 -0500
19012 +++ linux-2.6.32.49/arch/x86/kernel/verify_cpu.S 2011-11-15 19:59:43.000000000 -0500
19013 @@ -0,0 +1,140 @@
19014 +/*
19015 + *
19016 + * verify_cpu.S - Code for cpu long mode and SSE verification. This
19017 + * code has been borrowed from boot/setup.S and was introduced by
19018 + * Andi Kleen.
19019 + *
19020 + * Copyright (c) 2007 Andi Kleen (ak@suse.de)
19021 + * Copyright (c) 2007 Eric Biederman (ebiederm@xmission.com)
19022 + * Copyright (c) 2007 Vivek Goyal (vgoyal@in.ibm.com)
19023 + * Copyright (c) 2010 Kees Cook (kees.cook@canonical.com)
19024 + *
19025 + * This source code is licensed under the GNU General Public License,
19026 + * Version 2. See the file COPYING for more details.
19027 + *
19028 + * This is a common code for verification whether CPU supports
19029 + * long mode and SSE or not. It is not called directly instead this
19030 + * file is included at various places and compiled in that context.
19031 + * This file is expected to run in 32bit code. Currently:
19032 + *
19033 + * arch/x86/boot/compressed/head_64.S: Boot cpu verification
19034 + * arch/x86/kernel/trampoline_64.S: secondary processor verification
19035 + * arch/x86/kernel/head_32.S: processor startup
19036 + * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
19037 + *
19038 + * verify_cpu, returns the status of longmode and SSE in register %eax.
19039 + * 0: Success 1: Failure
19040 + *
19041 + * On Intel, the XD_DISABLE flag will be cleared as a side-effect.
19042 + *
19043 + * The caller needs to check for the error code and take the action
19044 + * appropriately. Either display a message or halt.
19045 + */
19046 +
19047 +#include <asm/cpufeature.h>
19048 +#include <asm/msr-index.h>
19049 +
19050 +verify_cpu:
19051 + pushfl # Save caller passed flags
19052 + pushl $0 # Kill any dangerous flags
19053 + popfl
19054 +
19055 + pushfl # standard way to check for cpuid
19056 + popl %eax
19057 + movl %eax,%ebx
19058 + xorl $0x200000,%eax
19059 + pushl %eax
19060 + popfl
19061 + pushfl
19062 + popl %eax
19063 + cmpl %eax,%ebx
19064 + jz verify_cpu_no_longmode # cpu has no cpuid
19065 +
19066 + movl $0x0,%eax # See if cpuid 1 is implemented
19067 + cpuid
19068 + cmpl $0x1,%eax
19069 + jb verify_cpu_no_longmode # no cpuid 1
19070 +
19071 + xor %di,%di
19072 + cmpl $0x68747541,%ebx # AuthenticAMD
19073 + jnz verify_cpu_noamd
19074 + cmpl $0x69746e65,%edx
19075 + jnz verify_cpu_noamd
19076 + cmpl $0x444d4163,%ecx
19077 + jnz verify_cpu_noamd
19078 + mov $1,%di # cpu is from AMD
19079 + jmp verify_cpu_check
19080 +
19081 +verify_cpu_noamd:
19082 + cmpl $0x756e6547,%ebx # GenuineIntel?
19083 + jnz verify_cpu_check
19084 + cmpl $0x49656e69,%edx
19085 + jnz verify_cpu_check
19086 + cmpl $0x6c65746e,%ecx
19087 + jnz verify_cpu_check
19088 +
19089 + # only call IA32_MISC_ENABLE when:
19090 + # family > 6 || (family == 6 && model >= 0xd)
19091 + movl $0x1, %eax # check CPU family and model
19092 + cpuid
19093 + movl %eax, %ecx
19094 +
19095 + andl $0x0ff00f00, %eax # mask family and extended family
19096 + shrl $8, %eax
19097 + cmpl $6, %eax
19098 + ja verify_cpu_clear_xd # family > 6, ok
19099 + jb verify_cpu_check # family < 6, skip
19100 +
19101 + andl $0x000f00f0, %ecx # mask model and extended model
19102 + shrl $4, %ecx
19103 + cmpl $0xd, %ecx
19104 + jb verify_cpu_check # family == 6, model < 0xd, skip
19105 +
19106 +verify_cpu_clear_xd:
19107 + movl $MSR_IA32_MISC_ENABLE, %ecx
19108 + rdmsr
19109 + btrl $2, %edx # clear MSR_IA32_MISC_ENABLE_XD_DISABLE
19110 + jnc verify_cpu_check # only write MSR if bit was changed
19111 + wrmsr
19112 +
19113 +verify_cpu_check:
19114 + movl $0x1,%eax # Does the cpu have what it takes
19115 + cpuid
19116 + andl $REQUIRED_MASK0,%edx
19117 + xorl $REQUIRED_MASK0,%edx
19118 + jnz verify_cpu_no_longmode
19119 +
19120 + movl $0x80000000,%eax # See if extended cpuid is implemented
19121 + cpuid
19122 + cmpl $0x80000001,%eax
19123 + jb verify_cpu_no_longmode # no extended cpuid
19124 +
19125 + movl $0x80000001,%eax # Does the cpu have what it takes
19126 + cpuid
19127 + andl $REQUIRED_MASK1,%edx
19128 + xorl $REQUIRED_MASK1,%edx
19129 + jnz verify_cpu_no_longmode
19130 +
19131 +verify_cpu_sse_test:
19132 + movl $1,%eax
19133 + cpuid
19134 + andl $SSE_MASK,%edx
19135 + cmpl $SSE_MASK,%edx
19136 + je verify_cpu_sse_ok
19137 + test %di,%di
19138 + jz verify_cpu_no_longmode # only try to force SSE on AMD
19139 + movl $MSR_K7_HWCR,%ecx
19140 + rdmsr
19141 + btr $15,%eax # enable SSE
19142 + wrmsr
19143 + xor %di,%di # don't loop
19144 + jmp verify_cpu_sse_test # try again
19145 +
19146 +verify_cpu_no_longmode:
19147 + popfl # Restore caller passed flags
19148 + movl $1,%eax
19149 + ret
19150 +verify_cpu_sse_ok:
19151 + popfl # Restore caller passed flags
19152 + xorl %eax, %eax
19153 + ret
19154 diff -urNp linux-2.6.32.49/arch/x86/kernel/vm86_32.c linux-2.6.32.49/arch/x86/kernel/vm86_32.c
19155 --- linux-2.6.32.49/arch/x86/kernel/vm86_32.c 2011-11-08 19:02:43.000000000 -0500
19156 +++ linux-2.6.32.49/arch/x86/kernel/vm86_32.c 2011-11-15 19:59:43.000000000 -0500
19157 @@ -41,6 +41,7 @@
19158 #include <linux/ptrace.h>
19159 #include <linux/audit.h>
19160 #include <linux/stddef.h>
19161 +#include <linux/grsecurity.h>
19162
19163 #include <asm/uaccess.h>
19164 #include <asm/io.h>
19165 @@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
19166 do_exit(SIGSEGV);
19167 }
19168
19169 - tss = &per_cpu(init_tss, get_cpu());
19170 + tss = init_tss + get_cpu();
19171 current->thread.sp0 = current->thread.saved_sp0;
19172 current->thread.sysenter_cs = __KERNEL_CS;
19173 load_sp0(tss, &current->thread);
19174 @@ -208,6 +209,13 @@ int sys_vm86old(struct pt_regs *regs)
19175 struct task_struct *tsk;
19176 int tmp, ret = -EPERM;
19177
19178 +#ifdef CONFIG_GRKERNSEC_VM86
19179 + if (!capable(CAP_SYS_RAWIO)) {
19180 + gr_handle_vm86();
19181 + goto out;
19182 + }
19183 +#endif
19184 +
19185 tsk = current;
19186 if (tsk->thread.saved_sp0)
19187 goto out;
19188 @@ -238,6 +246,14 @@ int sys_vm86(struct pt_regs *regs)
19189 int tmp, ret;
19190 struct vm86plus_struct __user *v86;
19191
19192 +#ifdef CONFIG_GRKERNSEC_VM86
19193 + if (!capable(CAP_SYS_RAWIO)) {
19194 + gr_handle_vm86();
19195 + ret = -EPERM;
19196 + goto out;
19197 + }
19198 +#endif
19199 +
19200 tsk = current;
19201 switch (regs->bx) {
19202 case VM86_REQUEST_IRQ:
19203 @@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
19204 tsk->thread.saved_fs = info->regs32->fs;
19205 tsk->thread.saved_gs = get_user_gs(info->regs32);
19206
19207 - tss = &per_cpu(init_tss, get_cpu());
19208 + tss = init_tss + get_cpu();
19209 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
19210 if (cpu_has_sep)
19211 tsk->thread.sysenter_cs = 0;
19212 @@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
19213 goto cannot_handle;
19214 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
19215 goto cannot_handle;
19216 - intr_ptr = (unsigned long __user *) (i << 2);
19217 + intr_ptr = (__force unsigned long __user *) (i << 2);
19218 if (get_user(segoffs, intr_ptr))
19219 goto cannot_handle;
19220 if ((segoffs >> 16) == BIOSSEG)
19221 diff -urNp linux-2.6.32.49/arch/x86/kernel/vmi_32.c linux-2.6.32.49/arch/x86/kernel/vmi_32.c
19222 --- linux-2.6.32.49/arch/x86/kernel/vmi_32.c 2011-11-08 19:02:43.000000000 -0500
19223 +++ linux-2.6.32.49/arch/x86/kernel/vmi_32.c 2011-11-15 19:59:43.000000000 -0500
19224 @@ -44,12 +44,17 @@ typedef u32 __attribute__((regparm(1)))
19225 typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
19226
19227 #define call_vrom_func(rom,func) \
19228 - (((VROMFUNC *)(rom->func))())
19229 + (((VROMFUNC *)(ktva_ktla(rom.func)))())
19230
19231 #define call_vrom_long_func(rom,func,arg) \
19232 - (((VROMLONGFUNC *)(rom->func)) (arg))
19233 +({\
19234 + u64 __reloc = ((VROMLONGFUNC *)(ktva_ktla(rom.func))) (arg);\
19235 + struct vmi_relocation_info *const __rel = (struct vmi_relocation_info *)&__reloc;\
19236 + __rel->eip = (unsigned char *)ktva_ktla((unsigned long)__rel->eip);\
19237 + __reloc;\
19238 +})
19239
19240 -static struct vrom_header *vmi_rom;
19241 +static struct vrom_header vmi_rom __attribute((__section__(".vmi.rom"), __aligned__(PAGE_SIZE)));
19242 static int disable_pge;
19243 static int disable_pse;
19244 static int disable_sep;
19245 @@ -76,10 +81,10 @@ static struct {
19246 void (*set_initial_ap_state)(int, int);
19247 void (*halt)(void);
19248 void (*set_lazy_mode)(int mode);
19249 -} vmi_ops;
19250 +} __no_const vmi_ops __read_only;
19251
19252 /* Cached VMI operations */
19253 -struct vmi_timer_ops vmi_timer_ops;
19254 +struct vmi_timer_ops vmi_timer_ops __read_only;
19255
19256 /*
19257 * VMI patching routines.
19258 @@ -94,7 +99,7 @@ struct vmi_timer_ops vmi_timer_ops;
19259 static inline void patch_offset(void *insnbuf,
19260 unsigned long ip, unsigned long dest)
19261 {
19262 - *(unsigned long *)(insnbuf+1) = dest-ip-5;
19263 + *(unsigned long *)(insnbuf+1) = dest-ip-5;
19264 }
19265
19266 static unsigned patch_internal(int call, unsigned len, void *insnbuf,
19267 @@ -102,6 +107,7 @@ static unsigned patch_internal(int call,
19268 {
19269 u64 reloc;
19270 struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
19271 +
19272 reloc = call_vrom_long_func(vmi_rom, get_reloc, call);
19273 switch(rel->type) {
19274 case VMI_RELOCATION_CALL_REL:
19275 @@ -404,13 +410,13 @@ static void vmi_set_pud(pud_t *pudp, pud
19276
19277 static void vmi_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
19278 {
19279 - const pte_t pte = { .pte = 0 };
19280 + const pte_t pte = __pte(0ULL);
19281 vmi_ops.set_pte(pte, ptep, vmi_flags_addr(mm, addr, VMI_PAGE_PT, 0));
19282 }
19283
19284 static void vmi_pmd_clear(pmd_t *pmd)
19285 {
19286 - const pte_t pte = { .pte = 0 };
19287 + const pte_t pte = __pte(0ULL);
19288 vmi_ops.set_pte(pte, (pte_t *)pmd, VMI_PAGE_PD);
19289 }
19290 #endif
19291 @@ -438,10 +444,10 @@ vmi_startup_ipi_hook(int phys_apicid, un
19292 ap.ss = __KERNEL_DS;
19293 ap.esp = (unsigned long) start_esp;
19294
19295 - ap.ds = __USER_DS;
19296 - ap.es = __USER_DS;
19297 + ap.ds = __KERNEL_DS;
19298 + ap.es = __KERNEL_DS;
19299 ap.fs = __KERNEL_PERCPU;
19300 - ap.gs = __KERNEL_STACK_CANARY;
19301 + savesegment(gs, ap.gs);
19302
19303 ap.eflags = 0;
19304
19305 @@ -486,6 +492,18 @@ static void vmi_leave_lazy_mmu(void)
19306 paravirt_leave_lazy_mmu();
19307 }
19308
19309 +#ifdef CONFIG_PAX_KERNEXEC
19310 +static unsigned long vmi_pax_open_kernel(void)
19311 +{
19312 + return 0;
19313 +}
19314 +
19315 +static unsigned long vmi_pax_close_kernel(void)
19316 +{
19317 + return 0;
19318 +}
19319 +#endif
19320 +
19321 static inline int __init check_vmi_rom(struct vrom_header *rom)
19322 {
19323 struct pci_header *pci;
19324 @@ -498,6 +516,10 @@ static inline int __init check_vmi_rom(s
19325 return 0;
19326 if (rom->vrom_signature != VMI_SIGNATURE)
19327 return 0;
19328 + if (rom->rom_length * 512 > sizeof(*rom)) {
19329 + printk(KERN_WARNING "PAX: VMI: ROM size too big: %x\n", rom->rom_length * 512);
19330 + return 0;
19331 + }
19332 if (rom->api_version_maj != VMI_API_REV_MAJOR ||
19333 rom->api_version_min+1 < VMI_API_REV_MINOR+1) {
19334 printk(KERN_WARNING "VMI: Found mismatched rom version %d.%d\n",
19335 @@ -562,7 +584,7 @@ static inline int __init probe_vmi_rom(v
19336 struct vrom_header *romstart;
19337 romstart = (struct vrom_header *)isa_bus_to_virt(base);
19338 if (check_vmi_rom(romstart)) {
19339 - vmi_rom = romstart;
19340 + vmi_rom = *romstart;
19341 return 1;
19342 }
19343 }
19344 @@ -836,6 +858,11 @@ static inline int __init activate_vmi(vo
19345
19346 para_fill(pv_irq_ops.safe_halt, Halt);
19347
19348 +#ifdef CONFIG_PAX_KERNEXEC
19349 + pv_mmu_ops.pax_open_kernel = vmi_pax_open_kernel;
19350 + pv_mmu_ops.pax_close_kernel = vmi_pax_close_kernel;
19351 +#endif
19352 +
19353 /*
19354 * Alternative instruction rewriting doesn't happen soon enough
19355 * to convert VMI_IRET to a call instead of a jump; so we have
19356 @@ -853,16 +880,16 @@ static inline int __init activate_vmi(vo
19357
19358 void __init vmi_init(void)
19359 {
19360 - if (!vmi_rom)
19361 + if (!vmi_rom.rom_signature)
19362 probe_vmi_rom();
19363 else
19364 - check_vmi_rom(vmi_rom);
19365 + check_vmi_rom(&vmi_rom);
19366
19367 /* In case probing for or validating the ROM failed, basil */
19368 - if (!vmi_rom)
19369 + if (!vmi_rom.rom_signature)
19370 return;
19371
19372 - reserve_top_address(-vmi_rom->virtual_top);
19373 + reserve_top_address(-vmi_rom.virtual_top);
19374
19375 #ifdef CONFIG_X86_IO_APIC
19376 /* This is virtual hardware; timer routing is wired correctly */
19377 @@ -874,7 +901,7 @@ void __init vmi_activate(void)
19378 {
19379 unsigned long flags;
19380
19381 - if (!vmi_rom)
19382 + if (!vmi_rom.rom_signature)
19383 return;
19384
19385 local_irq_save(flags);
19386 diff -urNp linux-2.6.32.49/arch/x86/kernel/vmlinux.lds.S linux-2.6.32.49/arch/x86/kernel/vmlinux.lds.S
19387 --- linux-2.6.32.49/arch/x86/kernel/vmlinux.lds.S 2011-11-08 19:02:43.000000000 -0500
19388 +++ linux-2.6.32.49/arch/x86/kernel/vmlinux.lds.S 2011-11-15 19:59:43.000000000 -0500
19389 @@ -26,6 +26,13 @@
19390 #include <asm/page_types.h>
19391 #include <asm/cache.h>
19392 #include <asm/boot.h>
19393 +#include <asm/segment.h>
19394 +
19395 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
19396 +#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
19397 +#else
19398 +#define __KERNEL_TEXT_OFFSET 0
19399 +#endif
19400
19401 #undef i386 /* in case the preprocessor is a 32bit one */
19402
19403 @@ -34,40 +41,53 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
19404 #ifdef CONFIG_X86_32
19405 OUTPUT_ARCH(i386)
19406 ENTRY(phys_startup_32)
19407 -jiffies = jiffies_64;
19408 #else
19409 OUTPUT_ARCH(i386:x86-64)
19410 ENTRY(phys_startup_64)
19411 -jiffies_64 = jiffies;
19412 #endif
19413
19414 PHDRS {
19415 text PT_LOAD FLAGS(5); /* R_E */
19416 - data PT_LOAD FLAGS(7); /* RWE */
19417 +#ifdef CONFIG_X86_32
19418 + module PT_LOAD FLAGS(5); /* R_E */
19419 +#endif
19420 +#ifdef CONFIG_XEN
19421 + rodata PT_LOAD FLAGS(5); /* R_E */
19422 +#else
19423 + rodata PT_LOAD FLAGS(4); /* R__ */
19424 +#endif
19425 + data PT_LOAD FLAGS(6); /* RW_ */
19426 #ifdef CONFIG_X86_64
19427 user PT_LOAD FLAGS(5); /* R_E */
19428 +#endif
19429 + init.begin PT_LOAD FLAGS(6); /* RW_ */
19430 #ifdef CONFIG_SMP
19431 percpu PT_LOAD FLAGS(6); /* RW_ */
19432 #endif
19433 + text.init PT_LOAD FLAGS(5); /* R_E */
19434 + text.exit PT_LOAD FLAGS(5); /* R_E */
19435 init PT_LOAD FLAGS(7); /* RWE */
19436 -#endif
19437 note PT_NOTE FLAGS(0); /* ___ */
19438 }
19439
19440 SECTIONS
19441 {
19442 #ifdef CONFIG_X86_32
19443 - . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
19444 - phys_startup_32 = startup_32 - LOAD_OFFSET;
19445 + . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
19446 #else
19447 - . = __START_KERNEL;
19448 - phys_startup_64 = startup_64 - LOAD_OFFSET;
19449 + . = __START_KERNEL;
19450 #endif
19451
19452 /* Text and read-only data */
19453 - .text : AT(ADDR(.text) - LOAD_OFFSET) {
19454 - _text = .;
19455 + .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
19456 /* bootstrapping code */
19457 +#ifdef CONFIG_X86_32
19458 + phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
19459 +#else
19460 + phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
19461 +#endif
19462 + __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
19463 + _text = .;
19464 HEAD_TEXT
19465 #ifdef CONFIG_X86_32
19466 . = ALIGN(PAGE_SIZE);
19467 @@ -82,28 +102,71 @@ SECTIONS
19468 IRQENTRY_TEXT
19469 *(.fixup)
19470 *(.gnu.warning)
19471 - /* End of text section */
19472 - _etext = .;
19473 } :text = 0x9090
19474
19475 - NOTES :text :note
19476 + . += __KERNEL_TEXT_OFFSET;
19477 +
19478 +#ifdef CONFIG_X86_32
19479 + . = ALIGN(PAGE_SIZE);
19480 + .vmi.rom : AT(ADDR(.vmi.rom) - LOAD_OFFSET) {
19481 + *(.vmi.rom)
19482 + } :module
19483 +
19484 + . = ALIGN(PAGE_SIZE);
19485 + .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
19486 +
19487 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
19488 + MODULES_EXEC_VADDR = .;
19489 + BYTE(0)
19490 + . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
19491 + . = ALIGN(HPAGE_SIZE);
19492 + MODULES_EXEC_END = . - 1;
19493 +#endif
19494 +
19495 + } :module
19496 +#endif
19497
19498 - EXCEPTION_TABLE(16) :text = 0x9090
19499 + .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
19500 + /* End of text section */
19501 + _etext = . - __KERNEL_TEXT_OFFSET;
19502 + }
19503 +
19504 +#ifdef CONFIG_X86_32
19505 + . = ALIGN(PAGE_SIZE);
19506 + .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
19507 + *(.idt)
19508 + . = ALIGN(PAGE_SIZE);
19509 + *(.empty_zero_page)
19510 + *(.swapper_pg_fixmap)
19511 + *(.swapper_pg_pmd)
19512 + *(.swapper_pg_dir)
19513 + *(.trampoline_pg_dir)
19514 + } :rodata
19515 +#endif
19516 +
19517 + . = ALIGN(PAGE_SIZE);
19518 + NOTES :rodata :note
19519 +
19520 + EXCEPTION_TABLE(16) :rodata
19521
19522 RO_DATA(PAGE_SIZE)
19523
19524 /* Data */
19525 .data : AT(ADDR(.data) - LOAD_OFFSET) {
19526 +
19527 +#ifdef CONFIG_PAX_KERNEXEC
19528 + . = ALIGN(HPAGE_SIZE);
19529 +#else
19530 + . = ALIGN(PAGE_SIZE);
19531 +#endif
19532 +
19533 /* Start of data section */
19534 _sdata = .;
19535
19536 /* init_task */
19537 INIT_TASK_DATA(THREAD_SIZE)
19538
19539 -#ifdef CONFIG_X86_32
19540 - /* 32 bit has nosave before _edata */
19541 NOSAVE_DATA
19542 -#endif
19543
19544 PAGE_ALIGNED_DATA(PAGE_SIZE)
19545
19546 @@ -112,6 +175,8 @@ SECTIONS
19547 DATA_DATA
19548 CONSTRUCTORS
19549
19550 + jiffies = jiffies_64;
19551 +
19552 /* rarely changed data like cpu maps */
19553 READ_MOSTLY_DATA(CONFIG_X86_INTERNODE_CACHE_BYTES)
19554
19555 @@ -166,12 +231,6 @@ SECTIONS
19556 }
19557 vgetcpu_mode = VVIRT(.vgetcpu_mode);
19558
19559 - . = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
19560 - .jiffies : AT(VLOAD(.jiffies)) {
19561 - *(.jiffies)
19562 - }
19563 - jiffies = VVIRT(.jiffies);
19564 -
19565 .vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
19566 *(.vsyscall_3)
19567 }
19568 @@ -187,12 +246,19 @@ SECTIONS
19569 #endif /* CONFIG_X86_64 */
19570
19571 /* Init code and data - will be freed after init */
19572 - . = ALIGN(PAGE_SIZE);
19573 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
19574 + BYTE(0)
19575 +
19576 +#ifdef CONFIG_PAX_KERNEXEC
19577 + . = ALIGN(HPAGE_SIZE);
19578 +#else
19579 + . = ALIGN(PAGE_SIZE);
19580 +#endif
19581 +
19582 __init_begin = .; /* paired with __init_end */
19583 - }
19584 + } :init.begin
19585
19586 -#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
19587 +#ifdef CONFIG_SMP
19588 /*
19589 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
19590 * output PHDR, so the next output section - .init.text - should
19591 @@ -201,12 +267,27 @@ SECTIONS
19592 PERCPU_VADDR(0, :percpu)
19593 #endif
19594
19595 - INIT_TEXT_SECTION(PAGE_SIZE)
19596 -#ifdef CONFIG_X86_64
19597 - :init
19598 -#endif
19599 + . = ALIGN(PAGE_SIZE);
19600 + init_begin = .;
19601 + .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
19602 + VMLINUX_SYMBOL(_sinittext) = .;
19603 + INIT_TEXT
19604 + VMLINUX_SYMBOL(_einittext) = .;
19605 + . = ALIGN(PAGE_SIZE);
19606 + } :text.init
19607
19608 - INIT_DATA_SECTION(16)
19609 + /*
19610 + * .exit.text is discard at runtime, not link time, to deal with
19611 + * references from .altinstructions and .eh_frame
19612 + */
19613 + .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
19614 + EXIT_TEXT
19615 + . = ALIGN(16);
19616 + } :text.exit
19617 + . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
19618 +
19619 + . = ALIGN(PAGE_SIZE);
19620 + INIT_DATA_SECTION(16) :init
19621
19622 .x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
19623 __x86_cpu_dev_start = .;
19624 @@ -232,19 +313,11 @@ SECTIONS
19625 *(.altinstr_replacement)
19626 }
19627
19628 - /*
19629 - * .exit.text is discard at runtime, not link time, to deal with
19630 - * references from .altinstructions and .eh_frame
19631 - */
19632 - .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
19633 - EXIT_TEXT
19634 - }
19635 -
19636 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
19637 EXIT_DATA
19638 }
19639
19640 -#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
19641 +#ifndef CONFIG_SMP
19642 PERCPU(PAGE_SIZE)
19643 #endif
19644
19645 @@ -267,12 +340,6 @@ SECTIONS
19646 . = ALIGN(PAGE_SIZE);
19647 }
19648
19649 -#ifdef CONFIG_X86_64
19650 - .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
19651 - NOSAVE_DATA
19652 - }
19653 -#endif
19654 -
19655 /* BSS */
19656 . = ALIGN(PAGE_SIZE);
19657 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
19658 @@ -288,6 +355,7 @@ SECTIONS
19659 __brk_base = .;
19660 . += 64 * 1024; /* 64k alignment slop space */
19661 *(.brk_reservation) /* areas brk users have reserved */
19662 + . = ALIGN(HPAGE_SIZE);
19663 __brk_limit = .;
19664 }
19665
19666 @@ -316,13 +384,12 @@ SECTIONS
19667 * for the boot processor.
19668 */
19669 #define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
19670 -INIT_PER_CPU(gdt_page);
19671 INIT_PER_CPU(irq_stack_union);
19672
19673 /*
19674 * Build-time check on the image size:
19675 */
19676 -. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
19677 +. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
19678 "kernel image bigger than KERNEL_IMAGE_SIZE");
19679
19680 #ifdef CONFIG_SMP
19681 diff -urNp linux-2.6.32.49/arch/x86/kernel/vsyscall_64.c linux-2.6.32.49/arch/x86/kernel/vsyscall_64.c
19682 --- linux-2.6.32.49/arch/x86/kernel/vsyscall_64.c 2011-11-08 19:02:43.000000000 -0500
19683 +++ linux-2.6.32.49/arch/x86/kernel/vsyscall_64.c 2011-11-15 19:59:43.000000000 -0500
19684 @@ -80,6 +80,7 @@ void update_vsyscall(struct timespec *wa
19685
19686 write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
19687 /* copy vsyscall data */
19688 + strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
19689 vsyscall_gtod_data.clock.vread = clock->vread;
19690 vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
19691 vsyscall_gtod_data.clock.mask = clock->mask;
19692 @@ -203,7 +204,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
19693 We do this here because otherwise user space would do it on
19694 its own in a likely inferior way (no access to jiffies).
19695 If you don't like it pass NULL. */
19696 - if (tcache && tcache->blob[0] == (j = __jiffies)) {
19697 + if (tcache && tcache->blob[0] == (j = jiffies)) {
19698 p = tcache->blob[1];
19699 } else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
19700 /* Load per CPU data from RDTSCP */
19701 diff -urNp linux-2.6.32.49/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.49/arch/x86/kernel/x8664_ksyms_64.c
19702 --- linux-2.6.32.49/arch/x86/kernel/x8664_ksyms_64.c 2011-11-08 19:02:43.000000000 -0500
19703 +++ linux-2.6.32.49/arch/x86/kernel/x8664_ksyms_64.c 2011-11-15 19:59:43.000000000 -0500
19704 @@ -30,8 +30,6 @@ EXPORT_SYMBOL(__put_user_8);
19705
19706 EXPORT_SYMBOL(copy_user_generic);
19707 EXPORT_SYMBOL(__copy_user_nocache);
19708 -EXPORT_SYMBOL(copy_from_user);
19709 -EXPORT_SYMBOL(copy_to_user);
19710 EXPORT_SYMBOL(__copy_from_user_inatomic);
19711
19712 EXPORT_SYMBOL(copy_page);
19713 diff -urNp linux-2.6.32.49/arch/x86/kernel/xsave.c linux-2.6.32.49/arch/x86/kernel/xsave.c
19714 --- linux-2.6.32.49/arch/x86/kernel/xsave.c 2011-11-08 19:02:43.000000000 -0500
19715 +++ linux-2.6.32.49/arch/x86/kernel/xsave.c 2011-11-15 19:59:43.000000000 -0500
19716 @@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_
19717 fx_sw_user->xstate_size > fx_sw_user->extended_size)
19718 return -1;
19719
19720 - err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
19721 + err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
19722 fx_sw_user->extended_size -
19723 FP_XSTATE_MAGIC2_SIZE));
19724 /*
19725 @@ -196,7 +196,7 @@ fx_only:
19726 * the other extended state.
19727 */
19728 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
19729 - return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
19730 + return fxrstor_checking((struct i387_fxsave_struct __force_kernel *)buf);
19731 }
19732
19733 /*
19734 @@ -228,7 +228,7 @@ int restore_i387_xstate(void __user *buf
19735 if (task_thread_info(tsk)->status & TS_XSAVE)
19736 err = restore_user_xstate(buf);
19737 else
19738 - err = fxrstor_checking((__force struct i387_fxsave_struct *)
19739 + err = fxrstor_checking((struct i387_fxsave_struct __user *)
19740 buf);
19741 if (unlikely(err)) {
19742 /*
19743 diff -urNp linux-2.6.32.49/arch/x86/kvm/emulate.c linux-2.6.32.49/arch/x86/kvm/emulate.c
19744 --- linux-2.6.32.49/arch/x86/kvm/emulate.c 2011-11-08 19:02:43.000000000 -0500
19745 +++ linux-2.6.32.49/arch/x86/kvm/emulate.c 2011-11-15 19:59:43.000000000 -0500
19746 @@ -81,8 +81,8 @@
19747 #define Src2CL (1<<29)
19748 #define Src2ImmByte (2<<29)
19749 #define Src2One (3<<29)
19750 -#define Src2Imm16 (4<<29)
19751 -#define Src2Mask (7<<29)
19752 +#define Src2Imm16 (4U<<29)
19753 +#define Src2Mask (7U<<29)
19754
19755 enum {
19756 Group1_80, Group1_81, Group1_82, Group1_83,
19757 @@ -411,6 +411,7 @@ static u32 group2_table[] = {
19758
19759 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix) \
19760 do { \
19761 + unsigned long _tmp; \
19762 __asm__ __volatile__ ( \
19763 _PRE_EFLAGS("0", "4", "2") \
19764 _op _suffix " %"_x"3,%1; " \
19765 @@ -424,8 +425,6 @@ static u32 group2_table[] = {
19766 /* Raw emulation: instruction has two explicit operands. */
19767 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
19768 do { \
19769 - unsigned long _tmp; \
19770 - \
19771 switch ((_dst).bytes) { \
19772 case 2: \
19773 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
19774 @@ -441,7 +440,6 @@ static u32 group2_table[] = {
19775
19776 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
19777 do { \
19778 - unsigned long _tmp; \
19779 switch ((_dst).bytes) { \
19780 case 1: \
19781 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b"); \
19782 diff -urNp linux-2.6.32.49/arch/x86/kvm/lapic.c linux-2.6.32.49/arch/x86/kvm/lapic.c
19783 --- linux-2.6.32.49/arch/x86/kvm/lapic.c 2011-11-08 19:02:43.000000000 -0500
19784 +++ linux-2.6.32.49/arch/x86/kvm/lapic.c 2011-11-15 19:59:43.000000000 -0500
19785 @@ -52,7 +52,7 @@
19786 #define APIC_BUS_CYCLE_NS 1
19787
19788 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
19789 -#define apic_debug(fmt, arg...)
19790 +#define apic_debug(fmt, arg...) do {} while (0)
19791
19792 #define APIC_LVT_NUM 6
19793 /* 14 is the version for Xeon and Pentium 8.4.8*/
19794 diff -urNp linux-2.6.32.49/arch/x86/kvm/paging_tmpl.h linux-2.6.32.49/arch/x86/kvm/paging_tmpl.h
19795 --- linux-2.6.32.49/arch/x86/kvm/paging_tmpl.h 2011-11-08 19:02:43.000000000 -0500
19796 +++ linux-2.6.32.49/arch/x86/kvm/paging_tmpl.h 2011-11-18 18:01:55.000000000 -0500
19797 @@ -416,6 +416,8 @@ static int FNAME(page_fault)(struct kvm_
19798 int level = PT_PAGE_TABLE_LEVEL;
19799 unsigned long mmu_seq;
19800
19801 + pax_track_stack();
19802 +
19803 pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
19804 kvm_mmu_audit(vcpu, "pre page fault");
19805
19806 @@ -461,6 +463,7 @@ static int FNAME(page_fault)(struct kvm_
19807 kvm_mmu_free_some_pages(vcpu);
19808 sptep = FNAME(fetch)(vcpu, addr, &walker, user_fault, write_fault,
19809 level, &write_pt, pfn);
19810 + (void)sptep;
19811 pgprintk("%s: shadow pte %p %llx ptwrite %d\n", __func__,
19812 sptep, *sptep, write_pt);
19813
19814 diff -urNp linux-2.6.32.49/arch/x86/kvm/svm.c linux-2.6.32.49/arch/x86/kvm/svm.c
19815 --- linux-2.6.32.49/arch/x86/kvm/svm.c 2011-11-08 19:02:43.000000000 -0500
19816 +++ linux-2.6.32.49/arch/x86/kvm/svm.c 2011-11-15 19:59:43.000000000 -0500
19817 @@ -2486,7 +2486,11 @@ static void reload_tss(struct kvm_vcpu *
19818 int cpu = raw_smp_processor_id();
19819
19820 struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
19821 +
19822 + pax_open_kernel();
19823 svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
19824 + pax_close_kernel();
19825 +
19826 load_TR_desc();
19827 }
19828
19829 @@ -2947,7 +2951,7 @@ static bool svm_gb_page_enable(void)
19830 return true;
19831 }
19832
19833 -static struct kvm_x86_ops svm_x86_ops = {
19834 +static const struct kvm_x86_ops svm_x86_ops = {
19835 .cpu_has_kvm_support = has_svm,
19836 .disabled_by_bios = is_disabled,
19837 .hardware_setup = svm_hardware_setup,
19838 diff -urNp linux-2.6.32.49/arch/x86/kvm/vmx.c linux-2.6.32.49/arch/x86/kvm/vmx.c
19839 --- linux-2.6.32.49/arch/x86/kvm/vmx.c 2011-11-08 19:02:43.000000000 -0500
19840 +++ linux-2.6.32.49/arch/x86/kvm/vmx.c 2011-11-15 19:59:43.000000000 -0500
19841 @@ -570,7 +570,11 @@ static void reload_tss(void)
19842
19843 kvm_get_gdt(&gdt);
19844 descs = (void *)gdt.base;
19845 +
19846 + pax_open_kernel();
19847 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
19848 + pax_close_kernel();
19849 +
19850 load_TR_desc();
19851 }
19852
19853 @@ -1410,8 +1414,11 @@ static __init int hardware_setup(void)
19854 if (!cpu_has_vmx_flexpriority())
19855 flexpriority_enabled = 0;
19856
19857 - if (!cpu_has_vmx_tpr_shadow())
19858 - kvm_x86_ops->update_cr8_intercept = NULL;
19859 + if (!cpu_has_vmx_tpr_shadow()) {
19860 + pax_open_kernel();
19861 + *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
19862 + pax_close_kernel();
19863 + }
19864
19865 if (enable_ept && !cpu_has_vmx_ept_2m_page())
19866 kvm_disable_largepages();
19867 @@ -2362,7 +2369,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
19868 vmcs_writel(HOST_IDTR_BASE, dt.base); /* 22.2.4 */
19869
19870 asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
19871 - vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
19872 + vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
19873 vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
19874 vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
19875 vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
19876 @@ -3718,6 +3725,12 @@ static void vmx_vcpu_run(struct kvm_vcpu
19877 "jmp .Lkvm_vmx_return \n\t"
19878 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
19879 ".Lkvm_vmx_return: "
19880 +
19881 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
19882 + "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
19883 + ".Lkvm_vmx_return2: "
19884 +#endif
19885 +
19886 /* Save guest registers, load host registers, keep flags */
19887 "xchg %0, (%%"R"sp) \n\t"
19888 "mov %%"R"ax, %c[rax](%0) \n\t"
19889 @@ -3764,8 +3777,13 @@ static void vmx_vcpu_run(struct kvm_vcpu
19890 [r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
19891 #endif
19892 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2))
19893 +
19894 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
19895 + ,[cs]"i"(__KERNEL_CS)
19896 +#endif
19897 +
19898 : "cc", "memory"
19899 - , R"bx", R"di", R"si"
19900 + , R"ax", R"bx", R"di", R"si"
19901 #ifdef CONFIG_X86_64
19902 , "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
19903 #endif
19904 @@ -3782,7 +3800,16 @@ static void vmx_vcpu_run(struct kvm_vcpu
19905 if (vmx->rmode.irq.pending)
19906 fixup_rmode_irq(vmx);
19907
19908 - asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
19909 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
19910 +
19911 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
19912 + loadsegment(fs, __KERNEL_PERCPU);
19913 +#endif
19914 +
19915 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19916 + __set_fs(current_thread_info()->addr_limit);
19917 +#endif
19918 +
19919 vmx->launched = 1;
19920
19921 vmx_complete_interrupts(vmx);
19922 @@ -3957,7 +3984,7 @@ static bool vmx_gb_page_enable(void)
19923 return false;
19924 }
19925
19926 -static struct kvm_x86_ops vmx_x86_ops = {
19927 +static const struct kvm_x86_ops vmx_x86_ops = {
19928 .cpu_has_kvm_support = cpu_has_kvm_support,
19929 .disabled_by_bios = vmx_disabled_by_bios,
19930 .hardware_setup = hardware_setup,
19931 diff -urNp linux-2.6.32.49/arch/x86/kvm/x86.c linux-2.6.32.49/arch/x86/kvm/x86.c
19932 --- linux-2.6.32.49/arch/x86/kvm/x86.c 2011-11-08 19:02:43.000000000 -0500
19933 +++ linux-2.6.32.49/arch/x86/kvm/x86.c 2011-11-15 19:59:43.000000000 -0500
19934 @@ -82,7 +82,7 @@ static void update_cr8_intercept(struct
19935 static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
19936 struct kvm_cpuid_entry2 __user *entries);
19937
19938 -struct kvm_x86_ops *kvm_x86_ops;
19939 +const struct kvm_x86_ops *kvm_x86_ops;
19940 EXPORT_SYMBOL_GPL(kvm_x86_ops);
19941
19942 int ignore_msrs = 0;
19943 @@ -1430,15 +1430,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(str
19944 struct kvm_cpuid2 *cpuid,
19945 struct kvm_cpuid_entry2 __user *entries)
19946 {
19947 - int r;
19948 + int r, i;
19949
19950 r = -E2BIG;
19951 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
19952 goto out;
19953 r = -EFAULT;
19954 - if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
19955 - cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
19956 + if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
19957 goto out;
19958 + for (i = 0; i < cpuid->nent; ++i) {
19959 + struct kvm_cpuid_entry2 cpuid_entry;
19960 + if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
19961 + goto out;
19962 + vcpu->arch.cpuid_entries[i] = cpuid_entry;
19963 + }
19964 vcpu->arch.cpuid_nent = cpuid->nent;
19965 kvm_apic_set_version(vcpu);
19966 return 0;
19967 @@ -1451,16 +1456,20 @@ static int kvm_vcpu_ioctl_get_cpuid2(str
19968 struct kvm_cpuid2 *cpuid,
19969 struct kvm_cpuid_entry2 __user *entries)
19970 {
19971 - int r;
19972 + int r, i;
19973
19974 vcpu_load(vcpu);
19975 r = -E2BIG;
19976 if (cpuid->nent < vcpu->arch.cpuid_nent)
19977 goto out;
19978 r = -EFAULT;
19979 - if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
19980 - vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
19981 + if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
19982 goto out;
19983 + for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
19984 + struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
19985 + if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
19986 + goto out;
19987 + }
19988 return 0;
19989
19990 out:
19991 @@ -1678,7 +1687,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
19992 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
19993 struct kvm_interrupt *irq)
19994 {
19995 - if (irq->irq < 0 || irq->irq >= 256)
19996 + if (irq->irq >= 256)
19997 return -EINVAL;
19998 if (irqchip_in_kernel(vcpu->kvm))
19999 return -ENXIO;
20000 @@ -3260,10 +3269,10 @@ static struct notifier_block kvmclock_cp
20001 .notifier_call = kvmclock_cpufreq_notifier
20002 };
20003
20004 -int kvm_arch_init(void *opaque)
20005 +int kvm_arch_init(const void *opaque)
20006 {
20007 int r, cpu;
20008 - struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
20009 + const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
20010
20011 if (kvm_x86_ops) {
20012 printk(KERN_ERR "kvm: already loaded the other module\n");
20013 diff -urNp linux-2.6.32.49/arch/x86/lguest/boot.c linux-2.6.32.49/arch/x86/lguest/boot.c
20014 --- linux-2.6.32.49/arch/x86/lguest/boot.c 2011-11-08 19:02:43.000000000 -0500
20015 +++ linux-2.6.32.49/arch/x86/lguest/boot.c 2011-11-15 19:59:43.000000000 -0500
20016 @@ -1172,9 +1172,10 @@ static __init int early_put_chars(u32 vt
20017 * Rebooting also tells the Host we're finished, but the RESTART flag tells the
20018 * Launcher to reboot us.
20019 */
20020 -static void lguest_restart(char *reason)
20021 +static __noreturn void lguest_restart(char *reason)
20022 {
20023 kvm_hypercall2(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART);
20024 + BUG();
20025 }
20026
20027 /*G:050
20028 diff -urNp linux-2.6.32.49/arch/x86/lib/atomic64_32.c linux-2.6.32.49/arch/x86/lib/atomic64_32.c
20029 --- linux-2.6.32.49/arch/x86/lib/atomic64_32.c 2011-11-08 19:02:43.000000000 -0500
20030 +++ linux-2.6.32.49/arch/x86/lib/atomic64_32.c 2011-11-15 19:59:43.000000000 -0500
20031 @@ -25,6 +25,12 @@ u64 atomic64_cmpxchg(atomic64_t *ptr, u6
20032 }
20033 EXPORT_SYMBOL(atomic64_cmpxchg);
20034
20035 +u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old_val, u64 new_val)
20036 +{
20037 + return cmpxchg8b(&ptr->counter, old_val, new_val);
20038 +}
20039 +EXPORT_SYMBOL(atomic64_cmpxchg_unchecked);
20040 +
20041 /**
20042 * atomic64_xchg - xchg atomic64 variable
20043 * @ptr: pointer to type atomic64_t
20044 @@ -56,6 +62,36 @@ u64 atomic64_xchg(atomic64_t *ptr, u64 n
20045 EXPORT_SYMBOL(atomic64_xchg);
20046
20047 /**
20048 + * atomic64_xchg_unchecked - xchg atomic64 variable
20049 + * @ptr: pointer to type atomic64_unchecked_t
20050 + * @new_val: value to assign
20051 + *
20052 + * Atomically xchgs the value of @ptr to @new_val and returns
20053 + * the old value.
20054 + */
20055 +u64 atomic64_xchg_unchecked(atomic64_unchecked_t *ptr, u64 new_val)
20056 +{
20057 + /*
20058 + * Try first with a (possibly incorrect) assumption about
20059 + * what we have there. We'll do two loops most likely,
20060 + * but we'll get an ownership MESI transaction straight away
20061 + * instead of a read transaction followed by a
20062 + * flush-for-ownership transaction:
20063 + */
20064 + u64 old_val, real_val = 0;
20065 +
20066 + do {
20067 + old_val = real_val;
20068 +
20069 + real_val = atomic64_cmpxchg_unchecked(ptr, old_val, new_val);
20070 +
20071 + } while (real_val != old_val);
20072 +
20073 + return old_val;
20074 +}
20075 +EXPORT_SYMBOL(atomic64_xchg_unchecked);
20076 +
20077 +/**
20078 * atomic64_set - set atomic64 variable
20079 * @ptr: pointer to type atomic64_t
20080 * @new_val: value to assign
20081 @@ -69,7 +105,19 @@ void atomic64_set(atomic64_t *ptr, u64 n
20082 EXPORT_SYMBOL(atomic64_set);
20083
20084 /**
20085 -EXPORT_SYMBOL(atomic64_read);
20086 + * atomic64_unchecked_set - set atomic64 variable
20087 + * @ptr: pointer to type atomic64_unchecked_t
20088 + * @new_val: value to assign
20089 + *
20090 + * Atomically sets the value of @ptr to @new_val.
20091 + */
20092 +void atomic64_set_unchecked(atomic64_unchecked_t *ptr, u64 new_val)
20093 +{
20094 + atomic64_xchg_unchecked(ptr, new_val);
20095 +}
20096 +EXPORT_SYMBOL(atomic64_set_unchecked);
20097 +
20098 +/**
20099 * atomic64_add_return - add and return
20100 * @delta: integer value to add
20101 * @ptr: pointer to type atomic64_t
20102 @@ -99,24 +147,72 @@ noinline u64 atomic64_add_return(u64 del
20103 }
20104 EXPORT_SYMBOL(atomic64_add_return);
20105
20106 +/**
20107 + * atomic64_add_return_unchecked - add and return
20108 + * @delta: integer value to add
20109 + * @ptr: pointer to type atomic64_unchecked_t
20110 + *
20111 + * Atomically adds @delta to @ptr and returns @delta + *@ptr
20112 + */
20113 +noinline u64 atomic64_add_return_unchecked(u64 delta, atomic64_unchecked_t *ptr)
20114 +{
20115 + /*
20116 + * Try first with a (possibly incorrect) assumption about
20117 + * what we have there. We'll do two loops most likely,
20118 + * but we'll get an ownership MESI transaction straight away
20119 + * instead of a read transaction followed by a
20120 + * flush-for-ownership transaction:
20121 + */
20122 + u64 old_val, new_val, real_val = 0;
20123 +
20124 + do {
20125 + old_val = real_val;
20126 + new_val = old_val + delta;
20127 +
20128 + real_val = atomic64_cmpxchg_unchecked(ptr, old_val, new_val);
20129 +
20130 + } while (real_val != old_val);
20131 +
20132 + return new_val;
20133 +}
20134 +EXPORT_SYMBOL(atomic64_add_return_unchecked);
20135 +
20136 u64 atomic64_sub_return(u64 delta, atomic64_t *ptr)
20137 {
20138 return atomic64_add_return(-delta, ptr);
20139 }
20140 EXPORT_SYMBOL(atomic64_sub_return);
20141
20142 +u64 atomic64_sub_return_unchecked(u64 delta, atomic64_unchecked_t *ptr)
20143 +{
20144 + return atomic64_add_return_unchecked(-delta, ptr);
20145 +}
20146 +EXPORT_SYMBOL(atomic64_sub_return_unchecked);
20147 +
20148 u64 atomic64_inc_return(atomic64_t *ptr)
20149 {
20150 return atomic64_add_return(1, ptr);
20151 }
20152 EXPORT_SYMBOL(atomic64_inc_return);
20153
20154 +u64 atomic64_inc_return_unchecked(atomic64_unchecked_t *ptr)
20155 +{
20156 + return atomic64_add_return_unchecked(1, ptr);
20157 +}
20158 +EXPORT_SYMBOL(atomic64_inc_return_unchecked);
20159 +
20160 u64 atomic64_dec_return(atomic64_t *ptr)
20161 {
20162 return atomic64_sub_return(1, ptr);
20163 }
20164 EXPORT_SYMBOL(atomic64_dec_return);
20165
20166 +u64 atomic64_dec_return_unchecked(atomic64_unchecked_t *ptr)
20167 +{
20168 + return atomic64_sub_return_unchecked(1, ptr);
20169 +}
20170 +EXPORT_SYMBOL(atomic64_dec_return_unchecked);
20171 +
20172 /**
20173 * atomic64_add - add integer to atomic64 variable
20174 * @delta: integer value to add
20175 @@ -131,6 +227,19 @@ void atomic64_add(u64 delta, atomic64_t
20176 EXPORT_SYMBOL(atomic64_add);
20177
20178 /**
20179 + * atomic64_add_unchecked - add integer to atomic64 variable
20180 + * @delta: integer value to add
20181 + * @ptr: pointer to type atomic64_unchecked_t
20182 + *
20183 + * Atomically adds @delta to @ptr.
20184 + */
20185 +void atomic64_add_unchecked(u64 delta, atomic64_unchecked_t *ptr)
20186 +{
20187 + atomic64_add_return_unchecked(delta, ptr);
20188 +}
20189 +EXPORT_SYMBOL(atomic64_add_unchecked);
20190 +
20191 +/**
20192 * atomic64_sub - subtract the atomic64 variable
20193 * @delta: integer value to subtract
20194 * @ptr: pointer to type atomic64_t
20195 @@ -144,6 +253,19 @@ void atomic64_sub(u64 delta, atomic64_t
20196 EXPORT_SYMBOL(atomic64_sub);
20197
20198 /**
20199 + * atomic64_sub_unchecked - subtract the atomic64 variable
20200 + * @delta: integer value to subtract
20201 + * @ptr: pointer to type atomic64_unchecked_t
20202 + *
20203 + * Atomically subtracts @delta from @ptr.
20204 + */
20205 +void atomic64_sub_unchecked(u64 delta, atomic64_unchecked_t *ptr)
20206 +{
20207 + atomic64_add_unchecked(-delta, ptr);
20208 +}
20209 +EXPORT_SYMBOL(atomic64_sub_unchecked);
20210 +
20211 +/**
20212 * atomic64_sub_and_test - subtract value from variable and test result
20213 * @delta: integer value to subtract
20214 * @ptr: pointer to type atomic64_t
20215 @@ -173,6 +295,18 @@ void atomic64_inc(atomic64_t *ptr)
20216 EXPORT_SYMBOL(atomic64_inc);
20217
20218 /**
20219 + * atomic64_inc_unchecked - increment atomic64 variable
20220 + * @ptr: pointer to type atomic64_unchecked_t
20221 + *
20222 + * Atomically increments @ptr by 1.
20223 + */
20224 +void atomic64_inc_unchecked(atomic64_unchecked_t *ptr)
20225 +{
20226 + atomic64_add_unchecked(1, ptr);
20227 +}
20228 +EXPORT_SYMBOL(atomic64_inc_unchecked);
20229 +
20230 +/**
20231 * atomic64_dec - decrement atomic64 variable
20232 * @ptr: pointer to type atomic64_t
20233 *
20234 @@ -185,6 +319,18 @@ void atomic64_dec(atomic64_t *ptr)
20235 EXPORT_SYMBOL(atomic64_dec);
20236
20237 /**
20238 + * atomic64_dec_unchecked - decrement atomic64 variable
20239 + * @ptr: pointer to type atomic64_unchecked_t
20240 + *
20241 + * Atomically decrements @ptr by 1.
20242 + */
20243 +void atomic64_dec_unchecked(atomic64_unchecked_t *ptr)
20244 +{
20245 + atomic64_sub_unchecked(1, ptr);
20246 +}
20247 +EXPORT_SYMBOL(atomic64_dec_unchecked);
20248 +
20249 +/**
20250 * atomic64_dec_and_test - decrement and test
20251 * @ptr: pointer to type atomic64_t
20252 *
20253 diff -urNp linux-2.6.32.49/arch/x86/lib/checksum_32.S linux-2.6.32.49/arch/x86/lib/checksum_32.S
20254 --- linux-2.6.32.49/arch/x86/lib/checksum_32.S 2011-11-08 19:02:43.000000000 -0500
20255 +++ linux-2.6.32.49/arch/x86/lib/checksum_32.S 2011-11-15 19:59:43.000000000 -0500
20256 @@ -28,7 +28,8 @@
20257 #include <linux/linkage.h>
20258 #include <asm/dwarf2.h>
20259 #include <asm/errno.h>
20260 -
20261 +#include <asm/segment.h>
20262 +
20263 /*
20264 * computes a partial checksum, e.g. for TCP/UDP fragments
20265 */
20266 @@ -304,9 +305,28 @@ unsigned int csum_partial_copy_generic (
20267
20268 #define ARGBASE 16
20269 #define FP 12
20270 -
20271 -ENTRY(csum_partial_copy_generic)
20272 +
20273 +ENTRY(csum_partial_copy_generic_to_user)
20274 CFI_STARTPROC
20275 +
20276 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20277 + pushl %gs
20278 + CFI_ADJUST_CFA_OFFSET 4
20279 + popl %es
20280 + CFI_ADJUST_CFA_OFFSET -4
20281 + jmp csum_partial_copy_generic
20282 +#endif
20283 +
20284 +ENTRY(csum_partial_copy_generic_from_user)
20285 +
20286 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20287 + pushl %gs
20288 + CFI_ADJUST_CFA_OFFSET 4
20289 + popl %ds
20290 + CFI_ADJUST_CFA_OFFSET -4
20291 +#endif
20292 +
20293 +ENTRY(csum_partial_copy_generic)
20294 subl $4,%esp
20295 CFI_ADJUST_CFA_OFFSET 4
20296 pushl %edi
20297 @@ -331,7 +351,7 @@ ENTRY(csum_partial_copy_generic)
20298 jmp 4f
20299 SRC(1: movw (%esi), %bx )
20300 addl $2, %esi
20301 -DST( movw %bx, (%edi) )
20302 +DST( movw %bx, %es:(%edi) )
20303 addl $2, %edi
20304 addw %bx, %ax
20305 adcl $0, %eax
20306 @@ -343,30 +363,30 @@ DST( movw %bx, (%edi) )
20307 SRC(1: movl (%esi), %ebx )
20308 SRC( movl 4(%esi), %edx )
20309 adcl %ebx, %eax
20310 -DST( movl %ebx, (%edi) )
20311 +DST( movl %ebx, %es:(%edi) )
20312 adcl %edx, %eax
20313 -DST( movl %edx, 4(%edi) )
20314 +DST( movl %edx, %es:4(%edi) )
20315
20316 SRC( movl 8(%esi), %ebx )
20317 SRC( movl 12(%esi), %edx )
20318 adcl %ebx, %eax
20319 -DST( movl %ebx, 8(%edi) )
20320 +DST( movl %ebx, %es:8(%edi) )
20321 adcl %edx, %eax
20322 -DST( movl %edx, 12(%edi) )
20323 +DST( movl %edx, %es:12(%edi) )
20324
20325 SRC( movl 16(%esi), %ebx )
20326 SRC( movl 20(%esi), %edx )
20327 adcl %ebx, %eax
20328 -DST( movl %ebx, 16(%edi) )
20329 +DST( movl %ebx, %es:16(%edi) )
20330 adcl %edx, %eax
20331 -DST( movl %edx, 20(%edi) )
20332 +DST( movl %edx, %es:20(%edi) )
20333
20334 SRC( movl 24(%esi), %ebx )
20335 SRC( movl 28(%esi), %edx )
20336 adcl %ebx, %eax
20337 -DST( movl %ebx, 24(%edi) )
20338 +DST( movl %ebx, %es:24(%edi) )
20339 adcl %edx, %eax
20340 -DST( movl %edx, 28(%edi) )
20341 +DST( movl %edx, %es:28(%edi) )
20342
20343 lea 32(%esi), %esi
20344 lea 32(%edi), %edi
20345 @@ -380,7 +400,7 @@ DST( movl %edx, 28(%edi) )
20346 shrl $2, %edx # This clears CF
20347 SRC(3: movl (%esi), %ebx )
20348 adcl %ebx, %eax
20349 -DST( movl %ebx, (%edi) )
20350 +DST( movl %ebx, %es:(%edi) )
20351 lea 4(%esi), %esi
20352 lea 4(%edi), %edi
20353 dec %edx
20354 @@ -392,12 +412,12 @@ DST( movl %ebx, (%edi) )
20355 jb 5f
20356 SRC( movw (%esi), %cx )
20357 leal 2(%esi), %esi
20358 -DST( movw %cx, (%edi) )
20359 +DST( movw %cx, %es:(%edi) )
20360 leal 2(%edi), %edi
20361 je 6f
20362 shll $16,%ecx
20363 SRC(5: movb (%esi), %cl )
20364 -DST( movb %cl, (%edi) )
20365 +DST( movb %cl, %es:(%edi) )
20366 6: addl %ecx, %eax
20367 adcl $0, %eax
20368 7:
20369 @@ -408,7 +428,7 @@ DST( movb %cl, (%edi) )
20370
20371 6001:
20372 movl ARGBASE+20(%esp), %ebx # src_err_ptr
20373 - movl $-EFAULT, (%ebx)
20374 + movl $-EFAULT, %ss:(%ebx)
20375
20376 # zero the complete destination - computing the rest
20377 # is too much work
20378 @@ -421,11 +441,19 @@ DST( movb %cl, (%edi) )
20379
20380 6002:
20381 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
20382 - movl $-EFAULT,(%ebx)
20383 + movl $-EFAULT,%ss:(%ebx)
20384 jmp 5000b
20385
20386 .previous
20387
20388 + pushl %ss
20389 + CFI_ADJUST_CFA_OFFSET 4
20390 + popl %ds
20391 + CFI_ADJUST_CFA_OFFSET -4
20392 + pushl %ss
20393 + CFI_ADJUST_CFA_OFFSET 4
20394 + popl %es
20395 + CFI_ADJUST_CFA_OFFSET -4
20396 popl %ebx
20397 CFI_ADJUST_CFA_OFFSET -4
20398 CFI_RESTORE ebx
20399 @@ -439,26 +467,47 @@ DST( movb %cl, (%edi) )
20400 CFI_ADJUST_CFA_OFFSET -4
20401 ret
20402 CFI_ENDPROC
20403 -ENDPROC(csum_partial_copy_generic)
20404 +ENDPROC(csum_partial_copy_generic_to_user)
20405
20406 #else
20407
20408 /* Version for PentiumII/PPro */
20409
20410 #define ROUND1(x) \
20411 + nop; nop; nop; \
20412 SRC(movl x(%esi), %ebx ) ; \
20413 addl %ebx, %eax ; \
20414 - DST(movl %ebx, x(%edi) ) ;
20415 + DST(movl %ebx, %es:x(%edi)) ;
20416
20417 #define ROUND(x) \
20418 + nop; nop; nop; \
20419 SRC(movl x(%esi), %ebx ) ; \
20420 adcl %ebx, %eax ; \
20421 - DST(movl %ebx, x(%edi) ) ;
20422 + DST(movl %ebx, %es:x(%edi)) ;
20423
20424 #define ARGBASE 12
20425 -
20426 -ENTRY(csum_partial_copy_generic)
20427 +
20428 +ENTRY(csum_partial_copy_generic_to_user)
20429 CFI_STARTPROC
20430 +
20431 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20432 + pushl %gs
20433 + CFI_ADJUST_CFA_OFFSET 4
20434 + popl %es
20435 + CFI_ADJUST_CFA_OFFSET -4
20436 + jmp csum_partial_copy_generic
20437 +#endif
20438 +
20439 +ENTRY(csum_partial_copy_generic_from_user)
20440 +
20441 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20442 + pushl %gs
20443 + CFI_ADJUST_CFA_OFFSET 4
20444 + popl %ds
20445 + CFI_ADJUST_CFA_OFFSET -4
20446 +#endif
20447 +
20448 +ENTRY(csum_partial_copy_generic)
20449 pushl %ebx
20450 CFI_ADJUST_CFA_OFFSET 4
20451 CFI_REL_OFFSET ebx, 0
20452 @@ -482,7 +531,7 @@ ENTRY(csum_partial_copy_generic)
20453 subl %ebx, %edi
20454 lea -1(%esi),%edx
20455 andl $-32,%edx
20456 - lea 3f(%ebx,%ebx), %ebx
20457 + lea 3f(%ebx,%ebx,2), %ebx
20458 testl %esi, %esi
20459 jmp *%ebx
20460 1: addl $64,%esi
20461 @@ -503,19 +552,19 @@ ENTRY(csum_partial_copy_generic)
20462 jb 5f
20463 SRC( movw (%esi), %dx )
20464 leal 2(%esi), %esi
20465 -DST( movw %dx, (%edi) )
20466 +DST( movw %dx, %es:(%edi) )
20467 leal 2(%edi), %edi
20468 je 6f
20469 shll $16,%edx
20470 5:
20471 SRC( movb (%esi), %dl )
20472 -DST( movb %dl, (%edi) )
20473 +DST( movb %dl, %es:(%edi) )
20474 6: addl %edx, %eax
20475 adcl $0, %eax
20476 7:
20477 .section .fixup, "ax"
20478 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
20479 - movl $-EFAULT, (%ebx)
20480 + movl $-EFAULT, %ss:(%ebx)
20481 # zero the complete destination (computing the rest is too much work)
20482 movl ARGBASE+8(%esp),%edi # dst
20483 movl ARGBASE+12(%esp),%ecx # len
20484 @@ -523,10 +572,21 @@ DST( movb %dl, (%edi) )
20485 rep; stosb
20486 jmp 7b
20487 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
20488 - movl $-EFAULT, (%ebx)
20489 + movl $-EFAULT, %ss:(%ebx)
20490 jmp 7b
20491 .previous
20492
20493 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20494 + pushl %ss
20495 + CFI_ADJUST_CFA_OFFSET 4
20496 + popl %ds
20497 + CFI_ADJUST_CFA_OFFSET -4
20498 + pushl %ss
20499 + CFI_ADJUST_CFA_OFFSET 4
20500 + popl %es
20501 + CFI_ADJUST_CFA_OFFSET -4
20502 +#endif
20503 +
20504 popl %esi
20505 CFI_ADJUST_CFA_OFFSET -4
20506 CFI_RESTORE esi
20507 @@ -538,7 +598,7 @@ DST( movb %dl, (%edi) )
20508 CFI_RESTORE ebx
20509 ret
20510 CFI_ENDPROC
20511 -ENDPROC(csum_partial_copy_generic)
20512 +ENDPROC(csum_partial_copy_generic_to_user)
20513
20514 #undef ROUND
20515 #undef ROUND1
20516 diff -urNp linux-2.6.32.49/arch/x86/lib/clear_page_64.S linux-2.6.32.49/arch/x86/lib/clear_page_64.S
20517 --- linux-2.6.32.49/arch/x86/lib/clear_page_64.S 2011-11-08 19:02:43.000000000 -0500
20518 +++ linux-2.6.32.49/arch/x86/lib/clear_page_64.S 2011-11-15 19:59:43.000000000 -0500
20519 @@ -1,5 +1,6 @@
20520 #include <linux/linkage.h>
20521 #include <asm/dwarf2.h>
20522 +#include <asm/alternative-asm.h>
20523
20524 /*
20525 * Zero a page.
20526 @@ -10,6 +11,7 @@ ENTRY(clear_page_c)
20527 movl $4096/8,%ecx
20528 xorl %eax,%eax
20529 rep stosq
20530 + pax_force_retaddr
20531 ret
20532 CFI_ENDPROC
20533 ENDPROC(clear_page_c)
20534 @@ -33,6 +35,7 @@ ENTRY(clear_page)
20535 leaq 64(%rdi),%rdi
20536 jnz .Lloop
20537 nop
20538 + pax_force_retaddr
20539 ret
20540 CFI_ENDPROC
20541 .Lclear_page_end:
20542 @@ -43,7 +46,7 @@ ENDPROC(clear_page)
20543
20544 #include <asm/cpufeature.h>
20545
20546 - .section .altinstr_replacement,"ax"
20547 + .section .altinstr_replacement,"a"
20548 1: .byte 0xeb /* jmp <disp8> */
20549 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
20550 2:
20551 diff -urNp linux-2.6.32.49/arch/x86/lib/copy_page_64.S linux-2.6.32.49/arch/x86/lib/copy_page_64.S
20552 --- linux-2.6.32.49/arch/x86/lib/copy_page_64.S 2011-11-08 19:02:43.000000000 -0500
20553 +++ linux-2.6.32.49/arch/x86/lib/copy_page_64.S 2011-11-15 19:59:43.000000000 -0500
20554 @@ -2,12 +2,14 @@
20555
20556 #include <linux/linkage.h>
20557 #include <asm/dwarf2.h>
20558 +#include <asm/alternative-asm.h>
20559
20560 ALIGN
20561 copy_page_c:
20562 CFI_STARTPROC
20563 movl $4096/8,%ecx
20564 rep movsq
20565 + pax_force_retaddr
20566 ret
20567 CFI_ENDPROC
20568 ENDPROC(copy_page_c)
20569 @@ -94,6 +96,7 @@ ENTRY(copy_page)
20570 CFI_RESTORE r13
20571 addq $3*8,%rsp
20572 CFI_ADJUST_CFA_OFFSET -3*8
20573 + pax_force_retaddr
20574 ret
20575 .Lcopy_page_end:
20576 CFI_ENDPROC
20577 @@ -104,7 +107,7 @@ ENDPROC(copy_page)
20578
20579 #include <asm/cpufeature.h>
20580
20581 - .section .altinstr_replacement,"ax"
20582 + .section .altinstr_replacement,"a"
20583 1: .byte 0xeb /* jmp <disp8> */
20584 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
20585 2:
20586 diff -urNp linux-2.6.32.49/arch/x86/lib/copy_user_64.S linux-2.6.32.49/arch/x86/lib/copy_user_64.S
20587 --- linux-2.6.32.49/arch/x86/lib/copy_user_64.S 2011-11-08 19:02:43.000000000 -0500
20588 +++ linux-2.6.32.49/arch/x86/lib/copy_user_64.S 2011-11-15 19:59:43.000000000 -0500
20589 @@ -15,13 +15,15 @@
20590 #include <asm/asm-offsets.h>
20591 #include <asm/thread_info.h>
20592 #include <asm/cpufeature.h>
20593 +#include <asm/pgtable.h>
20594 +#include <asm/alternative-asm.h>
20595
20596 .macro ALTERNATIVE_JUMP feature,orig,alt
20597 0:
20598 .byte 0xe9 /* 32bit jump */
20599 .long \orig-1f /* by default jump to orig */
20600 1:
20601 - .section .altinstr_replacement,"ax"
20602 + .section .altinstr_replacement,"a"
20603 2: .byte 0xe9 /* near jump with 32bit immediate */
20604 .long \alt-1b /* offset */ /* or alternatively to alt */
20605 .previous
20606 @@ -64,55 +66,26 @@
20607 #endif
20608 .endm
20609
20610 -/* Standard copy_to_user with segment limit checking */
20611 -ENTRY(copy_to_user)
20612 - CFI_STARTPROC
20613 - GET_THREAD_INFO(%rax)
20614 - movq %rdi,%rcx
20615 - addq %rdx,%rcx
20616 - jc bad_to_user
20617 - cmpq TI_addr_limit(%rax),%rcx
20618 - ja bad_to_user
20619 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
20620 - CFI_ENDPROC
20621 -ENDPROC(copy_to_user)
20622 -
20623 -/* Standard copy_from_user with segment limit checking */
20624 -ENTRY(copy_from_user)
20625 - CFI_STARTPROC
20626 - GET_THREAD_INFO(%rax)
20627 - movq %rsi,%rcx
20628 - addq %rdx,%rcx
20629 - jc bad_from_user
20630 - cmpq TI_addr_limit(%rax),%rcx
20631 - ja bad_from_user
20632 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
20633 - CFI_ENDPROC
20634 -ENDPROC(copy_from_user)
20635 -
20636 ENTRY(copy_user_generic)
20637 CFI_STARTPROC
20638 ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
20639 CFI_ENDPROC
20640 ENDPROC(copy_user_generic)
20641
20642 -ENTRY(__copy_from_user_inatomic)
20643 - CFI_STARTPROC
20644 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
20645 - CFI_ENDPROC
20646 -ENDPROC(__copy_from_user_inatomic)
20647 -
20648 .section .fixup,"ax"
20649 /* must zero dest */
20650 ENTRY(bad_from_user)
20651 bad_from_user:
20652 CFI_STARTPROC
20653 + testl %edx,%edx
20654 + js bad_to_user
20655 movl %edx,%ecx
20656 xorl %eax,%eax
20657 rep
20658 stosb
20659 bad_to_user:
20660 movl %edx,%eax
20661 + pax_force_retaddr
20662 ret
20663 CFI_ENDPROC
20664 ENDPROC(bad_from_user)
20665 @@ -180,6 +153,7 @@ ENTRY(copy_user_generic_unrolled)
20666 decl %ecx
20667 jnz 21b
20668 23: xor %eax,%eax
20669 + pax_force_retaddr
20670 ret
20671
20672 .section .fixup,"ax"
20673 @@ -252,6 +226,7 @@ ENTRY(copy_user_generic_string)
20674 3: rep
20675 movsb
20676 4: xorl %eax,%eax
20677 + pax_force_retaddr
20678 ret
20679
20680 .section .fixup,"ax"
20681 diff -urNp linux-2.6.32.49/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.49/arch/x86/lib/copy_user_nocache_64.S
20682 --- linux-2.6.32.49/arch/x86/lib/copy_user_nocache_64.S 2011-11-08 19:02:43.000000000 -0500
20683 +++ linux-2.6.32.49/arch/x86/lib/copy_user_nocache_64.S 2011-11-15 19:59:43.000000000 -0500
20684 @@ -8,12 +8,14 @@
20685
20686 #include <linux/linkage.h>
20687 #include <asm/dwarf2.h>
20688 +#include <asm/alternative-asm.h>
20689
20690 #define FIX_ALIGNMENT 1
20691
20692 #include <asm/current.h>
20693 #include <asm/asm-offsets.h>
20694 #include <asm/thread_info.h>
20695 +#include <asm/pgtable.h>
20696
20697 .macro ALIGN_DESTINATION
20698 #ifdef FIX_ALIGNMENT
20699 @@ -50,6 +52,15 @@
20700 */
20701 ENTRY(__copy_user_nocache)
20702 CFI_STARTPROC
20703 +
20704 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20705 + mov $PAX_USER_SHADOW_BASE,%rcx
20706 + cmp %rcx,%rsi
20707 + jae 1f
20708 + add %rcx,%rsi
20709 +1:
20710 +#endif
20711 +
20712 cmpl $8,%edx
20713 jb 20f /* less then 8 bytes, go to byte copy loop */
20714 ALIGN_DESTINATION
20715 @@ -98,6 +109,7 @@ ENTRY(__copy_user_nocache)
20716 jnz 21b
20717 23: xorl %eax,%eax
20718 sfence
20719 + pax_force_retaddr
20720 ret
20721
20722 .section .fixup,"ax"
20723 diff -urNp linux-2.6.32.49/arch/x86/lib/csum-copy_64.S linux-2.6.32.49/arch/x86/lib/csum-copy_64.S
20724 --- linux-2.6.32.49/arch/x86/lib/csum-copy_64.S 2011-11-08 19:02:43.000000000 -0500
20725 +++ linux-2.6.32.49/arch/x86/lib/csum-copy_64.S 2011-11-15 19:59:43.000000000 -0500
20726 @@ -8,6 +8,7 @@
20727 #include <linux/linkage.h>
20728 #include <asm/dwarf2.h>
20729 #include <asm/errno.h>
20730 +#include <asm/alternative-asm.h>
20731
20732 /*
20733 * Checksum copy with exception handling.
20734 @@ -228,6 +229,7 @@ ENTRY(csum_partial_copy_generic)
20735 CFI_RESTORE rbp
20736 addq $7*8,%rsp
20737 CFI_ADJUST_CFA_OFFSET -7*8
20738 + pax_force_retaddr
20739 ret
20740 CFI_RESTORE_STATE
20741
20742 diff -urNp linux-2.6.32.49/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.49/arch/x86/lib/csum-wrappers_64.c
20743 --- linux-2.6.32.49/arch/x86/lib/csum-wrappers_64.c 2011-11-08 19:02:43.000000000 -0500
20744 +++ linux-2.6.32.49/arch/x86/lib/csum-wrappers_64.c 2011-11-15 19:59:43.000000000 -0500
20745 @@ -52,7 +52,13 @@ csum_partial_copy_from_user(const void _
20746 len -= 2;
20747 }
20748 }
20749 - isum = csum_partial_copy_generic((__force const void *)src,
20750 +
20751 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20752 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
20753 + src += PAX_USER_SHADOW_BASE;
20754 +#endif
20755 +
20756 + isum = csum_partial_copy_generic((const void __force_kernel *)src,
20757 dst, len, isum, errp, NULL);
20758 if (unlikely(*errp))
20759 goto out_err;
20760 @@ -105,7 +111,13 @@ csum_partial_copy_to_user(const void *sr
20761 }
20762
20763 *errp = 0;
20764 - return csum_partial_copy_generic(src, (void __force *)dst,
20765 +
20766 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20767 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
20768 + dst += PAX_USER_SHADOW_BASE;
20769 +#endif
20770 +
20771 + return csum_partial_copy_generic(src, (void __force_kernel *)dst,
20772 len, isum, NULL, errp);
20773 }
20774 EXPORT_SYMBOL(csum_partial_copy_to_user);
20775 diff -urNp linux-2.6.32.49/arch/x86/lib/getuser.S linux-2.6.32.49/arch/x86/lib/getuser.S
20776 --- linux-2.6.32.49/arch/x86/lib/getuser.S 2011-11-08 19:02:43.000000000 -0500
20777 +++ linux-2.6.32.49/arch/x86/lib/getuser.S 2011-11-15 19:59:43.000000000 -0500
20778 @@ -33,15 +33,38 @@
20779 #include <asm/asm-offsets.h>
20780 #include <asm/thread_info.h>
20781 #include <asm/asm.h>
20782 +#include <asm/segment.h>
20783 +#include <asm/pgtable.h>
20784 +#include <asm/alternative-asm.h>
20785 +
20786 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
20787 +#define __copyuser_seg gs;
20788 +#else
20789 +#define __copyuser_seg
20790 +#endif
20791
20792 .text
20793 ENTRY(__get_user_1)
20794 CFI_STARTPROC
20795 +
20796 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20797 GET_THREAD_INFO(%_ASM_DX)
20798 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
20799 jae bad_get_user
20800 -1: movzb (%_ASM_AX),%edx
20801 +
20802 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20803 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
20804 + cmp %_ASM_DX,%_ASM_AX
20805 + jae 1234f
20806 + add %_ASM_DX,%_ASM_AX
20807 +1234:
20808 +#endif
20809 +
20810 +#endif
20811 +
20812 +1: __copyuser_seg movzb (%_ASM_AX),%edx
20813 xor %eax,%eax
20814 + pax_force_retaddr
20815 ret
20816 CFI_ENDPROC
20817 ENDPROC(__get_user_1)
20818 @@ -49,12 +72,26 @@ ENDPROC(__get_user_1)
20819 ENTRY(__get_user_2)
20820 CFI_STARTPROC
20821 add $1,%_ASM_AX
20822 +
20823 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20824 jc bad_get_user
20825 GET_THREAD_INFO(%_ASM_DX)
20826 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
20827 jae bad_get_user
20828 -2: movzwl -1(%_ASM_AX),%edx
20829 +
20830 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20831 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
20832 + cmp %_ASM_DX,%_ASM_AX
20833 + jae 1234f
20834 + add %_ASM_DX,%_ASM_AX
20835 +1234:
20836 +#endif
20837 +
20838 +#endif
20839 +
20840 +2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
20841 xor %eax,%eax
20842 + pax_force_retaddr
20843 ret
20844 CFI_ENDPROC
20845 ENDPROC(__get_user_2)
20846 @@ -62,12 +99,26 @@ ENDPROC(__get_user_2)
20847 ENTRY(__get_user_4)
20848 CFI_STARTPROC
20849 add $3,%_ASM_AX
20850 +
20851 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20852 jc bad_get_user
20853 GET_THREAD_INFO(%_ASM_DX)
20854 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
20855 jae bad_get_user
20856 -3: mov -3(%_ASM_AX),%edx
20857 +
20858 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20859 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
20860 + cmp %_ASM_DX,%_ASM_AX
20861 + jae 1234f
20862 + add %_ASM_DX,%_ASM_AX
20863 +1234:
20864 +#endif
20865 +
20866 +#endif
20867 +
20868 +3: __copyuser_seg mov -3(%_ASM_AX),%edx
20869 xor %eax,%eax
20870 + pax_force_retaddr
20871 ret
20872 CFI_ENDPROC
20873 ENDPROC(__get_user_4)
20874 @@ -80,8 +131,18 @@ ENTRY(__get_user_8)
20875 GET_THREAD_INFO(%_ASM_DX)
20876 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
20877 jae bad_get_user
20878 +
20879 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20880 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
20881 + cmp %_ASM_DX,%_ASM_AX
20882 + jae 1234f
20883 + add %_ASM_DX,%_ASM_AX
20884 +1234:
20885 +#endif
20886 +
20887 4: movq -7(%_ASM_AX),%_ASM_DX
20888 xor %eax,%eax
20889 + pax_force_retaddr
20890 ret
20891 CFI_ENDPROC
20892 ENDPROC(__get_user_8)
20893 @@ -91,6 +152,7 @@ bad_get_user:
20894 CFI_STARTPROC
20895 xor %edx,%edx
20896 mov $(-EFAULT),%_ASM_AX
20897 + pax_force_retaddr
20898 ret
20899 CFI_ENDPROC
20900 END(bad_get_user)
20901 diff -urNp linux-2.6.32.49/arch/x86/lib/iomap_copy_64.S linux-2.6.32.49/arch/x86/lib/iomap_copy_64.S
20902 --- linux-2.6.32.49/arch/x86/lib/iomap_copy_64.S 2011-11-08 19:02:43.000000000 -0500
20903 +++ linux-2.6.32.49/arch/x86/lib/iomap_copy_64.S 2011-11-15 19:59:43.000000000 -0500
20904 @@ -17,6 +17,7 @@
20905
20906 #include <linux/linkage.h>
20907 #include <asm/dwarf2.h>
20908 +#include <asm/alternative-asm.h>
20909
20910 /*
20911 * override generic version in lib/iomap_copy.c
20912 @@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy)
20913 CFI_STARTPROC
20914 movl %edx,%ecx
20915 rep movsd
20916 + pax_force_retaddr
20917 ret
20918 CFI_ENDPROC
20919 ENDPROC(__iowrite32_copy)
20920 diff -urNp linux-2.6.32.49/arch/x86/lib/memcpy_64.S linux-2.6.32.49/arch/x86/lib/memcpy_64.S
20921 --- linux-2.6.32.49/arch/x86/lib/memcpy_64.S 2011-11-08 19:02:43.000000000 -0500
20922 +++ linux-2.6.32.49/arch/x86/lib/memcpy_64.S 2011-11-15 19:59:43.000000000 -0500
20923 @@ -4,6 +4,7 @@
20924
20925 #include <asm/cpufeature.h>
20926 #include <asm/dwarf2.h>
20927 +#include <asm/alternative-asm.h>
20928
20929 /*
20930 * memcpy - Copy a memory block.
20931 @@ -34,6 +35,7 @@ memcpy_c:
20932 rep movsq
20933 movl %edx, %ecx
20934 rep movsb
20935 + pax_force_retaddr
20936 ret
20937 CFI_ENDPROC
20938 ENDPROC(memcpy_c)
20939 @@ -118,6 +120,7 @@ ENTRY(memcpy)
20940 jnz .Lloop_1
20941
20942 .Lend:
20943 + pax_force_retaddr
20944 ret
20945 CFI_ENDPROC
20946 ENDPROC(memcpy)
20947 @@ -128,7 +131,7 @@ ENDPROC(__memcpy)
20948 * It is also a lot simpler. Use this when possible:
20949 */
20950
20951 - .section .altinstr_replacement, "ax"
20952 + .section .altinstr_replacement, "a"
20953 1: .byte 0xeb /* jmp <disp8> */
20954 .byte (memcpy_c - memcpy) - (2f - 1b) /* offset */
20955 2:
20956 diff -urNp linux-2.6.32.49/arch/x86/lib/memset_64.S linux-2.6.32.49/arch/x86/lib/memset_64.S
20957 --- linux-2.6.32.49/arch/x86/lib/memset_64.S 2011-11-08 19:02:43.000000000 -0500
20958 +++ linux-2.6.32.49/arch/x86/lib/memset_64.S 2011-11-15 19:59:43.000000000 -0500
20959 @@ -2,6 +2,7 @@
20960
20961 #include <linux/linkage.h>
20962 #include <asm/dwarf2.h>
20963 +#include <asm/alternative-asm.h>
20964
20965 /*
20966 * ISO C memset - set a memory block to a byte value.
20967 @@ -28,6 +29,7 @@ memset_c:
20968 movl %r8d,%ecx
20969 rep stosb
20970 movq %r9,%rax
20971 + pax_force_retaddr
20972 ret
20973 CFI_ENDPROC
20974 ENDPROC(memset_c)
20975 @@ -96,6 +98,7 @@ ENTRY(__memset)
20976
20977 .Lende:
20978 movq %r10,%rax
20979 + pax_force_retaddr
20980 ret
20981
20982 CFI_RESTORE_STATE
20983 @@ -118,7 +121,7 @@ ENDPROC(__memset)
20984
20985 #include <asm/cpufeature.h>
20986
20987 - .section .altinstr_replacement,"ax"
20988 + .section .altinstr_replacement,"a"
20989 1: .byte 0xeb /* jmp <disp8> */
20990 .byte (memset_c - memset) - (2f - 1b) /* offset */
20991 2:
20992 diff -urNp linux-2.6.32.49/arch/x86/lib/mmx_32.c linux-2.6.32.49/arch/x86/lib/mmx_32.c
20993 --- linux-2.6.32.49/arch/x86/lib/mmx_32.c 2011-11-08 19:02:43.000000000 -0500
20994 +++ linux-2.6.32.49/arch/x86/lib/mmx_32.c 2011-11-15 19:59:43.000000000 -0500
20995 @@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
20996 {
20997 void *p;
20998 int i;
20999 + unsigned long cr0;
21000
21001 if (unlikely(in_interrupt()))
21002 return __memcpy(to, from, len);
21003 @@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
21004 kernel_fpu_begin();
21005
21006 __asm__ __volatile__ (
21007 - "1: prefetch (%0)\n" /* This set is 28 bytes */
21008 - " prefetch 64(%0)\n"
21009 - " prefetch 128(%0)\n"
21010 - " prefetch 192(%0)\n"
21011 - " prefetch 256(%0)\n"
21012 + "1: prefetch (%1)\n" /* This set is 28 bytes */
21013 + " prefetch 64(%1)\n"
21014 + " prefetch 128(%1)\n"
21015 + " prefetch 192(%1)\n"
21016 + " prefetch 256(%1)\n"
21017 "2: \n"
21018 ".section .fixup, \"ax\"\n"
21019 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
21020 + "3: \n"
21021 +
21022 +#ifdef CONFIG_PAX_KERNEXEC
21023 + " movl %%cr0, %0\n"
21024 + " movl %0, %%eax\n"
21025 + " andl $0xFFFEFFFF, %%eax\n"
21026 + " movl %%eax, %%cr0\n"
21027 +#endif
21028 +
21029 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
21030 +
21031 +#ifdef CONFIG_PAX_KERNEXEC
21032 + " movl %0, %%cr0\n"
21033 +#endif
21034 +
21035 " jmp 2b\n"
21036 ".previous\n"
21037 _ASM_EXTABLE(1b, 3b)
21038 - : : "r" (from));
21039 + : "=&r" (cr0) : "r" (from) : "ax");
21040
21041 for ( ; i > 5; i--) {
21042 __asm__ __volatile__ (
21043 - "1: prefetch 320(%0)\n"
21044 - "2: movq (%0), %%mm0\n"
21045 - " movq 8(%0), %%mm1\n"
21046 - " movq 16(%0), %%mm2\n"
21047 - " movq 24(%0), %%mm3\n"
21048 - " movq %%mm0, (%1)\n"
21049 - " movq %%mm1, 8(%1)\n"
21050 - " movq %%mm2, 16(%1)\n"
21051 - " movq %%mm3, 24(%1)\n"
21052 - " movq 32(%0), %%mm0\n"
21053 - " movq 40(%0), %%mm1\n"
21054 - " movq 48(%0), %%mm2\n"
21055 - " movq 56(%0), %%mm3\n"
21056 - " movq %%mm0, 32(%1)\n"
21057 - " movq %%mm1, 40(%1)\n"
21058 - " movq %%mm2, 48(%1)\n"
21059 - " movq %%mm3, 56(%1)\n"
21060 + "1: prefetch 320(%1)\n"
21061 + "2: movq (%1), %%mm0\n"
21062 + " movq 8(%1), %%mm1\n"
21063 + " movq 16(%1), %%mm2\n"
21064 + " movq 24(%1), %%mm3\n"
21065 + " movq %%mm0, (%2)\n"
21066 + " movq %%mm1, 8(%2)\n"
21067 + " movq %%mm2, 16(%2)\n"
21068 + " movq %%mm3, 24(%2)\n"
21069 + " movq 32(%1), %%mm0\n"
21070 + " movq 40(%1), %%mm1\n"
21071 + " movq 48(%1), %%mm2\n"
21072 + " movq 56(%1), %%mm3\n"
21073 + " movq %%mm0, 32(%2)\n"
21074 + " movq %%mm1, 40(%2)\n"
21075 + " movq %%mm2, 48(%2)\n"
21076 + " movq %%mm3, 56(%2)\n"
21077 ".section .fixup, \"ax\"\n"
21078 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
21079 + "3:\n"
21080 +
21081 +#ifdef CONFIG_PAX_KERNEXEC
21082 + " movl %%cr0, %0\n"
21083 + " movl %0, %%eax\n"
21084 + " andl $0xFFFEFFFF, %%eax\n"
21085 + " movl %%eax, %%cr0\n"
21086 +#endif
21087 +
21088 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
21089 +
21090 +#ifdef CONFIG_PAX_KERNEXEC
21091 + " movl %0, %%cr0\n"
21092 +#endif
21093 +
21094 " jmp 2b\n"
21095 ".previous\n"
21096 _ASM_EXTABLE(1b, 3b)
21097 - : : "r" (from), "r" (to) : "memory");
21098 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
21099
21100 from += 64;
21101 to += 64;
21102 @@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
21103 static void fast_copy_page(void *to, void *from)
21104 {
21105 int i;
21106 + unsigned long cr0;
21107
21108 kernel_fpu_begin();
21109
21110 @@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
21111 * but that is for later. -AV
21112 */
21113 __asm__ __volatile__(
21114 - "1: prefetch (%0)\n"
21115 - " prefetch 64(%0)\n"
21116 - " prefetch 128(%0)\n"
21117 - " prefetch 192(%0)\n"
21118 - " prefetch 256(%0)\n"
21119 + "1: prefetch (%1)\n"
21120 + " prefetch 64(%1)\n"
21121 + " prefetch 128(%1)\n"
21122 + " prefetch 192(%1)\n"
21123 + " prefetch 256(%1)\n"
21124 "2: \n"
21125 ".section .fixup, \"ax\"\n"
21126 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
21127 + "3: \n"
21128 +
21129 +#ifdef CONFIG_PAX_KERNEXEC
21130 + " movl %%cr0, %0\n"
21131 + " movl %0, %%eax\n"
21132 + " andl $0xFFFEFFFF, %%eax\n"
21133 + " movl %%eax, %%cr0\n"
21134 +#endif
21135 +
21136 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
21137 +
21138 +#ifdef CONFIG_PAX_KERNEXEC
21139 + " movl %0, %%cr0\n"
21140 +#endif
21141 +
21142 " jmp 2b\n"
21143 ".previous\n"
21144 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
21145 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
21146
21147 for (i = 0; i < (4096-320)/64; i++) {
21148 __asm__ __volatile__ (
21149 - "1: prefetch 320(%0)\n"
21150 - "2: movq (%0), %%mm0\n"
21151 - " movntq %%mm0, (%1)\n"
21152 - " movq 8(%0), %%mm1\n"
21153 - " movntq %%mm1, 8(%1)\n"
21154 - " movq 16(%0), %%mm2\n"
21155 - " movntq %%mm2, 16(%1)\n"
21156 - " movq 24(%0), %%mm3\n"
21157 - " movntq %%mm3, 24(%1)\n"
21158 - " movq 32(%0), %%mm4\n"
21159 - " movntq %%mm4, 32(%1)\n"
21160 - " movq 40(%0), %%mm5\n"
21161 - " movntq %%mm5, 40(%1)\n"
21162 - " movq 48(%0), %%mm6\n"
21163 - " movntq %%mm6, 48(%1)\n"
21164 - " movq 56(%0), %%mm7\n"
21165 - " movntq %%mm7, 56(%1)\n"
21166 + "1: prefetch 320(%1)\n"
21167 + "2: movq (%1), %%mm0\n"
21168 + " movntq %%mm0, (%2)\n"
21169 + " movq 8(%1), %%mm1\n"
21170 + " movntq %%mm1, 8(%2)\n"
21171 + " movq 16(%1), %%mm2\n"
21172 + " movntq %%mm2, 16(%2)\n"
21173 + " movq 24(%1), %%mm3\n"
21174 + " movntq %%mm3, 24(%2)\n"
21175 + " movq 32(%1), %%mm4\n"
21176 + " movntq %%mm4, 32(%2)\n"
21177 + " movq 40(%1), %%mm5\n"
21178 + " movntq %%mm5, 40(%2)\n"
21179 + " movq 48(%1), %%mm6\n"
21180 + " movntq %%mm6, 48(%2)\n"
21181 + " movq 56(%1), %%mm7\n"
21182 + " movntq %%mm7, 56(%2)\n"
21183 ".section .fixup, \"ax\"\n"
21184 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
21185 + "3:\n"
21186 +
21187 +#ifdef CONFIG_PAX_KERNEXEC
21188 + " movl %%cr0, %0\n"
21189 + " movl %0, %%eax\n"
21190 + " andl $0xFFFEFFFF, %%eax\n"
21191 + " movl %%eax, %%cr0\n"
21192 +#endif
21193 +
21194 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
21195 +
21196 +#ifdef CONFIG_PAX_KERNEXEC
21197 + " movl %0, %%cr0\n"
21198 +#endif
21199 +
21200 " jmp 2b\n"
21201 ".previous\n"
21202 - _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
21203 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
21204
21205 from += 64;
21206 to += 64;
21207 @@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
21208 static void fast_copy_page(void *to, void *from)
21209 {
21210 int i;
21211 + unsigned long cr0;
21212
21213 kernel_fpu_begin();
21214
21215 __asm__ __volatile__ (
21216 - "1: prefetch (%0)\n"
21217 - " prefetch 64(%0)\n"
21218 - " prefetch 128(%0)\n"
21219 - " prefetch 192(%0)\n"
21220 - " prefetch 256(%0)\n"
21221 + "1: prefetch (%1)\n"
21222 + " prefetch 64(%1)\n"
21223 + " prefetch 128(%1)\n"
21224 + " prefetch 192(%1)\n"
21225 + " prefetch 256(%1)\n"
21226 "2: \n"
21227 ".section .fixup, \"ax\"\n"
21228 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
21229 + "3: \n"
21230 +
21231 +#ifdef CONFIG_PAX_KERNEXEC
21232 + " movl %%cr0, %0\n"
21233 + " movl %0, %%eax\n"
21234 + " andl $0xFFFEFFFF, %%eax\n"
21235 + " movl %%eax, %%cr0\n"
21236 +#endif
21237 +
21238 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
21239 +
21240 +#ifdef CONFIG_PAX_KERNEXEC
21241 + " movl %0, %%cr0\n"
21242 +#endif
21243 +
21244 " jmp 2b\n"
21245 ".previous\n"
21246 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
21247 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
21248
21249 for (i = 0; i < 4096/64; i++) {
21250 __asm__ __volatile__ (
21251 - "1: prefetch 320(%0)\n"
21252 - "2: movq (%0), %%mm0\n"
21253 - " movq 8(%0), %%mm1\n"
21254 - " movq 16(%0), %%mm2\n"
21255 - " movq 24(%0), %%mm3\n"
21256 - " movq %%mm0, (%1)\n"
21257 - " movq %%mm1, 8(%1)\n"
21258 - " movq %%mm2, 16(%1)\n"
21259 - " movq %%mm3, 24(%1)\n"
21260 - " movq 32(%0), %%mm0\n"
21261 - " movq 40(%0), %%mm1\n"
21262 - " movq 48(%0), %%mm2\n"
21263 - " movq 56(%0), %%mm3\n"
21264 - " movq %%mm0, 32(%1)\n"
21265 - " movq %%mm1, 40(%1)\n"
21266 - " movq %%mm2, 48(%1)\n"
21267 - " movq %%mm3, 56(%1)\n"
21268 + "1: prefetch 320(%1)\n"
21269 + "2: movq (%1), %%mm0\n"
21270 + " movq 8(%1), %%mm1\n"
21271 + " movq 16(%1), %%mm2\n"
21272 + " movq 24(%1), %%mm3\n"
21273 + " movq %%mm0, (%2)\n"
21274 + " movq %%mm1, 8(%2)\n"
21275 + " movq %%mm2, 16(%2)\n"
21276 + " movq %%mm3, 24(%2)\n"
21277 + " movq 32(%1), %%mm0\n"
21278 + " movq 40(%1), %%mm1\n"
21279 + " movq 48(%1), %%mm2\n"
21280 + " movq 56(%1), %%mm3\n"
21281 + " movq %%mm0, 32(%2)\n"
21282 + " movq %%mm1, 40(%2)\n"
21283 + " movq %%mm2, 48(%2)\n"
21284 + " movq %%mm3, 56(%2)\n"
21285 ".section .fixup, \"ax\"\n"
21286 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
21287 + "3:\n"
21288 +
21289 +#ifdef CONFIG_PAX_KERNEXEC
21290 + " movl %%cr0, %0\n"
21291 + " movl %0, %%eax\n"
21292 + " andl $0xFFFEFFFF, %%eax\n"
21293 + " movl %%eax, %%cr0\n"
21294 +#endif
21295 +
21296 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
21297 +
21298 +#ifdef CONFIG_PAX_KERNEXEC
21299 + " movl %0, %%cr0\n"
21300 +#endif
21301 +
21302 " jmp 2b\n"
21303 ".previous\n"
21304 _ASM_EXTABLE(1b, 3b)
21305 - : : "r" (from), "r" (to) : "memory");
21306 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
21307
21308 from += 64;
21309 to += 64;
21310 diff -urNp linux-2.6.32.49/arch/x86/lib/msr-reg.S linux-2.6.32.49/arch/x86/lib/msr-reg.S
21311 --- linux-2.6.32.49/arch/x86/lib/msr-reg.S 2011-11-08 19:02:43.000000000 -0500
21312 +++ linux-2.6.32.49/arch/x86/lib/msr-reg.S 2011-11-15 19:59:43.000000000 -0500
21313 @@ -3,6 +3,7 @@
21314 #include <asm/dwarf2.h>
21315 #include <asm/asm.h>
21316 #include <asm/msr.h>
21317 +#include <asm/alternative-asm.h>
21318
21319 #ifdef CONFIG_X86_64
21320 /*
21321 @@ -37,6 +38,7 @@ ENTRY(native_\op\()_safe_regs)
21322 movl %edi, 28(%r10)
21323 popq_cfi %rbp
21324 popq_cfi %rbx
21325 + pax_force_retaddr
21326 ret
21327 3:
21328 CFI_RESTORE_STATE
21329 diff -urNp linux-2.6.32.49/arch/x86/lib/putuser.S linux-2.6.32.49/arch/x86/lib/putuser.S
21330 --- linux-2.6.32.49/arch/x86/lib/putuser.S 2011-11-08 19:02:43.000000000 -0500
21331 +++ linux-2.6.32.49/arch/x86/lib/putuser.S 2011-11-15 19:59:43.000000000 -0500
21332 @@ -15,7 +15,9 @@
21333 #include <asm/thread_info.h>
21334 #include <asm/errno.h>
21335 #include <asm/asm.h>
21336 -
21337 +#include <asm/segment.h>
21338 +#include <asm/pgtable.h>
21339 +#include <asm/alternative-asm.h>
21340
21341 /*
21342 * __put_user_X
21343 @@ -29,52 +31,119 @@
21344 * as they get called from within inline assembly.
21345 */
21346
21347 -#define ENTER CFI_STARTPROC ; \
21348 - GET_THREAD_INFO(%_ASM_BX)
21349 -#define EXIT ret ; \
21350 +#define ENTER CFI_STARTPROC
21351 +#define EXIT pax_force_retaddr; ret ; \
21352 CFI_ENDPROC
21353
21354 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21355 +#define _DEST %_ASM_CX,%_ASM_BX
21356 +#else
21357 +#define _DEST %_ASM_CX
21358 +#endif
21359 +
21360 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
21361 +#define __copyuser_seg gs;
21362 +#else
21363 +#define __copyuser_seg
21364 +#endif
21365 +
21366 .text
21367 ENTRY(__put_user_1)
21368 ENTER
21369 +
21370 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
21371 + GET_THREAD_INFO(%_ASM_BX)
21372 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
21373 jae bad_put_user
21374 -1: movb %al,(%_ASM_CX)
21375 +
21376 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21377 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
21378 + cmp %_ASM_BX,%_ASM_CX
21379 + jb 1234f
21380 + xor %ebx,%ebx
21381 +1234:
21382 +#endif
21383 +
21384 +#endif
21385 +
21386 +1: __copyuser_seg movb %al,(_DEST)
21387 xor %eax,%eax
21388 EXIT
21389 ENDPROC(__put_user_1)
21390
21391 ENTRY(__put_user_2)
21392 ENTER
21393 +
21394 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
21395 + GET_THREAD_INFO(%_ASM_BX)
21396 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
21397 sub $1,%_ASM_BX
21398 cmp %_ASM_BX,%_ASM_CX
21399 jae bad_put_user
21400 -2: movw %ax,(%_ASM_CX)
21401 +
21402 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21403 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
21404 + cmp %_ASM_BX,%_ASM_CX
21405 + jb 1234f
21406 + xor %ebx,%ebx
21407 +1234:
21408 +#endif
21409 +
21410 +#endif
21411 +
21412 +2: __copyuser_seg movw %ax,(_DEST)
21413 xor %eax,%eax
21414 EXIT
21415 ENDPROC(__put_user_2)
21416
21417 ENTRY(__put_user_4)
21418 ENTER
21419 +
21420 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
21421 + GET_THREAD_INFO(%_ASM_BX)
21422 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
21423 sub $3,%_ASM_BX
21424 cmp %_ASM_BX,%_ASM_CX
21425 jae bad_put_user
21426 -3: movl %eax,(%_ASM_CX)
21427 +
21428 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21429 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
21430 + cmp %_ASM_BX,%_ASM_CX
21431 + jb 1234f
21432 + xor %ebx,%ebx
21433 +1234:
21434 +#endif
21435 +
21436 +#endif
21437 +
21438 +3: __copyuser_seg movl %eax,(_DEST)
21439 xor %eax,%eax
21440 EXIT
21441 ENDPROC(__put_user_4)
21442
21443 ENTRY(__put_user_8)
21444 ENTER
21445 +
21446 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
21447 + GET_THREAD_INFO(%_ASM_BX)
21448 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
21449 sub $7,%_ASM_BX
21450 cmp %_ASM_BX,%_ASM_CX
21451 jae bad_put_user
21452 -4: mov %_ASM_AX,(%_ASM_CX)
21453 +
21454 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21455 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
21456 + cmp %_ASM_BX,%_ASM_CX
21457 + jb 1234f
21458 + xor %ebx,%ebx
21459 +1234:
21460 +#endif
21461 +
21462 +#endif
21463 +
21464 +4: __copyuser_seg mov %_ASM_AX,(_DEST)
21465 #ifdef CONFIG_X86_32
21466 -5: movl %edx,4(%_ASM_CX)
21467 +5: __copyuser_seg movl %edx,4(_DEST)
21468 #endif
21469 xor %eax,%eax
21470 EXIT
21471 diff -urNp linux-2.6.32.49/arch/x86/lib/rwlock_64.S linux-2.6.32.49/arch/x86/lib/rwlock_64.S
21472 --- linux-2.6.32.49/arch/x86/lib/rwlock_64.S 2011-11-08 19:02:43.000000000 -0500
21473 +++ linux-2.6.32.49/arch/x86/lib/rwlock_64.S 2011-11-15 19:59:43.000000000 -0500
21474 @@ -17,6 +17,7 @@ ENTRY(__write_lock_failed)
21475 LOCK_PREFIX
21476 subl $RW_LOCK_BIAS,(%rdi)
21477 jnz __write_lock_failed
21478 + pax_force_retaddr
21479 ret
21480 CFI_ENDPROC
21481 END(__write_lock_failed)
21482 @@ -33,6 +34,7 @@ ENTRY(__read_lock_failed)
21483 LOCK_PREFIX
21484 decl (%rdi)
21485 js __read_lock_failed
21486 + pax_force_retaddr
21487 ret
21488 CFI_ENDPROC
21489 END(__read_lock_failed)
21490 diff -urNp linux-2.6.32.49/arch/x86/lib/rwsem_64.S linux-2.6.32.49/arch/x86/lib/rwsem_64.S
21491 --- linux-2.6.32.49/arch/x86/lib/rwsem_64.S 2011-11-08 19:02:43.000000000 -0500
21492 +++ linux-2.6.32.49/arch/x86/lib/rwsem_64.S 2011-11-15 19:59:43.000000000 -0500
21493 @@ -48,6 +48,7 @@ ENTRY(call_rwsem_down_read_failed)
21494 call rwsem_down_read_failed
21495 popq %rdx
21496 restore_common_regs
21497 + pax_force_retaddr
21498 ret
21499 ENDPROC(call_rwsem_down_read_failed)
21500
21501 @@ -56,6 +57,7 @@ ENTRY(call_rwsem_down_write_failed)
21502 movq %rax,%rdi
21503 call rwsem_down_write_failed
21504 restore_common_regs
21505 + pax_force_retaddr
21506 ret
21507 ENDPROC(call_rwsem_down_write_failed)
21508
21509 @@ -66,7 +68,8 @@ ENTRY(call_rwsem_wake)
21510 movq %rax,%rdi
21511 call rwsem_wake
21512 restore_common_regs
21513 -1: ret
21514 +1: pax_force_retaddr
21515 + ret
21516 ENDPROC(call_rwsem_wake)
21517
21518 /* Fix up special calling conventions */
21519 @@ -77,5 +80,6 @@ ENTRY(call_rwsem_downgrade_wake)
21520 call rwsem_downgrade_wake
21521 popq %rdx
21522 restore_common_regs
21523 + pax_force_retaddr
21524 ret
21525 ENDPROC(call_rwsem_downgrade_wake)
21526 diff -urNp linux-2.6.32.49/arch/x86/lib/thunk_64.S linux-2.6.32.49/arch/x86/lib/thunk_64.S
21527 --- linux-2.6.32.49/arch/x86/lib/thunk_64.S 2011-11-08 19:02:43.000000000 -0500
21528 +++ linux-2.6.32.49/arch/x86/lib/thunk_64.S 2011-11-15 19:59:43.000000000 -0500
21529 @@ -10,7 +10,8 @@
21530 #include <asm/dwarf2.h>
21531 #include <asm/calling.h>
21532 #include <asm/rwlock.h>
21533 -
21534 + #include <asm/alternative-asm.h>
21535 +
21536 /* rdi: arg1 ... normal C conventions. rax is saved/restored. */
21537 .macro thunk name,func
21538 .globl \name
21539 @@ -70,6 +71,7 @@
21540 SAVE_ARGS
21541 restore:
21542 RESTORE_ARGS
21543 + pax_force_retaddr
21544 ret
21545 CFI_ENDPROC
21546
21547 @@ -77,5 +79,6 @@ restore:
21548 SAVE_ARGS
21549 restore_norax:
21550 RESTORE_ARGS 1
21551 + pax_force_retaddr
21552 ret
21553 CFI_ENDPROC
21554 diff -urNp linux-2.6.32.49/arch/x86/lib/usercopy_32.c linux-2.6.32.49/arch/x86/lib/usercopy_32.c
21555 --- linux-2.6.32.49/arch/x86/lib/usercopy_32.c 2011-11-08 19:02:43.000000000 -0500
21556 +++ linux-2.6.32.49/arch/x86/lib/usercopy_32.c 2011-11-15 19:59:43.000000000 -0500
21557 @@ -43,7 +43,7 @@ do { \
21558 __asm__ __volatile__( \
21559 " testl %1,%1\n" \
21560 " jz 2f\n" \
21561 - "0: lodsb\n" \
21562 + "0: "__copyuser_seg"lodsb\n" \
21563 " stosb\n" \
21564 " testb %%al,%%al\n" \
21565 " jz 1f\n" \
21566 @@ -128,10 +128,12 @@ do { \
21567 int __d0; \
21568 might_fault(); \
21569 __asm__ __volatile__( \
21570 + __COPYUSER_SET_ES \
21571 "0: rep; stosl\n" \
21572 " movl %2,%0\n" \
21573 "1: rep; stosb\n" \
21574 "2:\n" \
21575 + __COPYUSER_RESTORE_ES \
21576 ".section .fixup,\"ax\"\n" \
21577 "3: lea 0(%2,%0,4),%0\n" \
21578 " jmp 2b\n" \
21579 @@ -200,6 +202,7 @@ long strnlen_user(const char __user *s,
21580 might_fault();
21581
21582 __asm__ __volatile__(
21583 + __COPYUSER_SET_ES
21584 " testl %0, %0\n"
21585 " jz 3f\n"
21586 " andl %0,%%ecx\n"
21587 @@ -208,6 +211,7 @@ long strnlen_user(const char __user *s,
21588 " subl %%ecx,%0\n"
21589 " addl %0,%%eax\n"
21590 "1:\n"
21591 + __COPYUSER_RESTORE_ES
21592 ".section .fixup,\"ax\"\n"
21593 "2: xorl %%eax,%%eax\n"
21594 " jmp 1b\n"
21595 @@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
21596
21597 #ifdef CONFIG_X86_INTEL_USERCOPY
21598 static unsigned long
21599 -__copy_user_intel(void __user *to, const void *from, unsigned long size)
21600 +__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
21601 {
21602 int d0, d1;
21603 __asm__ __volatile__(
21604 @@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const
21605 " .align 2,0x90\n"
21606 "3: movl 0(%4), %%eax\n"
21607 "4: movl 4(%4), %%edx\n"
21608 - "5: movl %%eax, 0(%3)\n"
21609 - "6: movl %%edx, 4(%3)\n"
21610 + "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
21611 + "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
21612 "7: movl 8(%4), %%eax\n"
21613 "8: movl 12(%4),%%edx\n"
21614 - "9: movl %%eax, 8(%3)\n"
21615 - "10: movl %%edx, 12(%3)\n"
21616 + "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
21617 + "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
21618 "11: movl 16(%4), %%eax\n"
21619 "12: movl 20(%4), %%edx\n"
21620 - "13: movl %%eax, 16(%3)\n"
21621 - "14: movl %%edx, 20(%3)\n"
21622 + "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
21623 + "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
21624 "15: movl 24(%4), %%eax\n"
21625 "16: movl 28(%4), %%edx\n"
21626 - "17: movl %%eax, 24(%3)\n"
21627 - "18: movl %%edx, 28(%3)\n"
21628 + "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
21629 + "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
21630 "19: movl 32(%4), %%eax\n"
21631 "20: movl 36(%4), %%edx\n"
21632 - "21: movl %%eax, 32(%3)\n"
21633 - "22: movl %%edx, 36(%3)\n"
21634 + "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
21635 + "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
21636 "23: movl 40(%4), %%eax\n"
21637 "24: movl 44(%4), %%edx\n"
21638 - "25: movl %%eax, 40(%3)\n"
21639 - "26: movl %%edx, 44(%3)\n"
21640 + "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
21641 + "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
21642 "27: movl 48(%4), %%eax\n"
21643 "28: movl 52(%4), %%edx\n"
21644 - "29: movl %%eax, 48(%3)\n"
21645 - "30: movl %%edx, 52(%3)\n"
21646 + "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
21647 + "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
21648 "31: movl 56(%4), %%eax\n"
21649 "32: movl 60(%4), %%edx\n"
21650 - "33: movl %%eax, 56(%3)\n"
21651 - "34: movl %%edx, 60(%3)\n"
21652 + "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
21653 + "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
21654 " addl $-64, %0\n"
21655 " addl $64, %4\n"
21656 " addl $64, %3\n"
21657 @@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const
21658 " shrl $2, %0\n"
21659 " andl $3, %%eax\n"
21660 " cld\n"
21661 + __COPYUSER_SET_ES
21662 "99: rep; movsl\n"
21663 "36: movl %%eax, %0\n"
21664 "37: rep; movsb\n"
21665 "100:\n"
21666 + __COPYUSER_RESTORE_ES
21667 + ".section .fixup,\"ax\"\n"
21668 + "101: lea 0(%%eax,%0,4),%0\n"
21669 + " jmp 100b\n"
21670 + ".previous\n"
21671 + ".section __ex_table,\"a\"\n"
21672 + " .align 4\n"
21673 + " .long 1b,100b\n"
21674 + " .long 2b,100b\n"
21675 + " .long 3b,100b\n"
21676 + " .long 4b,100b\n"
21677 + " .long 5b,100b\n"
21678 + " .long 6b,100b\n"
21679 + " .long 7b,100b\n"
21680 + " .long 8b,100b\n"
21681 + " .long 9b,100b\n"
21682 + " .long 10b,100b\n"
21683 + " .long 11b,100b\n"
21684 + " .long 12b,100b\n"
21685 + " .long 13b,100b\n"
21686 + " .long 14b,100b\n"
21687 + " .long 15b,100b\n"
21688 + " .long 16b,100b\n"
21689 + " .long 17b,100b\n"
21690 + " .long 18b,100b\n"
21691 + " .long 19b,100b\n"
21692 + " .long 20b,100b\n"
21693 + " .long 21b,100b\n"
21694 + " .long 22b,100b\n"
21695 + " .long 23b,100b\n"
21696 + " .long 24b,100b\n"
21697 + " .long 25b,100b\n"
21698 + " .long 26b,100b\n"
21699 + " .long 27b,100b\n"
21700 + " .long 28b,100b\n"
21701 + " .long 29b,100b\n"
21702 + " .long 30b,100b\n"
21703 + " .long 31b,100b\n"
21704 + " .long 32b,100b\n"
21705 + " .long 33b,100b\n"
21706 + " .long 34b,100b\n"
21707 + " .long 35b,100b\n"
21708 + " .long 36b,100b\n"
21709 + " .long 37b,100b\n"
21710 + " .long 99b,101b\n"
21711 + ".previous"
21712 + : "=&c"(size), "=&D" (d0), "=&S" (d1)
21713 + : "1"(to), "2"(from), "0"(size)
21714 + : "eax", "edx", "memory");
21715 + return size;
21716 +}
21717 +
21718 +static unsigned long
21719 +__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
21720 +{
21721 + int d0, d1;
21722 + __asm__ __volatile__(
21723 + " .align 2,0x90\n"
21724 + "1: "__copyuser_seg" movl 32(%4), %%eax\n"
21725 + " cmpl $67, %0\n"
21726 + " jbe 3f\n"
21727 + "2: "__copyuser_seg" movl 64(%4), %%eax\n"
21728 + " .align 2,0x90\n"
21729 + "3: "__copyuser_seg" movl 0(%4), %%eax\n"
21730 + "4: "__copyuser_seg" movl 4(%4), %%edx\n"
21731 + "5: movl %%eax, 0(%3)\n"
21732 + "6: movl %%edx, 4(%3)\n"
21733 + "7: "__copyuser_seg" movl 8(%4), %%eax\n"
21734 + "8: "__copyuser_seg" movl 12(%4),%%edx\n"
21735 + "9: movl %%eax, 8(%3)\n"
21736 + "10: movl %%edx, 12(%3)\n"
21737 + "11: "__copyuser_seg" movl 16(%4), %%eax\n"
21738 + "12: "__copyuser_seg" movl 20(%4), %%edx\n"
21739 + "13: movl %%eax, 16(%3)\n"
21740 + "14: movl %%edx, 20(%3)\n"
21741 + "15: "__copyuser_seg" movl 24(%4), %%eax\n"
21742 + "16: "__copyuser_seg" movl 28(%4), %%edx\n"
21743 + "17: movl %%eax, 24(%3)\n"
21744 + "18: movl %%edx, 28(%3)\n"
21745 + "19: "__copyuser_seg" movl 32(%4), %%eax\n"
21746 + "20: "__copyuser_seg" movl 36(%4), %%edx\n"
21747 + "21: movl %%eax, 32(%3)\n"
21748 + "22: movl %%edx, 36(%3)\n"
21749 + "23: "__copyuser_seg" movl 40(%4), %%eax\n"
21750 + "24: "__copyuser_seg" movl 44(%4), %%edx\n"
21751 + "25: movl %%eax, 40(%3)\n"
21752 + "26: movl %%edx, 44(%3)\n"
21753 + "27: "__copyuser_seg" movl 48(%4), %%eax\n"
21754 + "28: "__copyuser_seg" movl 52(%4), %%edx\n"
21755 + "29: movl %%eax, 48(%3)\n"
21756 + "30: movl %%edx, 52(%3)\n"
21757 + "31: "__copyuser_seg" movl 56(%4), %%eax\n"
21758 + "32: "__copyuser_seg" movl 60(%4), %%edx\n"
21759 + "33: movl %%eax, 56(%3)\n"
21760 + "34: movl %%edx, 60(%3)\n"
21761 + " addl $-64, %0\n"
21762 + " addl $64, %4\n"
21763 + " addl $64, %3\n"
21764 + " cmpl $63, %0\n"
21765 + " ja 1b\n"
21766 + "35: movl %0, %%eax\n"
21767 + " shrl $2, %0\n"
21768 + " andl $3, %%eax\n"
21769 + " cld\n"
21770 + "99: rep; "__copyuser_seg" movsl\n"
21771 + "36: movl %%eax, %0\n"
21772 + "37: rep; "__copyuser_seg" movsb\n"
21773 + "100:\n"
21774 ".section .fixup,\"ax\"\n"
21775 "101: lea 0(%%eax,%0,4),%0\n"
21776 " jmp 100b\n"
21777 @@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, cons
21778 int d0, d1;
21779 __asm__ __volatile__(
21780 " .align 2,0x90\n"
21781 - "0: movl 32(%4), %%eax\n"
21782 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
21783 " cmpl $67, %0\n"
21784 " jbe 2f\n"
21785 - "1: movl 64(%4), %%eax\n"
21786 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
21787 " .align 2,0x90\n"
21788 - "2: movl 0(%4), %%eax\n"
21789 - "21: movl 4(%4), %%edx\n"
21790 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
21791 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
21792 " movl %%eax, 0(%3)\n"
21793 " movl %%edx, 4(%3)\n"
21794 - "3: movl 8(%4), %%eax\n"
21795 - "31: movl 12(%4),%%edx\n"
21796 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
21797 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
21798 " movl %%eax, 8(%3)\n"
21799 " movl %%edx, 12(%3)\n"
21800 - "4: movl 16(%4), %%eax\n"
21801 - "41: movl 20(%4), %%edx\n"
21802 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
21803 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
21804 " movl %%eax, 16(%3)\n"
21805 " movl %%edx, 20(%3)\n"
21806 - "10: movl 24(%4), %%eax\n"
21807 - "51: movl 28(%4), %%edx\n"
21808 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
21809 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
21810 " movl %%eax, 24(%3)\n"
21811 " movl %%edx, 28(%3)\n"
21812 - "11: movl 32(%4), %%eax\n"
21813 - "61: movl 36(%4), %%edx\n"
21814 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
21815 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
21816 " movl %%eax, 32(%3)\n"
21817 " movl %%edx, 36(%3)\n"
21818 - "12: movl 40(%4), %%eax\n"
21819 - "71: movl 44(%4), %%edx\n"
21820 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
21821 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
21822 " movl %%eax, 40(%3)\n"
21823 " movl %%edx, 44(%3)\n"
21824 - "13: movl 48(%4), %%eax\n"
21825 - "81: movl 52(%4), %%edx\n"
21826 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
21827 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
21828 " movl %%eax, 48(%3)\n"
21829 " movl %%edx, 52(%3)\n"
21830 - "14: movl 56(%4), %%eax\n"
21831 - "91: movl 60(%4), %%edx\n"
21832 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
21833 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
21834 " movl %%eax, 56(%3)\n"
21835 " movl %%edx, 60(%3)\n"
21836 " addl $-64, %0\n"
21837 @@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, cons
21838 " shrl $2, %0\n"
21839 " andl $3, %%eax\n"
21840 " cld\n"
21841 - "6: rep; movsl\n"
21842 + "6: rep; "__copyuser_seg" movsl\n"
21843 " movl %%eax,%0\n"
21844 - "7: rep; movsb\n"
21845 + "7: rep; "__copyuser_seg" movsb\n"
21846 "8:\n"
21847 ".section .fixup,\"ax\"\n"
21848 "9: lea 0(%%eax,%0,4),%0\n"
21849 @@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing
21850
21851 __asm__ __volatile__(
21852 " .align 2,0x90\n"
21853 - "0: movl 32(%4), %%eax\n"
21854 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
21855 " cmpl $67, %0\n"
21856 " jbe 2f\n"
21857 - "1: movl 64(%4), %%eax\n"
21858 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
21859 " .align 2,0x90\n"
21860 - "2: movl 0(%4), %%eax\n"
21861 - "21: movl 4(%4), %%edx\n"
21862 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
21863 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
21864 " movnti %%eax, 0(%3)\n"
21865 " movnti %%edx, 4(%3)\n"
21866 - "3: movl 8(%4), %%eax\n"
21867 - "31: movl 12(%4),%%edx\n"
21868 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
21869 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
21870 " movnti %%eax, 8(%3)\n"
21871 " movnti %%edx, 12(%3)\n"
21872 - "4: movl 16(%4), %%eax\n"
21873 - "41: movl 20(%4), %%edx\n"
21874 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
21875 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
21876 " movnti %%eax, 16(%3)\n"
21877 " movnti %%edx, 20(%3)\n"
21878 - "10: movl 24(%4), %%eax\n"
21879 - "51: movl 28(%4), %%edx\n"
21880 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
21881 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
21882 " movnti %%eax, 24(%3)\n"
21883 " movnti %%edx, 28(%3)\n"
21884 - "11: movl 32(%4), %%eax\n"
21885 - "61: movl 36(%4), %%edx\n"
21886 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
21887 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
21888 " movnti %%eax, 32(%3)\n"
21889 " movnti %%edx, 36(%3)\n"
21890 - "12: movl 40(%4), %%eax\n"
21891 - "71: movl 44(%4), %%edx\n"
21892 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
21893 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
21894 " movnti %%eax, 40(%3)\n"
21895 " movnti %%edx, 44(%3)\n"
21896 - "13: movl 48(%4), %%eax\n"
21897 - "81: movl 52(%4), %%edx\n"
21898 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
21899 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
21900 " movnti %%eax, 48(%3)\n"
21901 " movnti %%edx, 52(%3)\n"
21902 - "14: movl 56(%4), %%eax\n"
21903 - "91: movl 60(%4), %%edx\n"
21904 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
21905 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
21906 " movnti %%eax, 56(%3)\n"
21907 " movnti %%edx, 60(%3)\n"
21908 " addl $-64, %0\n"
21909 @@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing
21910 " shrl $2, %0\n"
21911 " andl $3, %%eax\n"
21912 " cld\n"
21913 - "6: rep; movsl\n"
21914 + "6: rep; "__copyuser_seg" movsl\n"
21915 " movl %%eax,%0\n"
21916 - "7: rep; movsb\n"
21917 + "7: rep; "__copyuser_seg" movsb\n"
21918 "8:\n"
21919 ".section .fixup,\"ax\"\n"
21920 "9: lea 0(%%eax,%0,4),%0\n"
21921 @@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_n
21922
21923 __asm__ __volatile__(
21924 " .align 2,0x90\n"
21925 - "0: movl 32(%4), %%eax\n"
21926 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
21927 " cmpl $67, %0\n"
21928 " jbe 2f\n"
21929 - "1: movl 64(%4), %%eax\n"
21930 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
21931 " .align 2,0x90\n"
21932 - "2: movl 0(%4), %%eax\n"
21933 - "21: movl 4(%4), %%edx\n"
21934 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
21935 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
21936 " movnti %%eax, 0(%3)\n"
21937 " movnti %%edx, 4(%3)\n"
21938 - "3: movl 8(%4), %%eax\n"
21939 - "31: movl 12(%4),%%edx\n"
21940 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
21941 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
21942 " movnti %%eax, 8(%3)\n"
21943 " movnti %%edx, 12(%3)\n"
21944 - "4: movl 16(%4), %%eax\n"
21945 - "41: movl 20(%4), %%edx\n"
21946 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
21947 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
21948 " movnti %%eax, 16(%3)\n"
21949 " movnti %%edx, 20(%3)\n"
21950 - "10: movl 24(%4), %%eax\n"
21951 - "51: movl 28(%4), %%edx\n"
21952 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
21953 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
21954 " movnti %%eax, 24(%3)\n"
21955 " movnti %%edx, 28(%3)\n"
21956 - "11: movl 32(%4), %%eax\n"
21957 - "61: movl 36(%4), %%edx\n"
21958 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
21959 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
21960 " movnti %%eax, 32(%3)\n"
21961 " movnti %%edx, 36(%3)\n"
21962 - "12: movl 40(%4), %%eax\n"
21963 - "71: movl 44(%4), %%edx\n"
21964 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
21965 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
21966 " movnti %%eax, 40(%3)\n"
21967 " movnti %%edx, 44(%3)\n"
21968 - "13: movl 48(%4), %%eax\n"
21969 - "81: movl 52(%4), %%edx\n"
21970 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
21971 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
21972 " movnti %%eax, 48(%3)\n"
21973 " movnti %%edx, 52(%3)\n"
21974 - "14: movl 56(%4), %%eax\n"
21975 - "91: movl 60(%4), %%edx\n"
21976 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
21977 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
21978 " movnti %%eax, 56(%3)\n"
21979 " movnti %%edx, 60(%3)\n"
21980 " addl $-64, %0\n"
21981 @@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_n
21982 " shrl $2, %0\n"
21983 " andl $3, %%eax\n"
21984 " cld\n"
21985 - "6: rep; movsl\n"
21986 + "6: rep; "__copyuser_seg" movsl\n"
21987 " movl %%eax,%0\n"
21988 - "7: rep; movsb\n"
21989 + "7: rep; "__copyuser_seg" movsb\n"
21990 "8:\n"
21991 ".section .fixup,\"ax\"\n"
21992 "9: lea 0(%%eax,%0,4),%0\n"
21993 @@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_n
21994 */
21995 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
21996 unsigned long size);
21997 -unsigned long __copy_user_intel(void __user *to, const void *from,
21998 +unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
21999 + unsigned long size);
22000 +unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
22001 unsigned long size);
22002 unsigned long __copy_user_zeroing_intel_nocache(void *to,
22003 const void __user *from, unsigned long size);
22004 #endif /* CONFIG_X86_INTEL_USERCOPY */
22005
22006 /* Generic arbitrary sized copy. */
22007 -#define __copy_user(to, from, size) \
22008 +#define __copy_user(to, from, size, prefix, set, restore) \
22009 do { \
22010 int __d0, __d1, __d2; \
22011 __asm__ __volatile__( \
22012 + set \
22013 " cmp $7,%0\n" \
22014 " jbe 1f\n" \
22015 " movl %1,%0\n" \
22016 " negl %0\n" \
22017 " andl $7,%0\n" \
22018 " subl %0,%3\n" \
22019 - "4: rep; movsb\n" \
22020 + "4: rep; "prefix"movsb\n" \
22021 " movl %3,%0\n" \
22022 " shrl $2,%0\n" \
22023 " andl $3,%3\n" \
22024 " .align 2,0x90\n" \
22025 - "0: rep; movsl\n" \
22026 + "0: rep; "prefix"movsl\n" \
22027 " movl %3,%0\n" \
22028 - "1: rep; movsb\n" \
22029 + "1: rep; "prefix"movsb\n" \
22030 "2:\n" \
22031 + restore \
22032 ".section .fixup,\"ax\"\n" \
22033 "5: addl %3,%0\n" \
22034 " jmp 2b\n" \
22035 @@ -682,14 +799,14 @@ do { \
22036 " negl %0\n" \
22037 " andl $7,%0\n" \
22038 " subl %0,%3\n" \
22039 - "4: rep; movsb\n" \
22040 + "4: rep; "__copyuser_seg"movsb\n" \
22041 " movl %3,%0\n" \
22042 " shrl $2,%0\n" \
22043 " andl $3,%3\n" \
22044 " .align 2,0x90\n" \
22045 - "0: rep; movsl\n" \
22046 + "0: rep; "__copyuser_seg"movsl\n" \
22047 " movl %3,%0\n" \
22048 - "1: rep; movsb\n" \
22049 + "1: rep; "__copyuser_seg"movsb\n" \
22050 "2:\n" \
22051 ".section .fixup,\"ax\"\n" \
22052 "5: addl %3,%0\n" \
22053 @@ -775,9 +892,9 @@ survive:
22054 }
22055 #endif
22056 if (movsl_is_ok(to, from, n))
22057 - __copy_user(to, from, n);
22058 + __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
22059 else
22060 - n = __copy_user_intel(to, from, n);
22061 + n = __generic_copy_to_user_intel(to, from, n);
22062 return n;
22063 }
22064 EXPORT_SYMBOL(__copy_to_user_ll);
22065 @@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero
22066 unsigned long n)
22067 {
22068 if (movsl_is_ok(to, from, n))
22069 - __copy_user(to, from, n);
22070 + __copy_user(to, from, n, __copyuser_seg, "", "");
22071 else
22072 - n = __copy_user_intel((void __user *)to,
22073 - (const void *)from, n);
22074 + n = __generic_copy_from_user_intel(to, from, n);
22075 return n;
22076 }
22077 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
22078 @@ -827,59 +943,38 @@ unsigned long __copy_from_user_ll_nocach
22079 if (n > 64 && cpu_has_xmm2)
22080 n = __copy_user_intel_nocache(to, from, n);
22081 else
22082 - __copy_user(to, from, n);
22083 + __copy_user(to, from, n, __copyuser_seg, "", "");
22084 #else
22085 - __copy_user(to, from, n);
22086 + __copy_user(to, from, n, __copyuser_seg, "", "");
22087 #endif
22088 return n;
22089 }
22090 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
22091
22092 -/**
22093 - * copy_to_user: - Copy a block of data into user space.
22094 - * @to: Destination address, in user space.
22095 - * @from: Source address, in kernel space.
22096 - * @n: Number of bytes to copy.
22097 - *
22098 - * Context: User context only. This function may sleep.
22099 - *
22100 - * Copy data from kernel space to user space.
22101 - *
22102 - * Returns number of bytes that could not be copied.
22103 - * On success, this will be zero.
22104 - */
22105 -unsigned long
22106 -copy_to_user(void __user *to, const void *from, unsigned long n)
22107 +#ifdef CONFIG_PAX_MEMORY_UDEREF
22108 +void __set_fs(mm_segment_t x)
22109 {
22110 - if (access_ok(VERIFY_WRITE, to, n))
22111 - n = __copy_to_user(to, from, n);
22112 - return n;
22113 + switch (x.seg) {
22114 + case 0:
22115 + loadsegment(gs, 0);
22116 + break;
22117 + case TASK_SIZE_MAX:
22118 + loadsegment(gs, __USER_DS);
22119 + break;
22120 + case -1UL:
22121 + loadsegment(gs, __KERNEL_DS);
22122 + break;
22123 + default:
22124 + BUG();
22125 + }
22126 + return;
22127 }
22128 -EXPORT_SYMBOL(copy_to_user);
22129 +EXPORT_SYMBOL(__set_fs);
22130
22131 -/**
22132 - * copy_from_user: - Copy a block of data from user space.
22133 - * @to: Destination address, in kernel space.
22134 - * @from: Source address, in user space.
22135 - * @n: Number of bytes to copy.
22136 - *
22137 - * Context: User context only. This function may sleep.
22138 - *
22139 - * Copy data from user space to kernel space.
22140 - *
22141 - * Returns number of bytes that could not be copied.
22142 - * On success, this will be zero.
22143 - *
22144 - * If some data could not be copied, this function will pad the copied
22145 - * data to the requested size using zero bytes.
22146 - */
22147 -unsigned long
22148 -copy_from_user(void *to, const void __user *from, unsigned long n)
22149 +void set_fs(mm_segment_t x)
22150 {
22151 - if (access_ok(VERIFY_READ, from, n))
22152 - n = __copy_from_user(to, from, n);
22153 - else
22154 - memset(to, 0, n);
22155 - return n;
22156 + current_thread_info()->addr_limit = x;
22157 + __set_fs(x);
22158 }
22159 -EXPORT_SYMBOL(copy_from_user);
22160 +EXPORT_SYMBOL(set_fs);
22161 +#endif
22162 diff -urNp linux-2.6.32.49/arch/x86/lib/usercopy_64.c linux-2.6.32.49/arch/x86/lib/usercopy_64.c
22163 --- linux-2.6.32.49/arch/x86/lib/usercopy_64.c 2011-11-08 19:02:43.000000000 -0500
22164 +++ linux-2.6.32.49/arch/x86/lib/usercopy_64.c 2011-11-15 19:59:43.000000000 -0500
22165 @@ -42,6 +42,12 @@ long
22166 __strncpy_from_user(char *dst, const char __user *src, long count)
22167 {
22168 long res;
22169 +
22170 +#ifdef CONFIG_PAX_MEMORY_UDEREF
22171 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
22172 + src += PAX_USER_SHADOW_BASE;
22173 +#endif
22174 +
22175 __do_strncpy_from_user(dst, src, count, res);
22176 return res;
22177 }
22178 @@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *
22179 {
22180 long __d0;
22181 might_fault();
22182 +
22183 +#ifdef CONFIG_PAX_MEMORY_UDEREF
22184 + if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
22185 + addr += PAX_USER_SHADOW_BASE;
22186 +#endif
22187 +
22188 /* no memory constraint because it doesn't change any memory gcc knows
22189 about */
22190 asm volatile(
22191 @@ -151,10 +163,18 @@ EXPORT_SYMBOL(strlen_user);
22192
22193 unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
22194 {
22195 - if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
22196 - return copy_user_generic((__force void *)to, (__force void *)from, len);
22197 - }
22198 - return len;
22199 + if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
22200 +
22201 +#ifdef CONFIG_PAX_MEMORY_UDEREF
22202 + if ((unsigned long)to < PAX_USER_SHADOW_BASE)
22203 + to += PAX_USER_SHADOW_BASE;
22204 + if ((unsigned long)from < PAX_USER_SHADOW_BASE)
22205 + from += PAX_USER_SHADOW_BASE;
22206 +#endif
22207 +
22208 + return copy_user_generic((void __force_kernel *)to, (void __force_kernel *)from, len);
22209 + }
22210 + return len;
22211 }
22212 EXPORT_SYMBOL(copy_in_user);
22213
22214 @@ -164,7 +184,7 @@ EXPORT_SYMBOL(copy_in_user);
22215 * it is not necessary to optimize tail handling.
22216 */
22217 unsigned long
22218 -copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
22219 +copy_user_handle_tail(char __user *to, char __user *from, unsigned len, unsigned zerorest)
22220 {
22221 char c;
22222 unsigned zero_len;
22223 diff -urNp linux-2.6.32.49/arch/x86/Makefile linux-2.6.32.49/arch/x86/Makefile
22224 --- linux-2.6.32.49/arch/x86/Makefile 2011-11-08 19:02:43.000000000 -0500
22225 +++ linux-2.6.32.49/arch/x86/Makefile 2011-11-15 19:59:43.000000000 -0500
22226 @@ -44,6 +44,7 @@ ifeq ($(CONFIG_X86_32),y)
22227 else
22228 BITS := 64
22229 UTS_MACHINE := x86_64
22230 + biarch := $(call cc-option,-m64)
22231 CHECKFLAGS += -D__x86_64__ -m64
22232
22233 KBUILD_AFLAGS += -m64
22234 @@ -189,3 +190,12 @@ define archhelp
22235 echo ' FDARGS="..." arguments for the booted kernel'
22236 echo ' FDINITRD=file initrd for the booted kernel'
22237 endef
22238 +
22239 +define OLD_LD
22240 +
22241 +*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
22242 +*** Please upgrade your binutils to 2.18 or newer
22243 +endef
22244 +
22245 +archprepare:
22246 + $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
22247 diff -urNp linux-2.6.32.49/arch/x86/mm/extable.c linux-2.6.32.49/arch/x86/mm/extable.c
22248 --- linux-2.6.32.49/arch/x86/mm/extable.c 2011-11-08 19:02:43.000000000 -0500
22249 +++ linux-2.6.32.49/arch/x86/mm/extable.c 2011-11-15 19:59:43.000000000 -0500
22250 @@ -1,14 +1,71 @@
22251 #include <linux/module.h>
22252 #include <linux/spinlock.h>
22253 +#include <linux/sort.h>
22254 #include <asm/uaccess.h>
22255 +#include <asm/pgtable.h>
22256
22257 +/*
22258 + * The exception table needs to be sorted so that the binary
22259 + * search that we use to find entries in it works properly.
22260 + * This is used both for the kernel exception table and for
22261 + * the exception tables of modules that get loaded.
22262 + */
22263 +static int cmp_ex(const void *a, const void *b)
22264 +{
22265 + const struct exception_table_entry *x = a, *y = b;
22266 +
22267 + /* avoid overflow */
22268 + if (x->insn > y->insn)
22269 + return 1;
22270 + if (x->insn < y->insn)
22271 + return -1;
22272 + return 0;
22273 +}
22274 +
22275 +static void swap_ex(void *a, void *b, int size)
22276 +{
22277 + struct exception_table_entry t, *x = a, *y = b;
22278 +
22279 + t = *x;
22280 +
22281 + pax_open_kernel();
22282 + *x = *y;
22283 + *y = t;
22284 + pax_close_kernel();
22285 +}
22286 +
22287 +void sort_extable(struct exception_table_entry *start,
22288 + struct exception_table_entry *finish)
22289 +{
22290 + sort(start, finish - start, sizeof(struct exception_table_entry),
22291 + cmp_ex, swap_ex);
22292 +}
22293 +
22294 +#ifdef CONFIG_MODULES
22295 +/*
22296 + * If the exception table is sorted, any referring to the module init
22297 + * will be at the beginning or the end.
22298 + */
22299 +void trim_init_extable(struct module *m)
22300 +{
22301 + /*trim the beginning*/
22302 + while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
22303 + m->extable++;
22304 + m->num_exentries--;
22305 + }
22306 + /*trim the end*/
22307 + while (m->num_exentries &&
22308 + within_module_init(m->extable[m->num_exentries-1].insn, m))
22309 + m->num_exentries--;
22310 +}
22311 +#endif /* CONFIG_MODULES */
22312
22313 int fixup_exception(struct pt_regs *regs)
22314 {
22315 const struct exception_table_entry *fixup;
22316
22317 #ifdef CONFIG_PNPBIOS
22318 - if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
22319 + if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
22320 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
22321 extern u32 pnp_bios_is_utter_crap;
22322 pnp_bios_is_utter_crap = 1;
22323 diff -urNp linux-2.6.32.49/arch/x86/mm/fault.c linux-2.6.32.49/arch/x86/mm/fault.c
22324 --- linux-2.6.32.49/arch/x86/mm/fault.c 2011-11-08 19:02:43.000000000 -0500
22325 +++ linux-2.6.32.49/arch/x86/mm/fault.c 2011-11-18 18:07:11.000000000 -0500
22326 @@ -11,10 +11,19 @@
22327 #include <linux/kprobes.h> /* __kprobes, ... */
22328 #include <linux/mmiotrace.h> /* kmmio_handler, ... */
22329 #include <linux/perf_event.h> /* perf_sw_event */
22330 +#include <linux/unistd.h>
22331 +#include <linux/compiler.h>
22332
22333 #include <asm/traps.h> /* dotraplinkage, ... */
22334 #include <asm/pgalloc.h> /* pgd_*(), ... */
22335 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
22336 +#include <asm/vsyscall.h>
22337 +#include <asm/tlbflush.h>
22338 +
22339 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22340 +#include <asm/stacktrace.h>
22341 +#include "../kernel/dumpstack.h"
22342 +#endif
22343
22344 /*
22345 * Page fault error code bits:
22346 @@ -51,7 +60,7 @@ static inline int notify_page_fault(stru
22347 int ret = 0;
22348
22349 /* kprobe_running() needs smp_processor_id() */
22350 - if (kprobes_built_in() && !user_mode_vm(regs)) {
22351 + if (kprobes_built_in() && !user_mode(regs)) {
22352 preempt_disable();
22353 if (kprobe_running() && kprobe_fault_handler(regs, 14))
22354 ret = 1;
22355 @@ -112,7 +121,10 @@ check_prefetch_opcode(struct pt_regs *re
22356 return !instr_lo || (instr_lo>>1) == 1;
22357 case 0x00:
22358 /* Prefetch instruction is 0x0F0D or 0x0F18 */
22359 - if (probe_kernel_address(instr, opcode))
22360 + if (user_mode(regs)) {
22361 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
22362 + return 0;
22363 + } else if (probe_kernel_address(instr, opcode))
22364 return 0;
22365
22366 *prefetch = (instr_lo == 0xF) &&
22367 @@ -146,7 +158,10 @@ is_prefetch(struct pt_regs *regs, unsign
22368 while (instr < max_instr) {
22369 unsigned char opcode;
22370
22371 - if (probe_kernel_address(instr, opcode))
22372 + if (user_mode(regs)) {
22373 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
22374 + break;
22375 + } else if (probe_kernel_address(instr, opcode))
22376 break;
22377
22378 instr++;
22379 @@ -172,6 +187,34 @@ force_sig_info_fault(int si_signo, int s
22380 force_sig_info(si_signo, &info, tsk);
22381 }
22382
22383 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22384 +static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address);
22385 +#endif
22386 +
22387 +#ifdef CONFIG_PAX_EMUTRAMP
22388 +static int pax_handle_fetch_fault(struct pt_regs *regs);
22389 +#endif
22390 +
22391 +#ifdef CONFIG_PAX_PAGEEXEC
22392 +static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
22393 +{
22394 + pgd_t *pgd;
22395 + pud_t *pud;
22396 + pmd_t *pmd;
22397 +
22398 + pgd = pgd_offset(mm, address);
22399 + if (!pgd_present(*pgd))
22400 + return NULL;
22401 + pud = pud_offset(pgd, address);
22402 + if (!pud_present(*pud))
22403 + return NULL;
22404 + pmd = pmd_offset(pud, address);
22405 + if (!pmd_present(*pmd))
22406 + return NULL;
22407 + return pmd;
22408 +}
22409 +#endif
22410 +
22411 DEFINE_SPINLOCK(pgd_lock);
22412 LIST_HEAD(pgd_list);
22413
22414 @@ -224,11 +267,24 @@ void vmalloc_sync_all(void)
22415 address += PMD_SIZE) {
22416
22417 unsigned long flags;
22418 +
22419 +#ifdef CONFIG_PAX_PER_CPU_PGD
22420 + unsigned long cpu;
22421 +#else
22422 struct page *page;
22423 +#endif
22424
22425 spin_lock_irqsave(&pgd_lock, flags);
22426 +
22427 +#ifdef CONFIG_PAX_PER_CPU_PGD
22428 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22429 + pgd_t *pgd = get_cpu_pgd(cpu);
22430 +#else
22431 list_for_each_entry(page, &pgd_list, lru) {
22432 - if (!vmalloc_sync_one(page_address(page), address))
22433 + pgd_t *pgd = page_address(page);
22434 +#endif
22435 +
22436 + if (!vmalloc_sync_one(pgd, address))
22437 break;
22438 }
22439 spin_unlock_irqrestore(&pgd_lock, flags);
22440 @@ -258,6 +314,11 @@ static noinline int vmalloc_fault(unsign
22441 * an interrupt in the middle of a task switch..
22442 */
22443 pgd_paddr = read_cr3();
22444 +
22445 +#ifdef CONFIG_PAX_PER_CPU_PGD
22446 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
22447 +#endif
22448 +
22449 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
22450 if (!pmd_k)
22451 return -1;
22452 @@ -332,15 +393,27 @@ void vmalloc_sync_all(void)
22453
22454 const pgd_t *pgd_ref = pgd_offset_k(address);
22455 unsigned long flags;
22456 +
22457 +#ifdef CONFIG_PAX_PER_CPU_PGD
22458 + unsigned long cpu;
22459 +#else
22460 struct page *page;
22461 +#endif
22462
22463 if (pgd_none(*pgd_ref))
22464 continue;
22465
22466 spin_lock_irqsave(&pgd_lock, flags);
22467 +
22468 +#ifdef CONFIG_PAX_PER_CPU_PGD
22469 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22470 + pgd_t *pgd = pgd_offset_cpu(cpu, address);
22471 +#else
22472 list_for_each_entry(page, &pgd_list, lru) {
22473 pgd_t *pgd;
22474 pgd = (pgd_t *)page_address(page) + pgd_index(address);
22475 +#endif
22476 +
22477 if (pgd_none(*pgd))
22478 set_pgd(pgd, *pgd_ref);
22479 else
22480 @@ -373,7 +446,14 @@ static noinline int vmalloc_fault(unsign
22481 * happen within a race in page table update. In the later
22482 * case just flush:
22483 */
22484 +
22485 +#ifdef CONFIG_PAX_PER_CPU_PGD
22486 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
22487 + pgd = pgd_offset_cpu(smp_processor_id(), address);
22488 +#else
22489 pgd = pgd_offset(current->active_mm, address);
22490 +#endif
22491 +
22492 pgd_ref = pgd_offset_k(address);
22493 if (pgd_none(*pgd_ref))
22494 return -1;
22495 @@ -535,7 +615,7 @@ static int is_errata93(struct pt_regs *r
22496 static int is_errata100(struct pt_regs *regs, unsigned long address)
22497 {
22498 #ifdef CONFIG_X86_64
22499 - if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
22500 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
22501 return 1;
22502 #endif
22503 return 0;
22504 @@ -562,7 +642,7 @@ static int is_f00f_bug(struct pt_regs *r
22505 }
22506
22507 static const char nx_warning[] = KERN_CRIT
22508 -"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
22509 +"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
22510
22511 static void
22512 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
22513 @@ -571,15 +651,26 @@ show_fault_oops(struct pt_regs *regs, un
22514 if (!oops_may_print())
22515 return;
22516
22517 - if (error_code & PF_INSTR) {
22518 + if (nx_enabled && (error_code & PF_INSTR)) {
22519 unsigned int level;
22520
22521 pte_t *pte = lookup_address(address, &level);
22522
22523 if (pte && pte_present(*pte) && !pte_exec(*pte))
22524 - printk(nx_warning, current_uid());
22525 + printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
22526 }
22527
22528 +#ifdef CONFIG_PAX_KERNEXEC
22529 + if (init_mm.start_code <= address && address < init_mm.end_code) {
22530 + if (current->signal->curr_ip)
22531 + printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
22532 + &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
22533 + else
22534 + printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
22535 + current->comm, task_pid_nr(current), current_uid(), current_euid());
22536 + }
22537 +#endif
22538 +
22539 printk(KERN_ALERT "BUG: unable to handle kernel ");
22540 if (address < PAGE_SIZE)
22541 printk(KERN_CONT "NULL pointer dereference");
22542 @@ -705,6 +796,23 @@ __bad_area_nosemaphore(struct pt_regs *r
22543 {
22544 struct task_struct *tsk = current;
22545
22546 +#ifdef CONFIG_X86_64
22547 + struct mm_struct *mm = tsk->mm;
22548 +
22549 + if (mm && (error_code & PF_INSTR) && mm->context.vdso) {
22550 + if (regs->ip == (unsigned long)vgettimeofday) {
22551 + regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
22552 + return;
22553 + } else if (regs->ip == (unsigned long)vtime) {
22554 + regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
22555 + return;
22556 + } else if (regs->ip == (unsigned long)vgetcpu) {
22557 + regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
22558 + return;
22559 + }
22560 + }
22561 +#endif
22562 +
22563 /* User mode accesses just cause a SIGSEGV */
22564 if (error_code & PF_USER) {
22565 /*
22566 @@ -722,6 +830,21 @@ __bad_area_nosemaphore(struct pt_regs *r
22567 if (is_errata100(regs, address))
22568 return;
22569
22570 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22571 + if (pax_is_fetch_fault(regs, error_code, address)) {
22572 +
22573 +#ifdef CONFIG_PAX_EMUTRAMP
22574 + switch (pax_handle_fetch_fault(regs)) {
22575 + case 2:
22576 + return;
22577 + }
22578 +#endif
22579 +
22580 + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
22581 + do_group_exit(SIGKILL);
22582 + }
22583 +#endif
22584 +
22585 if (unlikely(show_unhandled_signals))
22586 show_signal_msg(regs, error_code, address, tsk);
22587
22588 @@ -818,7 +941,7 @@ do_sigbus(struct pt_regs *regs, unsigned
22589 if (fault & VM_FAULT_HWPOISON) {
22590 printk(KERN_ERR
22591 "MCE: Killing %s:%d due to hardware memory corruption fault at %lx\n",
22592 - tsk->comm, tsk->pid, address);
22593 + tsk->comm, task_pid_nr(tsk), address);
22594 code = BUS_MCEERR_AR;
22595 }
22596 #endif
22597 @@ -857,6 +980,99 @@ static int spurious_fault_check(unsigned
22598 return 1;
22599 }
22600
22601 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
22602 +static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
22603 +{
22604 + pte_t *pte;
22605 + pmd_t *pmd;
22606 + spinlock_t *ptl;
22607 + unsigned char pte_mask;
22608 +
22609 + if (nx_enabled || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
22610 + !(mm->pax_flags & MF_PAX_PAGEEXEC))
22611 + return 0;
22612 +
22613 + /* PaX: it's our fault, let's handle it if we can */
22614 +
22615 + /* PaX: take a look at read faults before acquiring any locks */
22616 + if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
22617 + /* instruction fetch attempt from a protected page in user mode */
22618 + up_read(&mm->mmap_sem);
22619 +
22620 +#ifdef CONFIG_PAX_EMUTRAMP
22621 + switch (pax_handle_fetch_fault(regs)) {
22622 + case 2:
22623 + return 1;
22624 + }
22625 +#endif
22626 +
22627 + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
22628 + do_group_exit(SIGKILL);
22629 + }
22630 +
22631 + pmd = pax_get_pmd(mm, address);
22632 + if (unlikely(!pmd))
22633 + return 0;
22634 +
22635 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
22636 + if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
22637 + pte_unmap_unlock(pte, ptl);
22638 + return 0;
22639 + }
22640 +
22641 + if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
22642 + /* write attempt to a protected page in user mode */
22643 + pte_unmap_unlock(pte, ptl);
22644 + return 0;
22645 + }
22646 +
22647 +#ifdef CONFIG_SMP
22648 + if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
22649 +#else
22650 + if (likely(address > get_limit(regs->cs)))
22651 +#endif
22652 + {
22653 + set_pte(pte, pte_mkread(*pte));
22654 + __flush_tlb_one(address);
22655 + pte_unmap_unlock(pte, ptl);
22656 + up_read(&mm->mmap_sem);
22657 + return 1;
22658 + }
22659 +
22660 + pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
22661 +
22662 + /*
22663 + * PaX: fill DTLB with user rights and retry
22664 + */
22665 + __asm__ __volatile__ (
22666 + "orb %2,(%1)\n"
22667 +#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
22668 +/*
22669 + * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
22670 + * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
22671 + * page fault when examined during a TLB load attempt. this is true not only
22672 + * for PTEs holding a non-present entry but also present entries that will
22673 + * raise a page fault (such as those set up by PaX, or the copy-on-write
22674 + * mechanism). in effect it means that we do *not* need to flush the TLBs
22675 + * for our target pages since their PTEs are simply not in the TLBs at all.
22676 +
22677 + * the best thing in omitting it is that we gain around 15-20% speed in the
22678 + * fast path of the page fault handler and can get rid of tracing since we
22679 + * can no longer flush unintended entries.
22680 + */
22681 + "invlpg (%0)\n"
22682 +#endif
22683 + __copyuser_seg"testb $0,(%0)\n"
22684 + "xorb %3,(%1)\n"
22685 + :
22686 + : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
22687 + : "memory", "cc");
22688 + pte_unmap_unlock(pte, ptl);
22689 + up_read(&mm->mmap_sem);
22690 + return 1;
22691 +}
22692 +#endif
22693 +
22694 /*
22695 * Handle a spurious fault caused by a stale TLB entry.
22696 *
22697 @@ -923,6 +1139,9 @@ int show_unhandled_signals = 1;
22698 static inline int
22699 access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
22700 {
22701 + if (nx_enabled && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
22702 + return 1;
22703 +
22704 if (write) {
22705 /* write, present and write, not present: */
22706 if (unlikely(!(vma->vm_flags & VM_WRITE)))
22707 @@ -956,17 +1175,31 @@ do_page_fault(struct pt_regs *regs, unsi
22708 {
22709 struct vm_area_struct *vma;
22710 struct task_struct *tsk;
22711 - unsigned long address;
22712 struct mm_struct *mm;
22713 int write;
22714 int fault;
22715
22716 + /* Get the faulting address: */
22717 + unsigned long address = read_cr2();
22718 +
22719 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22720 + if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
22721 + if (!search_exception_tables(regs->ip)) {
22722 + bad_area_nosemaphore(regs, error_code, address);
22723 + return;
22724 + }
22725 + if (address < PAX_USER_SHADOW_BASE) {
22726 + printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
22727 + printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip);
22728 + show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
22729 + } else
22730 + address -= PAX_USER_SHADOW_BASE;
22731 + }
22732 +#endif
22733 +
22734 tsk = current;
22735 mm = tsk->mm;
22736
22737 - /* Get the faulting address: */
22738 - address = read_cr2();
22739 -
22740 /*
22741 * Detect and handle instructions that would cause a page fault for
22742 * both a tracked kernel page and a userspace page.
22743 @@ -1026,7 +1259,7 @@ do_page_fault(struct pt_regs *regs, unsi
22744 * User-mode registers count as a user access even for any
22745 * potential system fault or CPU buglet:
22746 */
22747 - if (user_mode_vm(regs)) {
22748 + if (user_mode(regs)) {
22749 local_irq_enable();
22750 error_code |= PF_USER;
22751 } else {
22752 @@ -1080,6 +1313,11 @@ do_page_fault(struct pt_regs *regs, unsi
22753 might_sleep();
22754 }
22755
22756 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
22757 + if (pax_handle_pageexec_fault(regs, mm, address, error_code))
22758 + return;
22759 +#endif
22760 +
22761 vma = find_vma(mm, address);
22762 if (unlikely(!vma)) {
22763 bad_area(regs, error_code, address);
22764 @@ -1091,18 +1329,24 @@ do_page_fault(struct pt_regs *regs, unsi
22765 bad_area(regs, error_code, address);
22766 return;
22767 }
22768 - if (error_code & PF_USER) {
22769 - /*
22770 - * Accessing the stack below %sp is always a bug.
22771 - * The large cushion allows instructions like enter
22772 - * and pusha to work. ("enter $65535, $31" pushes
22773 - * 32 pointers and then decrements %sp by 65535.)
22774 - */
22775 - if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
22776 - bad_area(regs, error_code, address);
22777 - return;
22778 - }
22779 + /*
22780 + * Accessing the stack below %sp is always a bug.
22781 + * The large cushion allows instructions like enter
22782 + * and pusha to work. ("enter $65535, $31" pushes
22783 + * 32 pointers and then decrements %sp by 65535.)
22784 + */
22785 + if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
22786 + bad_area(regs, error_code, address);
22787 + return;
22788 + }
22789 +
22790 +#ifdef CONFIG_PAX_SEGMEXEC
22791 + if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
22792 + bad_area(regs, error_code, address);
22793 + return;
22794 }
22795 +#endif
22796 +
22797 if (unlikely(expand_stack(vma, address))) {
22798 bad_area(regs, error_code, address);
22799 return;
22800 @@ -1146,3 +1390,240 @@ good_area:
22801
22802 up_read(&mm->mmap_sem);
22803 }
22804 +
22805 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22806 +static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address)
22807 +{
22808 + struct mm_struct *mm = current->mm;
22809 + unsigned long ip = regs->ip;
22810 +
22811 + if (v8086_mode(regs))
22812 + ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
22813 +
22814 +#ifdef CONFIG_PAX_PAGEEXEC
22815 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
22816 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR))
22817 + return true;
22818 + if (!(error_code & (PF_PROT | PF_WRITE)) && ip == address)
22819 + return true;
22820 + return false;
22821 + }
22822 +#endif
22823 +
22824 +#ifdef CONFIG_PAX_SEGMEXEC
22825 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
22826 + if (!(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address))
22827 + return true;
22828 + return false;
22829 + }
22830 +#endif
22831 +
22832 + return false;
22833 +}
22834 +#endif
22835 +
22836 +#ifdef CONFIG_PAX_EMUTRAMP
22837 +static int pax_handle_fetch_fault_32(struct pt_regs *regs)
22838 +{
22839 + int err;
22840 +
22841 + do { /* PaX: gcc trampoline emulation #1 */
22842 + unsigned char mov1, mov2;
22843 + unsigned short jmp;
22844 + unsigned int addr1, addr2;
22845 +
22846 +#ifdef CONFIG_X86_64
22847 + if ((regs->ip + 11) >> 32)
22848 + break;
22849 +#endif
22850 +
22851 + err = get_user(mov1, (unsigned char __user *)regs->ip);
22852 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
22853 + err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
22854 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
22855 + err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
22856 +
22857 + if (err)
22858 + break;
22859 +
22860 + if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
22861 + regs->cx = addr1;
22862 + regs->ax = addr2;
22863 + regs->ip = addr2;
22864 + return 2;
22865 + }
22866 + } while (0);
22867 +
22868 + do { /* PaX: gcc trampoline emulation #2 */
22869 + unsigned char mov, jmp;
22870 + unsigned int addr1, addr2;
22871 +
22872 +#ifdef CONFIG_X86_64
22873 + if ((regs->ip + 9) >> 32)
22874 + break;
22875 +#endif
22876 +
22877 + err = get_user(mov, (unsigned char __user *)regs->ip);
22878 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
22879 + err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
22880 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
22881 +
22882 + if (err)
22883 + break;
22884 +
22885 + if (mov == 0xB9 && jmp == 0xE9) {
22886 + regs->cx = addr1;
22887 + regs->ip = (unsigned int)(regs->ip + addr2 + 10);
22888 + return 2;
22889 + }
22890 + } while (0);
22891 +
22892 + return 1; /* PaX in action */
22893 +}
22894 +
22895 +#ifdef CONFIG_X86_64
22896 +static int pax_handle_fetch_fault_64(struct pt_regs *regs)
22897 +{
22898 + int err;
22899 +
22900 + do { /* PaX: gcc trampoline emulation #1 */
22901 + unsigned short mov1, mov2, jmp1;
22902 + unsigned char jmp2;
22903 + unsigned int addr1;
22904 + unsigned long addr2;
22905 +
22906 + err = get_user(mov1, (unsigned short __user *)regs->ip);
22907 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
22908 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
22909 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
22910 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
22911 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
22912 +
22913 + if (err)
22914 + break;
22915 +
22916 + if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
22917 + regs->r11 = addr1;
22918 + regs->r10 = addr2;
22919 + regs->ip = addr1;
22920 + return 2;
22921 + }
22922 + } while (0);
22923 +
22924 + do { /* PaX: gcc trampoline emulation #2 */
22925 + unsigned short mov1, mov2, jmp1;
22926 + unsigned char jmp2;
22927 + unsigned long addr1, addr2;
22928 +
22929 + err = get_user(mov1, (unsigned short __user *)regs->ip);
22930 + err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
22931 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
22932 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
22933 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
22934 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
22935 +
22936 + if (err)
22937 + break;
22938 +
22939 + if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
22940 + regs->r11 = addr1;
22941 + regs->r10 = addr2;
22942 + regs->ip = addr1;
22943 + return 2;
22944 + }
22945 + } while (0);
22946 +
22947 + return 1; /* PaX in action */
22948 +}
22949 +#endif
22950 +
22951 +/*
22952 + * PaX: decide what to do with offenders (regs->ip = fault address)
22953 + *
22954 + * returns 1 when task should be killed
22955 + * 2 when gcc trampoline was detected
22956 + */
22957 +static int pax_handle_fetch_fault(struct pt_regs *regs)
22958 +{
22959 + if (v8086_mode(regs))
22960 + return 1;
22961 +
22962 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
22963 + return 1;
22964 +
22965 +#ifdef CONFIG_X86_32
22966 + return pax_handle_fetch_fault_32(regs);
22967 +#else
22968 + if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
22969 + return pax_handle_fetch_fault_32(regs);
22970 + else
22971 + return pax_handle_fetch_fault_64(regs);
22972 +#endif
22973 +}
22974 +#endif
22975 +
22976 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
22977 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
22978 +{
22979 + long i;
22980 +
22981 + printk(KERN_ERR "PAX: bytes at PC: ");
22982 + for (i = 0; i < 20; i++) {
22983 + unsigned char c;
22984 + if (get_user(c, (unsigned char __force_user *)pc+i))
22985 + printk(KERN_CONT "?? ");
22986 + else
22987 + printk(KERN_CONT "%02x ", c);
22988 + }
22989 + printk("\n");
22990 +
22991 + printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
22992 + for (i = -1; i < 80 / (long)sizeof(long); i++) {
22993 + unsigned long c;
22994 + if (get_user(c, (unsigned long __force_user *)sp+i)) {
22995 +#ifdef CONFIG_X86_32
22996 + printk(KERN_CONT "???????? ");
22997 +#else
22998 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)))
22999 + printk(KERN_CONT "???????? ???????? ");
23000 + else
23001 + printk(KERN_CONT "???????????????? ");
23002 +#endif
23003 + } else {
23004 +#ifdef CONFIG_X86_64
23005 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))) {
23006 + printk(KERN_CONT "%08x ", (unsigned int)c);
23007 + printk(KERN_CONT "%08x ", (unsigned int)(c >> 32));
23008 + } else
23009 +#endif
23010 + printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
23011 + }
23012 + }
23013 + printk("\n");
23014 +}
23015 +#endif
23016 +
23017 +/**
23018 + * probe_kernel_write(): safely attempt to write to a location
23019 + * @dst: address to write to
23020 + * @src: pointer to the data that shall be written
23021 + * @size: size of the data chunk
23022 + *
23023 + * Safely write to address @dst from the buffer at @src. If a kernel fault
23024 + * happens, handle that and return -EFAULT.
23025 + */
23026 +long notrace probe_kernel_write(void *dst, const void *src, size_t size)
23027 +{
23028 + long ret;
23029 + mm_segment_t old_fs = get_fs();
23030 +
23031 + set_fs(KERNEL_DS);
23032 + pagefault_disable();
23033 + pax_open_kernel();
23034 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
23035 + pax_close_kernel();
23036 + pagefault_enable();
23037 + set_fs(old_fs);
23038 +
23039 + return ret ? -EFAULT : 0;
23040 +}
23041 diff -urNp linux-2.6.32.49/arch/x86/mm/gup.c linux-2.6.32.49/arch/x86/mm/gup.c
23042 --- linux-2.6.32.49/arch/x86/mm/gup.c 2011-11-08 19:02:43.000000000 -0500
23043 +++ linux-2.6.32.49/arch/x86/mm/gup.c 2011-11-15 19:59:43.000000000 -0500
23044 @@ -237,7 +237,7 @@ int __get_user_pages_fast(unsigned long
23045 addr = start;
23046 len = (unsigned long) nr_pages << PAGE_SHIFT;
23047 end = start + len;
23048 - if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
23049 + if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
23050 (void __user *)start, len)))
23051 return 0;
23052
23053 diff -urNp linux-2.6.32.49/arch/x86/mm/highmem_32.c linux-2.6.32.49/arch/x86/mm/highmem_32.c
23054 --- linux-2.6.32.49/arch/x86/mm/highmem_32.c 2011-11-08 19:02:43.000000000 -0500
23055 +++ linux-2.6.32.49/arch/x86/mm/highmem_32.c 2011-11-15 19:59:43.000000000 -0500
23056 @@ -43,7 +43,10 @@ void *kmap_atomic_prot(struct page *page
23057 idx = type + KM_TYPE_NR*smp_processor_id();
23058 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
23059 BUG_ON(!pte_none(*(kmap_pte-idx)));
23060 +
23061 + pax_open_kernel();
23062 set_pte(kmap_pte-idx, mk_pte(page, prot));
23063 + pax_close_kernel();
23064
23065 return (void *)vaddr;
23066 }
23067 diff -urNp linux-2.6.32.49/arch/x86/mm/hugetlbpage.c linux-2.6.32.49/arch/x86/mm/hugetlbpage.c
23068 --- linux-2.6.32.49/arch/x86/mm/hugetlbpage.c 2011-11-08 19:02:43.000000000 -0500
23069 +++ linux-2.6.32.49/arch/x86/mm/hugetlbpage.c 2011-11-15 19:59:43.000000000 -0500
23070 @@ -267,13 +267,20 @@ static unsigned long hugetlb_get_unmappe
23071 struct hstate *h = hstate_file(file);
23072 struct mm_struct *mm = current->mm;
23073 struct vm_area_struct *vma;
23074 - unsigned long start_addr;
23075 + unsigned long start_addr, pax_task_size = TASK_SIZE;
23076 +
23077 +#ifdef CONFIG_PAX_SEGMEXEC
23078 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
23079 + pax_task_size = SEGMEXEC_TASK_SIZE;
23080 +#endif
23081 +
23082 + pax_task_size -= PAGE_SIZE;
23083
23084 if (len > mm->cached_hole_size) {
23085 - start_addr = mm->free_area_cache;
23086 + start_addr = mm->free_area_cache;
23087 } else {
23088 - start_addr = TASK_UNMAPPED_BASE;
23089 - mm->cached_hole_size = 0;
23090 + start_addr = mm->mmap_base;
23091 + mm->cached_hole_size = 0;
23092 }
23093
23094 full_search:
23095 @@ -281,26 +288,27 @@ full_search:
23096
23097 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
23098 /* At this point: (!vma || addr < vma->vm_end). */
23099 - if (TASK_SIZE - len < addr) {
23100 + if (pax_task_size - len < addr) {
23101 /*
23102 * Start a new search - just in case we missed
23103 * some holes.
23104 */
23105 - if (start_addr != TASK_UNMAPPED_BASE) {
23106 - start_addr = TASK_UNMAPPED_BASE;
23107 + if (start_addr != mm->mmap_base) {
23108 + start_addr = mm->mmap_base;
23109 mm->cached_hole_size = 0;
23110 goto full_search;
23111 }
23112 return -ENOMEM;
23113 }
23114 - if (!vma || addr + len <= vma->vm_start) {
23115 - mm->free_area_cache = addr + len;
23116 - return addr;
23117 - }
23118 + if (check_heap_stack_gap(vma, addr, len))
23119 + break;
23120 if (addr + mm->cached_hole_size < vma->vm_start)
23121 mm->cached_hole_size = vma->vm_start - addr;
23122 addr = ALIGN(vma->vm_end, huge_page_size(h));
23123 }
23124 +
23125 + mm->free_area_cache = addr + len;
23126 + return addr;
23127 }
23128
23129 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
23130 @@ -309,10 +317,9 @@ static unsigned long hugetlb_get_unmappe
23131 {
23132 struct hstate *h = hstate_file(file);
23133 struct mm_struct *mm = current->mm;
23134 - struct vm_area_struct *vma, *prev_vma;
23135 - unsigned long base = mm->mmap_base, addr = addr0;
23136 + struct vm_area_struct *vma;
23137 + unsigned long base = mm->mmap_base, addr;
23138 unsigned long largest_hole = mm->cached_hole_size;
23139 - int first_time = 1;
23140
23141 /* don't allow allocations above current base */
23142 if (mm->free_area_cache > base)
23143 @@ -322,64 +329,63 @@ static unsigned long hugetlb_get_unmappe
23144 largest_hole = 0;
23145 mm->free_area_cache = base;
23146 }
23147 -try_again:
23148 +
23149 /* make sure it can fit in the remaining address space */
23150 if (mm->free_area_cache < len)
23151 goto fail;
23152
23153 /* either no address requested or cant fit in requested address hole */
23154 - addr = (mm->free_area_cache - len) & huge_page_mask(h);
23155 + addr = (mm->free_area_cache - len);
23156 do {
23157 + addr &= huge_page_mask(h);
23158 + vma = find_vma(mm, addr);
23159 /*
23160 * Lookup failure means no vma is above this address,
23161 * i.e. return with success:
23162 - */
23163 - if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
23164 - return addr;
23165 -
23166 - /*
23167 * new region fits between prev_vma->vm_end and
23168 * vma->vm_start, use it:
23169 */
23170 - if (addr + len <= vma->vm_start &&
23171 - (!prev_vma || (addr >= prev_vma->vm_end))) {
23172 + if (check_heap_stack_gap(vma, addr, len)) {
23173 /* remember the address as a hint for next time */
23174 - mm->cached_hole_size = largest_hole;
23175 - return (mm->free_area_cache = addr);
23176 - } else {
23177 - /* pull free_area_cache down to the first hole */
23178 - if (mm->free_area_cache == vma->vm_end) {
23179 - mm->free_area_cache = vma->vm_start;
23180 - mm->cached_hole_size = largest_hole;
23181 - }
23182 + mm->cached_hole_size = largest_hole;
23183 + return (mm->free_area_cache = addr);
23184 + }
23185 + /* pull free_area_cache down to the first hole */
23186 + if (mm->free_area_cache == vma->vm_end) {
23187 + mm->free_area_cache = vma->vm_start;
23188 + mm->cached_hole_size = largest_hole;
23189 }
23190
23191 /* remember the largest hole we saw so far */
23192 if (addr + largest_hole < vma->vm_start)
23193 - largest_hole = vma->vm_start - addr;
23194 + largest_hole = vma->vm_start - addr;
23195
23196 /* try just below the current vma->vm_start */
23197 - addr = (vma->vm_start - len) & huge_page_mask(h);
23198 - } while (len <= vma->vm_start);
23199 + addr = skip_heap_stack_gap(vma, len);
23200 + } while (!IS_ERR_VALUE(addr));
23201
23202 fail:
23203 /*
23204 - * if hint left us with no space for the requested
23205 - * mapping then try again:
23206 - */
23207 - if (first_time) {
23208 - mm->free_area_cache = base;
23209 - largest_hole = 0;
23210 - first_time = 0;
23211 - goto try_again;
23212 - }
23213 - /*
23214 * A failed mmap() very likely causes application failure,
23215 * so fall back to the bottom-up function here. This scenario
23216 * can happen with large stack limits and large mmap()
23217 * allocations.
23218 */
23219 - mm->free_area_cache = TASK_UNMAPPED_BASE;
23220 +
23221 +#ifdef CONFIG_PAX_SEGMEXEC
23222 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
23223 + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
23224 + else
23225 +#endif
23226 +
23227 + mm->mmap_base = TASK_UNMAPPED_BASE;
23228 +
23229 +#ifdef CONFIG_PAX_RANDMMAP
23230 + if (mm->pax_flags & MF_PAX_RANDMMAP)
23231 + mm->mmap_base += mm->delta_mmap;
23232 +#endif
23233 +
23234 + mm->free_area_cache = mm->mmap_base;
23235 mm->cached_hole_size = ~0UL;
23236 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
23237 len, pgoff, flags);
23238 @@ -387,6 +393,7 @@ fail:
23239 /*
23240 * Restore the topdown base:
23241 */
23242 + mm->mmap_base = base;
23243 mm->free_area_cache = base;
23244 mm->cached_hole_size = ~0UL;
23245
23246 @@ -400,10 +407,19 @@ hugetlb_get_unmapped_area(struct file *f
23247 struct hstate *h = hstate_file(file);
23248 struct mm_struct *mm = current->mm;
23249 struct vm_area_struct *vma;
23250 + unsigned long pax_task_size = TASK_SIZE;
23251
23252 if (len & ~huge_page_mask(h))
23253 return -EINVAL;
23254 - if (len > TASK_SIZE)
23255 +
23256 +#ifdef CONFIG_PAX_SEGMEXEC
23257 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
23258 + pax_task_size = SEGMEXEC_TASK_SIZE;
23259 +#endif
23260 +
23261 + pax_task_size -= PAGE_SIZE;
23262 +
23263 + if (len > pax_task_size)
23264 return -ENOMEM;
23265
23266 if (flags & MAP_FIXED) {
23267 @@ -415,8 +431,7 @@ hugetlb_get_unmapped_area(struct file *f
23268 if (addr) {
23269 addr = ALIGN(addr, huge_page_size(h));
23270 vma = find_vma(mm, addr);
23271 - if (TASK_SIZE - len >= addr &&
23272 - (!vma || addr + len <= vma->vm_start))
23273 + if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
23274 return addr;
23275 }
23276 if (mm->get_unmapped_area == arch_get_unmapped_area)
23277 diff -urNp linux-2.6.32.49/arch/x86/mm/init_32.c linux-2.6.32.49/arch/x86/mm/init_32.c
23278 --- linux-2.6.32.49/arch/x86/mm/init_32.c 2011-11-08 19:02:43.000000000 -0500
23279 +++ linux-2.6.32.49/arch/x86/mm/init_32.c 2011-11-15 19:59:43.000000000 -0500
23280 @@ -72,36 +72,6 @@ static __init void *alloc_low_page(void)
23281 }
23282
23283 /*
23284 - * Creates a middle page table and puts a pointer to it in the
23285 - * given global directory entry. This only returns the gd entry
23286 - * in non-PAE compilation mode, since the middle layer is folded.
23287 - */
23288 -static pmd_t * __init one_md_table_init(pgd_t *pgd)
23289 -{
23290 - pud_t *pud;
23291 - pmd_t *pmd_table;
23292 -
23293 -#ifdef CONFIG_X86_PAE
23294 - if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
23295 - if (after_bootmem)
23296 - pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
23297 - else
23298 - pmd_table = (pmd_t *)alloc_low_page();
23299 - paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
23300 - set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
23301 - pud = pud_offset(pgd, 0);
23302 - BUG_ON(pmd_table != pmd_offset(pud, 0));
23303 -
23304 - return pmd_table;
23305 - }
23306 -#endif
23307 - pud = pud_offset(pgd, 0);
23308 - pmd_table = pmd_offset(pud, 0);
23309 -
23310 - return pmd_table;
23311 -}
23312 -
23313 -/*
23314 * Create a page table and place a pointer to it in a middle page
23315 * directory entry:
23316 */
23317 @@ -121,13 +91,28 @@ static pte_t * __init one_page_table_ini
23318 page_table = (pte_t *)alloc_low_page();
23319
23320 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
23321 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
23322 + set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
23323 +#else
23324 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
23325 +#endif
23326 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
23327 }
23328
23329 return pte_offset_kernel(pmd, 0);
23330 }
23331
23332 +static pmd_t * __init one_md_table_init(pgd_t *pgd)
23333 +{
23334 + pud_t *pud;
23335 + pmd_t *pmd_table;
23336 +
23337 + pud = pud_offset(pgd, 0);
23338 + pmd_table = pmd_offset(pud, 0);
23339 +
23340 + return pmd_table;
23341 +}
23342 +
23343 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
23344 {
23345 int pgd_idx = pgd_index(vaddr);
23346 @@ -201,6 +186,7 @@ page_table_range_init(unsigned long star
23347 int pgd_idx, pmd_idx;
23348 unsigned long vaddr;
23349 pgd_t *pgd;
23350 + pud_t *pud;
23351 pmd_t *pmd;
23352 pte_t *pte = NULL;
23353
23354 @@ -210,8 +196,13 @@ page_table_range_init(unsigned long star
23355 pgd = pgd_base + pgd_idx;
23356
23357 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
23358 - pmd = one_md_table_init(pgd);
23359 - pmd = pmd + pmd_index(vaddr);
23360 + pud = pud_offset(pgd, vaddr);
23361 + pmd = pmd_offset(pud, vaddr);
23362 +
23363 +#ifdef CONFIG_X86_PAE
23364 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
23365 +#endif
23366 +
23367 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
23368 pmd++, pmd_idx++) {
23369 pte = page_table_kmap_check(one_page_table_init(pmd),
23370 @@ -223,11 +214,20 @@ page_table_range_init(unsigned long star
23371 }
23372 }
23373
23374 -static inline int is_kernel_text(unsigned long addr)
23375 +static inline int is_kernel_text(unsigned long start, unsigned long end)
23376 {
23377 - if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
23378 - return 1;
23379 - return 0;
23380 + if ((start > ktla_ktva((unsigned long)_etext) ||
23381 + end <= ktla_ktva((unsigned long)_stext)) &&
23382 + (start > ktla_ktva((unsigned long)_einittext) ||
23383 + end <= ktla_ktva((unsigned long)_sinittext)) &&
23384 +
23385 +#ifdef CONFIG_ACPI_SLEEP
23386 + (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
23387 +#endif
23388 +
23389 + (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
23390 + return 0;
23391 + return 1;
23392 }
23393
23394 /*
23395 @@ -243,9 +243,10 @@ kernel_physical_mapping_init(unsigned lo
23396 int use_pse = page_size_mask == (1<<PG_LEVEL_2M);
23397 unsigned long start_pfn, end_pfn;
23398 pgd_t *pgd_base = swapper_pg_dir;
23399 - int pgd_idx, pmd_idx, pte_ofs;
23400 + unsigned int pgd_idx, pmd_idx, pte_ofs;
23401 unsigned long pfn;
23402 pgd_t *pgd;
23403 + pud_t *pud;
23404 pmd_t *pmd;
23405 pte_t *pte;
23406 unsigned pages_2m, pages_4k;
23407 @@ -278,8 +279,13 @@ repeat:
23408 pfn = start_pfn;
23409 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
23410 pgd = pgd_base + pgd_idx;
23411 - for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
23412 - pmd = one_md_table_init(pgd);
23413 + for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
23414 + pud = pud_offset(pgd, 0);
23415 + pmd = pmd_offset(pud, 0);
23416 +
23417 +#ifdef CONFIG_X86_PAE
23418 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
23419 +#endif
23420
23421 if (pfn >= end_pfn)
23422 continue;
23423 @@ -291,14 +297,13 @@ repeat:
23424 #endif
23425 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
23426 pmd++, pmd_idx++) {
23427 - unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
23428 + unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
23429
23430 /*
23431 * Map with big pages if possible, otherwise
23432 * create normal page tables:
23433 */
23434 if (use_pse) {
23435 - unsigned int addr2;
23436 pgprot_t prot = PAGE_KERNEL_LARGE;
23437 /*
23438 * first pass will use the same initial
23439 @@ -308,11 +313,7 @@ repeat:
23440 __pgprot(PTE_IDENT_ATTR |
23441 _PAGE_PSE);
23442
23443 - addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
23444 - PAGE_OFFSET + PAGE_SIZE-1;
23445 -
23446 - if (is_kernel_text(addr) ||
23447 - is_kernel_text(addr2))
23448 + if (is_kernel_text(address, address + PMD_SIZE))
23449 prot = PAGE_KERNEL_LARGE_EXEC;
23450
23451 pages_2m++;
23452 @@ -329,7 +330,7 @@ repeat:
23453 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
23454 pte += pte_ofs;
23455 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
23456 - pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
23457 + pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
23458 pgprot_t prot = PAGE_KERNEL;
23459 /*
23460 * first pass will use the same initial
23461 @@ -337,7 +338,7 @@ repeat:
23462 */
23463 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
23464
23465 - if (is_kernel_text(addr))
23466 + if (is_kernel_text(address, address + PAGE_SIZE))
23467 prot = PAGE_KERNEL_EXEC;
23468
23469 pages_4k++;
23470 @@ -489,7 +490,7 @@ void __init native_pagetable_setup_start
23471
23472 pud = pud_offset(pgd, va);
23473 pmd = pmd_offset(pud, va);
23474 - if (!pmd_present(*pmd))
23475 + if (!pmd_present(*pmd) || pmd_huge(*pmd))
23476 break;
23477
23478 pte = pte_offset_kernel(pmd, va);
23479 @@ -541,9 +542,7 @@ void __init early_ioremap_page_table_ran
23480
23481 static void __init pagetable_init(void)
23482 {
23483 - pgd_t *pgd_base = swapper_pg_dir;
23484 -
23485 - permanent_kmaps_init(pgd_base);
23486 + permanent_kmaps_init(swapper_pg_dir);
23487 }
23488
23489 #ifdef CONFIG_ACPI_SLEEP
23490 @@ -551,12 +550,12 @@ static void __init pagetable_init(void)
23491 * ACPI suspend needs this for resume, because things like the intel-agp
23492 * driver might have split up a kernel 4MB mapping.
23493 */
23494 -char swsusp_pg_dir[PAGE_SIZE]
23495 +pgd_t swsusp_pg_dir[PTRS_PER_PGD]
23496 __attribute__ ((aligned(PAGE_SIZE)));
23497
23498 static inline void save_pg_dir(void)
23499 {
23500 - memcpy(swsusp_pg_dir, swapper_pg_dir, PAGE_SIZE);
23501 + clone_pgd_range(swsusp_pg_dir, swapper_pg_dir, PTRS_PER_PGD);
23502 }
23503 #else /* !CONFIG_ACPI_SLEEP */
23504 static inline void save_pg_dir(void)
23505 @@ -588,7 +587,7 @@ void zap_low_mappings(bool early)
23506 flush_tlb_all();
23507 }
23508
23509 -pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
23510 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
23511 EXPORT_SYMBOL_GPL(__supported_pte_mask);
23512
23513 /* user-defined highmem size */
23514 @@ -777,7 +776,7 @@ void __init setup_bootmem_allocator(void
23515 * Initialize the boot-time allocator (with low memory only):
23516 */
23517 bootmap_size = bootmem_bootmap_pages(max_low_pfn)<<PAGE_SHIFT;
23518 - bootmap = find_e820_area(0, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
23519 + bootmap = find_e820_area(0x100000, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
23520 PAGE_SIZE);
23521 if (bootmap == -1L)
23522 panic("Cannot find bootmem map of size %ld\n", bootmap_size);
23523 @@ -864,6 +863,12 @@ void __init mem_init(void)
23524
23525 pci_iommu_alloc();
23526
23527 +#ifdef CONFIG_PAX_PER_CPU_PGD
23528 + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
23529 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
23530 + KERNEL_PGD_PTRS);
23531 +#endif
23532 +
23533 #ifdef CONFIG_FLATMEM
23534 BUG_ON(!mem_map);
23535 #endif
23536 @@ -881,7 +886,7 @@ void __init mem_init(void)
23537 set_highmem_pages_init();
23538
23539 codesize = (unsigned long) &_etext - (unsigned long) &_text;
23540 - datasize = (unsigned long) &_edata - (unsigned long) &_etext;
23541 + datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
23542 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
23543
23544 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
23545 @@ -923,10 +928,10 @@ void __init mem_init(void)
23546 ((unsigned long)&__init_end -
23547 (unsigned long)&__init_begin) >> 10,
23548
23549 - (unsigned long)&_etext, (unsigned long)&_edata,
23550 - ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
23551 + (unsigned long)&_sdata, (unsigned long)&_edata,
23552 + ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
23553
23554 - (unsigned long)&_text, (unsigned long)&_etext,
23555 + ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
23556 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
23557
23558 /*
23559 @@ -1007,6 +1012,7 @@ void set_kernel_text_rw(void)
23560 if (!kernel_set_to_readonly)
23561 return;
23562
23563 + start = ktla_ktva(start);
23564 pr_debug("Set kernel text: %lx - %lx for read write\n",
23565 start, start+size);
23566
23567 @@ -1021,6 +1027,7 @@ void set_kernel_text_ro(void)
23568 if (!kernel_set_to_readonly)
23569 return;
23570
23571 + start = ktla_ktva(start);
23572 pr_debug("Set kernel text: %lx - %lx for read only\n",
23573 start, start+size);
23574
23575 @@ -1032,6 +1039,7 @@ void mark_rodata_ro(void)
23576 unsigned long start = PFN_ALIGN(_text);
23577 unsigned long size = PFN_ALIGN(_etext) - start;
23578
23579 + start = ktla_ktva(start);
23580 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
23581 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
23582 size >> 10);
23583 diff -urNp linux-2.6.32.49/arch/x86/mm/init_64.c linux-2.6.32.49/arch/x86/mm/init_64.c
23584 --- linux-2.6.32.49/arch/x86/mm/init_64.c 2011-11-08 19:02:43.000000000 -0500
23585 +++ linux-2.6.32.49/arch/x86/mm/init_64.c 2011-11-15 19:59:43.000000000 -0500
23586 @@ -164,7 +164,9 @@ void set_pte_vaddr_pud(pud_t *pud_page,
23587 pmd = fill_pmd(pud, vaddr);
23588 pte = fill_pte(pmd, vaddr);
23589
23590 + pax_open_kernel();
23591 set_pte(pte, new_pte);
23592 + pax_close_kernel();
23593
23594 /*
23595 * It's enough to flush this one mapping.
23596 @@ -223,14 +225,12 @@ static void __init __init_extra_mapping(
23597 pgd = pgd_offset_k((unsigned long)__va(phys));
23598 if (pgd_none(*pgd)) {
23599 pud = (pud_t *) spp_getpage();
23600 - set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
23601 - _PAGE_USER));
23602 + set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
23603 }
23604 pud = pud_offset(pgd, (unsigned long)__va(phys));
23605 if (pud_none(*pud)) {
23606 pmd = (pmd_t *) spp_getpage();
23607 - set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
23608 - _PAGE_USER));
23609 + set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
23610 }
23611 pmd = pmd_offset(pud, phys);
23612 BUG_ON(!pmd_none(*pmd));
23613 @@ -675,6 +675,12 @@ void __init mem_init(void)
23614
23615 pci_iommu_alloc();
23616
23617 +#ifdef CONFIG_PAX_PER_CPU_PGD
23618 + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
23619 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
23620 + KERNEL_PGD_PTRS);
23621 +#endif
23622 +
23623 /* clear_bss() already clear the empty_zero_page */
23624
23625 reservedpages = 0;
23626 @@ -861,8 +867,8 @@ int kern_addr_valid(unsigned long addr)
23627 static struct vm_area_struct gate_vma = {
23628 .vm_start = VSYSCALL_START,
23629 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
23630 - .vm_page_prot = PAGE_READONLY_EXEC,
23631 - .vm_flags = VM_READ | VM_EXEC
23632 + .vm_page_prot = PAGE_READONLY,
23633 + .vm_flags = VM_READ
23634 };
23635
23636 struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
23637 @@ -896,7 +902,7 @@ int in_gate_area_no_task(unsigned long a
23638
23639 const char *arch_vma_name(struct vm_area_struct *vma)
23640 {
23641 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
23642 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
23643 return "[vdso]";
23644 if (vma == &gate_vma)
23645 return "[vsyscall]";
23646 diff -urNp linux-2.6.32.49/arch/x86/mm/init.c linux-2.6.32.49/arch/x86/mm/init.c
23647 --- linux-2.6.32.49/arch/x86/mm/init.c 2011-11-08 19:02:43.000000000 -0500
23648 +++ linux-2.6.32.49/arch/x86/mm/init.c 2011-11-15 19:59:43.000000000 -0500
23649 @@ -69,11 +69,7 @@ static void __init find_early_table_spac
23650 * cause a hotspot and fill up ZONE_DMA. The page tables
23651 * need roughly 0.5KB per GB.
23652 */
23653 -#ifdef CONFIG_X86_32
23654 - start = 0x7000;
23655 -#else
23656 - start = 0x8000;
23657 -#endif
23658 + start = 0x100000;
23659 e820_table_start = find_e820_area(start, max_pfn_mapped<<PAGE_SHIFT,
23660 tables, PAGE_SIZE);
23661 if (e820_table_start == -1UL)
23662 @@ -147,7 +143,7 @@ unsigned long __init_refok init_memory_m
23663 #endif
23664
23665 set_nx();
23666 - if (nx_enabled)
23667 + if (nx_enabled && cpu_has_nx)
23668 printk(KERN_INFO "NX (Execute Disable) protection: active\n");
23669
23670 /* Enable PSE if available */
23671 @@ -329,10 +325,27 @@ unsigned long __init_refok init_memory_m
23672 * Access has to be given to non-kernel-ram areas as well, these contain the PCI
23673 * mmio resources as well as potential bios/acpi data regions.
23674 */
23675 +
23676 int devmem_is_allowed(unsigned long pagenr)
23677 {
23678 +#ifdef CONFIG_GRKERNSEC_KMEM
23679 + /* allow BDA */
23680 + if (!pagenr)
23681 + return 1;
23682 + /* allow EBDA */
23683 + if ((0x9f000 >> PAGE_SHIFT) == pagenr)
23684 + return 1;
23685 + /* allow ISA/video mem */
23686 + if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
23687 + return 1;
23688 + /* throw out everything else below 1MB */
23689 + if (pagenr <= 256)
23690 + return 0;
23691 +#else
23692 if (pagenr <= 256)
23693 return 1;
23694 +#endif
23695 +
23696 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
23697 return 0;
23698 if (!page_is_ram(pagenr))
23699 @@ -379,6 +392,86 @@ void free_init_pages(char *what, unsigne
23700
23701 void free_initmem(void)
23702 {
23703 +
23704 +#ifdef CONFIG_PAX_KERNEXEC
23705 +#ifdef CONFIG_X86_32
23706 + /* PaX: limit KERNEL_CS to actual size */
23707 + unsigned long addr, limit;
23708 + struct desc_struct d;
23709 + int cpu;
23710 +
23711 + limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
23712 + limit = (limit - 1UL) >> PAGE_SHIFT;
23713 +
23714 + memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
23715 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
23716 + pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
23717 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
23718 + }
23719 +
23720 + /* PaX: make KERNEL_CS read-only */
23721 + addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
23722 + if (!paravirt_enabled())
23723 + set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
23724 +/*
23725 + for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
23726 + pgd = pgd_offset_k(addr);
23727 + pud = pud_offset(pgd, addr);
23728 + pmd = pmd_offset(pud, addr);
23729 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
23730 + }
23731 +*/
23732 +#ifdef CONFIG_X86_PAE
23733 + set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
23734 +/*
23735 + for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
23736 + pgd = pgd_offset_k(addr);
23737 + pud = pud_offset(pgd, addr);
23738 + pmd = pmd_offset(pud, addr);
23739 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
23740 + }
23741 +*/
23742 +#endif
23743 +
23744 +#ifdef CONFIG_MODULES
23745 + set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
23746 +#endif
23747 +
23748 +#else
23749 + pgd_t *pgd;
23750 + pud_t *pud;
23751 + pmd_t *pmd;
23752 + unsigned long addr, end;
23753 +
23754 + /* PaX: make kernel code/rodata read-only, rest non-executable */
23755 + for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
23756 + pgd = pgd_offset_k(addr);
23757 + pud = pud_offset(pgd, addr);
23758 + pmd = pmd_offset(pud, addr);
23759 + if (!pmd_present(*pmd))
23760 + continue;
23761 + if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
23762 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
23763 + else
23764 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
23765 + }
23766 +
23767 + addr = (unsigned long)__va(__pa(__START_KERNEL_map));
23768 + end = addr + KERNEL_IMAGE_SIZE;
23769 + for (; addr < end; addr += PMD_SIZE) {
23770 + pgd = pgd_offset_k(addr);
23771 + pud = pud_offset(pgd, addr);
23772 + pmd = pmd_offset(pud, addr);
23773 + if (!pmd_present(*pmd))
23774 + continue;
23775 + if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
23776 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
23777 + }
23778 +#endif
23779 +
23780 + flush_tlb_all();
23781 +#endif
23782 +
23783 free_init_pages("unused kernel memory",
23784 (unsigned long)(&__init_begin),
23785 (unsigned long)(&__init_end));
23786 diff -urNp linux-2.6.32.49/arch/x86/mm/iomap_32.c linux-2.6.32.49/arch/x86/mm/iomap_32.c
23787 --- linux-2.6.32.49/arch/x86/mm/iomap_32.c 2011-11-08 19:02:43.000000000 -0500
23788 +++ linux-2.6.32.49/arch/x86/mm/iomap_32.c 2011-11-15 19:59:43.000000000 -0500
23789 @@ -65,7 +65,11 @@ void *kmap_atomic_prot_pfn(unsigned long
23790 debug_kmap_atomic(type);
23791 idx = type + KM_TYPE_NR * smp_processor_id();
23792 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
23793 +
23794 + pax_open_kernel();
23795 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
23796 + pax_close_kernel();
23797 +
23798 arch_flush_lazy_mmu_mode();
23799
23800 return (void *)vaddr;
23801 diff -urNp linux-2.6.32.49/arch/x86/mm/ioremap.c linux-2.6.32.49/arch/x86/mm/ioremap.c
23802 --- linux-2.6.32.49/arch/x86/mm/ioremap.c 2011-11-08 19:02:43.000000000 -0500
23803 +++ linux-2.6.32.49/arch/x86/mm/ioremap.c 2011-11-15 19:59:43.000000000 -0500
23804 @@ -41,8 +41,8 @@ int page_is_ram(unsigned long pagenr)
23805 * Second special case: Some BIOSen report the PC BIOS
23806 * area (640->1Mb) as ram even though it is not.
23807 */
23808 - if (pagenr >= (BIOS_BEGIN >> PAGE_SHIFT) &&
23809 - pagenr < (BIOS_END >> PAGE_SHIFT))
23810 + if (pagenr >= (ISA_START_ADDRESS >> PAGE_SHIFT) &&
23811 + pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
23812 return 0;
23813
23814 for (i = 0; i < e820.nr_map; i++) {
23815 @@ -137,13 +137,10 @@ static void __iomem *__ioremap_caller(re
23816 /*
23817 * Don't allow anybody to remap normal RAM that we're using..
23818 */
23819 - for (pfn = phys_addr >> PAGE_SHIFT;
23820 - (pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
23821 - pfn++) {
23822 -
23823 + for (pfn = phys_addr >> PAGE_SHIFT; ((resource_size_t)pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK); pfn++) {
23824 int is_ram = page_is_ram(pfn);
23825
23826 - if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
23827 + if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
23828 return NULL;
23829 WARN_ON_ONCE(is_ram);
23830 }
23831 @@ -407,7 +404,7 @@ static int __init early_ioremap_debug_se
23832 early_param("early_ioremap_debug", early_ioremap_debug_setup);
23833
23834 static __initdata int after_paging_init;
23835 -static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
23836 +static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
23837
23838 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
23839 {
23840 @@ -439,8 +436,7 @@ void __init early_ioremap_init(void)
23841 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
23842
23843 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
23844 - memset(bm_pte, 0, sizeof(bm_pte));
23845 - pmd_populate_kernel(&init_mm, pmd, bm_pte);
23846 + pmd_populate_user(&init_mm, pmd, bm_pte);
23847
23848 /*
23849 * The boot-ioremap range spans multiple pmds, for which
23850 diff -urNp linux-2.6.32.49/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.32.49/arch/x86/mm/kmemcheck/kmemcheck.c
23851 --- linux-2.6.32.49/arch/x86/mm/kmemcheck/kmemcheck.c 2011-11-08 19:02:43.000000000 -0500
23852 +++ linux-2.6.32.49/arch/x86/mm/kmemcheck/kmemcheck.c 2011-11-15 19:59:43.000000000 -0500
23853 @@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
23854 * memory (e.g. tracked pages)? For now, we need this to avoid
23855 * invoking kmemcheck for PnP BIOS calls.
23856 */
23857 - if (regs->flags & X86_VM_MASK)
23858 + if (v8086_mode(regs))
23859 return false;
23860 - if (regs->cs != __KERNEL_CS)
23861 + if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
23862 return false;
23863
23864 pte = kmemcheck_pte_lookup(address);
23865 diff -urNp linux-2.6.32.49/arch/x86/mm/mmap.c linux-2.6.32.49/arch/x86/mm/mmap.c
23866 --- linux-2.6.32.49/arch/x86/mm/mmap.c 2011-11-08 19:02:43.000000000 -0500
23867 +++ linux-2.6.32.49/arch/x86/mm/mmap.c 2011-11-15 19:59:43.000000000 -0500
23868 @@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
23869 * Leave an at least ~128 MB hole with possible stack randomization.
23870 */
23871 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
23872 -#define MAX_GAP (TASK_SIZE/6*5)
23873 +#define MAX_GAP (pax_task_size/6*5)
23874
23875 /*
23876 * True on X86_32 or when emulating IA32 on X86_64
23877 @@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
23878 return rnd << PAGE_SHIFT;
23879 }
23880
23881 -static unsigned long mmap_base(void)
23882 +static unsigned long mmap_base(struct mm_struct *mm)
23883 {
23884 unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
23885 + unsigned long pax_task_size = TASK_SIZE;
23886 +
23887 +#ifdef CONFIG_PAX_SEGMEXEC
23888 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
23889 + pax_task_size = SEGMEXEC_TASK_SIZE;
23890 +#endif
23891
23892 if (gap < MIN_GAP)
23893 gap = MIN_GAP;
23894 else if (gap > MAX_GAP)
23895 gap = MAX_GAP;
23896
23897 - return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
23898 + return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
23899 }
23900
23901 /*
23902 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
23903 * does, but not when emulating X86_32
23904 */
23905 -static unsigned long mmap_legacy_base(void)
23906 +static unsigned long mmap_legacy_base(struct mm_struct *mm)
23907 {
23908 - if (mmap_is_ia32())
23909 + if (mmap_is_ia32()) {
23910 +
23911 +#ifdef CONFIG_PAX_SEGMEXEC
23912 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
23913 + return SEGMEXEC_TASK_UNMAPPED_BASE;
23914 + else
23915 +#endif
23916 +
23917 return TASK_UNMAPPED_BASE;
23918 - else
23919 + } else
23920 return TASK_UNMAPPED_BASE + mmap_rnd();
23921 }
23922
23923 @@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
23924 void arch_pick_mmap_layout(struct mm_struct *mm)
23925 {
23926 if (mmap_is_legacy()) {
23927 - mm->mmap_base = mmap_legacy_base();
23928 + mm->mmap_base = mmap_legacy_base(mm);
23929 +
23930 +#ifdef CONFIG_PAX_RANDMMAP
23931 + if (mm->pax_flags & MF_PAX_RANDMMAP)
23932 + mm->mmap_base += mm->delta_mmap;
23933 +#endif
23934 +
23935 mm->get_unmapped_area = arch_get_unmapped_area;
23936 mm->unmap_area = arch_unmap_area;
23937 } else {
23938 - mm->mmap_base = mmap_base();
23939 + mm->mmap_base = mmap_base(mm);
23940 +
23941 +#ifdef CONFIG_PAX_RANDMMAP
23942 + if (mm->pax_flags & MF_PAX_RANDMMAP)
23943 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
23944 +#endif
23945 +
23946 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
23947 mm->unmap_area = arch_unmap_area_topdown;
23948 }
23949 diff -urNp linux-2.6.32.49/arch/x86/mm/mmio-mod.c linux-2.6.32.49/arch/x86/mm/mmio-mod.c
23950 --- linux-2.6.32.49/arch/x86/mm/mmio-mod.c 2011-11-08 19:02:43.000000000 -0500
23951 +++ linux-2.6.32.49/arch/x86/mm/mmio-mod.c 2011-11-15 19:59:43.000000000 -0500
23952 @@ -193,7 +193,7 @@ static void pre(struct kmmio_probe *p, s
23953 break;
23954 default:
23955 {
23956 - unsigned char *ip = (unsigned char *)instptr;
23957 + unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
23958 my_trace->opcode = MMIO_UNKNOWN_OP;
23959 my_trace->width = 0;
23960 my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
23961 @@ -233,7 +233,7 @@ static void post(struct kmmio_probe *p,
23962 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
23963 void __iomem *addr)
23964 {
23965 - static atomic_t next_id;
23966 + static atomic_unchecked_t next_id;
23967 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
23968 /* These are page-unaligned. */
23969 struct mmiotrace_map map = {
23970 @@ -257,7 +257,7 @@ static void ioremap_trace_core(resource_
23971 .private = trace
23972 },
23973 .phys = offset,
23974 - .id = atomic_inc_return(&next_id)
23975 + .id = atomic_inc_return_unchecked(&next_id)
23976 };
23977 map.map_id = trace->id;
23978
23979 diff -urNp linux-2.6.32.49/arch/x86/mm/numa_32.c linux-2.6.32.49/arch/x86/mm/numa_32.c
23980 --- linux-2.6.32.49/arch/x86/mm/numa_32.c 2011-11-08 19:02:43.000000000 -0500
23981 +++ linux-2.6.32.49/arch/x86/mm/numa_32.c 2011-11-15 19:59:43.000000000 -0500
23982 @@ -98,7 +98,6 @@ unsigned long node_memmap_size_bytes(int
23983 }
23984 #endif
23985
23986 -extern unsigned long find_max_low_pfn(void);
23987 extern unsigned long highend_pfn, highstart_pfn;
23988
23989 #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
23990 diff -urNp linux-2.6.32.49/arch/x86/mm/pageattr.c linux-2.6.32.49/arch/x86/mm/pageattr.c
23991 --- linux-2.6.32.49/arch/x86/mm/pageattr.c 2011-11-08 19:02:43.000000000 -0500
23992 +++ linux-2.6.32.49/arch/x86/mm/pageattr.c 2011-11-15 19:59:43.000000000 -0500
23993 @@ -261,16 +261,17 @@ static inline pgprot_t static_protection
23994 * PCI BIOS based config access (CONFIG_PCI_GOBIOS) support.
23995 */
23996 if (within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
23997 - pgprot_val(forbidden) |= _PAGE_NX;
23998 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
23999
24000 /*
24001 * The kernel text needs to be executable for obvious reasons
24002 * Does not cover __inittext since that is gone later on. On
24003 * 64bit we do not enforce !NX on the low mapping
24004 */
24005 - if (within(address, (unsigned long)_text, (unsigned long)_etext))
24006 - pgprot_val(forbidden) |= _PAGE_NX;
24007 + if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
24008 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
24009
24010 +#ifdef CONFIG_DEBUG_RODATA
24011 /*
24012 * The .rodata section needs to be read-only. Using the pfn
24013 * catches all aliases.
24014 @@ -278,6 +279,14 @@ static inline pgprot_t static_protection
24015 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
24016 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
24017 pgprot_val(forbidden) |= _PAGE_RW;
24018 +#endif
24019 +
24020 +#ifdef CONFIG_PAX_KERNEXEC
24021 + if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
24022 + pgprot_val(forbidden) |= _PAGE_RW;
24023 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
24024 + }
24025 +#endif
24026
24027 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
24028
24029 @@ -331,23 +340,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
24030 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
24031 {
24032 /* change init_mm */
24033 + pax_open_kernel();
24034 set_pte_atomic(kpte, pte);
24035 +
24036 #ifdef CONFIG_X86_32
24037 if (!SHARED_KERNEL_PMD) {
24038 +
24039 +#ifdef CONFIG_PAX_PER_CPU_PGD
24040 + unsigned long cpu;
24041 +#else
24042 struct page *page;
24043 +#endif
24044
24045 +#ifdef CONFIG_PAX_PER_CPU_PGD
24046 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
24047 + pgd_t *pgd = get_cpu_pgd(cpu);
24048 +#else
24049 list_for_each_entry(page, &pgd_list, lru) {
24050 - pgd_t *pgd;
24051 + pgd_t *pgd = (pgd_t *)page_address(page);
24052 +#endif
24053 +
24054 pud_t *pud;
24055 pmd_t *pmd;
24056
24057 - pgd = (pgd_t *)page_address(page) + pgd_index(address);
24058 + pgd += pgd_index(address);
24059 pud = pud_offset(pgd, address);
24060 pmd = pmd_offset(pud, address);
24061 set_pte_atomic((pte_t *)pmd, pte);
24062 }
24063 }
24064 #endif
24065 + pax_close_kernel();
24066 }
24067
24068 static int
24069 diff -urNp linux-2.6.32.49/arch/x86/mm/pageattr-test.c linux-2.6.32.49/arch/x86/mm/pageattr-test.c
24070 --- linux-2.6.32.49/arch/x86/mm/pageattr-test.c 2011-11-08 19:02:43.000000000 -0500
24071 +++ linux-2.6.32.49/arch/x86/mm/pageattr-test.c 2011-11-15 19:59:43.000000000 -0500
24072 @@ -36,7 +36,7 @@ enum {
24073
24074 static int pte_testbit(pte_t pte)
24075 {
24076 - return pte_flags(pte) & _PAGE_UNUSED1;
24077 + return pte_flags(pte) & _PAGE_CPA_TEST;
24078 }
24079
24080 struct split_state {
24081 diff -urNp linux-2.6.32.49/arch/x86/mm/pat.c linux-2.6.32.49/arch/x86/mm/pat.c
24082 --- linux-2.6.32.49/arch/x86/mm/pat.c 2011-11-08 19:02:43.000000000 -0500
24083 +++ linux-2.6.32.49/arch/x86/mm/pat.c 2011-11-15 19:59:43.000000000 -0500
24084 @@ -258,7 +258,7 @@ chk_conflict(struct memtype *new, struct
24085
24086 conflict:
24087 printk(KERN_INFO "%s:%d conflicting memory types "
24088 - "%Lx-%Lx %s<->%s\n", current->comm, current->pid, new->start,
24089 + "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), new->start,
24090 new->end, cattr_name(new->type), cattr_name(entry->type));
24091 return -EBUSY;
24092 }
24093 @@ -559,7 +559,7 @@ unlock_ret:
24094
24095 if (err) {
24096 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
24097 - current->comm, current->pid, start, end);
24098 + current->comm, task_pid_nr(current), start, end);
24099 }
24100
24101 dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
24102 @@ -689,8 +689,8 @@ static inline int range_is_allowed(unsig
24103 while (cursor < to) {
24104 if (!devmem_is_allowed(pfn)) {
24105 printk(KERN_INFO
24106 - "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
24107 - current->comm, from, to);
24108 + "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
24109 + current->comm, from, to, cursor);
24110 return 0;
24111 }
24112 cursor += PAGE_SIZE;
24113 @@ -755,7 +755,7 @@ int kernel_map_sync_memtype(u64 base, un
24114 printk(KERN_INFO
24115 "%s:%d ioremap_change_attr failed %s "
24116 "for %Lx-%Lx\n",
24117 - current->comm, current->pid,
24118 + current->comm, task_pid_nr(current),
24119 cattr_name(flags),
24120 base, (unsigned long long)(base + size));
24121 return -EINVAL;
24122 @@ -813,7 +813,7 @@ static int reserve_pfn_range(u64 paddr,
24123 free_memtype(paddr, paddr + size);
24124 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
24125 " for %Lx-%Lx, got %s\n",
24126 - current->comm, current->pid,
24127 + current->comm, task_pid_nr(current),
24128 cattr_name(want_flags),
24129 (unsigned long long)paddr,
24130 (unsigned long long)(paddr + size),
24131 diff -urNp linux-2.6.32.49/arch/x86/mm/pf_in.c linux-2.6.32.49/arch/x86/mm/pf_in.c
24132 --- linux-2.6.32.49/arch/x86/mm/pf_in.c 2011-11-08 19:02:43.000000000 -0500
24133 +++ linux-2.6.32.49/arch/x86/mm/pf_in.c 2011-11-15 19:59:43.000000000 -0500
24134 @@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned l
24135 int i;
24136 enum reason_type rv = OTHERS;
24137
24138 - p = (unsigned char *)ins_addr;
24139 + p = (unsigned char *)ktla_ktva(ins_addr);
24140 p += skip_prefix(p, &prf);
24141 p += get_opcode(p, &opcode);
24142
24143 @@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(un
24144 struct prefix_bits prf;
24145 int i;
24146
24147 - p = (unsigned char *)ins_addr;
24148 + p = (unsigned char *)ktla_ktva(ins_addr);
24149 p += skip_prefix(p, &prf);
24150 p += get_opcode(p, &opcode);
24151
24152 @@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned
24153 struct prefix_bits prf;
24154 int i;
24155
24156 - p = (unsigned char *)ins_addr;
24157 + p = (unsigned char *)ktla_ktva(ins_addr);
24158 p += skip_prefix(p, &prf);
24159 p += get_opcode(p, &opcode);
24160
24161 @@ -417,7 +417,7 @@ unsigned long get_ins_reg_val(unsigned l
24162 int i;
24163 unsigned long rv;
24164
24165 - p = (unsigned char *)ins_addr;
24166 + p = (unsigned char *)ktla_ktva(ins_addr);
24167 p += skip_prefix(p, &prf);
24168 p += get_opcode(p, &opcode);
24169 for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
24170 @@ -472,7 +472,7 @@ unsigned long get_ins_imm_val(unsigned l
24171 int i;
24172 unsigned long rv;
24173
24174 - p = (unsigned char *)ins_addr;
24175 + p = (unsigned char *)ktla_ktva(ins_addr);
24176 p += skip_prefix(p, &prf);
24177 p += get_opcode(p, &opcode);
24178 for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
24179 diff -urNp linux-2.6.32.49/arch/x86/mm/pgtable_32.c linux-2.6.32.49/arch/x86/mm/pgtable_32.c
24180 --- linux-2.6.32.49/arch/x86/mm/pgtable_32.c 2011-11-08 19:02:43.000000000 -0500
24181 +++ linux-2.6.32.49/arch/x86/mm/pgtable_32.c 2011-11-15 19:59:43.000000000 -0500
24182 @@ -49,10 +49,13 @@ void set_pte_vaddr(unsigned long vaddr,
24183 return;
24184 }
24185 pte = pte_offset_kernel(pmd, vaddr);
24186 +
24187 + pax_open_kernel();
24188 if (pte_val(pteval))
24189 set_pte_at(&init_mm, vaddr, pte, pteval);
24190 else
24191 pte_clear(&init_mm, vaddr, pte);
24192 + pax_close_kernel();
24193
24194 /*
24195 * It's enough to flush this one mapping.
24196 diff -urNp linux-2.6.32.49/arch/x86/mm/pgtable.c linux-2.6.32.49/arch/x86/mm/pgtable.c
24197 --- linux-2.6.32.49/arch/x86/mm/pgtable.c 2011-11-08 19:02:43.000000000 -0500
24198 +++ linux-2.6.32.49/arch/x86/mm/pgtable.c 2011-11-15 19:59:43.000000000 -0500
24199 @@ -83,9 +83,52 @@ static inline void pgd_list_del(pgd_t *p
24200 list_del(&page->lru);
24201 }
24202
24203 -#define UNSHARED_PTRS_PER_PGD \
24204 - (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
24205 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
24206 +pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
24207
24208 +void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
24209 +{
24210 + while (count--)
24211 + *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
24212 +}
24213 +#endif
24214 +
24215 +#ifdef CONFIG_PAX_PER_CPU_PGD
24216 +void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
24217 +{
24218 + while (count--)
24219 +
24220 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
24221 + *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
24222 +#else
24223 + *dst++ = *src++;
24224 +#endif
24225 +
24226 +}
24227 +#endif
24228 +
24229 +#ifdef CONFIG_X86_64
24230 +#define pxd_t pud_t
24231 +#define pyd_t pgd_t
24232 +#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
24233 +#define pxd_free(mm, pud) pud_free((mm), (pud))
24234 +#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
24235 +#define pyd_offset(mm ,address) pgd_offset((mm), (address))
24236 +#define PYD_SIZE PGDIR_SIZE
24237 +#else
24238 +#define pxd_t pmd_t
24239 +#define pyd_t pud_t
24240 +#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
24241 +#define pxd_free(mm, pud) pmd_free((mm), (pud))
24242 +#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
24243 +#define pyd_offset(mm ,address) pud_offset((mm), (address))
24244 +#define PYD_SIZE PUD_SIZE
24245 +#endif
24246 +
24247 +#ifdef CONFIG_PAX_PER_CPU_PGD
24248 +static inline void pgd_ctor(pgd_t *pgd) {}
24249 +static inline void pgd_dtor(pgd_t *pgd) {}
24250 +#else
24251 static void pgd_ctor(pgd_t *pgd)
24252 {
24253 /* If the pgd points to a shared pagetable level (either the
24254 @@ -119,6 +162,7 @@ static void pgd_dtor(pgd_t *pgd)
24255 pgd_list_del(pgd);
24256 spin_unlock_irqrestore(&pgd_lock, flags);
24257 }
24258 +#endif
24259
24260 /*
24261 * List of all pgd's needed for non-PAE so it can invalidate entries
24262 @@ -131,7 +175,7 @@ static void pgd_dtor(pgd_t *pgd)
24263 * -- wli
24264 */
24265
24266 -#ifdef CONFIG_X86_PAE
24267 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
24268 /*
24269 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
24270 * updating the top-level pagetable entries to guarantee the
24271 @@ -143,7 +187,7 @@ static void pgd_dtor(pgd_t *pgd)
24272 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
24273 * and initialize the kernel pmds here.
24274 */
24275 -#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
24276 +#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
24277
24278 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
24279 {
24280 @@ -161,36 +205,38 @@ void pud_populate(struct mm_struct *mm,
24281 */
24282 flush_tlb_mm(mm);
24283 }
24284 +#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
24285 +#define PREALLOCATED_PXDS USER_PGD_PTRS
24286 #else /* !CONFIG_X86_PAE */
24287
24288 /* No need to prepopulate any pagetable entries in non-PAE modes. */
24289 -#define PREALLOCATED_PMDS 0
24290 +#define PREALLOCATED_PXDS 0
24291
24292 #endif /* CONFIG_X86_PAE */
24293
24294 -static void free_pmds(pmd_t *pmds[])
24295 +static void free_pxds(pxd_t *pxds[])
24296 {
24297 int i;
24298
24299 - for(i = 0; i < PREALLOCATED_PMDS; i++)
24300 - if (pmds[i])
24301 - free_page((unsigned long)pmds[i]);
24302 + for(i = 0; i < PREALLOCATED_PXDS; i++)
24303 + if (pxds[i])
24304 + free_page((unsigned long)pxds[i]);
24305 }
24306
24307 -static int preallocate_pmds(pmd_t *pmds[])
24308 +static int preallocate_pxds(pxd_t *pxds[])
24309 {
24310 int i;
24311 bool failed = false;
24312
24313 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
24314 - pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
24315 - if (pmd == NULL)
24316 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
24317 + pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
24318 + if (pxd == NULL)
24319 failed = true;
24320 - pmds[i] = pmd;
24321 + pxds[i] = pxd;
24322 }
24323
24324 if (failed) {
24325 - free_pmds(pmds);
24326 + free_pxds(pxds);
24327 return -ENOMEM;
24328 }
24329
24330 @@ -203,51 +249,56 @@ static int preallocate_pmds(pmd_t *pmds[
24331 * preallocate which never got a corresponding vma will need to be
24332 * freed manually.
24333 */
24334 -static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
24335 +static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
24336 {
24337 int i;
24338
24339 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
24340 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
24341 pgd_t pgd = pgdp[i];
24342
24343 if (pgd_val(pgd) != 0) {
24344 - pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
24345 + pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
24346
24347 - pgdp[i] = native_make_pgd(0);
24348 + set_pgd(pgdp + i, native_make_pgd(0));
24349
24350 - paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
24351 - pmd_free(mm, pmd);
24352 + paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
24353 + pxd_free(mm, pxd);
24354 }
24355 }
24356 }
24357
24358 -static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
24359 +static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
24360 {
24361 - pud_t *pud;
24362 + pyd_t *pyd;
24363 unsigned long addr;
24364 int i;
24365
24366 - if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
24367 + if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
24368 return;
24369
24370 - pud = pud_offset(pgd, 0);
24371 +#ifdef CONFIG_X86_64
24372 + pyd = pyd_offset(mm, 0L);
24373 +#else
24374 + pyd = pyd_offset(pgd, 0L);
24375 +#endif
24376
24377 - for (addr = i = 0; i < PREALLOCATED_PMDS;
24378 - i++, pud++, addr += PUD_SIZE) {
24379 - pmd_t *pmd = pmds[i];
24380 + for (addr = i = 0; i < PREALLOCATED_PXDS;
24381 + i++, pyd++, addr += PYD_SIZE) {
24382 + pxd_t *pxd = pxds[i];
24383
24384 if (i >= KERNEL_PGD_BOUNDARY)
24385 - memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
24386 - sizeof(pmd_t) * PTRS_PER_PMD);
24387 + memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
24388 + sizeof(pxd_t) * PTRS_PER_PMD);
24389
24390 - pud_populate(mm, pud, pmd);
24391 + pyd_populate(mm, pyd, pxd);
24392 }
24393 }
24394
24395 pgd_t *pgd_alloc(struct mm_struct *mm)
24396 {
24397 pgd_t *pgd;
24398 - pmd_t *pmds[PREALLOCATED_PMDS];
24399 + pxd_t *pxds[PREALLOCATED_PXDS];
24400 +
24401 unsigned long flags;
24402
24403 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
24404 @@ -257,11 +308,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
24405
24406 mm->pgd = pgd;
24407
24408 - if (preallocate_pmds(pmds) != 0)
24409 + if (preallocate_pxds(pxds) != 0)
24410 goto out_free_pgd;
24411
24412 if (paravirt_pgd_alloc(mm) != 0)
24413 - goto out_free_pmds;
24414 + goto out_free_pxds;
24415
24416 /*
24417 * Make sure that pre-populating the pmds is atomic with
24418 @@ -271,14 +322,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
24419 spin_lock_irqsave(&pgd_lock, flags);
24420
24421 pgd_ctor(pgd);
24422 - pgd_prepopulate_pmd(mm, pgd, pmds);
24423 + pgd_prepopulate_pxd(mm, pgd, pxds);
24424
24425 spin_unlock_irqrestore(&pgd_lock, flags);
24426
24427 return pgd;
24428
24429 -out_free_pmds:
24430 - free_pmds(pmds);
24431 +out_free_pxds:
24432 + free_pxds(pxds);
24433 out_free_pgd:
24434 free_page((unsigned long)pgd);
24435 out:
24436 @@ -287,7 +338,7 @@ out:
24437
24438 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
24439 {
24440 - pgd_mop_up_pmds(mm, pgd);
24441 + pgd_mop_up_pxds(mm, pgd);
24442 pgd_dtor(pgd);
24443 paravirt_pgd_free(mm, pgd);
24444 free_page((unsigned long)pgd);
24445 diff -urNp linux-2.6.32.49/arch/x86/mm/setup_nx.c linux-2.6.32.49/arch/x86/mm/setup_nx.c
24446 --- linux-2.6.32.49/arch/x86/mm/setup_nx.c 2011-11-08 19:02:43.000000000 -0500
24447 +++ linux-2.6.32.49/arch/x86/mm/setup_nx.c 2011-11-15 19:59:43.000000000 -0500
24448 @@ -4,11 +4,10 @@
24449
24450 #include <asm/pgtable.h>
24451
24452 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
24453 int nx_enabled;
24454
24455 -#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
24456 -static int disable_nx __cpuinitdata;
24457 -
24458 +#ifndef CONFIG_PAX_PAGEEXEC
24459 /*
24460 * noexec = on|off
24461 *
24462 @@ -22,32 +21,26 @@ static int __init noexec_setup(char *str
24463 if (!str)
24464 return -EINVAL;
24465 if (!strncmp(str, "on", 2)) {
24466 - __supported_pte_mask |= _PAGE_NX;
24467 - disable_nx = 0;
24468 + nx_enabled = 1;
24469 } else if (!strncmp(str, "off", 3)) {
24470 - disable_nx = 1;
24471 - __supported_pte_mask &= ~_PAGE_NX;
24472 + nx_enabled = 0;
24473 }
24474 return 0;
24475 }
24476 early_param("noexec", noexec_setup);
24477 #endif
24478 +#endif
24479
24480 #ifdef CONFIG_X86_PAE
24481 void __init set_nx(void)
24482 {
24483 - unsigned int v[4], l, h;
24484 + if (!nx_enabled && cpu_has_nx) {
24485 + unsigned l, h;
24486
24487 - if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {
24488 - cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);
24489 -
24490 - if ((v[3] & (1 << 20)) && !disable_nx) {
24491 - rdmsr(MSR_EFER, l, h);
24492 - l |= EFER_NX;
24493 - wrmsr(MSR_EFER, l, h);
24494 - nx_enabled = 1;
24495 - __supported_pte_mask |= _PAGE_NX;
24496 - }
24497 + __supported_pte_mask &= ~_PAGE_NX;
24498 + rdmsr(MSR_EFER, l, h);
24499 + l &= ~EFER_NX;
24500 + wrmsr(MSR_EFER, l, h);
24501 }
24502 }
24503 #else
24504 @@ -62,7 +55,7 @@ void __cpuinit check_efer(void)
24505 unsigned long efer;
24506
24507 rdmsrl(MSR_EFER, efer);
24508 - if (!(efer & EFER_NX) || disable_nx)
24509 + if (!(efer & EFER_NX) || !nx_enabled)
24510 __supported_pte_mask &= ~_PAGE_NX;
24511 }
24512 #endif
24513 diff -urNp linux-2.6.32.49/arch/x86/mm/tlb.c linux-2.6.32.49/arch/x86/mm/tlb.c
24514 --- linux-2.6.32.49/arch/x86/mm/tlb.c 2011-11-08 19:02:43.000000000 -0500
24515 +++ linux-2.6.32.49/arch/x86/mm/tlb.c 2011-11-15 19:59:43.000000000 -0500
24516 @@ -61,7 +61,11 @@ void leave_mm(int cpu)
24517 BUG();
24518 cpumask_clear_cpu(cpu,
24519 mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
24520 +
24521 +#ifndef CONFIG_PAX_PER_CPU_PGD
24522 load_cr3(swapper_pg_dir);
24523 +#endif
24524 +
24525 }
24526 EXPORT_SYMBOL_GPL(leave_mm);
24527
24528 diff -urNp linux-2.6.32.49/arch/x86/oprofile/backtrace.c linux-2.6.32.49/arch/x86/oprofile/backtrace.c
24529 --- linux-2.6.32.49/arch/x86/oprofile/backtrace.c 2011-11-08 19:02:43.000000000 -0500
24530 +++ linux-2.6.32.49/arch/x86/oprofile/backtrace.c 2011-11-15 19:59:43.000000000 -0500
24531 @@ -57,7 +57,7 @@ static struct frame_head *dump_user_back
24532 struct frame_head bufhead[2];
24533
24534 /* Also check accessibility of one struct frame_head beyond */
24535 - if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
24536 + if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
24537 return NULL;
24538 if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
24539 return NULL;
24540 @@ -77,7 +77,7 @@ x86_backtrace(struct pt_regs * const reg
24541 {
24542 struct frame_head *head = (struct frame_head *)frame_pointer(regs);
24543
24544 - if (!user_mode_vm(regs)) {
24545 + if (!user_mode(regs)) {
24546 unsigned long stack = kernel_stack_pointer(regs);
24547 if (depth)
24548 dump_trace(NULL, regs, (unsigned long *)stack, 0,
24549 diff -urNp linux-2.6.32.49/arch/x86/oprofile/op_model_p4.c linux-2.6.32.49/arch/x86/oprofile/op_model_p4.c
24550 --- linux-2.6.32.49/arch/x86/oprofile/op_model_p4.c 2011-11-08 19:02:43.000000000 -0500
24551 +++ linux-2.6.32.49/arch/x86/oprofile/op_model_p4.c 2011-11-15 19:59:43.000000000 -0500
24552 @@ -50,7 +50,7 @@ static inline void setup_num_counters(vo
24553 #endif
24554 }
24555
24556 -static int inline addr_increment(void)
24557 +static inline int addr_increment(void)
24558 {
24559 #ifdef CONFIG_SMP
24560 return smp_num_siblings == 2 ? 2 : 1;
24561 diff -urNp linux-2.6.32.49/arch/x86/pci/common.c linux-2.6.32.49/arch/x86/pci/common.c
24562 --- linux-2.6.32.49/arch/x86/pci/common.c 2011-11-08 19:02:43.000000000 -0500
24563 +++ linux-2.6.32.49/arch/x86/pci/common.c 2011-11-15 19:59:43.000000000 -0500
24564 @@ -31,8 +31,8 @@ int noioapicreroute = 1;
24565 int pcibios_last_bus = -1;
24566 unsigned long pirq_table_addr;
24567 struct pci_bus *pci_root_bus;
24568 -struct pci_raw_ops *raw_pci_ops;
24569 -struct pci_raw_ops *raw_pci_ext_ops;
24570 +const struct pci_raw_ops *raw_pci_ops;
24571 +const struct pci_raw_ops *raw_pci_ext_ops;
24572
24573 int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
24574 int reg, int len, u32 *val)
24575 diff -urNp linux-2.6.32.49/arch/x86/pci/direct.c linux-2.6.32.49/arch/x86/pci/direct.c
24576 --- linux-2.6.32.49/arch/x86/pci/direct.c 2011-11-08 19:02:43.000000000 -0500
24577 +++ linux-2.6.32.49/arch/x86/pci/direct.c 2011-11-15 19:59:43.000000000 -0500
24578 @@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int
24579
24580 #undef PCI_CONF1_ADDRESS
24581
24582 -struct pci_raw_ops pci_direct_conf1 = {
24583 +const struct pci_raw_ops pci_direct_conf1 = {
24584 .read = pci_conf1_read,
24585 .write = pci_conf1_write,
24586 };
24587 @@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int
24588
24589 #undef PCI_CONF2_ADDRESS
24590
24591 -struct pci_raw_ops pci_direct_conf2 = {
24592 +const struct pci_raw_ops pci_direct_conf2 = {
24593 .read = pci_conf2_read,
24594 .write = pci_conf2_write,
24595 };
24596 @@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
24597 * This should be close to trivial, but it isn't, because there are buggy
24598 * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
24599 */
24600 -static int __init pci_sanity_check(struct pci_raw_ops *o)
24601 +static int __init pci_sanity_check(const struct pci_raw_ops *o)
24602 {
24603 u32 x = 0;
24604 int year, devfn;
24605 diff -urNp linux-2.6.32.49/arch/x86/pci/mmconfig_32.c linux-2.6.32.49/arch/x86/pci/mmconfig_32.c
24606 --- linux-2.6.32.49/arch/x86/pci/mmconfig_32.c 2011-11-08 19:02:43.000000000 -0500
24607 +++ linux-2.6.32.49/arch/x86/pci/mmconfig_32.c 2011-11-15 19:59:43.000000000 -0500
24608 @@ -125,7 +125,7 @@ static int pci_mmcfg_write(unsigned int
24609 return 0;
24610 }
24611
24612 -static struct pci_raw_ops pci_mmcfg = {
24613 +static const struct pci_raw_ops pci_mmcfg = {
24614 .read = pci_mmcfg_read,
24615 .write = pci_mmcfg_write,
24616 };
24617 diff -urNp linux-2.6.32.49/arch/x86/pci/mmconfig_64.c linux-2.6.32.49/arch/x86/pci/mmconfig_64.c
24618 --- linux-2.6.32.49/arch/x86/pci/mmconfig_64.c 2011-11-08 19:02:43.000000000 -0500
24619 +++ linux-2.6.32.49/arch/x86/pci/mmconfig_64.c 2011-11-15 19:59:43.000000000 -0500
24620 @@ -104,7 +104,7 @@ static int pci_mmcfg_write(unsigned int
24621 return 0;
24622 }
24623
24624 -static struct pci_raw_ops pci_mmcfg = {
24625 +static const struct pci_raw_ops pci_mmcfg = {
24626 .read = pci_mmcfg_read,
24627 .write = pci_mmcfg_write,
24628 };
24629 diff -urNp linux-2.6.32.49/arch/x86/pci/numaq_32.c linux-2.6.32.49/arch/x86/pci/numaq_32.c
24630 --- linux-2.6.32.49/arch/x86/pci/numaq_32.c 2011-11-08 19:02:43.000000000 -0500
24631 +++ linux-2.6.32.49/arch/x86/pci/numaq_32.c 2011-11-15 19:59:43.000000000 -0500
24632 @@ -112,7 +112,7 @@ static int pci_conf1_mq_write(unsigned i
24633
24634 #undef PCI_CONF1_MQ_ADDRESS
24635
24636 -static struct pci_raw_ops pci_direct_conf1_mq = {
24637 +static const struct pci_raw_ops pci_direct_conf1_mq = {
24638 .read = pci_conf1_mq_read,
24639 .write = pci_conf1_mq_write
24640 };
24641 diff -urNp linux-2.6.32.49/arch/x86/pci/olpc.c linux-2.6.32.49/arch/x86/pci/olpc.c
24642 --- linux-2.6.32.49/arch/x86/pci/olpc.c 2011-11-08 19:02:43.000000000 -0500
24643 +++ linux-2.6.32.49/arch/x86/pci/olpc.c 2011-11-15 19:59:43.000000000 -0500
24644 @@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
24645 return 0;
24646 }
24647
24648 -static struct pci_raw_ops pci_olpc_conf = {
24649 +static const struct pci_raw_ops pci_olpc_conf = {
24650 .read = pci_olpc_read,
24651 .write = pci_olpc_write,
24652 };
24653 diff -urNp linux-2.6.32.49/arch/x86/pci/pcbios.c linux-2.6.32.49/arch/x86/pci/pcbios.c
24654 --- linux-2.6.32.49/arch/x86/pci/pcbios.c 2011-11-08 19:02:43.000000000 -0500
24655 +++ linux-2.6.32.49/arch/x86/pci/pcbios.c 2011-11-15 19:59:43.000000000 -0500
24656 @@ -56,50 +56,93 @@ union bios32 {
24657 static struct {
24658 unsigned long address;
24659 unsigned short segment;
24660 -} bios32_indirect = { 0, __KERNEL_CS };
24661 +} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
24662
24663 /*
24664 * Returns the entry point for the given service, NULL on error
24665 */
24666
24667 -static unsigned long bios32_service(unsigned long service)
24668 +static unsigned long __devinit bios32_service(unsigned long service)
24669 {
24670 unsigned char return_code; /* %al */
24671 unsigned long address; /* %ebx */
24672 unsigned long length; /* %ecx */
24673 unsigned long entry; /* %edx */
24674 unsigned long flags;
24675 + struct desc_struct d, *gdt;
24676
24677 local_irq_save(flags);
24678 - __asm__("lcall *(%%edi); cld"
24679 +
24680 + gdt = get_cpu_gdt_table(smp_processor_id());
24681 +
24682 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
24683 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
24684 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
24685 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
24686 +
24687 + __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
24688 : "=a" (return_code),
24689 "=b" (address),
24690 "=c" (length),
24691 "=d" (entry)
24692 : "0" (service),
24693 "1" (0),
24694 - "D" (&bios32_indirect));
24695 + "D" (&bios32_indirect),
24696 + "r"(__PCIBIOS_DS)
24697 + : "memory");
24698 +
24699 + pax_open_kernel();
24700 + gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
24701 + gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
24702 + gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
24703 + gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
24704 + pax_close_kernel();
24705 +
24706 local_irq_restore(flags);
24707
24708 switch (return_code) {
24709 - case 0:
24710 - return address + entry;
24711 - case 0x80: /* Not present */
24712 - printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
24713 - return 0;
24714 - default: /* Shouldn't happen */
24715 - printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
24716 - service, return_code);
24717 + case 0: {
24718 + int cpu;
24719 + unsigned char flags;
24720 +
24721 + printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
24722 + if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
24723 + printk(KERN_WARNING "bios32_service: not valid\n");
24724 return 0;
24725 + }
24726 + address = address + PAGE_OFFSET;
24727 + length += 16UL; /* some BIOSs underreport this... */
24728 + flags = 4;
24729 + if (length >= 64*1024*1024) {
24730 + length >>= PAGE_SHIFT;
24731 + flags |= 8;
24732 + }
24733 +
24734 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
24735 + gdt = get_cpu_gdt_table(cpu);
24736 + pack_descriptor(&d, address, length, 0x9b, flags);
24737 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
24738 + pack_descriptor(&d, address, length, 0x93, flags);
24739 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
24740 + }
24741 + return entry;
24742 + }
24743 + case 0x80: /* Not present */
24744 + printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
24745 + return 0;
24746 + default: /* Shouldn't happen */
24747 + printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
24748 + service, return_code);
24749 + return 0;
24750 }
24751 }
24752
24753 static struct {
24754 unsigned long address;
24755 unsigned short segment;
24756 -} pci_indirect = { 0, __KERNEL_CS };
24757 +} pci_indirect __read_only = { 0, __PCIBIOS_CS };
24758
24759 -static int pci_bios_present;
24760 +static int pci_bios_present __read_only;
24761
24762 static int __devinit check_pcibios(void)
24763 {
24764 @@ -108,11 +151,13 @@ static int __devinit check_pcibios(void)
24765 unsigned long flags, pcibios_entry;
24766
24767 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
24768 - pci_indirect.address = pcibios_entry + PAGE_OFFSET;
24769 + pci_indirect.address = pcibios_entry;
24770
24771 local_irq_save(flags);
24772 - __asm__(
24773 - "lcall *(%%edi); cld\n\t"
24774 + __asm__("movw %w6, %%ds\n\t"
24775 + "lcall *%%ss:(%%edi); cld\n\t"
24776 + "push %%ss\n\t"
24777 + "pop %%ds\n\t"
24778 "jc 1f\n\t"
24779 "xor %%ah, %%ah\n"
24780 "1:"
24781 @@ -121,7 +166,8 @@ static int __devinit check_pcibios(void)
24782 "=b" (ebx),
24783 "=c" (ecx)
24784 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
24785 - "D" (&pci_indirect)
24786 + "D" (&pci_indirect),
24787 + "r" (__PCIBIOS_DS)
24788 : "memory");
24789 local_irq_restore(flags);
24790
24791 @@ -165,7 +211,10 @@ static int pci_bios_read(unsigned int se
24792
24793 switch (len) {
24794 case 1:
24795 - __asm__("lcall *(%%esi); cld\n\t"
24796 + __asm__("movw %w6, %%ds\n\t"
24797 + "lcall *%%ss:(%%esi); cld\n\t"
24798 + "push %%ss\n\t"
24799 + "pop %%ds\n\t"
24800 "jc 1f\n\t"
24801 "xor %%ah, %%ah\n"
24802 "1:"
24803 @@ -174,7 +223,8 @@ static int pci_bios_read(unsigned int se
24804 : "1" (PCIBIOS_READ_CONFIG_BYTE),
24805 "b" (bx),
24806 "D" ((long)reg),
24807 - "S" (&pci_indirect));
24808 + "S" (&pci_indirect),
24809 + "r" (__PCIBIOS_DS));
24810 /*
24811 * Zero-extend the result beyond 8 bits, do not trust the
24812 * BIOS having done it:
24813 @@ -182,7 +232,10 @@ static int pci_bios_read(unsigned int se
24814 *value &= 0xff;
24815 break;
24816 case 2:
24817 - __asm__("lcall *(%%esi); cld\n\t"
24818 + __asm__("movw %w6, %%ds\n\t"
24819 + "lcall *%%ss:(%%esi); cld\n\t"
24820 + "push %%ss\n\t"
24821 + "pop %%ds\n\t"
24822 "jc 1f\n\t"
24823 "xor %%ah, %%ah\n"
24824 "1:"
24825 @@ -191,7 +244,8 @@ static int pci_bios_read(unsigned int se
24826 : "1" (PCIBIOS_READ_CONFIG_WORD),
24827 "b" (bx),
24828 "D" ((long)reg),
24829 - "S" (&pci_indirect));
24830 + "S" (&pci_indirect),
24831 + "r" (__PCIBIOS_DS));
24832 /*
24833 * Zero-extend the result beyond 16 bits, do not trust the
24834 * BIOS having done it:
24835 @@ -199,7 +253,10 @@ static int pci_bios_read(unsigned int se
24836 *value &= 0xffff;
24837 break;
24838 case 4:
24839 - __asm__("lcall *(%%esi); cld\n\t"
24840 + __asm__("movw %w6, %%ds\n\t"
24841 + "lcall *%%ss:(%%esi); cld\n\t"
24842 + "push %%ss\n\t"
24843 + "pop %%ds\n\t"
24844 "jc 1f\n\t"
24845 "xor %%ah, %%ah\n"
24846 "1:"
24847 @@ -208,7 +265,8 @@ static int pci_bios_read(unsigned int se
24848 : "1" (PCIBIOS_READ_CONFIG_DWORD),
24849 "b" (bx),
24850 "D" ((long)reg),
24851 - "S" (&pci_indirect));
24852 + "S" (&pci_indirect),
24853 + "r" (__PCIBIOS_DS));
24854 break;
24855 }
24856
24857 @@ -231,7 +289,10 @@ static int pci_bios_write(unsigned int s
24858
24859 switch (len) {
24860 case 1:
24861 - __asm__("lcall *(%%esi); cld\n\t"
24862 + __asm__("movw %w6, %%ds\n\t"
24863 + "lcall *%%ss:(%%esi); cld\n\t"
24864 + "push %%ss\n\t"
24865 + "pop %%ds\n\t"
24866 "jc 1f\n\t"
24867 "xor %%ah, %%ah\n"
24868 "1:"
24869 @@ -240,10 +301,14 @@ static int pci_bios_write(unsigned int s
24870 "c" (value),
24871 "b" (bx),
24872 "D" ((long)reg),
24873 - "S" (&pci_indirect));
24874 + "S" (&pci_indirect),
24875 + "r" (__PCIBIOS_DS));
24876 break;
24877 case 2:
24878 - __asm__("lcall *(%%esi); cld\n\t"
24879 + __asm__("movw %w6, %%ds\n\t"
24880 + "lcall *%%ss:(%%esi); cld\n\t"
24881 + "push %%ss\n\t"
24882 + "pop %%ds\n\t"
24883 "jc 1f\n\t"
24884 "xor %%ah, %%ah\n"
24885 "1:"
24886 @@ -252,10 +317,14 @@ static int pci_bios_write(unsigned int s
24887 "c" (value),
24888 "b" (bx),
24889 "D" ((long)reg),
24890 - "S" (&pci_indirect));
24891 + "S" (&pci_indirect),
24892 + "r" (__PCIBIOS_DS));
24893 break;
24894 case 4:
24895 - __asm__("lcall *(%%esi); cld\n\t"
24896 + __asm__("movw %w6, %%ds\n\t"
24897 + "lcall *%%ss:(%%esi); cld\n\t"
24898 + "push %%ss\n\t"
24899 + "pop %%ds\n\t"
24900 "jc 1f\n\t"
24901 "xor %%ah, %%ah\n"
24902 "1:"
24903 @@ -264,7 +333,8 @@ static int pci_bios_write(unsigned int s
24904 "c" (value),
24905 "b" (bx),
24906 "D" ((long)reg),
24907 - "S" (&pci_indirect));
24908 + "S" (&pci_indirect),
24909 + "r" (__PCIBIOS_DS));
24910 break;
24911 }
24912
24913 @@ -278,7 +348,7 @@ static int pci_bios_write(unsigned int s
24914 * Function table for BIOS32 access
24915 */
24916
24917 -static struct pci_raw_ops pci_bios_access = {
24918 +static const struct pci_raw_ops pci_bios_access = {
24919 .read = pci_bios_read,
24920 .write = pci_bios_write
24921 };
24922 @@ -287,7 +357,7 @@ static struct pci_raw_ops pci_bios_acces
24923 * Try to find PCI BIOS.
24924 */
24925
24926 -static struct pci_raw_ops * __devinit pci_find_bios(void)
24927 +static const struct pci_raw_ops * __devinit pci_find_bios(void)
24928 {
24929 union bios32 *check;
24930 unsigned char sum;
24931 @@ -368,10 +438,13 @@ struct irq_routing_table * pcibios_get_i
24932
24933 DBG("PCI: Fetching IRQ routing table... ");
24934 __asm__("push %%es\n\t"
24935 + "movw %w8, %%ds\n\t"
24936 "push %%ds\n\t"
24937 "pop %%es\n\t"
24938 - "lcall *(%%esi); cld\n\t"
24939 + "lcall *%%ss:(%%esi); cld\n\t"
24940 "pop %%es\n\t"
24941 + "push %%ss\n\t"
24942 + "pop %%ds\n"
24943 "jc 1f\n\t"
24944 "xor %%ah, %%ah\n"
24945 "1:"
24946 @@ -382,7 +455,8 @@ struct irq_routing_table * pcibios_get_i
24947 "1" (0),
24948 "D" ((long) &opt),
24949 "S" (&pci_indirect),
24950 - "m" (opt)
24951 + "m" (opt),
24952 + "r" (__PCIBIOS_DS)
24953 : "memory");
24954 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
24955 if (ret & 0xff00)
24956 @@ -406,7 +480,10 @@ int pcibios_set_irq_routing(struct pci_d
24957 {
24958 int ret;
24959
24960 - __asm__("lcall *(%%esi); cld\n\t"
24961 + __asm__("movw %w5, %%ds\n\t"
24962 + "lcall *%%ss:(%%esi); cld\n\t"
24963 + "push %%ss\n\t"
24964 + "pop %%ds\n"
24965 "jc 1f\n\t"
24966 "xor %%ah, %%ah\n"
24967 "1:"
24968 @@ -414,7 +491,8 @@ int pcibios_set_irq_routing(struct pci_d
24969 : "0" (PCIBIOS_SET_PCI_HW_INT),
24970 "b" ((dev->bus->number << 8) | dev->devfn),
24971 "c" ((irq << 8) | (pin + 10)),
24972 - "S" (&pci_indirect));
24973 + "S" (&pci_indirect),
24974 + "r" (__PCIBIOS_DS));
24975 return !(ret & 0xff00);
24976 }
24977 EXPORT_SYMBOL(pcibios_set_irq_routing);
24978 diff -urNp linux-2.6.32.49/arch/x86/power/cpu.c linux-2.6.32.49/arch/x86/power/cpu.c
24979 --- linux-2.6.32.49/arch/x86/power/cpu.c 2011-11-08 19:02:43.000000000 -0500
24980 +++ linux-2.6.32.49/arch/x86/power/cpu.c 2011-11-15 19:59:43.000000000 -0500
24981 @@ -129,7 +129,7 @@ static void do_fpu_end(void)
24982 static void fix_processor_context(void)
24983 {
24984 int cpu = smp_processor_id();
24985 - struct tss_struct *t = &per_cpu(init_tss, cpu);
24986 + struct tss_struct *t = init_tss + cpu;
24987
24988 set_tss_desc(cpu, t); /*
24989 * This just modifies memory; should not be
24990 @@ -139,7 +139,9 @@ static void fix_processor_context(void)
24991 */
24992
24993 #ifdef CONFIG_X86_64
24994 + pax_open_kernel();
24995 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
24996 + pax_close_kernel();
24997
24998 syscall_init(); /* This sets MSR_*STAR and related */
24999 #endif
25000 diff -urNp linux-2.6.32.49/arch/x86/vdso/Makefile linux-2.6.32.49/arch/x86/vdso/Makefile
25001 --- linux-2.6.32.49/arch/x86/vdso/Makefile 2011-11-08 19:02:43.000000000 -0500
25002 +++ linux-2.6.32.49/arch/x86/vdso/Makefile 2011-11-15 19:59:43.000000000 -0500
25003 @@ -122,7 +122,7 @@ quiet_cmd_vdso = VDSO $@
25004 $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
25005 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
25006
25007 -VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
25008 +VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
25009 GCOV_PROFILE := n
25010
25011 #
25012 diff -urNp linux-2.6.32.49/arch/x86/vdso/vclock_gettime.c linux-2.6.32.49/arch/x86/vdso/vclock_gettime.c
25013 --- linux-2.6.32.49/arch/x86/vdso/vclock_gettime.c 2011-11-08 19:02:43.000000000 -0500
25014 +++ linux-2.6.32.49/arch/x86/vdso/vclock_gettime.c 2011-11-15 19:59:43.000000000 -0500
25015 @@ -22,24 +22,48 @@
25016 #include <asm/hpet.h>
25017 #include <asm/unistd.h>
25018 #include <asm/io.h>
25019 +#include <asm/fixmap.h>
25020 #include "vextern.h"
25021
25022 #define gtod vdso_vsyscall_gtod_data
25023
25024 +notrace noinline long __vdso_fallback_time(long *t)
25025 +{
25026 + long secs;
25027 + asm volatile("syscall"
25028 + : "=a" (secs)
25029 + : "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
25030 + return secs;
25031 +}
25032 +
25033 notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
25034 {
25035 long ret;
25036 asm("syscall" : "=a" (ret) :
25037 - "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
25038 + "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
25039 return ret;
25040 }
25041
25042 +notrace static inline cycle_t __vdso_vread_hpet(void)
25043 +{
25044 + return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
25045 +}
25046 +
25047 +notrace static inline cycle_t __vdso_vread_tsc(void)
25048 +{
25049 + cycle_t ret = (cycle_t)vget_cycles();
25050 +
25051 + return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
25052 +}
25053 +
25054 notrace static inline long vgetns(void)
25055 {
25056 long v;
25057 - cycles_t (*vread)(void);
25058 - vread = gtod->clock.vread;
25059 - v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
25060 + if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
25061 + v = __vdso_vread_tsc();
25062 + else
25063 + v = __vdso_vread_hpet();
25064 + v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
25065 return (v * gtod->clock.mult) >> gtod->clock.shift;
25066 }
25067
25068 @@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
25069
25070 notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
25071 {
25072 - if (likely(gtod->sysctl_enabled))
25073 + if (likely(gtod->sysctl_enabled &&
25074 + ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
25075 + (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
25076 switch (clock) {
25077 case CLOCK_REALTIME:
25078 if (likely(gtod->clock.vread))
25079 @@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
25080 int clock_gettime(clockid_t, struct timespec *)
25081 __attribute__((weak, alias("__vdso_clock_gettime")));
25082
25083 -notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
25084 +notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
25085 {
25086 long ret;
25087 - if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
25088 + asm("syscall" : "=a" (ret) :
25089 + "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
25090 + return ret;
25091 +}
25092 +
25093 +notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
25094 +{
25095 + if (likely(gtod->sysctl_enabled &&
25096 + ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
25097 + (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
25098 + {
25099 if (likely(tv != NULL)) {
25100 BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
25101 offsetof(struct timespec, tv_nsec) ||
25102 @@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
25103 }
25104 return 0;
25105 }
25106 - asm("syscall" : "=a" (ret) :
25107 - "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
25108 - return ret;
25109 + return __vdso_fallback_gettimeofday(tv, tz);
25110 }
25111 int gettimeofday(struct timeval *, struct timezone *)
25112 __attribute__((weak, alias("__vdso_gettimeofday")));
25113 diff -urNp linux-2.6.32.49/arch/x86/vdso/vdso32-setup.c linux-2.6.32.49/arch/x86/vdso/vdso32-setup.c
25114 --- linux-2.6.32.49/arch/x86/vdso/vdso32-setup.c 2011-11-08 19:02:43.000000000 -0500
25115 +++ linux-2.6.32.49/arch/x86/vdso/vdso32-setup.c 2011-11-15 19:59:43.000000000 -0500
25116 @@ -25,6 +25,7 @@
25117 #include <asm/tlbflush.h>
25118 #include <asm/vdso.h>
25119 #include <asm/proto.h>
25120 +#include <asm/mman.h>
25121
25122 enum {
25123 VDSO_DISABLED = 0,
25124 @@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
25125 void enable_sep_cpu(void)
25126 {
25127 int cpu = get_cpu();
25128 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
25129 + struct tss_struct *tss = init_tss + cpu;
25130
25131 if (!boot_cpu_has(X86_FEATURE_SEP)) {
25132 put_cpu();
25133 @@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
25134 gate_vma.vm_start = FIXADDR_USER_START;
25135 gate_vma.vm_end = FIXADDR_USER_END;
25136 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
25137 - gate_vma.vm_page_prot = __P101;
25138 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
25139 /*
25140 * Make sure the vDSO gets into every core dump.
25141 * Dumping its contents makes post-mortem fully interpretable later
25142 @@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
25143 if (compat)
25144 addr = VDSO_HIGH_BASE;
25145 else {
25146 - addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
25147 + addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
25148 if (IS_ERR_VALUE(addr)) {
25149 ret = addr;
25150 goto up_fail;
25151 }
25152 }
25153
25154 - current->mm->context.vdso = (void *)addr;
25155 + current->mm->context.vdso = addr;
25156
25157 if (compat_uses_vma || !compat) {
25158 /*
25159 @@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
25160 }
25161
25162 current_thread_info()->sysenter_return =
25163 - VDSO32_SYMBOL(addr, SYSENTER_RETURN);
25164 + (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
25165
25166 up_fail:
25167 if (ret)
25168 - current->mm->context.vdso = NULL;
25169 + current->mm->context.vdso = 0;
25170
25171 up_write(&mm->mmap_sem);
25172
25173 @@ -413,8 +414,14 @@ __initcall(ia32_binfmt_init);
25174
25175 const char *arch_vma_name(struct vm_area_struct *vma)
25176 {
25177 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
25178 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
25179 return "[vdso]";
25180 +
25181 +#ifdef CONFIG_PAX_SEGMEXEC
25182 + if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
25183 + return "[vdso]";
25184 +#endif
25185 +
25186 return NULL;
25187 }
25188
25189 @@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
25190 struct mm_struct *mm = tsk->mm;
25191
25192 /* Check to see if this task was created in compat vdso mode */
25193 - if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
25194 + if (mm && mm->context.vdso == VDSO_HIGH_BASE)
25195 return &gate_vma;
25196 return NULL;
25197 }
25198 diff -urNp linux-2.6.32.49/arch/x86/vdso/vdso.lds.S linux-2.6.32.49/arch/x86/vdso/vdso.lds.S
25199 --- linux-2.6.32.49/arch/x86/vdso/vdso.lds.S 2011-11-08 19:02:43.000000000 -0500
25200 +++ linux-2.6.32.49/arch/x86/vdso/vdso.lds.S 2011-11-15 19:59:43.000000000 -0500
25201 @@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
25202 #define VEXTERN(x) VDSO64_ ## x = vdso_ ## x;
25203 #include "vextern.h"
25204 #undef VEXTERN
25205 +
25206 +#define VEXTERN(x) VDSO64_ ## x = __vdso_ ## x;
25207 +VEXTERN(fallback_gettimeofday)
25208 +VEXTERN(fallback_time)
25209 +VEXTERN(getcpu)
25210 +#undef VEXTERN
25211 diff -urNp linux-2.6.32.49/arch/x86/vdso/vextern.h linux-2.6.32.49/arch/x86/vdso/vextern.h
25212 --- linux-2.6.32.49/arch/x86/vdso/vextern.h 2011-11-08 19:02:43.000000000 -0500
25213 +++ linux-2.6.32.49/arch/x86/vdso/vextern.h 2011-11-15 19:59:43.000000000 -0500
25214 @@ -11,6 +11,5 @@
25215 put into vextern.h and be referenced as a pointer with vdso prefix.
25216 The main kernel later fills in the values. */
25217
25218 -VEXTERN(jiffies)
25219 VEXTERN(vgetcpu_mode)
25220 VEXTERN(vsyscall_gtod_data)
25221 diff -urNp linux-2.6.32.49/arch/x86/vdso/vma.c linux-2.6.32.49/arch/x86/vdso/vma.c
25222 --- linux-2.6.32.49/arch/x86/vdso/vma.c 2011-11-08 19:02:43.000000000 -0500
25223 +++ linux-2.6.32.49/arch/x86/vdso/vma.c 2011-11-18 18:01:52.000000000 -0500
25224 @@ -17,8 +17,6 @@
25225 #include "vextern.h" /* Just for VMAGIC. */
25226 #undef VEXTERN
25227
25228 -unsigned int __read_mostly vdso_enabled = 1;
25229 -
25230 extern char vdso_start[], vdso_end[];
25231 extern unsigned short vdso_sync_cpuid;
25232
25233 @@ -27,10 +25,8 @@ static unsigned vdso_size;
25234
25235 static inline void *var_ref(void *p, char *name)
25236 {
25237 - if (*(void **)p != (void *)VMAGIC) {
25238 - printk("VDSO: variable %s broken\n", name);
25239 - vdso_enabled = 0;
25240 - }
25241 + if (*(void **)p != (void *)VMAGIC)
25242 + panic("VDSO: variable %s broken\n", name);
25243 return p;
25244 }
25245
25246 @@ -57,21 +53,18 @@ static int __init init_vdso_vars(void)
25247 if (!vbase)
25248 goto oom;
25249
25250 - if (memcmp(vbase, "\177ELF", 4)) {
25251 - printk("VDSO: I'm broken; not ELF\n");
25252 - vdso_enabled = 0;
25253 - }
25254 + if (memcmp(vbase, ELFMAG, SELFMAG))
25255 + panic("VDSO: I'm broken; not ELF\n");
25256
25257 #define VEXTERN(x) \
25258 *(typeof(__ ## x) **) var_ref(VDSO64_SYMBOL(vbase, x), #x) = &__ ## x;
25259 #include "vextern.h"
25260 #undef VEXTERN
25261 + vunmap(vbase);
25262 return 0;
25263
25264 oom:
25265 - printk("Cannot allocate vdso\n");
25266 - vdso_enabled = 0;
25267 - return -ENOMEM;
25268 + panic("Cannot allocate vdso\n");
25269 }
25270 __initcall(init_vdso_vars);
25271
25272 @@ -102,13 +95,15 @@ static unsigned long vdso_addr(unsigned
25273 int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
25274 {
25275 struct mm_struct *mm = current->mm;
25276 - unsigned long addr;
25277 + unsigned long addr = 0;
25278 int ret;
25279
25280 - if (!vdso_enabled)
25281 - return 0;
25282 -
25283 down_write(&mm->mmap_sem);
25284 +
25285 +#ifdef CONFIG_PAX_RANDMMAP
25286 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
25287 +#endif
25288 +
25289 addr = vdso_addr(mm->start_stack, vdso_size);
25290 addr = get_unmapped_area(NULL, addr, vdso_size, 0, 0);
25291 if (IS_ERR_VALUE(addr)) {
25292 @@ -116,7 +111,7 @@ int arch_setup_additional_pages(struct l
25293 goto up_fail;
25294 }
25295
25296 - current->mm->context.vdso = (void *)addr;
25297 + current->mm->context.vdso = addr;
25298
25299 ret = install_special_mapping(mm, addr, vdso_size,
25300 VM_READ|VM_EXEC|
25301 @@ -124,7 +119,7 @@ int arch_setup_additional_pages(struct l
25302 VM_ALWAYSDUMP,
25303 vdso_pages);
25304 if (ret) {
25305 - current->mm->context.vdso = NULL;
25306 + current->mm->context.vdso = 0;
25307 goto up_fail;
25308 }
25309
25310 @@ -132,10 +127,3 @@ up_fail:
25311 up_write(&mm->mmap_sem);
25312 return ret;
25313 }
25314 -
25315 -static __init int vdso_setup(char *s)
25316 -{
25317 - vdso_enabled = simple_strtoul(s, NULL, 0);
25318 - return 0;
25319 -}
25320 -__setup("vdso=", vdso_setup);
25321 diff -urNp linux-2.6.32.49/arch/x86/xen/enlighten.c linux-2.6.32.49/arch/x86/xen/enlighten.c
25322 --- linux-2.6.32.49/arch/x86/xen/enlighten.c 2011-11-08 19:02:43.000000000 -0500
25323 +++ linux-2.6.32.49/arch/x86/xen/enlighten.c 2011-11-15 19:59:43.000000000 -0500
25324 @@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
25325
25326 struct shared_info xen_dummy_shared_info;
25327
25328 -void *xen_initial_gdt;
25329 -
25330 /*
25331 * Point at some empty memory to start with. We map the real shared_info
25332 * page as soon as fixmap is up and running.
25333 @@ -548,7 +546,7 @@ static void xen_write_idt_entry(gate_des
25334
25335 preempt_disable();
25336
25337 - start = __get_cpu_var(idt_desc).address;
25338 + start = (unsigned long)__get_cpu_var(idt_desc).address;
25339 end = start + __get_cpu_var(idt_desc).size + 1;
25340
25341 xen_mc_flush();
25342 @@ -993,7 +991,7 @@ static const struct pv_apic_ops xen_apic
25343 #endif
25344 };
25345
25346 -static void xen_reboot(int reason)
25347 +static __noreturn void xen_reboot(int reason)
25348 {
25349 struct sched_shutdown r = { .reason = reason };
25350
25351 @@ -1001,17 +999,17 @@ static void xen_reboot(int reason)
25352 BUG();
25353 }
25354
25355 -static void xen_restart(char *msg)
25356 +static __noreturn void xen_restart(char *msg)
25357 {
25358 xen_reboot(SHUTDOWN_reboot);
25359 }
25360
25361 -static void xen_emergency_restart(void)
25362 +static __noreturn void xen_emergency_restart(void)
25363 {
25364 xen_reboot(SHUTDOWN_reboot);
25365 }
25366
25367 -static void xen_machine_halt(void)
25368 +static __noreturn void xen_machine_halt(void)
25369 {
25370 xen_reboot(SHUTDOWN_poweroff);
25371 }
25372 @@ -1095,9 +1093,20 @@ asmlinkage void __init xen_start_kernel(
25373 */
25374 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
25375
25376 -#ifdef CONFIG_X86_64
25377 /* Work out if we support NX */
25378 - check_efer();
25379 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
25380 + if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
25381 + (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
25382 + unsigned l, h;
25383 +
25384 +#ifdef CONFIG_X86_PAE
25385 + nx_enabled = 1;
25386 +#endif
25387 + __supported_pte_mask |= _PAGE_NX;
25388 + rdmsr(MSR_EFER, l, h);
25389 + l |= EFER_NX;
25390 + wrmsr(MSR_EFER, l, h);
25391 + }
25392 #endif
25393
25394 xen_setup_features();
25395 @@ -1129,13 +1138,6 @@ asmlinkage void __init xen_start_kernel(
25396
25397 machine_ops = xen_machine_ops;
25398
25399 - /*
25400 - * The only reliable way to retain the initial address of the
25401 - * percpu gdt_page is to remember it here, so we can go and
25402 - * mark it RW later, when the initial percpu area is freed.
25403 - */
25404 - xen_initial_gdt = &per_cpu(gdt_page, 0);
25405 -
25406 xen_smp_init();
25407
25408 pgd = (pgd_t *)xen_start_info->pt_base;
25409 diff -urNp linux-2.6.32.49/arch/x86/xen/mmu.c linux-2.6.32.49/arch/x86/xen/mmu.c
25410 --- linux-2.6.32.49/arch/x86/xen/mmu.c 2011-11-08 19:02:43.000000000 -0500
25411 +++ linux-2.6.32.49/arch/x86/xen/mmu.c 2011-11-15 19:59:43.000000000 -0500
25412 @@ -1719,6 +1719,8 @@ __init pgd_t *xen_setup_kernel_pagetable
25413 convert_pfn_mfn(init_level4_pgt);
25414 convert_pfn_mfn(level3_ident_pgt);
25415 convert_pfn_mfn(level3_kernel_pgt);
25416 + convert_pfn_mfn(level3_vmalloc_pgt);
25417 + convert_pfn_mfn(level3_vmemmap_pgt);
25418
25419 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
25420 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
25421 @@ -1737,7 +1739,10 @@ __init pgd_t *xen_setup_kernel_pagetable
25422 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
25423 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
25424 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
25425 + set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
25426 + set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
25427 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
25428 + set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
25429 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
25430 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
25431
25432 @@ -1860,6 +1865,7 @@ static __init void xen_post_allocator_in
25433 pv_mmu_ops.set_pud = xen_set_pud;
25434 #if PAGETABLE_LEVELS == 4
25435 pv_mmu_ops.set_pgd = xen_set_pgd;
25436 + pv_mmu_ops.set_pgd_batched = xen_set_pgd;
25437 #endif
25438
25439 /* This will work as long as patching hasn't happened yet
25440 @@ -1946,6 +1952,7 @@ static const struct pv_mmu_ops xen_mmu_o
25441 .pud_val = PV_CALLEE_SAVE(xen_pud_val),
25442 .make_pud = PV_CALLEE_SAVE(xen_make_pud),
25443 .set_pgd = xen_set_pgd_hyper,
25444 + .set_pgd_batched = xen_set_pgd_hyper,
25445
25446 .alloc_pud = xen_alloc_pmd_init,
25447 .release_pud = xen_release_pmd_init,
25448 diff -urNp linux-2.6.32.49/arch/x86/xen/smp.c linux-2.6.32.49/arch/x86/xen/smp.c
25449 --- linux-2.6.32.49/arch/x86/xen/smp.c 2011-11-08 19:02:43.000000000 -0500
25450 +++ linux-2.6.32.49/arch/x86/xen/smp.c 2011-11-15 19:59:43.000000000 -0500
25451 @@ -168,11 +168,6 @@ static void __init xen_smp_prepare_boot_
25452 {
25453 BUG_ON(smp_processor_id() != 0);
25454 native_smp_prepare_boot_cpu();
25455 -
25456 - /* We've switched to the "real" per-cpu gdt, so make sure the
25457 - old memory can be recycled */
25458 - make_lowmem_page_readwrite(xen_initial_gdt);
25459 -
25460 xen_setup_vcpu_info_placement();
25461 }
25462
25463 @@ -241,12 +236,12 @@ cpu_initialize_context(unsigned int cpu,
25464 gdt = get_cpu_gdt_table(cpu);
25465
25466 ctxt->flags = VGCF_IN_KERNEL;
25467 - ctxt->user_regs.ds = __USER_DS;
25468 - ctxt->user_regs.es = __USER_DS;
25469 + ctxt->user_regs.ds = __KERNEL_DS;
25470 + ctxt->user_regs.es = __KERNEL_DS;
25471 ctxt->user_regs.ss = __KERNEL_DS;
25472 #ifdef CONFIG_X86_32
25473 ctxt->user_regs.fs = __KERNEL_PERCPU;
25474 - ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
25475 + savesegment(gs, ctxt->user_regs.gs);
25476 #else
25477 ctxt->gs_base_kernel = per_cpu_offset(cpu);
25478 #endif
25479 @@ -297,13 +292,12 @@ static int __cpuinit xen_cpu_up(unsigned
25480 int rc;
25481
25482 per_cpu(current_task, cpu) = idle;
25483 + per_cpu(current_tinfo, cpu) = &idle->tinfo;
25484 #ifdef CONFIG_X86_32
25485 irq_ctx_init(cpu);
25486 #else
25487 clear_tsk_thread_flag(idle, TIF_FORK);
25488 - per_cpu(kernel_stack, cpu) =
25489 - (unsigned long)task_stack_page(idle) -
25490 - KERNEL_STACK_OFFSET + THREAD_SIZE;
25491 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
25492 #endif
25493 xen_setup_runstate_info(cpu);
25494 xen_setup_timer(cpu);
25495 diff -urNp linux-2.6.32.49/arch/x86/xen/xen-asm_32.S linux-2.6.32.49/arch/x86/xen/xen-asm_32.S
25496 --- linux-2.6.32.49/arch/x86/xen/xen-asm_32.S 2011-11-08 19:02:43.000000000 -0500
25497 +++ linux-2.6.32.49/arch/x86/xen/xen-asm_32.S 2011-11-15 19:59:43.000000000 -0500
25498 @@ -83,14 +83,14 @@ ENTRY(xen_iret)
25499 ESP_OFFSET=4 # bytes pushed onto stack
25500
25501 /*
25502 - * Store vcpu_info pointer for easy access. Do it this way to
25503 - * avoid having to reload %fs
25504 + * Store vcpu_info pointer for easy access.
25505 */
25506 #ifdef CONFIG_SMP
25507 - GET_THREAD_INFO(%eax)
25508 - movl TI_cpu(%eax), %eax
25509 - movl __per_cpu_offset(,%eax,4), %eax
25510 - mov per_cpu__xen_vcpu(%eax), %eax
25511 + push %fs
25512 + mov $(__KERNEL_PERCPU), %eax
25513 + mov %eax, %fs
25514 + mov PER_CPU_VAR(xen_vcpu), %eax
25515 + pop %fs
25516 #else
25517 movl per_cpu__xen_vcpu, %eax
25518 #endif
25519 diff -urNp linux-2.6.32.49/arch/x86/xen/xen-head.S linux-2.6.32.49/arch/x86/xen/xen-head.S
25520 --- linux-2.6.32.49/arch/x86/xen/xen-head.S 2011-11-08 19:02:43.000000000 -0500
25521 +++ linux-2.6.32.49/arch/x86/xen/xen-head.S 2011-11-15 19:59:43.000000000 -0500
25522 @@ -19,6 +19,17 @@ ENTRY(startup_xen)
25523 #ifdef CONFIG_X86_32
25524 mov %esi,xen_start_info
25525 mov $init_thread_union+THREAD_SIZE,%esp
25526 +#ifdef CONFIG_SMP
25527 + movl $cpu_gdt_table,%edi
25528 + movl $__per_cpu_load,%eax
25529 + movw %ax,__KERNEL_PERCPU + 2(%edi)
25530 + rorl $16,%eax
25531 + movb %al,__KERNEL_PERCPU + 4(%edi)
25532 + movb %ah,__KERNEL_PERCPU + 7(%edi)
25533 + movl $__per_cpu_end - 1,%eax
25534 + subl $__per_cpu_start,%eax
25535 + movw %ax,__KERNEL_PERCPU + 0(%edi)
25536 +#endif
25537 #else
25538 mov %rsi,xen_start_info
25539 mov $init_thread_union+THREAD_SIZE,%rsp
25540 diff -urNp linux-2.6.32.49/arch/x86/xen/xen-ops.h linux-2.6.32.49/arch/x86/xen/xen-ops.h
25541 --- linux-2.6.32.49/arch/x86/xen/xen-ops.h 2011-11-08 19:02:43.000000000 -0500
25542 +++ linux-2.6.32.49/arch/x86/xen/xen-ops.h 2011-11-15 19:59:43.000000000 -0500
25543 @@ -10,8 +10,6 @@
25544 extern const char xen_hypervisor_callback[];
25545 extern const char xen_failsafe_callback[];
25546
25547 -extern void *xen_initial_gdt;
25548 -
25549 struct trap_info;
25550 void xen_copy_trap_info(struct trap_info *traps);
25551
25552 diff -urNp linux-2.6.32.49/block/blk-integrity.c linux-2.6.32.49/block/blk-integrity.c
25553 --- linux-2.6.32.49/block/blk-integrity.c 2011-11-08 19:02:43.000000000 -0500
25554 +++ linux-2.6.32.49/block/blk-integrity.c 2011-11-15 19:59:43.000000000 -0500
25555 @@ -278,7 +278,7 @@ static struct attribute *integrity_attrs
25556 NULL,
25557 };
25558
25559 -static struct sysfs_ops integrity_ops = {
25560 +static const struct sysfs_ops integrity_ops = {
25561 .show = &integrity_attr_show,
25562 .store = &integrity_attr_store,
25563 };
25564 diff -urNp linux-2.6.32.49/block/blk-iopoll.c linux-2.6.32.49/block/blk-iopoll.c
25565 --- linux-2.6.32.49/block/blk-iopoll.c 2011-11-08 19:02:43.000000000 -0500
25566 +++ linux-2.6.32.49/block/blk-iopoll.c 2011-11-15 19:59:43.000000000 -0500
25567 @@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
25568 }
25569 EXPORT_SYMBOL(blk_iopoll_complete);
25570
25571 -static void blk_iopoll_softirq(struct softirq_action *h)
25572 +static void blk_iopoll_softirq(void)
25573 {
25574 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
25575 int rearm = 0, budget = blk_iopoll_budget;
25576 diff -urNp linux-2.6.32.49/block/blk-map.c linux-2.6.32.49/block/blk-map.c
25577 --- linux-2.6.32.49/block/blk-map.c 2011-11-08 19:02:43.000000000 -0500
25578 +++ linux-2.6.32.49/block/blk-map.c 2011-11-15 19:59:43.000000000 -0500
25579 @@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct requ
25580 * direct dma. else, set up kernel bounce buffers
25581 */
25582 uaddr = (unsigned long) ubuf;
25583 - if (blk_rq_aligned(q, ubuf, len) && !map_data)
25584 + if (blk_rq_aligned(q, (__force void *)ubuf, len) && !map_data)
25585 bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
25586 else
25587 bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
25588 @@ -201,12 +201,13 @@ int blk_rq_map_user_iov(struct request_q
25589 for (i = 0; i < iov_count; i++) {
25590 unsigned long uaddr = (unsigned long)iov[i].iov_base;
25591
25592 + if (!iov[i].iov_len)
25593 + return -EINVAL;
25594 +
25595 if (uaddr & queue_dma_alignment(q)) {
25596 unaligned = 1;
25597 break;
25598 }
25599 - if (!iov[i].iov_len)
25600 - return -EINVAL;
25601 }
25602
25603 if (unaligned || (q->dma_pad_mask & len) || map_data)
25604 @@ -299,7 +300,7 @@ int blk_rq_map_kern(struct request_queue
25605 if (!len || !kbuf)
25606 return -EINVAL;
25607
25608 - do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
25609 + do_copy = !blk_rq_aligned(q, kbuf, len) || object_starts_on_stack(kbuf);
25610 if (do_copy)
25611 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
25612 else
25613 diff -urNp linux-2.6.32.49/block/blk-softirq.c linux-2.6.32.49/block/blk-softirq.c
25614 --- linux-2.6.32.49/block/blk-softirq.c 2011-11-08 19:02:43.000000000 -0500
25615 +++ linux-2.6.32.49/block/blk-softirq.c 2011-11-15 19:59:43.000000000 -0500
25616 @@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head,
25617 * Softirq action handler - move entries to local list and loop over them
25618 * while passing them to the queue registered handler.
25619 */
25620 -static void blk_done_softirq(struct softirq_action *h)
25621 +static void blk_done_softirq(void)
25622 {
25623 struct list_head *cpu_list, local_list;
25624
25625 diff -urNp linux-2.6.32.49/block/blk-sysfs.c linux-2.6.32.49/block/blk-sysfs.c
25626 --- linux-2.6.32.49/block/blk-sysfs.c 2011-11-08 19:02:43.000000000 -0500
25627 +++ linux-2.6.32.49/block/blk-sysfs.c 2011-11-15 19:59:43.000000000 -0500
25628 @@ -414,7 +414,7 @@ static void blk_release_queue(struct kob
25629 kmem_cache_free(blk_requestq_cachep, q);
25630 }
25631
25632 -static struct sysfs_ops queue_sysfs_ops = {
25633 +static const struct sysfs_ops queue_sysfs_ops = {
25634 .show = queue_attr_show,
25635 .store = queue_attr_store,
25636 };
25637 diff -urNp linux-2.6.32.49/block/bsg.c linux-2.6.32.49/block/bsg.c
25638 --- linux-2.6.32.49/block/bsg.c 2011-11-08 19:02:43.000000000 -0500
25639 +++ linux-2.6.32.49/block/bsg.c 2011-11-15 19:59:43.000000000 -0500
25640 @@ -175,16 +175,24 @@ static int blk_fill_sgv4_hdr_rq(struct r
25641 struct sg_io_v4 *hdr, struct bsg_device *bd,
25642 fmode_t has_write_perm)
25643 {
25644 + unsigned char tmpcmd[sizeof(rq->__cmd)];
25645 + unsigned char *cmdptr;
25646 +
25647 if (hdr->request_len > BLK_MAX_CDB) {
25648 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
25649 if (!rq->cmd)
25650 return -ENOMEM;
25651 - }
25652 + cmdptr = rq->cmd;
25653 + } else
25654 + cmdptr = tmpcmd;
25655
25656 - if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
25657 + if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request,
25658 hdr->request_len))
25659 return -EFAULT;
25660
25661 + if (cmdptr != rq->cmd)
25662 + memcpy(rq->cmd, cmdptr, hdr->request_len);
25663 +
25664 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
25665 if (blk_verify_command(rq->cmd, has_write_perm))
25666 return -EPERM;
25667 @@ -282,7 +290,7 @@ bsg_map_hdr(struct bsg_device *bd, struc
25668 rq->next_rq = next_rq;
25669 next_rq->cmd_type = rq->cmd_type;
25670
25671 - dxferp = (void*)(unsigned long)hdr->din_xferp;
25672 + dxferp = (void __user *)(unsigned long)hdr->din_xferp;
25673 ret = blk_rq_map_user(q, next_rq, NULL, dxferp,
25674 hdr->din_xfer_len, GFP_KERNEL);
25675 if (ret)
25676 @@ -291,10 +299,10 @@ bsg_map_hdr(struct bsg_device *bd, struc
25677
25678 if (hdr->dout_xfer_len) {
25679 dxfer_len = hdr->dout_xfer_len;
25680 - dxferp = (void*)(unsigned long)hdr->dout_xferp;
25681 + dxferp = (void __user *)(unsigned long)hdr->dout_xferp;
25682 } else if (hdr->din_xfer_len) {
25683 dxfer_len = hdr->din_xfer_len;
25684 - dxferp = (void*)(unsigned long)hdr->din_xferp;
25685 + dxferp = (void __user *)(unsigned long)hdr->din_xferp;
25686 } else
25687 dxfer_len = 0;
25688
25689 @@ -436,7 +444,7 @@ static int blk_complete_sgv4_hdr_rq(stru
25690 int len = min_t(unsigned int, hdr->max_response_len,
25691 rq->sense_len);
25692
25693 - ret = copy_to_user((void*)(unsigned long)hdr->response,
25694 + ret = copy_to_user((void __user *)(unsigned long)hdr->response,
25695 rq->sense, len);
25696 if (!ret)
25697 hdr->response_len = len;
25698 diff -urNp linux-2.6.32.49/block/compat_ioctl.c linux-2.6.32.49/block/compat_ioctl.c
25699 --- linux-2.6.32.49/block/compat_ioctl.c 2011-11-08 19:02:43.000000000 -0500
25700 +++ linux-2.6.32.49/block/compat_ioctl.c 2011-11-15 19:59:43.000000000 -0500
25701 @@ -354,7 +354,7 @@ static int compat_fd_ioctl(struct block_
25702 err |= __get_user(f->spec1, &uf->spec1);
25703 err |= __get_user(f->fmt_gap, &uf->fmt_gap);
25704 err |= __get_user(name, &uf->name);
25705 - f->name = compat_ptr(name);
25706 + f->name = (void __force_kernel *)compat_ptr(name);
25707 if (err) {
25708 err = -EFAULT;
25709 goto out;
25710 diff -urNp linux-2.6.32.49/block/elevator.c linux-2.6.32.49/block/elevator.c
25711 --- linux-2.6.32.49/block/elevator.c 2011-11-08 19:02:43.000000000 -0500
25712 +++ linux-2.6.32.49/block/elevator.c 2011-11-15 19:59:43.000000000 -0500
25713 @@ -889,7 +889,7 @@ elv_attr_store(struct kobject *kobj, str
25714 return error;
25715 }
25716
25717 -static struct sysfs_ops elv_sysfs_ops = {
25718 +static const struct sysfs_ops elv_sysfs_ops = {
25719 .show = elv_attr_show,
25720 .store = elv_attr_store,
25721 };
25722 diff -urNp linux-2.6.32.49/block/scsi_ioctl.c linux-2.6.32.49/block/scsi_ioctl.c
25723 --- linux-2.6.32.49/block/scsi_ioctl.c 2011-11-08 19:02:43.000000000 -0500
25724 +++ linux-2.6.32.49/block/scsi_ioctl.c 2011-11-15 19:59:43.000000000 -0500
25725 @@ -220,8 +220,20 @@ EXPORT_SYMBOL(blk_verify_command);
25726 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
25727 struct sg_io_hdr *hdr, fmode_t mode)
25728 {
25729 - if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
25730 + unsigned char tmpcmd[sizeof(rq->__cmd)];
25731 + unsigned char *cmdptr;
25732 +
25733 + if (rq->cmd != rq->__cmd)
25734 + cmdptr = rq->cmd;
25735 + else
25736 + cmdptr = tmpcmd;
25737 +
25738 + if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
25739 return -EFAULT;
25740 +
25741 + if (cmdptr != rq->cmd)
25742 + memcpy(rq->cmd, cmdptr, hdr->cmd_len);
25743 +
25744 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
25745 return -EPERM;
25746
25747 @@ -430,6 +442,8 @@ int sg_scsi_ioctl(struct request_queue *
25748 int err;
25749 unsigned int in_len, out_len, bytes, opcode, cmdlen;
25750 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
25751 + unsigned char tmpcmd[sizeof(rq->__cmd)];
25752 + unsigned char *cmdptr;
25753
25754 if (!sic)
25755 return -EINVAL;
25756 @@ -463,9 +477,18 @@ int sg_scsi_ioctl(struct request_queue *
25757 */
25758 err = -EFAULT;
25759 rq->cmd_len = cmdlen;
25760 - if (copy_from_user(rq->cmd, sic->data, cmdlen))
25761 +
25762 + if (rq->cmd != rq->__cmd)
25763 + cmdptr = rq->cmd;
25764 + else
25765 + cmdptr = tmpcmd;
25766 +
25767 + if (copy_from_user(cmdptr, sic->data, cmdlen))
25768 goto error;
25769
25770 + if (rq->cmd != cmdptr)
25771 + memcpy(rq->cmd, cmdptr, cmdlen);
25772 +
25773 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
25774 goto error;
25775
25776 diff -urNp linux-2.6.32.49/crypto/cryptd.c linux-2.6.32.49/crypto/cryptd.c
25777 --- linux-2.6.32.49/crypto/cryptd.c 2011-11-08 19:02:43.000000000 -0500
25778 +++ linux-2.6.32.49/crypto/cryptd.c 2011-11-15 19:59:43.000000000 -0500
25779 @@ -50,7 +50,7 @@ struct cryptd_blkcipher_ctx {
25780
25781 struct cryptd_blkcipher_request_ctx {
25782 crypto_completion_t complete;
25783 -};
25784 +} __no_const;
25785
25786 struct cryptd_hash_ctx {
25787 struct crypto_shash *child;
25788 diff -urNp linux-2.6.32.49/crypto/gf128mul.c linux-2.6.32.49/crypto/gf128mul.c
25789 --- linux-2.6.32.49/crypto/gf128mul.c 2011-11-08 19:02:43.000000000 -0500
25790 +++ linux-2.6.32.49/crypto/gf128mul.c 2011-11-15 19:59:43.000000000 -0500
25791 @@ -182,7 +182,7 @@ void gf128mul_lle(be128 *r, const be128
25792 for (i = 0; i < 7; ++i)
25793 gf128mul_x_lle(&p[i + 1], &p[i]);
25794
25795 - memset(r, 0, sizeof(r));
25796 + memset(r, 0, sizeof(*r));
25797 for (i = 0;;) {
25798 u8 ch = ((u8 *)b)[15 - i];
25799
25800 @@ -220,7 +220,7 @@ void gf128mul_bbe(be128 *r, const be128
25801 for (i = 0; i < 7; ++i)
25802 gf128mul_x_bbe(&p[i + 1], &p[i]);
25803
25804 - memset(r, 0, sizeof(r));
25805 + memset(r, 0, sizeof(*r));
25806 for (i = 0;;) {
25807 u8 ch = ((u8 *)b)[i];
25808
25809 diff -urNp linux-2.6.32.49/crypto/serpent.c linux-2.6.32.49/crypto/serpent.c
25810 --- linux-2.6.32.49/crypto/serpent.c 2011-11-08 19:02:43.000000000 -0500
25811 +++ linux-2.6.32.49/crypto/serpent.c 2011-11-15 19:59:43.000000000 -0500
25812 @@ -21,6 +21,7 @@
25813 #include <asm/byteorder.h>
25814 #include <linux/crypto.h>
25815 #include <linux/types.h>
25816 +#include <linux/sched.h>
25817
25818 /* Key is padded to the maximum of 256 bits before round key generation.
25819 * Any key length <= 256 bits (32 bytes) is allowed by the algorithm.
25820 @@ -224,6 +225,8 @@ static int serpent_setkey(struct crypto_
25821 u32 r0,r1,r2,r3,r4;
25822 int i;
25823
25824 + pax_track_stack();
25825 +
25826 /* Copy key, add padding */
25827
25828 for (i = 0; i < keylen; ++i)
25829 diff -urNp linux-2.6.32.49/Documentation/dontdiff linux-2.6.32.49/Documentation/dontdiff
25830 --- linux-2.6.32.49/Documentation/dontdiff 2011-11-08 19:02:43.000000000 -0500
25831 +++ linux-2.6.32.49/Documentation/dontdiff 2011-11-18 18:01:52.000000000 -0500
25832 @@ -1,13 +1,16 @@
25833 *.a
25834 *.aux
25835 *.bin
25836 +*.cis
25837 *.cpio
25838 *.csp
25839 +*.dbg
25840 *.dsp
25841 *.dvi
25842 *.elf
25843 *.eps
25844 *.fw
25845 +*.gcno
25846 *.gen.S
25847 *.gif
25848 *.grep
25849 @@ -38,8 +41,10 @@
25850 *.tab.h
25851 *.tex
25852 *.ver
25853 +*.vim
25854 *.xml
25855 *_MODULES
25856 +*_reg_safe.h
25857 *_vga16.c
25858 *~
25859 *.9
25860 @@ -49,11 +54,16 @@
25861 53c700_d.h
25862 CVS
25863 ChangeSet
25864 +GPATH
25865 +GRTAGS
25866 +GSYMS
25867 +GTAGS
25868 Image
25869 Kerntypes
25870 Module.markers
25871 Module.symvers
25872 PENDING
25873 +PERF*
25874 SCCS
25875 System.map*
25876 TAGS
25877 @@ -76,7 +86,11 @@ btfixupprep
25878 build
25879 bvmlinux
25880 bzImage*
25881 +capability_names.h
25882 +capflags.c
25883 classlist.h*
25884 +clut_vga16.c
25885 +common-cmds.h
25886 comp*.log
25887 compile.h*
25888 conf
25889 @@ -84,6 +98,8 @@ config
25890 config-*
25891 config_data.h*
25892 config_data.gz*
25893 +config.c
25894 +config.tmp
25895 conmakehash
25896 consolemap_deftbl.c*
25897 cpustr.h
25898 @@ -97,19 +113,22 @@ elfconfig.h*
25899 fixdep
25900 fore200e_mkfirm
25901 fore200e_pca_fw.c*
25902 +gate.lds
25903 gconf
25904 gen-devlist
25905 gen_crc32table
25906 gen_init_cpio
25907 genksyms
25908 *_gray256.c
25909 +hash
25910 ihex2fw
25911 ikconfig.h*
25912 initramfs_data.cpio
25913 +initramfs_data.cpio.bz2
25914 initramfs_data.cpio.gz
25915 initramfs_list
25916 kallsyms
25917 -kconfig
25918 +kern_constants.h
25919 keywords.c
25920 ksym.c*
25921 ksym.h*
25922 @@ -133,7 +152,9 @@ mkboot
25923 mkbugboot
25924 mkcpustr
25925 mkdep
25926 +mkpiggy
25927 mkprep
25928 +mkregtable
25929 mktables
25930 mktree
25931 modpost
25932 @@ -149,6 +170,7 @@ patches*
25933 pca200e.bin
25934 pca200e_ecd.bin2
25935 piggy.gz
25936 +piggy.S
25937 piggyback
25938 pnmtologo
25939 ppc_defs.h*
25940 @@ -157,12 +179,15 @@ qconf
25941 raid6altivec*.c
25942 raid6int*.c
25943 raid6tables.c
25944 +regdb.c
25945 relocs
25946 +rlim_names.h
25947 series
25948 setup
25949 setup.bin
25950 setup.elf
25951 sImage
25952 +slabinfo
25953 sm_tbl*
25954 split-include
25955 syscalltab.h
25956 @@ -171,6 +196,7 @@ tftpboot.img
25957 timeconst.h
25958 times.h*
25959 trix_boot.h
25960 +user_constants.h
25961 utsrelease.h*
25962 vdso-syms.lds
25963 vdso.lds
25964 @@ -186,14 +212,20 @@ version.h*
25965 vmlinux
25966 vmlinux-*
25967 vmlinux.aout
25968 +vmlinux.bin.all
25969 +vmlinux.bin.bz2
25970 vmlinux.lds
25971 +vmlinux.relocs
25972 +voffset.h
25973 vsyscall.lds
25974 vsyscall_32.lds
25975 wanxlfw.inc
25976 uImage
25977 unifdef
25978 +utsrelease.h
25979 wakeup.bin
25980 wakeup.elf
25981 wakeup.lds
25982 zImage*
25983 zconf.hash.c
25984 +zoffset.h
25985 diff -urNp linux-2.6.32.49/Documentation/kernel-parameters.txt linux-2.6.32.49/Documentation/kernel-parameters.txt
25986 --- linux-2.6.32.49/Documentation/kernel-parameters.txt 2011-11-08 19:02:43.000000000 -0500
25987 +++ linux-2.6.32.49/Documentation/kernel-parameters.txt 2011-11-15 19:59:43.000000000 -0500
25988 @@ -1837,6 +1837,13 @@ and is between 256 and 4096 characters.
25989 the specified number of seconds. This is to be used if
25990 your oopses keep scrolling off the screen.
25991
25992 + pax_nouderef [X86] disables UDEREF. Most likely needed under certain
25993 + virtualization environments that don't cope well with the
25994 + expand down segment used by UDEREF on X86-32 or the frequent
25995 + page table updates on X86-64.
25996 +
25997 + pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
25998 +
25999 pcbit= [HW,ISDN]
26000
26001 pcd. [PARIDE]
26002 diff -urNp linux-2.6.32.49/drivers/acpi/acpi_pad.c linux-2.6.32.49/drivers/acpi/acpi_pad.c
26003 --- linux-2.6.32.49/drivers/acpi/acpi_pad.c 2011-11-08 19:02:43.000000000 -0500
26004 +++ linux-2.6.32.49/drivers/acpi/acpi_pad.c 2011-11-15 19:59:43.000000000 -0500
26005 @@ -30,7 +30,7 @@
26006 #include <acpi/acpi_bus.h>
26007 #include <acpi/acpi_drivers.h>
26008
26009 -#define ACPI_PROCESSOR_AGGREGATOR_CLASS "processor_aggregator"
26010 +#define ACPI_PROCESSOR_AGGREGATOR_CLASS "acpi_pad"
26011 #define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"
26012 #define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80
26013 static DEFINE_MUTEX(isolated_cpus_lock);
26014 diff -urNp linux-2.6.32.49/drivers/acpi/battery.c linux-2.6.32.49/drivers/acpi/battery.c
26015 --- linux-2.6.32.49/drivers/acpi/battery.c 2011-11-08 19:02:43.000000000 -0500
26016 +++ linux-2.6.32.49/drivers/acpi/battery.c 2011-11-15 19:59:43.000000000 -0500
26017 @@ -763,7 +763,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
26018 }
26019
26020 static struct battery_file {
26021 - struct file_operations ops;
26022 + const struct file_operations ops;
26023 mode_t mode;
26024 const char *name;
26025 } acpi_battery_file[] = {
26026 diff -urNp linux-2.6.32.49/drivers/acpi/dock.c linux-2.6.32.49/drivers/acpi/dock.c
26027 --- linux-2.6.32.49/drivers/acpi/dock.c 2011-11-08 19:02:43.000000000 -0500
26028 +++ linux-2.6.32.49/drivers/acpi/dock.c 2011-11-15 19:59:43.000000000 -0500
26029 @@ -77,7 +77,7 @@ struct dock_dependent_device {
26030 struct list_head list;
26031 struct list_head hotplug_list;
26032 acpi_handle handle;
26033 - struct acpi_dock_ops *ops;
26034 + const struct acpi_dock_ops *ops;
26035 void *context;
26036 };
26037
26038 @@ -605,7 +605,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
26039 * the dock driver after _DCK is executed.
26040 */
26041 int
26042 -register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
26043 +register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
26044 void *context)
26045 {
26046 struct dock_dependent_device *dd;
26047 diff -urNp linux-2.6.32.49/drivers/acpi/osl.c linux-2.6.32.49/drivers/acpi/osl.c
26048 --- linux-2.6.32.49/drivers/acpi/osl.c 2011-11-08 19:02:43.000000000 -0500
26049 +++ linux-2.6.32.49/drivers/acpi/osl.c 2011-11-15 19:59:43.000000000 -0500
26050 @@ -523,6 +523,8 @@ acpi_os_read_memory(acpi_physical_addres
26051 void __iomem *virt_addr;
26052
26053 virt_addr = ioremap(phys_addr, width);
26054 + if (!virt_addr)
26055 + return AE_NO_MEMORY;
26056 if (!value)
26057 value = &dummy;
26058
26059 @@ -551,6 +553,8 @@ acpi_os_write_memory(acpi_physical_addre
26060 void __iomem *virt_addr;
26061
26062 virt_addr = ioremap(phys_addr, width);
26063 + if (!virt_addr)
26064 + return AE_NO_MEMORY;
26065
26066 switch (width) {
26067 case 8:
26068 diff -urNp linux-2.6.32.49/drivers/acpi/power_meter.c linux-2.6.32.49/drivers/acpi/power_meter.c
26069 --- linux-2.6.32.49/drivers/acpi/power_meter.c 2011-11-08 19:02:43.000000000 -0500
26070 +++ linux-2.6.32.49/drivers/acpi/power_meter.c 2011-11-15 19:59:43.000000000 -0500
26071 @@ -315,8 +315,6 @@ static ssize_t set_trip(struct device *d
26072 return res;
26073
26074 temp /= 1000;
26075 - if (temp < 0)
26076 - return -EINVAL;
26077
26078 mutex_lock(&resource->lock);
26079 resource->trip[attr->index - 7] = temp;
26080 diff -urNp linux-2.6.32.49/drivers/acpi/proc.c linux-2.6.32.49/drivers/acpi/proc.c
26081 --- linux-2.6.32.49/drivers/acpi/proc.c 2011-11-08 19:02:43.000000000 -0500
26082 +++ linux-2.6.32.49/drivers/acpi/proc.c 2011-11-15 19:59:43.000000000 -0500
26083 @@ -391,20 +391,15 @@ acpi_system_write_wakeup_device(struct f
26084 size_t count, loff_t * ppos)
26085 {
26086 struct list_head *node, *next;
26087 - char strbuf[5];
26088 - char str[5] = "";
26089 - unsigned int len = count;
26090 + char strbuf[5] = {0};
26091 struct acpi_device *found_dev = NULL;
26092
26093 - if (len > 4)
26094 - len = 4;
26095 - if (len < 0)
26096 - return -EFAULT;
26097 + if (count > 4)
26098 + count = 4;
26099
26100 - if (copy_from_user(strbuf, buffer, len))
26101 + if (copy_from_user(strbuf, buffer, count))
26102 return -EFAULT;
26103 - strbuf[len] = '\0';
26104 - sscanf(strbuf, "%s", str);
26105 + strbuf[count] = '\0';
26106
26107 mutex_lock(&acpi_device_lock);
26108 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
26109 @@ -413,7 +408,7 @@ acpi_system_write_wakeup_device(struct f
26110 if (!dev->wakeup.flags.valid)
26111 continue;
26112
26113 - if (!strncmp(dev->pnp.bus_id, str, 4)) {
26114 + if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
26115 dev->wakeup.state.enabled =
26116 dev->wakeup.state.enabled ? 0 : 1;
26117 found_dev = dev;
26118 diff -urNp linux-2.6.32.49/drivers/acpi/processor_core.c linux-2.6.32.49/drivers/acpi/processor_core.c
26119 --- linux-2.6.32.49/drivers/acpi/processor_core.c 2011-11-08 19:02:43.000000000 -0500
26120 +++ linux-2.6.32.49/drivers/acpi/processor_core.c 2011-11-15 19:59:43.000000000 -0500
26121 @@ -790,7 +790,7 @@ static int __cpuinit acpi_processor_add(
26122 return 0;
26123 }
26124
26125 - BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
26126 + BUG_ON(pr->id >= nr_cpu_ids);
26127
26128 /*
26129 * Buggy BIOS check
26130 diff -urNp linux-2.6.32.49/drivers/acpi/sbshc.c linux-2.6.32.49/drivers/acpi/sbshc.c
26131 --- linux-2.6.32.49/drivers/acpi/sbshc.c 2011-11-08 19:02:43.000000000 -0500
26132 +++ linux-2.6.32.49/drivers/acpi/sbshc.c 2011-11-15 19:59:43.000000000 -0500
26133 @@ -17,7 +17,7 @@
26134
26135 #define PREFIX "ACPI: "
26136
26137 -#define ACPI_SMB_HC_CLASS "smbus_host_controller"
26138 +#define ACPI_SMB_HC_CLASS "smbus_host_ctl"
26139 #define ACPI_SMB_HC_DEVICE_NAME "ACPI SMBus HC"
26140
26141 struct acpi_smb_hc {
26142 diff -urNp linux-2.6.32.49/drivers/acpi/sleep.c linux-2.6.32.49/drivers/acpi/sleep.c
26143 --- linux-2.6.32.49/drivers/acpi/sleep.c 2011-11-08 19:02:43.000000000 -0500
26144 +++ linux-2.6.32.49/drivers/acpi/sleep.c 2011-11-15 19:59:43.000000000 -0500
26145 @@ -283,7 +283,7 @@ static int acpi_suspend_state_valid(susp
26146 }
26147 }
26148
26149 -static struct platform_suspend_ops acpi_suspend_ops = {
26150 +static const struct platform_suspend_ops acpi_suspend_ops = {
26151 .valid = acpi_suspend_state_valid,
26152 .begin = acpi_suspend_begin,
26153 .prepare_late = acpi_pm_prepare,
26154 @@ -311,7 +311,7 @@ static int acpi_suspend_begin_old(suspen
26155 * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
26156 * been requested.
26157 */
26158 -static struct platform_suspend_ops acpi_suspend_ops_old = {
26159 +static const struct platform_suspend_ops acpi_suspend_ops_old = {
26160 .valid = acpi_suspend_state_valid,
26161 .begin = acpi_suspend_begin_old,
26162 .prepare_late = acpi_pm_disable_gpes,
26163 @@ -460,7 +460,7 @@ static void acpi_pm_enable_gpes(void)
26164 acpi_enable_all_runtime_gpes();
26165 }
26166
26167 -static struct platform_hibernation_ops acpi_hibernation_ops = {
26168 +static const struct platform_hibernation_ops acpi_hibernation_ops = {
26169 .begin = acpi_hibernation_begin,
26170 .end = acpi_pm_end,
26171 .pre_snapshot = acpi_hibernation_pre_snapshot,
26172 @@ -513,7 +513,7 @@ static int acpi_hibernation_pre_snapshot
26173 * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
26174 * been requested.
26175 */
26176 -static struct platform_hibernation_ops acpi_hibernation_ops_old = {
26177 +static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
26178 .begin = acpi_hibernation_begin_old,
26179 .end = acpi_pm_end,
26180 .pre_snapshot = acpi_hibernation_pre_snapshot_old,
26181 diff -urNp linux-2.6.32.49/drivers/acpi/video.c linux-2.6.32.49/drivers/acpi/video.c
26182 --- linux-2.6.32.49/drivers/acpi/video.c 2011-11-08 19:02:43.000000000 -0500
26183 +++ linux-2.6.32.49/drivers/acpi/video.c 2011-11-15 19:59:43.000000000 -0500
26184 @@ -359,7 +359,7 @@ static int acpi_video_set_brightness(str
26185 vd->brightness->levels[request_level]);
26186 }
26187
26188 -static struct backlight_ops acpi_backlight_ops = {
26189 +static const struct backlight_ops acpi_backlight_ops = {
26190 .get_brightness = acpi_video_get_brightness,
26191 .update_status = acpi_video_set_brightness,
26192 };
26193 diff -urNp linux-2.6.32.49/drivers/ata/ahci.c linux-2.6.32.49/drivers/ata/ahci.c
26194 --- linux-2.6.32.49/drivers/ata/ahci.c 2011-11-08 19:02:43.000000000 -0500
26195 +++ linux-2.6.32.49/drivers/ata/ahci.c 2011-11-15 19:59:43.000000000 -0500
26196 @@ -387,7 +387,7 @@ static struct scsi_host_template ahci_sh
26197 .sdev_attrs = ahci_sdev_attrs,
26198 };
26199
26200 -static struct ata_port_operations ahci_ops = {
26201 +static const struct ata_port_operations ahci_ops = {
26202 .inherits = &sata_pmp_port_ops,
26203
26204 .qc_defer = sata_pmp_qc_defer_cmd_switch,
26205 @@ -424,17 +424,17 @@ static struct ata_port_operations ahci_o
26206 .port_stop = ahci_port_stop,
26207 };
26208
26209 -static struct ata_port_operations ahci_vt8251_ops = {
26210 +static const struct ata_port_operations ahci_vt8251_ops = {
26211 .inherits = &ahci_ops,
26212 .hardreset = ahci_vt8251_hardreset,
26213 };
26214
26215 -static struct ata_port_operations ahci_p5wdh_ops = {
26216 +static const struct ata_port_operations ahci_p5wdh_ops = {
26217 .inherits = &ahci_ops,
26218 .hardreset = ahci_p5wdh_hardreset,
26219 };
26220
26221 -static struct ata_port_operations ahci_sb600_ops = {
26222 +static const struct ata_port_operations ahci_sb600_ops = {
26223 .inherits = &ahci_ops,
26224 .softreset = ahci_sb600_softreset,
26225 .pmp_softreset = ahci_sb600_softreset,
26226 diff -urNp linux-2.6.32.49/drivers/ata/ata_generic.c linux-2.6.32.49/drivers/ata/ata_generic.c
26227 --- linux-2.6.32.49/drivers/ata/ata_generic.c 2011-11-08 19:02:43.000000000 -0500
26228 +++ linux-2.6.32.49/drivers/ata/ata_generic.c 2011-11-15 19:59:43.000000000 -0500
26229 @@ -104,7 +104,7 @@ static struct scsi_host_template generic
26230 ATA_BMDMA_SHT(DRV_NAME),
26231 };
26232
26233 -static struct ata_port_operations generic_port_ops = {
26234 +static const struct ata_port_operations generic_port_ops = {
26235 .inherits = &ata_bmdma_port_ops,
26236 .cable_detect = ata_cable_unknown,
26237 .set_mode = generic_set_mode,
26238 diff -urNp linux-2.6.32.49/drivers/ata/ata_piix.c linux-2.6.32.49/drivers/ata/ata_piix.c
26239 --- linux-2.6.32.49/drivers/ata/ata_piix.c 2011-11-08 19:02:43.000000000 -0500
26240 +++ linux-2.6.32.49/drivers/ata/ata_piix.c 2011-11-15 19:59:43.000000000 -0500
26241 @@ -318,7 +318,7 @@ static struct scsi_host_template piix_sh
26242 ATA_BMDMA_SHT(DRV_NAME),
26243 };
26244
26245 -static struct ata_port_operations piix_pata_ops = {
26246 +static const struct ata_port_operations piix_pata_ops = {
26247 .inherits = &ata_bmdma32_port_ops,
26248 .cable_detect = ata_cable_40wire,
26249 .set_piomode = piix_set_piomode,
26250 @@ -326,22 +326,22 @@ static struct ata_port_operations piix_p
26251 .prereset = piix_pata_prereset,
26252 };
26253
26254 -static struct ata_port_operations piix_vmw_ops = {
26255 +static const struct ata_port_operations piix_vmw_ops = {
26256 .inherits = &piix_pata_ops,
26257 .bmdma_status = piix_vmw_bmdma_status,
26258 };
26259
26260 -static struct ata_port_operations ich_pata_ops = {
26261 +static const struct ata_port_operations ich_pata_ops = {
26262 .inherits = &piix_pata_ops,
26263 .cable_detect = ich_pata_cable_detect,
26264 .set_dmamode = ich_set_dmamode,
26265 };
26266
26267 -static struct ata_port_operations piix_sata_ops = {
26268 +static const struct ata_port_operations piix_sata_ops = {
26269 .inherits = &ata_bmdma_port_ops,
26270 };
26271
26272 -static struct ata_port_operations piix_sidpr_sata_ops = {
26273 +static const struct ata_port_operations piix_sidpr_sata_ops = {
26274 .inherits = &piix_sata_ops,
26275 .hardreset = sata_std_hardreset,
26276 .scr_read = piix_sidpr_scr_read,
26277 diff -urNp linux-2.6.32.49/drivers/ata/libata-acpi.c linux-2.6.32.49/drivers/ata/libata-acpi.c
26278 --- linux-2.6.32.49/drivers/ata/libata-acpi.c 2011-11-08 19:02:43.000000000 -0500
26279 +++ linux-2.6.32.49/drivers/ata/libata-acpi.c 2011-11-15 19:59:43.000000000 -0500
26280 @@ -223,12 +223,12 @@ static void ata_acpi_dev_uevent(acpi_han
26281 ata_acpi_uevent(dev->link->ap, dev, event);
26282 }
26283
26284 -static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
26285 +static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
26286 .handler = ata_acpi_dev_notify_dock,
26287 .uevent = ata_acpi_dev_uevent,
26288 };
26289
26290 -static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
26291 +static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
26292 .handler = ata_acpi_ap_notify_dock,
26293 .uevent = ata_acpi_ap_uevent,
26294 };
26295 diff -urNp linux-2.6.32.49/drivers/ata/libata-core.c linux-2.6.32.49/drivers/ata/libata-core.c
26296 --- linux-2.6.32.49/drivers/ata/libata-core.c 2011-11-08 19:02:43.000000000 -0500
26297 +++ linux-2.6.32.49/drivers/ata/libata-core.c 2011-11-15 19:59:43.000000000 -0500
26298 @@ -4954,7 +4954,7 @@ void ata_qc_free(struct ata_queued_cmd *
26299 struct ata_port *ap;
26300 unsigned int tag;
26301
26302 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
26303 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
26304 ap = qc->ap;
26305
26306 qc->flags = 0;
26307 @@ -4970,7 +4970,7 @@ void __ata_qc_complete(struct ata_queued
26308 struct ata_port *ap;
26309 struct ata_link *link;
26310
26311 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
26312 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
26313 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
26314 ap = qc->ap;
26315 link = qc->dev->link;
26316 @@ -5987,7 +5987,7 @@ static void ata_host_stop(struct device
26317 * LOCKING:
26318 * None.
26319 */
26320 -static void ata_finalize_port_ops(struct ata_port_operations *ops)
26321 +static void ata_finalize_port_ops(const struct ata_port_operations *ops)
26322 {
26323 static DEFINE_SPINLOCK(lock);
26324 const struct ata_port_operations *cur;
26325 @@ -5999,6 +5999,7 @@ static void ata_finalize_port_ops(struct
26326 return;
26327
26328 spin_lock(&lock);
26329 + pax_open_kernel();
26330
26331 for (cur = ops->inherits; cur; cur = cur->inherits) {
26332 void **inherit = (void **)cur;
26333 @@ -6012,8 +6013,9 @@ static void ata_finalize_port_ops(struct
26334 if (IS_ERR(*pp))
26335 *pp = NULL;
26336
26337 - ops->inherits = NULL;
26338 + *(struct ata_port_operations **)&ops->inherits = NULL;
26339
26340 + pax_close_kernel();
26341 spin_unlock(&lock);
26342 }
26343
26344 @@ -6110,7 +6112,7 @@ int ata_host_start(struct ata_host *host
26345 */
26346 /* KILLME - the only user left is ipr */
26347 void ata_host_init(struct ata_host *host, struct device *dev,
26348 - unsigned long flags, struct ata_port_operations *ops)
26349 + unsigned long flags, const struct ata_port_operations *ops)
26350 {
26351 spin_lock_init(&host->lock);
26352 host->dev = dev;
26353 @@ -6773,7 +6775,7 @@ static void ata_dummy_error_handler(stru
26354 /* truly dummy */
26355 }
26356
26357 -struct ata_port_operations ata_dummy_port_ops = {
26358 +const struct ata_port_operations ata_dummy_port_ops = {
26359 .qc_prep = ata_noop_qc_prep,
26360 .qc_issue = ata_dummy_qc_issue,
26361 .error_handler = ata_dummy_error_handler,
26362 diff -urNp linux-2.6.32.49/drivers/ata/libata-eh.c linux-2.6.32.49/drivers/ata/libata-eh.c
26363 --- linux-2.6.32.49/drivers/ata/libata-eh.c 2011-11-08 19:02:43.000000000 -0500
26364 +++ linux-2.6.32.49/drivers/ata/libata-eh.c 2011-11-15 19:59:43.000000000 -0500
26365 @@ -2423,6 +2423,8 @@ void ata_eh_report(struct ata_port *ap)
26366 {
26367 struct ata_link *link;
26368
26369 + pax_track_stack();
26370 +
26371 ata_for_each_link(link, ap, HOST_FIRST)
26372 ata_eh_link_report(link);
26373 }
26374 @@ -3594,7 +3596,7 @@ void ata_do_eh(struct ata_port *ap, ata_
26375 */
26376 void ata_std_error_handler(struct ata_port *ap)
26377 {
26378 - struct ata_port_operations *ops = ap->ops;
26379 + const struct ata_port_operations *ops = ap->ops;
26380 ata_reset_fn_t hardreset = ops->hardreset;
26381
26382 /* ignore built-in hardreset if SCR access is not available */
26383 diff -urNp linux-2.6.32.49/drivers/ata/libata-pmp.c linux-2.6.32.49/drivers/ata/libata-pmp.c
26384 --- linux-2.6.32.49/drivers/ata/libata-pmp.c 2011-11-08 19:02:43.000000000 -0500
26385 +++ linux-2.6.32.49/drivers/ata/libata-pmp.c 2011-11-15 19:59:43.000000000 -0500
26386 @@ -841,7 +841,7 @@ static int sata_pmp_handle_link_fail(str
26387 */
26388 static int sata_pmp_eh_recover(struct ata_port *ap)
26389 {
26390 - struct ata_port_operations *ops = ap->ops;
26391 + const struct ata_port_operations *ops = ap->ops;
26392 int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
26393 struct ata_link *pmp_link = &ap->link;
26394 struct ata_device *pmp_dev = pmp_link->device;
26395 diff -urNp linux-2.6.32.49/drivers/ata/pata_acpi.c linux-2.6.32.49/drivers/ata/pata_acpi.c
26396 --- linux-2.6.32.49/drivers/ata/pata_acpi.c 2011-11-08 19:02:43.000000000 -0500
26397 +++ linux-2.6.32.49/drivers/ata/pata_acpi.c 2011-11-15 19:59:43.000000000 -0500
26398 @@ -215,7 +215,7 @@ static struct scsi_host_template pacpi_s
26399 ATA_BMDMA_SHT(DRV_NAME),
26400 };
26401
26402 -static struct ata_port_operations pacpi_ops = {
26403 +static const struct ata_port_operations pacpi_ops = {
26404 .inherits = &ata_bmdma_port_ops,
26405 .qc_issue = pacpi_qc_issue,
26406 .cable_detect = pacpi_cable_detect,
26407 diff -urNp linux-2.6.32.49/drivers/ata/pata_ali.c linux-2.6.32.49/drivers/ata/pata_ali.c
26408 --- linux-2.6.32.49/drivers/ata/pata_ali.c 2011-11-08 19:02:43.000000000 -0500
26409 +++ linux-2.6.32.49/drivers/ata/pata_ali.c 2011-11-15 19:59:43.000000000 -0500
26410 @@ -365,7 +365,7 @@ static struct scsi_host_template ali_sht
26411 * Port operations for PIO only ALi
26412 */
26413
26414 -static struct ata_port_operations ali_early_port_ops = {
26415 +static const struct ata_port_operations ali_early_port_ops = {
26416 .inherits = &ata_sff_port_ops,
26417 .cable_detect = ata_cable_40wire,
26418 .set_piomode = ali_set_piomode,
26419 @@ -382,7 +382,7 @@ static const struct ata_port_operations
26420 * Port operations for DMA capable ALi without cable
26421 * detect
26422 */
26423 -static struct ata_port_operations ali_20_port_ops = {
26424 +static const struct ata_port_operations ali_20_port_ops = {
26425 .inherits = &ali_dma_base_ops,
26426 .cable_detect = ata_cable_40wire,
26427 .mode_filter = ali_20_filter,
26428 @@ -393,7 +393,7 @@ static struct ata_port_operations ali_20
26429 /*
26430 * Port operations for DMA capable ALi with cable detect
26431 */
26432 -static struct ata_port_operations ali_c2_port_ops = {
26433 +static const struct ata_port_operations ali_c2_port_ops = {
26434 .inherits = &ali_dma_base_ops,
26435 .check_atapi_dma = ali_check_atapi_dma,
26436 .cable_detect = ali_c2_cable_detect,
26437 @@ -404,7 +404,7 @@ static struct ata_port_operations ali_c2
26438 /*
26439 * Port operations for DMA capable ALi with cable detect
26440 */
26441 -static struct ata_port_operations ali_c4_port_ops = {
26442 +static const struct ata_port_operations ali_c4_port_ops = {
26443 .inherits = &ali_dma_base_ops,
26444 .check_atapi_dma = ali_check_atapi_dma,
26445 .cable_detect = ali_c2_cable_detect,
26446 @@ -414,7 +414,7 @@ static struct ata_port_operations ali_c4
26447 /*
26448 * Port operations for DMA capable ALi with cable detect and LBA48
26449 */
26450 -static struct ata_port_operations ali_c5_port_ops = {
26451 +static const struct ata_port_operations ali_c5_port_ops = {
26452 .inherits = &ali_dma_base_ops,
26453 .check_atapi_dma = ali_check_atapi_dma,
26454 .dev_config = ali_warn_atapi_dma,
26455 diff -urNp linux-2.6.32.49/drivers/ata/pata_amd.c linux-2.6.32.49/drivers/ata/pata_amd.c
26456 --- linux-2.6.32.49/drivers/ata/pata_amd.c 2011-11-08 19:02:43.000000000 -0500
26457 +++ linux-2.6.32.49/drivers/ata/pata_amd.c 2011-11-15 19:59:43.000000000 -0500
26458 @@ -397,28 +397,28 @@ static const struct ata_port_operations
26459 .prereset = amd_pre_reset,
26460 };
26461
26462 -static struct ata_port_operations amd33_port_ops = {
26463 +static const struct ata_port_operations amd33_port_ops = {
26464 .inherits = &amd_base_port_ops,
26465 .cable_detect = ata_cable_40wire,
26466 .set_piomode = amd33_set_piomode,
26467 .set_dmamode = amd33_set_dmamode,
26468 };
26469
26470 -static struct ata_port_operations amd66_port_ops = {
26471 +static const struct ata_port_operations amd66_port_ops = {
26472 .inherits = &amd_base_port_ops,
26473 .cable_detect = ata_cable_unknown,
26474 .set_piomode = amd66_set_piomode,
26475 .set_dmamode = amd66_set_dmamode,
26476 };
26477
26478 -static struct ata_port_operations amd100_port_ops = {
26479 +static const struct ata_port_operations amd100_port_ops = {
26480 .inherits = &amd_base_port_ops,
26481 .cable_detect = ata_cable_unknown,
26482 .set_piomode = amd100_set_piomode,
26483 .set_dmamode = amd100_set_dmamode,
26484 };
26485
26486 -static struct ata_port_operations amd133_port_ops = {
26487 +static const struct ata_port_operations amd133_port_ops = {
26488 .inherits = &amd_base_port_ops,
26489 .cable_detect = amd_cable_detect,
26490 .set_piomode = amd133_set_piomode,
26491 @@ -433,13 +433,13 @@ static const struct ata_port_operations
26492 .host_stop = nv_host_stop,
26493 };
26494
26495 -static struct ata_port_operations nv100_port_ops = {
26496 +static const struct ata_port_operations nv100_port_ops = {
26497 .inherits = &nv_base_port_ops,
26498 .set_piomode = nv100_set_piomode,
26499 .set_dmamode = nv100_set_dmamode,
26500 };
26501
26502 -static struct ata_port_operations nv133_port_ops = {
26503 +static const struct ata_port_operations nv133_port_ops = {
26504 .inherits = &nv_base_port_ops,
26505 .set_piomode = nv133_set_piomode,
26506 .set_dmamode = nv133_set_dmamode,
26507 diff -urNp linux-2.6.32.49/drivers/ata/pata_artop.c linux-2.6.32.49/drivers/ata/pata_artop.c
26508 --- linux-2.6.32.49/drivers/ata/pata_artop.c 2011-11-08 19:02:43.000000000 -0500
26509 +++ linux-2.6.32.49/drivers/ata/pata_artop.c 2011-11-15 19:59:43.000000000 -0500
26510 @@ -311,7 +311,7 @@ static struct scsi_host_template artop_s
26511 ATA_BMDMA_SHT(DRV_NAME),
26512 };
26513
26514 -static struct ata_port_operations artop6210_ops = {
26515 +static const struct ata_port_operations artop6210_ops = {
26516 .inherits = &ata_bmdma_port_ops,
26517 .cable_detect = ata_cable_40wire,
26518 .set_piomode = artop6210_set_piomode,
26519 @@ -320,7 +320,7 @@ static struct ata_port_operations artop6
26520 .qc_defer = artop6210_qc_defer,
26521 };
26522
26523 -static struct ata_port_operations artop6260_ops = {
26524 +static const struct ata_port_operations artop6260_ops = {
26525 .inherits = &ata_bmdma_port_ops,
26526 .cable_detect = artop6260_cable_detect,
26527 .set_piomode = artop6260_set_piomode,
26528 diff -urNp linux-2.6.32.49/drivers/ata/pata_at32.c linux-2.6.32.49/drivers/ata/pata_at32.c
26529 --- linux-2.6.32.49/drivers/ata/pata_at32.c 2011-11-08 19:02:43.000000000 -0500
26530 +++ linux-2.6.32.49/drivers/ata/pata_at32.c 2011-11-15 19:59:43.000000000 -0500
26531 @@ -172,7 +172,7 @@ static struct scsi_host_template at32_sh
26532 ATA_PIO_SHT(DRV_NAME),
26533 };
26534
26535 -static struct ata_port_operations at32_port_ops = {
26536 +static const struct ata_port_operations at32_port_ops = {
26537 .inherits = &ata_sff_port_ops,
26538 .cable_detect = ata_cable_40wire,
26539 .set_piomode = pata_at32_set_piomode,
26540 diff -urNp linux-2.6.32.49/drivers/ata/pata_at91.c linux-2.6.32.49/drivers/ata/pata_at91.c
26541 --- linux-2.6.32.49/drivers/ata/pata_at91.c 2011-11-08 19:02:43.000000000 -0500
26542 +++ linux-2.6.32.49/drivers/ata/pata_at91.c 2011-11-15 19:59:43.000000000 -0500
26543 @@ -195,7 +195,7 @@ static struct scsi_host_template pata_at
26544 ATA_PIO_SHT(DRV_NAME),
26545 };
26546
26547 -static struct ata_port_operations pata_at91_port_ops = {
26548 +static const struct ata_port_operations pata_at91_port_ops = {
26549 .inherits = &ata_sff_port_ops,
26550
26551 .sff_data_xfer = pata_at91_data_xfer_noirq,
26552 diff -urNp linux-2.6.32.49/drivers/ata/pata_atiixp.c linux-2.6.32.49/drivers/ata/pata_atiixp.c
26553 --- linux-2.6.32.49/drivers/ata/pata_atiixp.c 2011-11-08 19:02:43.000000000 -0500
26554 +++ linux-2.6.32.49/drivers/ata/pata_atiixp.c 2011-11-15 19:59:43.000000000 -0500
26555 @@ -205,7 +205,7 @@ static struct scsi_host_template atiixp_
26556 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
26557 };
26558
26559 -static struct ata_port_operations atiixp_port_ops = {
26560 +static const struct ata_port_operations atiixp_port_ops = {
26561 .inherits = &ata_bmdma_port_ops,
26562
26563 .qc_prep = ata_sff_dumb_qc_prep,
26564 diff -urNp linux-2.6.32.49/drivers/ata/pata_atp867x.c linux-2.6.32.49/drivers/ata/pata_atp867x.c
26565 --- linux-2.6.32.49/drivers/ata/pata_atp867x.c 2011-11-08 19:02:43.000000000 -0500
26566 +++ linux-2.6.32.49/drivers/ata/pata_atp867x.c 2011-11-15 19:59:43.000000000 -0500
26567 @@ -274,7 +274,7 @@ static struct scsi_host_template atp867x
26568 ATA_BMDMA_SHT(DRV_NAME),
26569 };
26570
26571 -static struct ata_port_operations atp867x_ops = {
26572 +static const struct ata_port_operations atp867x_ops = {
26573 .inherits = &ata_bmdma_port_ops,
26574 .cable_detect = atp867x_cable_detect,
26575 .set_piomode = atp867x_set_piomode,
26576 diff -urNp linux-2.6.32.49/drivers/ata/pata_bf54x.c linux-2.6.32.49/drivers/ata/pata_bf54x.c
26577 --- linux-2.6.32.49/drivers/ata/pata_bf54x.c 2011-11-08 19:02:43.000000000 -0500
26578 +++ linux-2.6.32.49/drivers/ata/pata_bf54x.c 2011-11-15 19:59:43.000000000 -0500
26579 @@ -1464,7 +1464,7 @@ static struct scsi_host_template bfin_sh
26580 .dma_boundary = ATA_DMA_BOUNDARY,
26581 };
26582
26583 -static struct ata_port_operations bfin_pata_ops = {
26584 +static const struct ata_port_operations bfin_pata_ops = {
26585 .inherits = &ata_sff_port_ops,
26586
26587 .set_piomode = bfin_set_piomode,
26588 diff -urNp linux-2.6.32.49/drivers/ata/pata_cmd640.c linux-2.6.32.49/drivers/ata/pata_cmd640.c
26589 --- linux-2.6.32.49/drivers/ata/pata_cmd640.c 2011-11-08 19:02:43.000000000 -0500
26590 +++ linux-2.6.32.49/drivers/ata/pata_cmd640.c 2011-11-15 19:59:43.000000000 -0500
26591 @@ -168,7 +168,7 @@ static struct scsi_host_template cmd640_
26592 ATA_BMDMA_SHT(DRV_NAME),
26593 };
26594
26595 -static struct ata_port_operations cmd640_port_ops = {
26596 +static const struct ata_port_operations cmd640_port_ops = {
26597 .inherits = &ata_bmdma_port_ops,
26598 /* In theory xfer_noirq is not needed once we kill the prefetcher */
26599 .sff_data_xfer = ata_sff_data_xfer_noirq,
26600 diff -urNp linux-2.6.32.49/drivers/ata/pata_cmd64x.c linux-2.6.32.49/drivers/ata/pata_cmd64x.c
26601 --- linux-2.6.32.49/drivers/ata/pata_cmd64x.c 2011-11-08 19:02:43.000000000 -0500
26602 +++ linux-2.6.32.49/drivers/ata/pata_cmd64x.c 2011-11-15 19:59:43.000000000 -0500
26603 @@ -271,18 +271,18 @@ static const struct ata_port_operations
26604 .set_dmamode = cmd64x_set_dmamode,
26605 };
26606
26607 -static struct ata_port_operations cmd64x_port_ops = {
26608 +static const struct ata_port_operations cmd64x_port_ops = {
26609 .inherits = &cmd64x_base_ops,
26610 .cable_detect = ata_cable_40wire,
26611 };
26612
26613 -static struct ata_port_operations cmd646r1_port_ops = {
26614 +static const struct ata_port_operations cmd646r1_port_ops = {
26615 .inherits = &cmd64x_base_ops,
26616 .bmdma_stop = cmd646r1_bmdma_stop,
26617 .cable_detect = ata_cable_40wire,
26618 };
26619
26620 -static struct ata_port_operations cmd648_port_ops = {
26621 +static const struct ata_port_operations cmd648_port_ops = {
26622 .inherits = &cmd64x_base_ops,
26623 .bmdma_stop = cmd648_bmdma_stop,
26624 .cable_detect = cmd648_cable_detect,
26625 diff -urNp linux-2.6.32.49/drivers/ata/pata_cs5520.c linux-2.6.32.49/drivers/ata/pata_cs5520.c
26626 --- linux-2.6.32.49/drivers/ata/pata_cs5520.c 2011-11-08 19:02:43.000000000 -0500
26627 +++ linux-2.6.32.49/drivers/ata/pata_cs5520.c 2011-11-15 19:59:43.000000000 -0500
26628 @@ -144,7 +144,7 @@ static struct scsi_host_template cs5520_
26629 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
26630 };
26631
26632 -static struct ata_port_operations cs5520_port_ops = {
26633 +static const struct ata_port_operations cs5520_port_ops = {
26634 .inherits = &ata_bmdma_port_ops,
26635 .qc_prep = ata_sff_dumb_qc_prep,
26636 .cable_detect = ata_cable_40wire,
26637 diff -urNp linux-2.6.32.49/drivers/ata/pata_cs5530.c linux-2.6.32.49/drivers/ata/pata_cs5530.c
26638 --- linux-2.6.32.49/drivers/ata/pata_cs5530.c 2011-11-08 19:02:43.000000000 -0500
26639 +++ linux-2.6.32.49/drivers/ata/pata_cs5530.c 2011-11-15 19:59:43.000000000 -0500
26640 @@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
26641 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
26642 };
26643
26644 -static struct ata_port_operations cs5530_port_ops = {
26645 +static const struct ata_port_operations cs5530_port_ops = {
26646 .inherits = &ata_bmdma_port_ops,
26647
26648 .qc_prep = ata_sff_dumb_qc_prep,
26649 diff -urNp linux-2.6.32.49/drivers/ata/pata_cs5535.c linux-2.6.32.49/drivers/ata/pata_cs5535.c
26650 --- linux-2.6.32.49/drivers/ata/pata_cs5535.c 2011-11-08 19:02:43.000000000 -0500
26651 +++ linux-2.6.32.49/drivers/ata/pata_cs5535.c 2011-11-15 19:59:43.000000000 -0500
26652 @@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
26653 ATA_BMDMA_SHT(DRV_NAME),
26654 };
26655
26656 -static struct ata_port_operations cs5535_port_ops = {
26657 +static const struct ata_port_operations cs5535_port_ops = {
26658 .inherits = &ata_bmdma_port_ops,
26659 .cable_detect = cs5535_cable_detect,
26660 .set_piomode = cs5535_set_piomode,
26661 diff -urNp linux-2.6.32.49/drivers/ata/pata_cs5536.c linux-2.6.32.49/drivers/ata/pata_cs5536.c
26662 --- linux-2.6.32.49/drivers/ata/pata_cs5536.c 2011-11-08 19:02:43.000000000 -0500
26663 +++ linux-2.6.32.49/drivers/ata/pata_cs5536.c 2011-11-15 19:59:43.000000000 -0500
26664 @@ -223,7 +223,7 @@ static struct scsi_host_template cs5536_
26665 ATA_BMDMA_SHT(DRV_NAME),
26666 };
26667
26668 -static struct ata_port_operations cs5536_port_ops = {
26669 +static const struct ata_port_operations cs5536_port_ops = {
26670 .inherits = &ata_bmdma_port_ops,
26671 .cable_detect = cs5536_cable_detect,
26672 .set_piomode = cs5536_set_piomode,
26673 diff -urNp linux-2.6.32.49/drivers/ata/pata_cypress.c linux-2.6.32.49/drivers/ata/pata_cypress.c
26674 --- linux-2.6.32.49/drivers/ata/pata_cypress.c 2011-11-08 19:02:43.000000000 -0500
26675 +++ linux-2.6.32.49/drivers/ata/pata_cypress.c 2011-11-15 19:59:43.000000000 -0500
26676 @@ -113,7 +113,7 @@ static struct scsi_host_template cy82c69
26677 ATA_BMDMA_SHT(DRV_NAME),
26678 };
26679
26680 -static struct ata_port_operations cy82c693_port_ops = {
26681 +static const struct ata_port_operations cy82c693_port_ops = {
26682 .inherits = &ata_bmdma_port_ops,
26683 .cable_detect = ata_cable_40wire,
26684 .set_piomode = cy82c693_set_piomode,
26685 diff -urNp linux-2.6.32.49/drivers/ata/pata_efar.c linux-2.6.32.49/drivers/ata/pata_efar.c
26686 --- linux-2.6.32.49/drivers/ata/pata_efar.c 2011-11-08 19:02:43.000000000 -0500
26687 +++ linux-2.6.32.49/drivers/ata/pata_efar.c 2011-11-15 19:59:43.000000000 -0500
26688 @@ -222,7 +222,7 @@ static struct scsi_host_template efar_sh
26689 ATA_BMDMA_SHT(DRV_NAME),
26690 };
26691
26692 -static struct ata_port_operations efar_ops = {
26693 +static const struct ata_port_operations efar_ops = {
26694 .inherits = &ata_bmdma_port_ops,
26695 .cable_detect = efar_cable_detect,
26696 .set_piomode = efar_set_piomode,
26697 diff -urNp linux-2.6.32.49/drivers/ata/pata_hpt366.c linux-2.6.32.49/drivers/ata/pata_hpt366.c
26698 --- linux-2.6.32.49/drivers/ata/pata_hpt366.c 2011-11-08 19:02:43.000000000 -0500
26699 +++ linux-2.6.32.49/drivers/ata/pata_hpt366.c 2011-11-15 19:59:43.000000000 -0500
26700 @@ -282,7 +282,7 @@ static struct scsi_host_template hpt36x_
26701 * Configuration for HPT366/68
26702 */
26703
26704 -static struct ata_port_operations hpt366_port_ops = {
26705 +static const struct ata_port_operations hpt366_port_ops = {
26706 .inherits = &ata_bmdma_port_ops,
26707 .cable_detect = hpt36x_cable_detect,
26708 .mode_filter = hpt366_filter,
26709 diff -urNp linux-2.6.32.49/drivers/ata/pata_hpt37x.c linux-2.6.32.49/drivers/ata/pata_hpt37x.c
26710 --- linux-2.6.32.49/drivers/ata/pata_hpt37x.c 2011-11-08 19:02:43.000000000 -0500
26711 +++ linux-2.6.32.49/drivers/ata/pata_hpt37x.c 2011-11-15 19:59:43.000000000 -0500
26712 @@ -576,7 +576,7 @@ static struct scsi_host_template hpt37x_
26713 * Configuration for HPT370
26714 */
26715
26716 -static struct ata_port_operations hpt370_port_ops = {
26717 +static const struct ata_port_operations hpt370_port_ops = {
26718 .inherits = &ata_bmdma_port_ops,
26719
26720 .bmdma_stop = hpt370_bmdma_stop,
26721 @@ -591,7 +591,7 @@ static struct ata_port_operations hpt370
26722 * Configuration for HPT370A. Close to 370 but less filters
26723 */
26724
26725 -static struct ata_port_operations hpt370a_port_ops = {
26726 +static const struct ata_port_operations hpt370a_port_ops = {
26727 .inherits = &hpt370_port_ops,
26728 .mode_filter = hpt370a_filter,
26729 };
26730 @@ -601,7 +601,7 @@ static struct ata_port_operations hpt370
26731 * and DMA mode setting functionality.
26732 */
26733
26734 -static struct ata_port_operations hpt372_port_ops = {
26735 +static const struct ata_port_operations hpt372_port_ops = {
26736 .inherits = &ata_bmdma_port_ops,
26737
26738 .bmdma_stop = hpt37x_bmdma_stop,
26739 @@ -616,7 +616,7 @@ static struct ata_port_operations hpt372
26740 * but we have a different cable detection procedure for function 1.
26741 */
26742
26743 -static struct ata_port_operations hpt374_fn1_port_ops = {
26744 +static const struct ata_port_operations hpt374_fn1_port_ops = {
26745 .inherits = &hpt372_port_ops,
26746 .prereset = hpt374_fn1_pre_reset,
26747 };
26748 diff -urNp linux-2.6.32.49/drivers/ata/pata_hpt3x2n.c linux-2.6.32.49/drivers/ata/pata_hpt3x2n.c
26749 --- linux-2.6.32.49/drivers/ata/pata_hpt3x2n.c 2011-11-08 19:02:43.000000000 -0500
26750 +++ linux-2.6.32.49/drivers/ata/pata_hpt3x2n.c 2011-11-15 19:59:43.000000000 -0500
26751 @@ -337,7 +337,7 @@ static struct scsi_host_template hpt3x2n
26752 * Configuration for HPT3x2n.
26753 */
26754
26755 -static struct ata_port_operations hpt3x2n_port_ops = {
26756 +static const struct ata_port_operations hpt3x2n_port_ops = {
26757 .inherits = &ata_bmdma_port_ops,
26758
26759 .bmdma_stop = hpt3x2n_bmdma_stop,
26760 diff -urNp linux-2.6.32.49/drivers/ata/pata_hpt3x3.c linux-2.6.32.49/drivers/ata/pata_hpt3x3.c
26761 --- linux-2.6.32.49/drivers/ata/pata_hpt3x3.c 2011-11-08 19:02:43.000000000 -0500
26762 +++ linux-2.6.32.49/drivers/ata/pata_hpt3x3.c 2011-11-15 19:59:43.000000000 -0500
26763 @@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
26764 ATA_BMDMA_SHT(DRV_NAME),
26765 };
26766
26767 -static struct ata_port_operations hpt3x3_port_ops = {
26768 +static const struct ata_port_operations hpt3x3_port_ops = {
26769 .inherits = &ata_bmdma_port_ops,
26770 .cable_detect = ata_cable_40wire,
26771 .set_piomode = hpt3x3_set_piomode,
26772 diff -urNp linux-2.6.32.49/drivers/ata/pata_icside.c linux-2.6.32.49/drivers/ata/pata_icside.c
26773 --- linux-2.6.32.49/drivers/ata/pata_icside.c 2011-11-08 19:02:43.000000000 -0500
26774 +++ linux-2.6.32.49/drivers/ata/pata_icside.c 2011-11-15 19:59:43.000000000 -0500
26775 @@ -319,7 +319,7 @@ static void pata_icside_postreset(struct
26776 }
26777 }
26778
26779 -static struct ata_port_operations pata_icside_port_ops = {
26780 +static const struct ata_port_operations pata_icside_port_ops = {
26781 .inherits = &ata_sff_port_ops,
26782 /* no need to build any PRD tables for DMA */
26783 .qc_prep = ata_noop_qc_prep,
26784 diff -urNp linux-2.6.32.49/drivers/ata/pata_isapnp.c linux-2.6.32.49/drivers/ata/pata_isapnp.c
26785 --- linux-2.6.32.49/drivers/ata/pata_isapnp.c 2011-11-08 19:02:43.000000000 -0500
26786 +++ linux-2.6.32.49/drivers/ata/pata_isapnp.c 2011-11-15 19:59:43.000000000 -0500
26787 @@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
26788 ATA_PIO_SHT(DRV_NAME),
26789 };
26790
26791 -static struct ata_port_operations isapnp_port_ops = {
26792 +static const struct ata_port_operations isapnp_port_ops = {
26793 .inherits = &ata_sff_port_ops,
26794 .cable_detect = ata_cable_40wire,
26795 };
26796
26797 -static struct ata_port_operations isapnp_noalt_port_ops = {
26798 +static const struct ata_port_operations isapnp_noalt_port_ops = {
26799 .inherits = &ata_sff_port_ops,
26800 .cable_detect = ata_cable_40wire,
26801 /* No altstatus so we don't want to use the lost interrupt poll */
26802 diff -urNp linux-2.6.32.49/drivers/ata/pata_it8213.c linux-2.6.32.49/drivers/ata/pata_it8213.c
26803 --- linux-2.6.32.49/drivers/ata/pata_it8213.c 2011-11-08 19:02:43.000000000 -0500
26804 +++ linux-2.6.32.49/drivers/ata/pata_it8213.c 2011-11-15 19:59:43.000000000 -0500
26805 @@ -234,7 +234,7 @@ static struct scsi_host_template it8213_
26806 };
26807
26808
26809 -static struct ata_port_operations it8213_ops = {
26810 +static const struct ata_port_operations it8213_ops = {
26811 .inherits = &ata_bmdma_port_ops,
26812 .cable_detect = it8213_cable_detect,
26813 .set_piomode = it8213_set_piomode,
26814 diff -urNp linux-2.6.32.49/drivers/ata/pata_it821x.c linux-2.6.32.49/drivers/ata/pata_it821x.c
26815 --- linux-2.6.32.49/drivers/ata/pata_it821x.c 2011-11-08 19:02:43.000000000 -0500
26816 +++ linux-2.6.32.49/drivers/ata/pata_it821x.c 2011-11-15 19:59:43.000000000 -0500
26817 @@ -800,7 +800,7 @@ static struct scsi_host_template it821x_
26818 ATA_BMDMA_SHT(DRV_NAME),
26819 };
26820
26821 -static struct ata_port_operations it821x_smart_port_ops = {
26822 +static const struct ata_port_operations it821x_smart_port_ops = {
26823 .inherits = &ata_bmdma_port_ops,
26824
26825 .check_atapi_dma= it821x_check_atapi_dma,
26826 @@ -814,7 +814,7 @@ static struct ata_port_operations it821x
26827 .port_start = it821x_port_start,
26828 };
26829
26830 -static struct ata_port_operations it821x_passthru_port_ops = {
26831 +static const struct ata_port_operations it821x_passthru_port_ops = {
26832 .inherits = &ata_bmdma_port_ops,
26833
26834 .check_atapi_dma= it821x_check_atapi_dma,
26835 @@ -830,7 +830,7 @@ static struct ata_port_operations it821x
26836 .port_start = it821x_port_start,
26837 };
26838
26839 -static struct ata_port_operations it821x_rdc_port_ops = {
26840 +static const struct ata_port_operations it821x_rdc_port_ops = {
26841 .inherits = &ata_bmdma_port_ops,
26842
26843 .check_atapi_dma= it821x_check_atapi_dma,
26844 diff -urNp linux-2.6.32.49/drivers/ata/pata_ixp4xx_cf.c linux-2.6.32.49/drivers/ata/pata_ixp4xx_cf.c
26845 --- linux-2.6.32.49/drivers/ata/pata_ixp4xx_cf.c 2011-11-08 19:02:43.000000000 -0500
26846 +++ linux-2.6.32.49/drivers/ata/pata_ixp4xx_cf.c 2011-11-15 19:59:43.000000000 -0500
26847 @@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
26848 ATA_PIO_SHT(DRV_NAME),
26849 };
26850
26851 -static struct ata_port_operations ixp4xx_port_ops = {
26852 +static const struct ata_port_operations ixp4xx_port_ops = {
26853 .inherits = &ata_sff_port_ops,
26854 .sff_data_xfer = ixp4xx_mmio_data_xfer,
26855 .cable_detect = ata_cable_40wire,
26856 diff -urNp linux-2.6.32.49/drivers/ata/pata_jmicron.c linux-2.6.32.49/drivers/ata/pata_jmicron.c
26857 --- linux-2.6.32.49/drivers/ata/pata_jmicron.c 2011-11-08 19:02:43.000000000 -0500
26858 +++ linux-2.6.32.49/drivers/ata/pata_jmicron.c 2011-11-15 19:59:43.000000000 -0500
26859 @@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
26860 ATA_BMDMA_SHT(DRV_NAME),
26861 };
26862
26863 -static struct ata_port_operations jmicron_ops = {
26864 +static const struct ata_port_operations jmicron_ops = {
26865 .inherits = &ata_bmdma_port_ops,
26866 .prereset = jmicron_pre_reset,
26867 };
26868 diff -urNp linux-2.6.32.49/drivers/ata/pata_legacy.c linux-2.6.32.49/drivers/ata/pata_legacy.c
26869 --- linux-2.6.32.49/drivers/ata/pata_legacy.c 2011-11-08 19:02:43.000000000 -0500
26870 +++ linux-2.6.32.49/drivers/ata/pata_legacy.c 2011-11-15 19:59:43.000000000 -0500
26871 @@ -106,7 +106,7 @@ struct legacy_probe {
26872
26873 struct legacy_controller {
26874 const char *name;
26875 - struct ata_port_operations *ops;
26876 + const struct ata_port_operations *ops;
26877 unsigned int pio_mask;
26878 unsigned int flags;
26879 unsigned int pflags;
26880 @@ -223,12 +223,12 @@ static const struct ata_port_operations
26881 * pio_mask as well.
26882 */
26883
26884 -static struct ata_port_operations simple_port_ops = {
26885 +static const struct ata_port_operations simple_port_ops = {
26886 .inherits = &legacy_base_port_ops,
26887 .sff_data_xfer = ata_sff_data_xfer_noirq,
26888 };
26889
26890 -static struct ata_port_operations legacy_port_ops = {
26891 +static const struct ata_port_operations legacy_port_ops = {
26892 .inherits = &legacy_base_port_ops,
26893 .sff_data_xfer = ata_sff_data_xfer_noirq,
26894 .set_mode = legacy_set_mode,
26895 @@ -324,7 +324,7 @@ static unsigned int pdc_data_xfer_vlb(st
26896 return buflen;
26897 }
26898
26899 -static struct ata_port_operations pdc20230_port_ops = {
26900 +static const struct ata_port_operations pdc20230_port_ops = {
26901 .inherits = &legacy_base_port_ops,
26902 .set_piomode = pdc20230_set_piomode,
26903 .sff_data_xfer = pdc_data_xfer_vlb,
26904 @@ -357,7 +357,7 @@ static void ht6560a_set_piomode(struct a
26905 ioread8(ap->ioaddr.status_addr);
26906 }
26907
26908 -static struct ata_port_operations ht6560a_port_ops = {
26909 +static const struct ata_port_operations ht6560a_port_ops = {
26910 .inherits = &legacy_base_port_ops,
26911 .set_piomode = ht6560a_set_piomode,
26912 };
26913 @@ -400,7 +400,7 @@ static void ht6560b_set_piomode(struct a
26914 ioread8(ap->ioaddr.status_addr);
26915 }
26916
26917 -static struct ata_port_operations ht6560b_port_ops = {
26918 +static const struct ata_port_operations ht6560b_port_ops = {
26919 .inherits = &legacy_base_port_ops,
26920 .set_piomode = ht6560b_set_piomode,
26921 };
26922 @@ -499,7 +499,7 @@ static void opti82c611a_set_piomode(stru
26923 }
26924
26925
26926 -static struct ata_port_operations opti82c611a_port_ops = {
26927 +static const struct ata_port_operations opti82c611a_port_ops = {
26928 .inherits = &legacy_base_port_ops,
26929 .set_piomode = opti82c611a_set_piomode,
26930 };
26931 @@ -609,7 +609,7 @@ static unsigned int opti82c46x_qc_issue(
26932 return ata_sff_qc_issue(qc);
26933 }
26934
26935 -static struct ata_port_operations opti82c46x_port_ops = {
26936 +static const struct ata_port_operations opti82c46x_port_ops = {
26937 .inherits = &legacy_base_port_ops,
26938 .set_piomode = opti82c46x_set_piomode,
26939 .qc_issue = opti82c46x_qc_issue,
26940 @@ -771,20 +771,20 @@ static int qdi_port(struct platform_devi
26941 return 0;
26942 }
26943
26944 -static struct ata_port_operations qdi6500_port_ops = {
26945 +static const struct ata_port_operations qdi6500_port_ops = {
26946 .inherits = &legacy_base_port_ops,
26947 .set_piomode = qdi6500_set_piomode,
26948 .qc_issue = qdi_qc_issue,
26949 .sff_data_xfer = vlb32_data_xfer,
26950 };
26951
26952 -static struct ata_port_operations qdi6580_port_ops = {
26953 +static const struct ata_port_operations qdi6580_port_ops = {
26954 .inherits = &legacy_base_port_ops,
26955 .set_piomode = qdi6580_set_piomode,
26956 .sff_data_xfer = vlb32_data_xfer,
26957 };
26958
26959 -static struct ata_port_operations qdi6580dp_port_ops = {
26960 +static const struct ata_port_operations qdi6580dp_port_ops = {
26961 .inherits = &legacy_base_port_ops,
26962 .set_piomode = qdi6580dp_set_piomode,
26963 .sff_data_xfer = vlb32_data_xfer,
26964 @@ -855,7 +855,7 @@ static int winbond_port(struct platform_
26965 return 0;
26966 }
26967
26968 -static struct ata_port_operations winbond_port_ops = {
26969 +static const struct ata_port_operations winbond_port_ops = {
26970 .inherits = &legacy_base_port_ops,
26971 .set_piomode = winbond_set_piomode,
26972 .sff_data_xfer = vlb32_data_xfer,
26973 @@ -978,7 +978,7 @@ static __init int legacy_init_one(struct
26974 int pio_modes = controller->pio_mask;
26975 unsigned long io = probe->port;
26976 u32 mask = (1 << probe->slot);
26977 - struct ata_port_operations *ops = controller->ops;
26978 + const struct ata_port_operations *ops = controller->ops;
26979 struct legacy_data *ld = &legacy_data[probe->slot];
26980 struct ata_host *host = NULL;
26981 struct ata_port *ap;
26982 diff -urNp linux-2.6.32.49/drivers/ata/pata_marvell.c linux-2.6.32.49/drivers/ata/pata_marvell.c
26983 --- linux-2.6.32.49/drivers/ata/pata_marvell.c 2011-11-08 19:02:43.000000000 -0500
26984 +++ linux-2.6.32.49/drivers/ata/pata_marvell.c 2011-11-15 19:59:43.000000000 -0500
26985 @@ -100,7 +100,7 @@ static struct scsi_host_template marvell
26986 ATA_BMDMA_SHT(DRV_NAME),
26987 };
26988
26989 -static struct ata_port_operations marvell_ops = {
26990 +static const struct ata_port_operations marvell_ops = {
26991 .inherits = &ata_bmdma_port_ops,
26992 .cable_detect = marvell_cable_detect,
26993 .prereset = marvell_pre_reset,
26994 diff -urNp linux-2.6.32.49/drivers/ata/pata_mpc52xx.c linux-2.6.32.49/drivers/ata/pata_mpc52xx.c
26995 --- linux-2.6.32.49/drivers/ata/pata_mpc52xx.c 2011-11-08 19:02:43.000000000 -0500
26996 +++ linux-2.6.32.49/drivers/ata/pata_mpc52xx.c 2011-11-15 19:59:43.000000000 -0500
26997 @@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
26998 ATA_PIO_SHT(DRV_NAME),
26999 };
27000
27001 -static struct ata_port_operations mpc52xx_ata_port_ops = {
27002 +static const struct ata_port_operations mpc52xx_ata_port_ops = {
27003 .inherits = &ata_bmdma_port_ops,
27004 .sff_dev_select = mpc52xx_ata_dev_select,
27005 .set_piomode = mpc52xx_ata_set_piomode,
27006 diff -urNp linux-2.6.32.49/drivers/ata/pata_mpiix.c linux-2.6.32.49/drivers/ata/pata_mpiix.c
27007 --- linux-2.6.32.49/drivers/ata/pata_mpiix.c 2011-11-08 19:02:43.000000000 -0500
27008 +++ linux-2.6.32.49/drivers/ata/pata_mpiix.c 2011-11-15 19:59:43.000000000 -0500
27009 @@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
27010 ATA_PIO_SHT(DRV_NAME),
27011 };
27012
27013 -static struct ata_port_operations mpiix_port_ops = {
27014 +static const struct ata_port_operations mpiix_port_ops = {
27015 .inherits = &ata_sff_port_ops,
27016 .qc_issue = mpiix_qc_issue,
27017 .cable_detect = ata_cable_40wire,
27018 diff -urNp linux-2.6.32.49/drivers/ata/pata_netcell.c linux-2.6.32.49/drivers/ata/pata_netcell.c
27019 --- linux-2.6.32.49/drivers/ata/pata_netcell.c 2011-11-08 19:02:43.000000000 -0500
27020 +++ linux-2.6.32.49/drivers/ata/pata_netcell.c 2011-11-15 19:59:43.000000000 -0500
27021 @@ -34,7 +34,7 @@ static struct scsi_host_template netcell
27022 ATA_BMDMA_SHT(DRV_NAME),
27023 };
27024
27025 -static struct ata_port_operations netcell_ops = {
27026 +static const struct ata_port_operations netcell_ops = {
27027 .inherits = &ata_bmdma_port_ops,
27028 .cable_detect = ata_cable_80wire,
27029 .read_id = netcell_read_id,
27030 diff -urNp linux-2.6.32.49/drivers/ata/pata_ninja32.c linux-2.6.32.49/drivers/ata/pata_ninja32.c
27031 --- linux-2.6.32.49/drivers/ata/pata_ninja32.c 2011-11-08 19:02:43.000000000 -0500
27032 +++ linux-2.6.32.49/drivers/ata/pata_ninja32.c 2011-11-15 19:59:43.000000000 -0500
27033 @@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
27034 ATA_BMDMA_SHT(DRV_NAME),
27035 };
27036
27037 -static struct ata_port_operations ninja32_port_ops = {
27038 +static const struct ata_port_operations ninja32_port_ops = {
27039 .inherits = &ata_bmdma_port_ops,
27040 .sff_dev_select = ninja32_dev_select,
27041 .cable_detect = ata_cable_40wire,
27042 diff -urNp linux-2.6.32.49/drivers/ata/pata_ns87410.c linux-2.6.32.49/drivers/ata/pata_ns87410.c
27043 --- linux-2.6.32.49/drivers/ata/pata_ns87410.c 2011-11-08 19:02:43.000000000 -0500
27044 +++ linux-2.6.32.49/drivers/ata/pata_ns87410.c 2011-11-15 19:59:43.000000000 -0500
27045 @@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
27046 ATA_PIO_SHT(DRV_NAME),
27047 };
27048
27049 -static struct ata_port_operations ns87410_port_ops = {
27050 +static const struct ata_port_operations ns87410_port_ops = {
27051 .inherits = &ata_sff_port_ops,
27052 .qc_issue = ns87410_qc_issue,
27053 .cable_detect = ata_cable_40wire,
27054 diff -urNp linux-2.6.32.49/drivers/ata/pata_ns87415.c linux-2.6.32.49/drivers/ata/pata_ns87415.c
27055 --- linux-2.6.32.49/drivers/ata/pata_ns87415.c 2011-11-08 19:02:43.000000000 -0500
27056 +++ linux-2.6.32.49/drivers/ata/pata_ns87415.c 2011-11-15 19:59:43.000000000 -0500
27057 @@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
27058 }
27059 #endif /* 87560 SuperIO Support */
27060
27061 -static struct ata_port_operations ns87415_pata_ops = {
27062 +static const struct ata_port_operations ns87415_pata_ops = {
27063 .inherits = &ata_bmdma_port_ops,
27064
27065 .check_atapi_dma = ns87415_check_atapi_dma,
27066 @@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
27067 };
27068
27069 #if defined(CONFIG_SUPERIO)
27070 -static struct ata_port_operations ns87560_pata_ops = {
27071 +static const struct ata_port_operations ns87560_pata_ops = {
27072 .inherits = &ns87415_pata_ops,
27073 .sff_tf_read = ns87560_tf_read,
27074 .sff_check_status = ns87560_check_status,
27075 diff -urNp linux-2.6.32.49/drivers/ata/pata_octeon_cf.c linux-2.6.32.49/drivers/ata/pata_octeon_cf.c
27076 --- linux-2.6.32.49/drivers/ata/pata_octeon_cf.c 2011-11-08 19:02:43.000000000 -0500
27077 +++ linux-2.6.32.49/drivers/ata/pata_octeon_cf.c 2011-11-15 19:59:43.000000000 -0500
27078 @@ -801,6 +801,7 @@ static unsigned int octeon_cf_qc_issue(s
27079 return 0;
27080 }
27081
27082 +/* cannot be const */
27083 static struct ata_port_operations octeon_cf_ops = {
27084 .inherits = &ata_sff_port_ops,
27085 .check_atapi_dma = octeon_cf_check_atapi_dma,
27086 diff -urNp linux-2.6.32.49/drivers/ata/pata_oldpiix.c linux-2.6.32.49/drivers/ata/pata_oldpiix.c
27087 --- linux-2.6.32.49/drivers/ata/pata_oldpiix.c 2011-11-08 19:02:43.000000000 -0500
27088 +++ linux-2.6.32.49/drivers/ata/pata_oldpiix.c 2011-11-15 19:59:43.000000000 -0500
27089 @@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
27090 ATA_BMDMA_SHT(DRV_NAME),
27091 };
27092
27093 -static struct ata_port_operations oldpiix_pata_ops = {
27094 +static const struct ata_port_operations oldpiix_pata_ops = {
27095 .inherits = &ata_bmdma_port_ops,
27096 .qc_issue = oldpiix_qc_issue,
27097 .cable_detect = ata_cable_40wire,
27098 diff -urNp linux-2.6.32.49/drivers/ata/pata_opti.c linux-2.6.32.49/drivers/ata/pata_opti.c
27099 --- linux-2.6.32.49/drivers/ata/pata_opti.c 2011-11-08 19:02:43.000000000 -0500
27100 +++ linux-2.6.32.49/drivers/ata/pata_opti.c 2011-11-15 19:59:43.000000000 -0500
27101 @@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
27102 ATA_PIO_SHT(DRV_NAME),
27103 };
27104
27105 -static struct ata_port_operations opti_port_ops = {
27106 +static const struct ata_port_operations opti_port_ops = {
27107 .inherits = &ata_sff_port_ops,
27108 .cable_detect = ata_cable_40wire,
27109 .set_piomode = opti_set_piomode,
27110 diff -urNp linux-2.6.32.49/drivers/ata/pata_optidma.c linux-2.6.32.49/drivers/ata/pata_optidma.c
27111 --- linux-2.6.32.49/drivers/ata/pata_optidma.c 2011-11-08 19:02:43.000000000 -0500
27112 +++ linux-2.6.32.49/drivers/ata/pata_optidma.c 2011-11-15 19:59:43.000000000 -0500
27113 @@ -337,7 +337,7 @@ static struct scsi_host_template optidma
27114 ATA_BMDMA_SHT(DRV_NAME),
27115 };
27116
27117 -static struct ata_port_operations optidma_port_ops = {
27118 +static const struct ata_port_operations optidma_port_ops = {
27119 .inherits = &ata_bmdma_port_ops,
27120 .cable_detect = ata_cable_40wire,
27121 .set_piomode = optidma_set_pio_mode,
27122 @@ -346,7 +346,7 @@ static struct ata_port_operations optidm
27123 .prereset = optidma_pre_reset,
27124 };
27125
27126 -static struct ata_port_operations optiplus_port_ops = {
27127 +static const struct ata_port_operations optiplus_port_ops = {
27128 .inherits = &optidma_port_ops,
27129 .set_piomode = optiplus_set_pio_mode,
27130 .set_dmamode = optiplus_set_dma_mode,
27131 diff -urNp linux-2.6.32.49/drivers/ata/pata_palmld.c linux-2.6.32.49/drivers/ata/pata_palmld.c
27132 --- linux-2.6.32.49/drivers/ata/pata_palmld.c 2011-11-08 19:02:43.000000000 -0500
27133 +++ linux-2.6.32.49/drivers/ata/pata_palmld.c 2011-11-15 19:59:43.000000000 -0500
27134 @@ -37,7 +37,7 @@ static struct scsi_host_template palmld_
27135 ATA_PIO_SHT(DRV_NAME),
27136 };
27137
27138 -static struct ata_port_operations palmld_port_ops = {
27139 +static const struct ata_port_operations palmld_port_ops = {
27140 .inherits = &ata_sff_port_ops,
27141 .sff_data_xfer = ata_sff_data_xfer_noirq,
27142 .cable_detect = ata_cable_40wire,
27143 diff -urNp linux-2.6.32.49/drivers/ata/pata_pcmcia.c linux-2.6.32.49/drivers/ata/pata_pcmcia.c
27144 --- linux-2.6.32.49/drivers/ata/pata_pcmcia.c 2011-11-08 19:02:43.000000000 -0500
27145 +++ linux-2.6.32.49/drivers/ata/pata_pcmcia.c 2011-11-15 19:59:43.000000000 -0500
27146 @@ -162,14 +162,14 @@ static struct scsi_host_template pcmcia_
27147 ATA_PIO_SHT(DRV_NAME),
27148 };
27149
27150 -static struct ata_port_operations pcmcia_port_ops = {
27151 +static const struct ata_port_operations pcmcia_port_ops = {
27152 .inherits = &ata_sff_port_ops,
27153 .sff_data_xfer = ata_sff_data_xfer_noirq,
27154 .cable_detect = ata_cable_40wire,
27155 .set_mode = pcmcia_set_mode,
27156 };
27157
27158 -static struct ata_port_operations pcmcia_8bit_port_ops = {
27159 +static const struct ata_port_operations pcmcia_8bit_port_ops = {
27160 .inherits = &ata_sff_port_ops,
27161 .sff_data_xfer = ata_data_xfer_8bit,
27162 .cable_detect = ata_cable_40wire,
27163 @@ -256,7 +256,7 @@ static int pcmcia_init_one(struct pcmcia
27164 unsigned long io_base, ctl_base;
27165 void __iomem *io_addr, *ctl_addr;
27166 int n_ports = 1;
27167 - struct ata_port_operations *ops = &pcmcia_port_ops;
27168 + const struct ata_port_operations *ops = &pcmcia_port_ops;
27169
27170 info = kzalloc(sizeof(*info), GFP_KERNEL);
27171 if (info == NULL)
27172 diff -urNp linux-2.6.32.49/drivers/ata/pata_pdc2027x.c linux-2.6.32.49/drivers/ata/pata_pdc2027x.c
27173 --- linux-2.6.32.49/drivers/ata/pata_pdc2027x.c 2011-11-08 19:02:43.000000000 -0500
27174 +++ linux-2.6.32.49/drivers/ata/pata_pdc2027x.c 2011-11-15 19:59:43.000000000 -0500
27175 @@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
27176 ATA_BMDMA_SHT(DRV_NAME),
27177 };
27178
27179 -static struct ata_port_operations pdc2027x_pata100_ops = {
27180 +static const struct ata_port_operations pdc2027x_pata100_ops = {
27181 .inherits = &ata_bmdma_port_ops,
27182 .check_atapi_dma = pdc2027x_check_atapi_dma,
27183 .cable_detect = pdc2027x_cable_detect,
27184 .prereset = pdc2027x_prereset,
27185 };
27186
27187 -static struct ata_port_operations pdc2027x_pata133_ops = {
27188 +static const struct ata_port_operations pdc2027x_pata133_ops = {
27189 .inherits = &pdc2027x_pata100_ops,
27190 .mode_filter = pdc2027x_mode_filter,
27191 .set_piomode = pdc2027x_set_piomode,
27192 diff -urNp linux-2.6.32.49/drivers/ata/pata_pdc202xx_old.c linux-2.6.32.49/drivers/ata/pata_pdc202xx_old.c
27193 --- linux-2.6.32.49/drivers/ata/pata_pdc202xx_old.c 2011-11-08 19:02:43.000000000 -0500
27194 +++ linux-2.6.32.49/drivers/ata/pata_pdc202xx_old.c 2011-11-15 19:59:43.000000000 -0500
27195 @@ -274,7 +274,7 @@ static struct scsi_host_template pdc202x
27196 ATA_BMDMA_SHT(DRV_NAME),
27197 };
27198
27199 -static struct ata_port_operations pdc2024x_port_ops = {
27200 +static const struct ata_port_operations pdc2024x_port_ops = {
27201 .inherits = &ata_bmdma_port_ops,
27202
27203 .cable_detect = ata_cable_40wire,
27204 @@ -284,7 +284,7 @@ static struct ata_port_operations pdc202
27205 .sff_exec_command = pdc202xx_exec_command,
27206 };
27207
27208 -static struct ata_port_operations pdc2026x_port_ops = {
27209 +static const struct ata_port_operations pdc2026x_port_ops = {
27210 .inherits = &pdc2024x_port_ops,
27211
27212 .check_atapi_dma = pdc2026x_check_atapi_dma,
27213 diff -urNp linux-2.6.32.49/drivers/ata/pata_platform.c linux-2.6.32.49/drivers/ata/pata_platform.c
27214 --- linux-2.6.32.49/drivers/ata/pata_platform.c 2011-11-08 19:02:43.000000000 -0500
27215 +++ linux-2.6.32.49/drivers/ata/pata_platform.c 2011-11-15 19:59:43.000000000 -0500
27216 @@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
27217 ATA_PIO_SHT(DRV_NAME),
27218 };
27219
27220 -static struct ata_port_operations pata_platform_port_ops = {
27221 +static const struct ata_port_operations pata_platform_port_ops = {
27222 .inherits = &ata_sff_port_ops,
27223 .sff_data_xfer = ata_sff_data_xfer_noirq,
27224 .cable_detect = ata_cable_unknown,
27225 diff -urNp linux-2.6.32.49/drivers/ata/pata_qdi.c linux-2.6.32.49/drivers/ata/pata_qdi.c
27226 --- linux-2.6.32.49/drivers/ata/pata_qdi.c 2011-11-08 19:02:43.000000000 -0500
27227 +++ linux-2.6.32.49/drivers/ata/pata_qdi.c 2011-11-15 19:59:43.000000000 -0500
27228 @@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
27229 ATA_PIO_SHT(DRV_NAME),
27230 };
27231
27232 -static struct ata_port_operations qdi6500_port_ops = {
27233 +static const struct ata_port_operations qdi6500_port_ops = {
27234 .inherits = &ata_sff_port_ops,
27235 .qc_issue = qdi_qc_issue,
27236 .sff_data_xfer = qdi_data_xfer,
27237 @@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
27238 .set_piomode = qdi6500_set_piomode,
27239 };
27240
27241 -static struct ata_port_operations qdi6580_port_ops = {
27242 +static const struct ata_port_operations qdi6580_port_ops = {
27243 .inherits = &qdi6500_port_ops,
27244 .set_piomode = qdi6580_set_piomode,
27245 };
27246 diff -urNp linux-2.6.32.49/drivers/ata/pata_radisys.c linux-2.6.32.49/drivers/ata/pata_radisys.c
27247 --- linux-2.6.32.49/drivers/ata/pata_radisys.c 2011-11-08 19:02:43.000000000 -0500
27248 +++ linux-2.6.32.49/drivers/ata/pata_radisys.c 2011-11-15 19:59:43.000000000 -0500
27249 @@ -187,7 +187,7 @@ static struct scsi_host_template radisys
27250 ATA_BMDMA_SHT(DRV_NAME),
27251 };
27252
27253 -static struct ata_port_operations radisys_pata_ops = {
27254 +static const struct ata_port_operations radisys_pata_ops = {
27255 .inherits = &ata_bmdma_port_ops,
27256 .qc_issue = radisys_qc_issue,
27257 .cable_detect = ata_cable_unknown,
27258 diff -urNp linux-2.6.32.49/drivers/ata/pata_rb532_cf.c linux-2.6.32.49/drivers/ata/pata_rb532_cf.c
27259 --- linux-2.6.32.49/drivers/ata/pata_rb532_cf.c 2011-11-08 19:02:43.000000000 -0500
27260 +++ linux-2.6.32.49/drivers/ata/pata_rb532_cf.c 2011-11-15 19:59:43.000000000 -0500
27261 @@ -68,7 +68,7 @@ static irqreturn_t rb532_pata_irq_handle
27262 return IRQ_HANDLED;
27263 }
27264
27265 -static struct ata_port_operations rb532_pata_port_ops = {
27266 +static const struct ata_port_operations rb532_pata_port_ops = {
27267 .inherits = &ata_sff_port_ops,
27268 .sff_data_xfer = ata_sff_data_xfer32,
27269 };
27270 diff -urNp linux-2.6.32.49/drivers/ata/pata_rdc.c linux-2.6.32.49/drivers/ata/pata_rdc.c
27271 --- linux-2.6.32.49/drivers/ata/pata_rdc.c 2011-11-08 19:02:43.000000000 -0500
27272 +++ linux-2.6.32.49/drivers/ata/pata_rdc.c 2011-11-15 19:59:43.000000000 -0500
27273 @@ -272,7 +272,7 @@ static void rdc_set_dmamode(struct ata_p
27274 pci_write_config_byte(dev, 0x48, udma_enable);
27275 }
27276
27277 -static struct ata_port_operations rdc_pata_ops = {
27278 +static const struct ata_port_operations rdc_pata_ops = {
27279 .inherits = &ata_bmdma32_port_ops,
27280 .cable_detect = rdc_pata_cable_detect,
27281 .set_piomode = rdc_set_piomode,
27282 diff -urNp linux-2.6.32.49/drivers/ata/pata_rz1000.c linux-2.6.32.49/drivers/ata/pata_rz1000.c
27283 --- linux-2.6.32.49/drivers/ata/pata_rz1000.c 2011-11-08 19:02:43.000000000 -0500
27284 +++ linux-2.6.32.49/drivers/ata/pata_rz1000.c 2011-11-15 19:59:43.000000000 -0500
27285 @@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
27286 ATA_PIO_SHT(DRV_NAME),
27287 };
27288
27289 -static struct ata_port_operations rz1000_port_ops = {
27290 +static const struct ata_port_operations rz1000_port_ops = {
27291 .inherits = &ata_sff_port_ops,
27292 .cable_detect = ata_cable_40wire,
27293 .set_mode = rz1000_set_mode,
27294 diff -urNp linux-2.6.32.49/drivers/ata/pata_sc1200.c linux-2.6.32.49/drivers/ata/pata_sc1200.c
27295 --- linux-2.6.32.49/drivers/ata/pata_sc1200.c 2011-11-08 19:02:43.000000000 -0500
27296 +++ linux-2.6.32.49/drivers/ata/pata_sc1200.c 2011-11-15 19:59:43.000000000 -0500
27297 @@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
27298 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
27299 };
27300
27301 -static struct ata_port_operations sc1200_port_ops = {
27302 +static const struct ata_port_operations sc1200_port_ops = {
27303 .inherits = &ata_bmdma_port_ops,
27304 .qc_prep = ata_sff_dumb_qc_prep,
27305 .qc_issue = sc1200_qc_issue,
27306 diff -urNp linux-2.6.32.49/drivers/ata/pata_scc.c linux-2.6.32.49/drivers/ata/pata_scc.c
27307 --- linux-2.6.32.49/drivers/ata/pata_scc.c 2011-11-08 19:02:43.000000000 -0500
27308 +++ linux-2.6.32.49/drivers/ata/pata_scc.c 2011-11-15 19:59:43.000000000 -0500
27309 @@ -965,7 +965,7 @@ static struct scsi_host_template scc_sht
27310 ATA_BMDMA_SHT(DRV_NAME),
27311 };
27312
27313 -static struct ata_port_operations scc_pata_ops = {
27314 +static const struct ata_port_operations scc_pata_ops = {
27315 .inherits = &ata_bmdma_port_ops,
27316
27317 .set_piomode = scc_set_piomode,
27318 diff -urNp linux-2.6.32.49/drivers/ata/pata_sch.c linux-2.6.32.49/drivers/ata/pata_sch.c
27319 --- linux-2.6.32.49/drivers/ata/pata_sch.c 2011-11-08 19:02:43.000000000 -0500
27320 +++ linux-2.6.32.49/drivers/ata/pata_sch.c 2011-11-15 19:59:43.000000000 -0500
27321 @@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
27322 ATA_BMDMA_SHT(DRV_NAME),
27323 };
27324
27325 -static struct ata_port_operations sch_pata_ops = {
27326 +static const struct ata_port_operations sch_pata_ops = {
27327 .inherits = &ata_bmdma_port_ops,
27328 .cable_detect = ata_cable_unknown,
27329 .set_piomode = sch_set_piomode,
27330 diff -urNp linux-2.6.32.49/drivers/ata/pata_serverworks.c linux-2.6.32.49/drivers/ata/pata_serverworks.c
27331 --- linux-2.6.32.49/drivers/ata/pata_serverworks.c 2011-11-08 19:02:43.000000000 -0500
27332 +++ linux-2.6.32.49/drivers/ata/pata_serverworks.c 2011-11-15 19:59:43.000000000 -0500
27333 @@ -299,7 +299,7 @@ static struct scsi_host_template serverw
27334 ATA_BMDMA_SHT(DRV_NAME),
27335 };
27336
27337 -static struct ata_port_operations serverworks_osb4_port_ops = {
27338 +static const struct ata_port_operations serverworks_osb4_port_ops = {
27339 .inherits = &ata_bmdma_port_ops,
27340 .cable_detect = serverworks_cable_detect,
27341 .mode_filter = serverworks_osb4_filter,
27342 @@ -307,7 +307,7 @@ static struct ata_port_operations server
27343 .set_dmamode = serverworks_set_dmamode,
27344 };
27345
27346 -static struct ata_port_operations serverworks_csb_port_ops = {
27347 +static const struct ata_port_operations serverworks_csb_port_ops = {
27348 .inherits = &serverworks_osb4_port_ops,
27349 .mode_filter = serverworks_csb_filter,
27350 };
27351 diff -urNp linux-2.6.32.49/drivers/ata/pata_sil680.c linux-2.6.32.49/drivers/ata/pata_sil680.c
27352 --- linux-2.6.32.49/drivers/ata/pata_sil680.c 2011-11-08 19:02:43.000000000 -0500
27353 +++ linux-2.6.32.49/drivers/ata/pata_sil680.c 2011-11-15 19:59:43.000000000 -0500
27354 @@ -194,7 +194,7 @@ static struct scsi_host_template sil680_
27355 ATA_BMDMA_SHT(DRV_NAME),
27356 };
27357
27358 -static struct ata_port_operations sil680_port_ops = {
27359 +static const struct ata_port_operations sil680_port_ops = {
27360 .inherits = &ata_bmdma32_port_ops,
27361 .cable_detect = sil680_cable_detect,
27362 .set_piomode = sil680_set_piomode,
27363 diff -urNp linux-2.6.32.49/drivers/ata/pata_sis.c linux-2.6.32.49/drivers/ata/pata_sis.c
27364 --- linux-2.6.32.49/drivers/ata/pata_sis.c 2011-11-08 19:02:43.000000000 -0500
27365 +++ linux-2.6.32.49/drivers/ata/pata_sis.c 2011-11-15 19:59:43.000000000 -0500
27366 @@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
27367 ATA_BMDMA_SHT(DRV_NAME),
27368 };
27369
27370 -static struct ata_port_operations sis_133_for_sata_ops = {
27371 +static const struct ata_port_operations sis_133_for_sata_ops = {
27372 .inherits = &ata_bmdma_port_ops,
27373 .set_piomode = sis_133_set_piomode,
27374 .set_dmamode = sis_133_set_dmamode,
27375 .cable_detect = sis_133_cable_detect,
27376 };
27377
27378 -static struct ata_port_operations sis_base_ops = {
27379 +static const struct ata_port_operations sis_base_ops = {
27380 .inherits = &ata_bmdma_port_ops,
27381 .prereset = sis_pre_reset,
27382 };
27383
27384 -static struct ata_port_operations sis_133_ops = {
27385 +static const struct ata_port_operations sis_133_ops = {
27386 .inherits = &sis_base_ops,
27387 .set_piomode = sis_133_set_piomode,
27388 .set_dmamode = sis_133_set_dmamode,
27389 .cable_detect = sis_133_cable_detect,
27390 };
27391
27392 -static struct ata_port_operations sis_133_early_ops = {
27393 +static const struct ata_port_operations sis_133_early_ops = {
27394 .inherits = &sis_base_ops,
27395 .set_piomode = sis_100_set_piomode,
27396 .set_dmamode = sis_133_early_set_dmamode,
27397 .cable_detect = sis_66_cable_detect,
27398 };
27399
27400 -static struct ata_port_operations sis_100_ops = {
27401 +static const struct ata_port_operations sis_100_ops = {
27402 .inherits = &sis_base_ops,
27403 .set_piomode = sis_100_set_piomode,
27404 .set_dmamode = sis_100_set_dmamode,
27405 .cable_detect = sis_66_cable_detect,
27406 };
27407
27408 -static struct ata_port_operations sis_66_ops = {
27409 +static const struct ata_port_operations sis_66_ops = {
27410 .inherits = &sis_base_ops,
27411 .set_piomode = sis_old_set_piomode,
27412 .set_dmamode = sis_66_set_dmamode,
27413 .cable_detect = sis_66_cable_detect,
27414 };
27415
27416 -static struct ata_port_operations sis_old_ops = {
27417 +static const struct ata_port_operations sis_old_ops = {
27418 .inherits = &sis_base_ops,
27419 .set_piomode = sis_old_set_piomode,
27420 .set_dmamode = sis_old_set_dmamode,
27421 diff -urNp linux-2.6.32.49/drivers/ata/pata_sl82c105.c linux-2.6.32.49/drivers/ata/pata_sl82c105.c
27422 --- linux-2.6.32.49/drivers/ata/pata_sl82c105.c 2011-11-08 19:02:43.000000000 -0500
27423 +++ linux-2.6.32.49/drivers/ata/pata_sl82c105.c 2011-11-15 19:59:43.000000000 -0500
27424 @@ -231,7 +231,7 @@ static struct scsi_host_template sl82c10
27425 ATA_BMDMA_SHT(DRV_NAME),
27426 };
27427
27428 -static struct ata_port_operations sl82c105_port_ops = {
27429 +static const struct ata_port_operations sl82c105_port_ops = {
27430 .inherits = &ata_bmdma_port_ops,
27431 .qc_defer = sl82c105_qc_defer,
27432 .bmdma_start = sl82c105_bmdma_start,
27433 diff -urNp linux-2.6.32.49/drivers/ata/pata_triflex.c linux-2.6.32.49/drivers/ata/pata_triflex.c
27434 --- linux-2.6.32.49/drivers/ata/pata_triflex.c 2011-11-08 19:02:43.000000000 -0500
27435 +++ linux-2.6.32.49/drivers/ata/pata_triflex.c 2011-11-15 19:59:43.000000000 -0500
27436 @@ -178,7 +178,7 @@ static struct scsi_host_template triflex
27437 ATA_BMDMA_SHT(DRV_NAME),
27438 };
27439
27440 -static struct ata_port_operations triflex_port_ops = {
27441 +static const struct ata_port_operations triflex_port_ops = {
27442 .inherits = &ata_bmdma_port_ops,
27443 .bmdma_start = triflex_bmdma_start,
27444 .bmdma_stop = triflex_bmdma_stop,
27445 diff -urNp linux-2.6.32.49/drivers/ata/pata_via.c linux-2.6.32.49/drivers/ata/pata_via.c
27446 --- linux-2.6.32.49/drivers/ata/pata_via.c 2011-11-08 19:02:43.000000000 -0500
27447 +++ linux-2.6.32.49/drivers/ata/pata_via.c 2011-11-15 19:59:43.000000000 -0500
27448 @@ -419,7 +419,7 @@ static struct scsi_host_template via_sht
27449 ATA_BMDMA_SHT(DRV_NAME),
27450 };
27451
27452 -static struct ata_port_operations via_port_ops = {
27453 +static const struct ata_port_operations via_port_ops = {
27454 .inherits = &ata_bmdma_port_ops,
27455 .cable_detect = via_cable_detect,
27456 .set_piomode = via_set_piomode,
27457 @@ -429,7 +429,7 @@ static struct ata_port_operations via_po
27458 .port_start = via_port_start,
27459 };
27460
27461 -static struct ata_port_operations via_port_ops_noirq = {
27462 +static const struct ata_port_operations via_port_ops_noirq = {
27463 .inherits = &via_port_ops,
27464 .sff_data_xfer = ata_sff_data_xfer_noirq,
27465 };
27466 diff -urNp linux-2.6.32.49/drivers/ata/pata_winbond.c linux-2.6.32.49/drivers/ata/pata_winbond.c
27467 --- linux-2.6.32.49/drivers/ata/pata_winbond.c 2011-11-08 19:02:43.000000000 -0500
27468 +++ linux-2.6.32.49/drivers/ata/pata_winbond.c 2011-11-15 19:59:43.000000000 -0500
27469 @@ -125,7 +125,7 @@ static struct scsi_host_template winbond
27470 ATA_PIO_SHT(DRV_NAME),
27471 };
27472
27473 -static struct ata_port_operations winbond_port_ops = {
27474 +static const struct ata_port_operations winbond_port_ops = {
27475 .inherits = &ata_sff_port_ops,
27476 .sff_data_xfer = winbond_data_xfer,
27477 .cable_detect = ata_cable_40wire,
27478 diff -urNp linux-2.6.32.49/drivers/ata/pdc_adma.c linux-2.6.32.49/drivers/ata/pdc_adma.c
27479 --- linux-2.6.32.49/drivers/ata/pdc_adma.c 2011-11-08 19:02:43.000000000 -0500
27480 +++ linux-2.6.32.49/drivers/ata/pdc_adma.c 2011-11-15 19:59:43.000000000 -0500
27481 @@ -145,7 +145,7 @@ static struct scsi_host_template adma_at
27482 .dma_boundary = ADMA_DMA_BOUNDARY,
27483 };
27484
27485 -static struct ata_port_operations adma_ata_ops = {
27486 +static const struct ata_port_operations adma_ata_ops = {
27487 .inherits = &ata_sff_port_ops,
27488
27489 .lost_interrupt = ATA_OP_NULL,
27490 diff -urNp linux-2.6.32.49/drivers/ata/sata_fsl.c linux-2.6.32.49/drivers/ata/sata_fsl.c
27491 --- linux-2.6.32.49/drivers/ata/sata_fsl.c 2011-11-08 19:02:43.000000000 -0500
27492 +++ linux-2.6.32.49/drivers/ata/sata_fsl.c 2011-11-15 19:59:43.000000000 -0500
27493 @@ -1258,7 +1258,7 @@ static struct scsi_host_template sata_fs
27494 .dma_boundary = ATA_DMA_BOUNDARY,
27495 };
27496
27497 -static struct ata_port_operations sata_fsl_ops = {
27498 +static const struct ata_port_operations sata_fsl_ops = {
27499 .inherits = &sata_pmp_port_ops,
27500
27501 .qc_defer = ata_std_qc_defer,
27502 diff -urNp linux-2.6.32.49/drivers/ata/sata_inic162x.c linux-2.6.32.49/drivers/ata/sata_inic162x.c
27503 --- linux-2.6.32.49/drivers/ata/sata_inic162x.c 2011-11-08 19:02:43.000000000 -0500
27504 +++ linux-2.6.32.49/drivers/ata/sata_inic162x.c 2011-11-15 19:59:43.000000000 -0500
27505 @@ -721,7 +721,7 @@ static int inic_port_start(struct ata_po
27506 return 0;
27507 }
27508
27509 -static struct ata_port_operations inic_port_ops = {
27510 +static const struct ata_port_operations inic_port_ops = {
27511 .inherits = &sata_port_ops,
27512
27513 .check_atapi_dma = inic_check_atapi_dma,
27514 diff -urNp linux-2.6.32.49/drivers/ata/sata_mv.c linux-2.6.32.49/drivers/ata/sata_mv.c
27515 --- linux-2.6.32.49/drivers/ata/sata_mv.c 2011-11-08 19:02:43.000000000 -0500
27516 +++ linux-2.6.32.49/drivers/ata/sata_mv.c 2011-11-15 19:59:43.000000000 -0500
27517 @@ -656,7 +656,7 @@ static struct scsi_host_template mv6_sht
27518 .dma_boundary = MV_DMA_BOUNDARY,
27519 };
27520
27521 -static struct ata_port_operations mv5_ops = {
27522 +static const struct ata_port_operations mv5_ops = {
27523 .inherits = &ata_sff_port_ops,
27524
27525 .lost_interrupt = ATA_OP_NULL,
27526 @@ -678,7 +678,7 @@ static struct ata_port_operations mv5_op
27527 .port_stop = mv_port_stop,
27528 };
27529
27530 -static struct ata_port_operations mv6_ops = {
27531 +static const struct ata_port_operations mv6_ops = {
27532 .inherits = &mv5_ops,
27533 .dev_config = mv6_dev_config,
27534 .scr_read = mv_scr_read,
27535 @@ -698,7 +698,7 @@ static struct ata_port_operations mv6_op
27536 .bmdma_status = mv_bmdma_status,
27537 };
27538
27539 -static struct ata_port_operations mv_iie_ops = {
27540 +static const struct ata_port_operations mv_iie_ops = {
27541 .inherits = &mv6_ops,
27542 .dev_config = ATA_OP_NULL,
27543 .qc_prep = mv_qc_prep_iie,
27544 diff -urNp linux-2.6.32.49/drivers/ata/sata_nv.c linux-2.6.32.49/drivers/ata/sata_nv.c
27545 --- linux-2.6.32.49/drivers/ata/sata_nv.c 2011-11-08 19:02:43.000000000 -0500
27546 +++ linux-2.6.32.49/drivers/ata/sata_nv.c 2011-11-15 19:59:43.000000000 -0500
27547 @@ -464,7 +464,7 @@ static struct scsi_host_template nv_swnc
27548 * cases. Define nv_hardreset() which only kicks in for post-boot
27549 * probing and use it for all variants.
27550 */
27551 -static struct ata_port_operations nv_generic_ops = {
27552 +static const struct ata_port_operations nv_generic_ops = {
27553 .inherits = &ata_bmdma_port_ops,
27554 .lost_interrupt = ATA_OP_NULL,
27555 .scr_read = nv_scr_read,
27556 @@ -472,20 +472,20 @@ static struct ata_port_operations nv_gen
27557 .hardreset = nv_hardreset,
27558 };
27559
27560 -static struct ata_port_operations nv_nf2_ops = {
27561 +static const struct ata_port_operations nv_nf2_ops = {
27562 .inherits = &nv_generic_ops,
27563 .freeze = nv_nf2_freeze,
27564 .thaw = nv_nf2_thaw,
27565 };
27566
27567 -static struct ata_port_operations nv_ck804_ops = {
27568 +static const struct ata_port_operations nv_ck804_ops = {
27569 .inherits = &nv_generic_ops,
27570 .freeze = nv_ck804_freeze,
27571 .thaw = nv_ck804_thaw,
27572 .host_stop = nv_ck804_host_stop,
27573 };
27574
27575 -static struct ata_port_operations nv_adma_ops = {
27576 +static const struct ata_port_operations nv_adma_ops = {
27577 .inherits = &nv_ck804_ops,
27578
27579 .check_atapi_dma = nv_adma_check_atapi_dma,
27580 @@ -509,7 +509,7 @@ static struct ata_port_operations nv_adm
27581 .host_stop = nv_adma_host_stop,
27582 };
27583
27584 -static struct ata_port_operations nv_swncq_ops = {
27585 +static const struct ata_port_operations nv_swncq_ops = {
27586 .inherits = &nv_generic_ops,
27587
27588 .qc_defer = ata_std_qc_defer,
27589 diff -urNp linux-2.6.32.49/drivers/ata/sata_promise.c linux-2.6.32.49/drivers/ata/sata_promise.c
27590 --- linux-2.6.32.49/drivers/ata/sata_promise.c 2011-11-08 19:02:43.000000000 -0500
27591 +++ linux-2.6.32.49/drivers/ata/sata_promise.c 2011-11-15 19:59:43.000000000 -0500
27592 @@ -195,7 +195,7 @@ static const struct ata_port_operations
27593 .error_handler = pdc_error_handler,
27594 };
27595
27596 -static struct ata_port_operations pdc_sata_ops = {
27597 +static const struct ata_port_operations pdc_sata_ops = {
27598 .inherits = &pdc_common_ops,
27599 .cable_detect = pdc_sata_cable_detect,
27600 .freeze = pdc_sata_freeze,
27601 @@ -208,14 +208,14 @@ static struct ata_port_operations pdc_sa
27602
27603 /* First-generation chips need a more restrictive ->check_atapi_dma op,
27604 and ->freeze/thaw that ignore the hotplug controls. */
27605 -static struct ata_port_operations pdc_old_sata_ops = {
27606 +static const struct ata_port_operations pdc_old_sata_ops = {
27607 .inherits = &pdc_sata_ops,
27608 .freeze = pdc_freeze,
27609 .thaw = pdc_thaw,
27610 .check_atapi_dma = pdc_old_sata_check_atapi_dma,
27611 };
27612
27613 -static struct ata_port_operations pdc_pata_ops = {
27614 +static const struct ata_port_operations pdc_pata_ops = {
27615 .inherits = &pdc_common_ops,
27616 .cable_detect = pdc_pata_cable_detect,
27617 .freeze = pdc_freeze,
27618 diff -urNp linux-2.6.32.49/drivers/ata/sata_qstor.c linux-2.6.32.49/drivers/ata/sata_qstor.c
27619 --- linux-2.6.32.49/drivers/ata/sata_qstor.c 2011-11-08 19:02:43.000000000 -0500
27620 +++ linux-2.6.32.49/drivers/ata/sata_qstor.c 2011-11-15 19:59:43.000000000 -0500
27621 @@ -132,7 +132,7 @@ static struct scsi_host_template qs_ata_
27622 .dma_boundary = QS_DMA_BOUNDARY,
27623 };
27624
27625 -static struct ata_port_operations qs_ata_ops = {
27626 +static const struct ata_port_operations qs_ata_ops = {
27627 .inherits = &ata_sff_port_ops,
27628
27629 .check_atapi_dma = qs_check_atapi_dma,
27630 diff -urNp linux-2.6.32.49/drivers/ata/sata_sil24.c linux-2.6.32.49/drivers/ata/sata_sil24.c
27631 --- linux-2.6.32.49/drivers/ata/sata_sil24.c 2011-11-08 19:02:43.000000000 -0500
27632 +++ linux-2.6.32.49/drivers/ata/sata_sil24.c 2011-11-15 19:59:43.000000000 -0500
27633 @@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
27634 .dma_boundary = ATA_DMA_BOUNDARY,
27635 };
27636
27637 -static struct ata_port_operations sil24_ops = {
27638 +static const struct ata_port_operations sil24_ops = {
27639 .inherits = &sata_pmp_port_ops,
27640
27641 .qc_defer = sil24_qc_defer,
27642 diff -urNp linux-2.6.32.49/drivers/ata/sata_sil.c linux-2.6.32.49/drivers/ata/sata_sil.c
27643 --- linux-2.6.32.49/drivers/ata/sata_sil.c 2011-11-08 19:02:43.000000000 -0500
27644 +++ linux-2.6.32.49/drivers/ata/sata_sil.c 2011-11-15 19:59:43.000000000 -0500
27645 @@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht
27646 .sg_tablesize = ATA_MAX_PRD
27647 };
27648
27649 -static struct ata_port_operations sil_ops = {
27650 +static const struct ata_port_operations sil_ops = {
27651 .inherits = &ata_bmdma32_port_ops,
27652 .dev_config = sil_dev_config,
27653 .set_mode = sil_set_mode,
27654 diff -urNp linux-2.6.32.49/drivers/ata/sata_sis.c linux-2.6.32.49/drivers/ata/sata_sis.c
27655 --- linux-2.6.32.49/drivers/ata/sata_sis.c 2011-11-08 19:02:43.000000000 -0500
27656 +++ linux-2.6.32.49/drivers/ata/sata_sis.c 2011-11-15 19:59:43.000000000 -0500
27657 @@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
27658 ATA_BMDMA_SHT(DRV_NAME),
27659 };
27660
27661 -static struct ata_port_operations sis_ops = {
27662 +static const struct ata_port_operations sis_ops = {
27663 .inherits = &ata_bmdma_port_ops,
27664 .scr_read = sis_scr_read,
27665 .scr_write = sis_scr_write,
27666 diff -urNp linux-2.6.32.49/drivers/ata/sata_svw.c linux-2.6.32.49/drivers/ata/sata_svw.c
27667 --- linux-2.6.32.49/drivers/ata/sata_svw.c 2011-11-08 19:02:43.000000000 -0500
27668 +++ linux-2.6.32.49/drivers/ata/sata_svw.c 2011-11-15 19:59:43.000000000 -0500
27669 @@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
27670 };
27671
27672
27673 -static struct ata_port_operations k2_sata_ops = {
27674 +static const struct ata_port_operations k2_sata_ops = {
27675 .inherits = &ata_bmdma_port_ops,
27676 .sff_tf_load = k2_sata_tf_load,
27677 .sff_tf_read = k2_sata_tf_read,
27678 diff -urNp linux-2.6.32.49/drivers/ata/sata_sx4.c linux-2.6.32.49/drivers/ata/sata_sx4.c
27679 --- linux-2.6.32.49/drivers/ata/sata_sx4.c 2011-11-08 19:02:43.000000000 -0500
27680 +++ linux-2.6.32.49/drivers/ata/sata_sx4.c 2011-11-15 19:59:43.000000000 -0500
27681 @@ -248,7 +248,7 @@ static struct scsi_host_template pdc_sat
27682 };
27683
27684 /* TODO: inherit from base port_ops after converting to new EH */
27685 -static struct ata_port_operations pdc_20621_ops = {
27686 +static const struct ata_port_operations pdc_20621_ops = {
27687 .inherits = &ata_sff_port_ops,
27688
27689 .check_atapi_dma = pdc_check_atapi_dma,
27690 diff -urNp linux-2.6.32.49/drivers/ata/sata_uli.c linux-2.6.32.49/drivers/ata/sata_uli.c
27691 --- linux-2.6.32.49/drivers/ata/sata_uli.c 2011-11-08 19:02:43.000000000 -0500
27692 +++ linux-2.6.32.49/drivers/ata/sata_uli.c 2011-11-15 19:59:43.000000000 -0500
27693 @@ -79,7 +79,7 @@ static struct scsi_host_template uli_sht
27694 ATA_BMDMA_SHT(DRV_NAME),
27695 };
27696
27697 -static struct ata_port_operations uli_ops = {
27698 +static const struct ata_port_operations uli_ops = {
27699 .inherits = &ata_bmdma_port_ops,
27700 .scr_read = uli_scr_read,
27701 .scr_write = uli_scr_write,
27702 diff -urNp linux-2.6.32.49/drivers/ata/sata_via.c linux-2.6.32.49/drivers/ata/sata_via.c
27703 --- linux-2.6.32.49/drivers/ata/sata_via.c 2011-11-08 19:02:43.000000000 -0500
27704 +++ linux-2.6.32.49/drivers/ata/sata_via.c 2011-11-15 19:59:43.000000000 -0500
27705 @@ -115,32 +115,32 @@ static struct scsi_host_template svia_sh
27706 ATA_BMDMA_SHT(DRV_NAME),
27707 };
27708
27709 -static struct ata_port_operations svia_base_ops = {
27710 +static const struct ata_port_operations svia_base_ops = {
27711 .inherits = &ata_bmdma_port_ops,
27712 .sff_tf_load = svia_tf_load,
27713 };
27714
27715 -static struct ata_port_operations vt6420_sata_ops = {
27716 +static const struct ata_port_operations vt6420_sata_ops = {
27717 .inherits = &svia_base_ops,
27718 .freeze = svia_noop_freeze,
27719 .prereset = vt6420_prereset,
27720 .bmdma_start = vt6420_bmdma_start,
27721 };
27722
27723 -static struct ata_port_operations vt6421_pata_ops = {
27724 +static const struct ata_port_operations vt6421_pata_ops = {
27725 .inherits = &svia_base_ops,
27726 .cable_detect = vt6421_pata_cable_detect,
27727 .set_piomode = vt6421_set_pio_mode,
27728 .set_dmamode = vt6421_set_dma_mode,
27729 };
27730
27731 -static struct ata_port_operations vt6421_sata_ops = {
27732 +static const struct ata_port_operations vt6421_sata_ops = {
27733 .inherits = &svia_base_ops,
27734 .scr_read = svia_scr_read,
27735 .scr_write = svia_scr_write,
27736 };
27737
27738 -static struct ata_port_operations vt8251_ops = {
27739 +static const struct ata_port_operations vt8251_ops = {
27740 .inherits = &svia_base_ops,
27741 .hardreset = sata_std_hardreset,
27742 .scr_read = vt8251_scr_read,
27743 diff -urNp linux-2.6.32.49/drivers/ata/sata_vsc.c linux-2.6.32.49/drivers/ata/sata_vsc.c
27744 --- linux-2.6.32.49/drivers/ata/sata_vsc.c 2011-11-08 19:02:43.000000000 -0500
27745 +++ linux-2.6.32.49/drivers/ata/sata_vsc.c 2011-11-15 19:59:43.000000000 -0500
27746 @@ -306,7 +306,7 @@ static struct scsi_host_template vsc_sat
27747 };
27748
27749
27750 -static struct ata_port_operations vsc_sata_ops = {
27751 +static const struct ata_port_operations vsc_sata_ops = {
27752 .inherits = &ata_bmdma_port_ops,
27753 /* The IRQ handling is not quite standard SFF behaviour so we
27754 cannot use the default lost interrupt handler */
27755 diff -urNp linux-2.6.32.49/drivers/atm/adummy.c linux-2.6.32.49/drivers/atm/adummy.c
27756 --- linux-2.6.32.49/drivers/atm/adummy.c 2011-11-08 19:02:43.000000000 -0500
27757 +++ linux-2.6.32.49/drivers/atm/adummy.c 2011-11-15 19:59:43.000000000 -0500
27758 @@ -77,7 +77,7 @@ adummy_send(struct atm_vcc *vcc, struct
27759 vcc->pop(vcc, skb);
27760 else
27761 dev_kfree_skb_any(skb);
27762 - atomic_inc(&vcc->stats->tx);
27763 + atomic_inc_unchecked(&vcc->stats->tx);
27764
27765 return 0;
27766 }
27767 diff -urNp linux-2.6.32.49/drivers/atm/ambassador.c linux-2.6.32.49/drivers/atm/ambassador.c
27768 --- linux-2.6.32.49/drivers/atm/ambassador.c 2011-11-08 19:02:43.000000000 -0500
27769 +++ linux-2.6.32.49/drivers/atm/ambassador.c 2011-11-15 19:59:43.000000000 -0500
27770 @@ -453,7 +453,7 @@ static void tx_complete (amb_dev * dev,
27771 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
27772
27773 // VC layer stats
27774 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
27775 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
27776
27777 // free the descriptor
27778 kfree (tx_descr);
27779 @@ -494,7 +494,7 @@ static void rx_complete (amb_dev * dev,
27780 dump_skb ("<<<", vc, skb);
27781
27782 // VC layer stats
27783 - atomic_inc(&atm_vcc->stats->rx);
27784 + atomic_inc_unchecked(&atm_vcc->stats->rx);
27785 __net_timestamp(skb);
27786 // end of our responsability
27787 atm_vcc->push (atm_vcc, skb);
27788 @@ -509,7 +509,7 @@ static void rx_complete (amb_dev * dev,
27789 } else {
27790 PRINTK (KERN_INFO, "dropped over-size frame");
27791 // should we count this?
27792 - atomic_inc(&atm_vcc->stats->rx_drop);
27793 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
27794 }
27795
27796 } else {
27797 @@ -1341,7 +1341,7 @@ static int amb_send (struct atm_vcc * at
27798 }
27799
27800 if (check_area (skb->data, skb->len)) {
27801 - atomic_inc(&atm_vcc->stats->tx_err);
27802 + atomic_inc_unchecked(&atm_vcc->stats->tx_err);
27803 return -ENOMEM; // ?
27804 }
27805
27806 diff -urNp linux-2.6.32.49/drivers/atm/atmtcp.c linux-2.6.32.49/drivers/atm/atmtcp.c
27807 --- linux-2.6.32.49/drivers/atm/atmtcp.c 2011-11-08 19:02:43.000000000 -0500
27808 +++ linux-2.6.32.49/drivers/atm/atmtcp.c 2011-11-15 19:59:43.000000000 -0500
27809 @@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc
27810 if (vcc->pop) vcc->pop(vcc,skb);
27811 else dev_kfree_skb(skb);
27812 if (dev_data) return 0;
27813 - atomic_inc(&vcc->stats->tx_err);
27814 + atomic_inc_unchecked(&vcc->stats->tx_err);
27815 return -ENOLINK;
27816 }
27817 size = skb->len+sizeof(struct atmtcp_hdr);
27818 @@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc
27819 if (!new_skb) {
27820 if (vcc->pop) vcc->pop(vcc,skb);
27821 else dev_kfree_skb(skb);
27822 - atomic_inc(&vcc->stats->tx_err);
27823 + atomic_inc_unchecked(&vcc->stats->tx_err);
27824 return -ENOBUFS;
27825 }
27826 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
27827 @@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc
27828 if (vcc->pop) vcc->pop(vcc,skb);
27829 else dev_kfree_skb(skb);
27830 out_vcc->push(out_vcc,new_skb);
27831 - atomic_inc(&vcc->stats->tx);
27832 - atomic_inc(&out_vcc->stats->rx);
27833 + atomic_inc_unchecked(&vcc->stats->tx);
27834 + atomic_inc_unchecked(&out_vcc->stats->rx);
27835 return 0;
27836 }
27837
27838 @@ -300,7 +300,7 @@ static int atmtcp_c_send(struct atm_vcc
27839 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
27840 read_unlock(&vcc_sklist_lock);
27841 if (!out_vcc) {
27842 - atomic_inc(&vcc->stats->tx_err);
27843 + atomic_inc_unchecked(&vcc->stats->tx_err);
27844 goto done;
27845 }
27846 skb_pull(skb,sizeof(struct atmtcp_hdr));
27847 @@ -312,8 +312,8 @@ static int atmtcp_c_send(struct atm_vcc
27848 __net_timestamp(new_skb);
27849 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
27850 out_vcc->push(out_vcc,new_skb);
27851 - atomic_inc(&vcc->stats->tx);
27852 - atomic_inc(&out_vcc->stats->rx);
27853 + atomic_inc_unchecked(&vcc->stats->tx);
27854 + atomic_inc_unchecked(&out_vcc->stats->rx);
27855 done:
27856 if (vcc->pop) vcc->pop(vcc,skb);
27857 else dev_kfree_skb(skb);
27858 diff -urNp linux-2.6.32.49/drivers/atm/eni.c linux-2.6.32.49/drivers/atm/eni.c
27859 --- linux-2.6.32.49/drivers/atm/eni.c 2011-11-08 19:02:43.000000000 -0500
27860 +++ linux-2.6.32.49/drivers/atm/eni.c 2011-11-18 18:01:52.000000000 -0500
27861 @@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
27862 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
27863 vcc->dev->number);
27864 length = 0;
27865 - atomic_inc(&vcc->stats->rx_err);
27866 + atomic_inc_unchecked(&vcc->stats->rx_err);
27867 }
27868 else {
27869 length = ATM_CELL_SIZE-1; /* no HEC */
27870 @@ -580,7 +580,7 @@ static int rx_aal5(struct atm_vcc *vcc)
27871 size);
27872 }
27873 eff = length = 0;
27874 - atomic_inc(&vcc->stats->rx_err);
27875 + atomic_inc_unchecked(&vcc->stats->rx_err);
27876 }
27877 else {
27878 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
27879 @@ -597,7 +597,7 @@ static int rx_aal5(struct atm_vcc *vcc)
27880 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
27881 vcc->dev->number,vcc->vci,length,size << 2,descr);
27882 length = eff = 0;
27883 - atomic_inc(&vcc->stats->rx_err);
27884 + atomic_inc_unchecked(&vcc->stats->rx_err);
27885 }
27886 }
27887 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
27888 @@ -770,7 +770,7 @@ rx_dequeued++;
27889 vcc->push(vcc,skb);
27890 pushed++;
27891 }
27892 - atomic_inc(&vcc->stats->rx);
27893 + atomic_inc_unchecked(&vcc->stats->rx);
27894 }
27895 wake_up(&eni_dev->rx_wait);
27896 }
27897 @@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *d
27898 PCI_DMA_TODEVICE);
27899 if (vcc->pop) vcc->pop(vcc,skb);
27900 else dev_kfree_skb_irq(skb);
27901 - atomic_inc(&vcc->stats->tx);
27902 + atomic_inc_unchecked(&vcc->stats->tx);
27903 wake_up(&eni_dev->tx_wait);
27904 dma_complete++;
27905 }
27906 @@ -1570,7 +1570,7 @@ tx_complete++;
27907 /*--------------------------------- entries ---------------------------------*/
27908
27909
27910 -static const char *media_name[] __devinitdata = {
27911 +static const char *media_name[] __devinitconst = {
27912 "MMF", "SMF", "MMF", "03?", /* 0- 3 */
27913 "UTP", "05?", "06?", "07?", /* 4- 7 */
27914 "TAXI","09?", "10?", "11?", /* 8-11 */
27915 diff -urNp linux-2.6.32.49/drivers/atm/firestream.c linux-2.6.32.49/drivers/atm/firestream.c
27916 --- linux-2.6.32.49/drivers/atm/firestream.c 2011-11-08 19:02:43.000000000 -0500
27917 +++ linux-2.6.32.49/drivers/atm/firestream.c 2011-11-15 19:59:43.000000000 -0500
27918 @@ -748,7 +748,7 @@ static void process_txdone_queue (struct
27919 }
27920 }
27921
27922 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
27923 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
27924
27925 fs_dprintk (FS_DEBUG_TXMEM, "i");
27926 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
27927 @@ -815,7 +815,7 @@ static void process_incoming (struct fs_
27928 #endif
27929 skb_put (skb, qe->p1 & 0xffff);
27930 ATM_SKB(skb)->vcc = atm_vcc;
27931 - atomic_inc(&atm_vcc->stats->rx);
27932 + atomic_inc_unchecked(&atm_vcc->stats->rx);
27933 __net_timestamp(skb);
27934 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
27935 atm_vcc->push (atm_vcc, skb);
27936 @@ -836,12 +836,12 @@ static void process_incoming (struct fs_
27937 kfree (pe);
27938 }
27939 if (atm_vcc)
27940 - atomic_inc(&atm_vcc->stats->rx_drop);
27941 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
27942 break;
27943 case 0x1f: /* Reassembly abort: no buffers. */
27944 /* Silently increment error counter. */
27945 if (atm_vcc)
27946 - atomic_inc(&atm_vcc->stats->rx_drop);
27947 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
27948 break;
27949 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
27950 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
27951 diff -urNp linux-2.6.32.49/drivers/atm/fore200e.c linux-2.6.32.49/drivers/atm/fore200e.c
27952 --- linux-2.6.32.49/drivers/atm/fore200e.c 2011-11-08 19:02:43.000000000 -0500
27953 +++ linux-2.6.32.49/drivers/atm/fore200e.c 2011-11-15 19:59:43.000000000 -0500
27954 @@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200
27955 #endif
27956 /* check error condition */
27957 if (*entry->status & STATUS_ERROR)
27958 - atomic_inc(&vcc->stats->tx_err);
27959 + atomic_inc_unchecked(&vcc->stats->tx_err);
27960 else
27961 - atomic_inc(&vcc->stats->tx);
27962 + atomic_inc_unchecked(&vcc->stats->tx);
27963 }
27964 }
27965
27966 @@ -1082,7 +1082,7 @@ fore200e_push_rpd(struct fore200e* fore2
27967 if (skb == NULL) {
27968 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
27969
27970 - atomic_inc(&vcc->stats->rx_drop);
27971 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27972 return -ENOMEM;
27973 }
27974
27975 @@ -1125,14 +1125,14 @@ fore200e_push_rpd(struct fore200e* fore2
27976
27977 dev_kfree_skb_any(skb);
27978
27979 - atomic_inc(&vcc->stats->rx_drop);
27980 + atomic_inc_unchecked(&vcc->stats->rx_drop);
27981 return -ENOMEM;
27982 }
27983
27984 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
27985
27986 vcc->push(vcc, skb);
27987 - atomic_inc(&vcc->stats->rx);
27988 + atomic_inc_unchecked(&vcc->stats->rx);
27989
27990 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
27991
27992 @@ -1210,7 +1210,7 @@ fore200e_rx_irq(struct fore200e* fore200
27993 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
27994 fore200e->atm_dev->number,
27995 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
27996 - atomic_inc(&vcc->stats->rx_err);
27997 + atomic_inc_unchecked(&vcc->stats->rx_err);
27998 }
27999 }
28000
28001 @@ -1655,7 +1655,7 @@ fore200e_send(struct atm_vcc *vcc, struc
28002 goto retry_here;
28003 }
28004
28005 - atomic_inc(&vcc->stats->tx_err);
28006 + atomic_inc_unchecked(&vcc->stats->tx_err);
28007
28008 fore200e->tx_sat++;
28009 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
28010 diff -urNp linux-2.6.32.49/drivers/atm/he.c linux-2.6.32.49/drivers/atm/he.c
28011 --- linux-2.6.32.49/drivers/atm/he.c 2011-11-08 19:02:43.000000000 -0500
28012 +++ linux-2.6.32.49/drivers/atm/he.c 2011-11-15 19:59:43.000000000 -0500
28013 @@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, i
28014
28015 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
28016 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
28017 - atomic_inc(&vcc->stats->rx_drop);
28018 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28019 goto return_host_buffers;
28020 }
28021
28022 @@ -1802,7 +1802,7 @@ he_service_rbrq(struct he_dev *he_dev, i
28023 RBRQ_LEN_ERR(he_dev->rbrq_head)
28024 ? "LEN_ERR" : "",
28025 vcc->vpi, vcc->vci);
28026 - atomic_inc(&vcc->stats->rx_err);
28027 + atomic_inc_unchecked(&vcc->stats->rx_err);
28028 goto return_host_buffers;
28029 }
28030
28031 @@ -1861,7 +1861,7 @@ he_service_rbrq(struct he_dev *he_dev, i
28032 vcc->push(vcc, skb);
28033 spin_lock(&he_dev->global_lock);
28034
28035 - atomic_inc(&vcc->stats->rx);
28036 + atomic_inc_unchecked(&vcc->stats->rx);
28037
28038 return_host_buffers:
28039 ++pdus_assembled;
28040 @@ -2206,7 +2206,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
28041 tpd->vcc->pop(tpd->vcc, tpd->skb);
28042 else
28043 dev_kfree_skb_any(tpd->skb);
28044 - atomic_inc(&tpd->vcc->stats->tx_err);
28045 + atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
28046 }
28047 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
28048 return;
28049 @@ -2618,7 +2618,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
28050 vcc->pop(vcc, skb);
28051 else
28052 dev_kfree_skb_any(skb);
28053 - atomic_inc(&vcc->stats->tx_err);
28054 + atomic_inc_unchecked(&vcc->stats->tx_err);
28055 return -EINVAL;
28056 }
28057
28058 @@ -2629,7 +2629,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
28059 vcc->pop(vcc, skb);
28060 else
28061 dev_kfree_skb_any(skb);
28062 - atomic_inc(&vcc->stats->tx_err);
28063 + atomic_inc_unchecked(&vcc->stats->tx_err);
28064 return -EINVAL;
28065 }
28066 #endif
28067 @@ -2641,7 +2641,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
28068 vcc->pop(vcc, skb);
28069 else
28070 dev_kfree_skb_any(skb);
28071 - atomic_inc(&vcc->stats->tx_err);
28072 + atomic_inc_unchecked(&vcc->stats->tx_err);
28073 spin_unlock_irqrestore(&he_dev->global_lock, flags);
28074 return -ENOMEM;
28075 }
28076 @@ -2683,7 +2683,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
28077 vcc->pop(vcc, skb);
28078 else
28079 dev_kfree_skb_any(skb);
28080 - atomic_inc(&vcc->stats->tx_err);
28081 + atomic_inc_unchecked(&vcc->stats->tx_err);
28082 spin_unlock_irqrestore(&he_dev->global_lock, flags);
28083 return -ENOMEM;
28084 }
28085 @@ -2714,7 +2714,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
28086 __enqueue_tpd(he_dev, tpd, cid);
28087 spin_unlock_irqrestore(&he_dev->global_lock, flags);
28088
28089 - atomic_inc(&vcc->stats->tx);
28090 + atomic_inc_unchecked(&vcc->stats->tx);
28091
28092 return 0;
28093 }
28094 diff -urNp linux-2.6.32.49/drivers/atm/horizon.c linux-2.6.32.49/drivers/atm/horizon.c
28095 --- linux-2.6.32.49/drivers/atm/horizon.c 2011-11-08 19:02:43.000000000 -0500
28096 +++ linux-2.6.32.49/drivers/atm/horizon.c 2011-11-15 19:59:43.000000000 -0500
28097 @@ -1033,7 +1033,7 @@ static void rx_schedule (hrz_dev * dev,
28098 {
28099 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
28100 // VC layer stats
28101 - atomic_inc(&vcc->stats->rx);
28102 + atomic_inc_unchecked(&vcc->stats->rx);
28103 __net_timestamp(skb);
28104 // end of our responsability
28105 vcc->push (vcc, skb);
28106 @@ -1185,7 +1185,7 @@ static void tx_schedule (hrz_dev * const
28107 dev->tx_iovec = NULL;
28108
28109 // VC layer stats
28110 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
28111 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
28112
28113 // free the skb
28114 hrz_kfree_skb (skb);
28115 diff -urNp linux-2.6.32.49/drivers/atm/idt77252.c linux-2.6.32.49/drivers/atm/idt77252.c
28116 --- linux-2.6.32.49/drivers/atm/idt77252.c 2011-11-08 19:02:43.000000000 -0500
28117 +++ linux-2.6.32.49/drivers/atm/idt77252.c 2011-11-15 19:59:43.000000000 -0500
28118 @@ -810,7 +810,7 @@ drain_scq(struct idt77252_dev *card, str
28119 else
28120 dev_kfree_skb(skb);
28121
28122 - atomic_inc(&vcc->stats->tx);
28123 + atomic_inc_unchecked(&vcc->stats->tx);
28124 }
28125
28126 atomic_dec(&scq->used);
28127 @@ -1073,13 +1073,13 @@ dequeue_rx(struct idt77252_dev *card, st
28128 if ((sb = dev_alloc_skb(64)) == NULL) {
28129 printk("%s: Can't allocate buffers for aal0.\n",
28130 card->name);
28131 - atomic_add(i, &vcc->stats->rx_drop);
28132 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
28133 break;
28134 }
28135 if (!atm_charge(vcc, sb->truesize)) {
28136 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
28137 card->name);
28138 - atomic_add(i - 1, &vcc->stats->rx_drop);
28139 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
28140 dev_kfree_skb(sb);
28141 break;
28142 }
28143 @@ -1096,7 +1096,7 @@ dequeue_rx(struct idt77252_dev *card, st
28144 ATM_SKB(sb)->vcc = vcc;
28145 __net_timestamp(sb);
28146 vcc->push(vcc, sb);
28147 - atomic_inc(&vcc->stats->rx);
28148 + atomic_inc_unchecked(&vcc->stats->rx);
28149
28150 cell += ATM_CELL_PAYLOAD;
28151 }
28152 @@ -1133,13 +1133,13 @@ dequeue_rx(struct idt77252_dev *card, st
28153 "(CDC: %08x)\n",
28154 card->name, len, rpp->len, readl(SAR_REG_CDC));
28155 recycle_rx_pool_skb(card, rpp);
28156 - atomic_inc(&vcc->stats->rx_err);
28157 + atomic_inc_unchecked(&vcc->stats->rx_err);
28158 return;
28159 }
28160 if (stat & SAR_RSQE_CRC) {
28161 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
28162 recycle_rx_pool_skb(card, rpp);
28163 - atomic_inc(&vcc->stats->rx_err);
28164 + atomic_inc_unchecked(&vcc->stats->rx_err);
28165 return;
28166 }
28167 if (skb_queue_len(&rpp->queue) > 1) {
28168 @@ -1150,7 +1150,7 @@ dequeue_rx(struct idt77252_dev *card, st
28169 RXPRINTK("%s: Can't alloc RX skb.\n",
28170 card->name);
28171 recycle_rx_pool_skb(card, rpp);
28172 - atomic_inc(&vcc->stats->rx_err);
28173 + atomic_inc_unchecked(&vcc->stats->rx_err);
28174 return;
28175 }
28176 if (!atm_charge(vcc, skb->truesize)) {
28177 @@ -1169,7 +1169,7 @@ dequeue_rx(struct idt77252_dev *card, st
28178 __net_timestamp(skb);
28179
28180 vcc->push(vcc, skb);
28181 - atomic_inc(&vcc->stats->rx);
28182 + atomic_inc_unchecked(&vcc->stats->rx);
28183
28184 return;
28185 }
28186 @@ -1191,7 +1191,7 @@ dequeue_rx(struct idt77252_dev *card, st
28187 __net_timestamp(skb);
28188
28189 vcc->push(vcc, skb);
28190 - atomic_inc(&vcc->stats->rx);
28191 + atomic_inc_unchecked(&vcc->stats->rx);
28192
28193 if (skb->truesize > SAR_FB_SIZE_3)
28194 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
28195 @@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *car
28196 if (vcc->qos.aal != ATM_AAL0) {
28197 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
28198 card->name, vpi, vci);
28199 - atomic_inc(&vcc->stats->rx_drop);
28200 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28201 goto drop;
28202 }
28203
28204 if ((sb = dev_alloc_skb(64)) == NULL) {
28205 printk("%s: Can't allocate buffers for AAL0.\n",
28206 card->name);
28207 - atomic_inc(&vcc->stats->rx_err);
28208 + atomic_inc_unchecked(&vcc->stats->rx_err);
28209 goto drop;
28210 }
28211
28212 @@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *car
28213 ATM_SKB(sb)->vcc = vcc;
28214 __net_timestamp(sb);
28215 vcc->push(vcc, sb);
28216 - atomic_inc(&vcc->stats->rx);
28217 + atomic_inc_unchecked(&vcc->stats->rx);
28218
28219 drop:
28220 skb_pull(queue, 64);
28221 @@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
28222
28223 if (vc == NULL) {
28224 printk("%s: NULL connection in send().\n", card->name);
28225 - atomic_inc(&vcc->stats->tx_err);
28226 + atomic_inc_unchecked(&vcc->stats->tx_err);
28227 dev_kfree_skb(skb);
28228 return -EINVAL;
28229 }
28230 if (!test_bit(VCF_TX, &vc->flags)) {
28231 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
28232 - atomic_inc(&vcc->stats->tx_err);
28233 + atomic_inc_unchecked(&vcc->stats->tx_err);
28234 dev_kfree_skb(skb);
28235 return -EINVAL;
28236 }
28237 @@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
28238 break;
28239 default:
28240 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
28241 - atomic_inc(&vcc->stats->tx_err);
28242 + atomic_inc_unchecked(&vcc->stats->tx_err);
28243 dev_kfree_skb(skb);
28244 return -EINVAL;
28245 }
28246
28247 if (skb_shinfo(skb)->nr_frags != 0) {
28248 printk("%s: No scatter-gather yet.\n", card->name);
28249 - atomic_inc(&vcc->stats->tx_err);
28250 + atomic_inc_unchecked(&vcc->stats->tx_err);
28251 dev_kfree_skb(skb);
28252 return -EINVAL;
28253 }
28254 @@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
28255
28256 err = queue_skb(card, vc, skb, oam);
28257 if (err) {
28258 - atomic_inc(&vcc->stats->tx_err);
28259 + atomic_inc_unchecked(&vcc->stats->tx_err);
28260 dev_kfree_skb(skb);
28261 return err;
28262 }
28263 @@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
28264 skb = dev_alloc_skb(64);
28265 if (!skb) {
28266 printk("%s: Out of memory in send_oam().\n", card->name);
28267 - atomic_inc(&vcc->stats->tx_err);
28268 + atomic_inc_unchecked(&vcc->stats->tx_err);
28269 return -ENOMEM;
28270 }
28271 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
28272 diff -urNp linux-2.6.32.49/drivers/atm/iphase.c linux-2.6.32.49/drivers/atm/iphase.c
28273 --- linux-2.6.32.49/drivers/atm/iphase.c 2011-11-08 19:02:43.000000000 -0500
28274 +++ linux-2.6.32.49/drivers/atm/iphase.c 2011-11-15 19:59:43.000000000 -0500
28275 @@ -1123,7 +1123,7 @@ static int rx_pkt(struct atm_dev *dev)
28276 status = (u_short) (buf_desc_ptr->desc_mode);
28277 if (status & (RX_CER | RX_PTE | RX_OFL))
28278 {
28279 - atomic_inc(&vcc->stats->rx_err);
28280 + atomic_inc_unchecked(&vcc->stats->rx_err);
28281 IF_ERR(printk("IA: bad packet, dropping it");)
28282 if (status & RX_CER) {
28283 IF_ERR(printk(" cause: packet CRC error\n");)
28284 @@ -1146,7 +1146,7 @@ static int rx_pkt(struct atm_dev *dev)
28285 len = dma_addr - buf_addr;
28286 if (len > iadev->rx_buf_sz) {
28287 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
28288 - atomic_inc(&vcc->stats->rx_err);
28289 + atomic_inc_unchecked(&vcc->stats->rx_err);
28290 goto out_free_desc;
28291 }
28292
28293 @@ -1296,7 +1296,7 @@ static void rx_dle_intr(struct atm_dev *
28294 ia_vcc = INPH_IA_VCC(vcc);
28295 if (ia_vcc == NULL)
28296 {
28297 - atomic_inc(&vcc->stats->rx_err);
28298 + atomic_inc_unchecked(&vcc->stats->rx_err);
28299 dev_kfree_skb_any(skb);
28300 atm_return(vcc, atm_guess_pdu2truesize(len));
28301 goto INCR_DLE;
28302 @@ -1308,7 +1308,7 @@ static void rx_dle_intr(struct atm_dev *
28303 if ((length > iadev->rx_buf_sz) || (length >
28304 (skb->len - sizeof(struct cpcs_trailer))))
28305 {
28306 - atomic_inc(&vcc->stats->rx_err);
28307 + atomic_inc_unchecked(&vcc->stats->rx_err);
28308 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
28309 length, skb->len);)
28310 dev_kfree_skb_any(skb);
28311 @@ -1324,7 +1324,7 @@ static void rx_dle_intr(struct atm_dev *
28312
28313 IF_RX(printk("rx_dle_intr: skb push");)
28314 vcc->push(vcc,skb);
28315 - atomic_inc(&vcc->stats->rx);
28316 + atomic_inc_unchecked(&vcc->stats->rx);
28317 iadev->rx_pkt_cnt++;
28318 }
28319 INCR_DLE:
28320 @@ -2806,15 +2806,15 @@ static int ia_ioctl(struct atm_dev *dev,
28321 {
28322 struct k_sonet_stats *stats;
28323 stats = &PRIV(_ia_dev[board])->sonet_stats;
28324 - printk("section_bip: %d\n", atomic_read(&stats->section_bip));
28325 - printk("line_bip : %d\n", atomic_read(&stats->line_bip));
28326 - printk("path_bip : %d\n", atomic_read(&stats->path_bip));
28327 - printk("line_febe : %d\n", atomic_read(&stats->line_febe));
28328 - printk("path_febe : %d\n", atomic_read(&stats->path_febe));
28329 - printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
28330 - printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
28331 - printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
28332 - printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
28333 + printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
28334 + printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
28335 + printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
28336 + printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
28337 + printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
28338 + printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
28339 + printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
28340 + printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
28341 + printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
28342 }
28343 ia_cmds.status = 0;
28344 break;
28345 @@ -2919,7 +2919,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
28346 if ((desc == 0) || (desc > iadev->num_tx_desc))
28347 {
28348 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
28349 - atomic_inc(&vcc->stats->tx);
28350 + atomic_inc_unchecked(&vcc->stats->tx);
28351 if (vcc->pop)
28352 vcc->pop(vcc, skb);
28353 else
28354 @@ -3024,14 +3024,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
28355 ATM_DESC(skb) = vcc->vci;
28356 skb_queue_tail(&iadev->tx_dma_q, skb);
28357
28358 - atomic_inc(&vcc->stats->tx);
28359 + atomic_inc_unchecked(&vcc->stats->tx);
28360 iadev->tx_pkt_cnt++;
28361 /* Increment transaction counter */
28362 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
28363
28364 #if 0
28365 /* add flow control logic */
28366 - if (atomic_read(&vcc->stats->tx) % 20 == 0) {
28367 + if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
28368 if (iavcc->vc_desc_cnt > 10) {
28369 vcc->tx_quota = vcc->tx_quota * 3 / 4;
28370 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
28371 diff -urNp linux-2.6.32.49/drivers/atm/lanai.c linux-2.6.32.49/drivers/atm/lanai.c
28372 --- linux-2.6.32.49/drivers/atm/lanai.c 2011-11-08 19:02:43.000000000 -0500
28373 +++ linux-2.6.32.49/drivers/atm/lanai.c 2011-11-15 19:59:43.000000000 -0500
28374 @@ -1305,7 +1305,7 @@ static void lanai_send_one_aal5(struct l
28375 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
28376 lanai_endtx(lanai, lvcc);
28377 lanai_free_skb(lvcc->tx.atmvcc, skb);
28378 - atomic_inc(&lvcc->tx.atmvcc->stats->tx);
28379 + atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
28380 }
28381
28382 /* Try to fill the buffer - don't call unless there is backlog */
28383 @@ -1428,7 +1428,7 @@ static void vcc_rx_aal5(struct lanai_vcc
28384 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
28385 __net_timestamp(skb);
28386 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
28387 - atomic_inc(&lvcc->rx.atmvcc->stats->rx);
28388 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
28389 out:
28390 lvcc->rx.buf.ptr = end;
28391 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
28392 @@ -1670,7 +1670,7 @@ static int handle_service(struct lanai_d
28393 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
28394 "vcc %d\n", lanai->number, (unsigned int) s, vci);
28395 lanai->stats.service_rxnotaal5++;
28396 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
28397 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
28398 return 0;
28399 }
28400 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
28401 @@ -1682,7 +1682,7 @@ static int handle_service(struct lanai_d
28402 int bytes;
28403 read_unlock(&vcc_sklist_lock);
28404 DPRINTK("got trashed rx pdu on vci %d\n", vci);
28405 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
28406 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
28407 lvcc->stats.x.aal5.service_trash++;
28408 bytes = (SERVICE_GET_END(s) * 16) -
28409 (((unsigned long) lvcc->rx.buf.ptr) -
28410 @@ -1694,7 +1694,7 @@ static int handle_service(struct lanai_d
28411 }
28412 if (s & SERVICE_STREAM) {
28413 read_unlock(&vcc_sklist_lock);
28414 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
28415 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
28416 lvcc->stats.x.aal5.service_stream++;
28417 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
28418 "PDU on VCI %d!\n", lanai->number, vci);
28419 @@ -1702,7 +1702,7 @@ static int handle_service(struct lanai_d
28420 return 0;
28421 }
28422 DPRINTK("got rx crc error on vci %d\n", vci);
28423 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
28424 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
28425 lvcc->stats.x.aal5.service_rxcrc++;
28426 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
28427 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
28428 diff -urNp linux-2.6.32.49/drivers/atm/nicstar.c linux-2.6.32.49/drivers/atm/nicstar.c
28429 --- linux-2.6.32.49/drivers/atm/nicstar.c 2011-11-08 19:02:43.000000000 -0500
28430 +++ linux-2.6.32.49/drivers/atm/nicstar.c 2011-11-15 19:59:43.000000000 -0500
28431 @@ -1723,7 +1723,7 @@ static int ns_send(struct atm_vcc *vcc,
28432 if ((vc = (vc_map *) vcc->dev_data) == NULL)
28433 {
28434 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", card->index);
28435 - atomic_inc(&vcc->stats->tx_err);
28436 + atomic_inc_unchecked(&vcc->stats->tx_err);
28437 dev_kfree_skb_any(skb);
28438 return -EINVAL;
28439 }
28440 @@ -1731,7 +1731,7 @@ static int ns_send(struct atm_vcc *vcc,
28441 if (!vc->tx)
28442 {
28443 printk("nicstar%d: Trying to transmit on a non-tx VC.\n", card->index);
28444 - atomic_inc(&vcc->stats->tx_err);
28445 + atomic_inc_unchecked(&vcc->stats->tx_err);
28446 dev_kfree_skb_any(skb);
28447 return -EINVAL;
28448 }
28449 @@ -1739,7 +1739,7 @@ static int ns_send(struct atm_vcc *vcc,
28450 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0)
28451 {
28452 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", card->index);
28453 - atomic_inc(&vcc->stats->tx_err);
28454 + atomic_inc_unchecked(&vcc->stats->tx_err);
28455 dev_kfree_skb_any(skb);
28456 return -EINVAL;
28457 }
28458 @@ -1747,7 +1747,7 @@ static int ns_send(struct atm_vcc *vcc,
28459 if (skb_shinfo(skb)->nr_frags != 0)
28460 {
28461 printk("nicstar%d: No scatter-gather yet.\n", card->index);
28462 - atomic_inc(&vcc->stats->tx_err);
28463 + atomic_inc_unchecked(&vcc->stats->tx_err);
28464 dev_kfree_skb_any(skb);
28465 return -EINVAL;
28466 }
28467 @@ -1792,11 +1792,11 @@ static int ns_send(struct atm_vcc *vcc,
28468
28469 if (push_scqe(card, vc, scq, &scqe, skb) != 0)
28470 {
28471 - atomic_inc(&vcc->stats->tx_err);
28472 + atomic_inc_unchecked(&vcc->stats->tx_err);
28473 dev_kfree_skb_any(skb);
28474 return -EIO;
28475 }
28476 - atomic_inc(&vcc->stats->tx);
28477 + atomic_inc_unchecked(&vcc->stats->tx);
28478
28479 return 0;
28480 }
28481 @@ -2111,14 +2111,14 @@ static void dequeue_rx(ns_dev *card, ns_
28482 {
28483 printk("nicstar%d: Can't allocate buffers for aal0.\n",
28484 card->index);
28485 - atomic_add(i,&vcc->stats->rx_drop);
28486 + atomic_add_unchecked(i,&vcc->stats->rx_drop);
28487 break;
28488 }
28489 if (!atm_charge(vcc, sb->truesize))
28490 {
28491 RXPRINTK("nicstar%d: atm_charge() dropped aal0 packets.\n",
28492 card->index);
28493 - atomic_add(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
28494 + atomic_add_unchecked(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
28495 dev_kfree_skb_any(sb);
28496 break;
28497 }
28498 @@ -2133,7 +2133,7 @@ static void dequeue_rx(ns_dev *card, ns_
28499 ATM_SKB(sb)->vcc = vcc;
28500 __net_timestamp(sb);
28501 vcc->push(vcc, sb);
28502 - atomic_inc(&vcc->stats->rx);
28503 + atomic_inc_unchecked(&vcc->stats->rx);
28504 cell += ATM_CELL_PAYLOAD;
28505 }
28506
28507 @@ -2152,7 +2152,7 @@ static void dequeue_rx(ns_dev *card, ns_
28508 if (iovb == NULL)
28509 {
28510 printk("nicstar%d: Out of iovec buffers.\n", card->index);
28511 - atomic_inc(&vcc->stats->rx_drop);
28512 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28513 recycle_rx_buf(card, skb);
28514 return;
28515 }
28516 @@ -2182,7 +2182,7 @@ static void dequeue_rx(ns_dev *card, ns_
28517 else if (NS_SKB(iovb)->iovcnt >= NS_MAX_IOVECS)
28518 {
28519 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
28520 - atomic_inc(&vcc->stats->rx_err);
28521 + atomic_inc_unchecked(&vcc->stats->rx_err);
28522 recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
28523 NS_SKB(iovb)->iovcnt = 0;
28524 iovb->len = 0;
28525 @@ -2202,7 +2202,7 @@ static void dequeue_rx(ns_dev *card, ns_
28526 printk("nicstar%d: Expected a small buffer, and this is not one.\n",
28527 card->index);
28528 which_list(card, skb);
28529 - atomic_inc(&vcc->stats->rx_err);
28530 + atomic_inc_unchecked(&vcc->stats->rx_err);
28531 recycle_rx_buf(card, skb);
28532 vc->rx_iov = NULL;
28533 recycle_iov_buf(card, iovb);
28534 @@ -2216,7 +2216,7 @@ static void dequeue_rx(ns_dev *card, ns_
28535 printk("nicstar%d: Expected a large buffer, and this is not one.\n",
28536 card->index);
28537 which_list(card, skb);
28538 - atomic_inc(&vcc->stats->rx_err);
28539 + atomic_inc_unchecked(&vcc->stats->rx_err);
28540 recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
28541 NS_SKB(iovb)->iovcnt);
28542 vc->rx_iov = NULL;
28543 @@ -2240,7 +2240,7 @@ static void dequeue_rx(ns_dev *card, ns_
28544 printk(" - PDU size mismatch.\n");
28545 else
28546 printk(".\n");
28547 - atomic_inc(&vcc->stats->rx_err);
28548 + atomic_inc_unchecked(&vcc->stats->rx_err);
28549 recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
28550 NS_SKB(iovb)->iovcnt);
28551 vc->rx_iov = NULL;
28552 @@ -2256,7 +2256,7 @@ static void dequeue_rx(ns_dev *card, ns_
28553 if (!atm_charge(vcc, skb->truesize))
28554 {
28555 push_rxbufs(card, skb);
28556 - atomic_inc(&vcc->stats->rx_drop);
28557 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28558 }
28559 else
28560 {
28561 @@ -2268,7 +2268,7 @@ static void dequeue_rx(ns_dev *card, ns_
28562 ATM_SKB(skb)->vcc = vcc;
28563 __net_timestamp(skb);
28564 vcc->push(vcc, skb);
28565 - atomic_inc(&vcc->stats->rx);
28566 + atomic_inc_unchecked(&vcc->stats->rx);
28567 }
28568 }
28569 else if (NS_SKB(iovb)->iovcnt == 2) /* One small plus one large buffer */
28570 @@ -2283,7 +2283,7 @@ static void dequeue_rx(ns_dev *card, ns_
28571 if (!atm_charge(vcc, sb->truesize))
28572 {
28573 push_rxbufs(card, sb);
28574 - atomic_inc(&vcc->stats->rx_drop);
28575 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28576 }
28577 else
28578 {
28579 @@ -2295,7 +2295,7 @@ static void dequeue_rx(ns_dev *card, ns_
28580 ATM_SKB(sb)->vcc = vcc;
28581 __net_timestamp(sb);
28582 vcc->push(vcc, sb);
28583 - atomic_inc(&vcc->stats->rx);
28584 + atomic_inc_unchecked(&vcc->stats->rx);
28585 }
28586
28587 push_rxbufs(card, skb);
28588 @@ -2306,7 +2306,7 @@ static void dequeue_rx(ns_dev *card, ns_
28589 if (!atm_charge(vcc, skb->truesize))
28590 {
28591 push_rxbufs(card, skb);
28592 - atomic_inc(&vcc->stats->rx_drop);
28593 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28594 }
28595 else
28596 {
28597 @@ -2320,7 +2320,7 @@ static void dequeue_rx(ns_dev *card, ns_
28598 ATM_SKB(skb)->vcc = vcc;
28599 __net_timestamp(skb);
28600 vcc->push(vcc, skb);
28601 - atomic_inc(&vcc->stats->rx);
28602 + atomic_inc_unchecked(&vcc->stats->rx);
28603 }
28604
28605 push_rxbufs(card, sb);
28606 @@ -2342,7 +2342,7 @@ static void dequeue_rx(ns_dev *card, ns_
28607 if (hb == NULL)
28608 {
28609 printk("nicstar%d: Out of huge buffers.\n", card->index);
28610 - atomic_inc(&vcc->stats->rx_drop);
28611 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28612 recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
28613 NS_SKB(iovb)->iovcnt);
28614 vc->rx_iov = NULL;
28615 @@ -2393,7 +2393,7 @@ static void dequeue_rx(ns_dev *card, ns_
28616 }
28617 else
28618 dev_kfree_skb_any(hb);
28619 - atomic_inc(&vcc->stats->rx_drop);
28620 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28621 }
28622 else
28623 {
28624 @@ -2427,7 +2427,7 @@ static void dequeue_rx(ns_dev *card, ns_
28625 #endif /* NS_USE_DESTRUCTORS */
28626 __net_timestamp(hb);
28627 vcc->push(vcc, hb);
28628 - atomic_inc(&vcc->stats->rx);
28629 + atomic_inc_unchecked(&vcc->stats->rx);
28630 }
28631 }
28632
28633 diff -urNp linux-2.6.32.49/drivers/atm/solos-pci.c linux-2.6.32.49/drivers/atm/solos-pci.c
28634 --- linux-2.6.32.49/drivers/atm/solos-pci.c 2011-11-08 19:02:43.000000000 -0500
28635 +++ linux-2.6.32.49/drivers/atm/solos-pci.c 2011-11-15 19:59:43.000000000 -0500
28636 @@ -708,7 +708,7 @@ void solos_bh(unsigned long card_arg)
28637 }
28638 atm_charge(vcc, skb->truesize);
28639 vcc->push(vcc, skb);
28640 - atomic_inc(&vcc->stats->rx);
28641 + atomic_inc_unchecked(&vcc->stats->rx);
28642 break;
28643
28644 case PKT_STATUS:
28645 @@ -914,6 +914,8 @@ static int print_buffer(struct sk_buff *
28646 char msg[500];
28647 char item[10];
28648
28649 + pax_track_stack();
28650 +
28651 len = buf->len;
28652 for (i = 0; i < len; i++){
28653 if(i % 8 == 0)
28654 @@ -1023,7 +1025,7 @@ static uint32_t fpga_tx(struct solos_car
28655 vcc = SKB_CB(oldskb)->vcc;
28656
28657 if (vcc) {
28658 - atomic_inc(&vcc->stats->tx);
28659 + atomic_inc_unchecked(&vcc->stats->tx);
28660 solos_pop(vcc, oldskb);
28661 } else
28662 dev_kfree_skb_irq(oldskb);
28663 diff -urNp linux-2.6.32.49/drivers/atm/suni.c linux-2.6.32.49/drivers/atm/suni.c
28664 --- linux-2.6.32.49/drivers/atm/suni.c 2011-11-08 19:02:43.000000000 -0500
28665 +++ linux-2.6.32.49/drivers/atm/suni.c 2011-11-15 19:59:43.000000000 -0500
28666 @@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
28667
28668
28669 #define ADD_LIMITED(s,v) \
28670 - atomic_add((v),&stats->s); \
28671 - if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
28672 + atomic_add_unchecked((v),&stats->s); \
28673 + if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
28674
28675
28676 static void suni_hz(unsigned long from_timer)
28677 diff -urNp linux-2.6.32.49/drivers/atm/uPD98402.c linux-2.6.32.49/drivers/atm/uPD98402.c
28678 --- linux-2.6.32.49/drivers/atm/uPD98402.c 2011-11-08 19:02:43.000000000 -0500
28679 +++ linux-2.6.32.49/drivers/atm/uPD98402.c 2011-11-15 19:59:43.000000000 -0500
28680 @@ -41,7 +41,7 @@ static int fetch_stats(struct atm_dev *d
28681 struct sonet_stats tmp;
28682 int error = 0;
28683
28684 - atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
28685 + atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
28686 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
28687 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
28688 if (zero && !error) {
28689 @@ -160,9 +160,9 @@ static int uPD98402_ioctl(struct atm_dev
28690
28691
28692 #define ADD_LIMITED(s,v) \
28693 - { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
28694 - if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
28695 - atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
28696 + { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
28697 + if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
28698 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
28699
28700
28701 static void stat_event(struct atm_dev *dev)
28702 @@ -193,7 +193,7 @@ static void uPD98402_int(struct atm_dev
28703 if (reason & uPD98402_INT_PFM) stat_event(dev);
28704 if (reason & uPD98402_INT_PCO) {
28705 (void) GET(PCOCR); /* clear interrupt cause */
28706 - atomic_add(GET(HECCT),
28707 + atomic_add_unchecked(GET(HECCT),
28708 &PRIV(dev)->sonet_stats.uncorr_hcs);
28709 }
28710 if ((reason & uPD98402_INT_RFO) &&
28711 @@ -221,9 +221,9 @@ static int uPD98402_start(struct atm_dev
28712 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
28713 uPD98402_INT_LOS),PIMR); /* enable them */
28714 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
28715 - atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
28716 - atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
28717 - atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
28718 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
28719 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
28720 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
28721 return 0;
28722 }
28723
28724 diff -urNp linux-2.6.32.49/drivers/atm/zatm.c linux-2.6.32.49/drivers/atm/zatm.c
28725 --- linux-2.6.32.49/drivers/atm/zatm.c 2011-11-08 19:02:43.000000000 -0500
28726 +++ linux-2.6.32.49/drivers/atm/zatm.c 2011-11-15 19:59:43.000000000 -0500
28727 @@ -458,7 +458,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
28728 }
28729 if (!size) {
28730 dev_kfree_skb_irq(skb);
28731 - if (vcc) atomic_inc(&vcc->stats->rx_err);
28732 + if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
28733 continue;
28734 }
28735 if (!atm_charge(vcc,skb->truesize)) {
28736 @@ -468,7 +468,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
28737 skb->len = size;
28738 ATM_SKB(skb)->vcc = vcc;
28739 vcc->push(vcc,skb);
28740 - atomic_inc(&vcc->stats->rx);
28741 + atomic_inc_unchecked(&vcc->stats->rx);
28742 }
28743 zout(pos & 0xffff,MTA(mbx));
28744 #if 0 /* probably a stupid idea */
28745 @@ -732,7 +732,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
28746 skb_queue_head(&zatm_vcc->backlog,skb);
28747 break;
28748 }
28749 - atomic_inc(&vcc->stats->tx);
28750 + atomic_inc_unchecked(&vcc->stats->tx);
28751 wake_up(&zatm_vcc->tx_wait);
28752 }
28753
28754 diff -urNp linux-2.6.32.49/drivers/base/bus.c linux-2.6.32.49/drivers/base/bus.c
28755 --- linux-2.6.32.49/drivers/base/bus.c 2011-11-08 19:02:43.000000000 -0500
28756 +++ linux-2.6.32.49/drivers/base/bus.c 2011-11-15 19:59:43.000000000 -0500
28757 @@ -70,7 +70,7 @@ static ssize_t drv_attr_store(struct kob
28758 return ret;
28759 }
28760
28761 -static struct sysfs_ops driver_sysfs_ops = {
28762 +static const struct sysfs_ops driver_sysfs_ops = {
28763 .show = drv_attr_show,
28764 .store = drv_attr_store,
28765 };
28766 @@ -115,7 +115,7 @@ static ssize_t bus_attr_store(struct kob
28767 return ret;
28768 }
28769
28770 -static struct sysfs_ops bus_sysfs_ops = {
28771 +static const struct sysfs_ops bus_sysfs_ops = {
28772 .show = bus_attr_show,
28773 .store = bus_attr_store,
28774 };
28775 @@ -154,7 +154,7 @@ static int bus_uevent_filter(struct kset
28776 return 0;
28777 }
28778
28779 -static struct kset_uevent_ops bus_uevent_ops = {
28780 +static const struct kset_uevent_ops bus_uevent_ops = {
28781 .filter = bus_uevent_filter,
28782 };
28783
28784 diff -urNp linux-2.6.32.49/drivers/base/class.c linux-2.6.32.49/drivers/base/class.c
28785 --- linux-2.6.32.49/drivers/base/class.c 2011-11-08 19:02:43.000000000 -0500
28786 +++ linux-2.6.32.49/drivers/base/class.c 2011-11-15 19:59:43.000000000 -0500
28787 @@ -63,7 +63,7 @@ static void class_release(struct kobject
28788 kfree(cp);
28789 }
28790
28791 -static struct sysfs_ops class_sysfs_ops = {
28792 +static const struct sysfs_ops class_sysfs_ops = {
28793 .show = class_attr_show,
28794 .store = class_attr_store,
28795 };
28796 diff -urNp linux-2.6.32.49/drivers/base/core.c linux-2.6.32.49/drivers/base/core.c
28797 --- linux-2.6.32.49/drivers/base/core.c 2011-11-08 19:02:43.000000000 -0500
28798 +++ linux-2.6.32.49/drivers/base/core.c 2011-11-15 19:59:43.000000000 -0500
28799 @@ -100,7 +100,7 @@ static ssize_t dev_attr_store(struct kob
28800 return ret;
28801 }
28802
28803 -static struct sysfs_ops dev_sysfs_ops = {
28804 +static const struct sysfs_ops dev_sysfs_ops = {
28805 .show = dev_attr_show,
28806 .store = dev_attr_store,
28807 };
28808 @@ -252,7 +252,7 @@ static int dev_uevent(struct kset *kset,
28809 return retval;
28810 }
28811
28812 -static struct kset_uevent_ops device_uevent_ops = {
28813 +static const struct kset_uevent_ops device_uevent_ops = {
28814 .filter = dev_uevent_filter,
28815 .name = dev_uevent_name,
28816 .uevent = dev_uevent,
28817 diff -urNp linux-2.6.32.49/drivers/base/memory.c linux-2.6.32.49/drivers/base/memory.c
28818 --- linux-2.6.32.49/drivers/base/memory.c 2011-11-08 19:02:43.000000000 -0500
28819 +++ linux-2.6.32.49/drivers/base/memory.c 2011-11-15 19:59:43.000000000 -0500
28820 @@ -44,7 +44,7 @@ static int memory_uevent(struct kset *ks
28821 return retval;
28822 }
28823
28824 -static struct kset_uevent_ops memory_uevent_ops = {
28825 +static const struct kset_uevent_ops memory_uevent_ops = {
28826 .name = memory_uevent_name,
28827 .uevent = memory_uevent,
28828 };
28829 diff -urNp linux-2.6.32.49/drivers/base/sys.c linux-2.6.32.49/drivers/base/sys.c
28830 --- linux-2.6.32.49/drivers/base/sys.c 2011-11-26 19:44:53.000000000 -0500
28831 +++ linux-2.6.32.49/drivers/base/sys.c 2011-11-26 19:45:05.000000000 -0500
28832 @@ -54,7 +54,7 @@ sysdev_store(struct kobject *kobj, struc
28833 return -EIO;
28834 }
28835
28836 -static struct sysfs_ops sysfs_ops = {
28837 +static const struct sysfs_ops sysfs_ops = {
28838 .show = sysdev_show,
28839 .store = sysdev_store,
28840 };
28841 @@ -104,7 +104,7 @@ static ssize_t sysdev_class_store(struct
28842 return -EIO;
28843 }
28844
28845 -static struct sysfs_ops sysfs_class_ops = {
28846 +static const struct sysfs_ops sysfs_class_ops = {
28847 .show = sysdev_class_show,
28848 .store = sysdev_class_store,
28849 };
28850 diff -urNp linux-2.6.32.49/drivers/block/cciss.c linux-2.6.32.49/drivers/block/cciss.c
28851 --- linux-2.6.32.49/drivers/block/cciss.c 2011-11-08 19:02:43.000000000 -0500
28852 +++ linux-2.6.32.49/drivers/block/cciss.c 2011-11-15 19:59:43.000000000 -0500
28853 @@ -1011,6 +1011,8 @@ static int cciss_ioctl32_passthru(struct
28854 int err;
28855 u32 cp;
28856
28857 + memset(&arg64, 0, sizeof(arg64));
28858 +
28859 err = 0;
28860 err |=
28861 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
28862 @@ -2852,7 +2854,7 @@ static unsigned long pollcomplete(int ct
28863 /* Wait (up to 20 seconds) for a command to complete */
28864
28865 for (i = 20 * HZ; i > 0; i--) {
28866 - done = hba[ctlr]->access.command_completed(hba[ctlr]);
28867 + done = hba[ctlr]->access->command_completed(hba[ctlr]);
28868 if (done == FIFO_EMPTY)
28869 schedule_timeout_uninterruptible(1);
28870 else
28871 @@ -2876,7 +2878,7 @@ static int sendcmd_core(ctlr_info_t *h,
28872 resend_cmd1:
28873
28874 /* Disable interrupt on the board. */
28875 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
28876 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
28877
28878 /* Make sure there is room in the command FIFO */
28879 /* Actually it should be completely empty at this time */
28880 @@ -2884,13 +2886,13 @@ resend_cmd1:
28881 /* tape side of the driver. */
28882 for (i = 200000; i > 0; i--) {
28883 /* if fifo isn't full go */
28884 - if (!(h->access.fifo_full(h)))
28885 + if (!(h->access->fifo_full(h)))
28886 break;
28887 udelay(10);
28888 printk(KERN_WARNING "cciss cciss%d: SendCmd FIFO full,"
28889 " waiting!\n", h->ctlr);
28890 }
28891 - h->access.submit_command(h, c); /* Send the cmd */
28892 + h->access->submit_command(h, c); /* Send the cmd */
28893 do {
28894 complete = pollcomplete(h->ctlr);
28895
28896 @@ -3023,7 +3025,7 @@ static void start_io(ctlr_info_t *h)
28897 while (!hlist_empty(&h->reqQ)) {
28898 c = hlist_entry(h->reqQ.first, CommandList_struct, list);
28899 /* can't do anything if fifo is full */
28900 - if ((h->access.fifo_full(h))) {
28901 + if ((h->access->fifo_full(h))) {
28902 printk(KERN_WARNING "cciss: fifo full\n");
28903 break;
28904 }
28905 @@ -3033,7 +3035,7 @@ static void start_io(ctlr_info_t *h)
28906 h->Qdepth--;
28907
28908 /* Tell the controller execute command */
28909 - h->access.submit_command(h, c);
28910 + h->access->submit_command(h, c);
28911
28912 /* Put job onto the completed Q */
28913 addQ(&h->cmpQ, c);
28914 @@ -3393,17 +3395,17 @@ startio:
28915
28916 static inline unsigned long get_next_completion(ctlr_info_t *h)
28917 {
28918 - return h->access.command_completed(h);
28919 + return h->access->command_completed(h);
28920 }
28921
28922 static inline int interrupt_pending(ctlr_info_t *h)
28923 {
28924 - return h->access.intr_pending(h);
28925 + return h->access->intr_pending(h);
28926 }
28927
28928 static inline long interrupt_not_for_us(ctlr_info_t *h)
28929 {
28930 - return (((h->access.intr_pending(h) == 0) ||
28931 + return (((h->access->intr_pending(h) == 0) ||
28932 (h->interrupts_enabled == 0)));
28933 }
28934
28935 @@ -3892,7 +3894,7 @@ static int __devinit cciss_pci_init(ctlr
28936 */
28937 c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
28938 c->product_name = products[prod_index].product_name;
28939 - c->access = *(products[prod_index].access);
28940 + c->access = products[prod_index].access;
28941 c->nr_cmds = c->max_commands - 4;
28942 if ((readb(&c->cfgtable->Signature[0]) != 'C') ||
28943 (readb(&c->cfgtable->Signature[1]) != 'I') ||
28944 @@ -4291,7 +4293,7 @@ static int __devinit cciss_init_one(stru
28945 }
28946
28947 /* make sure the board interrupts are off */
28948 - hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_OFF);
28949 + hba[i]->access->set_intr_mask(hba[i], CCISS_INTR_OFF);
28950 if (request_irq(hba[i]->intr[SIMPLE_MODE_INT], do_cciss_intr,
28951 IRQF_DISABLED | IRQF_SHARED, hba[i]->devname, hba[i])) {
28952 printk(KERN_ERR "cciss: Unable to get irq %d for %s\n",
28953 @@ -4341,7 +4343,7 @@ static int __devinit cciss_init_one(stru
28954 cciss_scsi_setup(i);
28955
28956 /* Turn the interrupts on so we can service requests */
28957 - hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_ON);
28958 + hba[i]->access->set_intr_mask(hba[i], CCISS_INTR_ON);
28959
28960 /* Get the firmware version */
28961 inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
28962 diff -urNp linux-2.6.32.49/drivers/block/cciss.h linux-2.6.32.49/drivers/block/cciss.h
28963 --- linux-2.6.32.49/drivers/block/cciss.h 2011-11-08 19:02:43.000000000 -0500
28964 +++ linux-2.6.32.49/drivers/block/cciss.h 2011-11-15 19:59:43.000000000 -0500
28965 @@ -90,7 +90,7 @@ struct ctlr_info
28966 // information about each logical volume
28967 drive_info_struct *drv[CISS_MAX_LUN];
28968
28969 - struct access_method access;
28970 + struct access_method *access;
28971
28972 /* queue and queue Info */
28973 struct hlist_head reqQ;
28974 diff -urNp linux-2.6.32.49/drivers/block/cpqarray.c linux-2.6.32.49/drivers/block/cpqarray.c
28975 --- linux-2.6.32.49/drivers/block/cpqarray.c 2011-11-08 19:02:43.000000000 -0500
28976 +++ linux-2.6.32.49/drivers/block/cpqarray.c 2011-11-15 19:59:43.000000000 -0500
28977 @@ -402,7 +402,7 @@ static int __init cpqarray_register_ctlr
28978 if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
28979 goto Enomem4;
28980 }
28981 - hba[i]->access.set_intr_mask(hba[i], 0);
28982 + hba[i]->access->set_intr_mask(hba[i], 0);
28983 if (request_irq(hba[i]->intr, do_ida_intr,
28984 IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i]))
28985 {
28986 @@ -460,7 +460,7 @@ static int __init cpqarray_register_ctlr
28987 add_timer(&hba[i]->timer);
28988
28989 /* Enable IRQ now that spinlock and rate limit timer are set up */
28990 - hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
28991 + hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
28992
28993 for(j=0; j<NWD; j++) {
28994 struct gendisk *disk = ida_gendisk[i][j];
28995 @@ -695,7 +695,7 @@ DBGINFO(
28996 for(i=0; i<NR_PRODUCTS; i++) {
28997 if (board_id == products[i].board_id) {
28998 c->product_name = products[i].product_name;
28999 - c->access = *(products[i].access);
29000 + c->access = products[i].access;
29001 break;
29002 }
29003 }
29004 @@ -793,7 +793,7 @@ static int __init cpqarray_eisa_detect(v
29005 hba[ctlr]->intr = intr;
29006 sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
29007 hba[ctlr]->product_name = products[j].product_name;
29008 - hba[ctlr]->access = *(products[j].access);
29009 + hba[ctlr]->access = products[j].access;
29010 hba[ctlr]->ctlr = ctlr;
29011 hba[ctlr]->board_id = board_id;
29012 hba[ctlr]->pci_dev = NULL; /* not PCI */
29013 @@ -896,6 +896,8 @@ static void do_ida_request(struct reques
29014 struct scatterlist tmp_sg[SG_MAX];
29015 int i, dir, seg;
29016
29017 + pax_track_stack();
29018 +
29019 if (blk_queue_plugged(q))
29020 goto startio;
29021
29022 @@ -968,7 +970,7 @@ static void start_io(ctlr_info_t *h)
29023
29024 while((c = h->reqQ) != NULL) {
29025 /* Can't do anything if we're busy */
29026 - if (h->access.fifo_full(h) == 0)
29027 + if (h->access->fifo_full(h) == 0)
29028 return;
29029
29030 /* Get the first entry from the request Q */
29031 @@ -976,7 +978,7 @@ static void start_io(ctlr_info_t *h)
29032 h->Qdepth--;
29033
29034 /* Tell the controller to do our bidding */
29035 - h->access.submit_command(h, c);
29036 + h->access->submit_command(h, c);
29037
29038 /* Get onto the completion Q */
29039 addQ(&h->cmpQ, c);
29040 @@ -1038,7 +1040,7 @@ static irqreturn_t do_ida_intr(int irq,
29041 unsigned long flags;
29042 __u32 a,a1;
29043
29044 - istat = h->access.intr_pending(h);
29045 + istat = h->access->intr_pending(h);
29046 /* Is this interrupt for us? */
29047 if (istat == 0)
29048 return IRQ_NONE;
29049 @@ -1049,7 +1051,7 @@ static irqreturn_t do_ida_intr(int irq,
29050 */
29051 spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
29052 if (istat & FIFO_NOT_EMPTY) {
29053 - while((a = h->access.command_completed(h))) {
29054 + while((a = h->access->command_completed(h))) {
29055 a1 = a; a &= ~3;
29056 if ((c = h->cmpQ) == NULL)
29057 {
29058 @@ -1434,11 +1436,11 @@ static int sendcmd(
29059 /*
29060 * Disable interrupt
29061 */
29062 - info_p->access.set_intr_mask(info_p, 0);
29063 + info_p->access->set_intr_mask(info_p, 0);
29064 /* Make sure there is room in the command FIFO */
29065 /* Actually it should be completely empty at this time. */
29066 for (i = 200000; i > 0; i--) {
29067 - temp = info_p->access.fifo_full(info_p);
29068 + temp = info_p->access->fifo_full(info_p);
29069 if (temp != 0) {
29070 break;
29071 }
29072 @@ -1451,7 +1453,7 @@ DBG(
29073 /*
29074 * Send the cmd
29075 */
29076 - info_p->access.submit_command(info_p, c);
29077 + info_p->access->submit_command(info_p, c);
29078 complete = pollcomplete(ctlr);
29079
29080 pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
29081 @@ -1534,9 +1536,9 @@ static int revalidate_allvol(ctlr_info_t
29082 * we check the new geometry. Then turn interrupts back on when
29083 * we're done.
29084 */
29085 - host->access.set_intr_mask(host, 0);
29086 + host->access->set_intr_mask(host, 0);
29087 getgeometry(ctlr);
29088 - host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
29089 + host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
29090
29091 for(i=0; i<NWD; i++) {
29092 struct gendisk *disk = ida_gendisk[ctlr][i];
29093 @@ -1576,7 +1578,7 @@ static int pollcomplete(int ctlr)
29094 /* Wait (up to 2 seconds) for a command to complete */
29095
29096 for (i = 200000; i > 0; i--) {
29097 - done = hba[ctlr]->access.command_completed(hba[ctlr]);
29098 + done = hba[ctlr]->access->command_completed(hba[ctlr]);
29099 if (done == 0) {
29100 udelay(10); /* a short fixed delay */
29101 } else
29102 diff -urNp linux-2.6.32.49/drivers/block/cpqarray.h linux-2.6.32.49/drivers/block/cpqarray.h
29103 --- linux-2.6.32.49/drivers/block/cpqarray.h 2011-11-08 19:02:43.000000000 -0500
29104 +++ linux-2.6.32.49/drivers/block/cpqarray.h 2011-11-15 19:59:43.000000000 -0500
29105 @@ -99,7 +99,7 @@ struct ctlr_info {
29106 drv_info_t drv[NWD];
29107 struct proc_dir_entry *proc;
29108
29109 - struct access_method access;
29110 + struct access_method *access;
29111
29112 cmdlist_t *reqQ;
29113 cmdlist_t *cmpQ;
29114 diff -urNp linux-2.6.32.49/drivers/block/DAC960.c linux-2.6.32.49/drivers/block/DAC960.c
29115 --- linux-2.6.32.49/drivers/block/DAC960.c 2011-11-08 19:02:43.000000000 -0500
29116 +++ linux-2.6.32.49/drivers/block/DAC960.c 2011-11-15 19:59:43.000000000 -0500
29117 @@ -1973,6 +1973,8 @@ static bool DAC960_V1_ReadDeviceConfigur
29118 unsigned long flags;
29119 int Channel, TargetID;
29120
29121 + pax_track_stack();
29122 +
29123 if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
29124 DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
29125 sizeof(DAC960_SCSI_Inquiry_T) +
29126 diff -urNp linux-2.6.32.49/drivers/block/loop.c linux-2.6.32.49/drivers/block/loop.c
29127 --- linux-2.6.32.49/drivers/block/loop.c 2011-11-08 19:02:43.000000000 -0500
29128 +++ linux-2.6.32.49/drivers/block/loop.c 2011-11-15 19:59:43.000000000 -0500
29129 @@ -282,7 +282,7 @@ static int __do_lo_send_write(struct fil
29130 mm_segment_t old_fs = get_fs();
29131
29132 set_fs(get_ds());
29133 - bw = file->f_op->write(file, buf, len, &pos);
29134 + bw = file->f_op->write(file, (const char __force_user *)buf, len, &pos);
29135 set_fs(old_fs);
29136 if (likely(bw == len))
29137 return 0;
29138 diff -urNp linux-2.6.32.49/drivers/block/nbd.c linux-2.6.32.49/drivers/block/nbd.c
29139 --- linux-2.6.32.49/drivers/block/nbd.c 2011-11-08 19:02:43.000000000 -0500
29140 +++ linux-2.6.32.49/drivers/block/nbd.c 2011-11-15 19:59:43.000000000 -0500
29141 @@ -155,6 +155,8 @@ static int sock_xmit(struct nbd_device *
29142 struct kvec iov;
29143 sigset_t blocked, oldset;
29144
29145 + pax_track_stack();
29146 +
29147 if (unlikely(!sock)) {
29148 printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
29149 lo->disk->disk_name, (send ? "send" : "recv"));
29150 @@ -569,6 +571,8 @@ static void do_nbd_request(struct reques
29151 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
29152 unsigned int cmd, unsigned long arg)
29153 {
29154 + pax_track_stack();
29155 +
29156 switch (cmd) {
29157 case NBD_DISCONNECT: {
29158 struct request sreq;
29159 diff -urNp linux-2.6.32.49/drivers/block/pktcdvd.c linux-2.6.32.49/drivers/block/pktcdvd.c
29160 --- linux-2.6.32.49/drivers/block/pktcdvd.c 2011-11-08 19:02:43.000000000 -0500
29161 +++ linux-2.6.32.49/drivers/block/pktcdvd.c 2011-11-15 19:59:43.000000000 -0500
29162 @@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kob
29163 return len;
29164 }
29165
29166 -static struct sysfs_ops kobj_pkt_ops = {
29167 +static const struct sysfs_ops kobj_pkt_ops = {
29168 .show = kobj_pkt_show,
29169 .store = kobj_pkt_store
29170 };
29171 diff -urNp linux-2.6.32.49/drivers/char/agp/frontend.c linux-2.6.32.49/drivers/char/agp/frontend.c
29172 --- linux-2.6.32.49/drivers/char/agp/frontend.c 2011-11-08 19:02:43.000000000 -0500
29173 +++ linux-2.6.32.49/drivers/char/agp/frontend.c 2011-11-15 19:59:43.000000000 -0500
29174 @@ -824,7 +824,7 @@ static int agpioc_reserve_wrap(struct ag
29175 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
29176 return -EFAULT;
29177
29178 - if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
29179 + if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
29180 return -EFAULT;
29181
29182 client = agp_find_client_by_pid(reserve.pid);
29183 diff -urNp linux-2.6.32.49/drivers/char/briq_panel.c linux-2.6.32.49/drivers/char/briq_panel.c
29184 --- linux-2.6.32.49/drivers/char/briq_panel.c 2011-11-08 19:02:43.000000000 -0500
29185 +++ linux-2.6.32.49/drivers/char/briq_panel.c 2011-11-15 19:59:43.000000000 -0500
29186 @@ -10,6 +10,7 @@
29187 #include <linux/types.h>
29188 #include <linux/errno.h>
29189 #include <linux/tty.h>
29190 +#include <linux/mutex.h>
29191 #include <linux/timer.h>
29192 #include <linux/kernel.h>
29193 #include <linux/wait.h>
29194 @@ -36,6 +37,7 @@ static int vfd_is_open;
29195 static unsigned char vfd[40];
29196 static int vfd_cursor;
29197 static unsigned char ledpb, led;
29198 +static DEFINE_MUTEX(vfd_mutex);
29199
29200 static void update_vfd(void)
29201 {
29202 @@ -142,12 +144,15 @@ static ssize_t briq_panel_write(struct f
29203 if (!vfd_is_open)
29204 return -EBUSY;
29205
29206 + mutex_lock(&vfd_mutex);
29207 for (;;) {
29208 char c;
29209 if (!indx)
29210 break;
29211 - if (get_user(c, buf))
29212 + if (get_user(c, buf)) {
29213 + mutex_unlock(&vfd_mutex);
29214 return -EFAULT;
29215 + }
29216 if (esc) {
29217 set_led(c);
29218 esc = 0;
29219 @@ -177,6 +182,7 @@ static ssize_t briq_panel_write(struct f
29220 buf++;
29221 }
29222 update_vfd();
29223 + mutex_unlock(&vfd_mutex);
29224
29225 return len;
29226 }
29227 diff -urNp linux-2.6.32.49/drivers/char/genrtc.c linux-2.6.32.49/drivers/char/genrtc.c
29228 --- linux-2.6.32.49/drivers/char/genrtc.c 2011-11-08 19:02:43.000000000 -0500
29229 +++ linux-2.6.32.49/drivers/char/genrtc.c 2011-11-15 19:59:43.000000000 -0500
29230 @@ -272,6 +272,7 @@ static int gen_rtc_ioctl(struct inode *i
29231 switch (cmd) {
29232
29233 case RTC_PLL_GET:
29234 + memset(&pll, 0, sizeof(pll));
29235 if (get_rtc_pll(&pll))
29236 return -EINVAL;
29237 else
29238 diff -urNp linux-2.6.32.49/drivers/char/hpet.c linux-2.6.32.49/drivers/char/hpet.c
29239 --- linux-2.6.32.49/drivers/char/hpet.c 2011-11-08 19:02:43.000000000 -0500
29240 +++ linux-2.6.32.49/drivers/char/hpet.c 2011-11-15 19:59:43.000000000 -0500
29241 @@ -430,7 +430,7 @@ static int hpet_release(struct inode *in
29242 return 0;
29243 }
29244
29245 -static int hpet_ioctl_common(struct hpet_dev *, int, unsigned long, int);
29246 +static int hpet_ioctl_common(struct hpet_dev *, unsigned int, unsigned long, int);
29247
29248 static int
29249 hpet_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
29250 @@ -565,7 +565,7 @@ static inline unsigned long hpet_time_di
29251 }
29252
29253 static int
29254 -hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
29255 +hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg, int kernel)
29256 {
29257 struct hpet_timer __iomem *timer;
29258 struct hpet __iomem *hpet;
29259 @@ -608,11 +608,11 @@ hpet_ioctl_common(struct hpet_dev *devp,
29260 {
29261 struct hpet_info info;
29262
29263 + memset(&info, 0, sizeof(info));
29264 +
29265 if (devp->hd_ireqfreq)
29266 info.hi_ireqfreq =
29267 hpet_time_div(hpetp, devp->hd_ireqfreq);
29268 - else
29269 - info.hi_ireqfreq = 0;
29270 info.hi_flags =
29271 readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK;
29272 info.hi_hpet = hpetp->hp_which;
29273 diff -urNp linux-2.6.32.49/drivers/char/hvc_beat.c linux-2.6.32.49/drivers/char/hvc_beat.c
29274 --- linux-2.6.32.49/drivers/char/hvc_beat.c 2011-11-08 19:02:43.000000000 -0500
29275 +++ linux-2.6.32.49/drivers/char/hvc_beat.c 2011-11-15 19:59:43.000000000 -0500
29276 @@ -84,7 +84,7 @@ static int hvc_beat_put_chars(uint32_t v
29277 return cnt;
29278 }
29279
29280 -static struct hv_ops hvc_beat_get_put_ops = {
29281 +static const struct hv_ops hvc_beat_get_put_ops = {
29282 .get_chars = hvc_beat_get_chars,
29283 .put_chars = hvc_beat_put_chars,
29284 };
29285 diff -urNp linux-2.6.32.49/drivers/char/hvc_console.c linux-2.6.32.49/drivers/char/hvc_console.c
29286 --- linux-2.6.32.49/drivers/char/hvc_console.c 2011-11-08 19:02:43.000000000 -0500
29287 +++ linux-2.6.32.49/drivers/char/hvc_console.c 2011-11-15 19:59:43.000000000 -0500
29288 @@ -125,7 +125,7 @@ static struct hvc_struct *hvc_get_by_ind
29289 * console interfaces but can still be used as a tty device. This has to be
29290 * static because kmalloc will not work during early console init.
29291 */
29292 -static struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
29293 +static const struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
29294 static uint32_t vtermnos[MAX_NR_HVC_CONSOLES] =
29295 {[0 ... MAX_NR_HVC_CONSOLES - 1] = -1};
29296
29297 @@ -249,7 +249,7 @@ static void destroy_hvc_struct(struct kr
29298 * vty adapters do NOT get an hvc_instantiate() callback since they
29299 * appear after early console init.
29300 */
29301 -int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops)
29302 +int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
29303 {
29304 struct hvc_struct *hp;
29305
29306 @@ -758,7 +758,7 @@ static const struct tty_operations hvc_o
29307 };
29308
29309 struct hvc_struct __devinit *hvc_alloc(uint32_t vtermno, int data,
29310 - struct hv_ops *ops, int outbuf_size)
29311 + const struct hv_ops *ops, int outbuf_size)
29312 {
29313 struct hvc_struct *hp;
29314 int i;
29315 diff -urNp linux-2.6.32.49/drivers/char/hvc_console.h linux-2.6.32.49/drivers/char/hvc_console.h
29316 --- linux-2.6.32.49/drivers/char/hvc_console.h 2011-11-08 19:02:43.000000000 -0500
29317 +++ linux-2.6.32.49/drivers/char/hvc_console.h 2011-11-15 19:59:43.000000000 -0500
29318 @@ -55,7 +55,7 @@ struct hvc_struct {
29319 int outbuf_size;
29320 int n_outbuf;
29321 uint32_t vtermno;
29322 - struct hv_ops *ops;
29323 + const struct hv_ops *ops;
29324 int irq_requested;
29325 int data;
29326 struct winsize ws;
29327 @@ -76,11 +76,11 @@ struct hv_ops {
29328 };
29329
29330 /* Register a vterm and a slot index for use as a console (console_init) */
29331 -extern int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops);
29332 +extern int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops);
29333
29334 /* register a vterm for hvc tty operation (module_init or hotplug add) */
29335 extern struct hvc_struct * __devinit hvc_alloc(uint32_t vtermno, int data,
29336 - struct hv_ops *ops, int outbuf_size);
29337 + const struct hv_ops *ops, int outbuf_size);
29338 /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
29339 extern int hvc_remove(struct hvc_struct *hp);
29340
29341 diff -urNp linux-2.6.32.49/drivers/char/hvc_iseries.c linux-2.6.32.49/drivers/char/hvc_iseries.c
29342 --- linux-2.6.32.49/drivers/char/hvc_iseries.c 2011-11-08 19:02:43.000000000 -0500
29343 +++ linux-2.6.32.49/drivers/char/hvc_iseries.c 2011-11-15 19:59:43.000000000 -0500
29344 @@ -197,7 +197,7 @@ done:
29345 return sent;
29346 }
29347
29348 -static struct hv_ops hvc_get_put_ops = {
29349 +static const struct hv_ops hvc_get_put_ops = {
29350 .get_chars = get_chars,
29351 .put_chars = put_chars,
29352 .notifier_add = notifier_add_irq,
29353 diff -urNp linux-2.6.32.49/drivers/char/hvc_iucv.c linux-2.6.32.49/drivers/char/hvc_iucv.c
29354 --- linux-2.6.32.49/drivers/char/hvc_iucv.c 2011-11-08 19:02:43.000000000 -0500
29355 +++ linux-2.6.32.49/drivers/char/hvc_iucv.c 2011-11-15 19:59:43.000000000 -0500
29356 @@ -924,7 +924,7 @@ static int hvc_iucv_pm_restore_thaw(stru
29357
29358
29359 /* HVC operations */
29360 -static struct hv_ops hvc_iucv_ops = {
29361 +static const struct hv_ops hvc_iucv_ops = {
29362 .get_chars = hvc_iucv_get_chars,
29363 .put_chars = hvc_iucv_put_chars,
29364 .notifier_add = hvc_iucv_notifier_add,
29365 diff -urNp linux-2.6.32.49/drivers/char/hvc_rtas.c linux-2.6.32.49/drivers/char/hvc_rtas.c
29366 --- linux-2.6.32.49/drivers/char/hvc_rtas.c 2011-11-08 19:02:43.000000000 -0500
29367 +++ linux-2.6.32.49/drivers/char/hvc_rtas.c 2011-11-15 19:59:43.000000000 -0500
29368 @@ -71,7 +71,7 @@ static int hvc_rtas_read_console(uint32_
29369 return i;
29370 }
29371
29372 -static struct hv_ops hvc_rtas_get_put_ops = {
29373 +static const struct hv_ops hvc_rtas_get_put_ops = {
29374 .get_chars = hvc_rtas_read_console,
29375 .put_chars = hvc_rtas_write_console,
29376 };
29377 diff -urNp linux-2.6.32.49/drivers/char/hvcs.c linux-2.6.32.49/drivers/char/hvcs.c
29378 --- linux-2.6.32.49/drivers/char/hvcs.c 2011-11-08 19:02:43.000000000 -0500
29379 +++ linux-2.6.32.49/drivers/char/hvcs.c 2011-11-15 19:59:43.000000000 -0500
29380 @@ -82,6 +82,7 @@
29381 #include <asm/hvcserver.h>
29382 #include <asm/uaccess.h>
29383 #include <asm/vio.h>
29384 +#include <asm/local.h>
29385
29386 /*
29387 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
29388 @@ -269,7 +270,7 @@ struct hvcs_struct {
29389 unsigned int index;
29390
29391 struct tty_struct *tty;
29392 - int open_count;
29393 + local_t open_count;
29394
29395 /*
29396 * Used to tell the driver kernel_thread what operations need to take
29397 @@ -419,7 +420,7 @@ static ssize_t hvcs_vterm_state_store(st
29398
29399 spin_lock_irqsave(&hvcsd->lock, flags);
29400
29401 - if (hvcsd->open_count > 0) {
29402 + if (local_read(&hvcsd->open_count) > 0) {
29403 spin_unlock_irqrestore(&hvcsd->lock, flags);
29404 printk(KERN_INFO "HVCS: vterm state unchanged. "
29405 "The hvcs device node is still in use.\n");
29406 @@ -1135,7 +1136,7 @@ static int hvcs_open(struct tty_struct *
29407 if ((retval = hvcs_partner_connect(hvcsd)))
29408 goto error_release;
29409
29410 - hvcsd->open_count = 1;
29411 + local_set(&hvcsd->open_count, 1);
29412 hvcsd->tty = tty;
29413 tty->driver_data = hvcsd;
29414
29415 @@ -1169,7 +1170,7 @@ fast_open:
29416
29417 spin_lock_irqsave(&hvcsd->lock, flags);
29418 kref_get(&hvcsd->kref);
29419 - hvcsd->open_count++;
29420 + local_inc(&hvcsd->open_count);
29421 hvcsd->todo_mask |= HVCS_SCHED_READ;
29422 spin_unlock_irqrestore(&hvcsd->lock, flags);
29423
29424 @@ -1213,7 +1214,7 @@ static void hvcs_close(struct tty_struct
29425 hvcsd = tty->driver_data;
29426
29427 spin_lock_irqsave(&hvcsd->lock, flags);
29428 - if (--hvcsd->open_count == 0) {
29429 + if (local_dec_and_test(&hvcsd->open_count)) {
29430
29431 vio_disable_interrupts(hvcsd->vdev);
29432
29433 @@ -1239,10 +1240,10 @@ static void hvcs_close(struct tty_struct
29434 free_irq(irq, hvcsd);
29435 kref_put(&hvcsd->kref, destroy_hvcs_struct);
29436 return;
29437 - } else if (hvcsd->open_count < 0) {
29438 + } else if (local_read(&hvcsd->open_count) < 0) {
29439 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
29440 " is missmanaged.\n",
29441 - hvcsd->vdev->unit_address, hvcsd->open_count);
29442 + hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
29443 }
29444
29445 spin_unlock_irqrestore(&hvcsd->lock, flags);
29446 @@ -1258,7 +1259,7 @@ static void hvcs_hangup(struct tty_struc
29447
29448 spin_lock_irqsave(&hvcsd->lock, flags);
29449 /* Preserve this so that we know how many kref refs to put */
29450 - temp_open_count = hvcsd->open_count;
29451 + temp_open_count = local_read(&hvcsd->open_count);
29452
29453 /*
29454 * Don't kref put inside the spinlock because the destruction
29455 @@ -1273,7 +1274,7 @@ static void hvcs_hangup(struct tty_struc
29456 hvcsd->tty->driver_data = NULL;
29457 hvcsd->tty = NULL;
29458
29459 - hvcsd->open_count = 0;
29460 + local_set(&hvcsd->open_count, 0);
29461
29462 /* This will drop any buffered data on the floor which is OK in a hangup
29463 * scenario. */
29464 @@ -1344,7 +1345,7 @@ static int hvcs_write(struct tty_struct
29465 * the middle of a write operation? This is a crummy place to do this
29466 * but we want to keep it all in the spinlock.
29467 */
29468 - if (hvcsd->open_count <= 0) {
29469 + if (local_read(&hvcsd->open_count) <= 0) {
29470 spin_unlock_irqrestore(&hvcsd->lock, flags);
29471 return -ENODEV;
29472 }
29473 @@ -1418,7 +1419,7 @@ static int hvcs_write_room(struct tty_st
29474 {
29475 struct hvcs_struct *hvcsd = tty->driver_data;
29476
29477 - if (!hvcsd || hvcsd->open_count <= 0)
29478 + if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
29479 return 0;
29480
29481 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
29482 diff -urNp linux-2.6.32.49/drivers/char/hvc_udbg.c linux-2.6.32.49/drivers/char/hvc_udbg.c
29483 --- linux-2.6.32.49/drivers/char/hvc_udbg.c 2011-11-08 19:02:43.000000000 -0500
29484 +++ linux-2.6.32.49/drivers/char/hvc_udbg.c 2011-11-15 19:59:43.000000000 -0500
29485 @@ -58,7 +58,7 @@ static int hvc_udbg_get(uint32_t vtermno
29486 return i;
29487 }
29488
29489 -static struct hv_ops hvc_udbg_ops = {
29490 +static const struct hv_ops hvc_udbg_ops = {
29491 .get_chars = hvc_udbg_get,
29492 .put_chars = hvc_udbg_put,
29493 };
29494 diff -urNp linux-2.6.32.49/drivers/char/hvc_vio.c linux-2.6.32.49/drivers/char/hvc_vio.c
29495 --- linux-2.6.32.49/drivers/char/hvc_vio.c 2011-11-08 19:02:43.000000000 -0500
29496 +++ linux-2.6.32.49/drivers/char/hvc_vio.c 2011-11-15 19:59:43.000000000 -0500
29497 @@ -77,7 +77,7 @@ static int filtered_get_chars(uint32_t v
29498 return got;
29499 }
29500
29501 -static struct hv_ops hvc_get_put_ops = {
29502 +static const struct hv_ops hvc_get_put_ops = {
29503 .get_chars = filtered_get_chars,
29504 .put_chars = hvc_put_chars,
29505 .notifier_add = notifier_add_irq,
29506 diff -urNp linux-2.6.32.49/drivers/char/hvc_xen.c linux-2.6.32.49/drivers/char/hvc_xen.c
29507 --- linux-2.6.32.49/drivers/char/hvc_xen.c 2011-11-08 19:02:43.000000000 -0500
29508 +++ linux-2.6.32.49/drivers/char/hvc_xen.c 2011-11-15 19:59:43.000000000 -0500
29509 @@ -120,7 +120,7 @@ static int read_console(uint32_t vtermno
29510 return recv;
29511 }
29512
29513 -static struct hv_ops hvc_ops = {
29514 +static const struct hv_ops hvc_ops = {
29515 .get_chars = read_console,
29516 .put_chars = write_console,
29517 .notifier_add = notifier_add_irq,
29518 diff -urNp linux-2.6.32.49/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.32.49/drivers/char/ipmi/ipmi_msghandler.c
29519 --- linux-2.6.32.49/drivers/char/ipmi/ipmi_msghandler.c 2011-11-08 19:02:43.000000000 -0500
29520 +++ linux-2.6.32.49/drivers/char/ipmi/ipmi_msghandler.c 2011-11-15 19:59:43.000000000 -0500
29521 @@ -414,7 +414,7 @@ struct ipmi_smi {
29522 struct proc_dir_entry *proc_dir;
29523 char proc_dir_name[10];
29524
29525 - atomic_t stats[IPMI_NUM_STATS];
29526 + atomic_unchecked_t stats[IPMI_NUM_STATS];
29527
29528 /*
29529 * run_to_completion duplicate of smb_info, smi_info
29530 @@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
29531
29532
29533 #define ipmi_inc_stat(intf, stat) \
29534 - atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
29535 + atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
29536 #define ipmi_get_stat(intf, stat) \
29537 - ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
29538 + ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
29539
29540 static int is_lan_addr(struct ipmi_addr *addr)
29541 {
29542 @@ -2808,7 +2808,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
29543 INIT_LIST_HEAD(&intf->cmd_rcvrs);
29544 init_waitqueue_head(&intf->waitq);
29545 for (i = 0; i < IPMI_NUM_STATS; i++)
29546 - atomic_set(&intf->stats[i], 0);
29547 + atomic_set_unchecked(&intf->stats[i], 0);
29548
29549 intf->proc_dir = NULL;
29550
29551 @@ -4160,6 +4160,8 @@ static void send_panic_events(char *str)
29552 struct ipmi_smi_msg smi_msg;
29553 struct ipmi_recv_msg recv_msg;
29554
29555 + pax_track_stack();
29556 +
29557 si = (struct ipmi_system_interface_addr *) &addr;
29558 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
29559 si->channel = IPMI_BMC_CHANNEL;
29560 diff -urNp linux-2.6.32.49/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.32.49/drivers/char/ipmi/ipmi_si_intf.c
29561 --- linux-2.6.32.49/drivers/char/ipmi/ipmi_si_intf.c 2011-11-08 19:02:43.000000000 -0500
29562 +++ linux-2.6.32.49/drivers/char/ipmi/ipmi_si_intf.c 2011-11-15 19:59:43.000000000 -0500
29563 @@ -277,7 +277,7 @@ struct smi_info {
29564 unsigned char slave_addr;
29565
29566 /* Counters and things for the proc filesystem. */
29567 - atomic_t stats[SI_NUM_STATS];
29568 + atomic_unchecked_t stats[SI_NUM_STATS];
29569
29570 struct task_struct *thread;
29571
29572 @@ -285,9 +285,9 @@ struct smi_info {
29573 };
29574
29575 #define smi_inc_stat(smi, stat) \
29576 - atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
29577 + atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
29578 #define smi_get_stat(smi, stat) \
29579 - ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
29580 + ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
29581
29582 #define SI_MAX_PARMS 4
29583
29584 @@ -2931,7 +2931,7 @@ static int try_smi_init(struct smi_info
29585 atomic_set(&new_smi->req_events, 0);
29586 new_smi->run_to_completion = 0;
29587 for (i = 0; i < SI_NUM_STATS; i++)
29588 - atomic_set(&new_smi->stats[i], 0);
29589 + atomic_set_unchecked(&new_smi->stats[i], 0);
29590
29591 new_smi->interrupt_disabled = 0;
29592 atomic_set(&new_smi->stop_operation, 0);
29593 diff -urNp linux-2.6.32.49/drivers/char/istallion.c linux-2.6.32.49/drivers/char/istallion.c
29594 --- linux-2.6.32.49/drivers/char/istallion.c 2011-11-08 19:02:43.000000000 -0500
29595 +++ linux-2.6.32.49/drivers/char/istallion.c 2011-11-15 19:59:43.000000000 -0500
29596 @@ -187,7 +187,6 @@ static struct ktermios stli_deftermios
29597 * re-used for each stats call.
29598 */
29599 static comstats_t stli_comstats;
29600 -static combrd_t stli_brdstats;
29601 static struct asystats stli_cdkstats;
29602
29603 /*****************************************************************************/
29604 @@ -4058,6 +4057,7 @@ static int stli_getbrdstats(combrd_t __u
29605 {
29606 struct stlibrd *brdp;
29607 unsigned int i;
29608 + combrd_t stli_brdstats;
29609
29610 if (copy_from_user(&stli_brdstats, bp, sizeof(combrd_t)))
29611 return -EFAULT;
29612 @@ -4269,6 +4269,8 @@ static int stli_getportstruct(struct stl
29613 struct stliport stli_dummyport;
29614 struct stliport *portp;
29615
29616 + pax_track_stack();
29617 +
29618 if (copy_from_user(&stli_dummyport, arg, sizeof(struct stliport)))
29619 return -EFAULT;
29620 portp = stli_getport(stli_dummyport.brdnr, stli_dummyport.panelnr,
29621 @@ -4291,6 +4293,8 @@ static int stli_getbrdstruct(struct stli
29622 struct stlibrd stli_dummybrd;
29623 struct stlibrd *brdp;
29624
29625 + pax_track_stack();
29626 +
29627 if (copy_from_user(&stli_dummybrd, arg, sizeof(struct stlibrd)))
29628 return -EFAULT;
29629 if (stli_dummybrd.brdnr >= STL_MAXBRDS)
29630 diff -urNp linux-2.6.32.49/drivers/char/Kconfig linux-2.6.32.49/drivers/char/Kconfig
29631 --- linux-2.6.32.49/drivers/char/Kconfig 2011-11-08 19:02:43.000000000 -0500
29632 +++ linux-2.6.32.49/drivers/char/Kconfig 2011-11-15 19:59:43.000000000 -0500
29633 @@ -90,7 +90,8 @@ config VT_HW_CONSOLE_BINDING
29634
29635 config DEVKMEM
29636 bool "/dev/kmem virtual device support"
29637 - default y
29638 + default n
29639 + depends on !GRKERNSEC_KMEM
29640 help
29641 Say Y here if you want to support the /dev/kmem device. The
29642 /dev/kmem device is rarely used, but can be used for certain
29643 @@ -1114,6 +1115,7 @@ config DEVPORT
29644 bool
29645 depends on !M68K
29646 depends on ISA || PCI
29647 + depends on !GRKERNSEC_KMEM
29648 default y
29649
29650 source "drivers/s390/char/Kconfig"
29651 diff -urNp linux-2.6.32.49/drivers/char/keyboard.c linux-2.6.32.49/drivers/char/keyboard.c
29652 --- linux-2.6.32.49/drivers/char/keyboard.c 2011-11-08 19:02:43.000000000 -0500
29653 +++ linux-2.6.32.49/drivers/char/keyboard.c 2011-11-15 19:59:43.000000000 -0500
29654 @@ -635,6 +635,16 @@ static void k_spec(struct vc_data *vc, u
29655 kbd->kbdmode == VC_MEDIUMRAW) &&
29656 value != KVAL(K_SAK))
29657 return; /* SAK is allowed even in raw mode */
29658 +
29659 +#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
29660 + {
29661 + void *func = fn_handler[value];
29662 + if (func == fn_show_state || func == fn_show_ptregs ||
29663 + func == fn_show_mem)
29664 + return;
29665 + }
29666 +#endif
29667 +
29668 fn_handler[value](vc);
29669 }
29670
29671 @@ -1386,7 +1396,7 @@ static const struct input_device_id kbd_
29672 .evbit = { BIT_MASK(EV_SND) },
29673 },
29674
29675 - { }, /* Terminating entry */
29676 + { 0 }, /* Terminating entry */
29677 };
29678
29679 MODULE_DEVICE_TABLE(input, kbd_ids);
29680 diff -urNp linux-2.6.32.49/drivers/char/mbcs.c linux-2.6.32.49/drivers/char/mbcs.c
29681 --- linux-2.6.32.49/drivers/char/mbcs.c 2011-11-08 19:02:43.000000000 -0500
29682 +++ linux-2.6.32.49/drivers/char/mbcs.c 2011-11-18 18:01:55.000000000 -0500
29683 @@ -799,7 +799,7 @@ static int mbcs_remove(struct cx_dev *de
29684 return 0;
29685 }
29686
29687 -static const struct cx_device_id __devinitdata mbcs_id_table[] = {
29688 +static const struct cx_device_id __devinitconst mbcs_id_table[] = {
29689 {
29690 .part_num = MBCS_PART_NUM,
29691 .mfg_num = MBCS_MFG_NUM,
29692 diff -urNp linux-2.6.32.49/drivers/char/mem.c linux-2.6.32.49/drivers/char/mem.c
29693 --- linux-2.6.32.49/drivers/char/mem.c 2011-11-08 19:02:43.000000000 -0500
29694 +++ linux-2.6.32.49/drivers/char/mem.c 2011-11-15 19:59:43.000000000 -0500
29695 @@ -18,6 +18,7 @@
29696 #include <linux/raw.h>
29697 #include <linux/tty.h>
29698 #include <linux/capability.h>
29699 +#include <linux/security.h>
29700 #include <linux/ptrace.h>
29701 #include <linux/device.h>
29702 #include <linux/highmem.h>
29703 @@ -35,6 +36,10 @@
29704 # include <linux/efi.h>
29705 #endif
29706
29707 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
29708 +extern struct file_operations grsec_fops;
29709 +#endif
29710 +
29711 static inline unsigned long size_inside_page(unsigned long start,
29712 unsigned long size)
29713 {
29714 @@ -102,9 +107,13 @@ static inline int range_is_allowed(unsig
29715
29716 while (cursor < to) {
29717 if (!devmem_is_allowed(pfn)) {
29718 +#ifdef CONFIG_GRKERNSEC_KMEM
29719 + gr_handle_mem_readwrite(from, to);
29720 +#else
29721 printk(KERN_INFO
29722 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
29723 current->comm, from, to);
29724 +#endif
29725 return 0;
29726 }
29727 cursor += PAGE_SIZE;
29728 @@ -112,6 +121,11 @@ static inline int range_is_allowed(unsig
29729 }
29730 return 1;
29731 }
29732 +#elif defined(CONFIG_GRKERNSEC_KMEM)
29733 +static inline int range_is_allowed(unsigned long pfn, unsigned long size)
29734 +{
29735 + return 0;
29736 +}
29737 #else
29738 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
29739 {
29740 @@ -155,6 +169,8 @@ static ssize_t read_mem(struct file * fi
29741 #endif
29742
29743 while (count > 0) {
29744 + char *temp;
29745 +
29746 /*
29747 * Handle first page in case it's not aligned
29748 */
29749 @@ -177,11 +193,31 @@ static ssize_t read_mem(struct file * fi
29750 if (!ptr)
29751 return -EFAULT;
29752
29753 - if (copy_to_user(buf, ptr, sz)) {
29754 +#ifdef CONFIG_PAX_USERCOPY
29755 + temp = kmalloc(sz, GFP_KERNEL);
29756 + if (!temp) {
29757 + unxlate_dev_mem_ptr(p, ptr);
29758 + return -ENOMEM;
29759 + }
29760 + memcpy(temp, ptr, sz);
29761 +#else
29762 + temp = ptr;
29763 +#endif
29764 +
29765 + if (copy_to_user(buf, temp, sz)) {
29766 +
29767 +#ifdef CONFIG_PAX_USERCOPY
29768 + kfree(temp);
29769 +#endif
29770 +
29771 unxlate_dev_mem_ptr(p, ptr);
29772 return -EFAULT;
29773 }
29774
29775 +#ifdef CONFIG_PAX_USERCOPY
29776 + kfree(temp);
29777 +#endif
29778 +
29779 unxlate_dev_mem_ptr(p, ptr);
29780
29781 buf += sz;
29782 @@ -419,9 +455,8 @@ static ssize_t read_kmem(struct file *fi
29783 size_t count, loff_t *ppos)
29784 {
29785 unsigned long p = *ppos;
29786 - ssize_t low_count, read, sz;
29787 + ssize_t low_count, read, sz, err = 0;
29788 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
29789 - int err = 0;
29790
29791 read = 0;
29792 if (p < (unsigned long) high_memory) {
29793 @@ -444,6 +479,8 @@ static ssize_t read_kmem(struct file *fi
29794 }
29795 #endif
29796 while (low_count > 0) {
29797 + char *temp;
29798 +
29799 sz = size_inside_page(p, low_count);
29800
29801 /*
29802 @@ -453,7 +490,22 @@ static ssize_t read_kmem(struct file *fi
29803 */
29804 kbuf = xlate_dev_kmem_ptr((char *)p);
29805
29806 - if (copy_to_user(buf, kbuf, sz))
29807 +#ifdef CONFIG_PAX_USERCOPY
29808 + temp = kmalloc(sz, GFP_KERNEL);
29809 + if (!temp)
29810 + return -ENOMEM;
29811 + memcpy(temp, kbuf, sz);
29812 +#else
29813 + temp = kbuf;
29814 +#endif
29815 +
29816 + err = copy_to_user(buf, temp, sz);
29817 +
29818 +#ifdef CONFIG_PAX_USERCOPY
29819 + kfree(temp);
29820 +#endif
29821 +
29822 + if (err)
29823 return -EFAULT;
29824 buf += sz;
29825 p += sz;
29826 @@ -889,6 +941,9 @@ static const struct memdev {
29827 #ifdef CONFIG_CRASH_DUMP
29828 [12] = { "oldmem", 0, &oldmem_fops, NULL },
29829 #endif
29830 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
29831 + [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
29832 +#endif
29833 };
29834
29835 static int memory_open(struct inode *inode, struct file *filp)
29836 diff -urNp linux-2.6.32.49/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.49/drivers/char/pcmcia/ipwireless/tty.c
29837 --- linux-2.6.32.49/drivers/char/pcmcia/ipwireless/tty.c 2011-11-08 19:02:43.000000000 -0500
29838 +++ linux-2.6.32.49/drivers/char/pcmcia/ipwireless/tty.c 2011-11-15 19:59:43.000000000 -0500
29839 @@ -29,6 +29,7 @@
29840 #include <linux/tty_driver.h>
29841 #include <linux/tty_flip.h>
29842 #include <linux/uaccess.h>
29843 +#include <asm/local.h>
29844
29845 #include "tty.h"
29846 #include "network.h"
29847 @@ -51,7 +52,7 @@ struct ipw_tty {
29848 int tty_type;
29849 struct ipw_network *network;
29850 struct tty_struct *linux_tty;
29851 - int open_count;
29852 + local_t open_count;
29853 unsigned int control_lines;
29854 struct mutex ipw_tty_mutex;
29855 int tx_bytes_queued;
29856 @@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *l
29857 mutex_unlock(&tty->ipw_tty_mutex);
29858 return -ENODEV;
29859 }
29860 - if (tty->open_count == 0)
29861 + if (local_read(&tty->open_count) == 0)
29862 tty->tx_bytes_queued = 0;
29863
29864 - tty->open_count++;
29865 + local_inc(&tty->open_count);
29866
29867 tty->linux_tty = linux_tty;
29868 linux_tty->driver_data = tty;
29869 @@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *l
29870
29871 static void do_ipw_close(struct ipw_tty *tty)
29872 {
29873 - tty->open_count--;
29874 -
29875 - if (tty->open_count == 0) {
29876 + if (local_dec_return(&tty->open_count) == 0) {
29877 struct tty_struct *linux_tty = tty->linux_tty;
29878
29879 if (linux_tty != NULL) {
29880 @@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct
29881 return;
29882
29883 mutex_lock(&tty->ipw_tty_mutex);
29884 - if (tty->open_count == 0) {
29885 + if (local_read(&tty->open_count) == 0) {
29886 mutex_unlock(&tty->ipw_tty_mutex);
29887 return;
29888 }
29889 @@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_
29890 return;
29891 }
29892
29893 - if (!tty->open_count) {
29894 + if (!local_read(&tty->open_count)) {
29895 mutex_unlock(&tty->ipw_tty_mutex);
29896 return;
29897 }
29898 @@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *
29899 return -ENODEV;
29900
29901 mutex_lock(&tty->ipw_tty_mutex);
29902 - if (!tty->open_count) {
29903 + if (!local_read(&tty->open_count)) {
29904 mutex_unlock(&tty->ipw_tty_mutex);
29905 return -EINVAL;
29906 }
29907 @@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_str
29908 if (!tty)
29909 return -ENODEV;
29910
29911 - if (!tty->open_count)
29912 + if (!local_read(&tty->open_count))
29913 return -EINVAL;
29914
29915 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
29916 @@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tt
29917 if (!tty)
29918 return 0;
29919
29920 - if (!tty->open_count)
29921 + if (!local_read(&tty->open_count))
29922 return 0;
29923
29924 return tty->tx_bytes_queued;
29925 @@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struc
29926 if (!tty)
29927 return -ENODEV;
29928
29929 - if (!tty->open_count)
29930 + if (!local_read(&tty->open_count))
29931 return -EINVAL;
29932
29933 return get_control_lines(tty);
29934 @@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
29935 if (!tty)
29936 return -ENODEV;
29937
29938 - if (!tty->open_count)
29939 + if (!local_read(&tty->open_count))
29940 return -EINVAL;
29941
29942 return set_control_lines(tty, set, clear);
29943 @@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *
29944 if (!tty)
29945 return -ENODEV;
29946
29947 - if (!tty->open_count)
29948 + if (!local_read(&tty->open_count))
29949 return -EINVAL;
29950
29951 /* FIXME: Exactly how is the tty object locked here .. */
29952 @@ -591,7 +590,7 @@ void ipwireless_tty_free(struct ipw_tty
29953 against a parallel ioctl etc */
29954 mutex_lock(&ttyj->ipw_tty_mutex);
29955 }
29956 - while (ttyj->open_count)
29957 + while (local_read(&ttyj->open_count))
29958 do_ipw_close(ttyj);
29959 ipwireless_disassociate_network_ttys(network,
29960 ttyj->channel_idx);
29961 diff -urNp linux-2.6.32.49/drivers/char/pty.c linux-2.6.32.49/drivers/char/pty.c
29962 --- linux-2.6.32.49/drivers/char/pty.c 2011-11-08 19:02:43.000000000 -0500
29963 +++ linux-2.6.32.49/drivers/char/pty.c 2011-11-15 19:59:43.000000000 -0500
29964 @@ -736,8 +736,10 @@ static void __init unix98_pty_init(void)
29965 register_sysctl_table(pty_root_table);
29966
29967 /* Now create the /dev/ptmx special device */
29968 + pax_open_kernel();
29969 tty_default_fops(&ptmx_fops);
29970 - ptmx_fops.open = ptmx_open;
29971 + *(void **)&ptmx_fops.open = ptmx_open;
29972 + pax_close_kernel();
29973
29974 cdev_init(&ptmx_cdev, &ptmx_fops);
29975 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
29976 diff -urNp linux-2.6.32.49/drivers/char/random.c linux-2.6.32.49/drivers/char/random.c
29977 --- linux-2.6.32.49/drivers/char/random.c 2011-11-08 19:02:43.000000000 -0500
29978 +++ linux-2.6.32.49/drivers/char/random.c 2011-11-15 19:59:43.000000000 -0500
29979 @@ -254,8 +254,13 @@
29980 /*
29981 * Configuration information
29982 */
29983 +#ifdef CONFIG_GRKERNSEC_RANDNET
29984 +#define INPUT_POOL_WORDS 512
29985 +#define OUTPUT_POOL_WORDS 128
29986 +#else
29987 #define INPUT_POOL_WORDS 128
29988 #define OUTPUT_POOL_WORDS 32
29989 +#endif
29990 #define SEC_XFER_SIZE 512
29991
29992 /*
29993 @@ -292,10 +297,17 @@ static struct poolinfo {
29994 int poolwords;
29995 int tap1, tap2, tap3, tap4, tap5;
29996 } poolinfo_table[] = {
29997 +#ifdef CONFIG_GRKERNSEC_RANDNET
29998 + /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
29999 + { 512, 411, 308, 208, 104, 1 },
30000 + /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
30001 + { 128, 103, 76, 51, 25, 1 },
30002 +#else
30003 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
30004 { 128, 103, 76, 51, 25, 1 },
30005 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
30006 { 32, 26, 20, 14, 7, 1 },
30007 +#endif
30008 #if 0
30009 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
30010 { 2048, 1638, 1231, 819, 411, 1 },
30011 @@ -1209,7 +1221,7 @@ EXPORT_SYMBOL(generate_random_uuid);
30012 #include <linux/sysctl.h>
30013
30014 static int min_read_thresh = 8, min_write_thresh;
30015 -static int max_read_thresh = INPUT_POOL_WORDS * 32;
30016 +static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
30017 static int max_write_thresh = INPUT_POOL_WORDS * 32;
30018 static char sysctl_bootid[16];
30019
30020 diff -urNp linux-2.6.32.49/drivers/char/rocket.c linux-2.6.32.49/drivers/char/rocket.c
30021 --- linux-2.6.32.49/drivers/char/rocket.c 2011-11-08 19:02:43.000000000 -0500
30022 +++ linux-2.6.32.49/drivers/char/rocket.c 2011-11-15 19:59:43.000000000 -0500
30023 @@ -1266,6 +1266,8 @@ static int get_ports(struct r_port *info
30024 struct rocket_ports tmp;
30025 int board;
30026
30027 + pax_track_stack();
30028 +
30029 if (!retports)
30030 return -EFAULT;
30031 memset(&tmp, 0, sizeof (tmp));
30032 diff -urNp linux-2.6.32.49/drivers/char/sonypi.c linux-2.6.32.49/drivers/char/sonypi.c
30033 --- linux-2.6.32.49/drivers/char/sonypi.c 2011-11-08 19:02:43.000000000 -0500
30034 +++ linux-2.6.32.49/drivers/char/sonypi.c 2011-11-15 19:59:43.000000000 -0500
30035 @@ -55,6 +55,7 @@
30036 #include <asm/uaccess.h>
30037 #include <asm/io.h>
30038 #include <asm/system.h>
30039 +#include <asm/local.h>
30040
30041 #include <linux/sonypi.h>
30042
30043 @@ -491,7 +492,7 @@ static struct sonypi_device {
30044 spinlock_t fifo_lock;
30045 wait_queue_head_t fifo_proc_list;
30046 struct fasync_struct *fifo_async;
30047 - int open_count;
30048 + local_t open_count;
30049 int model;
30050 struct input_dev *input_jog_dev;
30051 struct input_dev *input_key_dev;
30052 @@ -895,7 +896,7 @@ static int sonypi_misc_fasync(int fd, st
30053 static int sonypi_misc_release(struct inode *inode, struct file *file)
30054 {
30055 mutex_lock(&sonypi_device.lock);
30056 - sonypi_device.open_count--;
30057 + local_dec(&sonypi_device.open_count);
30058 mutex_unlock(&sonypi_device.lock);
30059 return 0;
30060 }
30061 @@ -905,9 +906,9 @@ static int sonypi_misc_open(struct inode
30062 lock_kernel();
30063 mutex_lock(&sonypi_device.lock);
30064 /* Flush input queue on first open */
30065 - if (!sonypi_device.open_count)
30066 + if (!local_read(&sonypi_device.open_count))
30067 kfifo_reset(sonypi_device.fifo);
30068 - sonypi_device.open_count++;
30069 + local_inc(&sonypi_device.open_count);
30070 mutex_unlock(&sonypi_device.lock);
30071 unlock_kernel();
30072 return 0;
30073 diff -urNp linux-2.6.32.49/drivers/char/stallion.c linux-2.6.32.49/drivers/char/stallion.c
30074 --- linux-2.6.32.49/drivers/char/stallion.c 2011-11-08 19:02:43.000000000 -0500
30075 +++ linux-2.6.32.49/drivers/char/stallion.c 2011-11-15 19:59:43.000000000 -0500
30076 @@ -2448,6 +2448,8 @@ static int stl_getportstruct(struct stlp
30077 struct stlport stl_dummyport;
30078 struct stlport *portp;
30079
30080 + pax_track_stack();
30081 +
30082 if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
30083 return -EFAULT;
30084 portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
30085 diff -urNp linux-2.6.32.49/drivers/char/tpm/tpm_bios.c linux-2.6.32.49/drivers/char/tpm/tpm_bios.c
30086 --- linux-2.6.32.49/drivers/char/tpm/tpm_bios.c 2011-11-08 19:02:43.000000000 -0500
30087 +++ linux-2.6.32.49/drivers/char/tpm/tpm_bios.c 2011-11-15 19:59:43.000000000 -0500
30088 @@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start
30089 event = addr;
30090
30091 if ((event->event_type == 0 && event->event_size == 0) ||
30092 - ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
30093 + (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
30094 return NULL;
30095
30096 return addr;
30097 @@ -197,7 +197,7 @@ static void *tpm_bios_measurements_next(
30098 return NULL;
30099
30100 if ((event->event_type == 0 && event->event_size == 0) ||
30101 - ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
30102 + (event->event_size >= limit - v - sizeof(struct tcpa_event)))
30103 return NULL;
30104
30105 (*pos)++;
30106 @@ -290,7 +290,8 @@ static int tpm_binary_bios_measurements_
30107 int i;
30108
30109 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
30110 - seq_putc(m, data[i]);
30111 + if (!seq_putc(m, data[i]))
30112 + return -EFAULT;
30113
30114 return 0;
30115 }
30116 @@ -409,8 +410,13 @@ static int read_log(struct tpm_bios_log
30117 log->bios_event_log_end = log->bios_event_log + len;
30118
30119 virt = acpi_os_map_memory(start, len);
30120 + if (!virt) {
30121 + kfree(log->bios_event_log);
30122 + log->bios_event_log = NULL;
30123 + return -EFAULT;
30124 + }
30125
30126 - memcpy(log->bios_event_log, virt, len);
30127 + memcpy(log->bios_event_log, (const char __force_kernel *)virt, len);
30128
30129 acpi_os_unmap_memory(virt, len);
30130 return 0;
30131 diff -urNp linux-2.6.32.49/drivers/char/tpm/tpm.c linux-2.6.32.49/drivers/char/tpm/tpm.c
30132 --- linux-2.6.32.49/drivers/char/tpm/tpm.c 2011-11-08 19:02:43.000000000 -0500
30133 +++ linux-2.6.32.49/drivers/char/tpm/tpm.c 2011-11-15 19:59:43.000000000 -0500
30134 @@ -405,7 +405,7 @@ static ssize_t tpm_transmit(struct tpm_c
30135 chip->vendor.req_complete_val)
30136 goto out_recv;
30137
30138 - if ((status == chip->vendor.req_canceled)) {
30139 + if (status == chip->vendor.req_canceled) {
30140 dev_err(chip->dev, "Operation Canceled\n");
30141 rc = -ECANCELED;
30142 goto out;
30143 @@ -824,6 +824,8 @@ ssize_t tpm_show_pubek(struct device *de
30144
30145 struct tpm_chip *chip = dev_get_drvdata(dev);
30146
30147 + pax_track_stack();
30148 +
30149 tpm_cmd.header.in = tpm_readpubek_header;
30150 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
30151 "attempting to read the PUBEK");
30152 diff -urNp linux-2.6.32.49/drivers/char/tty_io.c linux-2.6.32.49/drivers/char/tty_io.c
30153 --- linux-2.6.32.49/drivers/char/tty_io.c 2011-11-26 19:44:53.000000000 -0500
30154 +++ linux-2.6.32.49/drivers/char/tty_io.c 2011-11-26 19:45:05.000000000 -0500
30155 @@ -1774,6 +1774,7 @@ got_driver:
30156
30157 if (IS_ERR(tty)) {
30158 mutex_unlock(&tty_mutex);
30159 + tty_driver_kref_put(driver);
30160 return PTR_ERR(tty);
30161 }
30162 }
30163 @@ -2603,8 +2604,10 @@ long tty_ioctl(struct file *file, unsign
30164 return retval;
30165 }
30166
30167 +EXPORT_SYMBOL(tty_ioctl);
30168 +
30169 #ifdef CONFIG_COMPAT
30170 -static long tty_compat_ioctl(struct file *file, unsigned int cmd,
30171 +long tty_compat_ioctl(struct file *file, unsigned int cmd,
30172 unsigned long arg)
30173 {
30174 struct inode *inode = file->f_dentry->d_inode;
30175 @@ -2628,6 +2631,8 @@ static long tty_compat_ioctl(struct file
30176
30177 return retval;
30178 }
30179 +
30180 +EXPORT_SYMBOL(tty_compat_ioctl);
30181 #endif
30182
30183 /*
30184 @@ -3073,7 +3078,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
30185
30186 void tty_default_fops(struct file_operations *fops)
30187 {
30188 - *fops = tty_fops;
30189 + memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
30190 }
30191
30192 /*
30193 diff -urNp linux-2.6.32.49/drivers/char/tty_ldisc.c linux-2.6.32.49/drivers/char/tty_ldisc.c
30194 --- linux-2.6.32.49/drivers/char/tty_ldisc.c 2011-11-08 19:02:43.000000000 -0500
30195 +++ linux-2.6.32.49/drivers/char/tty_ldisc.c 2011-11-15 19:59:43.000000000 -0500
30196 @@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *
30197 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
30198 struct tty_ldisc_ops *ldo = ld->ops;
30199
30200 - ldo->refcount--;
30201 + atomic_dec(&ldo->refcount);
30202 module_put(ldo->owner);
30203 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
30204
30205 @@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct
30206 spin_lock_irqsave(&tty_ldisc_lock, flags);
30207 tty_ldiscs[disc] = new_ldisc;
30208 new_ldisc->num = disc;
30209 - new_ldisc->refcount = 0;
30210 + atomic_set(&new_ldisc->refcount, 0);
30211 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
30212
30213 return ret;
30214 @@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
30215 return -EINVAL;
30216
30217 spin_lock_irqsave(&tty_ldisc_lock, flags);
30218 - if (tty_ldiscs[disc]->refcount)
30219 + if (atomic_read(&tty_ldiscs[disc]->refcount))
30220 ret = -EBUSY;
30221 else
30222 tty_ldiscs[disc] = NULL;
30223 @@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(i
30224 if (ldops) {
30225 ret = ERR_PTR(-EAGAIN);
30226 if (try_module_get(ldops->owner)) {
30227 - ldops->refcount++;
30228 + atomic_inc(&ldops->refcount);
30229 ret = ldops;
30230 }
30231 }
30232 @@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_o
30233 unsigned long flags;
30234
30235 spin_lock_irqsave(&tty_ldisc_lock, flags);
30236 - ldops->refcount--;
30237 + atomic_dec(&ldops->refcount);
30238 module_put(ldops->owner);
30239 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
30240 }
30241 diff -urNp linux-2.6.32.49/drivers/char/virtio_console.c linux-2.6.32.49/drivers/char/virtio_console.c
30242 --- linux-2.6.32.49/drivers/char/virtio_console.c 2011-11-08 19:02:43.000000000 -0500
30243 +++ linux-2.6.32.49/drivers/char/virtio_console.c 2011-11-15 19:59:43.000000000 -0500
30244 @@ -133,7 +133,9 @@ static int get_chars(u32 vtermno, char *
30245 * virtqueue, so we let the drivers do some boutique early-output thing. */
30246 int __init virtio_cons_early_init(int (*put_chars)(u32, const char *, int))
30247 {
30248 - virtio_cons.put_chars = put_chars;
30249 + pax_open_kernel();
30250 + *(void **)&virtio_cons.put_chars = put_chars;
30251 + pax_close_kernel();
30252 return hvc_instantiate(0, 0, &virtio_cons);
30253 }
30254
30255 @@ -213,11 +215,13 @@ static int __devinit virtcons_probe(stru
30256 out_vq = vqs[1];
30257
30258 /* Start using the new console output. */
30259 - virtio_cons.get_chars = get_chars;
30260 - virtio_cons.put_chars = put_chars;
30261 - virtio_cons.notifier_add = notifier_add_vio;
30262 - virtio_cons.notifier_del = notifier_del_vio;
30263 - virtio_cons.notifier_hangup = notifier_del_vio;
30264 + pax_open_kernel();
30265 + *(void **)&virtio_cons.get_chars = get_chars;
30266 + *(void **)&virtio_cons.put_chars = put_chars;
30267 + *(void **)&virtio_cons.notifier_add = notifier_add_vio;
30268 + *(void **)&virtio_cons.notifier_del = notifier_del_vio;
30269 + *(void **)&virtio_cons.notifier_hangup = notifier_del_vio;
30270 + pax_close_kernel();
30271
30272 /* The first argument of hvc_alloc() is the virtual console number, so
30273 * we use zero. The second argument is the parameter for the
30274 diff -urNp linux-2.6.32.49/drivers/char/vt.c linux-2.6.32.49/drivers/char/vt.c
30275 --- linux-2.6.32.49/drivers/char/vt.c 2011-11-08 19:02:43.000000000 -0500
30276 +++ linux-2.6.32.49/drivers/char/vt.c 2011-11-15 19:59:43.000000000 -0500
30277 @@ -243,7 +243,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier
30278
30279 static void notify_write(struct vc_data *vc, unsigned int unicode)
30280 {
30281 - struct vt_notifier_param param = { .vc = vc, unicode = unicode };
30282 + struct vt_notifier_param param = { .vc = vc, .c = unicode };
30283 atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
30284 }
30285
30286 diff -urNp linux-2.6.32.49/drivers/char/vt_ioctl.c linux-2.6.32.49/drivers/char/vt_ioctl.c
30287 --- linux-2.6.32.49/drivers/char/vt_ioctl.c 2011-11-08 19:02:43.000000000 -0500
30288 +++ linux-2.6.32.49/drivers/char/vt_ioctl.c 2011-11-15 19:59:43.000000000 -0500
30289 @@ -210,9 +210,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __
30290 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
30291 return -EFAULT;
30292
30293 - if (!capable(CAP_SYS_TTY_CONFIG))
30294 - perm = 0;
30295 -
30296 switch (cmd) {
30297 case KDGKBENT:
30298 key_map = key_maps[s];
30299 @@ -224,8 +221,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __
30300 val = (i ? K_HOLE : K_NOSUCHMAP);
30301 return put_user(val, &user_kbe->kb_value);
30302 case KDSKBENT:
30303 + if (!capable(CAP_SYS_TTY_CONFIG))
30304 + perm = 0;
30305 +
30306 if (!perm)
30307 return -EPERM;
30308 +
30309 if (!i && v == K_NOSUCHMAP) {
30310 /* deallocate map */
30311 key_map = key_maps[s];
30312 @@ -325,9 +326,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
30313 int i, j, k;
30314 int ret;
30315
30316 - if (!capable(CAP_SYS_TTY_CONFIG))
30317 - perm = 0;
30318 -
30319 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
30320 if (!kbs) {
30321 ret = -ENOMEM;
30322 @@ -361,6 +359,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
30323 kfree(kbs);
30324 return ((p && *p) ? -EOVERFLOW : 0);
30325 case KDSKBSENT:
30326 + if (!capable(CAP_SYS_TTY_CONFIG))
30327 + perm = 0;
30328 +
30329 if (!perm) {
30330 ret = -EPERM;
30331 goto reterr;
30332 diff -urNp linux-2.6.32.49/drivers/cpufreq/cpufreq.c linux-2.6.32.49/drivers/cpufreq/cpufreq.c
30333 --- linux-2.6.32.49/drivers/cpufreq/cpufreq.c 2011-11-08 19:02:43.000000000 -0500
30334 +++ linux-2.6.32.49/drivers/cpufreq/cpufreq.c 2011-11-15 19:59:43.000000000 -0500
30335 @@ -750,7 +750,7 @@ static void cpufreq_sysfs_release(struct
30336 complete(&policy->kobj_unregister);
30337 }
30338
30339 -static struct sysfs_ops sysfs_ops = {
30340 +static const struct sysfs_ops sysfs_ops = {
30341 .show = show,
30342 .store = store,
30343 };
30344 diff -urNp linux-2.6.32.49/drivers/cpuidle/sysfs.c linux-2.6.32.49/drivers/cpuidle/sysfs.c
30345 --- linux-2.6.32.49/drivers/cpuidle/sysfs.c 2011-11-08 19:02:43.000000000 -0500
30346 +++ linux-2.6.32.49/drivers/cpuidle/sysfs.c 2011-11-15 19:59:43.000000000 -0500
30347 @@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobj
30348 return ret;
30349 }
30350
30351 -static struct sysfs_ops cpuidle_sysfs_ops = {
30352 +static const struct sysfs_ops cpuidle_sysfs_ops = {
30353 .show = cpuidle_show,
30354 .store = cpuidle_store,
30355 };
30356 @@ -277,7 +277,7 @@ static ssize_t cpuidle_state_show(struct
30357 return ret;
30358 }
30359
30360 -static struct sysfs_ops cpuidle_state_sysfs_ops = {
30361 +static const struct sysfs_ops cpuidle_state_sysfs_ops = {
30362 .show = cpuidle_state_show,
30363 };
30364
30365 @@ -294,7 +294,7 @@ static struct kobj_type ktype_state_cpui
30366 .release = cpuidle_state_sysfs_release,
30367 };
30368
30369 -static void inline cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
30370 +static inline void cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
30371 {
30372 kobject_put(&device->kobjs[i]->kobj);
30373 wait_for_completion(&device->kobjs[i]->kobj_unregister);
30374 diff -urNp linux-2.6.32.49/drivers/crypto/hifn_795x.c linux-2.6.32.49/drivers/crypto/hifn_795x.c
30375 --- linux-2.6.32.49/drivers/crypto/hifn_795x.c 2011-11-08 19:02:43.000000000 -0500
30376 +++ linux-2.6.32.49/drivers/crypto/hifn_795x.c 2011-11-15 19:59:43.000000000 -0500
30377 @@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device
30378 0xCA, 0x34, 0x2B, 0x2E};
30379 struct scatterlist sg;
30380
30381 + pax_track_stack();
30382 +
30383 memset(src, 0, sizeof(src));
30384 memset(ctx.key, 0, sizeof(ctx.key));
30385
30386 diff -urNp linux-2.6.32.49/drivers/crypto/padlock-aes.c linux-2.6.32.49/drivers/crypto/padlock-aes.c
30387 --- linux-2.6.32.49/drivers/crypto/padlock-aes.c 2011-11-08 19:02:43.000000000 -0500
30388 +++ linux-2.6.32.49/drivers/crypto/padlock-aes.c 2011-11-15 19:59:43.000000000 -0500
30389 @@ -108,6 +108,8 @@ static int aes_set_key(struct crypto_tfm
30390 struct crypto_aes_ctx gen_aes;
30391 int cpu;
30392
30393 + pax_track_stack();
30394 +
30395 if (key_len % 8) {
30396 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
30397 return -EINVAL;
30398 diff -urNp linux-2.6.32.49/drivers/dma/ioat/dma.c linux-2.6.32.49/drivers/dma/ioat/dma.c
30399 --- linux-2.6.32.49/drivers/dma/ioat/dma.c 2011-11-08 19:02:43.000000000 -0500
30400 +++ linux-2.6.32.49/drivers/dma/ioat/dma.c 2011-11-15 19:59:43.000000000 -0500
30401 @@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, str
30402 return entry->show(&chan->common, page);
30403 }
30404
30405 -struct sysfs_ops ioat_sysfs_ops = {
30406 +const struct sysfs_ops ioat_sysfs_ops = {
30407 .show = ioat_attr_show,
30408 };
30409
30410 diff -urNp linux-2.6.32.49/drivers/dma/ioat/dma.h linux-2.6.32.49/drivers/dma/ioat/dma.h
30411 --- linux-2.6.32.49/drivers/dma/ioat/dma.h 2011-11-08 19:02:43.000000000 -0500
30412 +++ linux-2.6.32.49/drivers/dma/ioat/dma.h 2011-11-15 19:59:43.000000000 -0500
30413 @@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_c
30414 unsigned long *phys_complete);
30415 void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
30416 void ioat_kobject_del(struct ioatdma_device *device);
30417 -extern struct sysfs_ops ioat_sysfs_ops;
30418 +extern const struct sysfs_ops ioat_sysfs_ops;
30419 extern struct ioat_sysfs_entry ioat_version_attr;
30420 extern struct ioat_sysfs_entry ioat_cap_attr;
30421 #endif /* IOATDMA_H */
30422 diff -urNp linux-2.6.32.49/drivers/dma/ioat/dma_v3.c linux-2.6.32.49/drivers/dma/ioat/dma_v3.c
30423 --- linux-2.6.32.49/drivers/dma/ioat/dma_v3.c 2011-11-08 19:02:43.000000000 -0500
30424 +++ linux-2.6.32.49/drivers/dma/ioat/dma_v3.c 2011-11-18 18:01:55.000000000 -0500
30425 @@ -71,10 +71,10 @@
30426 /* provide a lookup table for setting the source address in the base or
30427 * extended descriptor of an xor or pq descriptor
30428 */
30429 -static const u8 xor_idx_to_desc __read_mostly = 0xd0;
30430 -static const u8 xor_idx_to_field[] __read_mostly = { 1, 4, 5, 6, 7, 0, 1, 2 };
30431 -static const u8 pq_idx_to_desc __read_mostly = 0xf8;
30432 -static const u8 pq_idx_to_field[] __read_mostly = { 1, 4, 5, 0, 1, 2, 4, 5 };
30433 +static const u8 xor_idx_to_desc = 0xd0;
30434 +static const u8 xor_idx_to_field[] = { 1, 4, 5, 6, 7, 0, 1, 2 };
30435 +static const u8 pq_idx_to_desc = 0xf8;
30436 +static const u8 pq_idx_to_field[] = { 1, 4, 5, 0, 1, 2, 4, 5 };
30437
30438 static dma_addr_t xor_get_src(struct ioat_raw_descriptor *descs[2], int idx)
30439 {
30440 diff -urNp linux-2.6.32.49/drivers/edac/amd64_edac.c linux-2.6.32.49/drivers/edac/amd64_edac.c
30441 --- linux-2.6.32.49/drivers/edac/amd64_edac.c 2011-11-08 19:02:43.000000000 -0500
30442 +++ linux-2.6.32.49/drivers/edac/amd64_edac.c 2011-11-18 18:01:55.000000000 -0500
30443 @@ -3099,7 +3099,7 @@ static void __devexit amd64_remove_one_i
30444 * PCI core identifies what devices are on a system during boot, and then
30445 * inquiry this table to see if this driver is for a given device found.
30446 */
30447 -static const struct pci_device_id amd64_pci_table[] __devinitdata = {
30448 +static const struct pci_device_id amd64_pci_table[] __devinitconst = {
30449 {
30450 .vendor = PCI_VENDOR_ID_AMD,
30451 .device = PCI_DEVICE_ID_AMD_K8_NB_MEMCTL,
30452 diff -urNp linux-2.6.32.49/drivers/edac/amd76x_edac.c linux-2.6.32.49/drivers/edac/amd76x_edac.c
30453 --- linux-2.6.32.49/drivers/edac/amd76x_edac.c 2011-11-08 19:02:43.000000000 -0500
30454 +++ linux-2.6.32.49/drivers/edac/amd76x_edac.c 2011-11-18 18:01:55.000000000 -0500
30455 @@ -322,7 +322,7 @@ static void __devexit amd76x_remove_one(
30456 edac_mc_free(mci);
30457 }
30458
30459 -static const struct pci_device_id amd76x_pci_tbl[] __devinitdata = {
30460 +static const struct pci_device_id amd76x_pci_tbl[] __devinitconst = {
30461 {
30462 PCI_VEND_DEV(AMD, FE_GATE_700C), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
30463 AMD762},
30464 diff -urNp linux-2.6.32.49/drivers/edac/e752x_edac.c linux-2.6.32.49/drivers/edac/e752x_edac.c
30465 --- linux-2.6.32.49/drivers/edac/e752x_edac.c 2011-11-08 19:02:43.000000000 -0500
30466 +++ linux-2.6.32.49/drivers/edac/e752x_edac.c 2011-11-18 18:01:55.000000000 -0500
30467 @@ -1282,7 +1282,7 @@ static void __devexit e752x_remove_one(s
30468 edac_mc_free(mci);
30469 }
30470
30471 -static const struct pci_device_id e752x_pci_tbl[] __devinitdata = {
30472 +static const struct pci_device_id e752x_pci_tbl[] __devinitconst = {
30473 {
30474 PCI_VEND_DEV(INTEL, 7520_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
30475 E7520},
30476 diff -urNp linux-2.6.32.49/drivers/edac/e7xxx_edac.c linux-2.6.32.49/drivers/edac/e7xxx_edac.c
30477 --- linux-2.6.32.49/drivers/edac/e7xxx_edac.c 2011-11-08 19:02:43.000000000 -0500
30478 +++ linux-2.6.32.49/drivers/edac/e7xxx_edac.c 2011-11-18 18:01:55.000000000 -0500
30479 @@ -526,7 +526,7 @@ static void __devexit e7xxx_remove_one(s
30480 edac_mc_free(mci);
30481 }
30482
30483 -static const struct pci_device_id e7xxx_pci_tbl[] __devinitdata = {
30484 +static const struct pci_device_id e7xxx_pci_tbl[] __devinitconst = {
30485 {
30486 PCI_VEND_DEV(INTEL, 7205_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
30487 E7205},
30488 diff -urNp linux-2.6.32.49/drivers/edac/edac_device_sysfs.c linux-2.6.32.49/drivers/edac/edac_device_sysfs.c
30489 --- linux-2.6.32.49/drivers/edac/edac_device_sysfs.c 2011-11-08 19:02:43.000000000 -0500
30490 +++ linux-2.6.32.49/drivers/edac/edac_device_sysfs.c 2011-11-15 19:59:43.000000000 -0500
30491 @@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(s
30492 }
30493
30494 /* edac_dev file operations for an 'ctl_info' */
30495 -static struct sysfs_ops device_ctl_info_ops = {
30496 +static const struct sysfs_ops device_ctl_info_ops = {
30497 .show = edac_dev_ctl_info_show,
30498 .store = edac_dev_ctl_info_store
30499 };
30500 @@ -373,7 +373,7 @@ static ssize_t edac_dev_instance_store(s
30501 }
30502
30503 /* edac_dev file operations for an 'instance' */
30504 -static struct sysfs_ops device_instance_ops = {
30505 +static const struct sysfs_ops device_instance_ops = {
30506 .show = edac_dev_instance_show,
30507 .store = edac_dev_instance_store
30508 };
30509 @@ -476,7 +476,7 @@ static ssize_t edac_dev_block_store(stru
30510 }
30511
30512 /* edac_dev file operations for a 'block' */
30513 -static struct sysfs_ops device_block_ops = {
30514 +static const struct sysfs_ops device_block_ops = {
30515 .show = edac_dev_block_show,
30516 .store = edac_dev_block_store
30517 };
30518 diff -urNp linux-2.6.32.49/drivers/edac/edac_mc_sysfs.c linux-2.6.32.49/drivers/edac/edac_mc_sysfs.c
30519 --- linux-2.6.32.49/drivers/edac/edac_mc_sysfs.c 2011-11-08 19:02:43.000000000 -0500
30520 +++ linux-2.6.32.49/drivers/edac/edac_mc_sysfs.c 2011-11-15 19:59:43.000000000 -0500
30521 @@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kob
30522 return -EIO;
30523 }
30524
30525 -static struct sysfs_ops csrowfs_ops = {
30526 +static const struct sysfs_ops csrowfs_ops = {
30527 .show = csrowdev_show,
30528 .store = csrowdev_store
30529 };
30530 @@ -575,7 +575,7 @@ static ssize_t mcidev_store(struct kobje
30531 }
30532
30533 /* Intermediate show/store table */
30534 -static struct sysfs_ops mci_ops = {
30535 +static const struct sysfs_ops mci_ops = {
30536 .show = mcidev_show,
30537 .store = mcidev_store
30538 };
30539 diff -urNp linux-2.6.32.49/drivers/edac/edac_pci_sysfs.c linux-2.6.32.49/drivers/edac/edac_pci_sysfs.c
30540 --- linux-2.6.32.49/drivers/edac/edac_pci_sysfs.c 2011-11-08 19:02:43.000000000 -0500
30541 +++ linux-2.6.32.49/drivers/edac/edac_pci_sysfs.c 2011-11-15 19:59:43.000000000 -0500
30542 @@ -25,8 +25,8 @@ static int edac_pci_log_pe = 1; /* log
30543 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
30544 static int edac_pci_poll_msec = 1000; /* one second workq period */
30545
30546 -static atomic_t pci_parity_count = ATOMIC_INIT(0);
30547 -static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
30548 +static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
30549 +static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
30550
30551 static struct kobject *edac_pci_top_main_kobj;
30552 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
30553 @@ -121,7 +121,7 @@ static ssize_t edac_pci_instance_store(s
30554 }
30555
30556 /* fs_ops table */
30557 -static struct sysfs_ops pci_instance_ops = {
30558 +static const struct sysfs_ops pci_instance_ops = {
30559 .show = edac_pci_instance_show,
30560 .store = edac_pci_instance_store
30561 };
30562 @@ -261,7 +261,7 @@ static ssize_t edac_pci_dev_store(struct
30563 return -EIO;
30564 }
30565
30566 -static struct sysfs_ops edac_pci_sysfs_ops = {
30567 +static const struct sysfs_ops edac_pci_sysfs_ops = {
30568 .show = edac_pci_dev_show,
30569 .store = edac_pci_dev_store
30570 };
30571 @@ -579,7 +579,7 @@ static void edac_pci_dev_parity_test(str
30572 edac_printk(KERN_CRIT, EDAC_PCI,
30573 "Signaled System Error on %s\n",
30574 pci_name(dev));
30575 - atomic_inc(&pci_nonparity_count);
30576 + atomic_inc_unchecked(&pci_nonparity_count);
30577 }
30578
30579 if (status & (PCI_STATUS_PARITY)) {
30580 @@ -587,7 +587,7 @@ static void edac_pci_dev_parity_test(str
30581 "Master Data Parity Error on %s\n",
30582 pci_name(dev));
30583
30584 - atomic_inc(&pci_parity_count);
30585 + atomic_inc_unchecked(&pci_parity_count);
30586 }
30587
30588 if (status & (PCI_STATUS_DETECTED_PARITY)) {
30589 @@ -595,7 +595,7 @@ static void edac_pci_dev_parity_test(str
30590 "Detected Parity Error on %s\n",
30591 pci_name(dev));
30592
30593 - atomic_inc(&pci_parity_count);
30594 + atomic_inc_unchecked(&pci_parity_count);
30595 }
30596 }
30597
30598 @@ -616,7 +616,7 @@ static void edac_pci_dev_parity_test(str
30599 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
30600 "Signaled System Error on %s\n",
30601 pci_name(dev));
30602 - atomic_inc(&pci_nonparity_count);
30603 + atomic_inc_unchecked(&pci_nonparity_count);
30604 }
30605
30606 if (status & (PCI_STATUS_PARITY)) {
30607 @@ -624,7 +624,7 @@ static void edac_pci_dev_parity_test(str
30608 "Master Data Parity Error on "
30609 "%s\n", pci_name(dev));
30610
30611 - atomic_inc(&pci_parity_count);
30612 + atomic_inc_unchecked(&pci_parity_count);
30613 }
30614
30615 if (status & (PCI_STATUS_DETECTED_PARITY)) {
30616 @@ -632,7 +632,7 @@ static void edac_pci_dev_parity_test(str
30617 "Detected Parity Error on %s\n",
30618 pci_name(dev));
30619
30620 - atomic_inc(&pci_parity_count);
30621 + atomic_inc_unchecked(&pci_parity_count);
30622 }
30623 }
30624 }
30625 @@ -674,7 +674,7 @@ void edac_pci_do_parity_check(void)
30626 if (!check_pci_errors)
30627 return;
30628
30629 - before_count = atomic_read(&pci_parity_count);
30630 + before_count = atomic_read_unchecked(&pci_parity_count);
30631
30632 /* scan all PCI devices looking for a Parity Error on devices and
30633 * bridges.
30634 @@ -686,7 +686,7 @@ void edac_pci_do_parity_check(void)
30635 /* Only if operator has selected panic on PCI Error */
30636 if (edac_pci_get_panic_on_pe()) {
30637 /* If the count is different 'after' from 'before' */
30638 - if (before_count != atomic_read(&pci_parity_count))
30639 + if (before_count != atomic_read_unchecked(&pci_parity_count))
30640 panic("EDAC: PCI Parity Error");
30641 }
30642 }
30643 diff -urNp linux-2.6.32.49/drivers/edac/i3000_edac.c linux-2.6.32.49/drivers/edac/i3000_edac.c
30644 --- linux-2.6.32.49/drivers/edac/i3000_edac.c 2011-11-08 19:02:43.000000000 -0500
30645 +++ linux-2.6.32.49/drivers/edac/i3000_edac.c 2011-11-18 18:01:55.000000000 -0500
30646 @@ -471,7 +471,7 @@ static void __devexit i3000_remove_one(s
30647 edac_mc_free(mci);
30648 }
30649
30650 -static const struct pci_device_id i3000_pci_tbl[] __devinitdata = {
30651 +static const struct pci_device_id i3000_pci_tbl[] __devinitconst = {
30652 {
30653 PCI_VEND_DEV(INTEL, 3000_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
30654 I3000},
30655 diff -urNp linux-2.6.32.49/drivers/edac/i3200_edac.c linux-2.6.32.49/drivers/edac/i3200_edac.c
30656 --- linux-2.6.32.49/drivers/edac/i3200_edac.c 2011-11-08 19:02:43.000000000 -0500
30657 +++ linux-2.6.32.49/drivers/edac/i3200_edac.c 2011-11-18 18:01:55.000000000 -0500
30658 @@ -444,7 +444,7 @@ static void __devexit i3200_remove_one(s
30659 edac_mc_free(mci);
30660 }
30661
30662 -static const struct pci_device_id i3200_pci_tbl[] __devinitdata = {
30663 +static const struct pci_device_id i3200_pci_tbl[] __devinitconst = {
30664 {
30665 PCI_VEND_DEV(INTEL, 3200_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
30666 I3200},
30667 diff -urNp linux-2.6.32.49/drivers/edac/i5000_edac.c linux-2.6.32.49/drivers/edac/i5000_edac.c
30668 --- linux-2.6.32.49/drivers/edac/i5000_edac.c 2011-11-08 19:02:43.000000000 -0500
30669 +++ linux-2.6.32.49/drivers/edac/i5000_edac.c 2011-11-18 18:01:55.000000000 -0500
30670 @@ -1516,7 +1516,7 @@ static void __devexit i5000_remove_one(s
30671 *
30672 * The "E500P" device is the first device supported.
30673 */
30674 -static const struct pci_device_id i5000_pci_tbl[] __devinitdata = {
30675 +static const struct pci_device_id i5000_pci_tbl[] __devinitconst = {
30676 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I5000_DEV16),
30677 .driver_data = I5000P},
30678
30679 diff -urNp linux-2.6.32.49/drivers/edac/i5100_edac.c linux-2.6.32.49/drivers/edac/i5100_edac.c
30680 --- linux-2.6.32.49/drivers/edac/i5100_edac.c 2011-11-08 19:02:43.000000000 -0500
30681 +++ linux-2.6.32.49/drivers/edac/i5100_edac.c 2011-11-18 18:01:55.000000000 -0500
30682 @@ -944,7 +944,7 @@ static void __devexit i5100_remove_one(s
30683 edac_mc_free(mci);
30684 }
30685
30686 -static const struct pci_device_id i5100_pci_tbl[] __devinitdata = {
30687 +static const struct pci_device_id i5100_pci_tbl[] __devinitconst = {
30688 /* Device 16, Function 0, Channel 0 Memory Map, Error Flag/Mask, ... */
30689 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5100_16) },
30690 { 0, }
30691 diff -urNp linux-2.6.32.49/drivers/edac/i5400_edac.c linux-2.6.32.49/drivers/edac/i5400_edac.c
30692 --- linux-2.6.32.49/drivers/edac/i5400_edac.c 2011-11-08 19:02:43.000000000 -0500
30693 +++ linux-2.6.32.49/drivers/edac/i5400_edac.c 2011-11-18 18:01:55.000000000 -0500
30694 @@ -1383,7 +1383,7 @@ static void __devexit i5400_remove_one(s
30695 *
30696 * The "E500P" device is the first device supported.
30697 */
30698 -static const struct pci_device_id i5400_pci_tbl[] __devinitdata = {
30699 +static const struct pci_device_id i5400_pci_tbl[] __devinitconst = {
30700 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5400_ERR)},
30701 {0,} /* 0 terminated list. */
30702 };
30703 diff -urNp linux-2.6.32.49/drivers/edac/i82443bxgx_edac.c linux-2.6.32.49/drivers/edac/i82443bxgx_edac.c
30704 --- linux-2.6.32.49/drivers/edac/i82443bxgx_edac.c 2011-11-08 19:02:43.000000000 -0500
30705 +++ linux-2.6.32.49/drivers/edac/i82443bxgx_edac.c 2011-11-18 18:01:55.000000000 -0500
30706 @@ -381,7 +381,7 @@ static void __devexit i82443bxgx_edacmc_
30707
30708 EXPORT_SYMBOL_GPL(i82443bxgx_edacmc_remove_one);
30709
30710 -static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitdata = {
30711 +static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitconst = {
30712 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_0)},
30713 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_2)},
30714 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0)},
30715 diff -urNp linux-2.6.32.49/drivers/edac/i82860_edac.c linux-2.6.32.49/drivers/edac/i82860_edac.c
30716 --- linux-2.6.32.49/drivers/edac/i82860_edac.c 2011-11-08 19:02:43.000000000 -0500
30717 +++ linux-2.6.32.49/drivers/edac/i82860_edac.c 2011-11-18 18:01:55.000000000 -0500
30718 @@ -271,7 +271,7 @@ static void __devexit i82860_remove_one(
30719 edac_mc_free(mci);
30720 }
30721
30722 -static const struct pci_device_id i82860_pci_tbl[] __devinitdata = {
30723 +static const struct pci_device_id i82860_pci_tbl[] __devinitconst = {
30724 {
30725 PCI_VEND_DEV(INTEL, 82860_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
30726 I82860},
30727 diff -urNp linux-2.6.32.49/drivers/edac/i82875p_edac.c linux-2.6.32.49/drivers/edac/i82875p_edac.c
30728 --- linux-2.6.32.49/drivers/edac/i82875p_edac.c 2011-11-08 19:02:43.000000000 -0500
30729 +++ linux-2.6.32.49/drivers/edac/i82875p_edac.c 2011-11-18 18:01:55.000000000 -0500
30730 @@ -512,7 +512,7 @@ static void __devexit i82875p_remove_one
30731 edac_mc_free(mci);
30732 }
30733
30734 -static const struct pci_device_id i82875p_pci_tbl[] __devinitdata = {
30735 +static const struct pci_device_id i82875p_pci_tbl[] __devinitconst = {
30736 {
30737 PCI_VEND_DEV(INTEL, 82875_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
30738 I82875P},
30739 diff -urNp linux-2.6.32.49/drivers/edac/i82975x_edac.c linux-2.6.32.49/drivers/edac/i82975x_edac.c
30740 --- linux-2.6.32.49/drivers/edac/i82975x_edac.c 2011-11-08 19:02:43.000000000 -0500
30741 +++ linux-2.6.32.49/drivers/edac/i82975x_edac.c 2011-11-18 18:01:55.000000000 -0500
30742 @@ -586,7 +586,7 @@ static void __devexit i82975x_remove_one
30743 edac_mc_free(mci);
30744 }
30745
30746 -static const struct pci_device_id i82975x_pci_tbl[] __devinitdata = {
30747 +static const struct pci_device_id i82975x_pci_tbl[] __devinitconst = {
30748 {
30749 PCI_VEND_DEV(INTEL, 82975_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
30750 I82975X
30751 diff -urNp linux-2.6.32.49/drivers/edac/r82600_edac.c linux-2.6.32.49/drivers/edac/r82600_edac.c
30752 --- linux-2.6.32.49/drivers/edac/r82600_edac.c 2011-11-08 19:02:43.000000000 -0500
30753 +++ linux-2.6.32.49/drivers/edac/r82600_edac.c 2011-11-18 18:01:55.000000000 -0500
30754 @@ -374,7 +374,7 @@ static void __devexit r82600_remove_one(
30755 edac_mc_free(mci);
30756 }
30757
30758 -static const struct pci_device_id r82600_pci_tbl[] __devinitdata = {
30759 +static const struct pci_device_id r82600_pci_tbl[] __devinitconst = {
30760 {
30761 PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
30762 },
30763 diff -urNp linux-2.6.32.49/drivers/edac/x38_edac.c linux-2.6.32.49/drivers/edac/x38_edac.c
30764 --- linux-2.6.32.49/drivers/edac/x38_edac.c 2011-11-08 19:02:43.000000000 -0500
30765 +++ linux-2.6.32.49/drivers/edac/x38_edac.c 2011-11-18 18:01:55.000000000 -0500
30766 @@ -441,7 +441,7 @@ static void __devexit x38_remove_one(str
30767 edac_mc_free(mci);
30768 }
30769
30770 -static const struct pci_device_id x38_pci_tbl[] __devinitdata = {
30771 +static const struct pci_device_id x38_pci_tbl[] __devinitconst = {
30772 {
30773 PCI_VEND_DEV(INTEL, X38_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
30774 X38},
30775 diff -urNp linux-2.6.32.49/drivers/firewire/core-card.c linux-2.6.32.49/drivers/firewire/core-card.c
30776 --- linux-2.6.32.49/drivers/firewire/core-card.c 2011-11-08 19:02:43.000000000 -0500
30777 +++ linux-2.6.32.49/drivers/firewire/core-card.c 2011-11-15 19:59:43.000000000 -0500
30778 @@ -558,7 +558,7 @@ void fw_card_release(struct kref *kref)
30779
30780 void fw_core_remove_card(struct fw_card *card)
30781 {
30782 - struct fw_card_driver dummy_driver = dummy_driver_template;
30783 + fw_card_driver_no_const dummy_driver = dummy_driver_template;
30784
30785 card->driver->update_phy_reg(card, 4,
30786 PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
30787 diff -urNp linux-2.6.32.49/drivers/firewire/core-cdev.c linux-2.6.32.49/drivers/firewire/core-cdev.c
30788 --- linux-2.6.32.49/drivers/firewire/core-cdev.c 2011-11-08 19:02:43.000000000 -0500
30789 +++ linux-2.6.32.49/drivers/firewire/core-cdev.c 2011-11-15 19:59:43.000000000 -0500
30790 @@ -1141,8 +1141,7 @@ static int init_iso_resource(struct clie
30791 int ret;
30792
30793 if ((request->channels == 0 && request->bandwidth == 0) ||
30794 - request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
30795 - request->bandwidth < 0)
30796 + request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
30797 return -EINVAL;
30798
30799 r = kmalloc(sizeof(*r), GFP_KERNEL);
30800 diff -urNp linux-2.6.32.49/drivers/firewire/core.h linux-2.6.32.49/drivers/firewire/core.h
30801 --- linux-2.6.32.49/drivers/firewire/core.h 2011-11-08 19:02:43.000000000 -0500
30802 +++ linux-2.6.32.49/drivers/firewire/core.h 2011-11-15 19:59:43.000000000 -0500
30803 @@ -86,6 +86,7 @@ struct fw_card_driver {
30804
30805 int (*stop_iso)(struct fw_iso_context *ctx);
30806 };
30807 +typedef struct fw_card_driver __no_const fw_card_driver_no_const;
30808
30809 void fw_card_initialize(struct fw_card *card,
30810 const struct fw_card_driver *driver, struct device *device);
30811 diff -urNp linux-2.6.32.49/drivers/firewire/core-transaction.c linux-2.6.32.49/drivers/firewire/core-transaction.c
30812 --- linux-2.6.32.49/drivers/firewire/core-transaction.c 2011-11-08 19:02:43.000000000 -0500
30813 +++ linux-2.6.32.49/drivers/firewire/core-transaction.c 2011-11-15 19:59:43.000000000 -0500
30814 @@ -36,6 +36,7 @@
30815 #include <linux/string.h>
30816 #include <linux/timer.h>
30817 #include <linux/types.h>
30818 +#include <linux/sched.h>
30819
30820 #include <asm/byteorder.h>
30821
30822 @@ -344,6 +345,8 @@ int fw_run_transaction(struct fw_card *c
30823 struct transaction_callback_data d;
30824 struct fw_transaction t;
30825
30826 + pax_track_stack();
30827 +
30828 init_completion(&d.done);
30829 d.payload = payload;
30830 fw_send_request(card, &t, tcode, destination_id, generation, speed,
30831 diff -urNp linux-2.6.32.49/drivers/firmware/dmi_scan.c linux-2.6.32.49/drivers/firmware/dmi_scan.c
30832 --- linux-2.6.32.49/drivers/firmware/dmi_scan.c 2011-11-08 19:02:43.000000000 -0500
30833 +++ linux-2.6.32.49/drivers/firmware/dmi_scan.c 2011-11-15 19:59:43.000000000 -0500
30834 @@ -391,11 +391,6 @@ void __init dmi_scan_machine(void)
30835 }
30836 }
30837 else {
30838 - /*
30839 - * no iounmap() for that ioremap(); it would be a no-op, but
30840 - * it's so early in setup that sucker gets confused into doing
30841 - * what it shouldn't if we actually call it.
30842 - */
30843 p = dmi_ioremap(0xF0000, 0x10000);
30844 if (p == NULL)
30845 goto error;
30846 @@ -667,7 +662,7 @@ int dmi_walk(void (*decode)(const struct
30847 if (buf == NULL)
30848 return -1;
30849
30850 - dmi_table(buf, dmi_len, dmi_num, decode, private_data);
30851 + dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data);
30852
30853 iounmap(buf);
30854 return 0;
30855 diff -urNp linux-2.6.32.49/drivers/firmware/edd.c linux-2.6.32.49/drivers/firmware/edd.c
30856 --- linux-2.6.32.49/drivers/firmware/edd.c 2011-11-08 19:02:43.000000000 -0500
30857 +++ linux-2.6.32.49/drivers/firmware/edd.c 2011-11-15 19:59:43.000000000 -0500
30858 @@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, str
30859 return ret;
30860 }
30861
30862 -static struct sysfs_ops edd_attr_ops = {
30863 +static const struct sysfs_ops edd_attr_ops = {
30864 .show = edd_attr_show,
30865 };
30866
30867 diff -urNp linux-2.6.32.49/drivers/firmware/efivars.c linux-2.6.32.49/drivers/firmware/efivars.c
30868 --- linux-2.6.32.49/drivers/firmware/efivars.c 2011-11-08 19:02:43.000000000 -0500
30869 +++ linux-2.6.32.49/drivers/firmware/efivars.c 2011-11-15 19:59:43.000000000 -0500
30870 @@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct
30871 return ret;
30872 }
30873
30874 -static struct sysfs_ops efivar_attr_ops = {
30875 +static const struct sysfs_ops efivar_attr_ops = {
30876 .show = efivar_attr_show,
30877 .store = efivar_attr_store,
30878 };
30879 diff -urNp linux-2.6.32.49/drivers/firmware/iscsi_ibft.c linux-2.6.32.49/drivers/firmware/iscsi_ibft.c
30880 --- linux-2.6.32.49/drivers/firmware/iscsi_ibft.c 2011-11-08 19:02:43.000000000 -0500
30881 +++ linux-2.6.32.49/drivers/firmware/iscsi_ibft.c 2011-11-15 19:59:43.000000000 -0500
30882 @@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struc
30883 return ret;
30884 }
30885
30886 -static struct sysfs_ops ibft_attr_ops = {
30887 +static const struct sysfs_ops ibft_attr_ops = {
30888 .show = ibft_show_attribute,
30889 };
30890
30891 diff -urNp linux-2.6.32.49/drivers/firmware/memmap.c linux-2.6.32.49/drivers/firmware/memmap.c
30892 --- linux-2.6.32.49/drivers/firmware/memmap.c 2011-11-08 19:02:43.000000000 -0500
30893 +++ linux-2.6.32.49/drivers/firmware/memmap.c 2011-11-15 19:59:43.000000000 -0500
30894 @@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
30895 NULL
30896 };
30897
30898 -static struct sysfs_ops memmap_attr_ops = {
30899 +static const struct sysfs_ops memmap_attr_ops = {
30900 .show = memmap_attr_show,
30901 };
30902
30903 diff -urNp linux-2.6.32.49/drivers/gpio/vr41xx_giu.c linux-2.6.32.49/drivers/gpio/vr41xx_giu.c
30904 --- linux-2.6.32.49/drivers/gpio/vr41xx_giu.c 2011-11-08 19:02:43.000000000 -0500
30905 +++ linux-2.6.32.49/drivers/gpio/vr41xx_giu.c 2011-11-15 19:59:43.000000000 -0500
30906 @@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
30907 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
30908 maskl, pendl, maskh, pendh);
30909
30910 - atomic_inc(&irq_err_count);
30911 + atomic_inc_unchecked(&irq_err_count);
30912
30913 return -EINVAL;
30914 }
30915 diff -urNp linux-2.6.32.49/drivers/gpu/drm/drm_crtc.c linux-2.6.32.49/drivers/gpu/drm/drm_crtc.c
30916 --- linux-2.6.32.49/drivers/gpu/drm/drm_crtc.c 2011-11-08 19:02:43.000000000 -0500
30917 +++ linux-2.6.32.49/drivers/gpu/drm/drm_crtc.c 2011-11-15 19:59:43.000000000 -0500
30918 @@ -1323,7 +1323,7 @@ int drm_mode_getconnector(struct drm_dev
30919 */
30920 if ((out_resp->count_modes >= mode_count) && mode_count) {
30921 copied = 0;
30922 - mode_ptr = (struct drm_mode_modeinfo *)(unsigned long)out_resp->modes_ptr;
30923 + mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
30924 list_for_each_entry(mode, &connector->modes, head) {
30925 drm_crtc_convert_to_umode(&u_mode, mode);
30926 if (copy_to_user(mode_ptr + copied,
30927 @@ -1338,8 +1338,8 @@ int drm_mode_getconnector(struct drm_dev
30928
30929 if ((out_resp->count_props >= props_count) && props_count) {
30930 copied = 0;
30931 - prop_ptr = (uint32_t *)(unsigned long)(out_resp->props_ptr);
30932 - prop_values = (uint64_t *)(unsigned long)(out_resp->prop_values_ptr);
30933 + prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr);
30934 + prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr);
30935 for (i = 0; i < DRM_CONNECTOR_MAX_PROPERTY; i++) {
30936 if (connector->property_ids[i] != 0) {
30937 if (put_user(connector->property_ids[i],
30938 @@ -1361,7 +1361,7 @@ int drm_mode_getconnector(struct drm_dev
30939
30940 if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
30941 copied = 0;
30942 - encoder_ptr = (uint32_t *)(unsigned long)(out_resp->encoders_ptr);
30943 + encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
30944 for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
30945 if (connector->encoder_ids[i] != 0) {
30946 if (put_user(connector->encoder_ids[i],
30947 @@ -1513,7 +1513,7 @@ int drm_mode_setcrtc(struct drm_device *
30948 }
30949
30950 for (i = 0; i < crtc_req->count_connectors; i++) {
30951 - set_connectors_ptr = (uint32_t *)(unsigned long)crtc_req->set_connectors_ptr;
30952 + set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
30953 if (get_user(out_id, &set_connectors_ptr[i])) {
30954 ret = -EFAULT;
30955 goto out;
30956 @@ -2118,7 +2118,7 @@ int drm_mode_getproperty_ioctl(struct dr
30957 out_resp->flags = property->flags;
30958
30959 if ((out_resp->count_values >= value_count) && value_count) {
30960 - values_ptr = (uint64_t *)(unsigned long)out_resp->values_ptr;
30961 + values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
30962 for (i = 0; i < value_count; i++) {
30963 if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
30964 ret = -EFAULT;
30965 @@ -2131,7 +2131,7 @@ int drm_mode_getproperty_ioctl(struct dr
30966 if (property->flags & DRM_MODE_PROP_ENUM) {
30967 if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
30968 copied = 0;
30969 - enum_ptr = (struct drm_mode_property_enum *)(unsigned long)out_resp->enum_blob_ptr;
30970 + enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
30971 list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
30972
30973 if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
30974 @@ -2154,7 +2154,7 @@ int drm_mode_getproperty_ioctl(struct dr
30975 if ((out_resp->count_enum_blobs >= blob_count) && blob_count) {
30976 copied = 0;
30977 blob_id_ptr = (uint32_t *)(unsigned long)out_resp->enum_blob_ptr;
30978 - blob_length_ptr = (uint32_t *)(unsigned long)out_resp->values_ptr;
30979 + blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr;
30980
30981 list_for_each_entry(prop_blob, &property->enum_blob_list, head) {
30982 if (put_user(prop_blob->base.id, blob_id_ptr + copied)) {
30983 @@ -2226,7 +2226,7 @@ int drm_mode_getblob_ioctl(struct drm_de
30984 blob = obj_to_blob(obj);
30985
30986 if (out_resp->length == blob->length) {
30987 - blob_ptr = (void *)(unsigned long)out_resp->data;
30988 + blob_ptr = (void __user *)(unsigned long)out_resp->data;
30989 if (copy_to_user(blob_ptr, blob->data, blob->length)){
30990 ret = -EFAULT;
30991 goto done;
30992 diff -urNp linux-2.6.32.49/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.32.49/drivers/gpu/drm/drm_crtc_helper.c
30993 --- linux-2.6.32.49/drivers/gpu/drm/drm_crtc_helper.c 2011-11-08 19:02:43.000000000 -0500
30994 +++ linux-2.6.32.49/drivers/gpu/drm/drm_crtc_helper.c 2011-11-15 19:59:43.000000000 -0500
30995 @@ -573,7 +573,7 @@ static bool drm_encoder_crtc_ok(struct d
30996 struct drm_crtc *tmp;
30997 int crtc_mask = 1;
30998
30999 - WARN(!crtc, "checking null crtc?");
31000 + BUG_ON(!crtc);
31001
31002 dev = crtc->dev;
31003
31004 @@ -642,6 +642,8 @@ bool drm_crtc_helper_set_mode(struct drm
31005
31006 adjusted_mode = drm_mode_duplicate(dev, mode);
31007
31008 + pax_track_stack();
31009 +
31010 crtc->enabled = drm_helper_crtc_in_use(crtc);
31011
31012 if (!crtc->enabled)
31013 diff -urNp linux-2.6.32.49/drivers/gpu/drm/drm_drv.c linux-2.6.32.49/drivers/gpu/drm/drm_drv.c
31014 --- linux-2.6.32.49/drivers/gpu/drm/drm_drv.c 2011-11-08 19:02:43.000000000 -0500
31015 +++ linux-2.6.32.49/drivers/gpu/drm/drm_drv.c 2011-11-15 19:59:43.000000000 -0500
31016 @@ -417,7 +417,7 @@ int drm_ioctl(struct inode *inode, struc
31017 char *kdata = NULL;
31018
31019 atomic_inc(&dev->ioctl_count);
31020 - atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
31021 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
31022 ++file_priv->ioctl_count;
31023
31024 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
31025 diff -urNp linux-2.6.32.49/drivers/gpu/drm/drm_fops.c linux-2.6.32.49/drivers/gpu/drm/drm_fops.c
31026 --- linux-2.6.32.49/drivers/gpu/drm/drm_fops.c 2011-11-08 19:02:43.000000000 -0500
31027 +++ linux-2.6.32.49/drivers/gpu/drm/drm_fops.c 2011-11-15 19:59:43.000000000 -0500
31028 @@ -66,7 +66,7 @@ static int drm_setup(struct drm_device *
31029 }
31030
31031 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
31032 - atomic_set(&dev->counts[i], 0);
31033 + atomic_set_unchecked(&dev->counts[i], 0);
31034
31035 dev->sigdata.lock = NULL;
31036
31037 @@ -130,9 +130,9 @@ int drm_open(struct inode *inode, struct
31038
31039 retcode = drm_open_helper(inode, filp, dev);
31040 if (!retcode) {
31041 - atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
31042 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
31043 spin_lock(&dev->count_lock);
31044 - if (!dev->open_count++) {
31045 + if (local_inc_return(&dev->open_count) == 1) {
31046 spin_unlock(&dev->count_lock);
31047 retcode = drm_setup(dev);
31048 goto out;
31049 @@ -435,7 +435,7 @@ int drm_release(struct inode *inode, str
31050
31051 lock_kernel();
31052
31053 - DRM_DEBUG("open_count = %d\n", dev->open_count);
31054 + DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
31055
31056 if (dev->driver->preclose)
31057 dev->driver->preclose(dev, file_priv);
31058 @@ -447,7 +447,7 @@ int drm_release(struct inode *inode, str
31059 DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
31060 task_pid_nr(current),
31061 (long)old_encode_dev(file_priv->minor->device),
31062 - dev->open_count);
31063 + local_read(&dev->open_count));
31064
31065 /* if the master has gone away we can't do anything with the lock */
31066 if (file_priv->minor->master)
31067 @@ -524,9 +524,9 @@ int drm_release(struct inode *inode, str
31068 * End inline drm_release
31069 */
31070
31071 - atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
31072 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
31073 spin_lock(&dev->count_lock);
31074 - if (!--dev->open_count) {
31075 + if (local_dec_and_test(&dev->open_count)) {
31076 if (atomic_read(&dev->ioctl_count)) {
31077 DRM_ERROR("Device busy: %d\n",
31078 atomic_read(&dev->ioctl_count));
31079 diff -urNp linux-2.6.32.49/drivers/gpu/drm/drm_gem.c linux-2.6.32.49/drivers/gpu/drm/drm_gem.c
31080 --- linux-2.6.32.49/drivers/gpu/drm/drm_gem.c 2011-11-08 19:02:43.000000000 -0500
31081 +++ linux-2.6.32.49/drivers/gpu/drm/drm_gem.c 2011-11-15 19:59:43.000000000 -0500
31082 @@ -83,11 +83,11 @@ drm_gem_init(struct drm_device *dev)
31083 spin_lock_init(&dev->object_name_lock);
31084 idr_init(&dev->object_name_idr);
31085 atomic_set(&dev->object_count, 0);
31086 - atomic_set(&dev->object_memory, 0);
31087 + atomic_set_unchecked(&dev->object_memory, 0);
31088 atomic_set(&dev->pin_count, 0);
31089 - atomic_set(&dev->pin_memory, 0);
31090 + atomic_set_unchecked(&dev->pin_memory, 0);
31091 atomic_set(&dev->gtt_count, 0);
31092 - atomic_set(&dev->gtt_memory, 0);
31093 + atomic_set_unchecked(&dev->gtt_memory, 0);
31094
31095 mm = kzalloc(sizeof(struct drm_gem_mm), GFP_KERNEL);
31096 if (!mm) {
31097 @@ -150,7 +150,7 @@ drm_gem_object_alloc(struct drm_device *
31098 goto fput;
31099 }
31100 atomic_inc(&dev->object_count);
31101 - atomic_add(obj->size, &dev->object_memory);
31102 + atomic_add_unchecked(obj->size, &dev->object_memory);
31103 return obj;
31104 fput:
31105 fput(obj->filp);
31106 @@ -429,7 +429,7 @@ drm_gem_object_free(struct kref *kref)
31107
31108 fput(obj->filp);
31109 atomic_dec(&dev->object_count);
31110 - atomic_sub(obj->size, &dev->object_memory);
31111 + atomic_sub_unchecked(obj->size, &dev->object_memory);
31112 kfree(obj);
31113 }
31114 EXPORT_SYMBOL(drm_gem_object_free);
31115 diff -urNp linux-2.6.32.49/drivers/gpu/drm/drm_info.c linux-2.6.32.49/drivers/gpu/drm/drm_info.c
31116 --- linux-2.6.32.49/drivers/gpu/drm/drm_info.c 2011-11-08 19:02:43.000000000 -0500
31117 +++ linux-2.6.32.49/drivers/gpu/drm/drm_info.c 2011-11-15 19:59:43.000000000 -0500
31118 @@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void
31119 struct drm_local_map *map;
31120 struct drm_map_list *r_list;
31121
31122 - /* Hardcoded from _DRM_FRAME_BUFFER,
31123 - _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
31124 - _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
31125 - const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
31126 + static const char * const types[] = {
31127 + [_DRM_FRAME_BUFFER] = "FB",
31128 + [_DRM_REGISTERS] = "REG",
31129 + [_DRM_SHM] = "SHM",
31130 + [_DRM_AGP] = "AGP",
31131 + [_DRM_SCATTER_GATHER] = "SG",
31132 + [_DRM_CONSISTENT] = "PCI",
31133 + [_DRM_GEM] = "GEM" };
31134 const char *type;
31135 int i;
31136
31137 @@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void
31138 map = r_list->map;
31139 if (!map)
31140 continue;
31141 - if (map->type < 0 || map->type > 5)
31142 + if (map->type >= ARRAY_SIZE(types))
31143 type = "??";
31144 else
31145 type = types[map->type];
31146 @@ -265,10 +269,10 @@ int drm_gem_object_info(struct seq_file
31147 struct drm_device *dev = node->minor->dev;
31148
31149 seq_printf(m, "%d objects\n", atomic_read(&dev->object_count));
31150 - seq_printf(m, "%d object bytes\n", atomic_read(&dev->object_memory));
31151 + seq_printf(m, "%d object bytes\n", atomic_read_unchecked(&dev->object_memory));
31152 seq_printf(m, "%d pinned\n", atomic_read(&dev->pin_count));
31153 - seq_printf(m, "%d pin bytes\n", atomic_read(&dev->pin_memory));
31154 - seq_printf(m, "%d gtt bytes\n", atomic_read(&dev->gtt_memory));
31155 + seq_printf(m, "%d pin bytes\n", atomic_read_unchecked(&dev->pin_memory));
31156 + seq_printf(m, "%d gtt bytes\n", atomic_read_unchecked(&dev->gtt_memory));
31157 seq_printf(m, "%d gtt total\n", dev->gtt_total);
31158 return 0;
31159 }
31160 @@ -288,7 +292,11 @@ int drm_vma_info(struct seq_file *m, voi
31161 mutex_lock(&dev->struct_mutex);
31162 seq_printf(m, "vma use count: %d, high_memory = %p, 0x%08llx\n",
31163 atomic_read(&dev->vma_count),
31164 +#ifdef CONFIG_GRKERNSEC_HIDESYM
31165 + NULL, 0);
31166 +#else
31167 high_memory, (u64)virt_to_phys(high_memory));
31168 +#endif
31169
31170 list_for_each_entry(pt, &dev->vmalist, head) {
31171 vma = pt->vma;
31172 @@ -296,14 +304,23 @@ int drm_vma_info(struct seq_file *m, voi
31173 continue;
31174 seq_printf(m,
31175 "\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx000",
31176 - pt->pid, vma->vm_start, vma->vm_end,
31177 + pt->pid,
31178 +#ifdef CONFIG_GRKERNSEC_HIDESYM
31179 + 0, 0,
31180 +#else
31181 + vma->vm_start, vma->vm_end,
31182 +#endif
31183 vma->vm_flags & VM_READ ? 'r' : '-',
31184 vma->vm_flags & VM_WRITE ? 'w' : '-',
31185 vma->vm_flags & VM_EXEC ? 'x' : '-',
31186 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
31187 vma->vm_flags & VM_LOCKED ? 'l' : '-',
31188 vma->vm_flags & VM_IO ? 'i' : '-',
31189 +#ifdef CONFIG_GRKERNSEC_HIDESYM
31190 + 0);
31191 +#else
31192 vma->vm_pgoff);
31193 +#endif
31194
31195 #if defined(__i386__)
31196 pgprot = pgprot_val(vma->vm_page_prot);
31197 diff -urNp linux-2.6.32.49/drivers/gpu/drm/drm_ioc32.c linux-2.6.32.49/drivers/gpu/drm/drm_ioc32.c
31198 --- linux-2.6.32.49/drivers/gpu/drm/drm_ioc32.c 2011-11-08 19:02:43.000000000 -0500
31199 +++ linux-2.6.32.49/drivers/gpu/drm/drm_ioc32.c 2011-11-15 19:59:43.000000000 -0500
31200 @@ -463,7 +463,7 @@ static int compat_drm_infobufs(struct fi
31201 request = compat_alloc_user_space(nbytes);
31202 if (!access_ok(VERIFY_WRITE, request, nbytes))
31203 return -EFAULT;
31204 - list = (struct drm_buf_desc *) (request + 1);
31205 + list = (struct drm_buf_desc __user *) (request + 1);
31206
31207 if (__put_user(count, &request->count)
31208 || __put_user(list, &request->list))
31209 @@ -525,7 +525,7 @@ static int compat_drm_mapbufs(struct fil
31210 request = compat_alloc_user_space(nbytes);
31211 if (!access_ok(VERIFY_WRITE, request, nbytes))
31212 return -EFAULT;
31213 - list = (struct drm_buf_pub *) (request + 1);
31214 + list = (struct drm_buf_pub __user *) (request + 1);
31215
31216 if (__put_user(count, &request->count)
31217 || __put_user(list, &request->list))
31218 diff -urNp linux-2.6.32.49/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.49/drivers/gpu/drm/drm_ioctl.c
31219 --- linux-2.6.32.49/drivers/gpu/drm/drm_ioctl.c 2011-11-08 19:02:43.000000000 -0500
31220 +++ linux-2.6.32.49/drivers/gpu/drm/drm_ioctl.c 2011-11-15 19:59:43.000000000 -0500
31221 @@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev,
31222 stats->data[i].value =
31223 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
31224 else
31225 - stats->data[i].value = atomic_read(&dev->counts[i]);
31226 + stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
31227 stats->data[i].type = dev->types[i];
31228 }
31229
31230 diff -urNp linux-2.6.32.49/drivers/gpu/drm/drm_lock.c linux-2.6.32.49/drivers/gpu/drm/drm_lock.c
31231 --- linux-2.6.32.49/drivers/gpu/drm/drm_lock.c 2011-11-08 19:02:43.000000000 -0500
31232 +++ linux-2.6.32.49/drivers/gpu/drm/drm_lock.c 2011-11-15 19:59:43.000000000 -0500
31233 @@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, voi
31234 if (drm_lock_take(&master->lock, lock->context)) {
31235 master->lock.file_priv = file_priv;
31236 master->lock.lock_time = jiffies;
31237 - atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
31238 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
31239 break; /* Got lock */
31240 }
31241
31242 @@ -165,7 +165,7 @@ int drm_unlock(struct drm_device *dev, v
31243 return -EINVAL;
31244 }
31245
31246 - atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
31247 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
31248
31249 /* kernel_context_switch isn't used by any of the x86 drm
31250 * modules but is required by the Sparc driver.
31251 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i810/i810_dma.c linux-2.6.32.49/drivers/gpu/drm/i810/i810_dma.c
31252 --- linux-2.6.32.49/drivers/gpu/drm/i810/i810_dma.c 2011-11-08 19:02:43.000000000 -0500
31253 +++ linux-2.6.32.49/drivers/gpu/drm/i810/i810_dma.c 2011-11-15 19:59:43.000000000 -0500
31254 @@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_de
31255 dma->buflist[vertex->idx],
31256 vertex->discard, vertex->used);
31257
31258 - atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
31259 - atomic_inc(&dev->counts[_DRM_STAT_DMA]);
31260 + atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
31261 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
31262 sarea_priv->last_enqueue = dev_priv->counter - 1;
31263 sarea_priv->last_dispatch = (int)hw_status[5];
31264
31265 @@ -1115,8 +1115,8 @@ static int i810_dma_mc(struct drm_device
31266 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
31267 mc->last_render);
31268
31269 - atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
31270 - atomic_inc(&dev->counts[_DRM_STAT_DMA]);
31271 + atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
31272 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
31273 sarea_priv->last_enqueue = dev_priv->counter - 1;
31274 sarea_priv->last_dispatch = (int)hw_status[5];
31275
31276 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i810/i810_drv.h linux-2.6.32.49/drivers/gpu/drm/i810/i810_drv.h
31277 --- linux-2.6.32.49/drivers/gpu/drm/i810/i810_drv.h 2011-11-08 19:02:43.000000000 -0500
31278 +++ linux-2.6.32.49/drivers/gpu/drm/i810/i810_drv.h 2011-11-15 19:59:43.000000000 -0500
31279 @@ -108,8 +108,8 @@ typedef struct drm_i810_private {
31280 int page_flipping;
31281
31282 wait_queue_head_t irq_queue;
31283 - atomic_t irq_received;
31284 - atomic_t irq_emitted;
31285 + atomic_unchecked_t irq_received;
31286 + atomic_unchecked_t irq_emitted;
31287
31288 int front_offset;
31289 } drm_i810_private_t;
31290 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i830/i830_drv.h linux-2.6.32.49/drivers/gpu/drm/i830/i830_drv.h
31291 --- linux-2.6.32.49/drivers/gpu/drm/i830/i830_drv.h 2011-11-08 19:02:43.000000000 -0500
31292 +++ linux-2.6.32.49/drivers/gpu/drm/i830/i830_drv.h 2011-11-15 19:59:43.000000000 -0500
31293 @@ -115,8 +115,8 @@ typedef struct drm_i830_private {
31294 int page_flipping;
31295
31296 wait_queue_head_t irq_queue;
31297 - atomic_t irq_received;
31298 - atomic_t irq_emitted;
31299 + atomic_unchecked_t irq_received;
31300 + atomic_unchecked_t irq_emitted;
31301
31302 int use_mi_batchbuffer_start;
31303
31304 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i830/i830_irq.c linux-2.6.32.49/drivers/gpu/drm/i830/i830_irq.c
31305 --- linux-2.6.32.49/drivers/gpu/drm/i830/i830_irq.c 2011-11-08 19:02:43.000000000 -0500
31306 +++ linux-2.6.32.49/drivers/gpu/drm/i830/i830_irq.c 2011-11-15 19:59:43.000000000 -0500
31307 @@ -47,7 +47,7 @@ irqreturn_t i830_driver_irq_handler(DRM_
31308
31309 I830_WRITE16(I830REG_INT_IDENTITY_R, temp);
31310
31311 - atomic_inc(&dev_priv->irq_received);
31312 + atomic_inc_unchecked(&dev_priv->irq_received);
31313 wake_up_interruptible(&dev_priv->irq_queue);
31314
31315 return IRQ_HANDLED;
31316 @@ -60,14 +60,14 @@ static int i830_emit_irq(struct drm_devi
31317
31318 DRM_DEBUG("%s\n", __func__);
31319
31320 - atomic_inc(&dev_priv->irq_emitted);
31321 + atomic_inc_unchecked(&dev_priv->irq_emitted);
31322
31323 BEGIN_LP_RING(2);
31324 OUT_RING(0);
31325 OUT_RING(GFX_OP_USER_INTERRUPT);
31326 ADVANCE_LP_RING();
31327
31328 - return atomic_read(&dev_priv->irq_emitted);
31329 + return atomic_read_unchecked(&dev_priv->irq_emitted);
31330 }
31331
31332 static int i830_wait_irq(struct drm_device * dev, int irq_nr)
31333 @@ -79,7 +79,7 @@ static int i830_wait_irq(struct drm_devi
31334
31335 DRM_DEBUG("%s\n", __func__);
31336
31337 - if (atomic_read(&dev_priv->irq_received) >= irq_nr)
31338 + if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
31339 return 0;
31340
31341 dev_priv->sarea_priv->perf_boxes |= I830_BOX_WAIT;
31342 @@ -88,7 +88,7 @@ static int i830_wait_irq(struct drm_devi
31343
31344 for (;;) {
31345 __set_current_state(TASK_INTERRUPTIBLE);
31346 - if (atomic_read(&dev_priv->irq_received) >= irq_nr)
31347 + if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
31348 break;
31349 if ((signed)(end - jiffies) <= 0) {
31350 DRM_ERROR("timeout iir %x imr %x ier %x hwstam %x\n",
31351 @@ -163,8 +163,8 @@ void i830_driver_irq_preinstall(struct d
31352 I830_WRITE16(I830REG_HWSTAM, 0xffff);
31353 I830_WRITE16(I830REG_INT_MASK_R, 0x0);
31354 I830_WRITE16(I830REG_INT_ENABLE_R, 0x0);
31355 - atomic_set(&dev_priv->irq_received, 0);
31356 - atomic_set(&dev_priv->irq_emitted, 0);
31357 + atomic_set_unchecked(&dev_priv->irq_received, 0);
31358 + atomic_set_unchecked(&dev_priv->irq_emitted, 0);
31359 init_waitqueue_head(&dev_priv->irq_queue);
31360 }
31361
31362 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.32.49/drivers/gpu/drm/i915/dvo_ch7017.c
31363 --- linux-2.6.32.49/drivers/gpu/drm/i915/dvo_ch7017.c 2011-11-08 19:02:43.000000000 -0500
31364 +++ linux-2.6.32.49/drivers/gpu/drm/i915/dvo_ch7017.c 2011-11-15 19:59:43.000000000 -0500
31365 @@ -443,7 +443,7 @@ static void ch7017_destroy(struct intel_
31366 }
31367 }
31368
31369 -struct intel_dvo_dev_ops ch7017_ops = {
31370 +const struct intel_dvo_dev_ops ch7017_ops = {
31371 .init = ch7017_init,
31372 .detect = ch7017_detect,
31373 .mode_valid = ch7017_mode_valid,
31374 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.32.49/drivers/gpu/drm/i915/dvo_ch7xxx.c
31375 --- linux-2.6.32.49/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-11-08 19:02:43.000000000 -0500
31376 +++ linux-2.6.32.49/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-11-15 19:59:43.000000000 -0500
31377 @@ -356,7 +356,7 @@ static void ch7xxx_destroy(struct intel_
31378 }
31379 }
31380
31381 -struct intel_dvo_dev_ops ch7xxx_ops = {
31382 +const struct intel_dvo_dev_ops ch7xxx_ops = {
31383 .init = ch7xxx_init,
31384 .detect = ch7xxx_detect,
31385 .mode_valid = ch7xxx_mode_valid,
31386 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i915/dvo.h linux-2.6.32.49/drivers/gpu/drm/i915/dvo.h
31387 --- linux-2.6.32.49/drivers/gpu/drm/i915/dvo.h 2011-11-08 19:02:43.000000000 -0500
31388 +++ linux-2.6.32.49/drivers/gpu/drm/i915/dvo.h 2011-11-15 19:59:43.000000000 -0500
31389 @@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
31390 *
31391 * \return singly-linked list of modes or NULL if no modes found.
31392 */
31393 - struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
31394 + struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
31395
31396 /**
31397 * Clean up driver-specific bits of the output
31398 */
31399 - void (*destroy) (struct intel_dvo_device *dvo);
31400 + void (* const destroy) (struct intel_dvo_device *dvo);
31401
31402 /**
31403 * Debugging hook to dump device registers to log file
31404 */
31405 - void (*dump_regs)(struct intel_dvo_device *dvo);
31406 + void (* const dump_regs)(struct intel_dvo_device *dvo);
31407 };
31408
31409 -extern struct intel_dvo_dev_ops sil164_ops;
31410 -extern struct intel_dvo_dev_ops ch7xxx_ops;
31411 -extern struct intel_dvo_dev_ops ivch_ops;
31412 -extern struct intel_dvo_dev_ops tfp410_ops;
31413 -extern struct intel_dvo_dev_ops ch7017_ops;
31414 +extern const struct intel_dvo_dev_ops sil164_ops;
31415 +extern const struct intel_dvo_dev_ops ch7xxx_ops;
31416 +extern const struct intel_dvo_dev_ops ivch_ops;
31417 +extern const struct intel_dvo_dev_ops tfp410_ops;
31418 +extern const struct intel_dvo_dev_ops ch7017_ops;
31419
31420 #endif /* _INTEL_DVO_H */
31421 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.32.49/drivers/gpu/drm/i915/dvo_ivch.c
31422 --- linux-2.6.32.49/drivers/gpu/drm/i915/dvo_ivch.c 2011-11-08 19:02:43.000000000 -0500
31423 +++ linux-2.6.32.49/drivers/gpu/drm/i915/dvo_ivch.c 2011-11-15 19:59:43.000000000 -0500
31424 @@ -430,7 +430,7 @@ static void ivch_destroy(struct intel_dv
31425 }
31426 }
31427
31428 -struct intel_dvo_dev_ops ivch_ops= {
31429 +const struct intel_dvo_dev_ops ivch_ops= {
31430 .init = ivch_init,
31431 .dpms = ivch_dpms,
31432 .save = ivch_save,
31433 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.32.49/drivers/gpu/drm/i915/dvo_sil164.c
31434 --- linux-2.6.32.49/drivers/gpu/drm/i915/dvo_sil164.c 2011-11-08 19:02:43.000000000 -0500
31435 +++ linux-2.6.32.49/drivers/gpu/drm/i915/dvo_sil164.c 2011-11-15 19:59:43.000000000 -0500
31436 @@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_
31437 }
31438 }
31439
31440 -struct intel_dvo_dev_ops sil164_ops = {
31441 +const struct intel_dvo_dev_ops sil164_ops = {
31442 .init = sil164_init,
31443 .detect = sil164_detect,
31444 .mode_valid = sil164_mode_valid,
31445 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.32.49/drivers/gpu/drm/i915/dvo_tfp410.c
31446 --- linux-2.6.32.49/drivers/gpu/drm/i915/dvo_tfp410.c 2011-11-08 19:02:43.000000000 -0500
31447 +++ linux-2.6.32.49/drivers/gpu/drm/i915/dvo_tfp410.c 2011-11-15 19:59:43.000000000 -0500
31448 @@ -323,7 +323,7 @@ static void tfp410_destroy(struct intel_
31449 }
31450 }
31451
31452 -struct intel_dvo_dev_ops tfp410_ops = {
31453 +const struct intel_dvo_dev_ops tfp410_ops = {
31454 .init = tfp410_init,
31455 .detect = tfp410_detect,
31456 .mode_valid = tfp410_mode_valid,
31457 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i915/i915_debugfs.c linux-2.6.32.49/drivers/gpu/drm/i915/i915_debugfs.c
31458 --- linux-2.6.32.49/drivers/gpu/drm/i915/i915_debugfs.c 2011-11-08 19:02:43.000000000 -0500
31459 +++ linux-2.6.32.49/drivers/gpu/drm/i915/i915_debugfs.c 2011-11-15 19:59:43.000000000 -0500
31460 @@ -192,7 +192,7 @@ static int i915_interrupt_info(struct se
31461 I915_READ(GTIMR));
31462 }
31463 seq_printf(m, "Interrupts received: %d\n",
31464 - atomic_read(&dev_priv->irq_received));
31465 + atomic_read_unchecked(&dev_priv->irq_received));
31466 if (dev_priv->hw_status_page != NULL) {
31467 seq_printf(m, "Current sequence: %d\n",
31468 i915_get_gem_seqno(dev));
31469 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.49/drivers/gpu/drm/i915/i915_drv.c
31470 --- linux-2.6.32.49/drivers/gpu/drm/i915/i915_drv.c 2011-11-08 19:02:43.000000000 -0500
31471 +++ linux-2.6.32.49/drivers/gpu/drm/i915/i915_drv.c 2011-11-15 19:59:43.000000000 -0500
31472 @@ -285,7 +285,7 @@ i915_pci_resume(struct pci_dev *pdev)
31473 return i915_resume(dev);
31474 }
31475
31476 -static struct vm_operations_struct i915_gem_vm_ops = {
31477 +static const struct vm_operations_struct i915_gem_vm_ops = {
31478 .fault = i915_gem_fault,
31479 .open = drm_gem_vm_open,
31480 .close = drm_gem_vm_close,
31481 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i915/i915_drv.h linux-2.6.32.49/drivers/gpu/drm/i915/i915_drv.h
31482 --- linux-2.6.32.49/drivers/gpu/drm/i915/i915_drv.h 2011-11-08 19:02:43.000000000 -0500
31483 +++ linux-2.6.32.49/drivers/gpu/drm/i915/i915_drv.h 2011-11-15 19:59:43.000000000 -0500
31484 @@ -168,7 +168,7 @@ struct drm_i915_display_funcs {
31485 /* display clock increase/decrease */
31486 /* pll clock increase/decrease */
31487 /* clock gating init */
31488 -};
31489 +} __no_const;
31490
31491 typedef struct drm_i915_private {
31492 struct drm_device *dev;
31493 @@ -197,7 +197,7 @@ typedef struct drm_i915_private {
31494 int page_flipping;
31495
31496 wait_queue_head_t irq_queue;
31497 - atomic_t irq_received;
31498 + atomic_unchecked_t irq_received;
31499 /** Protects user_irq_refcount and irq_mask_reg */
31500 spinlock_t user_irq_lock;
31501 /** Refcount for i915_user_irq_get() versus i915_user_irq_put(). */
31502 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i915/i915_gem.c linux-2.6.32.49/drivers/gpu/drm/i915/i915_gem.c
31503 --- linux-2.6.32.49/drivers/gpu/drm/i915/i915_gem.c 2011-11-26 19:44:53.000000000 -0500
31504 +++ linux-2.6.32.49/drivers/gpu/drm/i915/i915_gem.c 2011-11-26 19:55:10.000000000 -0500
31505 @@ -102,7 +102,7 @@ i915_gem_get_aperture_ioctl(struct drm_d
31506
31507 args->aper_size = dev->gtt_total;
31508 args->aper_available_size = (args->aper_size -
31509 - atomic_read(&dev->pin_memory));
31510 + atomic_read_unchecked(&dev->pin_memory));
31511
31512 return 0;
31513 }
31514 @@ -2058,7 +2058,7 @@ i915_gem_object_unbind(struct drm_gem_ob
31515
31516 if (obj_priv->gtt_space) {
31517 atomic_dec(&dev->gtt_count);
31518 - atomic_sub(obj->size, &dev->gtt_memory);
31519 + atomic_sub_unchecked(obj->size, &dev->gtt_memory);
31520
31521 drm_mm_put_block(obj_priv->gtt_space);
31522 obj_priv->gtt_space = NULL;
31523 @@ -2701,7 +2701,7 @@ i915_gem_object_bind_to_gtt(struct drm_g
31524 goto search_free;
31525 }
31526 atomic_inc(&dev->gtt_count);
31527 - atomic_add(obj->size, &dev->gtt_memory);
31528 + atomic_add_unchecked(obj->size, &dev->gtt_memory);
31529
31530 /* Assert that the object is not currently in any GPU domain. As it
31531 * wasn't in the GTT, there shouldn't be any way it could have been in
31532 @@ -3755,9 +3755,9 @@ i915_gem_execbuffer(struct drm_device *d
31533 "%d/%d gtt bytes\n",
31534 atomic_read(&dev->object_count),
31535 atomic_read(&dev->pin_count),
31536 - atomic_read(&dev->object_memory),
31537 - atomic_read(&dev->pin_memory),
31538 - atomic_read(&dev->gtt_memory),
31539 + atomic_read_unchecked(&dev->object_memory),
31540 + atomic_read_unchecked(&dev->pin_memory),
31541 + atomic_read_unchecked(&dev->gtt_memory),
31542 dev->gtt_total);
31543 }
31544 goto err;
31545 @@ -3989,7 +3989,7 @@ i915_gem_object_pin(struct drm_gem_objec
31546 */
31547 if (obj_priv->pin_count == 1) {
31548 atomic_inc(&dev->pin_count);
31549 - atomic_add(obj->size, &dev->pin_memory);
31550 + atomic_add_unchecked(obj->size, &dev->pin_memory);
31551 if (!obj_priv->active &&
31552 (obj->write_domain & I915_GEM_GPU_DOMAINS) == 0 &&
31553 !list_empty(&obj_priv->list))
31554 @@ -4022,7 +4022,7 @@ i915_gem_object_unpin(struct drm_gem_obj
31555 list_move_tail(&obj_priv->list,
31556 &dev_priv->mm.inactive_list);
31557 atomic_dec(&dev->pin_count);
31558 - atomic_sub(obj->size, &dev->pin_memory);
31559 + atomic_sub_unchecked(obj->size, &dev->pin_memory);
31560 }
31561 i915_verify_inactive(dev, __FILE__, __LINE__);
31562 }
31563 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i915/i915_irq.c linux-2.6.32.49/drivers/gpu/drm/i915/i915_irq.c
31564 --- linux-2.6.32.49/drivers/gpu/drm/i915/i915_irq.c 2011-11-08 19:02:43.000000000 -0500
31565 +++ linux-2.6.32.49/drivers/gpu/drm/i915/i915_irq.c 2011-11-15 19:59:43.000000000 -0500
31566 @@ -528,7 +528,7 @@ irqreturn_t i915_driver_irq_handler(DRM_
31567 int irq_received;
31568 int ret = IRQ_NONE;
31569
31570 - atomic_inc(&dev_priv->irq_received);
31571 + atomic_inc_unchecked(&dev_priv->irq_received);
31572
31573 if (IS_IGDNG(dev))
31574 return igdng_irq_handler(dev);
31575 @@ -1021,7 +1021,7 @@ void i915_driver_irq_preinstall(struct d
31576 {
31577 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
31578
31579 - atomic_set(&dev_priv->irq_received, 0);
31580 + atomic_set_unchecked(&dev_priv->irq_received, 0);
31581
31582 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
31583 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
31584 diff -urNp linux-2.6.32.49/drivers/gpu/drm/i915/intel_sdvo.c linux-2.6.32.49/drivers/gpu/drm/i915/intel_sdvo.c
31585 --- linux-2.6.32.49/drivers/gpu/drm/i915/intel_sdvo.c 2011-11-08 19:02:43.000000000 -0500
31586 +++ linux-2.6.32.49/drivers/gpu/drm/i915/intel_sdvo.c 2011-11-15 19:59:43.000000000 -0500
31587 @@ -2795,7 +2795,9 @@ bool intel_sdvo_init(struct drm_device *
31588 sdvo_priv->slave_addr = intel_sdvo_get_slave_addr(dev, output_device);
31589
31590 /* Save the bit-banging i2c functionality for use by the DDC wrapper */
31591 - intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
31592 + pax_open_kernel();
31593 + *(void **)&intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
31594 + pax_close_kernel();
31595
31596 /* Read the regs to test if we can talk to the device */
31597 for (i = 0; i < 0x40; i++) {
31598 diff -urNp linux-2.6.32.49/drivers/gpu/drm/mga/mga_drv.h linux-2.6.32.49/drivers/gpu/drm/mga/mga_drv.h
31599 --- linux-2.6.32.49/drivers/gpu/drm/mga/mga_drv.h 2011-11-08 19:02:43.000000000 -0500
31600 +++ linux-2.6.32.49/drivers/gpu/drm/mga/mga_drv.h 2011-11-15 19:59:43.000000000 -0500
31601 @@ -120,9 +120,9 @@ typedef struct drm_mga_private {
31602 u32 clear_cmd;
31603 u32 maccess;
31604
31605 - atomic_t vbl_received; /**< Number of vblanks received. */
31606 + atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
31607 wait_queue_head_t fence_queue;
31608 - atomic_t last_fence_retired;
31609 + atomic_unchecked_t last_fence_retired;
31610 u32 next_fence_to_post;
31611
31612 unsigned int fb_cpp;
31613 diff -urNp linux-2.6.32.49/drivers/gpu/drm/mga/mga_irq.c linux-2.6.32.49/drivers/gpu/drm/mga/mga_irq.c
31614 --- linux-2.6.32.49/drivers/gpu/drm/mga/mga_irq.c 2011-11-08 19:02:43.000000000 -0500
31615 +++ linux-2.6.32.49/drivers/gpu/drm/mga/mga_irq.c 2011-11-15 19:59:43.000000000 -0500
31616 @@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_de
31617 if (crtc != 0)
31618 return 0;
31619
31620 - return atomic_read(&dev_priv->vbl_received);
31621 + return atomic_read_unchecked(&dev_priv->vbl_received);
31622 }
31623
31624
31625 @@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
31626 /* VBLANK interrupt */
31627 if (status & MGA_VLINEPEN) {
31628 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
31629 - atomic_inc(&dev_priv->vbl_received);
31630 + atomic_inc_unchecked(&dev_priv->vbl_received);
31631 drm_handle_vblank(dev, 0);
31632 handled = 1;
31633 }
31634 @@ -80,7 +80,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
31635 MGA_WRITE(MGA_PRIMEND, prim_end);
31636 }
31637
31638 - atomic_inc(&dev_priv->last_fence_retired);
31639 + atomic_inc_unchecked(&dev_priv->last_fence_retired);
31640 DRM_WAKEUP(&dev_priv->fence_queue);
31641 handled = 1;
31642 }
31643 @@ -131,7 +131,7 @@ int mga_driver_fence_wait(struct drm_dev
31644 * using fences.
31645 */
31646 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
31647 - (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
31648 + (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
31649 - *sequence) <= (1 << 23)));
31650
31651 *sequence = cur_fence;
31652 diff -urNp linux-2.6.32.49/drivers/gpu/drm/r128/r128_cce.c linux-2.6.32.49/drivers/gpu/drm/r128/r128_cce.c
31653 --- linux-2.6.32.49/drivers/gpu/drm/r128/r128_cce.c 2011-11-08 19:02:43.000000000 -0500
31654 +++ linux-2.6.32.49/drivers/gpu/drm/r128/r128_cce.c 2011-11-15 19:59:43.000000000 -0500
31655 @@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_d
31656
31657 /* GH: Simple idle check.
31658 */
31659 - atomic_set(&dev_priv->idle_count, 0);
31660 + atomic_set_unchecked(&dev_priv->idle_count, 0);
31661
31662 /* We don't support anything other than bus-mastering ring mode,
31663 * but the ring can be in either AGP or PCI space for the ring
31664 diff -urNp linux-2.6.32.49/drivers/gpu/drm/r128/r128_drv.h linux-2.6.32.49/drivers/gpu/drm/r128/r128_drv.h
31665 --- linux-2.6.32.49/drivers/gpu/drm/r128/r128_drv.h 2011-11-08 19:02:43.000000000 -0500
31666 +++ linux-2.6.32.49/drivers/gpu/drm/r128/r128_drv.h 2011-11-15 19:59:43.000000000 -0500
31667 @@ -90,14 +90,14 @@ typedef struct drm_r128_private {
31668 int is_pci;
31669 unsigned long cce_buffers_offset;
31670
31671 - atomic_t idle_count;
31672 + atomic_unchecked_t idle_count;
31673
31674 int page_flipping;
31675 int current_page;
31676 u32 crtc_offset;
31677 u32 crtc_offset_cntl;
31678
31679 - atomic_t vbl_received;
31680 + atomic_unchecked_t vbl_received;
31681
31682 u32 color_fmt;
31683 unsigned int front_offset;
31684 diff -urNp linux-2.6.32.49/drivers/gpu/drm/r128/r128_irq.c linux-2.6.32.49/drivers/gpu/drm/r128/r128_irq.c
31685 --- linux-2.6.32.49/drivers/gpu/drm/r128/r128_irq.c 2011-11-08 19:02:43.000000000 -0500
31686 +++ linux-2.6.32.49/drivers/gpu/drm/r128/r128_irq.c 2011-11-15 19:59:43.000000000 -0500
31687 @@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_d
31688 if (crtc != 0)
31689 return 0;
31690
31691 - return atomic_read(&dev_priv->vbl_received);
31692 + return atomic_read_unchecked(&dev_priv->vbl_received);
31693 }
31694
31695 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
31696 @@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_
31697 /* VBLANK interrupt */
31698 if (status & R128_CRTC_VBLANK_INT) {
31699 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
31700 - atomic_inc(&dev_priv->vbl_received);
31701 + atomic_inc_unchecked(&dev_priv->vbl_received);
31702 drm_handle_vblank(dev, 0);
31703 return IRQ_HANDLED;
31704 }
31705 diff -urNp linux-2.6.32.49/drivers/gpu/drm/r128/r128_state.c linux-2.6.32.49/drivers/gpu/drm/r128/r128_state.c
31706 --- linux-2.6.32.49/drivers/gpu/drm/r128/r128_state.c 2011-11-08 19:02:43.000000000 -0500
31707 +++ linux-2.6.32.49/drivers/gpu/drm/r128/r128_state.c 2011-11-15 19:59:43.000000000 -0500
31708 @@ -323,10 +323,10 @@ static void r128_clear_box(drm_r128_priv
31709
31710 static void r128_cce_performance_boxes(drm_r128_private_t * dev_priv)
31711 {
31712 - if (atomic_read(&dev_priv->idle_count) == 0) {
31713 + if (atomic_read_unchecked(&dev_priv->idle_count) == 0) {
31714 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
31715 } else {
31716 - atomic_set(&dev_priv->idle_count, 0);
31717 + atomic_set_unchecked(&dev_priv->idle_count, 0);
31718 }
31719 }
31720
31721 diff -urNp linux-2.6.32.49/drivers/gpu/drm/radeon/atom.c linux-2.6.32.49/drivers/gpu/drm/radeon/atom.c
31722 --- linux-2.6.32.49/drivers/gpu/drm/radeon/atom.c 2011-11-08 19:02:43.000000000 -0500
31723 +++ linux-2.6.32.49/drivers/gpu/drm/radeon/atom.c 2011-11-15 19:59:43.000000000 -0500
31724 @@ -1115,6 +1115,8 @@ struct atom_context *atom_parse(struct c
31725 char name[512];
31726 int i;
31727
31728 + pax_track_stack();
31729 +
31730 ctx->card = card;
31731 ctx->bios = bios;
31732
31733 diff -urNp linux-2.6.32.49/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.49/drivers/gpu/drm/radeon/mkregtable.c
31734 --- linux-2.6.32.49/drivers/gpu/drm/radeon/mkregtable.c 2011-11-08 19:02:43.000000000 -0500
31735 +++ linux-2.6.32.49/drivers/gpu/drm/radeon/mkregtable.c 2011-11-15 19:59:43.000000000 -0500
31736 @@ -637,14 +637,14 @@ static int parser_auth(struct table *t,
31737 regex_t mask_rex;
31738 regmatch_t match[4];
31739 char buf[1024];
31740 - size_t end;
31741 + long end;
31742 int len;
31743 int done = 0;
31744 int r;
31745 unsigned o;
31746 struct offset *offset;
31747 char last_reg_s[10];
31748 - int last_reg;
31749 + unsigned long last_reg;
31750
31751 if (regcomp
31752 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
31753 diff -urNp linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_atombios.c
31754 --- linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_atombios.c 2011-11-08 19:02:43.000000000 -0500
31755 +++ linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_atombios.c 2011-11-15 19:59:43.000000000 -0500
31756 @@ -275,6 +275,8 @@ bool radeon_get_atom_connector_info_from
31757 bool linkb;
31758 struct radeon_i2c_bus_rec ddc_bus;
31759
31760 + pax_track_stack();
31761 +
31762 atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
31763
31764 if (data_offset == 0)
31765 @@ -520,13 +522,13 @@ static uint16_t atombios_get_connector_o
31766 }
31767 }
31768
31769 -struct bios_connector {
31770 +static struct bios_connector {
31771 bool valid;
31772 uint16_t line_mux;
31773 uint16_t devices;
31774 int connector_type;
31775 struct radeon_i2c_bus_rec ddc_bus;
31776 -};
31777 +} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
31778
31779 bool radeon_get_atom_connector_info_from_supported_devices_table(struct
31780 drm_device
31781 @@ -542,7 +544,6 @@ bool radeon_get_atom_connector_info_from
31782 uint8_t dac;
31783 union atom_supported_devices *supported_devices;
31784 int i, j;
31785 - struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
31786
31787 atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
31788
31789 diff -urNp linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_display.c
31790 --- linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_display.c 2011-11-08 19:02:43.000000000 -0500
31791 +++ linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_display.c 2011-11-15 19:59:43.000000000 -0500
31792 @@ -482,7 +482,7 @@ void radeon_compute_pll(struct radeon_pl
31793
31794 if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
31795 error = freq - current_freq;
31796 - error = error < 0 ? 0xffffffff : error;
31797 + error = (int32_t)error < 0 ? 0xffffffff : error;
31798 } else
31799 error = abs(current_freq - freq);
31800 vco_diff = abs(vco - best_vco);
31801 diff -urNp linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_drv.h linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_drv.h
31802 --- linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_drv.h 2011-11-08 19:02:43.000000000 -0500
31803 +++ linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_drv.h 2011-11-15 19:59:43.000000000 -0500
31804 @@ -253,7 +253,7 @@ typedef struct drm_radeon_private {
31805
31806 /* SW interrupt */
31807 wait_queue_head_t swi_queue;
31808 - atomic_t swi_emitted;
31809 + atomic_unchecked_t swi_emitted;
31810 int vblank_crtc;
31811 uint32_t irq_enable_reg;
31812 uint32_t r500_disp_irq_reg;
31813 diff -urNp linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_fence.c linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_fence.c
31814 --- linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_fence.c 2011-11-08 19:02:43.000000000 -0500
31815 +++ linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_fence.c 2011-11-15 19:59:43.000000000 -0500
31816 @@ -47,7 +47,7 @@ int radeon_fence_emit(struct radeon_devi
31817 write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
31818 return 0;
31819 }
31820 - fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
31821 + fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
31822 if (!rdev->cp.ready) {
31823 /* FIXME: cp is not running assume everythings is done right
31824 * away
31825 @@ -364,7 +364,7 @@ int radeon_fence_driver_init(struct rade
31826 return r;
31827 }
31828 WREG32(rdev->fence_drv.scratch_reg, 0);
31829 - atomic_set(&rdev->fence_drv.seq, 0);
31830 + atomic_set_unchecked(&rdev->fence_drv.seq, 0);
31831 INIT_LIST_HEAD(&rdev->fence_drv.created);
31832 INIT_LIST_HEAD(&rdev->fence_drv.emited);
31833 INIT_LIST_HEAD(&rdev->fence_drv.signaled);
31834 diff -urNp linux-2.6.32.49/drivers/gpu/drm/radeon/radeon.h linux-2.6.32.49/drivers/gpu/drm/radeon/radeon.h
31835 --- linux-2.6.32.49/drivers/gpu/drm/radeon/radeon.h 2011-11-08 19:02:43.000000000 -0500
31836 +++ linux-2.6.32.49/drivers/gpu/drm/radeon/radeon.h 2011-11-15 19:59:43.000000000 -0500
31837 @@ -149,7 +149,7 @@ int radeon_pm_init(struct radeon_device
31838 */
31839 struct radeon_fence_driver {
31840 uint32_t scratch_reg;
31841 - atomic_t seq;
31842 + atomic_unchecked_t seq;
31843 uint32_t last_seq;
31844 unsigned long count_timeout;
31845 wait_queue_head_t queue;
31846 @@ -640,7 +640,7 @@ struct radeon_asic {
31847 uint32_t offset, uint32_t obj_size);
31848 int (*clear_surface_reg)(struct radeon_device *rdev, int reg);
31849 void (*bandwidth_update)(struct radeon_device *rdev);
31850 -};
31851 +} __no_const;
31852
31853 /*
31854 * Asic structures
31855 diff -urNp linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_ioc32.c linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_ioc32.c
31856 --- linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-11-08 19:02:43.000000000 -0500
31857 +++ linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-11-15 19:59:43.000000000 -0500
31858 @@ -368,7 +368,7 @@ static int compat_radeon_cp_setparam(str
31859 request = compat_alloc_user_space(sizeof(*request));
31860 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
31861 || __put_user(req32.param, &request->param)
31862 - || __put_user((void __user *)(unsigned long)req32.value,
31863 + || __put_user((unsigned long)req32.value,
31864 &request->value))
31865 return -EFAULT;
31866
31867 diff -urNp linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_irq.c linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_irq.c
31868 --- linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_irq.c 2011-11-08 19:02:43.000000000 -0500
31869 +++ linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_irq.c 2011-11-15 19:59:43.000000000 -0500
31870 @@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_de
31871 unsigned int ret;
31872 RING_LOCALS;
31873
31874 - atomic_inc(&dev_priv->swi_emitted);
31875 - ret = atomic_read(&dev_priv->swi_emitted);
31876 + atomic_inc_unchecked(&dev_priv->swi_emitted);
31877 + ret = atomic_read_unchecked(&dev_priv->swi_emitted);
31878
31879 BEGIN_RING(4);
31880 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
31881 @@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct
31882 drm_radeon_private_t *dev_priv =
31883 (drm_radeon_private_t *) dev->dev_private;
31884
31885 - atomic_set(&dev_priv->swi_emitted, 0);
31886 + atomic_set_unchecked(&dev_priv->swi_emitted, 0);
31887 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
31888
31889 dev->max_vblank_count = 0x001fffff;
31890 diff -urNp linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_state.c
31891 --- linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_state.c 2011-11-08 19:02:43.000000000 -0500
31892 +++ linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_state.c 2011-11-15 19:59:43.000000000 -0500
31893 @@ -3021,7 +3021,7 @@ static int radeon_cp_getparam(struct drm
31894 {
31895 drm_radeon_private_t *dev_priv = dev->dev_private;
31896 drm_radeon_getparam_t *param = data;
31897 - int value;
31898 + int value = 0;
31899
31900 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
31901
31902 diff -urNp linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_ttm.c
31903 --- linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_ttm.c 2011-11-08 19:02:43.000000000 -0500
31904 +++ linux-2.6.32.49/drivers/gpu/drm/radeon/radeon_ttm.c 2011-11-15 19:59:43.000000000 -0500
31905 @@ -535,27 +535,10 @@ void radeon_ttm_fini(struct radeon_devic
31906 DRM_INFO("radeon: ttm finalized\n");
31907 }
31908
31909 -static struct vm_operations_struct radeon_ttm_vm_ops;
31910 -static const struct vm_operations_struct *ttm_vm_ops = NULL;
31911 -
31912 -static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
31913 -{
31914 - struct ttm_buffer_object *bo;
31915 - int r;
31916 -
31917 - bo = (struct ttm_buffer_object *)vma->vm_private_data;
31918 - if (bo == NULL) {
31919 - return VM_FAULT_NOPAGE;
31920 - }
31921 - r = ttm_vm_ops->fault(vma, vmf);
31922 - return r;
31923 -}
31924 -
31925 int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
31926 {
31927 struct drm_file *file_priv;
31928 struct radeon_device *rdev;
31929 - int r;
31930
31931 if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
31932 return drm_mmap(filp, vma);
31933 @@ -563,20 +546,9 @@ int radeon_mmap(struct file *filp, struc
31934
31935 file_priv = (struct drm_file *)filp->private_data;
31936 rdev = file_priv->minor->dev->dev_private;
31937 - if (rdev == NULL) {
31938 + if (!rdev)
31939 return -EINVAL;
31940 - }
31941 - r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
31942 - if (unlikely(r != 0)) {
31943 - return r;
31944 - }
31945 - if (unlikely(ttm_vm_ops == NULL)) {
31946 - ttm_vm_ops = vma->vm_ops;
31947 - radeon_ttm_vm_ops = *ttm_vm_ops;
31948 - radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
31949 - }
31950 - vma->vm_ops = &radeon_ttm_vm_ops;
31951 - return 0;
31952 + return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
31953 }
31954
31955
31956 diff -urNp linux-2.6.32.49/drivers/gpu/drm/radeon/rs690.c linux-2.6.32.49/drivers/gpu/drm/radeon/rs690.c
31957 --- linux-2.6.32.49/drivers/gpu/drm/radeon/rs690.c 2011-11-08 19:02:43.000000000 -0500
31958 +++ linux-2.6.32.49/drivers/gpu/drm/radeon/rs690.c 2011-11-15 19:59:43.000000000 -0500
31959 @@ -302,9 +302,11 @@ void rs690_crtc_bandwidth_compute(struct
31960 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
31961 rdev->pm.sideport_bandwidth.full)
31962 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
31963 - read_delay_latency.full = rfixed_const(370 * 800 * 1000);
31964 + read_delay_latency.full = rfixed_const(800 * 1000);
31965 read_delay_latency.full = rfixed_div(read_delay_latency,
31966 rdev->pm.igp_sideport_mclk);
31967 + a.full = rfixed_const(370);
31968 + read_delay_latency.full = rfixed_mul(read_delay_latency, a);
31969 } else {
31970 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
31971 rdev->pm.k8_bandwidth.full)
31972 diff -urNp linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_bo.c
31973 --- linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_bo.c 2011-11-08 19:02:43.000000000 -0500
31974 +++ linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_bo.c 2011-11-15 19:59:43.000000000 -0500
31975 @@ -67,7 +67,7 @@ static struct attribute *ttm_bo_global_a
31976 NULL
31977 };
31978
31979 -static struct sysfs_ops ttm_bo_global_ops = {
31980 +static const struct sysfs_ops ttm_bo_global_ops = {
31981 .show = &ttm_bo_global_show
31982 };
31983
31984 diff -urNp linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_bo_vm.c
31985 --- linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-11-08 19:02:43.000000000 -0500
31986 +++ linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-11-15 19:59:43.000000000 -0500
31987 @@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_are
31988 {
31989 struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
31990 vma->vm_private_data;
31991 - struct ttm_bo_device *bdev = bo->bdev;
31992 + struct ttm_bo_device *bdev;
31993 unsigned long bus_base;
31994 unsigned long bus_offset;
31995 unsigned long bus_size;
31996 @@ -88,6 +88,10 @@ static int ttm_bo_vm_fault(struct vm_are
31997 unsigned long address = (unsigned long)vmf->virtual_address;
31998 int retval = VM_FAULT_NOPAGE;
31999
32000 + if (!bo)
32001 + return VM_FAULT_NOPAGE;
32002 + bdev = bo->bdev;
32003 +
32004 /*
32005 * Work around locking order reversal in fault / nopfn
32006 * between mmap_sem and bo_reserve: Perform a trylock operation
32007 diff -urNp linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_global.c
32008 --- linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_global.c 2011-11-08 19:02:43.000000000 -0500
32009 +++ linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_global.c 2011-11-15 19:59:43.000000000 -0500
32010 @@ -36,7 +36,7 @@
32011 struct ttm_global_item {
32012 struct mutex mutex;
32013 void *object;
32014 - int refcount;
32015 + atomic_t refcount;
32016 };
32017
32018 static struct ttm_global_item glob[TTM_GLOBAL_NUM];
32019 @@ -49,7 +49,7 @@ void ttm_global_init(void)
32020 struct ttm_global_item *item = &glob[i];
32021 mutex_init(&item->mutex);
32022 item->object = NULL;
32023 - item->refcount = 0;
32024 + atomic_set(&item->refcount, 0);
32025 }
32026 }
32027
32028 @@ -59,7 +59,7 @@ void ttm_global_release(void)
32029 for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
32030 struct ttm_global_item *item = &glob[i];
32031 BUG_ON(item->object != NULL);
32032 - BUG_ON(item->refcount != 0);
32033 + BUG_ON(atomic_read(&item->refcount) != 0);
32034 }
32035 }
32036
32037 @@ -70,7 +70,7 @@ int ttm_global_item_ref(struct ttm_globa
32038 void *object;
32039
32040 mutex_lock(&item->mutex);
32041 - if (item->refcount == 0) {
32042 + if (atomic_read(&item->refcount) == 0) {
32043 item->object = kzalloc(ref->size, GFP_KERNEL);
32044 if (unlikely(item->object == NULL)) {
32045 ret = -ENOMEM;
32046 @@ -83,7 +83,7 @@ int ttm_global_item_ref(struct ttm_globa
32047 goto out_err;
32048
32049 }
32050 - ++item->refcount;
32051 + atomic_inc(&item->refcount);
32052 ref->object = item->object;
32053 object = item->object;
32054 mutex_unlock(&item->mutex);
32055 @@ -100,9 +100,9 @@ void ttm_global_item_unref(struct ttm_gl
32056 struct ttm_global_item *item = &glob[ref->global_type];
32057
32058 mutex_lock(&item->mutex);
32059 - BUG_ON(item->refcount == 0);
32060 + BUG_ON(atomic_read(&item->refcount) == 0);
32061 BUG_ON(ref->object != item->object);
32062 - if (--item->refcount == 0) {
32063 + if (atomic_dec_and_test(&item->refcount)) {
32064 ref->release(ref);
32065 item->object = NULL;
32066 }
32067 diff -urNp linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_memory.c
32068 --- linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_memory.c 2011-11-08 19:02:43.000000000 -0500
32069 +++ linux-2.6.32.49/drivers/gpu/drm/ttm/ttm_memory.c 2011-11-15 19:59:43.000000000 -0500
32070 @@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_at
32071 NULL
32072 };
32073
32074 -static struct sysfs_ops ttm_mem_zone_ops = {
32075 +static const struct sysfs_ops ttm_mem_zone_ops = {
32076 .show = &ttm_mem_zone_show,
32077 .store = &ttm_mem_zone_store
32078 };
32079 diff -urNp linux-2.6.32.49/drivers/gpu/drm/via/via_drv.h linux-2.6.32.49/drivers/gpu/drm/via/via_drv.h
32080 --- linux-2.6.32.49/drivers/gpu/drm/via/via_drv.h 2011-11-08 19:02:43.000000000 -0500
32081 +++ linux-2.6.32.49/drivers/gpu/drm/via/via_drv.h 2011-11-15 19:59:43.000000000 -0500
32082 @@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
32083 typedef uint32_t maskarray_t[5];
32084
32085 typedef struct drm_via_irq {
32086 - atomic_t irq_received;
32087 + atomic_unchecked_t irq_received;
32088 uint32_t pending_mask;
32089 uint32_t enable_mask;
32090 wait_queue_head_t irq_queue;
32091 @@ -75,7 +75,7 @@ typedef struct drm_via_private {
32092 struct timeval last_vblank;
32093 int last_vblank_valid;
32094 unsigned usec_per_vblank;
32095 - atomic_t vbl_received;
32096 + atomic_unchecked_t vbl_received;
32097 drm_via_state_t hc_state;
32098 char pci_buf[VIA_PCI_BUF_SIZE];
32099 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
32100 diff -urNp linux-2.6.32.49/drivers/gpu/drm/via/via_irq.c linux-2.6.32.49/drivers/gpu/drm/via/via_irq.c
32101 --- linux-2.6.32.49/drivers/gpu/drm/via/via_irq.c 2011-11-08 19:02:43.000000000 -0500
32102 +++ linux-2.6.32.49/drivers/gpu/drm/via/via_irq.c 2011-11-15 19:59:43.000000000 -0500
32103 @@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_de
32104 if (crtc != 0)
32105 return 0;
32106
32107 - return atomic_read(&dev_priv->vbl_received);
32108 + return atomic_read_unchecked(&dev_priv->vbl_received);
32109 }
32110
32111 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
32112 @@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_I
32113
32114 status = VIA_READ(VIA_REG_INTERRUPT);
32115 if (status & VIA_IRQ_VBLANK_PENDING) {
32116 - atomic_inc(&dev_priv->vbl_received);
32117 - if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
32118 + atomic_inc_unchecked(&dev_priv->vbl_received);
32119 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
32120 do_gettimeofday(&cur_vblank);
32121 if (dev_priv->last_vblank_valid) {
32122 dev_priv->usec_per_vblank =
32123 @@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
32124 dev_priv->last_vblank = cur_vblank;
32125 dev_priv->last_vblank_valid = 1;
32126 }
32127 - if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
32128 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
32129 DRM_DEBUG("US per vblank is: %u\n",
32130 dev_priv->usec_per_vblank);
32131 }
32132 @@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
32133
32134 for (i = 0; i < dev_priv->num_irqs; ++i) {
32135 if (status & cur_irq->pending_mask) {
32136 - atomic_inc(&cur_irq->irq_received);
32137 + atomic_inc_unchecked(&cur_irq->irq_received);
32138 DRM_WAKEUP(&cur_irq->irq_queue);
32139 handled = 1;
32140 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i) {
32141 @@ -244,11 +244,11 @@ via_driver_irq_wait(struct drm_device *
32142 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
32143 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
32144 masks[irq][4]));
32145 - cur_irq_sequence = atomic_read(&cur_irq->irq_received);
32146 + cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
32147 } else {
32148 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
32149 (((cur_irq_sequence =
32150 - atomic_read(&cur_irq->irq_received)) -
32151 + atomic_read_unchecked(&cur_irq->irq_received)) -
32152 *sequence) <= (1 << 23)));
32153 }
32154 *sequence = cur_irq_sequence;
32155 @@ -286,7 +286,7 @@ void via_driver_irq_preinstall(struct dr
32156 }
32157
32158 for (i = 0; i < dev_priv->num_irqs; ++i) {
32159 - atomic_set(&cur_irq->irq_received, 0);
32160 + atomic_set_unchecked(&cur_irq->irq_received, 0);
32161 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
32162 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
32163 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
32164 @@ -368,7 +368,7 @@ int via_wait_irq(struct drm_device *dev,
32165 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
32166 case VIA_IRQ_RELATIVE:
32167 irqwait->request.sequence +=
32168 - atomic_read(&cur_irq->irq_received);
32169 + atomic_read_unchecked(&cur_irq->irq_received);
32170 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
32171 case VIA_IRQ_ABSOLUTE:
32172 break;
32173 diff -urNp linux-2.6.32.49/drivers/hid/hid-core.c linux-2.6.32.49/drivers/hid/hid-core.c
32174 --- linux-2.6.32.49/drivers/hid/hid-core.c 2011-11-08 19:02:43.000000000 -0500
32175 +++ linux-2.6.32.49/drivers/hid/hid-core.c 2011-11-15 19:59:43.000000000 -0500
32176 @@ -1752,7 +1752,7 @@ static bool hid_ignore(struct hid_device
32177
32178 int hid_add_device(struct hid_device *hdev)
32179 {
32180 - static atomic_t id = ATOMIC_INIT(0);
32181 + static atomic_unchecked_t id = ATOMIC_INIT(0);
32182 int ret;
32183
32184 if (WARN_ON(hdev->status & HID_STAT_ADDED))
32185 @@ -1766,7 +1766,7 @@ int hid_add_device(struct hid_device *hd
32186 /* XXX hack, any other cleaner solution after the driver core
32187 * is converted to allow more than 20 bytes as the device name? */
32188 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
32189 - hdev->vendor, hdev->product, atomic_inc_return(&id));
32190 + hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
32191
32192 ret = device_add(&hdev->dev);
32193 if (!ret)
32194 diff -urNp linux-2.6.32.49/drivers/hid/usbhid/hiddev.c linux-2.6.32.49/drivers/hid/usbhid/hiddev.c
32195 --- linux-2.6.32.49/drivers/hid/usbhid/hiddev.c 2011-11-08 19:02:43.000000000 -0500
32196 +++ linux-2.6.32.49/drivers/hid/usbhid/hiddev.c 2011-11-15 19:59:43.000000000 -0500
32197 @@ -617,7 +617,7 @@ static long hiddev_ioctl(struct file *fi
32198 return put_user(HID_VERSION, (int __user *)arg);
32199
32200 case HIDIOCAPPLICATION:
32201 - if (arg < 0 || arg >= hid->maxapplication)
32202 + if (arg >= hid->maxapplication)
32203 return -EINVAL;
32204
32205 for (i = 0; i < hid->maxcollection; i++)
32206 diff -urNp linux-2.6.32.49/drivers/hwmon/lis3lv02d.c linux-2.6.32.49/drivers/hwmon/lis3lv02d.c
32207 --- linux-2.6.32.49/drivers/hwmon/lis3lv02d.c 2011-11-08 19:02:43.000000000 -0500
32208 +++ linux-2.6.32.49/drivers/hwmon/lis3lv02d.c 2011-11-15 19:59:43.000000000 -0500
32209 @@ -146,7 +146,7 @@ static irqreturn_t lis302dl_interrupt(in
32210 * the lid is closed. This leads to interrupts as soon as a little move
32211 * is done.
32212 */
32213 - atomic_inc(&lis3_dev.count);
32214 + atomic_inc_unchecked(&lis3_dev.count);
32215
32216 wake_up_interruptible(&lis3_dev.misc_wait);
32217 kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
32218 @@ -160,7 +160,7 @@ static int lis3lv02d_misc_open(struct in
32219 if (test_and_set_bit(0, &lis3_dev.misc_opened))
32220 return -EBUSY; /* already open */
32221
32222 - atomic_set(&lis3_dev.count, 0);
32223 + atomic_set_unchecked(&lis3_dev.count, 0);
32224
32225 /*
32226 * The sensor can generate interrupts for free-fall and direction
32227 @@ -206,7 +206,7 @@ static ssize_t lis3lv02d_misc_read(struc
32228 add_wait_queue(&lis3_dev.misc_wait, &wait);
32229 while (true) {
32230 set_current_state(TASK_INTERRUPTIBLE);
32231 - data = atomic_xchg(&lis3_dev.count, 0);
32232 + data = atomic_xchg_unchecked(&lis3_dev.count, 0);
32233 if (data)
32234 break;
32235
32236 @@ -244,7 +244,7 @@ out:
32237 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
32238 {
32239 poll_wait(file, &lis3_dev.misc_wait, wait);
32240 - if (atomic_read(&lis3_dev.count))
32241 + if (atomic_read_unchecked(&lis3_dev.count))
32242 return POLLIN | POLLRDNORM;
32243 return 0;
32244 }
32245 diff -urNp linux-2.6.32.49/drivers/hwmon/lis3lv02d.h linux-2.6.32.49/drivers/hwmon/lis3lv02d.h
32246 --- linux-2.6.32.49/drivers/hwmon/lis3lv02d.h 2011-11-08 19:02:43.000000000 -0500
32247 +++ linux-2.6.32.49/drivers/hwmon/lis3lv02d.h 2011-11-15 19:59:43.000000000 -0500
32248 @@ -201,7 +201,7 @@ struct lis3lv02d {
32249
32250 struct input_polled_dev *idev; /* input device */
32251 struct platform_device *pdev; /* platform device */
32252 - atomic_t count; /* interrupt count after last read */
32253 + atomic_unchecked_t count; /* interrupt count after last read */
32254 int xcalib; /* calibrated null value for x */
32255 int ycalib; /* calibrated null value for y */
32256 int zcalib; /* calibrated null value for z */
32257 diff -urNp linux-2.6.32.49/drivers/hwmon/sht15.c linux-2.6.32.49/drivers/hwmon/sht15.c
32258 --- linux-2.6.32.49/drivers/hwmon/sht15.c 2011-11-08 19:02:43.000000000 -0500
32259 +++ linux-2.6.32.49/drivers/hwmon/sht15.c 2011-11-15 19:59:43.000000000 -0500
32260 @@ -112,7 +112,7 @@ struct sht15_data {
32261 int supply_uV;
32262 int supply_uV_valid;
32263 struct work_struct update_supply_work;
32264 - atomic_t interrupt_handled;
32265 + atomic_unchecked_t interrupt_handled;
32266 };
32267
32268 /**
32269 @@ -245,13 +245,13 @@ static inline int sht15_update_single_va
32270 return ret;
32271
32272 gpio_direction_input(data->pdata->gpio_data);
32273 - atomic_set(&data->interrupt_handled, 0);
32274 + atomic_set_unchecked(&data->interrupt_handled, 0);
32275
32276 enable_irq(gpio_to_irq(data->pdata->gpio_data));
32277 if (gpio_get_value(data->pdata->gpio_data) == 0) {
32278 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
32279 /* Only relevant if the interrupt hasn't occured. */
32280 - if (!atomic_read(&data->interrupt_handled))
32281 + if (!atomic_read_unchecked(&data->interrupt_handled))
32282 schedule_work(&data->read_work);
32283 }
32284 ret = wait_event_timeout(data->wait_queue,
32285 @@ -398,7 +398,7 @@ static irqreturn_t sht15_interrupt_fired
32286 struct sht15_data *data = d;
32287 /* First disable the interrupt */
32288 disable_irq_nosync(irq);
32289 - atomic_inc(&data->interrupt_handled);
32290 + atomic_inc_unchecked(&data->interrupt_handled);
32291 /* Then schedule a reading work struct */
32292 if (data->flag != SHT15_READING_NOTHING)
32293 schedule_work(&data->read_work);
32294 @@ -449,11 +449,11 @@ static void sht15_bh_read_data(struct wo
32295 here as could have gone low in meantime so verify
32296 it hasn't!
32297 */
32298 - atomic_set(&data->interrupt_handled, 0);
32299 + atomic_set_unchecked(&data->interrupt_handled, 0);
32300 enable_irq(gpio_to_irq(data->pdata->gpio_data));
32301 /* If still not occured or another handler has been scheduled */
32302 if (gpio_get_value(data->pdata->gpio_data)
32303 - || atomic_read(&data->interrupt_handled))
32304 + || atomic_read_unchecked(&data->interrupt_handled))
32305 return;
32306 }
32307 /* Read the data back from the device */
32308 diff -urNp linux-2.6.32.49/drivers/hwmon/w83791d.c linux-2.6.32.49/drivers/hwmon/w83791d.c
32309 --- linux-2.6.32.49/drivers/hwmon/w83791d.c 2011-11-08 19:02:43.000000000 -0500
32310 +++ linux-2.6.32.49/drivers/hwmon/w83791d.c 2011-11-15 19:59:43.000000000 -0500
32311 @@ -330,8 +330,8 @@ static int w83791d_detect(struct i2c_cli
32312 struct i2c_board_info *info);
32313 static int w83791d_remove(struct i2c_client *client);
32314
32315 -static int w83791d_read(struct i2c_client *client, u8 register);
32316 -static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
32317 +static int w83791d_read(struct i2c_client *client, u8 reg);
32318 +static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
32319 static struct w83791d_data *w83791d_update_device(struct device *dev);
32320
32321 #ifdef DEBUG
32322 diff -urNp linux-2.6.32.49/drivers/i2c/busses/i2c-amd756-s4882.c linux-2.6.32.49/drivers/i2c/busses/i2c-amd756-s4882.c
32323 --- linux-2.6.32.49/drivers/i2c/busses/i2c-amd756-s4882.c 2011-11-08 19:02:43.000000000 -0500
32324 +++ linux-2.6.32.49/drivers/i2c/busses/i2c-amd756-s4882.c 2011-11-15 19:59:43.000000000 -0500
32325 @@ -43,7 +43,7 @@
32326 extern struct i2c_adapter amd756_smbus;
32327
32328 static struct i2c_adapter *s4882_adapter;
32329 -static struct i2c_algorithm *s4882_algo;
32330 +static i2c_algorithm_no_const *s4882_algo;
32331
32332 /* Wrapper access functions for multiplexed SMBus */
32333 static DEFINE_MUTEX(amd756_lock);
32334 diff -urNp linux-2.6.32.49/drivers/i2c/busses/i2c-nforce2-s4985.c linux-2.6.32.49/drivers/i2c/busses/i2c-nforce2-s4985.c
32335 --- linux-2.6.32.49/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-11-08 19:02:43.000000000 -0500
32336 +++ linux-2.6.32.49/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-11-15 19:59:43.000000000 -0500
32337 @@ -41,7 +41,7 @@
32338 extern struct i2c_adapter *nforce2_smbus;
32339
32340 static struct i2c_adapter *s4985_adapter;
32341 -static struct i2c_algorithm *s4985_algo;
32342 +static i2c_algorithm_no_const *s4985_algo;
32343
32344 /* Wrapper access functions for multiplexed SMBus */
32345 static DEFINE_MUTEX(nforce2_lock);
32346 diff -urNp linux-2.6.32.49/drivers/ide/aec62xx.c linux-2.6.32.49/drivers/ide/aec62xx.c
32347 --- linux-2.6.32.49/drivers/ide/aec62xx.c 2011-11-08 19:02:43.000000000 -0500
32348 +++ linux-2.6.32.49/drivers/ide/aec62xx.c 2011-11-18 18:01:55.000000000 -0500
32349 @@ -180,7 +180,7 @@ static const struct ide_port_ops atp86x_
32350 .cable_detect = atp86x_cable_detect,
32351 };
32352
32353 -static const struct ide_port_info aec62xx_chipsets[] __devinitdata = {
32354 +static const struct ide_port_info aec62xx_chipsets[] __devinitconst = {
32355 { /* 0: AEC6210 */
32356 .name = DRV_NAME,
32357 .init_chipset = init_chipset_aec62xx,
32358 diff -urNp linux-2.6.32.49/drivers/ide/alim15x3.c linux-2.6.32.49/drivers/ide/alim15x3.c
32359 --- linux-2.6.32.49/drivers/ide/alim15x3.c 2011-11-08 19:02:43.000000000 -0500
32360 +++ linux-2.6.32.49/drivers/ide/alim15x3.c 2011-11-18 18:01:55.000000000 -0500
32361 @@ -509,7 +509,7 @@ static const struct ide_dma_ops ali_dma_
32362 .dma_sff_read_status = ide_dma_sff_read_status,
32363 };
32364
32365 -static const struct ide_port_info ali15x3_chipset __devinitdata = {
32366 +static const struct ide_port_info ali15x3_chipset __devinitconst = {
32367 .name = DRV_NAME,
32368 .init_chipset = init_chipset_ali15x3,
32369 .init_hwif = init_hwif_ali15x3,
32370 diff -urNp linux-2.6.32.49/drivers/ide/amd74xx.c linux-2.6.32.49/drivers/ide/amd74xx.c
32371 --- linux-2.6.32.49/drivers/ide/amd74xx.c 2011-11-08 19:02:43.000000000 -0500
32372 +++ linux-2.6.32.49/drivers/ide/amd74xx.c 2011-11-18 18:01:55.000000000 -0500
32373 @@ -221,7 +221,7 @@ static const struct ide_port_ops amd_por
32374 .udma_mask = udma, \
32375 }
32376
32377 -static const struct ide_port_info amd74xx_chipsets[] __devinitdata = {
32378 +static const struct ide_port_info amd74xx_chipsets[] __devinitconst = {
32379 /* 0: AMD7401 */ DECLARE_AMD_DEV(0x00, ATA_UDMA2),
32380 /* 1: AMD7409 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA4),
32381 /* 2: AMD7411/7441 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA5),
32382 diff -urNp linux-2.6.32.49/drivers/ide/atiixp.c linux-2.6.32.49/drivers/ide/atiixp.c
32383 --- linux-2.6.32.49/drivers/ide/atiixp.c 2011-11-08 19:02:43.000000000 -0500
32384 +++ linux-2.6.32.49/drivers/ide/atiixp.c 2011-11-18 18:01:55.000000000 -0500
32385 @@ -137,7 +137,7 @@ static const struct ide_port_ops atiixp_
32386 .cable_detect = atiixp_cable_detect,
32387 };
32388
32389 -static const struct ide_port_info atiixp_pci_info[] __devinitdata = {
32390 +static const struct ide_port_info atiixp_pci_info[] __devinitconst = {
32391 { /* 0: IXP200/300/400/700 */
32392 .name = DRV_NAME,
32393 .enablebits = {{0x48,0x01,0x00}, {0x48,0x08,0x00}},
32394 diff -urNp linux-2.6.32.49/drivers/ide/cmd64x.c linux-2.6.32.49/drivers/ide/cmd64x.c
32395 --- linux-2.6.32.49/drivers/ide/cmd64x.c 2011-11-08 19:02:43.000000000 -0500
32396 +++ linux-2.6.32.49/drivers/ide/cmd64x.c 2011-11-18 18:01:55.000000000 -0500
32397 @@ -372,7 +372,7 @@ static const struct ide_dma_ops cmd646_r
32398 .dma_sff_read_status = ide_dma_sff_read_status,
32399 };
32400
32401 -static const struct ide_port_info cmd64x_chipsets[] __devinitdata = {
32402 +static const struct ide_port_info cmd64x_chipsets[] __devinitconst = {
32403 { /* 0: CMD643 */
32404 .name = DRV_NAME,
32405 .init_chipset = init_chipset_cmd64x,
32406 diff -urNp linux-2.6.32.49/drivers/ide/cs5520.c linux-2.6.32.49/drivers/ide/cs5520.c
32407 --- linux-2.6.32.49/drivers/ide/cs5520.c 2011-11-08 19:02:43.000000000 -0500
32408 +++ linux-2.6.32.49/drivers/ide/cs5520.c 2011-11-18 18:01:55.000000000 -0500
32409 @@ -93,7 +93,7 @@ static const struct ide_port_ops cs5520_
32410 .set_dma_mode = cs5520_set_dma_mode,
32411 };
32412
32413 -static const struct ide_port_info cyrix_chipset __devinitdata = {
32414 +static const struct ide_port_info cyrix_chipset __devinitconst = {
32415 .name = DRV_NAME,
32416 .enablebits = { { 0x60, 0x01, 0x01 }, { 0x60, 0x02, 0x02 } },
32417 .port_ops = &cs5520_port_ops,
32418 diff -urNp linux-2.6.32.49/drivers/ide/cs5530.c linux-2.6.32.49/drivers/ide/cs5530.c
32419 --- linux-2.6.32.49/drivers/ide/cs5530.c 2011-11-08 19:02:43.000000000 -0500
32420 +++ linux-2.6.32.49/drivers/ide/cs5530.c 2011-11-18 18:01:55.000000000 -0500
32421 @@ -244,7 +244,7 @@ static const struct ide_port_ops cs5530_
32422 .udma_filter = cs5530_udma_filter,
32423 };
32424
32425 -static const struct ide_port_info cs5530_chipset __devinitdata = {
32426 +static const struct ide_port_info cs5530_chipset __devinitconst = {
32427 .name = DRV_NAME,
32428 .init_chipset = init_chipset_cs5530,
32429 .init_hwif = init_hwif_cs5530,
32430 diff -urNp linux-2.6.32.49/drivers/ide/cs5535.c linux-2.6.32.49/drivers/ide/cs5535.c
32431 --- linux-2.6.32.49/drivers/ide/cs5535.c 2011-11-08 19:02:43.000000000 -0500
32432 +++ linux-2.6.32.49/drivers/ide/cs5535.c 2011-11-18 18:01:55.000000000 -0500
32433 @@ -170,7 +170,7 @@ static const struct ide_port_ops cs5535_
32434 .cable_detect = cs5535_cable_detect,
32435 };
32436
32437 -static const struct ide_port_info cs5535_chipset __devinitdata = {
32438 +static const struct ide_port_info cs5535_chipset __devinitconst = {
32439 .name = DRV_NAME,
32440 .port_ops = &cs5535_port_ops,
32441 .host_flags = IDE_HFLAG_SINGLE | IDE_HFLAG_POST_SET_MODE,
32442 diff -urNp linux-2.6.32.49/drivers/ide/cy82c693.c linux-2.6.32.49/drivers/ide/cy82c693.c
32443 --- linux-2.6.32.49/drivers/ide/cy82c693.c 2011-11-08 19:02:43.000000000 -0500
32444 +++ linux-2.6.32.49/drivers/ide/cy82c693.c 2011-11-18 18:01:55.000000000 -0500
32445 @@ -288,7 +288,7 @@ static const struct ide_port_ops cy82c69
32446 .set_dma_mode = cy82c693_set_dma_mode,
32447 };
32448
32449 -static const struct ide_port_info cy82c693_chipset __devinitdata = {
32450 +static const struct ide_port_info cy82c693_chipset __devinitconst = {
32451 .name = DRV_NAME,
32452 .init_iops = init_iops_cy82c693,
32453 .port_ops = &cy82c693_port_ops,
32454 diff -urNp linux-2.6.32.49/drivers/ide/hpt366.c linux-2.6.32.49/drivers/ide/hpt366.c
32455 --- linux-2.6.32.49/drivers/ide/hpt366.c 2011-11-08 19:02:43.000000000 -0500
32456 +++ linux-2.6.32.49/drivers/ide/hpt366.c 2011-11-18 18:01:55.000000000 -0500
32457 @@ -507,7 +507,7 @@ static struct hpt_timings hpt37x_timings
32458 }
32459 };
32460
32461 -static const struct hpt_info hpt36x __devinitdata = {
32462 +static const struct hpt_info hpt36x __devinitconst = {
32463 .chip_name = "HPT36x",
32464 .chip_type = HPT36x,
32465 .udma_mask = HPT366_ALLOW_ATA66_3 ? (HPT366_ALLOW_ATA66_4 ? ATA_UDMA4 : ATA_UDMA3) : ATA_UDMA2,
32466 @@ -515,7 +515,7 @@ static const struct hpt_info hpt36x __de
32467 .timings = &hpt36x_timings
32468 };
32469
32470 -static const struct hpt_info hpt370 __devinitdata = {
32471 +static const struct hpt_info hpt370 __devinitconst = {
32472 .chip_name = "HPT370",
32473 .chip_type = HPT370,
32474 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
32475 @@ -523,7 +523,7 @@ static const struct hpt_info hpt370 __de
32476 .timings = &hpt37x_timings
32477 };
32478
32479 -static const struct hpt_info hpt370a __devinitdata = {
32480 +static const struct hpt_info hpt370a __devinitconst = {
32481 .chip_name = "HPT370A",
32482 .chip_type = HPT370A,
32483 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
32484 @@ -531,7 +531,7 @@ static const struct hpt_info hpt370a __d
32485 .timings = &hpt37x_timings
32486 };
32487
32488 -static const struct hpt_info hpt374 __devinitdata = {
32489 +static const struct hpt_info hpt374 __devinitconst = {
32490 .chip_name = "HPT374",
32491 .chip_type = HPT374,
32492 .udma_mask = ATA_UDMA5,
32493 @@ -539,7 +539,7 @@ static const struct hpt_info hpt374 __de
32494 .timings = &hpt37x_timings
32495 };
32496
32497 -static const struct hpt_info hpt372 __devinitdata = {
32498 +static const struct hpt_info hpt372 __devinitconst = {
32499 .chip_name = "HPT372",
32500 .chip_type = HPT372,
32501 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
32502 @@ -547,7 +547,7 @@ static const struct hpt_info hpt372 __de
32503 .timings = &hpt37x_timings
32504 };
32505
32506 -static const struct hpt_info hpt372a __devinitdata = {
32507 +static const struct hpt_info hpt372a __devinitconst = {
32508 .chip_name = "HPT372A",
32509 .chip_type = HPT372A,
32510 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
32511 @@ -555,7 +555,7 @@ static const struct hpt_info hpt372a __d
32512 .timings = &hpt37x_timings
32513 };
32514
32515 -static const struct hpt_info hpt302 __devinitdata = {
32516 +static const struct hpt_info hpt302 __devinitconst = {
32517 .chip_name = "HPT302",
32518 .chip_type = HPT302,
32519 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
32520 @@ -563,7 +563,7 @@ static const struct hpt_info hpt302 __de
32521 .timings = &hpt37x_timings
32522 };
32523
32524 -static const struct hpt_info hpt371 __devinitdata = {
32525 +static const struct hpt_info hpt371 __devinitconst = {
32526 .chip_name = "HPT371",
32527 .chip_type = HPT371,
32528 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
32529 @@ -571,7 +571,7 @@ static const struct hpt_info hpt371 __de
32530 .timings = &hpt37x_timings
32531 };
32532
32533 -static const struct hpt_info hpt372n __devinitdata = {
32534 +static const struct hpt_info hpt372n __devinitconst = {
32535 .chip_name = "HPT372N",
32536 .chip_type = HPT372N,
32537 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
32538 @@ -579,7 +579,7 @@ static const struct hpt_info hpt372n __d
32539 .timings = &hpt37x_timings
32540 };
32541
32542 -static const struct hpt_info hpt302n __devinitdata = {
32543 +static const struct hpt_info hpt302n __devinitconst = {
32544 .chip_name = "HPT302N",
32545 .chip_type = HPT302N,
32546 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
32547 @@ -587,7 +587,7 @@ static const struct hpt_info hpt302n __d
32548 .timings = &hpt37x_timings
32549 };
32550
32551 -static const struct hpt_info hpt371n __devinitdata = {
32552 +static const struct hpt_info hpt371n __devinitconst = {
32553 .chip_name = "HPT371N",
32554 .chip_type = HPT371N,
32555 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
32556 @@ -1422,7 +1422,7 @@ static const struct ide_dma_ops hpt36x_d
32557 .dma_sff_read_status = ide_dma_sff_read_status,
32558 };
32559
32560 -static const struct ide_port_info hpt366_chipsets[] __devinitdata = {
32561 +static const struct ide_port_info hpt366_chipsets[] __devinitconst = {
32562 { /* 0: HPT36x */
32563 .name = DRV_NAME,
32564 .init_chipset = init_chipset_hpt366,
32565 diff -urNp linux-2.6.32.49/drivers/ide/ide-cd.c linux-2.6.32.49/drivers/ide/ide-cd.c
32566 --- linux-2.6.32.49/drivers/ide/ide-cd.c 2011-11-08 19:02:43.000000000 -0500
32567 +++ linux-2.6.32.49/drivers/ide/ide-cd.c 2011-11-15 19:59:43.000000000 -0500
32568 @@ -774,7 +774,7 @@ static void cdrom_do_block_pc(ide_drive_
32569 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
32570 if ((unsigned long)buf & alignment
32571 || blk_rq_bytes(rq) & q->dma_pad_mask
32572 - || object_is_on_stack(buf))
32573 + || object_starts_on_stack(buf))
32574 drive->dma = 0;
32575 }
32576 }
32577 diff -urNp linux-2.6.32.49/drivers/ide/ide-floppy.c linux-2.6.32.49/drivers/ide/ide-floppy.c
32578 --- linux-2.6.32.49/drivers/ide/ide-floppy.c 2011-11-08 19:02:43.000000000 -0500
32579 +++ linux-2.6.32.49/drivers/ide/ide-floppy.c 2011-11-15 19:59:43.000000000 -0500
32580 @@ -373,6 +373,8 @@ static int ide_floppy_get_capacity(ide_d
32581 u8 pc_buf[256], header_len, desc_cnt;
32582 int i, rc = 1, blocks, length;
32583
32584 + pax_track_stack();
32585 +
32586 ide_debug_log(IDE_DBG_FUNC, "enter");
32587
32588 drive->bios_cyl = 0;
32589 diff -urNp linux-2.6.32.49/drivers/ide/ide-pci-generic.c linux-2.6.32.49/drivers/ide/ide-pci-generic.c
32590 --- linux-2.6.32.49/drivers/ide/ide-pci-generic.c 2011-11-08 19:02:43.000000000 -0500
32591 +++ linux-2.6.32.49/drivers/ide/ide-pci-generic.c 2011-11-18 18:01:55.000000000 -0500
32592 @@ -53,7 +53,7 @@ static const struct ide_port_ops netcell
32593 .udma_mask = ATA_UDMA6, \
32594 }
32595
32596 -static const struct ide_port_info generic_chipsets[] __devinitdata = {
32597 +static const struct ide_port_info generic_chipsets[] __devinitconst = {
32598 /* 0: Unknown */
32599 DECLARE_GENERIC_PCI_DEV(0),
32600
32601 diff -urNp linux-2.6.32.49/drivers/ide/it8172.c linux-2.6.32.49/drivers/ide/it8172.c
32602 --- linux-2.6.32.49/drivers/ide/it8172.c 2011-11-08 19:02:43.000000000 -0500
32603 +++ linux-2.6.32.49/drivers/ide/it8172.c 2011-11-18 18:01:55.000000000 -0500
32604 @@ -115,7 +115,7 @@ static const struct ide_port_ops it8172_
32605 .set_dma_mode = it8172_set_dma_mode,
32606 };
32607
32608 -static const struct ide_port_info it8172_port_info __devinitdata = {
32609 +static const struct ide_port_info it8172_port_info __devinitconst = {
32610 .name = DRV_NAME,
32611 .port_ops = &it8172_port_ops,
32612 .enablebits = { {0x41, 0x80, 0x80}, {0x00, 0x00, 0x00} },
32613 diff -urNp linux-2.6.32.49/drivers/ide/it8213.c linux-2.6.32.49/drivers/ide/it8213.c
32614 --- linux-2.6.32.49/drivers/ide/it8213.c 2011-11-08 19:02:43.000000000 -0500
32615 +++ linux-2.6.32.49/drivers/ide/it8213.c 2011-11-18 18:01:55.000000000 -0500
32616 @@ -156,7 +156,7 @@ static const struct ide_port_ops it8213_
32617 .cable_detect = it8213_cable_detect,
32618 };
32619
32620 -static const struct ide_port_info it8213_chipset __devinitdata = {
32621 +static const struct ide_port_info it8213_chipset __devinitconst = {
32622 .name = DRV_NAME,
32623 .enablebits = { {0x41, 0x80, 0x80} },
32624 .port_ops = &it8213_port_ops,
32625 diff -urNp linux-2.6.32.49/drivers/ide/it821x.c linux-2.6.32.49/drivers/ide/it821x.c
32626 --- linux-2.6.32.49/drivers/ide/it821x.c 2011-11-08 19:02:43.000000000 -0500
32627 +++ linux-2.6.32.49/drivers/ide/it821x.c 2011-11-18 18:01:55.000000000 -0500
32628 @@ -627,7 +627,7 @@ static const struct ide_port_ops it821x_
32629 .cable_detect = it821x_cable_detect,
32630 };
32631
32632 -static const struct ide_port_info it821x_chipset __devinitdata = {
32633 +static const struct ide_port_info it821x_chipset __devinitconst = {
32634 .name = DRV_NAME,
32635 .init_chipset = init_chipset_it821x,
32636 .init_hwif = init_hwif_it821x,
32637 diff -urNp linux-2.6.32.49/drivers/ide/jmicron.c linux-2.6.32.49/drivers/ide/jmicron.c
32638 --- linux-2.6.32.49/drivers/ide/jmicron.c 2011-11-08 19:02:43.000000000 -0500
32639 +++ linux-2.6.32.49/drivers/ide/jmicron.c 2011-11-18 18:01:55.000000000 -0500
32640 @@ -102,7 +102,7 @@ static const struct ide_port_ops jmicron
32641 .cable_detect = jmicron_cable_detect,
32642 };
32643
32644 -static const struct ide_port_info jmicron_chipset __devinitdata = {
32645 +static const struct ide_port_info jmicron_chipset __devinitconst = {
32646 .name = DRV_NAME,
32647 .enablebits = { { 0x40, 0x01, 0x01 }, { 0x40, 0x10, 0x10 } },
32648 .port_ops = &jmicron_port_ops,
32649 diff -urNp linux-2.6.32.49/drivers/ide/ns87415.c linux-2.6.32.49/drivers/ide/ns87415.c
32650 --- linux-2.6.32.49/drivers/ide/ns87415.c 2011-11-08 19:02:43.000000000 -0500
32651 +++ linux-2.6.32.49/drivers/ide/ns87415.c 2011-11-18 18:01:55.000000000 -0500
32652 @@ -293,7 +293,7 @@ static const struct ide_dma_ops ns87415_
32653 .dma_sff_read_status = superio_dma_sff_read_status,
32654 };
32655
32656 -static const struct ide_port_info ns87415_chipset __devinitdata = {
32657 +static const struct ide_port_info ns87415_chipset __devinitconst = {
32658 .name = DRV_NAME,
32659 .init_hwif = init_hwif_ns87415,
32660 .tp_ops = &ns87415_tp_ops,
32661 diff -urNp linux-2.6.32.49/drivers/ide/opti621.c linux-2.6.32.49/drivers/ide/opti621.c
32662 --- linux-2.6.32.49/drivers/ide/opti621.c 2011-11-08 19:02:43.000000000 -0500
32663 +++ linux-2.6.32.49/drivers/ide/opti621.c 2011-11-18 18:01:55.000000000 -0500
32664 @@ -202,7 +202,7 @@ static const struct ide_port_ops opti621
32665 .set_pio_mode = opti621_set_pio_mode,
32666 };
32667
32668 -static const struct ide_port_info opti621_chipset __devinitdata = {
32669 +static const struct ide_port_info opti621_chipset __devinitconst = {
32670 .name = DRV_NAME,
32671 .enablebits = { {0x45, 0x80, 0x00}, {0x40, 0x08, 0x00} },
32672 .port_ops = &opti621_port_ops,
32673 diff -urNp linux-2.6.32.49/drivers/ide/pdc202xx_new.c linux-2.6.32.49/drivers/ide/pdc202xx_new.c
32674 --- linux-2.6.32.49/drivers/ide/pdc202xx_new.c 2011-11-08 19:02:43.000000000 -0500
32675 +++ linux-2.6.32.49/drivers/ide/pdc202xx_new.c 2011-11-18 18:01:55.000000000 -0500
32676 @@ -465,7 +465,7 @@ static const struct ide_port_ops pdcnew_
32677 .udma_mask = udma, \
32678 }
32679
32680 -static const struct ide_port_info pdcnew_chipsets[] __devinitdata = {
32681 +static const struct ide_port_info pdcnew_chipsets[] __devinitconst = {
32682 /* 0: PDC202{68,70} */ DECLARE_PDCNEW_DEV(ATA_UDMA5),
32683 /* 1: PDC202{69,71,75,76,77} */ DECLARE_PDCNEW_DEV(ATA_UDMA6),
32684 };
32685 diff -urNp linux-2.6.32.49/drivers/ide/pdc202xx_old.c linux-2.6.32.49/drivers/ide/pdc202xx_old.c
32686 --- linux-2.6.32.49/drivers/ide/pdc202xx_old.c 2011-11-08 19:02:43.000000000 -0500
32687 +++ linux-2.6.32.49/drivers/ide/pdc202xx_old.c 2011-11-18 18:01:55.000000000 -0500
32688 @@ -285,7 +285,7 @@ static const struct ide_dma_ops pdc2026x
32689 .max_sectors = sectors, \
32690 }
32691
32692 -static const struct ide_port_info pdc202xx_chipsets[] __devinitdata = {
32693 +static const struct ide_port_info pdc202xx_chipsets[] __devinitconst = {
32694 { /* 0: PDC20246 */
32695 .name = DRV_NAME,
32696 .init_chipset = init_chipset_pdc202xx,
32697 diff -urNp linux-2.6.32.49/drivers/ide/piix.c linux-2.6.32.49/drivers/ide/piix.c
32698 --- linux-2.6.32.49/drivers/ide/piix.c 2011-11-08 19:02:43.000000000 -0500
32699 +++ linux-2.6.32.49/drivers/ide/piix.c 2011-11-18 18:01:55.000000000 -0500
32700 @@ -344,7 +344,7 @@ static const struct ide_port_ops ich_por
32701 .udma_mask = udma, \
32702 }
32703
32704 -static const struct ide_port_info piix_pci_info[] __devinitdata = {
32705 +static const struct ide_port_info piix_pci_info[] __devinitconst = {
32706 /* 0: MPIIX */
32707 { /*
32708 * MPIIX actually has only a single IDE channel mapped to
32709 diff -urNp linux-2.6.32.49/drivers/ide/rz1000.c linux-2.6.32.49/drivers/ide/rz1000.c
32710 --- linux-2.6.32.49/drivers/ide/rz1000.c 2011-11-08 19:02:43.000000000 -0500
32711 +++ linux-2.6.32.49/drivers/ide/rz1000.c 2011-11-18 18:01:55.000000000 -0500
32712 @@ -38,7 +38,7 @@ static int __devinit rz1000_disable_read
32713 }
32714 }
32715
32716 -static const struct ide_port_info rz1000_chipset __devinitdata = {
32717 +static const struct ide_port_info rz1000_chipset __devinitconst = {
32718 .name = DRV_NAME,
32719 .host_flags = IDE_HFLAG_NO_DMA,
32720 };
32721 diff -urNp linux-2.6.32.49/drivers/ide/sc1200.c linux-2.6.32.49/drivers/ide/sc1200.c
32722 --- linux-2.6.32.49/drivers/ide/sc1200.c 2011-11-08 19:02:43.000000000 -0500
32723 +++ linux-2.6.32.49/drivers/ide/sc1200.c 2011-11-18 18:01:55.000000000 -0500
32724 @@ -290,7 +290,7 @@ static const struct ide_dma_ops sc1200_d
32725 .dma_sff_read_status = ide_dma_sff_read_status,
32726 };
32727
32728 -static const struct ide_port_info sc1200_chipset __devinitdata = {
32729 +static const struct ide_port_info sc1200_chipset __devinitconst = {
32730 .name = DRV_NAME,
32731 .port_ops = &sc1200_port_ops,
32732 .dma_ops = &sc1200_dma_ops,
32733 diff -urNp linux-2.6.32.49/drivers/ide/scc_pata.c linux-2.6.32.49/drivers/ide/scc_pata.c
32734 --- linux-2.6.32.49/drivers/ide/scc_pata.c 2011-11-08 19:02:43.000000000 -0500
32735 +++ linux-2.6.32.49/drivers/ide/scc_pata.c 2011-11-18 18:01:55.000000000 -0500
32736 @@ -811,7 +811,7 @@ static const struct ide_dma_ops scc_dma_
32737 .dma_sff_read_status = scc_dma_sff_read_status,
32738 };
32739
32740 -static const struct ide_port_info scc_chipset __devinitdata = {
32741 +static const struct ide_port_info scc_chipset __devinitconst = {
32742 .name = "sccIDE",
32743 .init_iops = init_iops_scc,
32744 .init_dma = scc_init_dma,
32745 diff -urNp linux-2.6.32.49/drivers/ide/serverworks.c linux-2.6.32.49/drivers/ide/serverworks.c
32746 --- linux-2.6.32.49/drivers/ide/serverworks.c 2011-11-08 19:02:43.000000000 -0500
32747 +++ linux-2.6.32.49/drivers/ide/serverworks.c 2011-11-18 18:01:55.000000000 -0500
32748 @@ -353,7 +353,7 @@ static const struct ide_port_ops svwks_p
32749 .cable_detect = svwks_cable_detect,
32750 };
32751
32752 -static const struct ide_port_info serverworks_chipsets[] __devinitdata = {
32753 +static const struct ide_port_info serverworks_chipsets[] __devinitconst = {
32754 { /* 0: OSB4 */
32755 .name = DRV_NAME,
32756 .init_chipset = init_chipset_svwks,
32757 diff -urNp linux-2.6.32.49/drivers/ide/setup-pci.c linux-2.6.32.49/drivers/ide/setup-pci.c
32758 --- linux-2.6.32.49/drivers/ide/setup-pci.c 2011-11-08 19:02:43.000000000 -0500
32759 +++ linux-2.6.32.49/drivers/ide/setup-pci.c 2011-11-15 19:59:43.000000000 -0500
32760 @@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev
32761 int ret, i, n_ports = dev2 ? 4 : 2;
32762 struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
32763
32764 + pax_track_stack();
32765 +
32766 for (i = 0; i < n_ports / 2; i++) {
32767 ret = ide_setup_pci_controller(pdev[i], d, !i);
32768 if (ret < 0)
32769 diff -urNp linux-2.6.32.49/drivers/ide/siimage.c linux-2.6.32.49/drivers/ide/siimage.c
32770 --- linux-2.6.32.49/drivers/ide/siimage.c 2011-11-08 19:02:43.000000000 -0500
32771 +++ linux-2.6.32.49/drivers/ide/siimage.c 2011-11-18 18:01:55.000000000 -0500
32772 @@ -719,7 +719,7 @@ static const struct ide_dma_ops sil_dma_
32773 .udma_mask = ATA_UDMA6, \
32774 }
32775
32776 -static const struct ide_port_info siimage_chipsets[] __devinitdata = {
32777 +static const struct ide_port_info siimage_chipsets[] __devinitconst = {
32778 /* 0: SiI680 */ DECLARE_SII_DEV(&sil_pata_port_ops),
32779 /* 1: SiI3112 */ DECLARE_SII_DEV(&sil_sata_port_ops)
32780 };
32781 diff -urNp linux-2.6.32.49/drivers/ide/sis5513.c linux-2.6.32.49/drivers/ide/sis5513.c
32782 --- linux-2.6.32.49/drivers/ide/sis5513.c 2011-11-08 19:02:43.000000000 -0500
32783 +++ linux-2.6.32.49/drivers/ide/sis5513.c 2011-11-18 18:01:55.000000000 -0500
32784 @@ -561,7 +561,7 @@ static const struct ide_port_ops sis_ata
32785 .cable_detect = sis_cable_detect,
32786 };
32787
32788 -static const struct ide_port_info sis5513_chipset __devinitdata = {
32789 +static const struct ide_port_info sis5513_chipset __devinitconst = {
32790 .name = DRV_NAME,
32791 .init_chipset = init_chipset_sis5513,
32792 .enablebits = { {0x4a, 0x02, 0x02}, {0x4a, 0x04, 0x04} },
32793 diff -urNp linux-2.6.32.49/drivers/ide/sl82c105.c linux-2.6.32.49/drivers/ide/sl82c105.c
32794 --- linux-2.6.32.49/drivers/ide/sl82c105.c 2011-11-08 19:02:43.000000000 -0500
32795 +++ linux-2.6.32.49/drivers/ide/sl82c105.c 2011-11-18 18:01:55.000000000 -0500
32796 @@ -319,7 +319,7 @@ static const struct ide_dma_ops sl82c105
32797 .dma_sff_read_status = ide_dma_sff_read_status,
32798 };
32799
32800 -static const struct ide_port_info sl82c105_chipset __devinitdata = {
32801 +static const struct ide_port_info sl82c105_chipset __devinitconst = {
32802 .name = DRV_NAME,
32803 .init_chipset = init_chipset_sl82c105,
32804 .enablebits = {{0x40,0x01,0x01}, {0x40,0x10,0x10}},
32805 diff -urNp linux-2.6.32.49/drivers/ide/slc90e66.c linux-2.6.32.49/drivers/ide/slc90e66.c
32806 --- linux-2.6.32.49/drivers/ide/slc90e66.c 2011-11-08 19:02:43.000000000 -0500
32807 +++ linux-2.6.32.49/drivers/ide/slc90e66.c 2011-11-18 18:01:55.000000000 -0500
32808 @@ -131,7 +131,7 @@ static const struct ide_port_ops slc90e6
32809 .cable_detect = slc90e66_cable_detect,
32810 };
32811
32812 -static const struct ide_port_info slc90e66_chipset __devinitdata = {
32813 +static const struct ide_port_info slc90e66_chipset __devinitconst = {
32814 .name = DRV_NAME,
32815 .enablebits = { {0x41, 0x80, 0x80}, {0x43, 0x80, 0x80} },
32816 .port_ops = &slc90e66_port_ops,
32817 diff -urNp linux-2.6.32.49/drivers/ide/tc86c001.c linux-2.6.32.49/drivers/ide/tc86c001.c
32818 --- linux-2.6.32.49/drivers/ide/tc86c001.c 2011-11-08 19:02:43.000000000 -0500
32819 +++ linux-2.6.32.49/drivers/ide/tc86c001.c 2011-11-18 18:01:55.000000000 -0500
32820 @@ -190,7 +190,7 @@ static const struct ide_dma_ops tc86c001
32821 .dma_sff_read_status = ide_dma_sff_read_status,
32822 };
32823
32824 -static const struct ide_port_info tc86c001_chipset __devinitdata = {
32825 +static const struct ide_port_info tc86c001_chipset __devinitconst = {
32826 .name = DRV_NAME,
32827 .init_hwif = init_hwif_tc86c001,
32828 .port_ops = &tc86c001_port_ops,
32829 diff -urNp linux-2.6.32.49/drivers/ide/triflex.c linux-2.6.32.49/drivers/ide/triflex.c
32830 --- linux-2.6.32.49/drivers/ide/triflex.c 2011-11-08 19:02:43.000000000 -0500
32831 +++ linux-2.6.32.49/drivers/ide/triflex.c 2011-11-18 18:01:55.000000000 -0500
32832 @@ -92,7 +92,7 @@ static const struct ide_port_ops triflex
32833 .set_dma_mode = triflex_set_mode,
32834 };
32835
32836 -static const struct ide_port_info triflex_device __devinitdata = {
32837 +static const struct ide_port_info triflex_device __devinitconst = {
32838 .name = DRV_NAME,
32839 .enablebits = {{0x80, 0x01, 0x01}, {0x80, 0x02, 0x02}},
32840 .port_ops = &triflex_port_ops,
32841 diff -urNp linux-2.6.32.49/drivers/ide/trm290.c linux-2.6.32.49/drivers/ide/trm290.c
32842 --- linux-2.6.32.49/drivers/ide/trm290.c 2011-11-08 19:02:43.000000000 -0500
32843 +++ linux-2.6.32.49/drivers/ide/trm290.c 2011-11-18 18:01:55.000000000 -0500
32844 @@ -324,7 +324,7 @@ static struct ide_dma_ops trm290_dma_ops
32845 .dma_check = trm290_dma_check,
32846 };
32847
32848 -static const struct ide_port_info trm290_chipset __devinitdata = {
32849 +static const struct ide_port_info trm290_chipset __devinitconst = {
32850 .name = DRV_NAME,
32851 .init_hwif = init_hwif_trm290,
32852 .tp_ops = &trm290_tp_ops,
32853 diff -urNp linux-2.6.32.49/drivers/ide/via82cxxx.c linux-2.6.32.49/drivers/ide/via82cxxx.c
32854 --- linux-2.6.32.49/drivers/ide/via82cxxx.c 2011-11-08 19:02:43.000000000 -0500
32855 +++ linux-2.6.32.49/drivers/ide/via82cxxx.c 2011-11-18 18:01:55.000000000 -0500
32856 @@ -374,7 +374,7 @@ static const struct ide_port_ops via_por
32857 .cable_detect = via82cxxx_cable_detect,
32858 };
32859
32860 -static const struct ide_port_info via82cxxx_chipset __devinitdata = {
32861 +static const struct ide_port_info via82cxxx_chipset __devinitconst = {
32862 .name = DRV_NAME,
32863 .init_chipset = init_chipset_via82cxxx,
32864 .enablebits = { { 0x40, 0x02, 0x02 }, { 0x40, 0x01, 0x01 } },
32865 diff -urNp linux-2.6.32.49/drivers/ieee1394/dv1394.c linux-2.6.32.49/drivers/ieee1394/dv1394.c
32866 --- linux-2.6.32.49/drivers/ieee1394/dv1394.c 2011-11-08 19:02:43.000000000 -0500
32867 +++ linux-2.6.32.49/drivers/ieee1394/dv1394.c 2011-11-15 19:59:43.000000000 -0500
32868 @@ -739,7 +739,7 @@ static void frame_prepare(struct video_c
32869 based upon DIF section and sequence
32870 */
32871
32872 -static void inline
32873 +static inline void
32874 frame_put_packet (struct frame *f, struct packet *p)
32875 {
32876 int section_type = p->data[0] >> 5; /* section type is in bits 5 - 7 */
32877 diff -urNp linux-2.6.32.49/drivers/ieee1394/hosts.c linux-2.6.32.49/drivers/ieee1394/hosts.c
32878 --- linux-2.6.32.49/drivers/ieee1394/hosts.c 2011-11-08 19:02:43.000000000 -0500
32879 +++ linux-2.6.32.49/drivers/ieee1394/hosts.c 2011-11-15 19:59:43.000000000 -0500
32880 @@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso
32881 }
32882
32883 static struct hpsb_host_driver dummy_driver = {
32884 + .name = "dummy",
32885 .transmit_packet = dummy_transmit_packet,
32886 .devctl = dummy_devctl,
32887 .isoctl = dummy_isoctl
32888 diff -urNp linux-2.6.32.49/drivers/ieee1394/init_ohci1394_dma.c linux-2.6.32.49/drivers/ieee1394/init_ohci1394_dma.c
32889 --- linux-2.6.32.49/drivers/ieee1394/init_ohci1394_dma.c 2011-11-08 19:02:43.000000000 -0500
32890 +++ linux-2.6.32.49/drivers/ieee1394/init_ohci1394_dma.c 2011-11-15 19:59:43.000000000 -0500
32891 @@ -257,7 +257,7 @@ void __init init_ohci1394_dma_on_all_con
32892 for (func = 0; func < 8; func++) {
32893 u32 class = read_pci_config(num,slot,func,
32894 PCI_CLASS_REVISION);
32895 - if ((class == 0xffffffff))
32896 + if (class == 0xffffffff)
32897 continue; /* No device at this func */
32898
32899 if (class>>8 != PCI_CLASS_SERIAL_FIREWIRE_OHCI)
32900 diff -urNp linux-2.6.32.49/drivers/ieee1394/ohci1394.c linux-2.6.32.49/drivers/ieee1394/ohci1394.c
32901 --- linux-2.6.32.49/drivers/ieee1394/ohci1394.c 2011-11-08 19:02:43.000000000 -0500
32902 +++ linux-2.6.32.49/drivers/ieee1394/ohci1394.c 2011-11-15 19:59:43.000000000 -0500
32903 @@ -147,9 +147,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_
32904 printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
32905
32906 /* Module Parameters */
32907 -static int phys_dma = 1;
32908 +static int phys_dma;
32909 module_param(phys_dma, int, 0444);
32910 -MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
32911 +MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
32912
32913 static void dma_trm_tasklet(unsigned long data);
32914 static void dma_trm_reset(struct dma_trm_ctx *d);
32915 diff -urNp linux-2.6.32.49/drivers/ieee1394/sbp2.c linux-2.6.32.49/drivers/ieee1394/sbp2.c
32916 --- linux-2.6.32.49/drivers/ieee1394/sbp2.c 2011-11-08 19:02:43.000000000 -0500
32917 +++ linux-2.6.32.49/drivers/ieee1394/sbp2.c 2011-11-15 19:59:43.000000000 -0500
32918 @@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 prot
32919 MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
32920 MODULE_LICENSE("GPL");
32921
32922 -static int sbp2_module_init(void)
32923 +static int __init sbp2_module_init(void)
32924 {
32925 int ret;
32926
32927 diff -urNp linux-2.6.32.49/drivers/infiniband/core/cm.c linux-2.6.32.49/drivers/infiniband/core/cm.c
32928 --- linux-2.6.32.49/drivers/infiniband/core/cm.c 2011-11-08 19:02:43.000000000 -0500
32929 +++ linux-2.6.32.49/drivers/infiniband/core/cm.c 2011-11-15 19:59:43.000000000 -0500
32930 @@ -112,7 +112,7 @@ static char const counter_group_names[CM
32931
32932 struct cm_counter_group {
32933 struct kobject obj;
32934 - atomic_long_t counter[CM_ATTR_COUNT];
32935 + atomic_long_unchecked_t counter[CM_ATTR_COUNT];
32936 };
32937
32938 struct cm_counter_attribute {
32939 @@ -1386,7 +1386,7 @@ static void cm_dup_req_handler(struct cm
32940 struct ib_mad_send_buf *msg = NULL;
32941 int ret;
32942
32943 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32944 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32945 counter[CM_REQ_COUNTER]);
32946
32947 /* Quick state check to discard duplicate REQs. */
32948 @@ -1764,7 +1764,7 @@ static void cm_dup_rep_handler(struct cm
32949 if (!cm_id_priv)
32950 return;
32951
32952 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32953 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32954 counter[CM_REP_COUNTER]);
32955 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
32956 if (ret)
32957 @@ -1931,7 +1931,7 @@ static int cm_rtu_handler(struct cm_work
32958 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
32959 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
32960 spin_unlock_irq(&cm_id_priv->lock);
32961 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32962 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32963 counter[CM_RTU_COUNTER]);
32964 goto out;
32965 }
32966 @@ -2110,7 +2110,7 @@ static int cm_dreq_handler(struct cm_wor
32967 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
32968 dreq_msg->local_comm_id);
32969 if (!cm_id_priv) {
32970 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32971 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32972 counter[CM_DREQ_COUNTER]);
32973 cm_issue_drep(work->port, work->mad_recv_wc);
32974 return -EINVAL;
32975 @@ -2131,7 +2131,7 @@ static int cm_dreq_handler(struct cm_wor
32976 case IB_CM_MRA_REP_RCVD:
32977 break;
32978 case IB_CM_TIMEWAIT:
32979 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32980 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32981 counter[CM_DREQ_COUNTER]);
32982 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
32983 goto unlock;
32984 @@ -2145,7 +2145,7 @@ static int cm_dreq_handler(struct cm_wor
32985 cm_free_msg(msg);
32986 goto deref;
32987 case IB_CM_DREQ_RCVD:
32988 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32989 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32990 counter[CM_DREQ_COUNTER]);
32991 goto unlock;
32992 default:
32993 @@ -2501,7 +2501,7 @@ static int cm_mra_handler(struct cm_work
32994 ib_modify_mad(cm_id_priv->av.port->mad_agent,
32995 cm_id_priv->msg, timeout)) {
32996 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
32997 - atomic_long_inc(&work->port->
32998 + atomic_long_inc_unchecked(&work->port->
32999 counter_group[CM_RECV_DUPLICATES].
33000 counter[CM_MRA_COUNTER]);
33001 goto out;
33002 @@ -2510,7 +2510,7 @@ static int cm_mra_handler(struct cm_work
33003 break;
33004 case IB_CM_MRA_REQ_RCVD:
33005 case IB_CM_MRA_REP_RCVD:
33006 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
33007 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
33008 counter[CM_MRA_COUNTER]);
33009 /* fall through */
33010 default:
33011 @@ -2672,7 +2672,7 @@ static int cm_lap_handler(struct cm_work
33012 case IB_CM_LAP_IDLE:
33013 break;
33014 case IB_CM_MRA_LAP_SENT:
33015 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
33016 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
33017 counter[CM_LAP_COUNTER]);
33018 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
33019 goto unlock;
33020 @@ -2688,7 +2688,7 @@ static int cm_lap_handler(struct cm_work
33021 cm_free_msg(msg);
33022 goto deref;
33023 case IB_CM_LAP_RCVD:
33024 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
33025 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
33026 counter[CM_LAP_COUNTER]);
33027 goto unlock;
33028 default:
33029 @@ -2972,7 +2972,7 @@ static int cm_sidr_req_handler(struct cm
33030 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
33031 if (cur_cm_id_priv) {
33032 spin_unlock_irq(&cm.lock);
33033 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
33034 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
33035 counter[CM_SIDR_REQ_COUNTER]);
33036 goto out; /* Duplicate message. */
33037 }
33038 @@ -3184,10 +3184,10 @@ static void cm_send_handler(struct ib_ma
33039 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
33040 msg->retries = 1;
33041
33042 - atomic_long_add(1 + msg->retries,
33043 + atomic_long_add_unchecked(1 + msg->retries,
33044 &port->counter_group[CM_XMIT].counter[attr_index]);
33045 if (msg->retries)
33046 - atomic_long_add(msg->retries,
33047 + atomic_long_add_unchecked(msg->retries,
33048 &port->counter_group[CM_XMIT_RETRIES].
33049 counter[attr_index]);
33050
33051 @@ -3397,7 +3397,7 @@ static void cm_recv_handler(struct ib_ma
33052 }
33053
33054 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
33055 - atomic_long_inc(&port->counter_group[CM_RECV].
33056 + atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
33057 counter[attr_id - CM_ATTR_ID_OFFSET]);
33058
33059 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
33060 @@ -3595,10 +3595,10 @@ static ssize_t cm_show_counter(struct ko
33061 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
33062
33063 return sprintf(buf, "%ld\n",
33064 - atomic_long_read(&group->counter[cm_attr->index]));
33065 + atomic_long_read_unchecked(&group->counter[cm_attr->index]));
33066 }
33067
33068 -static struct sysfs_ops cm_counter_ops = {
33069 +static const struct sysfs_ops cm_counter_ops = {
33070 .show = cm_show_counter
33071 };
33072
33073 diff -urNp linux-2.6.32.49/drivers/infiniband/core/fmr_pool.c linux-2.6.32.49/drivers/infiniband/core/fmr_pool.c
33074 --- linux-2.6.32.49/drivers/infiniband/core/fmr_pool.c 2011-11-08 19:02:43.000000000 -0500
33075 +++ linux-2.6.32.49/drivers/infiniband/core/fmr_pool.c 2011-11-15 19:59:43.000000000 -0500
33076 @@ -97,8 +97,8 @@ struct ib_fmr_pool {
33077
33078 struct task_struct *thread;
33079
33080 - atomic_t req_ser;
33081 - atomic_t flush_ser;
33082 + atomic_unchecked_t req_ser;
33083 + atomic_unchecked_t flush_ser;
33084
33085 wait_queue_head_t force_wait;
33086 };
33087 @@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *p
33088 struct ib_fmr_pool *pool = pool_ptr;
33089
33090 do {
33091 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
33092 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
33093 ib_fmr_batch_release(pool);
33094
33095 - atomic_inc(&pool->flush_ser);
33096 + atomic_inc_unchecked(&pool->flush_ser);
33097 wake_up_interruptible(&pool->force_wait);
33098
33099 if (pool->flush_function)
33100 @@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *p
33101 }
33102
33103 set_current_state(TASK_INTERRUPTIBLE);
33104 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
33105 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
33106 !kthread_should_stop())
33107 schedule();
33108 __set_current_state(TASK_RUNNING);
33109 @@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(s
33110 pool->dirty_watermark = params->dirty_watermark;
33111 pool->dirty_len = 0;
33112 spin_lock_init(&pool->pool_lock);
33113 - atomic_set(&pool->req_ser, 0);
33114 - atomic_set(&pool->flush_ser, 0);
33115 + atomic_set_unchecked(&pool->req_ser, 0);
33116 + atomic_set_unchecked(&pool->flush_ser, 0);
33117 init_waitqueue_head(&pool->force_wait);
33118
33119 pool->thread = kthread_run(ib_fmr_cleanup_thread,
33120 @@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool
33121 }
33122 spin_unlock_irq(&pool->pool_lock);
33123
33124 - serial = atomic_inc_return(&pool->req_ser);
33125 + serial = atomic_inc_return_unchecked(&pool->req_ser);
33126 wake_up_process(pool->thread);
33127
33128 if (wait_event_interruptible(pool->force_wait,
33129 - atomic_read(&pool->flush_ser) - serial >= 0))
33130 + atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
33131 return -EINTR;
33132
33133 return 0;
33134 @@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr
33135 } else {
33136 list_add_tail(&fmr->list, &pool->dirty_list);
33137 if (++pool->dirty_len >= pool->dirty_watermark) {
33138 - atomic_inc(&pool->req_ser);
33139 + atomic_inc_unchecked(&pool->req_ser);
33140 wake_up_process(pool->thread);
33141 }
33142 }
33143 diff -urNp linux-2.6.32.49/drivers/infiniband/core/sysfs.c linux-2.6.32.49/drivers/infiniband/core/sysfs.c
33144 --- linux-2.6.32.49/drivers/infiniband/core/sysfs.c 2011-11-08 19:02:43.000000000 -0500
33145 +++ linux-2.6.32.49/drivers/infiniband/core/sysfs.c 2011-11-15 19:59:43.000000000 -0500
33146 @@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kob
33147 return port_attr->show(p, port_attr, buf);
33148 }
33149
33150 -static struct sysfs_ops port_sysfs_ops = {
33151 +static const struct sysfs_ops port_sysfs_ops = {
33152 .show = port_attr_show
33153 };
33154
33155 diff -urNp linux-2.6.32.49/drivers/infiniband/core/uverbs_marshall.c linux-2.6.32.49/drivers/infiniband/core/uverbs_marshall.c
33156 --- linux-2.6.32.49/drivers/infiniband/core/uverbs_marshall.c 2011-11-08 19:02:43.000000000 -0500
33157 +++ linux-2.6.32.49/drivers/infiniband/core/uverbs_marshall.c 2011-11-15 19:59:43.000000000 -0500
33158 @@ -40,18 +40,21 @@ void ib_copy_ah_attr_to_user(struct ib_u
33159 dst->grh.sgid_index = src->grh.sgid_index;
33160 dst->grh.hop_limit = src->grh.hop_limit;
33161 dst->grh.traffic_class = src->grh.traffic_class;
33162 + memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved));
33163 dst->dlid = src->dlid;
33164 dst->sl = src->sl;
33165 dst->src_path_bits = src->src_path_bits;
33166 dst->static_rate = src->static_rate;
33167 dst->is_global = src->ah_flags & IB_AH_GRH ? 1 : 0;
33168 dst->port_num = src->port_num;
33169 + dst->reserved = 0;
33170 }
33171 EXPORT_SYMBOL(ib_copy_ah_attr_to_user);
33172
33173 void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
33174 struct ib_qp_attr *src)
33175 {
33176 + dst->qp_state = src->qp_state;
33177 dst->cur_qp_state = src->cur_qp_state;
33178 dst->path_mtu = src->path_mtu;
33179 dst->path_mig_state = src->path_mig_state;
33180 @@ -83,6 +86,7 @@ void ib_copy_qp_attr_to_user(struct ib_u
33181 dst->rnr_retry = src->rnr_retry;
33182 dst->alt_port_num = src->alt_port_num;
33183 dst->alt_timeout = src->alt_timeout;
33184 + memset(dst->reserved, 0, sizeof(dst->reserved));
33185 }
33186 EXPORT_SYMBOL(ib_copy_qp_attr_to_user);
33187
33188 diff -urNp linux-2.6.32.49/drivers/infiniband/hw/ipath/ipath_fs.c linux-2.6.32.49/drivers/infiniband/hw/ipath/ipath_fs.c
33189 --- linux-2.6.32.49/drivers/infiniband/hw/ipath/ipath_fs.c 2011-11-08 19:02:43.000000000 -0500
33190 +++ linux-2.6.32.49/drivers/infiniband/hw/ipath/ipath_fs.c 2011-11-15 19:59:43.000000000 -0500
33191 @@ -110,6 +110,8 @@ static ssize_t atomic_counters_read(stru
33192 struct infinipath_counters counters;
33193 struct ipath_devdata *dd;
33194
33195 + pax_track_stack();
33196 +
33197 dd = file->f_path.dentry->d_inode->i_private;
33198 dd->ipath_f_read_counters(dd, &counters);
33199
33200 diff -urNp linux-2.6.32.49/drivers/infiniband/hw/nes/nes.c linux-2.6.32.49/drivers/infiniband/hw/nes/nes.c
33201 --- linux-2.6.32.49/drivers/infiniband/hw/nes/nes.c 2011-11-08 19:02:43.000000000 -0500
33202 +++ linux-2.6.32.49/drivers/infiniband/hw/nes/nes.c 2011-11-15 19:59:43.000000000 -0500
33203 @@ -102,7 +102,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limi
33204 LIST_HEAD(nes_adapter_list);
33205 static LIST_HEAD(nes_dev_list);
33206
33207 -atomic_t qps_destroyed;
33208 +atomic_unchecked_t qps_destroyed;
33209
33210 static unsigned int ee_flsh_adapter;
33211 static unsigned int sysfs_nonidx_addr;
33212 @@ -259,7 +259,7 @@ static void nes_cqp_rem_ref_callback(str
33213 struct nes_adapter *nesadapter = nesdev->nesadapter;
33214 u32 qp_id;
33215
33216 - atomic_inc(&qps_destroyed);
33217 + atomic_inc_unchecked(&qps_destroyed);
33218
33219 /* Free the control structures */
33220
33221 diff -urNp linux-2.6.32.49/drivers/infiniband/hw/nes/nes_cm.c linux-2.6.32.49/drivers/infiniband/hw/nes/nes_cm.c
33222 --- linux-2.6.32.49/drivers/infiniband/hw/nes/nes_cm.c 2011-11-08 19:02:43.000000000 -0500
33223 +++ linux-2.6.32.49/drivers/infiniband/hw/nes/nes_cm.c 2011-11-15 19:59:43.000000000 -0500
33224 @@ -69,11 +69,11 @@ u32 cm_packets_received;
33225 u32 cm_listens_created;
33226 u32 cm_listens_destroyed;
33227 u32 cm_backlog_drops;
33228 -atomic_t cm_loopbacks;
33229 -atomic_t cm_nodes_created;
33230 -atomic_t cm_nodes_destroyed;
33231 -atomic_t cm_accel_dropped_pkts;
33232 -atomic_t cm_resets_recvd;
33233 +atomic_unchecked_t cm_loopbacks;
33234 +atomic_unchecked_t cm_nodes_created;
33235 +atomic_unchecked_t cm_nodes_destroyed;
33236 +atomic_unchecked_t cm_accel_dropped_pkts;
33237 +atomic_unchecked_t cm_resets_recvd;
33238
33239 static inline int mini_cm_accelerated(struct nes_cm_core *,
33240 struct nes_cm_node *);
33241 @@ -149,13 +149,13 @@ static struct nes_cm_ops nes_cm_api = {
33242
33243 static struct nes_cm_core *g_cm_core;
33244
33245 -atomic_t cm_connects;
33246 -atomic_t cm_accepts;
33247 -atomic_t cm_disconnects;
33248 -atomic_t cm_closes;
33249 -atomic_t cm_connecteds;
33250 -atomic_t cm_connect_reqs;
33251 -atomic_t cm_rejects;
33252 +atomic_unchecked_t cm_connects;
33253 +atomic_unchecked_t cm_accepts;
33254 +atomic_unchecked_t cm_disconnects;
33255 +atomic_unchecked_t cm_closes;
33256 +atomic_unchecked_t cm_connecteds;
33257 +atomic_unchecked_t cm_connect_reqs;
33258 +atomic_unchecked_t cm_rejects;
33259
33260
33261 /**
33262 @@ -1195,7 +1195,7 @@ static struct nes_cm_node *make_cm_node(
33263 cm_node->rem_mac);
33264
33265 add_hte_node(cm_core, cm_node);
33266 - atomic_inc(&cm_nodes_created);
33267 + atomic_inc_unchecked(&cm_nodes_created);
33268
33269 return cm_node;
33270 }
33271 @@ -1253,7 +1253,7 @@ static int rem_ref_cm_node(struct nes_cm
33272 }
33273
33274 atomic_dec(&cm_core->node_cnt);
33275 - atomic_inc(&cm_nodes_destroyed);
33276 + atomic_inc_unchecked(&cm_nodes_destroyed);
33277 nesqp = cm_node->nesqp;
33278 if (nesqp) {
33279 nesqp->cm_node = NULL;
33280 @@ -1320,7 +1320,7 @@ static int process_options(struct nes_cm
33281
33282 static void drop_packet(struct sk_buff *skb)
33283 {
33284 - atomic_inc(&cm_accel_dropped_pkts);
33285 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
33286 dev_kfree_skb_any(skb);
33287 }
33288
33289 @@ -1377,7 +1377,7 @@ static void handle_rst_pkt(struct nes_cm
33290
33291 int reset = 0; /* whether to send reset in case of err.. */
33292 int passive_state;
33293 - atomic_inc(&cm_resets_recvd);
33294 + atomic_inc_unchecked(&cm_resets_recvd);
33295 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
33296 " refcnt=%d\n", cm_node, cm_node->state,
33297 atomic_read(&cm_node->ref_count));
33298 @@ -2000,7 +2000,7 @@ static struct nes_cm_node *mini_cm_conne
33299 rem_ref_cm_node(cm_node->cm_core, cm_node);
33300 return NULL;
33301 }
33302 - atomic_inc(&cm_loopbacks);
33303 + atomic_inc_unchecked(&cm_loopbacks);
33304 loopbackremotenode->loopbackpartner = cm_node;
33305 loopbackremotenode->tcp_cntxt.rcv_wscale =
33306 NES_CM_DEFAULT_RCV_WND_SCALE;
33307 @@ -2262,7 +2262,7 @@ static int mini_cm_recv_pkt(struct nes_c
33308 add_ref_cm_node(cm_node);
33309 } else if (cm_node->state == NES_CM_STATE_TSA) {
33310 rem_ref_cm_node(cm_core, cm_node);
33311 - atomic_inc(&cm_accel_dropped_pkts);
33312 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
33313 dev_kfree_skb_any(skb);
33314 break;
33315 }
33316 @@ -2568,7 +2568,7 @@ static int nes_cm_disconn_true(struct ne
33317
33318 if ((cm_id) && (cm_id->event_handler)) {
33319 if (issue_disconn) {
33320 - atomic_inc(&cm_disconnects);
33321 + atomic_inc_unchecked(&cm_disconnects);
33322 cm_event.event = IW_CM_EVENT_DISCONNECT;
33323 cm_event.status = disconn_status;
33324 cm_event.local_addr = cm_id->local_addr;
33325 @@ -2590,7 +2590,7 @@ static int nes_cm_disconn_true(struct ne
33326 }
33327
33328 if (issue_close) {
33329 - atomic_inc(&cm_closes);
33330 + atomic_inc_unchecked(&cm_closes);
33331 nes_disconnect(nesqp, 1);
33332
33333 cm_id->provider_data = nesqp;
33334 @@ -2710,7 +2710,7 @@ int nes_accept(struct iw_cm_id *cm_id, s
33335
33336 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
33337 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
33338 - atomic_inc(&cm_accepts);
33339 + atomic_inc_unchecked(&cm_accepts);
33340
33341 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
33342 atomic_read(&nesvnic->netdev->refcnt));
33343 @@ -2919,7 +2919,7 @@ int nes_reject(struct iw_cm_id *cm_id, c
33344
33345 struct nes_cm_core *cm_core;
33346
33347 - atomic_inc(&cm_rejects);
33348 + atomic_inc_unchecked(&cm_rejects);
33349 cm_node = (struct nes_cm_node *) cm_id->provider_data;
33350 loopback = cm_node->loopbackpartner;
33351 cm_core = cm_node->cm_core;
33352 @@ -2982,7 +2982,7 @@ int nes_connect(struct iw_cm_id *cm_id,
33353 ntohl(cm_id->local_addr.sin_addr.s_addr),
33354 ntohs(cm_id->local_addr.sin_port));
33355
33356 - atomic_inc(&cm_connects);
33357 + atomic_inc_unchecked(&cm_connects);
33358 nesqp->active_conn = 1;
33359
33360 /* cache the cm_id in the qp */
33361 @@ -3195,7 +3195,7 @@ static void cm_event_connected(struct ne
33362 if (nesqp->destroyed) {
33363 return;
33364 }
33365 - atomic_inc(&cm_connecteds);
33366 + atomic_inc_unchecked(&cm_connecteds);
33367 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
33368 " local port 0x%04X. jiffies = %lu.\n",
33369 nesqp->hwqp.qp_id,
33370 @@ -3403,7 +3403,7 @@ static void cm_event_reset(struct nes_cm
33371
33372 ret = cm_id->event_handler(cm_id, &cm_event);
33373 cm_id->add_ref(cm_id);
33374 - atomic_inc(&cm_closes);
33375 + atomic_inc_unchecked(&cm_closes);
33376 cm_event.event = IW_CM_EVENT_CLOSE;
33377 cm_event.status = IW_CM_EVENT_STATUS_OK;
33378 cm_event.provider_data = cm_id->provider_data;
33379 @@ -3439,7 +3439,7 @@ static void cm_event_mpa_req(struct nes_
33380 return;
33381 cm_id = cm_node->cm_id;
33382
33383 - atomic_inc(&cm_connect_reqs);
33384 + atomic_inc_unchecked(&cm_connect_reqs);
33385 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
33386 cm_node, cm_id, jiffies);
33387
33388 @@ -3477,7 +3477,7 @@ static void cm_event_mpa_reject(struct n
33389 return;
33390 cm_id = cm_node->cm_id;
33391
33392 - atomic_inc(&cm_connect_reqs);
33393 + atomic_inc_unchecked(&cm_connect_reqs);
33394 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
33395 cm_node, cm_id, jiffies);
33396
33397 diff -urNp linux-2.6.32.49/drivers/infiniband/hw/nes/nes.h linux-2.6.32.49/drivers/infiniband/hw/nes/nes.h
33398 --- linux-2.6.32.49/drivers/infiniband/hw/nes/nes.h 2011-11-08 19:02:43.000000000 -0500
33399 +++ linux-2.6.32.49/drivers/infiniband/hw/nes/nes.h 2011-11-15 19:59:43.000000000 -0500
33400 @@ -174,17 +174,17 @@ extern unsigned int nes_debug_level;
33401 extern unsigned int wqm_quanta;
33402 extern struct list_head nes_adapter_list;
33403
33404 -extern atomic_t cm_connects;
33405 -extern atomic_t cm_accepts;
33406 -extern atomic_t cm_disconnects;
33407 -extern atomic_t cm_closes;
33408 -extern atomic_t cm_connecteds;
33409 -extern atomic_t cm_connect_reqs;
33410 -extern atomic_t cm_rejects;
33411 -extern atomic_t mod_qp_timouts;
33412 -extern atomic_t qps_created;
33413 -extern atomic_t qps_destroyed;
33414 -extern atomic_t sw_qps_destroyed;
33415 +extern atomic_unchecked_t cm_connects;
33416 +extern atomic_unchecked_t cm_accepts;
33417 +extern atomic_unchecked_t cm_disconnects;
33418 +extern atomic_unchecked_t cm_closes;
33419 +extern atomic_unchecked_t cm_connecteds;
33420 +extern atomic_unchecked_t cm_connect_reqs;
33421 +extern atomic_unchecked_t cm_rejects;
33422 +extern atomic_unchecked_t mod_qp_timouts;
33423 +extern atomic_unchecked_t qps_created;
33424 +extern atomic_unchecked_t qps_destroyed;
33425 +extern atomic_unchecked_t sw_qps_destroyed;
33426 extern u32 mh_detected;
33427 extern u32 mh_pauses_sent;
33428 extern u32 cm_packets_sent;
33429 @@ -196,11 +196,11 @@ extern u32 cm_packets_retrans;
33430 extern u32 cm_listens_created;
33431 extern u32 cm_listens_destroyed;
33432 extern u32 cm_backlog_drops;
33433 -extern atomic_t cm_loopbacks;
33434 -extern atomic_t cm_nodes_created;
33435 -extern atomic_t cm_nodes_destroyed;
33436 -extern atomic_t cm_accel_dropped_pkts;
33437 -extern atomic_t cm_resets_recvd;
33438 +extern atomic_unchecked_t cm_loopbacks;
33439 +extern atomic_unchecked_t cm_nodes_created;
33440 +extern atomic_unchecked_t cm_nodes_destroyed;
33441 +extern atomic_unchecked_t cm_accel_dropped_pkts;
33442 +extern atomic_unchecked_t cm_resets_recvd;
33443
33444 extern u32 int_mod_timer_init;
33445 extern u32 int_mod_cq_depth_256;
33446 diff -urNp linux-2.6.32.49/drivers/infiniband/hw/nes/nes_nic.c linux-2.6.32.49/drivers/infiniband/hw/nes/nes_nic.c
33447 --- linux-2.6.32.49/drivers/infiniband/hw/nes/nes_nic.c 2011-11-08 19:02:43.000000000 -0500
33448 +++ linux-2.6.32.49/drivers/infiniband/hw/nes/nes_nic.c 2011-11-15 19:59:43.000000000 -0500
33449 @@ -1210,17 +1210,17 @@ static void nes_netdev_get_ethtool_stats
33450 target_stat_values[++index] = mh_detected;
33451 target_stat_values[++index] = mh_pauses_sent;
33452 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
33453 - target_stat_values[++index] = atomic_read(&cm_connects);
33454 - target_stat_values[++index] = atomic_read(&cm_accepts);
33455 - target_stat_values[++index] = atomic_read(&cm_disconnects);
33456 - target_stat_values[++index] = atomic_read(&cm_connecteds);
33457 - target_stat_values[++index] = atomic_read(&cm_connect_reqs);
33458 - target_stat_values[++index] = atomic_read(&cm_rejects);
33459 - target_stat_values[++index] = atomic_read(&mod_qp_timouts);
33460 - target_stat_values[++index] = atomic_read(&qps_created);
33461 - target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
33462 - target_stat_values[++index] = atomic_read(&qps_destroyed);
33463 - target_stat_values[++index] = atomic_read(&cm_closes);
33464 + target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
33465 + target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
33466 + target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
33467 + target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
33468 + target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
33469 + target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
33470 + target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
33471 + target_stat_values[++index] = atomic_read_unchecked(&qps_created);
33472 + target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
33473 + target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
33474 + target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
33475 target_stat_values[++index] = cm_packets_sent;
33476 target_stat_values[++index] = cm_packets_bounced;
33477 target_stat_values[++index] = cm_packets_created;
33478 @@ -1230,11 +1230,11 @@ static void nes_netdev_get_ethtool_stats
33479 target_stat_values[++index] = cm_listens_created;
33480 target_stat_values[++index] = cm_listens_destroyed;
33481 target_stat_values[++index] = cm_backlog_drops;
33482 - target_stat_values[++index] = atomic_read(&cm_loopbacks);
33483 - target_stat_values[++index] = atomic_read(&cm_nodes_created);
33484 - target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
33485 - target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
33486 - target_stat_values[++index] = atomic_read(&cm_resets_recvd);
33487 + target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
33488 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
33489 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
33490 + target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
33491 + target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
33492 target_stat_values[++index] = int_mod_timer_init;
33493 target_stat_values[++index] = int_mod_cq_depth_1;
33494 target_stat_values[++index] = int_mod_cq_depth_4;
33495 diff -urNp linux-2.6.32.49/drivers/infiniband/hw/nes/nes_verbs.c linux-2.6.32.49/drivers/infiniband/hw/nes/nes_verbs.c
33496 --- linux-2.6.32.49/drivers/infiniband/hw/nes/nes_verbs.c 2011-11-08 19:02:43.000000000 -0500
33497 +++ linux-2.6.32.49/drivers/infiniband/hw/nes/nes_verbs.c 2011-11-15 19:59:43.000000000 -0500
33498 @@ -45,9 +45,9 @@
33499
33500 #include <rdma/ib_umem.h>
33501
33502 -atomic_t mod_qp_timouts;
33503 -atomic_t qps_created;
33504 -atomic_t sw_qps_destroyed;
33505 +atomic_unchecked_t mod_qp_timouts;
33506 +atomic_unchecked_t qps_created;
33507 +atomic_unchecked_t sw_qps_destroyed;
33508
33509 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
33510
33511 @@ -1240,7 +1240,7 @@ static struct ib_qp *nes_create_qp(struc
33512 if (init_attr->create_flags)
33513 return ERR_PTR(-EINVAL);
33514
33515 - atomic_inc(&qps_created);
33516 + atomic_inc_unchecked(&qps_created);
33517 switch (init_attr->qp_type) {
33518 case IB_QPT_RC:
33519 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
33520 @@ -1568,7 +1568,7 @@ static int nes_destroy_qp(struct ib_qp *
33521 struct iw_cm_event cm_event;
33522 int ret;
33523
33524 - atomic_inc(&sw_qps_destroyed);
33525 + atomic_inc_unchecked(&sw_qps_destroyed);
33526 nesqp->destroyed = 1;
33527
33528 /* Blow away the connection if it exists. */
33529 diff -urNp linux-2.6.32.49/drivers/input/gameport/gameport.c linux-2.6.32.49/drivers/input/gameport/gameport.c
33530 --- linux-2.6.32.49/drivers/input/gameport/gameport.c 2011-11-08 19:02:43.000000000 -0500
33531 +++ linux-2.6.32.49/drivers/input/gameport/gameport.c 2011-11-15 19:59:43.000000000 -0500
33532 @@ -515,13 +515,13 @@ EXPORT_SYMBOL(gameport_set_phys);
33533 */
33534 static void gameport_init_port(struct gameport *gameport)
33535 {
33536 - static atomic_t gameport_no = ATOMIC_INIT(0);
33537 + static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
33538
33539 __module_get(THIS_MODULE);
33540
33541 mutex_init(&gameport->drv_mutex);
33542 device_initialize(&gameport->dev);
33543 - dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return(&gameport_no) - 1);
33544 + dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
33545 gameport->dev.bus = &gameport_bus;
33546 gameport->dev.release = gameport_release_port;
33547 if (gameport->parent)
33548 diff -urNp linux-2.6.32.49/drivers/input/input.c linux-2.6.32.49/drivers/input/input.c
33549 --- linux-2.6.32.49/drivers/input/input.c 2011-11-08 19:02:43.000000000 -0500
33550 +++ linux-2.6.32.49/drivers/input/input.c 2011-11-15 19:59:43.000000000 -0500
33551 @@ -1558,7 +1558,7 @@ EXPORT_SYMBOL(input_set_capability);
33552 */
33553 int input_register_device(struct input_dev *dev)
33554 {
33555 - static atomic_t input_no = ATOMIC_INIT(0);
33556 + static atomic_unchecked_t input_no = ATOMIC_INIT(0);
33557 struct input_handler *handler;
33558 const char *path;
33559 int error;
33560 @@ -1585,7 +1585,7 @@ int input_register_device(struct input_d
33561 dev->setkeycode = input_default_setkeycode;
33562
33563 dev_set_name(&dev->dev, "input%ld",
33564 - (unsigned long) atomic_inc_return(&input_no) - 1);
33565 + (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
33566
33567 error = device_add(&dev->dev);
33568 if (error)
33569 diff -urNp linux-2.6.32.49/drivers/input/joystick/sidewinder.c linux-2.6.32.49/drivers/input/joystick/sidewinder.c
33570 --- linux-2.6.32.49/drivers/input/joystick/sidewinder.c 2011-11-08 19:02:43.000000000 -0500
33571 +++ linux-2.6.32.49/drivers/input/joystick/sidewinder.c 2011-11-15 19:59:43.000000000 -0500
33572 @@ -30,6 +30,7 @@
33573 #include <linux/kernel.h>
33574 #include <linux/module.h>
33575 #include <linux/slab.h>
33576 +#include <linux/sched.h>
33577 #include <linux/init.h>
33578 #include <linux/input.h>
33579 #include <linux/gameport.h>
33580 @@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
33581 unsigned char buf[SW_LENGTH];
33582 int i;
33583
33584 + pax_track_stack();
33585 +
33586 i = sw_read_packet(sw->gameport, buf, sw->length, 0);
33587
33588 if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
33589 diff -urNp linux-2.6.32.49/drivers/input/joystick/xpad.c linux-2.6.32.49/drivers/input/joystick/xpad.c
33590 --- linux-2.6.32.49/drivers/input/joystick/xpad.c 2011-11-08 19:02:43.000000000 -0500
33591 +++ linux-2.6.32.49/drivers/input/joystick/xpad.c 2011-11-15 19:59:43.000000000 -0500
33592 @@ -621,7 +621,7 @@ static void xpad_led_set(struct led_clas
33593
33594 static int xpad_led_probe(struct usb_xpad *xpad)
33595 {
33596 - static atomic_t led_seq = ATOMIC_INIT(0);
33597 + static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
33598 long led_no;
33599 struct xpad_led *led;
33600 struct led_classdev *led_cdev;
33601 @@ -634,7 +634,7 @@ static int xpad_led_probe(struct usb_xpa
33602 if (!led)
33603 return -ENOMEM;
33604
33605 - led_no = (long)atomic_inc_return(&led_seq) - 1;
33606 + led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
33607
33608 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
33609 led->xpad = xpad;
33610 diff -urNp linux-2.6.32.49/drivers/input/serio/serio.c linux-2.6.32.49/drivers/input/serio/serio.c
33611 --- linux-2.6.32.49/drivers/input/serio/serio.c 2011-11-08 19:02:43.000000000 -0500
33612 +++ linux-2.6.32.49/drivers/input/serio/serio.c 2011-11-15 19:59:43.000000000 -0500
33613 @@ -527,7 +527,7 @@ static void serio_release_port(struct de
33614 */
33615 static void serio_init_port(struct serio *serio)
33616 {
33617 - static atomic_t serio_no = ATOMIC_INIT(0);
33618 + static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
33619
33620 __module_get(THIS_MODULE);
33621
33622 @@ -536,7 +536,7 @@ static void serio_init_port(struct serio
33623 mutex_init(&serio->drv_mutex);
33624 device_initialize(&serio->dev);
33625 dev_set_name(&serio->dev, "serio%ld",
33626 - (long)atomic_inc_return(&serio_no) - 1);
33627 + (long)atomic_inc_return_unchecked(&serio_no) - 1);
33628 serio->dev.bus = &serio_bus;
33629 serio->dev.release = serio_release_port;
33630 if (serio->parent) {
33631 diff -urNp linux-2.6.32.49/drivers/isdn/gigaset/common.c linux-2.6.32.49/drivers/isdn/gigaset/common.c
33632 --- linux-2.6.32.49/drivers/isdn/gigaset/common.c 2011-11-08 19:02:43.000000000 -0500
33633 +++ linux-2.6.32.49/drivers/isdn/gigaset/common.c 2011-11-15 19:59:43.000000000 -0500
33634 @@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct
33635 cs->commands_pending = 0;
33636 cs->cur_at_seq = 0;
33637 cs->gotfwver = -1;
33638 - cs->open_count = 0;
33639 + local_set(&cs->open_count, 0);
33640 cs->dev = NULL;
33641 cs->tty = NULL;
33642 cs->tty_dev = NULL;
33643 diff -urNp linux-2.6.32.49/drivers/isdn/gigaset/gigaset.h linux-2.6.32.49/drivers/isdn/gigaset/gigaset.h
33644 --- linux-2.6.32.49/drivers/isdn/gigaset/gigaset.h 2011-11-08 19:02:43.000000000 -0500
33645 +++ linux-2.6.32.49/drivers/isdn/gigaset/gigaset.h 2011-11-15 19:59:43.000000000 -0500
33646 @@ -34,6 +34,7 @@
33647 #include <linux/tty_driver.h>
33648 #include <linux/list.h>
33649 #include <asm/atomic.h>
33650 +#include <asm/local.h>
33651
33652 #define GIG_VERSION {0,5,0,0}
33653 #define GIG_COMPAT {0,4,0,0}
33654 @@ -446,7 +447,7 @@ struct cardstate {
33655 spinlock_t cmdlock;
33656 unsigned curlen, cmdbytes;
33657
33658 - unsigned open_count;
33659 + local_t open_count;
33660 struct tty_struct *tty;
33661 struct tasklet_struct if_wake_tasklet;
33662 unsigned control_state;
33663 diff -urNp linux-2.6.32.49/drivers/isdn/gigaset/interface.c linux-2.6.32.49/drivers/isdn/gigaset/interface.c
33664 --- linux-2.6.32.49/drivers/isdn/gigaset/interface.c 2011-11-08 19:02:43.000000000 -0500
33665 +++ linux-2.6.32.49/drivers/isdn/gigaset/interface.c 2011-11-15 19:59:43.000000000 -0500
33666 @@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tt
33667 return -ERESTARTSYS; // FIXME -EINTR?
33668 tty->driver_data = cs;
33669
33670 - ++cs->open_count;
33671 -
33672 - if (cs->open_count == 1) {
33673 + if (local_inc_return(&cs->open_count) == 1) {
33674 spin_lock_irqsave(&cs->lock, flags);
33675 cs->tty = tty;
33676 spin_unlock_irqrestore(&cs->lock, flags);
33677 @@ -195,10 +193,10 @@ static void if_close(struct tty_struct *
33678
33679 if (!cs->connected)
33680 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
33681 - else if (!cs->open_count)
33682 + else if (!local_read(&cs->open_count))
33683 dev_warn(cs->dev, "%s: device not opened\n", __func__);
33684 else {
33685 - if (!--cs->open_count) {
33686 + if (!local_dec_return(&cs->open_count)) {
33687 spin_lock_irqsave(&cs->lock, flags);
33688 cs->tty = NULL;
33689 spin_unlock_irqrestore(&cs->lock, flags);
33690 @@ -233,7 +231,7 @@ static int if_ioctl(struct tty_struct *t
33691 if (!cs->connected) {
33692 gig_dbg(DEBUG_IF, "not connected");
33693 retval = -ENODEV;
33694 - } else if (!cs->open_count)
33695 + } else if (!local_read(&cs->open_count))
33696 dev_warn(cs->dev, "%s: device not opened\n", __func__);
33697 else {
33698 retval = 0;
33699 @@ -361,7 +359,7 @@ static int if_write(struct tty_struct *t
33700 if (!cs->connected) {
33701 gig_dbg(DEBUG_IF, "not connected");
33702 retval = -ENODEV;
33703 - } else if (!cs->open_count)
33704 + } else if (!local_read(&cs->open_count))
33705 dev_warn(cs->dev, "%s: device not opened\n", __func__);
33706 else if (cs->mstate != MS_LOCKED) {
33707 dev_warn(cs->dev, "can't write to unlocked device\n");
33708 @@ -395,7 +393,7 @@ static int if_write_room(struct tty_stru
33709 if (!cs->connected) {
33710 gig_dbg(DEBUG_IF, "not connected");
33711 retval = -ENODEV;
33712 - } else if (!cs->open_count)
33713 + } else if (!local_read(&cs->open_count))
33714 dev_warn(cs->dev, "%s: device not opened\n", __func__);
33715 else if (cs->mstate != MS_LOCKED) {
33716 dev_warn(cs->dev, "can't write to unlocked device\n");
33717 @@ -425,7 +423,7 @@ static int if_chars_in_buffer(struct tty
33718
33719 if (!cs->connected)
33720 gig_dbg(DEBUG_IF, "not connected");
33721 - else if (!cs->open_count)
33722 + else if (!local_read(&cs->open_count))
33723 dev_warn(cs->dev, "%s: device not opened\n", __func__);
33724 else if (cs->mstate != MS_LOCKED)
33725 dev_warn(cs->dev, "can't write to unlocked device\n");
33726 @@ -453,7 +451,7 @@ static void if_throttle(struct tty_struc
33727
33728 if (!cs->connected)
33729 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
33730 - else if (!cs->open_count)
33731 + else if (!local_read(&cs->open_count))
33732 dev_warn(cs->dev, "%s: device not opened\n", __func__);
33733 else {
33734 //FIXME
33735 @@ -478,7 +476,7 @@ static void if_unthrottle(struct tty_str
33736
33737 if (!cs->connected)
33738 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
33739 - else if (!cs->open_count)
33740 + else if (!local_read(&cs->open_count))
33741 dev_warn(cs->dev, "%s: device not opened\n", __func__);
33742 else {
33743 //FIXME
33744 @@ -510,7 +508,7 @@ static void if_set_termios(struct tty_st
33745 goto out;
33746 }
33747
33748 - if (!cs->open_count) {
33749 + if (!local_read(&cs->open_count)) {
33750 dev_warn(cs->dev, "%s: device not opened\n", __func__);
33751 goto out;
33752 }
33753 diff -urNp linux-2.6.32.49/drivers/isdn/hardware/avm/b1.c linux-2.6.32.49/drivers/isdn/hardware/avm/b1.c
33754 --- linux-2.6.32.49/drivers/isdn/hardware/avm/b1.c 2011-11-08 19:02:43.000000000 -0500
33755 +++ linux-2.6.32.49/drivers/isdn/hardware/avm/b1.c 2011-11-15 19:59:43.000000000 -0500
33756 @@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capilo
33757 }
33758 if (left) {
33759 if (t4file->user) {
33760 - if (copy_from_user(buf, dp, left))
33761 + if (left > sizeof buf || copy_from_user(buf, dp, left))
33762 return -EFAULT;
33763 } else {
33764 memcpy(buf, dp, left);
33765 @@ -221,7 +221,7 @@ int b1_load_config(avmcard *card, capilo
33766 }
33767 if (left) {
33768 if (config->user) {
33769 - if (copy_from_user(buf, dp, left))
33770 + if (left > sizeof buf || copy_from_user(buf, dp, left))
33771 return -EFAULT;
33772 } else {
33773 memcpy(buf, dp, left);
33774 diff -urNp linux-2.6.32.49/drivers/isdn/hardware/eicon/capidtmf.c linux-2.6.32.49/drivers/isdn/hardware/eicon/capidtmf.c
33775 --- linux-2.6.32.49/drivers/isdn/hardware/eicon/capidtmf.c 2011-11-08 19:02:43.000000000 -0500
33776 +++ linux-2.6.32.49/drivers/isdn/hardware/eicon/capidtmf.c 2011-11-15 19:59:43.000000000 -0500
33777 @@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_sta
33778 byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
33779 short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
33780
33781 + pax_track_stack();
33782
33783 if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
33784 {
33785 diff -urNp linux-2.6.32.49/drivers/isdn/hardware/eicon/capifunc.c linux-2.6.32.49/drivers/isdn/hardware/eicon/capifunc.c
33786 --- linux-2.6.32.49/drivers/isdn/hardware/eicon/capifunc.c 2011-11-08 19:02:43.000000000 -0500
33787 +++ linux-2.6.32.49/drivers/isdn/hardware/eicon/capifunc.c 2011-11-15 19:59:43.000000000 -0500
33788 @@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
33789 IDI_SYNC_REQ req;
33790 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
33791
33792 + pax_track_stack();
33793 +
33794 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
33795
33796 for (x = 0; x < MAX_DESCRIPTORS; x++) {
33797 diff -urNp linux-2.6.32.49/drivers/isdn/hardware/eicon/diddfunc.c linux-2.6.32.49/drivers/isdn/hardware/eicon/diddfunc.c
33798 --- linux-2.6.32.49/drivers/isdn/hardware/eicon/diddfunc.c 2011-11-08 19:02:43.000000000 -0500
33799 +++ linux-2.6.32.49/drivers/isdn/hardware/eicon/diddfunc.c 2011-11-15 19:59:43.000000000 -0500
33800 @@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_di
33801 IDI_SYNC_REQ req;
33802 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
33803
33804 + pax_track_stack();
33805 +
33806 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
33807
33808 for (x = 0; x < MAX_DESCRIPTORS; x++) {
33809 diff -urNp linux-2.6.32.49/drivers/isdn/hardware/eicon/divasfunc.c linux-2.6.32.49/drivers/isdn/hardware/eicon/divasfunc.c
33810 --- linux-2.6.32.49/drivers/isdn/hardware/eicon/divasfunc.c 2011-11-08 19:02:43.000000000 -0500
33811 +++ linux-2.6.32.49/drivers/isdn/hardware/eicon/divasfunc.c 2011-11-15 19:59:43.000000000 -0500
33812 @@ -161,6 +161,8 @@ static int DIVA_INIT_FUNCTION connect_di
33813 IDI_SYNC_REQ req;
33814 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
33815
33816 + pax_track_stack();
33817 +
33818 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
33819
33820 for (x = 0; x < MAX_DESCRIPTORS; x++) {
33821 diff -urNp linux-2.6.32.49/drivers/isdn/hardware/eicon/divasync.h linux-2.6.32.49/drivers/isdn/hardware/eicon/divasync.h
33822 --- linux-2.6.32.49/drivers/isdn/hardware/eicon/divasync.h 2011-11-08 19:02:43.000000000 -0500
33823 +++ linux-2.6.32.49/drivers/isdn/hardware/eicon/divasync.h 2011-11-15 19:59:43.000000000 -0500
33824 @@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
33825 } diva_didd_add_adapter_t;
33826 typedef struct _diva_didd_remove_adapter {
33827 IDI_CALL p_request;
33828 -} diva_didd_remove_adapter_t;
33829 +} __no_const diva_didd_remove_adapter_t;
33830 typedef struct _diva_didd_read_adapter_array {
33831 void * buffer;
33832 dword length;
33833 diff -urNp linux-2.6.32.49/drivers/isdn/hardware/eicon/idifunc.c linux-2.6.32.49/drivers/isdn/hardware/eicon/idifunc.c
33834 --- linux-2.6.32.49/drivers/isdn/hardware/eicon/idifunc.c 2011-11-08 19:02:43.000000000 -0500
33835 +++ linux-2.6.32.49/drivers/isdn/hardware/eicon/idifunc.c 2011-11-15 19:59:43.000000000 -0500
33836 @@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_di
33837 IDI_SYNC_REQ req;
33838 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
33839
33840 + pax_track_stack();
33841 +
33842 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
33843
33844 for (x = 0; x < MAX_DESCRIPTORS; x++) {
33845 diff -urNp linux-2.6.32.49/drivers/isdn/hardware/eicon/message.c linux-2.6.32.49/drivers/isdn/hardware/eicon/message.c
33846 --- linux-2.6.32.49/drivers/isdn/hardware/eicon/message.c 2011-11-08 19:02:43.000000000 -0500
33847 +++ linux-2.6.32.49/drivers/isdn/hardware/eicon/message.c 2011-11-15 19:59:43.000000000 -0500
33848 @@ -4889,6 +4889,8 @@ static void sig_ind(PLCI *plci)
33849 dword d;
33850 word w;
33851
33852 + pax_track_stack();
33853 +
33854 a = plci->adapter;
33855 Id = ((word)plci->Id<<8)|a->Id;
33856 PUT_WORD(&SS_Ind[4],0x0000);
33857 @@ -7484,6 +7486,8 @@ static word add_b1(PLCI *plci, API_PARSE
33858 word j, n, w;
33859 dword d;
33860
33861 + pax_track_stack();
33862 +
33863
33864 for(i=0;i<8;i++) bp_parms[i].length = 0;
33865 for(i=0;i<2;i++) global_config[i].length = 0;
33866 @@ -7958,6 +7962,8 @@ static word add_b23(PLCI *plci, API_PARS
33867 const byte llc3[] = {4,3,2,2,6,6,0};
33868 const byte header[] = {0,2,3,3,0,0,0};
33869
33870 + pax_track_stack();
33871 +
33872 for(i=0;i<8;i++) bp_parms[i].length = 0;
33873 for(i=0;i<6;i++) b2_config_parms[i].length = 0;
33874 for(i=0;i<5;i++) b3_config_parms[i].length = 0;
33875 @@ -14761,6 +14767,8 @@ static void group_optimization(DIVA_CAPI
33876 word appl_number_group_type[MAX_APPL];
33877 PLCI *auxplci;
33878
33879 + pax_track_stack();
33880 +
33881 set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
33882
33883 if(!a->group_optimization_enabled)
33884 diff -urNp linux-2.6.32.49/drivers/isdn/hardware/eicon/mntfunc.c linux-2.6.32.49/drivers/isdn/hardware/eicon/mntfunc.c
33885 --- linux-2.6.32.49/drivers/isdn/hardware/eicon/mntfunc.c 2011-11-08 19:02:43.000000000 -0500
33886 +++ linux-2.6.32.49/drivers/isdn/hardware/eicon/mntfunc.c 2011-11-15 19:59:43.000000000 -0500
33887 @@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_di
33888 IDI_SYNC_REQ req;
33889 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
33890
33891 + pax_track_stack();
33892 +
33893 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
33894
33895 for (x = 0; x < MAX_DESCRIPTORS; x++) {
33896 diff -urNp linux-2.6.32.49/drivers/isdn/hardware/eicon/xdi_adapter.h linux-2.6.32.49/drivers/isdn/hardware/eicon/xdi_adapter.h
33897 --- linux-2.6.32.49/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-11-08 19:02:43.000000000 -0500
33898 +++ linux-2.6.32.49/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-11-15 19:59:43.000000000 -0500
33899 @@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
33900 typedef struct _diva_os_idi_adapter_interface {
33901 diva_init_card_proc_t cleanup_adapter_proc;
33902 diva_cmd_card_proc_t cmd_proc;
33903 -} diva_os_idi_adapter_interface_t;
33904 +} __no_const diva_os_idi_adapter_interface_t;
33905
33906 typedef struct _diva_os_xdi_adapter {
33907 struct list_head link;
33908 diff -urNp linux-2.6.32.49/drivers/isdn/i4l/isdn_common.c linux-2.6.32.49/drivers/isdn/i4l/isdn_common.c
33909 --- linux-2.6.32.49/drivers/isdn/i4l/isdn_common.c 2011-11-08 19:02:43.000000000 -0500
33910 +++ linux-2.6.32.49/drivers/isdn/i4l/isdn_common.c 2011-11-15 19:59:43.000000000 -0500
33911 @@ -1290,6 +1290,8 @@ isdn_ioctl(struct inode *inode, struct f
33912 } iocpar;
33913 void __user *argp = (void __user *)arg;
33914
33915 + pax_track_stack();
33916 +
33917 #define name iocpar.name
33918 #define bname iocpar.bname
33919 #define iocts iocpar.iocts
33920 diff -urNp linux-2.6.32.49/drivers/isdn/icn/icn.c linux-2.6.32.49/drivers/isdn/icn/icn.c
33921 --- linux-2.6.32.49/drivers/isdn/icn/icn.c 2011-11-08 19:02:43.000000000 -0500
33922 +++ linux-2.6.32.49/drivers/isdn/icn/icn.c 2011-11-15 19:59:43.000000000 -0500
33923 @@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len
33924 if (count > len)
33925 count = len;
33926 if (user) {
33927 - if (copy_from_user(msg, buf, count))
33928 + if (count > sizeof msg || copy_from_user(msg, buf, count))
33929 return -EFAULT;
33930 } else
33931 memcpy(msg, buf, count);
33932 diff -urNp linux-2.6.32.49/drivers/isdn/mISDN/socket.c linux-2.6.32.49/drivers/isdn/mISDN/socket.c
33933 --- linux-2.6.32.49/drivers/isdn/mISDN/socket.c 2011-11-08 19:02:43.000000000 -0500
33934 +++ linux-2.6.32.49/drivers/isdn/mISDN/socket.c 2011-11-15 19:59:43.000000000 -0500
33935 @@ -391,6 +391,7 @@ data_sock_ioctl(struct socket *sock, uns
33936 if (dev) {
33937 struct mISDN_devinfo di;
33938
33939 + memset(&di, 0, sizeof(di));
33940 di.id = dev->id;
33941 di.Dprotocols = dev->Dprotocols;
33942 di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
33943 @@ -671,6 +672,7 @@ base_sock_ioctl(struct socket *sock, uns
33944 if (dev) {
33945 struct mISDN_devinfo di;
33946
33947 + memset(&di, 0, sizeof(di));
33948 di.id = dev->id;
33949 di.Dprotocols = dev->Dprotocols;
33950 di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
33951 diff -urNp linux-2.6.32.49/drivers/isdn/sc/interrupt.c linux-2.6.32.49/drivers/isdn/sc/interrupt.c
33952 --- linux-2.6.32.49/drivers/isdn/sc/interrupt.c 2011-11-08 19:02:43.000000000 -0500
33953 +++ linux-2.6.32.49/drivers/isdn/sc/interrupt.c 2011-11-15 19:59:43.000000000 -0500
33954 @@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy,
33955 }
33956 else if(callid>=0x0000 && callid<=0x7FFF)
33957 {
33958 + int len;
33959 +
33960 pr_debug("%s: Got Incoming Call\n",
33961 sc_adapter[card]->devicename);
33962 - strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4]));
33963 - strcpy(setup.eazmsn,
33964 - sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn);
33965 + len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]),
33966 + sizeof(setup.phone));
33967 + if (len >= sizeof(setup.phone))
33968 + continue;
33969 + len = strlcpy(setup.eazmsn,
33970 + sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
33971 + sizeof(setup.eazmsn));
33972 + if (len >= sizeof(setup.eazmsn))
33973 + continue;
33974 setup.si1 = 7;
33975 setup.si2 = 0;
33976 setup.plan = 0;
33977 @@ -176,7 +184,9 @@ irqreturn_t interrupt_handler(int dummy,
33978 * Handle a GetMyNumber Rsp
33979 */
33980 if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){
33981 - strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array);
33982 + strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
33983 + rcvmsg.msg_data.byte_array,
33984 + sizeof(rcvmsg.msg_data.byte_array));
33985 continue;
33986 }
33987
33988 diff -urNp linux-2.6.32.49/drivers/lguest/core.c linux-2.6.32.49/drivers/lguest/core.c
33989 --- linux-2.6.32.49/drivers/lguest/core.c 2011-11-08 19:02:43.000000000 -0500
33990 +++ linux-2.6.32.49/drivers/lguest/core.c 2011-11-15 19:59:43.000000000 -0500
33991 @@ -91,9 +91,17 @@ static __init int map_switcher(void)
33992 * it's worked so far. The end address needs +1 because __get_vm_area
33993 * allocates an extra guard page, so we need space for that.
33994 */
33995 +
33996 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
33997 + switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
33998 + VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
33999 + + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
34000 +#else
34001 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
34002 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
34003 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
34004 +#endif
34005 +
34006 if (!switcher_vma) {
34007 err = -ENOMEM;
34008 printk("lguest: could not map switcher pages high\n");
34009 @@ -118,7 +126,7 @@ static __init int map_switcher(void)
34010 * Now the Switcher is mapped at the right address, we can't fail!
34011 * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
34012 */
34013 - memcpy(switcher_vma->addr, start_switcher_text,
34014 + memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
34015 end_switcher_text - start_switcher_text);
34016
34017 printk(KERN_INFO "lguest: mapped switcher at %p\n",
34018 diff -urNp linux-2.6.32.49/drivers/lguest/x86/core.c linux-2.6.32.49/drivers/lguest/x86/core.c
34019 --- linux-2.6.32.49/drivers/lguest/x86/core.c 2011-11-08 19:02:43.000000000 -0500
34020 +++ linux-2.6.32.49/drivers/lguest/x86/core.c 2011-11-15 19:59:43.000000000 -0500
34021 @@ -59,7 +59,7 @@ static struct {
34022 /* Offset from where switcher.S was compiled to where we've copied it */
34023 static unsigned long switcher_offset(void)
34024 {
34025 - return SWITCHER_ADDR - (unsigned long)start_switcher_text;
34026 + return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
34027 }
34028
34029 /* This cpu's struct lguest_pages. */
34030 @@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg
34031 * These copies are pretty cheap, so we do them unconditionally: */
34032 /* Save the current Host top-level page directory.
34033 */
34034 +
34035 +#ifdef CONFIG_PAX_PER_CPU_PGD
34036 + pages->state.host_cr3 = read_cr3();
34037 +#else
34038 pages->state.host_cr3 = __pa(current->mm->pgd);
34039 +#endif
34040 +
34041 /*
34042 * Set up the Guest's page tables to see this CPU's pages (and no
34043 * other CPU's pages).
34044 @@ -535,7 +541,7 @@ void __init lguest_arch_host_init(void)
34045 * compiled-in switcher code and the high-mapped copy we just made.
34046 */
34047 for (i = 0; i < IDT_ENTRIES; i++)
34048 - default_idt_entries[i] += switcher_offset();
34049 + default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
34050
34051 /*
34052 * Set up the Switcher's per-cpu areas.
34053 @@ -618,7 +624,7 @@ void __init lguest_arch_host_init(void)
34054 * it will be undisturbed when we switch. To change %cs and jump we
34055 * need this structure to feed to Intel's "lcall" instruction.
34056 */
34057 - lguest_entry.offset = (long)switch_to_guest + switcher_offset();
34058 + lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
34059 lguest_entry.segment = LGUEST_CS;
34060
34061 /*
34062 diff -urNp linux-2.6.32.49/drivers/lguest/x86/switcher_32.S linux-2.6.32.49/drivers/lguest/x86/switcher_32.S
34063 --- linux-2.6.32.49/drivers/lguest/x86/switcher_32.S 2011-11-08 19:02:43.000000000 -0500
34064 +++ linux-2.6.32.49/drivers/lguest/x86/switcher_32.S 2011-11-15 19:59:43.000000000 -0500
34065 @@ -87,6 +87,7 @@
34066 #include <asm/page.h>
34067 #include <asm/segment.h>
34068 #include <asm/lguest.h>
34069 +#include <asm/processor-flags.h>
34070
34071 // We mark the start of the code to copy
34072 // It's placed in .text tho it's never run here
34073 @@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
34074 // Changes type when we load it: damn Intel!
34075 // For after we switch over our page tables
34076 // That entry will be read-only: we'd crash.
34077 +
34078 +#ifdef CONFIG_PAX_KERNEXEC
34079 + mov %cr0, %edx
34080 + xor $X86_CR0_WP, %edx
34081 + mov %edx, %cr0
34082 +#endif
34083 +
34084 movl $(GDT_ENTRY_TSS*8), %edx
34085 ltr %dx
34086
34087 @@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
34088 // Let's clear it again for our return.
34089 // The GDT descriptor of the Host
34090 // Points to the table after two "size" bytes
34091 - movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
34092 + movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
34093 // Clear "used" from type field (byte 5, bit 2)
34094 - andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
34095 + andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
34096 +
34097 +#ifdef CONFIG_PAX_KERNEXEC
34098 + mov %cr0, %eax
34099 + xor $X86_CR0_WP, %eax
34100 + mov %eax, %cr0
34101 +#endif
34102
34103 // Once our page table's switched, the Guest is live!
34104 // The Host fades as we run this final step.
34105 @@ -295,13 +309,12 @@ deliver_to_host:
34106 // I consulted gcc, and it gave
34107 // These instructions, which I gladly credit:
34108 leal (%edx,%ebx,8), %eax
34109 - movzwl (%eax),%edx
34110 - movl 4(%eax), %eax
34111 - xorw %ax, %ax
34112 - orl %eax, %edx
34113 + movl 4(%eax), %edx
34114 + movw (%eax), %dx
34115 // Now the address of the handler's in %edx
34116 // We call it now: its "iret" drops us home.
34117 - jmp *%edx
34118 + ljmp $__KERNEL_CS, $1f
34119 +1: jmp *%edx
34120
34121 // Every interrupt can come to us here
34122 // But we must truly tell each apart.
34123 diff -urNp linux-2.6.32.49/drivers/macintosh/macio_asic.c linux-2.6.32.49/drivers/macintosh/macio_asic.c
34124 --- linux-2.6.32.49/drivers/macintosh/macio_asic.c 2011-11-08 19:02:43.000000000 -0500
34125 +++ linux-2.6.32.49/drivers/macintosh/macio_asic.c 2011-11-18 18:01:55.000000000 -0500
34126 @@ -701,7 +701,7 @@ static void __devexit macio_pci_remove(s
34127 * MacIO is matched against any Apple ID, it's probe() function
34128 * will then decide wether it applies or not
34129 */
34130 -static const struct pci_device_id __devinitdata pci_ids [] = { {
34131 +static const struct pci_device_id __devinitconst pci_ids [] = { {
34132 .vendor = PCI_VENDOR_ID_APPLE,
34133 .device = PCI_ANY_ID,
34134 .subvendor = PCI_ANY_ID,
34135 diff -urNp linux-2.6.32.49/drivers/macintosh/via-pmu-backlight.c linux-2.6.32.49/drivers/macintosh/via-pmu-backlight.c
34136 --- linux-2.6.32.49/drivers/macintosh/via-pmu-backlight.c 2011-11-08 19:02:43.000000000 -0500
34137 +++ linux-2.6.32.49/drivers/macintosh/via-pmu-backlight.c 2011-11-15 19:59:43.000000000 -0500
34138 @@ -15,7 +15,7 @@
34139
34140 #define MAX_PMU_LEVEL 0xFF
34141
34142 -static struct backlight_ops pmu_backlight_data;
34143 +static const struct backlight_ops pmu_backlight_data;
34144 static DEFINE_SPINLOCK(pmu_backlight_lock);
34145 static int sleeping, uses_pmu_bl;
34146 static u8 bl_curve[FB_BACKLIGHT_LEVELS];
34147 @@ -115,7 +115,7 @@ static int pmu_backlight_get_brightness(
34148 return bd->props.brightness;
34149 }
34150
34151 -static struct backlight_ops pmu_backlight_data = {
34152 +static const struct backlight_ops pmu_backlight_data = {
34153 .get_brightness = pmu_backlight_get_brightness,
34154 .update_status = pmu_backlight_update_status,
34155
34156 diff -urNp linux-2.6.32.49/drivers/macintosh/via-pmu.c linux-2.6.32.49/drivers/macintosh/via-pmu.c
34157 --- linux-2.6.32.49/drivers/macintosh/via-pmu.c 2011-11-08 19:02:43.000000000 -0500
34158 +++ linux-2.6.32.49/drivers/macintosh/via-pmu.c 2011-11-15 19:59:43.000000000 -0500
34159 @@ -2232,7 +2232,7 @@ static int pmu_sleep_valid(suspend_state
34160 && (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
34161 }
34162
34163 -static struct platform_suspend_ops pmu_pm_ops = {
34164 +static const struct platform_suspend_ops pmu_pm_ops = {
34165 .enter = powerbook_sleep,
34166 .valid = pmu_sleep_valid,
34167 };
34168 diff -urNp linux-2.6.32.49/drivers/md/dm.c linux-2.6.32.49/drivers/md/dm.c
34169 --- linux-2.6.32.49/drivers/md/dm.c 2011-11-08 19:02:43.000000000 -0500
34170 +++ linux-2.6.32.49/drivers/md/dm.c 2011-11-15 19:59:43.000000000 -0500
34171 @@ -165,9 +165,9 @@ struct mapped_device {
34172 /*
34173 * Event handling.
34174 */
34175 - atomic_t event_nr;
34176 + atomic_unchecked_t event_nr;
34177 wait_queue_head_t eventq;
34178 - atomic_t uevent_seq;
34179 + atomic_unchecked_t uevent_seq;
34180 struct list_head uevent_list;
34181 spinlock_t uevent_lock; /* Protect access to uevent_list */
34182
34183 @@ -1776,8 +1776,8 @@ static struct mapped_device *alloc_dev(i
34184 rwlock_init(&md->map_lock);
34185 atomic_set(&md->holders, 1);
34186 atomic_set(&md->open_count, 0);
34187 - atomic_set(&md->event_nr, 0);
34188 - atomic_set(&md->uevent_seq, 0);
34189 + atomic_set_unchecked(&md->event_nr, 0);
34190 + atomic_set_unchecked(&md->uevent_seq, 0);
34191 INIT_LIST_HEAD(&md->uevent_list);
34192 spin_lock_init(&md->uevent_lock);
34193
34194 @@ -1927,7 +1927,7 @@ static void event_callback(void *context
34195
34196 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
34197
34198 - atomic_inc(&md->event_nr);
34199 + atomic_inc_unchecked(&md->event_nr);
34200 wake_up(&md->eventq);
34201 }
34202
34203 @@ -2562,18 +2562,18 @@ void dm_kobject_uevent(struct mapped_dev
34204
34205 uint32_t dm_next_uevent_seq(struct mapped_device *md)
34206 {
34207 - return atomic_add_return(1, &md->uevent_seq);
34208 + return atomic_add_return_unchecked(1, &md->uevent_seq);
34209 }
34210
34211 uint32_t dm_get_event_nr(struct mapped_device *md)
34212 {
34213 - return atomic_read(&md->event_nr);
34214 + return atomic_read_unchecked(&md->event_nr);
34215 }
34216
34217 int dm_wait_event(struct mapped_device *md, int event_nr)
34218 {
34219 return wait_event_interruptible(md->eventq,
34220 - (event_nr != atomic_read(&md->event_nr)));
34221 + (event_nr != atomic_read_unchecked(&md->event_nr)));
34222 }
34223
34224 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
34225 diff -urNp linux-2.6.32.49/drivers/md/dm-ioctl.c linux-2.6.32.49/drivers/md/dm-ioctl.c
34226 --- linux-2.6.32.49/drivers/md/dm-ioctl.c 2011-11-08 19:02:43.000000000 -0500
34227 +++ linux-2.6.32.49/drivers/md/dm-ioctl.c 2011-11-15 19:59:43.000000000 -0500
34228 @@ -1437,7 +1437,7 @@ static int validate_params(uint cmd, str
34229 cmd == DM_LIST_VERSIONS_CMD)
34230 return 0;
34231
34232 - if ((cmd == DM_DEV_CREATE_CMD)) {
34233 + if (cmd == DM_DEV_CREATE_CMD) {
34234 if (!*param->name) {
34235 DMWARN("name not supplied when creating device");
34236 return -EINVAL;
34237 diff -urNp linux-2.6.32.49/drivers/md/dm-raid1.c linux-2.6.32.49/drivers/md/dm-raid1.c
34238 --- linux-2.6.32.49/drivers/md/dm-raid1.c 2011-11-08 19:02:43.000000000 -0500
34239 +++ linux-2.6.32.49/drivers/md/dm-raid1.c 2011-11-15 19:59:43.000000000 -0500
34240 @@ -41,7 +41,7 @@ enum dm_raid1_error {
34241
34242 struct mirror {
34243 struct mirror_set *ms;
34244 - atomic_t error_count;
34245 + atomic_unchecked_t error_count;
34246 unsigned long error_type;
34247 struct dm_dev *dev;
34248 sector_t offset;
34249 @@ -203,7 +203,7 @@ static void fail_mirror(struct mirror *m
34250 * simple way to tell if a device has encountered
34251 * errors.
34252 */
34253 - atomic_inc(&m->error_count);
34254 + atomic_inc_unchecked(&m->error_count);
34255
34256 if (test_and_set_bit(error_type, &m->error_type))
34257 return;
34258 @@ -225,7 +225,7 @@ static void fail_mirror(struct mirror *m
34259 }
34260
34261 for (new = ms->mirror; new < ms->mirror + ms->nr_mirrors; new++)
34262 - if (!atomic_read(&new->error_count)) {
34263 + if (!atomic_read_unchecked(&new->error_count)) {
34264 set_default_mirror(new);
34265 break;
34266 }
34267 @@ -363,7 +363,7 @@ static struct mirror *choose_mirror(stru
34268 struct mirror *m = get_default_mirror(ms);
34269
34270 do {
34271 - if (likely(!atomic_read(&m->error_count)))
34272 + if (likely(!atomic_read_unchecked(&m->error_count)))
34273 return m;
34274
34275 if (m-- == ms->mirror)
34276 @@ -377,7 +377,7 @@ static int default_ok(struct mirror *m)
34277 {
34278 struct mirror *default_mirror = get_default_mirror(m->ms);
34279
34280 - return !atomic_read(&default_mirror->error_count);
34281 + return !atomic_read_unchecked(&default_mirror->error_count);
34282 }
34283
34284 static int mirror_available(struct mirror_set *ms, struct bio *bio)
34285 @@ -484,7 +484,7 @@ static void do_reads(struct mirror_set *
34286 */
34287 if (likely(region_in_sync(ms, region, 1)))
34288 m = choose_mirror(ms, bio->bi_sector);
34289 - else if (m && atomic_read(&m->error_count))
34290 + else if (m && atomic_read_unchecked(&m->error_count))
34291 m = NULL;
34292
34293 if (likely(m))
34294 @@ -855,7 +855,7 @@ static int get_mirror(struct mirror_set
34295 }
34296
34297 ms->mirror[mirror].ms = ms;
34298 - atomic_set(&(ms->mirror[mirror].error_count), 0);
34299 + atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
34300 ms->mirror[mirror].error_type = 0;
34301 ms->mirror[mirror].offset = offset;
34302
34303 @@ -1241,7 +1241,7 @@ static void mirror_resume(struct dm_targ
34304 */
34305 static char device_status_char(struct mirror *m)
34306 {
34307 - if (!atomic_read(&(m->error_count)))
34308 + if (!atomic_read_unchecked(&(m->error_count)))
34309 return 'A';
34310
34311 return (test_bit(DM_RAID1_WRITE_ERROR, &(m->error_type))) ? 'D' :
34312 diff -urNp linux-2.6.32.49/drivers/md/dm-stripe.c linux-2.6.32.49/drivers/md/dm-stripe.c
34313 --- linux-2.6.32.49/drivers/md/dm-stripe.c 2011-11-08 19:02:43.000000000 -0500
34314 +++ linux-2.6.32.49/drivers/md/dm-stripe.c 2011-11-15 19:59:43.000000000 -0500
34315 @@ -20,7 +20,7 @@ struct stripe {
34316 struct dm_dev *dev;
34317 sector_t physical_start;
34318
34319 - atomic_t error_count;
34320 + atomic_unchecked_t error_count;
34321 };
34322
34323 struct stripe_c {
34324 @@ -188,7 +188,7 @@ static int stripe_ctr(struct dm_target *
34325 kfree(sc);
34326 return r;
34327 }
34328 - atomic_set(&(sc->stripe[i].error_count), 0);
34329 + atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
34330 }
34331
34332 ti->private = sc;
34333 @@ -257,7 +257,7 @@ static int stripe_status(struct dm_targe
34334 DMEMIT("%d ", sc->stripes);
34335 for (i = 0; i < sc->stripes; i++) {
34336 DMEMIT("%s ", sc->stripe[i].dev->name);
34337 - buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
34338 + buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
34339 'D' : 'A';
34340 }
34341 buffer[i] = '\0';
34342 @@ -304,8 +304,8 @@ static int stripe_end_io(struct dm_targe
34343 */
34344 for (i = 0; i < sc->stripes; i++)
34345 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
34346 - atomic_inc(&(sc->stripe[i].error_count));
34347 - if (atomic_read(&(sc->stripe[i].error_count)) <
34348 + atomic_inc_unchecked(&(sc->stripe[i].error_count));
34349 + if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
34350 DM_IO_ERROR_THRESHOLD)
34351 queue_work(kstriped, &sc->kstriped_ws);
34352 }
34353 diff -urNp linux-2.6.32.49/drivers/md/dm-sysfs.c linux-2.6.32.49/drivers/md/dm-sysfs.c
34354 --- linux-2.6.32.49/drivers/md/dm-sysfs.c 2011-11-08 19:02:43.000000000 -0500
34355 +++ linux-2.6.32.49/drivers/md/dm-sysfs.c 2011-11-15 19:59:43.000000000 -0500
34356 @@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
34357 NULL,
34358 };
34359
34360 -static struct sysfs_ops dm_sysfs_ops = {
34361 +static const struct sysfs_ops dm_sysfs_ops = {
34362 .show = dm_attr_show,
34363 };
34364
34365 diff -urNp linux-2.6.32.49/drivers/md/dm-table.c linux-2.6.32.49/drivers/md/dm-table.c
34366 --- linux-2.6.32.49/drivers/md/dm-table.c 2011-11-08 19:02:43.000000000 -0500
34367 +++ linux-2.6.32.49/drivers/md/dm-table.c 2011-11-15 19:59:43.000000000 -0500
34368 @@ -376,7 +376,7 @@ static int device_area_is_invalid(struct
34369 if (!dev_size)
34370 return 0;
34371
34372 - if ((start >= dev_size) || (start + len > dev_size)) {
34373 + if ((start >= dev_size) || (len > dev_size - start)) {
34374 DMWARN("%s: %s too small for target: "
34375 "start=%llu, len=%llu, dev_size=%llu",
34376 dm_device_name(ti->table->md), bdevname(bdev, b),
34377 diff -urNp linux-2.6.32.49/drivers/md/md.c linux-2.6.32.49/drivers/md/md.c
34378 --- linux-2.6.32.49/drivers/md/md.c 2011-11-08 19:02:43.000000000 -0500
34379 +++ linux-2.6.32.49/drivers/md/md.c 2011-11-15 19:59:43.000000000 -0500
34380 @@ -153,10 +153,10 @@ static int start_readonly;
34381 * start build, activate spare
34382 */
34383 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
34384 -static atomic_t md_event_count;
34385 +static atomic_unchecked_t md_event_count;
34386 void md_new_event(mddev_t *mddev)
34387 {
34388 - atomic_inc(&md_event_count);
34389 + atomic_inc_unchecked(&md_event_count);
34390 wake_up(&md_event_waiters);
34391 }
34392 EXPORT_SYMBOL_GPL(md_new_event);
34393 @@ -166,7 +166,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
34394 */
34395 static void md_new_event_inintr(mddev_t *mddev)
34396 {
34397 - atomic_inc(&md_event_count);
34398 + atomic_inc_unchecked(&md_event_count);
34399 wake_up(&md_event_waiters);
34400 }
34401
34402 @@ -1226,7 +1226,7 @@ static int super_1_load(mdk_rdev_t *rdev
34403
34404 rdev->preferred_minor = 0xffff;
34405 rdev->data_offset = le64_to_cpu(sb->data_offset);
34406 - atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
34407 + atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
34408
34409 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
34410 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
34411 @@ -1400,7 +1400,7 @@ static void super_1_sync(mddev_t *mddev,
34412 else
34413 sb->resync_offset = cpu_to_le64(0);
34414
34415 - sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
34416 + sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
34417
34418 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
34419 sb->size = cpu_to_le64(mddev->dev_sectors);
34420 @@ -2222,7 +2222,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_sho
34421 static ssize_t
34422 errors_show(mdk_rdev_t *rdev, char *page)
34423 {
34424 - return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
34425 + return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
34426 }
34427
34428 static ssize_t
34429 @@ -2231,7 +2231,7 @@ errors_store(mdk_rdev_t *rdev, const cha
34430 char *e;
34431 unsigned long n = simple_strtoul(buf, &e, 10);
34432 if (*buf && (*e == 0 || *e == '\n')) {
34433 - atomic_set(&rdev->corrected_errors, n);
34434 + atomic_set_unchecked(&rdev->corrected_errors, n);
34435 return len;
34436 }
34437 return -EINVAL;
34438 @@ -2525,7 +2525,7 @@ static void rdev_free(struct kobject *ko
34439 mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
34440 kfree(rdev);
34441 }
34442 -static struct sysfs_ops rdev_sysfs_ops = {
34443 +static const struct sysfs_ops rdev_sysfs_ops = {
34444 .show = rdev_attr_show,
34445 .store = rdev_attr_store,
34446 };
34447 @@ -2574,8 +2574,8 @@ static mdk_rdev_t *md_import_device(dev_
34448 rdev->data_offset = 0;
34449 rdev->sb_events = 0;
34450 atomic_set(&rdev->nr_pending, 0);
34451 - atomic_set(&rdev->read_errors, 0);
34452 - atomic_set(&rdev->corrected_errors, 0);
34453 + atomic_set_unchecked(&rdev->read_errors, 0);
34454 + atomic_set_unchecked(&rdev->corrected_errors, 0);
34455
34456 size = rdev->bdev->bd_inode->i_size >> BLOCK_SIZE_BITS;
34457 if (!size) {
34458 @@ -3895,7 +3895,7 @@ static void md_free(struct kobject *ko)
34459 kfree(mddev);
34460 }
34461
34462 -static struct sysfs_ops md_sysfs_ops = {
34463 +static const struct sysfs_ops md_sysfs_ops = {
34464 .show = md_attr_show,
34465 .store = md_attr_store,
34466 };
34467 @@ -4482,7 +4482,8 @@ out:
34468 err = 0;
34469 blk_integrity_unregister(disk);
34470 md_new_event(mddev);
34471 - sysfs_notify_dirent(mddev->sysfs_state);
34472 + if (mddev->sysfs_state)
34473 + sysfs_notify_dirent(mddev->sysfs_state);
34474 return err;
34475 }
34476
34477 @@ -5962,7 +5963,7 @@ static int md_seq_show(struct seq_file *
34478
34479 spin_unlock(&pers_lock);
34480 seq_printf(seq, "\n");
34481 - mi->event = atomic_read(&md_event_count);
34482 + mi->event = atomic_read_unchecked(&md_event_count);
34483 return 0;
34484 }
34485 if (v == (void*)2) {
34486 @@ -6051,7 +6052,7 @@ static int md_seq_show(struct seq_file *
34487 chunk_kb ? "KB" : "B");
34488 if (bitmap->file) {
34489 seq_printf(seq, ", file: ");
34490 - seq_path(seq, &bitmap->file->f_path, " \t\n");
34491 + seq_path(seq, &bitmap->file->f_path, " \t\n\\");
34492 }
34493
34494 seq_printf(seq, "\n");
34495 @@ -6085,7 +6086,7 @@ static int md_seq_open(struct inode *ino
34496 else {
34497 struct seq_file *p = file->private_data;
34498 p->private = mi;
34499 - mi->event = atomic_read(&md_event_count);
34500 + mi->event = atomic_read_unchecked(&md_event_count);
34501 }
34502 return error;
34503 }
34504 @@ -6101,7 +6102,7 @@ static unsigned int mdstat_poll(struct f
34505 /* always allow read */
34506 mask = POLLIN | POLLRDNORM;
34507
34508 - if (mi->event != atomic_read(&md_event_count))
34509 + if (mi->event != atomic_read_unchecked(&md_event_count))
34510 mask |= POLLERR | POLLPRI;
34511 return mask;
34512 }
34513 @@ -6145,7 +6146,7 @@ static int is_mddev_idle(mddev_t *mddev,
34514 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
34515 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
34516 (int)part_stat_read(&disk->part0, sectors[1]) -
34517 - atomic_read(&disk->sync_io);
34518 + atomic_read_unchecked(&disk->sync_io);
34519 /* sync IO will cause sync_io to increase before the disk_stats
34520 * as sync_io is counted when a request starts, and
34521 * disk_stats is counted when it completes.
34522 diff -urNp linux-2.6.32.49/drivers/md/md.h linux-2.6.32.49/drivers/md/md.h
34523 --- linux-2.6.32.49/drivers/md/md.h 2011-11-08 19:02:43.000000000 -0500
34524 +++ linux-2.6.32.49/drivers/md/md.h 2011-11-15 19:59:43.000000000 -0500
34525 @@ -94,10 +94,10 @@ struct mdk_rdev_s
34526 * only maintained for arrays that
34527 * support hot removal
34528 */
34529 - atomic_t read_errors; /* number of consecutive read errors that
34530 + atomic_unchecked_t read_errors; /* number of consecutive read errors that
34531 * we have tried to ignore.
34532 */
34533 - atomic_t corrected_errors; /* number of corrected read errors,
34534 + atomic_unchecked_t corrected_errors; /* number of corrected read errors,
34535 * for reporting to userspace and storing
34536 * in superblock.
34537 */
34538 @@ -304,7 +304,7 @@ static inline void rdev_dec_pending(mdk_
34539
34540 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
34541 {
34542 - atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
34543 + atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
34544 }
34545
34546 struct mdk_personality
34547 diff -urNp linux-2.6.32.49/drivers/md/raid10.c linux-2.6.32.49/drivers/md/raid10.c
34548 --- linux-2.6.32.49/drivers/md/raid10.c 2011-11-08 19:02:43.000000000 -0500
34549 +++ linux-2.6.32.49/drivers/md/raid10.c 2011-11-15 19:59:43.000000000 -0500
34550 @@ -1255,7 +1255,7 @@ static void end_sync_read(struct bio *bi
34551 if (test_bit(BIO_UPTODATE, &bio->bi_flags))
34552 set_bit(R10BIO_Uptodate, &r10_bio->state);
34553 else {
34554 - atomic_add(r10_bio->sectors,
34555 + atomic_add_unchecked(r10_bio->sectors,
34556 &conf->mirrors[d].rdev->corrected_errors);
34557 if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
34558 md_error(r10_bio->mddev,
34559 @@ -1520,7 +1520,7 @@ static void fix_read_error(conf_t *conf,
34560 test_bit(In_sync, &rdev->flags)) {
34561 atomic_inc(&rdev->nr_pending);
34562 rcu_read_unlock();
34563 - atomic_add(s, &rdev->corrected_errors);
34564 + atomic_add_unchecked(s, &rdev->corrected_errors);
34565 if (sync_page_io(rdev->bdev,
34566 r10_bio->devs[sl].addr +
34567 sect + rdev->data_offset,
34568 diff -urNp linux-2.6.32.49/drivers/md/raid1.c linux-2.6.32.49/drivers/md/raid1.c
34569 --- linux-2.6.32.49/drivers/md/raid1.c 2011-11-08 19:02:43.000000000 -0500
34570 +++ linux-2.6.32.49/drivers/md/raid1.c 2011-11-15 19:59:43.000000000 -0500
34571 @@ -1415,7 +1415,7 @@ static void sync_request_write(mddev_t *
34572 if (r1_bio->bios[d]->bi_end_io != end_sync_read)
34573 continue;
34574 rdev = conf->mirrors[d].rdev;
34575 - atomic_add(s, &rdev->corrected_errors);
34576 + atomic_add_unchecked(s, &rdev->corrected_errors);
34577 if (sync_page_io(rdev->bdev,
34578 sect + rdev->data_offset,
34579 s<<9,
34580 @@ -1564,7 +1564,7 @@ static void fix_read_error(conf_t *conf,
34581 /* Well, this device is dead */
34582 md_error(mddev, rdev);
34583 else {
34584 - atomic_add(s, &rdev->corrected_errors);
34585 + atomic_add_unchecked(s, &rdev->corrected_errors);
34586 printk(KERN_INFO
34587 "raid1:%s: read error corrected "
34588 "(%d sectors at %llu on %s)\n",
34589 diff -urNp linux-2.6.32.49/drivers/md/raid5.c linux-2.6.32.49/drivers/md/raid5.c
34590 --- linux-2.6.32.49/drivers/md/raid5.c 2011-11-26 19:44:53.000000000 -0500
34591 +++ linux-2.6.32.49/drivers/md/raid5.c 2011-11-26 19:45:06.000000000 -0500
34592 @@ -482,7 +482,7 @@ static void ops_run_io(struct stripe_hea
34593 bi->bi_next = NULL;
34594 if ((rw & WRITE) &&
34595 test_bit(R5_ReWrite, &sh->dev[i].flags))
34596 - atomic_add(STRIPE_SECTORS,
34597 + atomic_add_unchecked(STRIPE_SECTORS,
34598 &rdev->corrected_errors);
34599 generic_make_request(bi);
34600 } else {
34601 @@ -1517,15 +1517,15 @@ static void raid5_end_read_request(struc
34602 clear_bit(R5_ReadError, &sh->dev[i].flags);
34603 clear_bit(R5_ReWrite, &sh->dev[i].flags);
34604 }
34605 - if (atomic_read(&conf->disks[i].rdev->read_errors))
34606 - atomic_set(&conf->disks[i].rdev->read_errors, 0);
34607 + if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
34608 + atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
34609 } else {
34610 const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
34611 int retry = 0;
34612 rdev = conf->disks[i].rdev;
34613
34614 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
34615 - atomic_inc(&rdev->read_errors);
34616 + atomic_inc_unchecked(&rdev->read_errors);
34617 if (conf->mddev->degraded >= conf->max_degraded)
34618 printk_rl(KERN_WARNING
34619 "raid5:%s: read error not correctable "
34620 @@ -1543,7 +1543,7 @@ static void raid5_end_read_request(struc
34621 (unsigned long long)(sh->sector
34622 + rdev->data_offset),
34623 bdn);
34624 - else if (atomic_read(&rdev->read_errors)
34625 + else if (atomic_read_unchecked(&rdev->read_errors)
34626 > conf->max_nr_stripes)
34627 printk(KERN_WARNING
34628 "raid5:%s: Too many read errors, failing device %s.\n",
34629 @@ -1870,6 +1870,7 @@ static sector_t compute_blocknr(struct s
34630 sector_t r_sector;
34631 struct stripe_head sh2;
34632
34633 + pax_track_stack();
34634
34635 chunk_offset = sector_div(new_sector, sectors_per_chunk);
34636 stripe = new_sector;
34637 diff -urNp linux-2.6.32.49/drivers/media/common/saa7146_hlp.c linux-2.6.32.49/drivers/media/common/saa7146_hlp.c
34638 --- linux-2.6.32.49/drivers/media/common/saa7146_hlp.c 2011-11-08 19:02:43.000000000 -0500
34639 +++ linux-2.6.32.49/drivers/media/common/saa7146_hlp.c 2011-11-15 19:59:43.000000000 -0500
34640 @@ -353,6 +353,8 @@ static void calculate_clipping_registers
34641
34642 int x[32], y[32], w[32], h[32];
34643
34644 + pax_track_stack();
34645 +
34646 /* clear out memory */
34647 memset(&line_list[0], 0x00, sizeof(u32)*32);
34648 memset(&pixel_list[0], 0x00, sizeof(u32)*32);
34649 diff -urNp linux-2.6.32.49/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-2.6.32.49/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
34650 --- linux-2.6.32.49/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-11-08 19:02:43.000000000 -0500
34651 +++ linux-2.6.32.49/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-11-15 19:59:43.000000000 -0500
34652 @@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(stru
34653 u8 buf[HOST_LINK_BUF_SIZE];
34654 int i;
34655
34656 + pax_track_stack();
34657 +
34658 dprintk("%s\n", __func__);
34659
34660 /* check if we have space for a link buf in the rx_buffer */
34661 @@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(s
34662 unsigned long timeout;
34663 int written;
34664
34665 + pax_track_stack();
34666 +
34667 dprintk("%s\n", __func__);
34668
34669 /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
34670 diff -urNp linux-2.6.32.49/drivers/media/dvb/dvb-core/dvb_demux.h linux-2.6.32.49/drivers/media/dvb/dvb-core/dvb_demux.h
34671 --- linux-2.6.32.49/drivers/media/dvb/dvb-core/dvb_demux.h 2011-11-08 19:02:43.000000000 -0500
34672 +++ linux-2.6.32.49/drivers/media/dvb/dvb-core/dvb_demux.h 2011-11-15 19:59:43.000000000 -0500
34673 @@ -71,7 +71,7 @@ struct dvb_demux_feed {
34674 union {
34675 dmx_ts_cb ts;
34676 dmx_section_cb sec;
34677 - } cb;
34678 + } __no_const cb;
34679
34680 struct dvb_demux *demux;
34681 void *priv;
34682 diff -urNp linux-2.6.32.49/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.49/drivers/media/dvb/dvb-core/dvbdev.c
34683 --- linux-2.6.32.49/drivers/media/dvb/dvb-core/dvbdev.c 2011-11-08 19:02:43.000000000 -0500
34684 +++ linux-2.6.32.49/drivers/media/dvb/dvb-core/dvbdev.c 2011-11-15 19:59:43.000000000 -0500
34685 @@ -191,7 +191,7 @@ int dvb_register_device(struct dvb_adapt
34686 const struct dvb_device *template, void *priv, int type)
34687 {
34688 struct dvb_device *dvbdev;
34689 - struct file_operations *dvbdevfops;
34690 + file_operations_no_const *dvbdevfops;
34691 struct device *clsdev;
34692 int minor;
34693 int id;
34694 diff -urNp linux-2.6.32.49/drivers/media/dvb/dvb-usb/cxusb.c linux-2.6.32.49/drivers/media/dvb/dvb-usb/cxusb.c
34695 --- linux-2.6.32.49/drivers/media/dvb/dvb-usb/cxusb.c 2011-11-08 19:02:43.000000000 -0500
34696 +++ linux-2.6.32.49/drivers/media/dvb/dvb-usb/cxusb.c 2011-11-15 19:59:43.000000000 -0500
34697 @@ -1040,7 +1040,7 @@ static struct dib0070_config dib7070p_di
34698 struct dib0700_adapter_state {
34699 int (*set_param_save) (struct dvb_frontend *,
34700 struct dvb_frontend_parameters *);
34701 -};
34702 +} __no_const;
34703
34704 static int dib7070_set_param_override(struct dvb_frontend *fe,
34705 struct dvb_frontend_parameters *fep)
34706 diff -urNp linux-2.6.32.49/drivers/media/dvb/dvb-usb/dib0700_core.c linux-2.6.32.49/drivers/media/dvb/dvb-usb/dib0700_core.c
34707 --- linux-2.6.32.49/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-11-08 19:02:43.000000000 -0500
34708 +++ linux-2.6.32.49/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-11-15 19:59:43.000000000 -0500
34709 @@ -332,6 +332,8 @@ int dib0700_download_firmware(struct usb
34710
34711 u8 buf[260];
34712
34713 + pax_track_stack();
34714 +
34715 while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
34716 deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",hx.addr, hx.len, hx.chk);
34717
34718 diff -urNp linux-2.6.32.49/drivers/media/dvb/dvb-usb/dib0700_devices.c linux-2.6.32.49/drivers/media/dvb/dvb-usb/dib0700_devices.c
34719 --- linux-2.6.32.49/drivers/media/dvb/dvb-usb/dib0700_devices.c 2011-11-08 19:02:43.000000000 -0500
34720 +++ linux-2.6.32.49/drivers/media/dvb/dvb-usb/dib0700_devices.c 2011-11-15 19:59:43.000000000 -0500
34721 @@ -28,7 +28,7 @@ MODULE_PARM_DESC(force_lna_activation, "
34722
34723 struct dib0700_adapter_state {
34724 int (*set_param_save) (struct dvb_frontend *, struct dvb_frontend_parameters *);
34725 -};
34726 +} __no_const;
34727
34728 /* Hauppauge Nova-T 500 (aka Bristol)
34729 * has a LNA on GPIO0 which is enabled by setting 1 */
34730 diff -urNp linux-2.6.32.49/drivers/media/dvb/frontends/dib3000.h linux-2.6.32.49/drivers/media/dvb/frontends/dib3000.h
34731 --- linux-2.6.32.49/drivers/media/dvb/frontends/dib3000.h 2011-11-08 19:02:43.000000000 -0500
34732 +++ linux-2.6.32.49/drivers/media/dvb/frontends/dib3000.h 2011-11-15 19:59:43.000000000 -0500
34733 @@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
34734 int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
34735 int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
34736 int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
34737 -};
34738 +} __no_const;
34739
34740 #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
34741 extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
34742 diff -urNp linux-2.6.32.49/drivers/media/dvb/frontends/or51211.c linux-2.6.32.49/drivers/media/dvb/frontends/or51211.c
34743 --- linux-2.6.32.49/drivers/media/dvb/frontends/or51211.c 2011-11-08 19:02:43.000000000 -0500
34744 +++ linux-2.6.32.49/drivers/media/dvb/frontends/or51211.c 2011-11-15 19:59:43.000000000 -0500
34745 @@ -113,6 +113,8 @@ static int or51211_load_firmware (struct
34746 u8 tudata[585];
34747 int i;
34748
34749 + pax_track_stack();
34750 +
34751 dprintk("Firmware is %zd bytes\n",fw->size);
34752
34753 /* Get eprom data */
34754 diff -urNp linux-2.6.32.49/drivers/media/radio/radio-cadet.c linux-2.6.32.49/drivers/media/radio/radio-cadet.c
34755 --- linux-2.6.32.49/drivers/media/radio/radio-cadet.c 2011-11-08 19:02:43.000000000 -0500
34756 +++ linux-2.6.32.49/drivers/media/radio/radio-cadet.c 2011-11-15 19:59:43.000000000 -0500
34757 @@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *f
34758 while (i < count && dev->rdsin != dev->rdsout)
34759 readbuf[i++] = dev->rdsbuf[dev->rdsout++];
34760
34761 - if (copy_to_user(data, readbuf, i))
34762 + if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
34763 return -EFAULT;
34764 return i;
34765 }
34766 diff -urNp linux-2.6.32.49/drivers/media/video/cx18/cx18-driver.c linux-2.6.32.49/drivers/media/video/cx18/cx18-driver.c
34767 --- linux-2.6.32.49/drivers/media/video/cx18/cx18-driver.c 2011-11-08 19:02:43.000000000 -0500
34768 +++ linux-2.6.32.49/drivers/media/video/cx18/cx18-driver.c 2011-11-15 19:59:43.000000000 -0500
34769 @@ -56,7 +56,7 @@ static struct pci_device_id cx18_pci_tbl
34770
34771 MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
34772
34773 -static atomic_t cx18_instance = ATOMIC_INIT(0);
34774 +static atomic_unchecked_t cx18_instance = ATOMIC_INIT(0);
34775
34776 /* Parameter declarations */
34777 static int cardtype[CX18_MAX_CARDS];
34778 @@ -288,6 +288,8 @@ void cx18_read_eeprom(struct cx18 *cx, s
34779 struct i2c_client c;
34780 u8 eedata[256];
34781
34782 + pax_track_stack();
34783 +
34784 memset(&c, 0, sizeof(c));
34785 strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
34786 c.adapter = &cx->i2c_adap[0];
34787 @@ -800,7 +802,7 @@ static int __devinit cx18_probe(struct p
34788 struct cx18 *cx;
34789
34790 /* FIXME - module parameter arrays constrain max instances */
34791 - i = atomic_inc_return(&cx18_instance) - 1;
34792 + i = atomic_inc_return_unchecked(&cx18_instance) - 1;
34793 if (i >= CX18_MAX_CARDS) {
34794 printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
34795 "limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
34796 diff -urNp linux-2.6.32.49/drivers/media/video/ivtv/ivtv-driver.c linux-2.6.32.49/drivers/media/video/ivtv/ivtv-driver.c
34797 --- linux-2.6.32.49/drivers/media/video/ivtv/ivtv-driver.c 2011-11-08 19:02:43.000000000 -0500
34798 +++ linux-2.6.32.49/drivers/media/video/ivtv/ivtv-driver.c 2011-11-15 19:59:43.000000000 -0500
34799 @@ -79,7 +79,7 @@ static struct pci_device_id ivtv_pci_tbl
34800 MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
34801
34802 /* ivtv instance counter */
34803 -static atomic_t ivtv_instance = ATOMIC_INIT(0);
34804 +static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
34805
34806 /* Parameter declarations */
34807 static int cardtype[IVTV_MAX_CARDS];
34808 diff -urNp linux-2.6.32.49/drivers/media/video/omap24xxcam.c linux-2.6.32.49/drivers/media/video/omap24xxcam.c
34809 --- linux-2.6.32.49/drivers/media/video/omap24xxcam.c 2011-11-08 19:02:43.000000000 -0500
34810 +++ linux-2.6.32.49/drivers/media/video/omap24xxcam.c 2011-11-15 19:59:43.000000000 -0500
34811 @@ -401,7 +401,7 @@ static void omap24xxcam_vbq_complete(str
34812 spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
34813
34814 do_gettimeofday(&vb->ts);
34815 - vb->field_count = atomic_add_return(2, &fh->field_count);
34816 + vb->field_count = atomic_add_return_unchecked(2, &fh->field_count);
34817 if (csr & csr_error) {
34818 vb->state = VIDEOBUF_ERROR;
34819 if (!atomic_read(&fh->cam->in_reset)) {
34820 diff -urNp linux-2.6.32.49/drivers/media/video/omap24xxcam.h linux-2.6.32.49/drivers/media/video/omap24xxcam.h
34821 --- linux-2.6.32.49/drivers/media/video/omap24xxcam.h 2011-11-08 19:02:43.000000000 -0500
34822 +++ linux-2.6.32.49/drivers/media/video/omap24xxcam.h 2011-11-15 19:59:43.000000000 -0500
34823 @@ -533,7 +533,7 @@ struct omap24xxcam_fh {
34824 spinlock_t vbq_lock; /* spinlock for the videobuf queue */
34825 struct videobuf_queue vbq;
34826 struct v4l2_pix_format pix; /* serialise pix by vbq->lock */
34827 - atomic_t field_count; /* field counter for videobuf_buffer */
34828 + atomic_unchecked_t field_count; /* field counter for videobuf_buffer */
34829 /* accessing cam here doesn't need serialisation: it's constant */
34830 struct omap24xxcam_device *cam;
34831 };
34832 diff -urNp linux-2.6.32.49/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-2.6.32.49/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
34833 --- linux-2.6.32.49/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-11-08 19:02:43.000000000 -0500
34834 +++ linux-2.6.32.49/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-11-15 19:59:43.000000000 -0500
34835 @@ -119,6 +119,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw
34836 u8 *eeprom;
34837 struct tveeprom tvdata;
34838
34839 + pax_track_stack();
34840 +
34841 memset(&tvdata,0,sizeof(tvdata));
34842
34843 eeprom = pvr2_eeprom_fetch(hdw);
34844 diff -urNp linux-2.6.32.49/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h linux-2.6.32.49/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
34845 --- linux-2.6.32.49/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h 2011-11-08 19:02:43.000000000 -0500
34846 +++ linux-2.6.32.49/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h 2011-11-15 19:59:43.000000000 -0500
34847 @@ -195,7 +195,7 @@ struct pvr2_hdw {
34848
34849 /* I2C stuff */
34850 struct i2c_adapter i2c_adap;
34851 - struct i2c_algorithm i2c_algo;
34852 + i2c_algorithm_no_const i2c_algo;
34853 pvr2_i2c_func i2c_func[PVR2_I2C_FUNC_CNT];
34854 int i2c_cx25840_hack_state;
34855 int i2c_linked;
34856 diff -urNp linux-2.6.32.49/drivers/media/video/saa7134/saa6752hs.c linux-2.6.32.49/drivers/media/video/saa7134/saa6752hs.c
34857 --- linux-2.6.32.49/drivers/media/video/saa7134/saa6752hs.c 2011-11-08 19:02:43.000000000 -0500
34858 +++ linux-2.6.32.49/drivers/media/video/saa7134/saa6752hs.c 2011-11-15 19:59:43.000000000 -0500
34859 @@ -683,6 +683,8 @@ static int saa6752hs_init(struct v4l2_su
34860 unsigned char localPAT[256];
34861 unsigned char localPMT[256];
34862
34863 + pax_track_stack();
34864 +
34865 /* Set video format - must be done first as it resets other settings */
34866 set_reg8(client, 0x41, h->video_format);
34867
34868 diff -urNp linux-2.6.32.49/drivers/media/video/saa7164/saa7164-cmd.c linux-2.6.32.49/drivers/media/video/saa7164/saa7164-cmd.c
34869 --- linux-2.6.32.49/drivers/media/video/saa7164/saa7164-cmd.c 2011-11-08 19:02:43.000000000 -0500
34870 +++ linux-2.6.32.49/drivers/media/video/saa7164/saa7164-cmd.c 2011-11-15 19:59:43.000000000 -0500
34871 @@ -87,6 +87,8 @@ int saa7164_irq_dequeue(struct saa7164_d
34872 wait_queue_head_t *q = 0;
34873 dprintk(DBGLVL_CMD, "%s()\n", __func__);
34874
34875 + pax_track_stack();
34876 +
34877 /* While any outstand message on the bus exists... */
34878 do {
34879
34880 @@ -126,6 +128,8 @@ int saa7164_cmd_dequeue(struct saa7164_d
34881 u8 tmp[512];
34882 dprintk(DBGLVL_CMD, "%s()\n", __func__);
34883
34884 + pax_track_stack();
34885 +
34886 while (loop) {
34887
34888 tmComResInfo_t tRsp = { 0, 0, 0, 0, 0, 0 };
34889 diff -urNp linux-2.6.32.49/drivers/media/video/usbvideo/ibmcam.c linux-2.6.32.49/drivers/media/video/usbvideo/ibmcam.c
34890 --- linux-2.6.32.49/drivers/media/video/usbvideo/ibmcam.c 2011-11-08 19:02:43.000000000 -0500
34891 +++ linux-2.6.32.49/drivers/media/video/usbvideo/ibmcam.c 2011-11-15 19:59:43.000000000 -0500
34892 @@ -3947,15 +3947,15 @@ static struct usb_device_id id_table[] =
34893 static int __init ibmcam_init(void)
34894 {
34895 struct usbvideo_cb cbTbl;
34896 - memset(&cbTbl, 0, sizeof(cbTbl));
34897 - cbTbl.probe = ibmcam_probe;
34898 - cbTbl.setupOnOpen = ibmcam_setup_on_open;
34899 - cbTbl.videoStart = ibmcam_video_start;
34900 - cbTbl.videoStop = ibmcam_video_stop;
34901 - cbTbl.processData = ibmcam_ProcessIsocData;
34902 - cbTbl.postProcess = usbvideo_DeinterlaceFrame;
34903 - cbTbl.adjustPicture = ibmcam_adjust_picture;
34904 - cbTbl.getFPS = ibmcam_calculate_fps;
34905 + memset((void *)&cbTbl, 0, sizeof(cbTbl));
34906 + *(void **)&cbTbl.probe = ibmcam_probe;
34907 + *(void **)&cbTbl.setupOnOpen = ibmcam_setup_on_open;
34908 + *(void **)&cbTbl.videoStart = ibmcam_video_start;
34909 + *(void **)&cbTbl.videoStop = ibmcam_video_stop;
34910 + *(void **)&cbTbl.processData = ibmcam_ProcessIsocData;
34911 + *(void **)&cbTbl.postProcess = usbvideo_DeinterlaceFrame;
34912 + *(void **)&cbTbl.adjustPicture = ibmcam_adjust_picture;
34913 + *(void **)&cbTbl.getFPS = ibmcam_calculate_fps;
34914 return usbvideo_register(
34915 &cams,
34916 MAX_IBMCAM,
34917 diff -urNp linux-2.6.32.49/drivers/media/video/usbvideo/konicawc.c linux-2.6.32.49/drivers/media/video/usbvideo/konicawc.c
34918 --- linux-2.6.32.49/drivers/media/video/usbvideo/konicawc.c 2011-11-08 19:02:43.000000000 -0500
34919 +++ linux-2.6.32.49/drivers/media/video/usbvideo/konicawc.c 2011-11-15 19:59:43.000000000 -0500
34920 @@ -225,7 +225,7 @@ static void konicawc_register_input(stru
34921 int error;
34922
34923 usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
34924 - strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
34925 + strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
34926
34927 cam->input = input_dev = input_allocate_device();
34928 if (!input_dev) {
34929 @@ -935,16 +935,16 @@ static int __init konicawc_init(void)
34930 struct usbvideo_cb cbTbl;
34931 printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_VERSION ":"
34932 DRIVER_DESC "\n");
34933 - memset(&cbTbl, 0, sizeof(cbTbl));
34934 - cbTbl.probe = konicawc_probe;
34935 - cbTbl.setupOnOpen = konicawc_setup_on_open;
34936 - cbTbl.processData = konicawc_process_isoc;
34937 - cbTbl.getFPS = konicawc_calculate_fps;
34938 - cbTbl.setVideoMode = konicawc_set_video_mode;
34939 - cbTbl.startDataPump = konicawc_start_data;
34940 - cbTbl.stopDataPump = konicawc_stop_data;
34941 - cbTbl.adjustPicture = konicawc_adjust_picture;
34942 - cbTbl.userFree = konicawc_free_uvd;
34943 + memset((void * )&cbTbl, 0, sizeof(cbTbl));
34944 + *(void **)&cbTbl.probe = konicawc_probe;
34945 + *(void **)&cbTbl.setupOnOpen = konicawc_setup_on_open;
34946 + *(void **)&cbTbl.processData = konicawc_process_isoc;
34947 + *(void **)&cbTbl.getFPS = konicawc_calculate_fps;
34948 + *(void **)&cbTbl.setVideoMode = konicawc_set_video_mode;
34949 + *(void **)&cbTbl.startDataPump = konicawc_start_data;
34950 + *(void **)&cbTbl.stopDataPump = konicawc_stop_data;
34951 + *(void **)&cbTbl.adjustPicture = konicawc_adjust_picture;
34952 + *(void **)&cbTbl.userFree = konicawc_free_uvd;
34953 return usbvideo_register(
34954 &cams,
34955 MAX_CAMERAS,
34956 diff -urNp linux-2.6.32.49/drivers/media/video/usbvideo/quickcam_messenger.c linux-2.6.32.49/drivers/media/video/usbvideo/quickcam_messenger.c
34957 --- linux-2.6.32.49/drivers/media/video/usbvideo/quickcam_messenger.c 2011-11-08 19:02:43.000000000 -0500
34958 +++ linux-2.6.32.49/drivers/media/video/usbvideo/quickcam_messenger.c 2011-11-15 19:59:43.000000000 -0500
34959 @@ -89,7 +89,7 @@ static void qcm_register_input(struct qc
34960 int error;
34961
34962 usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
34963 - strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
34964 + strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
34965
34966 cam->input = input_dev = input_allocate_device();
34967 if (!input_dev) {
34968 diff -urNp linux-2.6.32.49/drivers/media/video/usbvideo/ultracam.c linux-2.6.32.49/drivers/media/video/usbvideo/ultracam.c
34969 --- linux-2.6.32.49/drivers/media/video/usbvideo/ultracam.c 2011-11-08 19:02:43.000000000 -0500
34970 +++ linux-2.6.32.49/drivers/media/video/usbvideo/ultracam.c 2011-11-15 19:59:43.000000000 -0500
34971 @@ -655,14 +655,14 @@ static int __init ultracam_init(void)
34972 {
34973 struct usbvideo_cb cbTbl;
34974 memset(&cbTbl, 0, sizeof(cbTbl));
34975 - cbTbl.probe = ultracam_probe;
34976 - cbTbl.setupOnOpen = ultracam_setup_on_open;
34977 - cbTbl.videoStart = ultracam_video_start;
34978 - cbTbl.videoStop = ultracam_video_stop;
34979 - cbTbl.processData = ultracam_ProcessIsocData;
34980 - cbTbl.postProcess = usbvideo_DeinterlaceFrame;
34981 - cbTbl.adjustPicture = ultracam_adjust_picture;
34982 - cbTbl.getFPS = ultracam_calculate_fps;
34983 + *(void **)&cbTbl.probe = ultracam_probe;
34984 + *(void **)&cbTbl.setupOnOpen = ultracam_setup_on_open;
34985 + *(void **)&cbTbl.videoStart = ultracam_video_start;
34986 + *(void **)&cbTbl.videoStop = ultracam_video_stop;
34987 + *(void **)&cbTbl.processData = ultracam_ProcessIsocData;
34988 + *(void **)&cbTbl.postProcess = usbvideo_DeinterlaceFrame;
34989 + *(void **)&cbTbl.adjustPicture = ultracam_adjust_picture;
34990 + *(void **)&cbTbl.getFPS = ultracam_calculate_fps;
34991 return usbvideo_register(
34992 &cams,
34993 MAX_CAMERAS,
34994 diff -urNp linux-2.6.32.49/drivers/media/video/usbvideo/usbvideo.c linux-2.6.32.49/drivers/media/video/usbvideo/usbvideo.c
34995 --- linux-2.6.32.49/drivers/media/video/usbvideo/usbvideo.c 2011-11-08 19:02:43.000000000 -0500
34996 +++ linux-2.6.32.49/drivers/media/video/usbvideo/usbvideo.c 2011-11-15 19:59:43.000000000 -0500
34997 @@ -697,15 +697,15 @@ int usbvideo_register(
34998 __func__, cams, base_size, num_cams);
34999
35000 /* Copy callbacks, apply defaults for those that are not set */
35001 - memmove(&cams->cb, cbTbl, sizeof(cams->cb));
35002 + memmove((void *)&cams->cb, cbTbl, sizeof(cams->cb));
35003 if (cams->cb.getFrame == NULL)
35004 - cams->cb.getFrame = usbvideo_GetFrame;
35005 + *(void **)&cams->cb.getFrame = usbvideo_GetFrame;
35006 if (cams->cb.disconnect == NULL)
35007 - cams->cb.disconnect = usbvideo_Disconnect;
35008 + *(void **)&cams->cb.disconnect = usbvideo_Disconnect;
35009 if (cams->cb.startDataPump == NULL)
35010 - cams->cb.startDataPump = usbvideo_StartDataPump;
35011 + *(void **)&cams->cb.startDataPump = usbvideo_StartDataPump;
35012 if (cams->cb.stopDataPump == NULL)
35013 - cams->cb.stopDataPump = usbvideo_StopDataPump;
35014 + *(void **)&cams->cb.stopDataPump = usbvideo_StopDataPump;
35015
35016 cams->num_cameras = num_cams;
35017 cams->cam = (struct uvd *) &cams[1];
35018 diff -urNp linux-2.6.32.49/drivers/media/video/usbvideo/usbvideo.h linux-2.6.32.49/drivers/media/video/usbvideo/usbvideo.h
35019 --- linux-2.6.32.49/drivers/media/video/usbvideo/usbvideo.h 2011-11-08 19:02:43.000000000 -0500
35020 +++ linux-2.6.32.49/drivers/media/video/usbvideo/usbvideo.h 2011-11-15 19:59:43.000000000 -0500
35021 @@ -268,7 +268,7 @@ struct usbvideo_cb {
35022 int (*startDataPump)(struct uvd *uvd);
35023 void (*stopDataPump)(struct uvd *uvd);
35024 int (*setVideoMode)(struct uvd *uvd, struct video_window *vw);
35025 -};
35026 +} __no_const;
35027
35028 struct usbvideo {
35029 int num_cameras; /* As allocated */
35030 diff -urNp linux-2.6.32.49/drivers/media/video/usbvision/usbvision-core.c linux-2.6.32.49/drivers/media/video/usbvision/usbvision-core.c
35031 --- linux-2.6.32.49/drivers/media/video/usbvision/usbvision-core.c 2011-11-08 19:02:43.000000000 -0500
35032 +++ linux-2.6.32.49/drivers/media/video/usbvision/usbvision-core.c 2011-11-15 19:59:43.000000000 -0500
35033 @@ -820,6 +820,8 @@ static enum ParseState usbvision_parse_c
35034 unsigned char rv, gv, bv;
35035 static unsigned char *Y, *U, *V;
35036
35037 + pax_track_stack();
35038 +
35039 frame = usbvision->curFrame;
35040 imageSize = frame->frmwidth * frame->frmheight;
35041 if ( (frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
35042 diff -urNp linux-2.6.32.49/drivers/media/video/v4l2-device.c linux-2.6.32.49/drivers/media/video/v4l2-device.c
35043 --- linux-2.6.32.49/drivers/media/video/v4l2-device.c 2011-11-08 19:02:43.000000000 -0500
35044 +++ linux-2.6.32.49/drivers/media/video/v4l2-device.c 2011-11-15 19:59:43.000000000 -0500
35045 @@ -50,9 +50,9 @@ int v4l2_device_register(struct device *
35046 EXPORT_SYMBOL_GPL(v4l2_device_register);
35047
35048 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
35049 - atomic_t *instance)
35050 + atomic_unchecked_t *instance)
35051 {
35052 - int num = atomic_inc_return(instance) - 1;
35053 + int num = atomic_inc_return_unchecked(instance) - 1;
35054 int len = strlen(basename);
35055
35056 if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
35057 diff -urNp linux-2.6.32.49/drivers/media/video/videobuf-dma-sg.c linux-2.6.32.49/drivers/media/video/videobuf-dma-sg.c
35058 --- linux-2.6.32.49/drivers/media/video/videobuf-dma-sg.c 2011-11-08 19:02:43.000000000 -0500
35059 +++ linux-2.6.32.49/drivers/media/video/videobuf-dma-sg.c 2011-11-15 19:59:43.000000000 -0500
35060 @@ -693,6 +693,8 @@ void *videobuf_sg_alloc(size_t size)
35061 {
35062 struct videobuf_queue q;
35063
35064 + pax_track_stack();
35065 +
35066 /* Required to make generic handler to call __videobuf_alloc */
35067 q.int_ops = &sg_ops;
35068
35069 diff -urNp linux-2.6.32.49/drivers/message/fusion/mptbase.c linux-2.6.32.49/drivers/message/fusion/mptbase.c
35070 --- linux-2.6.32.49/drivers/message/fusion/mptbase.c 2011-11-08 19:02:43.000000000 -0500
35071 +++ linux-2.6.32.49/drivers/message/fusion/mptbase.c 2011-11-15 19:59:43.000000000 -0500
35072 @@ -6709,8 +6709,14 @@ procmpt_iocinfo_read(char *buf, char **s
35073 len += sprintf(buf+len, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
35074 len += sprintf(buf+len, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
35075
35076 +#ifdef CONFIG_GRKERNSEC_HIDESYM
35077 + len += sprintf(buf+len, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
35078 + NULL, NULL);
35079 +#else
35080 len += sprintf(buf+len, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
35081 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
35082 +#endif
35083 +
35084 /*
35085 * Rounding UP to nearest 4-kB boundary here...
35086 */
35087 diff -urNp linux-2.6.32.49/drivers/message/fusion/mptsas.c linux-2.6.32.49/drivers/message/fusion/mptsas.c
35088 --- linux-2.6.32.49/drivers/message/fusion/mptsas.c 2011-11-08 19:02:43.000000000 -0500
35089 +++ linux-2.6.32.49/drivers/message/fusion/mptsas.c 2011-11-15 19:59:43.000000000 -0500
35090 @@ -436,6 +436,23 @@ mptsas_is_end_device(struct mptsas_devin
35091 return 0;
35092 }
35093
35094 +static inline void
35095 +mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
35096 +{
35097 + if (phy_info->port_details) {
35098 + phy_info->port_details->rphy = rphy;
35099 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
35100 + ioc->name, rphy));
35101 + }
35102 +
35103 + if (rphy) {
35104 + dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
35105 + &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
35106 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
35107 + ioc->name, rphy, rphy->dev.release));
35108 + }
35109 +}
35110 +
35111 /* no mutex */
35112 static void
35113 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
35114 @@ -474,23 +491,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
35115 return NULL;
35116 }
35117
35118 -static inline void
35119 -mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
35120 -{
35121 - if (phy_info->port_details) {
35122 - phy_info->port_details->rphy = rphy;
35123 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
35124 - ioc->name, rphy));
35125 - }
35126 -
35127 - if (rphy) {
35128 - dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
35129 - &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
35130 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
35131 - ioc->name, rphy, rphy->dev.release));
35132 - }
35133 -}
35134 -
35135 static inline struct sas_port *
35136 mptsas_get_port(struct mptsas_phyinfo *phy_info)
35137 {
35138 diff -urNp linux-2.6.32.49/drivers/message/fusion/mptscsih.c linux-2.6.32.49/drivers/message/fusion/mptscsih.c
35139 --- linux-2.6.32.49/drivers/message/fusion/mptscsih.c 2011-11-08 19:02:43.000000000 -0500
35140 +++ linux-2.6.32.49/drivers/message/fusion/mptscsih.c 2011-11-15 19:59:43.000000000 -0500
35141 @@ -1248,15 +1248,16 @@ mptscsih_info(struct Scsi_Host *SChost)
35142
35143 h = shost_priv(SChost);
35144
35145 - if (h) {
35146 - if (h->info_kbuf == NULL)
35147 - if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
35148 - return h->info_kbuf;
35149 - h->info_kbuf[0] = '\0';
35150 + if (!h)
35151 + return NULL;
35152
35153 - mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
35154 - h->info_kbuf[size-1] = '\0';
35155 - }
35156 + if (h->info_kbuf == NULL)
35157 + if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
35158 + return h->info_kbuf;
35159 + h->info_kbuf[0] = '\0';
35160 +
35161 + mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
35162 + h->info_kbuf[size-1] = '\0';
35163
35164 return h->info_kbuf;
35165 }
35166 diff -urNp linux-2.6.32.49/drivers/message/i2o/i2o_config.c linux-2.6.32.49/drivers/message/i2o/i2o_config.c
35167 --- linux-2.6.32.49/drivers/message/i2o/i2o_config.c 2011-11-08 19:02:43.000000000 -0500
35168 +++ linux-2.6.32.49/drivers/message/i2o/i2o_config.c 2011-11-15 19:59:43.000000000 -0500
35169 @@ -787,6 +787,8 @@ static int i2o_cfg_passthru(unsigned lon
35170 struct i2o_message *msg;
35171 unsigned int iop;
35172
35173 + pax_track_stack();
35174 +
35175 if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
35176 return -EFAULT;
35177
35178 diff -urNp linux-2.6.32.49/drivers/message/i2o/i2o_proc.c linux-2.6.32.49/drivers/message/i2o/i2o_proc.c
35179 --- linux-2.6.32.49/drivers/message/i2o/i2o_proc.c 2011-11-08 19:02:43.000000000 -0500
35180 +++ linux-2.6.32.49/drivers/message/i2o/i2o_proc.c 2011-11-15 19:59:43.000000000 -0500
35181 @@ -259,13 +259,6 @@ static char *scsi_devices[] = {
35182 "Array Controller Device"
35183 };
35184
35185 -static char *chtostr(u8 * chars, int n)
35186 -{
35187 - char tmp[256];
35188 - tmp[0] = 0;
35189 - return strncat(tmp, (char *)chars, n);
35190 -}
35191 -
35192 static int i2o_report_query_status(struct seq_file *seq, int block_status,
35193 char *group)
35194 {
35195 @@ -842,8 +835,7 @@ static int i2o_seq_show_ddm_table(struct
35196
35197 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
35198 seq_printf(seq, "%-#8x", ddm_table.module_id);
35199 - seq_printf(seq, "%-29s",
35200 - chtostr(ddm_table.module_name_version, 28));
35201 + seq_printf(seq, "%-.28s", ddm_table.module_name_version);
35202 seq_printf(seq, "%9d ", ddm_table.data_size);
35203 seq_printf(seq, "%8d", ddm_table.code_size);
35204
35205 @@ -944,8 +936,8 @@ static int i2o_seq_show_drivers_stored(s
35206
35207 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
35208 seq_printf(seq, "%-#8x", dst->module_id);
35209 - seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
35210 - seq_printf(seq, "%-9s", chtostr(dst->date, 8));
35211 + seq_printf(seq, "%-.28s", dst->module_name_version);
35212 + seq_printf(seq, "%-.8s", dst->date);
35213 seq_printf(seq, "%8d ", dst->module_size);
35214 seq_printf(seq, "%8d ", dst->mpb_size);
35215 seq_printf(seq, "0x%04x", dst->module_flags);
35216 @@ -1276,14 +1268,10 @@ static int i2o_seq_show_dev_identity(str
35217 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
35218 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
35219 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
35220 - seq_printf(seq, "Vendor info : %s\n",
35221 - chtostr((u8 *) (work32 + 2), 16));
35222 - seq_printf(seq, "Product info : %s\n",
35223 - chtostr((u8 *) (work32 + 6), 16));
35224 - seq_printf(seq, "Description : %s\n",
35225 - chtostr((u8 *) (work32 + 10), 16));
35226 - seq_printf(seq, "Product rev. : %s\n",
35227 - chtostr((u8 *) (work32 + 14), 8));
35228 + seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
35229 + seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
35230 + seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
35231 + seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
35232
35233 seq_printf(seq, "Serial number : ");
35234 print_serial_number(seq, (u8 *) (work32 + 16),
35235 @@ -1328,10 +1316,8 @@ static int i2o_seq_show_ddm_identity(str
35236 }
35237
35238 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
35239 - seq_printf(seq, "Module name : %s\n",
35240 - chtostr(result.module_name, 24));
35241 - seq_printf(seq, "Module revision : %s\n",
35242 - chtostr(result.module_rev, 8));
35243 + seq_printf(seq, "Module name : %.24s\n", result.module_name);
35244 + seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
35245
35246 seq_printf(seq, "Serial number : ");
35247 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
35248 @@ -1362,14 +1348,10 @@ static int i2o_seq_show_uinfo(struct seq
35249 return 0;
35250 }
35251
35252 - seq_printf(seq, "Device name : %s\n",
35253 - chtostr(result.device_name, 64));
35254 - seq_printf(seq, "Service name : %s\n",
35255 - chtostr(result.service_name, 64));
35256 - seq_printf(seq, "Physical name : %s\n",
35257 - chtostr(result.physical_location, 64));
35258 - seq_printf(seq, "Instance number : %s\n",
35259 - chtostr(result.instance_number, 4));
35260 + seq_printf(seq, "Device name : %.64s\n", result.device_name);
35261 + seq_printf(seq, "Service name : %.64s\n", result.service_name);
35262 + seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
35263 + seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
35264
35265 return 0;
35266 }
35267 diff -urNp linux-2.6.32.49/drivers/message/i2o/iop.c linux-2.6.32.49/drivers/message/i2o/iop.c
35268 --- linux-2.6.32.49/drivers/message/i2o/iop.c 2011-11-08 19:02:43.000000000 -0500
35269 +++ linux-2.6.32.49/drivers/message/i2o/iop.c 2011-11-15 19:59:43.000000000 -0500
35270 @@ -110,10 +110,10 @@ u32 i2o_cntxt_list_add(struct i2o_contro
35271
35272 spin_lock_irqsave(&c->context_list_lock, flags);
35273
35274 - if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
35275 - atomic_inc(&c->context_list_counter);
35276 + if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
35277 + atomic_inc_unchecked(&c->context_list_counter);
35278
35279 - entry->context = atomic_read(&c->context_list_counter);
35280 + entry->context = atomic_read_unchecked(&c->context_list_counter);
35281
35282 list_add(&entry->list, &c->context_list);
35283
35284 @@ -1076,7 +1076,7 @@ struct i2o_controller *i2o_iop_alloc(voi
35285
35286 #if BITS_PER_LONG == 64
35287 spin_lock_init(&c->context_list_lock);
35288 - atomic_set(&c->context_list_counter, 0);
35289 + atomic_set_unchecked(&c->context_list_counter, 0);
35290 INIT_LIST_HEAD(&c->context_list);
35291 #endif
35292
35293 diff -urNp linux-2.6.32.49/drivers/mfd/ab3100-core.c linux-2.6.32.49/drivers/mfd/ab3100-core.c
35294 --- linux-2.6.32.49/drivers/mfd/ab3100-core.c 2011-11-08 19:02:43.000000000 -0500
35295 +++ linux-2.6.32.49/drivers/mfd/ab3100-core.c 2011-11-18 18:01:55.000000000 -0500
35296 @@ -777,7 +777,7 @@ struct ab_family_id {
35297 char *name;
35298 };
35299
35300 -static const struct ab_family_id ids[] __initdata = {
35301 +static const struct ab_family_id ids[] __initconst = {
35302 /* AB3100 */
35303 {
35304 .id = 0xc0,
35305 diff -urNp linux-2.6.32.49/drivers/mfd/wm8350-i2c.c linux-2.6.32.49/drivers/mfd/wm8350-i2c.c
35306 --- linux-2.6.32.49/drivers/mfd/wm8350-i2c.c 2011-11-08 19:02:43.000000000 -0500
35307 +++ linux-2.6.32.49/drivers/mfd/wm8350-i2c.c 2011-11-15 19:59:43.000000000 -0500
35308 @@ -43,6 +43,8 @@ static int wm8350_i2c_write_device(struc
35309 u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
35310 int ret;
35311
35312 + pax_track_stack();
35313 +
35314 if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
35315 return -EINVAL;
35316
35317 diff -urNp linux-2.6.32.49/drivers/misc/kgdbts.c linux-2.6.32.49/drivers/misc/kgdbts.c
35318 --- linux-2.6.32.49/drivers/misc/kgdbts.c 2011-11-08 19:02:43.000000000 -0500
35319 +++ linux-2.6.32.49/drivers/misc/kgdbts.c 2011-11-15 19:59:43.000000000 -0500
35320 @@ -118,7 +118,7 @@
35321 } while (0)
35322 #define MAX_CONFIG_LEN 40
35323
35324 -static struct kgdb_io kgdbts_io_ops;
35325 +static const struct kgdb_io kgdbts_io_ops;
35326 static char get_buf[BUFMAX];
35327 static int get_buf_cnt;
35328 static char put_buf[BUFMAX];
35329 @@ -1102,7 +1102,7 @@ static void kgdbts_post_exp_handler(void
35330 module_put(THIS_MODULE);
35331 }
35332
35333 -static struct kgdb_io kgdbts_io_ops = {
35334 +static const struct kgdb_io kgdbts_io_ops = {
35335 .name = "kgdbts",
35336 .read_char = kgdbts_get_char,
35337 .write_char = kgdbts_put_char,
35338 diff -urNp linux-2.6.32.49/drivers/misc/sgi-gru/gruhandles.c linux-2.6.32.49/drivers/misc/sgi-gru/gruhandles.c
35339 --- linux-2.6.32.49/drivers/misc/sgi-gru/gruhandles.c 2011-11-08 19:02:43.000000000 -0500
35340 +++ linux-2.6.32.49/drivers/misc/sgi-gru/gruhandles.c 2011-11-15 19:59:43.000000000 -0500
35341 @@ -39,8 +39,8 @@ struct mcs_op_statistic mcs_op_statistic
35342
35343 static void update_mcs_stats(enum mcs_op op, unsigned long clks)
35344 {
35345 - atomic_long_inc(&mcs_op_statistics[op].count);
35346 - atomic_long_add(clks, &mcs_op_statistics[op].total);
35347 + atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
35348 + atomic_long_add_unchecked(clks, &mcs_op_statistics[op].total);
35349 if (mcs_op_statistics[op].max < clks)
35350 mcs_op_statistics[op].max = clks;
35351 }
35352 diff -urNp linux-2.6.32.49/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.32.49/drivers/misc/sgi-gru/gruprocfs.c
35353 --- linux-2.6.32.49/drivers/misc/sgi-gru/gruprocfs.c 2011-11-08 19:02:43.000000000 -0500
35354 +++ linux-2.6.32.49/drivers/misc/sgi-gru/gruprocfs.c 2011-11-15 19:59:43.000000000 -0500
35355 @@ -32,9 +32,9 @@
35356
35357 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
35358
35359 -static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
35360 +static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
35361 {
35362 - unsigned long val = atomic_long_read(v);
35363 + unsigned long val = atomic_long_read_unchecked(v);
35364
35365 if (val)
35366 seq_printf(s, "%16lu %s\n", val, id);
35367 @@ -136,8 +136,8 @@ static int mcs_statistics_show(struct se
35368 "cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
35369
35370 for (op = 0; op < mcsop_last; op++) {
35371 - count = atomic_long_read(&mcs_op_statistics[op].count);
35372 - total = atomic_long_read(&mcs_op_statistics[op].total);
35373 + count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
35374 + total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
35375 max = mcs_op_statistics[op].max;
35376 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
35377 count ? total / count : 0, max);
35378 diff -urNp linux-2.6.32.49/drivers/misc/sgi-gru/grutables.h linux-2.6.32.49/drivers/misc/sgi-gru/grutables.h
35379 --- linux-2.6.32.49/drivers/misc/sgi-gru/grutables.h 2011-11-08 19:02:43.000000000 -0500
35380 +++ linux-2.6.32.49/drivers/misc/sgi-gru/grutables.h 2011-11-15 19:59:43.000000000 -0500
35381 @@ -167,84 +167,84 @@ extern unsigned int gru_max_gids;
35382 * GRU statistics.
35383 */
35384 struct gru_stats_s {
35385 - atomic_long_t vdata_alloc;
35386 - atomic_long_t vdata_free;
35387 - atomic_long_t gts_alloc;
35388 - atomic_long_t gts_free;
35389 - atomic_long_t vdata_double_alloc;
35390 - atomic_long_t gts_double_allocate;
35391 - atomic_long_t assign_context;
35392 - atomic_long_t assign_context_failed;
35393 - atomic_long_t free_context;
35394 - atomic_long_t load_user_context;
35395 - atomic_long_t load_kernel_context;
35396 - atomic_long_t lock_kernel_context;
35397 - atomic_long_t unlock_kernel_context;
35398 - atomic_long_t steal_user_context;
35399 - atomic_long_t steal_kernel_context;
35400 - atomic_long_t steal_context_failed;
35401 - atomic_long_t nopfn;
35402 - atomic_long_t break_cow;
35403 - atomic_long_t asid_new;
35404 - atomic_long_t asid_next;
35405 - atomic_long_t asid_wrap;
35406 - atomic_long_t asid_reuse;
35407 - atomic_long_t intr;
35408 - atomic_long_t intr_mm_lock_failed;
35409 - atomic_long_t call_os;
35410 - atomic_long_t call_os_offnode_reference;
35411 - atomic_long_t call_os_check_for_bug;
35412 - atomic_long_t call_os_wait_queue;
35413 - atomic_long_t user_flush_tlb;
35414 - atomic_long_t user_unload_context;
35415 - atomic_long_t user_exception;
35416 - atomic_long_t set_context_option;
35417 - atomic_long_t migrate_check;
35418 - atomic_long_t migrated_retarget;
35419 - atomic_long_t migrated_unload;
35420 - atomic_long_t migrated_unload_delay;
35421 - atomic_long_t migrated_nopfn_retarget;
35422 - atomic_long_t migrated_nopfn_unload;
35423 - atomic_long_t tlb_dropin;
35424 - atomic_long_t tlb_dropin_fail_no_asid;
35425 - atomic_long_t tlb_dropin_fail_upm;
35426 - atomic_long_t tlb_dropin_fail_invalid;
35427 - atomic_long_t tlb_dropin_fail_range_active;
35428 - atomic_long_t tlb_dropin_fail_idle;
35429 - atomic_long_t tlb_dropin_fail_fmm;
35430 - atomic_long_t tlb_dropin_fail_no_exception;
35431 - atomic_long_t tlb_dropin_fail_no_exception_war;
35432 - atomic_long_t tfh_stale_on_fault;
35433 - atomic_long_t mmu_invalidate_range;
35434 - atomic_long_t mmu_invalidate_page;
35435 - atomic_long_t mmu_clear_flush_young;
35436 - atomic_long_t flush_tlb;
35437 - atomic_long_t flush_tlb_gru;
35438 - atomic_long_t flush_tlb_gru_tgh;
35439 - atomic_long_t flush_tlb_gru_zero_asid;
35440 -
35441 - atomic_long_t copy_gpa;
35442 -
35443 - atomic_long_t mesq_receive;
35444 - atomic_long_t mesq_receive_none;
35445 - atomic_long_t mesq_send;
35446 - atomic_long_t mesq_send_failed;
35447 - atomic_long_t mesq_noop;
35448 - atomic_long_t mesq_send_unexpected_error;
35449 - atomic_long_t mesq_send_lb_overflow;
35450 - atomic_long_t mesq_send_qlimit_reached;
35451 - atomic_long_t mesq_send_amo_nacked;
35452 - atomic_long_t mesq_send_put_nacked;
35453 - atomic_long_t mesq_qf_not_full;
35454 - atomic_long_t mesq_qf_locked;
35455 - atomic_long_t mesq_qf_noop_not_full;
35456 - atomic_long_t mesq_qf_switch_head_failed;
35457 - atomic_long_t mesq_qf_unexpected_error;
35458 - atomic_long_t mesq_noop_unexpected_error;
35459 - atomic_long_t mesq_noop_lb_overflow;
35460 - atomic_long_t mesq_noop_qlimit_reached;
35461 - atomic_long_t mesq_noop_amo_nacked;
35462 - atomic_long_t mesq_noop_put_nacked;
35463 + atomic_long_unchecked_t vdata_alloc;
35464 + atomic_long_unchecked_t vdata_free;
35465 + atomic_long_unchecked_t gts_alloc;
35466 + atomic_long_unchecked_t gts_free;
35467 + atomic_long_unchecked_t vdata_double_alloc;
35468 + atomic_long_unchecked_t gts_double_allocate;
35469 + atomic_long_unchecked_t assign_context;
35470 + atomic_long_unchecked_t assign_context_failed;
35471 + atomic_long_unchecked_t free_context;
35472 + atomic_long_unchecked_t load_user_context;
35473 + atomic_long_unchecked_t load_kernel_context;
35474 + atomic_long_unchecked_t lock_kernel_context;
35475 + atomic_long_unchecked_t unlock_kernel_context;
35476 + atomic_long_unchecked_t steal_user_context;
35477 + atomic_long_unchecked_t steal_kernel_context;
35478 + atomic_long_unchecked_t steal_context_failed;
35479 + atomic_long_unchecked_t nopfn;
35480 + atomic_long_unchecked_t break_cow;
35481 + atomic_long_unchecked_t asid_new;
35482 + atomic_long_unchecked_t asid_next;
35483 + atomic_long_unchecked_t asid_wrap;
35484 + atomic_long_unchecked_t asid_reuse;
35485 + atomic_long_unchecked_t intr;
35486 + atomic_long_unchecked_t intr_mm_lock_failed;
35487 + atomic_long_unchecked_t call_os;
35488 + atomic_long_unchecked_t call_os_offnode_reference;
35489 + atomic_long_unchecked_t call_os_check_for_bug;
35490 + atomic_long_unchecked_t call_os_wait_queue;
35491 + atomic_long_unchecked_t user_flush_tlb;
35492 + atomic_long_unchecked_t user_unload_context;
35493 + atomic_long_unchecked_t user_exception;
35494 + atomic_long_unchecked_t set_context_option;
35495 + atomic_long_unchecked_t migrate_check;
35496 + atomic_long_unchecked_t migrated_retarget;
35497 + atomic_long_unchecked_t migrated_unload;
35498 + atomic_long_unchecked_t migrated_unload_delay;
35499 + atomic_long_unchecked_t migrated_nopfn_retarget;
35500 + atomic_long_unchecked_t migrated_nopfn_unload;
35501 + atomic_long_unchecked_t tlb_dropin;
35502 + atomic_long_unchecked_t tlb_dropin_fail_no_asid;
35503 + atomic_long_unchecked_t tlb_dropin_fail_upm;
35504 + atomic_long_unchecked_t tlb_dropin_fail_invalid;
35505 + atomic_long_unchecked_t tlb_dropin_fail_range_active;
35506 + atomic_long_unchecked_t tlb_dropin_fail_idle;
35507 + atomic_long_unchecked_t tlb_dropin_fail_fmm;
35508 + atomic_long_unchecked_t tlb_dropin_fail_no_exception;
35509 + atomic_long_unchecked_t tlb_dropin_fail_no_exception_war;
35510 + atomic_long_unchecked_t tfh_stale_on_fault;
35511 + atomic_long_unchecked_t mmu_invalidate_range;
35512 + atomic_long_unchecked_t mmu_invalidate_page;
35513 + atomic_long_unchecked_t mmu_clear_flush_young;
35514 + atomic_long_unchecked_t flush_tlb;
35515 + atomic_long_unchecked_t flush_tlb_gru;
35516 + atomic_long_unchecked_t flush_tlb_gru_tgh;
35517 + atomic_long_unchecked_t flush_tlb_gru_zero_asid;
35518 +
35519 + atomic_long_unchecked_t copy_gpa;
35520 +
35521 + atomic_long_unchecked_t mesq_receive;
35522 + atomic_long_unchecked_t mesq_receive_none;
35523 + atomic_long_unchecked_t mesq_send;
35524 + atomic_long_unchecked_t mesq_send_failed;
35525 + atomic_long_unchecked_t mesq_noop;
35526 + atomic_long_unchecked_t mesq_send_unexpected_error;
35527 + atomic_long_unchecked_t mesq_send_lb_overflow;
35528 + atomic_long_unchecked_t mesq_send_qlimit_reached;
35529 + atomic_long_unchecked_t mesq_send_amo_nacked;
35530 + atomic_long_unchecked_t mesq_send_put_nacked;
35531 + atomic_long_unchecked_t mesq_qf_not_full;
35532 + atomic_long_unchecked_t mesq_qf_locked;
35533 + atomic_long_unchecked_t mesq_qf_noop_not_full;
35534 + atomic_long_unchecked_t mesq_qf_switch_head_failed;
35535 + atomic_long_unchecked_t mesq_qf_unexpected_error;
35536 + atomic_long_unchecked_t mesq_noop_unexpected_error;
35537 + atomic_long_unchecked_t mesq_noop_lb_overflow;
35538 + atomic_long_unchecked_t mesq_noop_qlimit_reached;
35539 + atomic_long_unchecked_t mesq_noop_amo_nacked;
35540 + atomic_long_unchecked_t mesq_noop_put_nacked;
35541
35542 };
35543
35544 @@ -252,8 +252,8 @@ enum mcs_op {cchop_allocate, cchop_start
35545 cchop_deallocate, tghop_invalidate, mcsop_last};
35546
35547 struct mcs_op_statistic {
35548 - atomic_long_t count;
35549 - atomic_long_t total;
35550 + atomic_long_unchecked_t count;
35551 + atomic_long_unchecked_t total;
35552 unsigned long max;
35553 };
35554
35555 @@ -276,7 +276,7 @@ extern struct mcs_op_statistic mcs_op_st
35556
35557 #define STAT(id) do { \
35558 if (gru_options & OPT_STATS) \
35559 - atomic_long_inc(&gru_stats.id); \
35560 + atomic_long_inc_unchecked(&gru_stats.id); \
35561 } while (0)
35562
35563 #ifdef CONFIG_SGI_GRU_DEBUG
35564 diff -urNp linux-2.6.32.49/drivers/misc/sgi-xp/xpc.h linux-2.6.32.49/drivers/misc/sgi-xp/xpc.h
35565 --- linux-2.6.32.49/drivers/misc/sgi-xp/xpc.h 2011-11-08 19:02:43.000000000 -0500
35566 +++ linux-2.6.32.49/drivers/misc/sgi-xp/xpc.h 2011-11-18 18:05:51.000000000 -0500
35567 @@ -835,6 +835,7 @@ struct xpc_arch_operations {
35568 void (*received_payload) (struct xpc_channel *, void *);
35569 void (*notify_senders_of_disconnect) (struct xpc_channel *);
35570 };
35571 +typedef struct xpc_arch_operations __no_const xpc_arch_operations_no_const;
35572
35573 /* struct xpc_partition act_state values (for XPC HB) */
35574
35575 @@ -876,7 +877,7 @@ extern struct xpc_registration xpc_regis
35576 /* found in xpc_main.c */
35577 extern struct device *xpc_part;
35578 extern struct device *xpc_chan;
35579 -extern struct xpc_arch_operations xpc_arch_ops;
35580 +extern xpc_arch_operations_no_const xpc_arch_ops;
35581 extern int xpc_disengage_timelimit;
35582 extern int xpc_disengage_timedout;
35583 extern int xpc_activate_IRQ_rcvd;
35584 diff -urNp linux-2.6.32.49/drivers/misc/sgi-xp/xpc_main.c linux-2.6.32.49/drivers/misc/sgi-xp/xpc_main.c
35585 --- linux-2.6.32.49/drivers/misc/sgi-xp/xpc_main.c 2011-11-08 19:02:43.000000000 -0500
35586 +++ linux-2.6.32.49/drivers/misc/sgi-xp/xpc_main.c 2011-11-18 18:05:28.000000000 -0500
35587 @@ -169,7 +169,7 @@ static struct notifier_block xpc_die_not
35588 .notifier_call = xpc_system_die,
35589 };
35590
35591 -struct xpc_arch_operations xpc_arch_ops;
35592 +xpc_arch_operations_no_const xpc_arch_ops;
35593
35594 /*
35595 * Timer function to enforce the timelimit on the partition disengage.
35596 diff -urNp linux-2.6.32.49/drivers/misc/sgi-xp/xpc_sn2.c linux-2.6.32.49/drivers/misc/sgi-xp/xpc_sn2.c
35597 --- linux-2.6.32.49/drivers/misc/sgi-xp/xpc_sn2.c 2011-11-08 19:02:43.000000000 -0500
35598 +++ linux-2.6.32.49/drivers/misc/sgi-xp/xpc_sn2.c 2011-11-15 19:59:43.000000000 -0500
35599 @@ -2350,7 +2350,7 @@ xpc_received_payload_sn2(struct xpc_chan
35600 xpc_acknowledge_msgs_sn2(ch, get, msg->flags);
35601 }
35602
35603 -static struct xpc_arch_operations xpc_arch_ops_sn2 = {
35604 +static const struct xpc_arch_operations xpc_arch_ops_sn2 = {
35605 .setup_partitions = xpc_setup_partitions_sn2,
35606 .teardown_partitions = xpc_teardown_partitions_sn2,
35607 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_sn2,
35608 @@ -2413,7 +2413,9 @@ xpc_init_sn2(void)
35609 int ret;
35610 size_t buf_size;
35611
35612 - xpc_arch_ops = xpc_arch_ops_sn2;
35613 + pax_open_kernel();
35614 + memcpy((void *)&xpc_arch_ops, &xpc_arch_ops_sn2, sizeof(xpc_arch_ops_sn2));
35615 + pax_close_kernel();
35616
35617 if (offsetof(struct xpc_msg_sn2, payload) > XPC_MSG_HDR_MAX_SIZE) {
35618 dev_err(xpc_part, "header portion of struct xpc_msg_sn2 is "
35619 diff -urNp linux-2.6.32.49/drivers/misc/sgi-xp/xpc_uv.c linux-2.6.32.49/drivers/misc/sgi-xp/xpc_uv.c
35620 --- linux-2.6.32.49/drivers/misc/sgi-xp/xpc_uv.c 2011-11-08 19:02:43.000000000 -0500
35621 +++ linux-2.6.32.49/drivers/misc/sgi-xp/xpc_uv.c 2011-11-15 19:59:43.000000000 -0500
35622 @@ -1669,7 +1669,7 @@ xpc_received_payload_uv(struct xpc_chann
35623 XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
35624 }
35625
35626 -static struct xpc_arch_operations xpc_arch_ops_uv = {
35627 +static const struct xpc_arch_operations xpc_arch_ops_uv = {
35628 .setup_partitions = xpc_setup_partitions_uv,
35629 .teardown_partitions = xpc_teardown_partitions_uv,
35630 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_uv,
35631 @@ -1729,7 +1729,9 @@ static struct xpc_arch_operations xpc_ar
35632 int
35633 xpc_init_uv(void)
35634 {
35635 - xpc_arch_ops = xpc_arch_ops_uv;
35636 + pax_open_kernel();
35637 + memcpy((void *)&xpc_arch_ops, &xpc_arch_ops_uv, sizeof(xpc_arch_ops_uv));
35638 + pax_close_kernel();
35639
35640 if (sizeof(struct xpc_notify_mq_msghdr_uv) > XPC_MSG_HDR_MAX_SIZE) {
35641 dev_err(xpc_part, "xpc_notify_mq_msghdr_uv is larger than %d\n",
35642 diff -urNp linux-2.6.32.49/drivers/misc/sgi-xp/xp.h linux-2.6.32.49/drivers/misc/sgi-xp/xp.h
35643 --- linux-2.6.32.49/drivers/misc/sgi-xp/xp.h 2011-11-08 19:02:43.000000000 -0500
35644 +++ linux-2.6.32.49/drivers/misc/sgi-xp/xp.h 2011-11-15 19:59:43.000000000 -0500
35645 @@ -289,7 +289,7 @@ struct xpc_interface {
35646 xpc_notify_func, void *);
35647 void (*received) (short, int, void *);
35648 enum xp_retval (*partid_to_nasids) (short, void *);
35649 -};
35650 +} __no_const;
35651
35652 extern struct xpc_interface xpc_interface;
35653
35654 diff -urNp linux-2.6.32.49/drivers/mmc/host/sdhci-pci.c linux-2.6.32.49/drivers/mmc/host/sdhci-pci.c
35655 --- linux-2.6.32.49/drivers/mmc/host/sdhci-pci.c 2011-11-08 19:02:43.000000000 -0500
35656 +++ linux-2.6.32.49/drivers/mmc/host/sdhci-pci.c 2011-11-18 18:01:55.000000000 -0500
35657 @@ -297,7 +297,7 @@ static const struct sdhci_pci_fixes sdhc
35658 .probe = via_probe,
35659 };
35660
35661 -static const struct pci_device_id pci_ids[] __devinitdata = {
35662 +static const struct pci_device_id pci_ids[] __devinitconst = {
35663 {
35664 .vendor = PCI_VENDOR_ID_RICOH,
35665 .device = PCI_DEVICE_ID_RICOH_R5C822,
35666 diff -urNp linux-2.6.32.49/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.32.49/drivers/mtd/chips/cfi_cmdset_0001.c
35667 --- linux-2.6.32.49/drivers/mtd/chips/cfi_cmdset_0001.c 2011-11-08 19:02:43.000000000 -0500
35668 +++ linux-2.6.32.49/drivers/mtd/chips/cfi_cmdset_0001.c 2011-11-15 19:59:43.000000000 -0500
35669 @@ -743,6 +743,8 @@ static int chip_ready (struct map_info *
35670 struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
35671 unsigned long timeo = jiffies + HZ;
35672
35673 + pax_track_stack();
35674 +
35675 /* Prevent setting state FL_SYNCING for chip in suspended state. */
35676 if (mode == FL_SYNCING && chip->oldstate != FL_READY)
35677 goto sleep;
35678 @@ -1642,6 +1644,8 @@ static int __xipram do_write_buffer(stru
35679 unsigned long initial_adr;
35680 int initial_len = len;
35681
35682 + pax_track_stack();
35683 +
35684 wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
35685 adr += chip->start;
35686 initial_adr = adr;
35687 @@ -1860,6 +1864,8 @@ static int __xipram do_erase_oneblock(st
35688 int retries = 3;
35689 int ret;
35690
35691 + pax_track_stack();
35692 +
35693 adr += chip->start;
35694
35695 retry:
35696 diff -urNp linux-2.6.32.49/drivers/mtd/chips/cfi_cmdset_0020.c linux-2.6.32.49/drivers/mtd/chips/cfi_cmdset_0020.c
35697 --- linux-2.6.32.49/drivers/mtd/chips/cfi_cmdset_0020.c 2011-11-08 19:02:43.000000000 -0500
35698 +++ linux-2.6.32.49/drivers/mtd/chips/cfi_cmdset_0020.c 2011-11-15 19:59:43.000000000 -0500
35699 @@ -255,6 +255,8 @@ static inline int do_read_onechip(struct
35700 unsigned long cmd_addr;
35701 struct cfi_private *cfi = map->fldrv_priv;
35702
35703 + pax_track_stack();
35704 +
35705 adr += chip->start;
35706
35707 /* Ensure cmd read/writes are aligned. */
35708 @@ -428,6 +430,8 @@ static inline int do_write_buffer(struct
35709 DECLARE_WAITQUEUE(wait, current);
35710 int wbufsize, z;
35711
35712 + pax_track_stack();
35713 +
35714 /* M58LW064A requires bus alignment for buffer wriets -- saw */
35715 if (adr & (map_bankwidth(map)-1))
35716 return -EINVAL;
35717 @@ -742,6 +746,8 @@ static inline int do_erase_oneblock(stru
35718 DECLARE_WAITQUEUE(wait, current);
35719 int ret = 0;
35720
35721 + pax_track_stack();
35722 +
35723 adr += chip->start;
35724
35725 /* Let's determine this according to the interleave only once */
35726 @@ -1047,6 +1053,8 @@ static inline int do_lock_oneblock(struc
35727 unsigned long timeo = jiffies + HZ;
35728 DECLARE_WAITQUEUE(wait, current);
35729
35730 + pax_track_stack();
35731 +
35732 adr += chip->start;
35733
35734 /* Let's determine this according to the interleave only once */
35735 @@ -1196,6 +1204,8 @@ static inline int do_unlock_oneblock(str
35736 unsigned long timeo = jiffies + HZ;
35737 DECLARE_WAITQUEUE(wait, current);
35738
35739 + pax_track_stack();
35740 +
35741 adr += chip->start;
35742
35743 /* Let's determine this according to the interleave only once */
35744 diff -urNp linux-2.6.32.49/drivers/mtd/devices/doc2000.c linux-2.6.32.49/drivers/mtd/devices/doc2000.c
35745 --- linux-2.6.32.49/drivers/mtd/devices/doc2000.c 2011-11-08 19:02:43.000000000 -0500
35746 +++ linux-2.6.32.49/drivers/mtd/devices/doc2000.c 2011-11-15 19:59:43.000000000 -0500
35747 @@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
35748
35749 /* The ECC will not be calculated correctly if less than 512 is written */
35750 /* DBB-
35751 - if (len != 0x200 && eccbuf)
35752 + if (len != 0x200)
35753 printk(KERN_WARNING
35754 "ECC needs a full sector write (adr: %lx size %lx)\n",
35755 (long) to, (long) len);
35756 diff -urNp linux-2.6.32.49/drivers/mtd/devices/doc2001.c linux-2.6.32.49/drivers/mtd/devices/doc2001.c
35757 --- linux-2.6.32.49/drivers/mtd/devices/doc2001.c 2011-11-08 19:02:43.000000000 -0500
35758 +++ linux-2.6.32.49/drivers/mtd/devices/doc2001.c 2011-11-15 19:59:43.000000000 -0500
35759 @@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
35760 struct Nand *mychip = &this->chips[from >> (this->chipshift)];
35761
35762 /* Don't allow read past end of device */
35763 - if (from >= this->totlen)
35764 + if (from >= this->totlen || !len)
35765 return -EINVAL;
35766
35767 /* Don't allow a single read to cross a 512-byte block boundary */
35768 diff -urNp linux-2.6.32.49/drivers/mtd/ftl.c linux-2.6.32.49/drivers/mtd/ftl.c
35769 --- linux-2.6.32.49/drivers/mtd/ftl.c 2011-11-08 19:02:43.000000000 -0500
35770 +++ linux-2.6.32.49/drivers/mtd/ftl.c 2011-11-15 19:59:43.000000000 -0500
35771 @@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *
35772 loff_t offset;
35773 uint16_t srcunitswap = cpu_to_le16(srcunit);
35774
35775 + pax_track_stack();
35776 +
35777 eun = &part->EUNInfo[srcunit];
35778 xfer = &part->XferInfo[xferunit];
35779 DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
35780 diff -urNp linux-2.6.32.49/drivers/mtd/inftlcore.c linux-2.6.32.49/drivers/mtd/inftlcore.c
35781 --- linux-2.6.32.49/drivers/mtd/inftlcore.c 2011-11-08 19:02:43.000000000 -0500
35782 +++ linux-2.6.32.49/drivers/mtd/inftlcore.c 2011-11-15 19:59:43.000000000 -0500
35783 @@ -260,6 +260,8 @@ static u16 INFTL_foldchain(struct INFTLr
35784 struct inftl_oob oob;
35785 size_t retlen;
35786
35787 + pax_track_stack();
35788 +
35789 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
35790 "pending=%d)\n", inftl, thisVUC, pendingblock);
35791
35792 diff -urNp linux-2.6.32.49/drivers/mtd/inftlmount.c linux-2.6.32.49/drivers/mtd/inftlmount.c
35793 --- linux-2.6.32.49/drivers/mtd/inftlmount.c 2011-11-08 19:02:43.000000000 -0500
35794 +++ linux-2.6.32.49/drivers/mtd/inftlmount.c 2011-11-15 19:59:43.000000000 -0500
35795 @@ -54,6 +54,8 @@ static int find_boot_record(struct INFTL
35796 struct INFTLPartition *ip;
35797 size_t retlen;
35798
35799 + pax_track_stack();
35800 +
35801 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
35802
35803 /*
35804 diff -urNp linux-2.6.32.49/drivers/mtd/lpddr/qinfo_probe.c linux-2.6.32.49/drivers/mtd/lpddr/qinfo_probe.c
35805 --- linux-2.6.32.49/drivers/mtd/lpddr/qinfo_probe.c 2011-11-08 19:02:43.000000000 -0500
35806 +++ linux-2.6.32.49/drivers/mtd/lpddr/qinfo_probe.c 2011-11-15 19:59:43.000000000 -0500
35807 @@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map
35808 {
35809 map_word pfow_val[4];
35810
35811 + pax_track_stack();
35812 +
35813 /* Check identification string */
35814 pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
35815 pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
35816 diff -urNp linux-2.6.32.49/drivers/mtd/mtdchar.c linux-2.6.32.49/drivers/mtd/mtdchar.c
35817 --- linux-2.6.32.49/drivers/mtd/mtdchar.c 2011-11-26 19:44:53.000000000 -0500
35818 +++ linux-2.6.32.49/drivers/mtd/mtdchar.c 2011-11-26 19:45:06.000000000 -0500
35819 @@ -461,6 +461,8 @@ static int mtd_ioctl(struct inode *inode
35820 u_long size;
35821 struct mtd_info_user info;
35822
35823 + pax_track_stack();
35824 +
35825 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
35826
35827 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
35828 diff -urNp linux-2.6.32.49/drivers/mtd/nftlcore.c linux-2.6.32.49/drivers/mtd/nftlcore.c
35829 --- linux-2.6.32.49/drivers/mtd/nftlcore.c 2011-11-08 19:02:43.000000000 -0500
35830 +++ linux-2.6.32.49/drivers/mtd/nftlcore.c 2011-11-15 19:59:43.000000000 -0500
35831 @@ -254,6 +254,8 @@ static u16 NFTL_foldchain (struct NFTLre
35832 int inplace = 1;
35833 size_t retlen;
35834
35835 + pax_track_stack();
35836 +
35837 memset(BlockMap, 0xff, sizeof(BlockMap));
35838 memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
35839
35840 diff -urNp linux-2.6.32.49/drivers/mtd/nftlmount.c linux-2.6.32.49/drivers/mtd/nftlmount.c
35841 --- linux-2.6.32.49/drivers/mtd/nftlmount.c 2011-11-08 19:02:43.000000000 -0500
35842 +++ linux-2.6.32.49/drivers/mtd/nftlmount.c 2011-11-15 19:59:43.000000000 -0500
35843 @@ -23,6 +23,7 @@
35844 #include <asm/errno.h>
35845 #include <linux/delay.h>
35846 #include <linux/slab.h>
35847 +#include <linux/sched.h>
35848 #include <linux/mtd/mtd.h>
35849 #include <linux/mtd/nand.h>
35850 #include <linux/mtd/nftl.h>
35851 @@ -44,6 +45,8 @@ static int find_boot_record(struct NFTLr
35852 struct mtd_info *mtd = nftl->mbd.mtd;
35853 unsigned int i;
35854
35855 + pax_track_stack();
35856 +
35857 /* Assume logical EraseSize == physical erasesize for starting the scan.
35858 We'll sort it out later if we find a MediaHeader which says otherwise */
35859 /* Actually, we won't. The new DiskOnChip driver has already scanned
35860 diff -urNp linux-2.6.32.49/drivers/mtd/ubi/build.c linux-2.6.32.49/drivers/mtd/ubi/build.c
35861 --- linux-2.6.32.49/drivers/mtd/ubi/build.c 2011-11-08 19:02:43.000000000 -0500
35862 +++ linux-2.6.32.49/drivers/mtd/ubi/build.c 2011-11-15 19:59:43.000000000 -0500
35863 @@ -1255,7 +1255,7 @@ module_exit(ubi_exit);
35864 static int __init bytes_str_to_int(const char *str)
35865 {
35866 char *endp;
35867 - unsigned long result;
35868 + unsigned long result, scale = 1;
35869
35870 result = simple_strtoul(str, &endp, 0);
35871 if (str == endp || result >= INT_MAX) {
35872 @@ -1266,11 +1266,11 @@ static int __init bytes_str_to_int(const
35873
35874 switch (*endp) {
35875 case 'G':
35876 - result *= 1024;
35877 + scale *= 1024;
35878 case 'M':
35879 - result *= 1024;
35880 + scale *= 1024;
35881 case 'K':
35882 - result *= 1024;
35883 + scale *= 1024;
35884 if (endp[1] == 'i' && endp[2] == 'B')
35885 endp += 2;
35886 case '\0':
35887 @@ -1281,7 +1281,13 @@ static int __init bytes_str_to_int(const
35888 return -EINVAL;
35889 }
35890
35891 - return result;
35892 + if ((intoverflow_t)result*scale >= INT_MAX) {
35893 + printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
35894 + str);
35895 + return -EINVAL;
35896 + }
35897 +
35898 + return result*scale;
35899 }
35900
35901 /**
35902 diff -urNp linux-2.6.32.49/drivers/net/atlx/atl2.c linux-2.6.32.49/drivers/net/atlx/atl2.c
35903 --- linux-2.6.32.49/drivers/net/atlx/atl2.c 2011-11-08 19:02:43.000000000 -0500
35904 +++ linux-2.6.32.49/drivers/net/atlx/atl2.c 2011-11-18 18:01:55.000000000 -0500
35905 @@ -2845,7 +2845,7 @@ static void atl2_force_ps(struct atl2_hw
35906 */
35907
35908 #define ATL2_PARAM(X, desc) \
35909 - static const int __devinitdata X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
35910 + static const int __devinitconst X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
35911 MODULE_PARM(X, "1-" __MODULE_STRING(ATL2_MAX_NIC) "i"); \
35912 MODULE_PARM_DESC(X, desc);
35913 #else
35914 diff -urNp linux-2.6.32.49/drivers/net/bnx2.c linux-2.6.32.49/drivers/net/bnx2.c
35915 --- linux-2.6.32.49/drivers/net/bnx2.c 2011-11-08 19:02:43.000000000 -0500
35916 +++ linux-2.6.32.49/drivers/net/bnx2.c 2011-11-15 19:59:43.000000000 -0500
35917 @@ -5809,6 +5809,8 @@ bnx2_test_nvram(struct bnx2 *bp)
35918 int rc = 0;
35919 u32 magic, csum;
35920
35921 + pax_track_stack();
35922 +
35923 if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
35924 goto test_nvram_done;
35925
35926 diff -urNp linux-2.6.32.49/drivers/net/cxgb3/l2t.h linux-2.6.32.49/drivers/net/cxgb3/l2t.h
35927 --- linux-2.6.32.49/drivers/net/cxgb3/l2t.h 2011-11-08 19:02:43.000000000 -0500
35928 +++ linux-2.6.32.49/drivers/net/cxgb3/l2t.h 2011-11-15 19:59:43.000000000 -0500
35929 @@ -86,7 +86,7 @@ typedef void (*arp_failure_handler_func)
35930 */
35931 struct l2t_skb_cb {
35932 arp_failure_handler_func arp_failure_handler;
35933 -};
35934 +} __no_const;
35935
35936 #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
35937
35938 diff -urNp linux-2.6.32.49/drivers/net/cxgb3/t3_hw.c linux-2.6.32.49/drivers/net/cxgb3/t3_hw.c
35939 --- linux-2.6.32.49/drivers/net/cxgb3/t3_hw.c 2011-11-08 19:02:43.000000000 -0500
35940 +++ linux-2.6.32.49/drivers/net/cxgb3/t3_hw.c 2011-11-15 19:59:43.000000000 -0500
35941 @@ -699,6 +699,8 @@ static int get_vpd_params(struct adapter
35942 int i, addr, ret;
35943 struct t3_vpd vpd;
35944
35945 + pax_track_stack();
35946 +
35947 /*
35948 * Card information is normally at VPD_BASE but some early cards had
35949 * it at 0.
35950 diff -urNp linux-2.6.32.49/drivers/net/e1000e/82571.c linux-2.6.32.49/drivers/net/e1000e/82571.c
35951 --- linux-2.6.32.49/drivers/net/e1000e/82571.c 2011-11-08 19:02:43.000000000 -0500
35952 +++ linux-2.6.32.49/drivers/net/e1000e/82571.c 2011-11-15 19:59:43.000000000 -0500
35953 @@ -212,7 +212,7 @@ static s32 e1000_init_mac_params_82571(s
35954 {
35955 struct e1000_hw *hw = &adapter->hw;
35956 struct e1000_mac_info *mac = &hw->mac;
35957 - struct e1000_mac_operations *func = &mac->ops;
35958 + e1000_mac_operations_no_const *func = &mac->ops;
35959 u32 swsm = 0;
35960 u32 swsm2 = 0;
35961 bool force_clear_smbi = false;
35962 @@ -1656,7 +1656,7 @@ static void e1000_clear_hw_cntrs_82571(s
35963 temp = er32(ICRXDMTC);
35964 }
35965
35966 -static struct e1000_mac_operations e82571_mac_ops = {
35967 +static const struct e1000_mac_operations e82571_mac_ops = {
35968 /* .check_mng_mode: mac type dependent */
35969 /* .check_for_link: media type dependent */
35970 .id_led_init = e1000e_id_led_init,
35971 @@ -1674,7 +1674,7 @@ static struct e1000_mac_operations e8257
35972 .setup_led = e1000e_setup_led_generic,
35973 };
35974
35975 -static struct e1000_phy_operations e82_phy_ops_igp = {
35976 +static const struct e1000_phy_operations e82_phy_ops_igp = {
35977 .acquire_phy = e1000_get_hw_semaphore_82571,
35978 .check_reset_block = e1000e_check_reset_block_generic,
35979 .commit_phy = NULL,
35980 @@ -1691,7 +1691,7 @@ static struct e1000_phy_operations e82_p
35981 .cfg_on_link_up = NULL,
35982 };
35983
35984 -static struct e1000_phy_operations e82_phy_ops_m88 = {
35985 +static const struct e1000_phy_operations e82_phy_ops_m88 = {
35986 .acquire_phy = e1000_get_hw_semaphore_82571,
35987 .check_reset_block = e1000e_check_reset_block_generic,
35988 .commit_phy = e1000e_phy_sw_reset,
35989 @@ -1708,7 +1708,7 @@ static struct e1000_phy_operations e82_p
35990 .cfg_on_link_up = NULL,
35991 };
35992
35993 -static struct e1000_phy_operations e82_phy_ops_bm = {
35994 +static const struct e1000_phy_operations e82_phy_ops_bm = {
35995 .acquire_phy = e1000_get_hw_semaphore_82571,
35996 .check_reset_block = e1000e_check_reset_block_generic,
35997 .commit_phy = e1000e_phy_sw_reset,
35998 @@ -1725,7 +1725,7 @@ static struct e1000_phy_operations e82_p
35999 .cfg_on_link_up = NULL,
36000 };
36001
36002 -static struct e1000_nvm_operations e82571_nvm_ops = {
36003 +static const struct e1000_nvm_operations e82571_nvm_ops = {
36004 .acquire_nvm = e1000_acquire_nvm_82571,
36005 .read_nvm = e1000e_read_nvm_eerd,
36006 .release_nvm = e1000_release_nvm_82571,
36007 diff -urNp linux-2.6.32.49/drivers/net/e1000e/e1000.h linux-2.6.32.49/drivers/net/e1000e/e1000.h
36008 --- linux-2.6.32.49/drivers/net/e1000e/e1000.h 2011-11-08 19:02:43.000000000 -0500
36009 +++ linux-2.6.32.49/drivers/net/e1000e/e1000.h 2011-11-15 19:59:43.000000000 -0500
36010 @@ -375,9 +375,9 @@ struct e1000_info {
36011 u32 pba;
36012 u32 max_hw_frame_size;
36013 s32 (*get_variants)(struct e1000_adapter *);
36014 - struct e1000_mac_operations *mac_ops;
36015 - struct e1000_phy_operations *phy_ops;
36016 - struct e1000_nvm_operations *nvm_ops;
36017 + const struct e1000_mac_operations *mac_ops;
36018 + const struct e1000_phy_operations *phy_ops;
36019 + const struct e1000_nvm_operations *nvm_ops;
36020 };
36021
36022 /* hardware capability, feature, and workaround flags */
36023 diff -urNp linux-2.6.32.49/drivers/net/e1000e/es2lan.c linux-2.6.32.49/drivers/net/e1000e/es2lan.c
36024 --- linux-2.6.32.49/drivers/net/e1000e/es2lan.c 2011-11-08 19:02:43.000000000 -0500
36025 +++ linux-2.6.32.49/drivers/net/e1000e/es2lan.c 2011-11-15 19:59:43.000000000 -0500
36026 @@ -207,7 +207,7 @@ static s32 e1000_init_mac_params_80003es
36027 {
36028 struct e1000_hw *hw = &adapter->hw;
36029 struct e1000_mac_info *mac = &hw->mac;
36030 - struct e1000_mac_operations *func = &mac->ops;
36031 + e1000_mac_operations_no_const *func = &mac->ops;
36032
36033 /* Set media type */
36034 switch (adapter->pdev->device) {
36035 @@ -1365,7 +1365,7 @@ static void e1000_clear_hw_cntrs_80003es
36036 temp = er32(ICRXDMTC);
36037 }
36038
36039 -static struct e1000_mac_operations es2_mac_ops = {
36040 +static const struct e1000_mac_operations es2_mac_ops = {
36041 .id_led_init = e1000e_id_led_init,
36042 .check_mng_mode = e1000e_check_mng_mode_generic,
36043 /* check_for_link dependent on media type */
36044 @@ -1383,7 +1383,7 @@ static struct e1000_mac_operations es2_m
36045 .setup_led = e1000e_setup_led_generic,
36046 };
36047
36048 -static struct e1000_phy_operations es2_phy_ops = {
36049 +static const struct e1000_phy_operations es2_phy_ops = {
36050 .acquire_phy = e1000_acquire_phy_80003es2lan,
36051 .check_reset_block = e1000e_check_reset_block_generic,
36052 .commit_phy = e1000e_phy_sw_reset,
36053 @@ -1400,7 +1400,7 @@ static struct e1000_phy_operations es2_p
36054 .cfg_on_link_up = e1000_cfg_on_link_up_80003es2lan,
36055 };
36056
36057 -static struct e1000_nvm_operations es2_nvm_ops = {
36058 +static const struct e1000_nvm_operations es2_nvm_ops = {
36059 .acquire_nvm = e1000_acquire_nvm_80003es2lan,
36060 .read_nvm = e1000e_read_nvm_eerd,
36061 .release_nvm = e1000_release_nvm_80003es2lan,
36062 diff -urNp linux-2.6.32.49/drivers/net/e1000e/hw.h linux-2.6.32.49/drivers/net/e1000e/hw.h
36063 --- linux-2.6.32.49/drivers/net/e1000e/hw.h 2011-11-08 19:02:43.000000000 -0500
36064 +++ linux-2.6.32.49/drivers/net/e1000e/hw.h 2011-11-15 19:59:43.000000000 -0500
36065 @@ -753,6 +753,7 @@ struct e1000_mac_operations {
36066 s32 (*setup_physical_interface)(struct e1000_hw *);
36067 s32 (*setup_led)(struct e1000_hw *);
36068 };
36069 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
36070
36071 /* Function pointers for the PHY. */
36072 struct e1000_phy_operations {
36073 @@ -774,6 +775,7 @@ struct e1000_phy_operations {
36074 s32 (*write_phy_reg_locked)(struct e1000_hw *, u32, u16);
36075 s32 (*cfg_on_link_up)(struct e1000_hw *);
36076 };
36077 +typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
36078
36079 /* Function pointers for the NVM. */
36080 struct e1000_nvm_operations {
36081 @@ -785,9 +787,10 @@ struct e1000_nvm_operations {
36082 s32 (*validate_nvm)(struct e1000_hw *);
36083 s32 (*write_nvm)(struct e1000_hw *, u16, u16, u16 *);
36084 };
36085 +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
36086
36087 struct e1000_mac_info {
36088 - struct e1000_mac_operations ops;
36089 + e1000_mac_operations_no_const ops;
36090
36091 u8 addr[6];
36092 u8 perm_addr[6];
36093 @@ -823,7 +826,7 @@ struct e1000_mac_info {
36094 };
36095
36096 struct e1000_phy_info {
36097 - struct e1000_phy_operations ops;
36098 + e1000_phy_operations_no_const ops;
36099
36100 enum e1000_phy_type type;
36101
36102 @@ -857,7 +860,7 @@ struct e1000_phy_info {
36103 };
36104
36105 struct e1000_nvm_info {
36106 - struct e1000_nvm_operations ops;
36107 + e1000_nvm_operations_no_const ops;
36108
36109 enum e1000_nvm_type type;
36110 enum e1000_nvm_override override;
36111 diff -urNp linux-2.6.32.49/drivers/net/e1000e/ich8lan.c linux-2.6.32.49/drivers/net/e1000e/ich8lan.c
36112 --- linux-2.6.32.49/drivers/net/e1000e/ich8lan.c 2011-11-08 19:02:43.000000000 -0500
36113 +++ linux-2.6.32.49/drivers/net/e1000e/ich8lan.c 2011-11-15 19:59:43.000000000 -0500
36114 @@ -3463,7 +3463,7 @@ static void e1000_clear_hw_cntrs_ich8lan
36115 }
36116 }
36117
36118 -static struct e1000_mac_operations ich8_mac_ops = {
36119 +static const struct e1000_mac_operations ich8_mac_ops = {
36120 .id_led_init = e1000e_id_led_init,
36121 .check_mng_mode = e1000_check_mng_mode_ich8lan,
36122 .check_for_link = e1000_check_for_copper_link_ich8lan,
36123 @@ -3481,7 +3481,7 @@ static struct e1000_mac_operations ich8_
36124 /* id_led_init dependent on mac type */
36125 };
36126
36127 -static struct e1000_phy_operations ich8_phy_ops = {
36128 +static const struct e1000_phy_operations ich8_phy_ops = {
36129 .acquire_phy = e1000_acquire_swflag_ich8lan,
36130 .check_reset_block = e1000_check_reset_block_ich8lan,
36131 .commit_phy = NULL,
36132 @@ -3497,7 +3497,7 @@ static struct e1000_phy_operations ich8_
36133 .write_phy_reg = e1000e_write_phy_reg_igp,
36134 };
36135
36136 -static struct e1000_nvm_operations ich8_nvm_ops = {
36137 +static const struct e1000_nvm_operations ich8_nvm_ops = {
36138 .acquire_nvm = e1000_acquire_nvm_ich8lan,
36139 .read_nvm = e1000_read_nvm_ich8lan,
36140 .release_nvm = e1000_release_nvm_ich8lan,
36141 diff -urNp linux-2.6.32.49/drivers/net/fealnx.c linux-2.6.32.49/drivers/net/fealnx.c
36142 --- linux-2.6.32.49/drivers/net/fealnx.c 2011-11-08 19:02:43.000000000 -0500
36143 +++ linux-2.6.32.49/drivers/net/fealnx.c 2011-11-18 18:01:55.000000000 -0500
36144 @@ -151,7 +151,7 @@ struct chip_info {
36145 int flags;
36146 };
36147
36148 -static const struct chip_info skel_netdrv_tbl[] __devinitdata = {
36149 +static const struct chip_info skel_netdrv_tbl[] __devinitconst = {
36150 { "100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
36151 { "100/10M Ethernet PCI Adapter", HAS_CHIP_XCVR },
36152 { "1000/100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
36153 diff -urNp linux-2.6.32.49/drivers/net/hamradio/6pack.c linux-2.6.32.49/drivers/net/hamradio/6pack.c
36154 --- linux-2.6.32.49/drivers/net/hamradio/6pack.c 2011-11-08 19:02:43.000000000 -0500
36155 +++ linux-2.6.32.49/drivers/net/hamradio/6pack.c 2011-11-15 19:59:43.000000000 -0500
36156 @@ -461,6 +461,8 @@ static void sixpack_receive_buf(struct t
36157 unsigned char buf[512];
36158 int count1;
36159
36160 + pax_track_stack();
36161 +
36162 if (!count)
36163 return;
36164
36165 diff -urNp linux-2.6.32.49/drivers/net/ibmveth.c linux-2.6.32.49/drivers/net/ibmveth.c
36166 --- linux-2.6.32.49/drivers/net/ibmveth.c 2011-11-08 19:02:43.000000000 -0500
36167 +++ linux-2.6.32.49/drivers/net/ibmveth.c 2011-11-15 19:59:43.000000000 -0500
36168 @@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attr
36169 NULL,
36170 };
36171
36172 -static struct sysfs_ops veth_pool_ops = {
36173 +static const struct sysfs_ops veth_pool_ops = {
36174 .show = veth_pool_show,
36175 .store = veth_pool_store,
36176 };
36177 diff -urNp linux-2.6.32.49/drivers/net/igb/e1000_82575.c linux-2.6.32.49/drivers/net/igb/e1000_82575.c
36178 --- linux-2.6.32.49/drivers/net/igb/e1000_82575.c 2011-11-08 19:02:43.000000000 -0500
36179 +++ linux-2.6.32.49/drivers/net/igb/e1000_82575.c 2011-11-15 19:59:43.000000000 -0500
36180 @@ -1411,7 +1411,7 @@ void igb_vmdq_set_replication_pf(struct
36181 wr32(E1000_VT_CTL, vt_ctl);
36182 }
36183
36184 -static struct e1000_mac_operations e1000_mac_ops_82575 = {
36185 +static const struct e1000_mac_operations e1000_mac_ops_82575 = {
36186 .reset_hw = igb_reset_hw_82575,
36187 .init_hw = igb_init_hw_82575,
36188 .check_for_link = igb_check_for_link_82575,
36189 @@ -1420,13 +1420,13 @@ static struct e1000_mac_operations e1000
36190 .get_speed_and_duplex = igb_get_speed_and_duplex_copper,
36191 };
36192
36193 -static struct e1000_phy_operations e1000_phy_ops_82575 = {
36194 +static const struct e1000_phy_operations e1000_phy_ops_82575 = {
36195 .acquire = igb_acquire_phy_82575,
36196 .get_cfg_done = igb_get_cfg_done_82575,
36197 .release = igb_release_phy_82575,
36198 };
36199
36200 -static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
36201 +static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
36202 .acquire = igb_acquire_nvm_82575,
36203 .read = igb_read_nvm_eerd,
36204 .release = igb_release_nvm_82575,
36205 diff -urNp linux-2.6.32.49/drivers/net/igb/e1000_hw.h linux-2.6.32.49/drivers/net/igb/e1000_hw.h
36206 --- linux-2.6.32.49/drivers/net/igb/e1000_hw.h 2011-11-08 19:02:43.000000000 -0500
36207 +++ linux-2.6.32.49/drivers/net/igb/e1000_hw.h 2011-11-15 19:59:43.000000000 -0500
36208 @@ -288,6 +288,7 @@ struct e1000_mac_operations {
36209 s32 (*read_mac_addr)(struct e1000_hw *);
36210 s32 (*get_speed_and_duplex)(struct e1000_hw *, u16 *, u16 *);
36211 };
36212 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
36213
36214 struct e1000_phy_operations {
36215 s32 (*acquire)(struct e1000_hw *);
36216 @@ -303,6 +304,7 @@ struct e1000_phy_operations {
36217 s32 (*set_d3_lplu_state)(struct e1000_hw *, bool);
36218 s32 (*write_reg)(struct e1000_hw *, u32, u16);
36219 };
36220 +typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
36221
36222 struct e1000_nvm_operations {
36223 s32 (*acquire)(struct e1000_hw *);
36224 @@ -310,6 +312,7 @@ struct e1000_nvm_operations {
36225 void (*release)(struct e1000_hw *);
36226 s32 (*write)(struct e1000_hw *, u16, u16, u16 *);
36227 };
36228 +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
36229
36230 struct e1000_info {
36231 s32 (*get_invariants)(struct e1000_hw *);
36232 @@ -321,7 +324,7 @@ struct e1000_info {
36233 extern const struct e1000_info e1000_82575_info;
36234
36235 struct e1000_mac_info {
36236 - struct e1000_mac_operations ops;
36237 + e1000_mac_operations_no_const ops;
36238
36239 u8 addr[6];
36240 u8 perm_addr[6];
36241 @@ -365,7 +368,7 @@ struct e1000_mac_info {
36242 };
36243
36244 struct e1000_phy_info {
36245 - struct e1000_phy_operations ops;
36246 + e1000_phy_operations_no_const ops;
36247
36248 enum e1000_phy_type type;
36249
36250 @@ -400,7 +403,7 @@ struct e1000_phy_info {
36251 };
36252
36253 struct e1000_nvm_info {
36254 - struct e1000_nvm_operations ops;
36255 + e1000_nvm_operations_no_const ops;
36256
36257 enum e1000_nvm_type type;
36258 enum e1000_nvm_override override;
36259 @@ -446,6 +449,7 @@ struct e1000_mbx_operations {
36260 s32 (*check_for_ack)(struct e1000_hw *, u16);
36261 s32 (*check_for_rst)(struct e1000_hw *, u16);
36262 };
36263 +typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
36264
36265 struct e1000_mbx_stats {
36266 u32 msgs_tx;
36267 @@ -457,7 +461,7 @@ struct e1000_mbx_stats {
36268 };
36269
36270 struct e1000_mbx_info {
36271 - struct e1000_mbx_operations ops;
36272 + e1000_mbx_operations_no_const ops;
36273 struct e1000_mbx_stats stats;
36274 u32 timeout;
36275 u32 usec_delay;
36276 diff -urNp linux-2.6.32.49/drivers/net/igbvf/vf.h linux-2.6.32.49/drivers/net/igbvf/vf.h
36277 --- linux-2.6.32.49/drivers/net/igbvf/vf.h 2011-11-08 19:02:43.000000000 -0500
36278 +++ linux-2.6.32.49/drivers/net/igbvf/vf.h 2011-11-15 19:59:43.000000000 -0500
36279 @@ -187,9 +187,10 @@ struct e1000_mac_operations {
36280 s32 (*read_mac_addr)(struct e1000_hw *);
36281 s32 (*set_vfta)(struct e1000_hw *, u16, bool);
36282 };
36283 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
36284
36285 struct e1000_mac_info {
36286 - struct e1000_mac_operations ops;
36287 + e1000_mac_operations_no_const ops;
36288 u8 addr[6];
36289 u8 perm_addr[6];
36290
36291 @@ -211,6 +212,7 @@ struct e1000_mbx_operations {
36292 s32 (*check_for_ack)(struct e1000_hw *);
36293 s32 (*check_for_rst)(struct e1000_hw *);
36294 };
36295 +typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
36296
36297 struct e1000_mbx_stats {
36298 u32 msgs_tx;
36299 @@ -222,7 +224,7 @@ struct e1000_mbx_stats {
36300 };
36301
36302 struct e1000_mbx_info {
36303 - struct e1000_mbx_operations ops;
36304 + e1000_mbx_operations_no_const ops;
36305 struct e1000_mbx_stats stats;
36306 u32 timeout;
36307 u32 usec_delay;
36308 diff -urNp linux-2.6.32.49/drivers/net/iseries_veth.c linux-2.6.32.49/drivers/net/iseries_veth.c
36309 --- linux-2.6.32.49/drivers/net/iseries_veth.c 2011-11-08 19:02:43.000000000 -0500
36310 +++ linux-2.6.32.49/drivers/net/iseries_veth.c 2011-11-15 19:59:43.000000000 -0500
36311 @@ -384,7 +384,7 @@ static struct attribute *veth_cnx_defaul
36312 NULL
36313 };
36314
36315 -static struct sysfs_ops veth_cnx_sysfs_ops = {
36316 +static const struct sysfs_ops veth_cnx_sysfs_ops = {
36317 .show = veth_cnx_attribute_show
36318 };
36319
36320 @@ -441,7 +441,7 @@ static struct attribute *veth_port_defau
36321 NULL
36322 };
36323
36324 -static struct sysfs_ops veth_port_sysfs_ops = {
36325 +static const struct sysfs_ops veth_port_sysfs_ops = {
36326 .show = veth_port_attribute_show
36327 };
36328
36329 diff -urNp linux-2.6.32.49/drivers/net/ixgb/ixgb_main.c linux-2.6.32.49/drivers/net/ixgb/ixgb_main.c
36330 --- linux-2.6.32.49/drivers/net/ixgb/ixgb_main.c 2011-11-08 19:02:43.000000000 -0500
36331 +++ linux-2.6.32.49/drivers/net/ixgb/ixgb_main.c 2011-11-15 19:59:43.000000000 -0500
36332 @@ -1052,6 +1052,8 @@ ixgb_set_multi(struct net_device *netdev
36333 u32 rctl;
36334 int i;
36335
36336 + pax_track_stack();
36337 +
36338 /* Check for Promiscuous and All Multicast modes */
36339
36340 rctl = IXGB_READ_REG(hw, RCTL);
36341 diff -urNp linux-2.6.32.49/drivers/net/ixgb/ixgb_param.c linux-2.6.32.49/drivers/net/ixgb/ixgb_param.c
36342 --- linux-2.6.32.49/drivers/net/ixgb/ixgb_param.c 2011-11-08 19:02:43.000000000 -0500
36343 +++ linux-2.6.32.49/drivers/net/ixgb/ixgb_param.c 2011-11-15 19:59:43.000000000 -0500
36344 @@ -260,6 +260,9 @@ void __devinit
36345 ixgb_check_options(struct ixgb_adapter *adapter)
36346 {
36347 int bd = adapter->bd_number;
36348 +
36349 + pax_track_stack();
36350 +
36351 if (bd >= IXGB_MAX_NIC) {
36352 printk(KERN_NOTICE
36353 "Warning: no configuration for board #%i\n", bd);
36354 diff -urNp linux-2.6.32.49/drivers/net/ixgbe/ixgbe_type.h linux-2.6.32.49/drivers/net/ixgbe/ixgbe_type.h
36355 --- linux-2.6.32.49/drivers/net/ixgbe/ixgbe_type.h 2011-11-08 19:02:43.000000000 -0500
36356 +++ linux-2.6.32.49/drivers/net/ixgbe/ixgbe_type.h 2011-11-15 19:59:43.000000000 -0500
36357 @@ -2327,6 +2327,7 @@ struct ixgbe_eeprom_operations {
36358 s32 (*validate_checksum)(struct ixgbe_hw *, u16 *);
36359 s32 (*update_checksum)(struct ixgbe_hw *);
36360 };
36361 +typedef struct ixgbe_eeprom_operations __no_const ixgbe_eeprom_operations_no_const;
36362
36363 struct ixgbe_mac_operations {
36364 s32 (*init_hw)(struct ixgbe_hw *);
36365 @@ -2376,6 +2377,7 @@ struct ixgbe_mac_operations {
36366 /* Flow Control */
36367 s32 (*fc_enable)(struct ixgbe_hw *, s32);
36368 };
36369 +typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
36370
36371 struct ixgbe_phy_operations {
36372 s32 (*identify)(struct ixgbe_hw *);
36373 @@ -2394,9 +2396,10 @@ struct ixgbe_phy_operations {
36374 s32 (*read_i2c_eeprom)(struct ixgbe_hw *, u8 , u8 *);
36375 s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
36376 };
36377 +typedef struct ixgbe_phy_operations __no_const ixgbe_phy_operations_no_const;
36378
36379 struct ixgbe_eeprom_info {
36380 - struct ixgbe_eeprom_operations ops;
36381 + ixgbe_eeprom_operations_no_const ops;
36382 enum ixgbe_eeprom_type type;
36383 u32 semaphore_delay;
36384 u16 word_size;
36385 @@ -2404,7 +2407,7 @@ struct ixgbe_eeprom_info {
36386 };
36387
36388 struct ixgbe_mac_info {
36389 - struct ixgbe_mac_operations ops;
36390 + ixgbe_mac_operations_no_const ops;
36391 enum ixgbe_mac_type type;
36392 u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
36393 u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
36394 @@ -2423,7 +2426,7 @@ struct ixgbe_mac_info {
36395 };
36396
36397 struct ixgbe_phy_info {
36398 - struct ixgbe_phy_operations ops;
36399 + ixgbe_phy_operations_no_const ops;
36400 struct mdio_if_info mdio;
36401 enum ixgbe_phy_type type;
36402 u32 id;
36403 diff -urNp linux-2.6.32.49/drivers/net/mlx4/main.c linux-2.6.32.49/drivers/net/mlx4/main.c
36404 --- linux-2.6.32.49/drivers/net/mlx4/main.c 2011-11-08 19:02:43.000000000 -0500
36405 +++ linux-2.6.32.49/drivers/net/mlx4/main.c 2011-11-15 19:59:43.000000000 -0500
36406 @@ -38,6 +38,7 @@
36407 #include <linux/errno.h>
36408 #include <linux/pci.h>
36409 #include <linux/dma-mapping.h>
36410 +#include <linux/sched.h>
36411
36412 #include <linux/mlx4/device.h>
36413 #include <linux/mlx4/doorbell.h>
36414 @@ -730,6 +731,8 @@ static int mlx4_init_hca(struct mlx4_dev
36415 u64 icm_size;
36416 int err;
36417
36418 + pax_track_stack();
36419 +
36420 err = mlx4_QUERY_FW(dev);
36421 if (err) {
36422 if (err == -EACCES)
36423 diff -urNp linux-2.6.32.49/drivers/net/niu.c linux-2.6.32.49/drivers/net/niu.c
36424 --- linux-2.6.32.49/drivers/net/niu.c 2011-11-08 19:02:43.000000000 -0500
36425 +++ linux-2.6.32.49/drivers/net/niu.c 2011-11-15 19:59:43.000000000 -0500
36426 @@ -9128,6 +9128,8 @@ static void __devinit niu_try_msix(struc
36427 int i, num_irqs, err;
36428 u8 first_ldg;
36429
36430 + pax_track_stack();
36431 +
36432 first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
36433 for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
36434 ldg_num_map[i] = first_ldg + i;
36435 diff -urNp linux-2.6.32.49/drivers/net/pcnet32.c linux-2.6.32.49/drivers/net/pcnet32.c
36436 --- linux-2.6.32.49/drivers/net/pcnet32.c 2011-11-08 19:02:43.000000000 -0500
36437 +++ linux-2.6.32.49/drivers/net/pcnet32.c 2011-11-15 19:59:43.000000000 -0500
36438 @@ -79,7 +79,7 @@ static int cards_found;
36439 /*
36440 * VLB I/O addresses
36441 */
36442 -static unsigned int pcnet32_portlist[] __initdata =
36443 +static unsigned int pcnet32_portlist[] __devinitdata =
36444 { 0x300, 0x320, 0x340, 0x360, 0 };
36445
36446 static int pcnet32_debug = 0;
36447 @@ -267,7 +267,7 @@ struct pcnet32_private {
36448 struct sk_buff **rx_skbuff;
36449 dma_addr_t *tx_dma_addr;
36450 dma_addr_t *rx_dma_addr;
36451 - struct pcnet32_access a;
36452 + struct pcnet32_access *a;
36453 spinlock_t lock; /* Guard lock */
36454 unsigned int cur_rx, cur_tx; /* The next free ring entry */
36455 unsigned int rx_ring_size; /* current rx ring size */
36456 @@ -457,9 +457,9 @@ static void pcnet32_netif_start(struct n
36457 u16 val;
36458
36459 netif_wake_queue(dev);
36460 - val = lp->a.read_csr(ioaddr, CSR3);
36461 + val = lp->a->read_csr(ioaddr, CSR3);
36462 val &= 0x00ff;
36463 - lp->a.write_csr(ioaddr, CSR3, val);
36464 + lp->a->write_csr(ioaddr, CSR3, val);
36465 napi_enable(&lp->napi);
36466 }
36467
36468 @@ -744,7 +744,7 @@ static u32 pcnet32_get_link(struct net_d
36469 r = mii_link_ok(&lp->mii_if);
36470 } else if (lp->chip_version >= PCNET32_79C970A) {
36471 ulong ioaddr = dev->base_addr; /* card base I/O address */
36472 - r = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
36473 + r = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
36474 } else { /* can not detect link on really old chips */
36475 r = 1;
36476 }
36477 @@ -806,7 +806,7 @@ static int pcnet32_set_ringparam(struct
36478 pcnet32_netif_stop(dev);
36479
36480 spin_lock_irqsave(&lp->lock, flags);
36481 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
36482 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
36483
36484 size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
36485
36486 @@ -886,7 +886,7 @@ static void pcnet32_ethtool_test(struct
36487 static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
36488 {
36489 struct pcnet32_private *lp = netdev_priv(dev);
36490 - struct pcnet32_access *a = &lp->a; /* access to registers */
36491 + struct pcnet32_access *a = lp->a; /* access to registers */
36492 ulong ioaddr = dev->base_addr; /* card base I/O address */
36493 struct sk_buff *skb; /* sk buff */
36494 int x, i; /* counters */
36495 @@ -906,21 +906,21 @@ static int pcnet32_loopback_test(struct
36496 pcnet32_netif_stop(dev);
36497
36498 spin_lock_irqsave(&lp->lock, flags);
36499 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
36500 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
36501
36502 numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size));
36503
36504 /* Reset the PCNET32 */
36505 - lp->a.reset(ioaddr);
36506 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
36507 + lp->a->reset(ioaddr);
36508 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
36509
36510 /* switch pcnet32 to 32bit mode */
36511 - lp->a.write_bcr(ioaddr, 20, 2);
36512 + lp->a->write_bcr(ioaddr, 20, 2);
36513
36514 /* purge & init rings but don't actually restart */
36515 pcnet32_restart(dev, 0x0000);
36516
36517 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
36518 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
36519
36520 /* Initialize Transmit buffers. */
36521 size = data_len + 15;
36522 @@ -966,10 +966,10 @@ static int pcnet32_loopback_test(struct
36523
36524 /* set int loopback in CSR15 */
36525 x = a->read_csr(ioaddr, CSR15) & 0xfffc;
36526 - lp->a.write_csr(ioaddr, CSR15, x | 0x0044);
36527 + lp->a->write_csr(ioaddr, CSR15, x | 0x0044);
36528
36529 teststatus = cpu_to_le16(0x8000);
36530 - lp->a.write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
36531 + lp->a->write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
36532
36533 /* Check status of descriptors */
36534 for (x = 0; x < numbuffs; x++) {
36535 @@ -990,7 +990,7 @@ static int pcnet32_loopback_test(struct
36536 }
36537 }
36538
36539 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
36540 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
36541 wmb();
36542 if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) {
36543 printk(KERN_DEBUG "%s: RX loopback packets:\n", dev->name);
36544 @@ -1039,7 +1039,7 @@ static int pcnet32_loopback_test(struct
36545 pcnet32_restart(dev, CSR0_NORMAL);
36546 } else {
36547 pcnet32_purge_rx_ring(dev);
36548 - lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
36549 + lp->a->write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
36550 }
36551 spin_unlock_irqrestore(&lp->lock, flags);
36552
36553 @@ -1049,7 +1049,7 @@ static int pcnet32_loopback_test(struct
36554 static void pcnet32_led_blink_callback(struct net_device *dev)
36555 {
36556 struct pcnet32_private *lp = netdev_priv(dev);
36557 - struct pcnet32_access *a = &lp->a;
36558 + struct pcnet32_access *a = lp->a;
36559 ulong ioaddr = dev->base_addr;
36560 unsigned long flags;
36561 int i;
36562 @@ -1066,7 +1066,7 @@ static void pcnet32_led_blink_callback(s
36563 static int pcnet32_phys_id(struct net_device *dev, u32 data)
36564 {
36565 struct pcnet32_private *lp = netdev_priv(dev);
36566 - struct pcnet32_access *a = &lp->a;
36567 + struct pcnet32_access *a = lp->a;
36568 ulong ioaddr = dev->base_addr;
36569 unsigned long flags;
36570 int i, regs[4];
36571 @@ -1112,7 +1112,7 @@ static int pcnet32_suspend(struct net_de
36572 {
36573 int csr5;
36574 struct pcnet32_private *lp = netdev_priv(dev);
36575 - struct pcnet32_access *a = &lp->a;
36576 + struct pcnet32_access *a = lp->a;
36577 ulong ioaddr = dev->base_addr;
36578 int ticks;
36579
36580 @@ -1388,8 +1388,8 @@ static int pcnet32_poll(struct napi_stru
36581 spin_lock_irqsave(&lp->lock, flags);
36582 if (pcnet32_tx(dev)) {
36583 /* reset the chip to clear the error condition, then restart */
36584 - lp->a.reset(ioaddr);
36585 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
36586 + lp->a->reset(ioaddr);
36587 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
36588 pcnet32_restart(dev, CSR0_START);
36589 netif_wake_queue(dev);
36590 }
36591 @@ -1401,12 +1401,12 @@ static int pcnet32_poll(struct napi_stru
36592 __napi_complete(napi);
36593
36594 /* clear interrupt masks */
36595 - val = lp->a.read_csr(ioaddr, CSR3);
36596 + val = lp->a->read_csr(ioaddr, CSR3);
36597 val &= 0x00ff;
36598 - lp->a.write_csr(ioaddr, CSR3, val);
36599 + lp->a->write_csr(ioaddr, CSR3, val);
36600
36601 /* Set interrupt enable. */
36602 - lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN);
36603 + lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN);
36604
36605 spin_unlock_irqrestore(&lp->lock, flags);
36606 }
36607 @@ -1429,7 +1429,7 @@ static void pcnet32_get_regs(struct net_
36608 int i, csr0;
36609 u16 *buff = ptr;
36610 struct pcnet32_private *lp = netdev_priv(dev);
36611 - struct pcnet32_access *a = &lp->a;
36612 + struct pcnet32_access *a = lp->a;
36613 ulong ioaddr = dev->base_addr;
36614 unsigned long flags;
36615
36616 @@ -1466,9 +1466,9 @@ static void pcnet32_get_regs(struct net_
36617 for (j = 0; j < PCNET32_MAX_PHYS; j++) {
36618 if (lp->phymask & (1 << j)) {
36619 for (i = 0; i < PCNET32_REGS_PER_PHY; i++) {
36620 - lp->a.write_bcr(ioaddr, 33,
36621 + lp->a->write_bcr(ioaddr, 33,
36622 (j << 5) | i);
36623 - *buff++ = lp->a.read_bcr(ioaddr, 34);
36624 + *buff++ = lp->a->read_bcr(ioaddr, 34);
36625 }
36626 }
36627 }
36628 @@ -1858,7 +1858,7 @@ pcnet32_probe1(unsigned long ioaddr, int
36629 ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
36630 lp->options |= PCNET32_PORT_FD;
36631
36632 - lp->a = *a;
36633 + lp->a = a;
36634
36635 /* prior to register_netdev, dev->name is not yet correct */
36636 if (pcnet32_alloc_ring(dev, pci_name(lp->pci_dev))) {
36637 @@ -1917,7 +1917,7 @@ pcnet32_probe1(unsigned long ioaddr, int
36638 if (lp->mii) {
36639 /* lp->phycount and lp->phymask are set to 0 by memset above */
36640
36641 - lp->mii_if.phy_id = ((lp->a.read_bcr(ioaddr, 33)) >> 5) & 0x1f;
36642 + lp->mii_if.phy_id = ((lp->a->read_bcr(ioaddr, 33)) >> 5) & 0x1f;
36643 /* scan for PHYs */
36644 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
36645 unsigned short id1, id2;
36646 @@ -1938,7 +1938,7 @@ pcnet32_probe1(unsigned long ioaddr, int
36647 "Found PHY %04x:%04x at address %d.\n",
36648 id1, id2, i);
36649 }
36650 - lp->a.write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
36651 + lp->a->write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
36652 if (lp->phycount > 1) {
36653 lp->options |= PCNET32_PORT_MII;
36654 }
36655 @@ -2109,10 +2109,10 @@ static int pcnet32_open(struct net_devic
36656 }
36657
36658 /* Reset the PCNET32 */
36659 - lp->a.reset(ioaddr);
36660 + lp->a->reset(ioaddr);
36661
36662 /* switch pcnet32 to 32bit mode */
36663 - lp->a.write_bcr(ioaddr, 20, 2);
36664 + lp->a->write_bcr(ioaddr, 20, 2);
36665
36666 if (netif_msg_ifup(lp))
36667 printk(KERN_DEBUG
36668 @@ -2122,14 +2122,14 @@ static int pcnet32_open(struct net_devic
36669 (u32) (lp->init_dma_addr));
36670
36671 /* set/reset autoselect bit */
36672 - val = lp->a.read_bcr(ioaddr, 2) & ~2;
36673 + val = lp->a->read_bcr(ioaddr, 2) & ~2;
36674 if (lp->options & PCNET32_PORT_ASEL)
36675 val |= 2;
36676 - lp->a.write_bcr(ioaddr, 2, val);
36677 + lp->a->write_bcr(ioaddr, 2, val);
36678
36679 /* handle full duplex setting */
36680 if (lp->mii_if.full_duplex) {
36681 - val = lp->a.read_bcr(ioaddr, 9) & ~3;
36682 + val = lp->a->read_bcr(ioaddr, 9) & ~3;
36683 if (lp->options & PCNET32_PORT_FD) {
36684 val |= 1;
36685 if (lp->options == (PCNET32_PORT_FD | PCNET32_PORT_AUI))
36686 @@ -2139,14 +2139,14 @@ static int pcnet32_open(struct net_devic
36687 if (lp->chip_version == 0x2627)
36688 val |= 3;
36689 }
36690 - lp->a.write_bcr(ioaddr, 9, val);
36691 + lp->a->write_bcr(ioaddr, 9, val);
36692 }
36693
36694 /* set/reset GPSI bit in test register */
36695 - val = lp->a.read_csr(ioaddr, 124) & ~0x10;
36696 + val = lp->a->read_csr(ioaddr, 124) & ~0x10;
36697 if ((lp->options & PCNET32_PORT_PORTSEL) == PCNET32_PORT_GPSI)
36698 val |= 0x10;
36699 - lp->a.write_csr(ioaddr, 124, val);
36700 + lp->a->write_csr(ioaddr, 124, val);
36701
36702 /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
36703 if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
36704 @@ -2167,24 +2167,24 @@ static int pcnet32_open(struct net_devic
36705 * duplex, and/or enable auto negotiation, and clear DANAS
36706 */
36707 if (lp->mii && !(lp->options & PCNET32_PORT_ASEL)) {
36708 - lp->a.write_bcr(ioaddr, 32,
36709 - lp->a.read_bcr(ioaddr, 32) | 0x0080);
36710 + lp->a->write_bcr(ioaddr, 32,
36711 + lp->a->read_bcr(ioaddr, 32) | 0x0080);
36712 /* disable Auto Negotiation, set 10Mpbs, HD */
36713 - val = lp->a.read_bcr(ioaddr, 32) & ~0xb8;
36714 + val = lp->a->read_bcr(ioaddr, 32) & ~0xb8;
36715 if (lp->options & PCNET32_PORT_FD)
36716 val |= 0x10;
36717 if (lp->options & PCNET32_PORT_100)
36718 val |= 0x08;
36719 - lp->a.write_bcr(ioaddr, 32, val);
36720 + lp->a->write_bcr(ioaddr, 32, val);
36721 } else {
36722 if (lp->options & PCNET32_PORT_ASEL) {
36723 - lp->a.write_bcr(ioaddr, 32,
36724 - lp->a.read_bcr(ioaddr,
36725 + lp->a->write_bcr(ioaddr, 32,
36726 + lp->a->read_bcr(ioaddr,
36727 32) | 0x0080);
36728 /* enable auto negotiate, setup, disable fd */
36729 - val = lp->a.read_bcr(ioaddr, 32) & ~0x98;
36730 + val = lp->a->read_bcr(ioaddr, 32) & ~0x98;
36731 val |= 0x20;
36732 - lp->a.write_bcr(ioaddr, 32, val);
36733 + lp->a->write_bcr(ioaddr, 32, val);
36734 }
36735 }
36736 } else {
36737 @@ -2197,10 +2197,10 @@ static int pcnet32_open(struct net_devic
36738 * There is really no good other way to handle multiple PHYs
36739 * other than turning off all automatics
36740 */
36741 - val = lp->a.read_bcr(ioaddr, 2);
36742 - lp->a.write_bcr(ioaddr, 2, val & ~2);
36743 - val = lp->a.read_bcr(ioaddr, 32);
36744 - lp->a.write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
36745 + val = lp->a->read_bcr(ioaddr, 2);
36746 + lp->a->write_bcr(ioaddr, 2, val & ~2);
36747 + val = lp->a->read_bcr(ioaddr, 32);
36748 + lp->a->write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
36749
36750 if (!(lp->options & PCNET32_PORT_ASEL)) {
36751 /* setup ecmd */
36752 @@ -2210,7 +2210,7 @@ static int pcnet32_open(struct net_devic
36753 ecmd.speed =
36754 lp->
36755 options & PCNET32_PORT_100 ? SPEED_100 : SPEED_10;
36756 - bcr9 = lp->a.read_bcr(ioaddr, 9);
36757 + bcr9 = lp->a->read_bcr(ioaddr, 9);
36758
36759 if (lp->options & PCNET32_PORT_FD) {
36760 ecmd.duplex = DUPLEX_FULL;
36761 @@ -2219,7 +2219,7 @@ static int pcnet32_open(struct net_devic
36762 ecmd.duplex = DUPLEX_HALF;
36763 bcr9 |= ~(1 << 0);
36764 }
36765 - lp->a.write_bcr(ioaddr, 9, bcr9);
36766 + lp->a->write_bcr(ioaddr, 9, bcr9);
36767 }
36768
36769 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
36770 @@ -2252,9 +2252,9 @@ static int pcnet32_open(struct net_devic
36771
36772 #ifdef DO_DXSUFLO
36773 if (lp->dxsuflo) { /* Disable transmit stop on underflow */
36774 - val = lp->a.read_csr(ioaddr, CSR3);
36775 + val = lp->a->read_csr(ioaddr, CSR3);
36776 val |= 0x40;
36777 - lp->a.write_csr(ioaddr, CSR3, val);
36778 + lp->a->write_csr(ioaddr, CSR3, val);
36779 }
36780 #endif
36781
36782 @@ -2270,11 +2270,11 @@ static int pcnet32_open(struct net_devic
36783 napi_enable(&lp->napi);
36784
36785 /* Re-initialize the PCNET32, and start it when done. */
36786 - lp->a.write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
36787 - lp->a.write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
36788 + lp->a->write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
36789 + lp->a->write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
36790
36791 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
36792 - lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
36793 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
36794 + lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
36795
36796 netif_start_queue(dev);
36797
36798 @@ -2286,20 +2286,20 @@ static int pcnet32_open(struct net_devic
36799
36800 i = 0;
36801 while (i++ < 100)
36802 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
36803 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
36804 break;
36805 /*
36806 * We used to clear the InitDone bit, 0x0100, here but Mark Stockton
36807 * reports that doing so triggers a bug in the '974.
36808 */
36809 - lp->a.write_csr(ioaddr, CSR0, CSR0_NORMAL);
36810 + lp->a->write_csr(ioaddr, CSR0, CSR0_NORMAL);
36811
36812 if (netif_msg_ifup(lp))
36813 printk(KERN_DEBUG
36814 "%s: pcnet32 open after %d ticks, init block %#x csr0 %4.4x.\n",
36815 dev->name, i,
36816 (u32) (lp->init_dma_addr),
36817 - lp->a.read_csr(ioaddr, CSR0));
36818 + lp->a->read_csr(ioaddr, CSR0));
36819
36820 spin_unlock_irqrestore(&lp->lock, flags);
36821
36822 @@ -2313,7 +2313,7 @@ static int pcnet32_open(struct net_devic
36823 * Switch back to 16bit mode to avoid problems with dumb
36824 * DOS packet driver after a warm reboot
36825 */
36826 - lp->a.write_bcr(ioaddr, 20, 4);
36827 + lp->a->write_bcr(ioaddr, 20, 4);
36828
36829 err_free_irq:
36830 spin_unlock_irqrestore(&lp->lock, flags);
36831 @@ -2420,7 +2420,7 @@ static void pcnet32_restart(struct net_d
36832
36833 /* wait for stop */
36834 for (i = 0; i < 100; i++)
36835 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_STOP)
36836 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_STOP)
36837 break;
36838
36839 if (i >= 100 && netif_msg_drv(lp))
36840 @@ -2433,13 +2433,13 @@ static void pcnet32_restart(struct net_d
36841 return;
36842
36843 /* ReInit Ring */
36844 - lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
36845 + lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
36846 i = 0;
36847 while (i++ < 1000)
36848 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
36849 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
36850 break;
36851
36852 - lp->a.write_csr(ioaddr, CSR0, csr0_bits);
36853 + lp->a->write_csr(ioaddr, CSR0, csr0_bits);
36854 }
36855
36856 static void pcnet32_tx_timeout(struct net_device *dev)
36857 @@ -2452,8 +2452,8 @@ static void pcnet32_tx_timeout(struct ne
36858 if (pcnet32_debug & NETIF_MSG_DRV)
36859 printk(KERN_ERR
36860 "%s: transmit timed out, status %4.4x, resetting.\n",
36861 - dev->name, lp->a.read_csr(ioaddr, CSR0));
36862 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
36863 + dev->name, lp->a->read_csr(ioaddr, CSR0));
36864 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
36865 dev->stats.tx_errors++;
36866 if (netif_msg_tx_err(lp)) {
36867 int i;
36868 @@ -2497,7 +2497,7 @@ static netdev_tx_t pcnet32_start_xmit(st
36869 if (netif_msg_tx_queued(lp)) {
36870 printk(KERN_DEBUG
36871 "%s: pcnet32_start_xmit() called, csr0 %4.4x.\n",
36872 - dev->name, lp->a.read_csr(ioaddr, CSR0));
36873 + dev->name, lp->a->read_csr(ioaddr, CSR0));
36874 }
36875
36876 /* Default status -- will not enable Successful-TxDone
36877 @@ -2528,7 +2528,7 @@ static netdev_tx_t pcnet32_start_xmit(st
36878 dev->stats.tx_bytes += skb->len;
36879
36880 /* Trigger an immediate send poll. */
36881 - lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
36882 + lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
36883
36884 dev->trans_start = jiffies;
36885
36886 @@ -2555,18 +2555,18 @@ pcnet32_interrupt(int irq, void *dev_id)
36887
36888 spin_lock(&lp->lock);
36889
36890 - csr0 = lp->a.read_csr(ioaddr, CSR0);
36891 + csr0 = lp->a->read_csr(ioaddr, CSR0);
36892 while ((csr0 & 0x8f00) && --boguscnt >= 0) {
36893 if (csr0 == 0xffff) {
36894 break; /* PCMCIA remove happened */
36895 }
36896 /* Acknowledge all of the current interrupt sources ASAP. */
36897 - lp->a.write_csr(ioaddr, CSR0, csr0 & ~0x004f);
36898 + lp->a->write_csr(ioaddr, CSR0, csr0 & ~0x004f);
36899
36900 if (netif_msg_intr(lp))
36901 printk(KERN_DEBUG
36902 "%s: interrupt csr0=%#2.2x new csr=%#2.2x.\n",
36903 - dev->name, csr0, lp->a.read_csr(ioaddr, CSR0));
36904 + dev->name, csr0, lp->a->read_csr(ioaddr, CSR0));
36905
36906 /* Log misc errors. */
36907 if (csr0 & 0x4000)
36908 @@ -2595,19 +2595,19 @@ pcnet32_interrupt(int irq, void *dev_id)
36909 if (napi_schedule_prep(&lp->napi)) {
36910 u16 val;
36911 /* set interrupt masks */
36912 - val = lp->a.read_csr(ioaddr, CSR3);
36913 + val = lp->a->read_csr(ioaddr, CSR3);
36914 val |= 0x5f00;
36915 - lp->a.write_csr(ioaddr, CSR3, val);
36916 + lp->a->write_csr(ioaddr, CSR3, val);
36917
36918 __napi_schedule(&lp->napi);
36919 break;
36920 }
36921 - csr0 = lp->a.read_csr(ioaddr, CSR0);
36922 + csr0 = lp->a->read_csr(ioaddr, CSR0);
36923 }
36924
36925 if (netif_msg_intr(lp))
36926 printk(KERN_DEBUG "%s: exiting interrupt, csr0=%#4.4x.\n",
36927 - dev->name, lp->a.read_csr(ioaddr, CSR0));
36928 + dev->name, lp->a->read_csr(ioaddr, CSR0));
36929
36930 spin_unlock(&lp->lock);
36931
36932 @@ -2627,21 +2627,21 @@ static int pcnet32_close(struct net_devi
36933
36934 spin_lock_irqsave(&lp->lock, flags);
36935
36936 - dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
36937 + dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
36938
36939 if (netif_msg_ifdown(lp))
36940 printk(KERN_DEBUG
36941 "%s: Shutting down ethercard, status was %2.2x.\n",
36942 - dev->name, lp->a.read_csr(ioaddr, CSR0));
36943 + dev->name, lp->a->read_csr(ioaddr, CSR0));
36944
36945 /* We stop the PCNET32 here -- it occasionally polls memory if we don't. */
36946 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
36947 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
36948
36949 /*
36950 * Switch back to 16bit mode to avoid problems with dumb
36951 * DOS packet driver after a warm reboot
36952 */
36953 - lp->a.write_bcr(ioaddr, 20, 4);
36954 + lp->a->write_bcr(ioaddr, 20, 4);
36955
36956 spin_unlock_irqrestore(&lp->lock, flags);
36957
36958 @@ -2664,7 +2664,7 @@ static struct net_device_stats *pcnet32_
36959 unsigned long flags;
36960
36961 spin_lock_irqsave(&lp->lock, flags);
36962 - dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
36963 + dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
36964 spin_unlock_irqrestore(&lp->lock, flags);
36965
36966 return &dev->stats;
36967 @@ -2686,10 +2686,10 @@ static void pcnet32_load_multicast(struc
36968 if (dev->flags & IFF_ALLMULTI) {
36969 ib->filter[0] = cpu_to_le32(~0U);
36970 ib->filter[1] = cpu_to_le32(~0U);
36971 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
36972 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
36973 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
36974 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
36975 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
36976 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
36977 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
36978 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
36979 return;
36980 }
36981 /* clear the multicast filter */
36982 @@ -2710,7 +2710,7 @@ static void pcnet32_load_multicast(struc
36983 mcast_table[crc >> 4] |= cpu_to_le16(1 << (crc & 0xf));
36984 }
36985 for (i = 0; i < 4; i++)
36986 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i,
36987 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER + i,
36988 le16_to_cpu(mcast_table[i]));
36989 return;
36990 }
36991 @@ -2726,7 +2726,7 @@ static void pcnet32_set_multicast_list(s
36992
36993 spin_lock_irqsave(&lp->lock, flags);
36994 suspended = pcnet32_suspend(dev, &flags, 0);
36995 - csr15 = lp->a.read_csr(ioaddr, CSR15);
36996 + csr15 = lp->a->read_csr(ioaddr, CSR15);
36997 if (dev->flags & IFF_PROMISC) {
36998 /* Log any net taps. */
36999 if (netif_msg_hw(lp))
37000 @@ -2735,21 +2735,21 @@ static void pcnet32_set_multicast_list(s
37001 lp->init_block->mode =
37002 cpu_to_le16(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) <<
37003 7);
37004 - lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000);
37005 + lp->a->write_csr(ioaddr, CSR15, csr15 | 0x8000);
37006 } else {
37007 lp->init_block->mode =
37008 cpu_to_le16((lp->options & PCNET32_PORT_PORTSEL) << 7);
37009 - lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff);
37010 + lp->a->write_csr(ioaddr, CSR15, csr15 & 0x7fff);
37011 pcnet32_load_multicast(dev);
37012 }
37013
37014 if (suspended) {
37015 int csr5;
37016 /* clear SUSPEND (SPND) - CSR5 bit 0 */
37017 - csr5 = lp->a.read_csr(ioaddr, CSR5);
37018 - lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
37019 + csr5 = lp->a->read_csr(ioaddr, CSR5);
37020 + lp->a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
37021 } else {
37022 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
37023 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
37024 pcnet32_restart(dev, CSR0_NORMAL);
37025 netif_wake_queue(dev);
37026 }
37027 @@ -2767,8 +2767,8 @@ static int mdio_read(struct net_device *
37028 if (!lp->mii)
37029 return 0;
37030
37031 - lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
37032 - val_out = lp->a.read_bcr(ioaddr, 34);
37033 + lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
37034 + val_out = lp->a->read_bcr(ioaddr, 34);
37035
37036 return val_out;
37037 }
37038 @@ -2782,8 +2782,8 @@ static void mdio_write(struct net_device
37039 if (!lp->mii)
37040 return;
37041
37042 - lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
37043 - lp->a.write_bcr(ioaddr, 34, val);
37044 + lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
37045 + lp->a->write_bcr(ioaddr, 34, val);
37046 }
37047
37048 static int pcnet32_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
37049 @@ -2862,7 +2862,7 @@ static void pcnet32_check_media(struct n
37050 curr_link = mii_link_ok(&lp->mii_if);
37051 } else {
37052 ulong ioaddr = dev->base_addr; /* card base I/O address */
37053 - curr_link = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
37054 + curr_link = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
37055 }
37056 if (!curr_link) {
37057 if (prev_link || verbose) {
37058 @@ -2887,13 +2887,13 @@ static void pcnet32_check_media(struct n
37059 (ecmd.duplex ==
37060 DUPLEX_FULL) ? "full" : "half");
37061 }
37062 - bcr9 = lp->a.read_bcr(dev->base_addr, 9);
37063 + bcr9 = lp->a->read_bcr(dev->base_addr, 9);
37064 if ((bcr9 & (1 << 0)) != lp->mii_if.full_duplex) {
37065 if (lp->mii_if.full_duplex)
37066 bcr9 |= (1 << 0);
37067 else
37068 bcr9 &= ~(1 << 0);
37069 - lp->a.write_bcr(dev->base_addr, 9, bcr9);
37070 + lp->a->write_bcr(dev->base_addr, 9, bcr9);
37071 }
37072 } else {
37073 if (netif_msg_link(lp))
37074 diff -urNp linux-2.6.32.49/drivers/net/sis190.c linux-2.6.32.49/drivers/net/sis190.c
37075 --- linux-2.6.32.49/drivers/net/sis190.c 2011-11-08 19:02:43.000000000 -0500
37076 +++ linux-2.6.32.49/drivers/net/sis190.c 2011-11-18 18:01:55.000000000 -0500
37077 @@ -1598,7 +1598,7 @@ static int __devinit sis190_get_mac_addr
37078 static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev,
37079 struct net_device *dev)
37080 {
37081 - static const u16 __devinitdata ids[] = { 0x0965, 0x0966, 0x0968 };
37082 + static const u16 __devinitconst ids[] = { 0x0965, 0x0966, 0x0968 };
37083 struct sis190_private *tp = netdev_priv(dev);
37084 struct pci_dev *isa_bridge;
37085 u8 reg, tmp8;
37086 diff -urNp linux-2.6.32.49/drivers/net/sundance.c linux-2.6.32.49/drivers/net/sundance.c
37087 --- linux-2.6.32.49/drivers/net/sundance.c 2011-11-08 19:02:43.000000000 -0500
37088 +++ linux-2.6.32.49/drivers/net/sundance.c 2011-11-18 18:01:55.000000000 -0500
37089 @@ -225,7 +225,7 @@ enum {
37090 struct pci_id_info {
37091 const char *name;
37092 };
37093 -static const struct pci_id_info pci_id_tbl[] __devinitdata = {
37094 +static const struct pci_id_info pci_id_tbl[] __devinitconst = {
37095 {"D-Link DFE-550TX FAST Ethernet Adapter"},
37096 {"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"},
37097 {"D-Link DFE-580TX 4 port Server Adapter"},
37098 diff -urNp linux-2.6.32.49/drivers/net/tg3.h linux-2.6.32.49/drivers/net/tg3.h
37099 --- linux-2.6.32.49/drivers/net/tg3.h 2011-11-08 19:02:43.000000000 -0500
37100 +++ linux-2.6.32.49/drivers/net/tg3.h 2011-11-15 19:59:43.000000000 -0500
37101 @@ -95,6 +95,7 @@
37102 #define CHIPREV_ID_5750_A0 0x4000
37103 #define CHIPREV_ID_5750_A1 0x4001
37104 #define CHIPREV_ID_5750_A3 0x4003
37105 +#define CHIPREV_ID_5750_C1 0x4201
37106 #define CHIPREV_ID_5750_C2 0x4202
37107 #define CHIPREV_ID_5752_A0_HW 0x5000
37108 #define CHIPREV_ID_5752_A0 0x6000
37109 diff -urNp linux-2.6.32.49/drivers/net/tokenring/abyss.c linux-2.6.32.49/drivers/net/tokenring/abyss.c
37110 --- linux-2.6.32.49/drivers/net/tokenring/abyss.c 2011-11-08 19:02:43.000000000 -0500
37111 +++ linux-2.6.32.49/drivers/net/tokenring/abyss.c 2011-11-15 19:59:43.000000000 -0500
37112 @@ -451,10 +451,12 @@ static struct pci_driver abyss_driver =
37113
37114 static int __init abyss_init (void)
37115 {
37116 - abyss_netdev_ops = tms380tr_netdev_ops;
37117 + pax_open_kernel();
37118 + memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
37119
37120 - abyss_netdev_ops.ndo_open = abyss_open;
37121 - abyss_netdev_ops.ndo_stop = abyss_close;
37122 + *(void **)&abyss_netdev_ops.ndo_open = abyss_open;
37123 + *(void **)&abyss_netdev_ops.ndo_stop = abyss_close;
37124 + pax_close_kernel();
37125
37126 return pci_register_driver(&abyss_driver);
37127 }
37128 diff -urNp linux-2.6.32.49/drivers/net/tokenring/madgemc.c linux-2.6.32.49/drivers/net/tokenring/madgemc.c
37129 --- linux-2.6.32.49/drivers/net/tokenring/madgemc.c 2011-11-08 19:02:43.000000000 -0500
37130 +++ linux-2.6.32.49/drivers/net/tokenring/madgemc.c 2011-11-15 19:59:43.000000000 -0500
37131 @@ -755,9 +755,11 @@ static struct mca_driver madgemc_driver
37132
37133 static int __init madgemc_init (void)
37134 {
37135 - madgemc_netdev_ops = tms380tr_netdev_ops;
37136 - madgemc_netdev_ops.ndo_open = madgemc_open;
37137 - madgemc_netdev_ops.ndo_stop = madgemc_close;
37138 + pax_open_kernel();
37139 + memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
37140 + *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open;
37141 + *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close;
37142 + pax_close_kernel();
37143
37144 return mca_register_driver (&madgemc_driver);
37145 }
37146 diff -urNp linux-2.6.32.49/drivers/net/tokenring/proteon.c linux-2.6.32.49/drivers/net/tokenring/proteon.c
37147 --- linux-2.6.32.49/drivers/net/tokenring/proteon.c 2011-11-08 19:02:43.000000000 -0500
37148 +++ linux-2.6.32.49/drivers/net/tokenring/proteon.c 2011-11-15 19:59:43.000000000 -0500
37149 @@ -353,9 +353,11 @@ static int __init proteon_init(void)
37150 struct platform_device *pdev;
37151 int i, num = 0, err = 0;
37152
37153 - proteon_netdev_ops = tms380tr_netdev_ops;
37154 - proteon_netdev_ops.ndo_open = proteon_open;
37155 - proteon_netdev_ops.ndo_stop = tms380tr_close;
37156 + pax_open_kernel();
37157 + memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
37158 + *(void **)&proteon_netdev_ops.ndo_open = proteon_open;
37159 + *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close;
37160 + pax_close_kernel();
37161
37162 err = platform_driver_register(&proteon_driver);
37163 if (err)
37164 diff -urNp linux-2.6.32.49/drivers/net/tokenring/skisa.c linux-2.6.32.49/drivers/net/tokenring/skisa.c
37165 --- linux-2.6.32.49/drivers/net/tokenring/skisa.c 2011-11-08 19:02:43.000000000 -0500
37166 +++ linux-2.6.32.49/drivers/net/tokenring/skisa.c 2011-11-15 19:59:43.000000000 -0500
37167 @@ -363,9 +363,11 @@ static int __init sk_isa_init(void)
37168 struct platform_device *pdev;
37169 int i, num = 0, err = 0;
37170
37171 - sk_isa_netdev_ops = tms380tr_netdev_ops;
37172 - sk_isa_netdev_ops.ndo_open = sk_isa_open;
37173 - sk_isa_netdev_ops.ndo_stop = tms380tr_close;
37174 + pax_open_kernel();
37175 + memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
37176 + *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open;
37177 + *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close;
37178 + pax_close_kernel();
37179
37180 err = platform_driver_register(&sk_isa_driver);
37181 if (err)
37182 diff -urNp linux-2.6.32.49/drivers/net/tulip/de2104x.c linux-2.6.32.49/drivers/net/tulip/de2104x.c
37183 --- linux-2.6.32.49/drivers/net/tulip/de2104x.c 2011-11-08 19:02:43.000000000 -0500
37184 +++ linux-2.6.32.49/drivers/net/tulip/de2104x.c 2011-11-15 19:59:43.000000000 -0500
37185 @@ -1785,6 +1785,8 @@ static void __devinit de21041_get_srom_i
37186 struct de_srom_info_leaf *il;
37187 void *bufp;
37188
37189 + pax_track_stack();
37190 +
37191 /* download entire eeprom */
37192 for (i = 0; i < DE_EEPROM_WORDS; i++)
37193 ((__le16 *)ee_data)[i] =
37194 diff -urNp linux-2.6.32.49/drivers/net/tulip/de4x5.c linux-2.6.32.49/drivers/net/tulip/de4x5.c
37195 --- linux-2.6.32.49/drivers/net/tulip/de4x5.c 2011-11-08 19:02:43.000000000 -0500
37196 +++ linux-2.6.32.49/drivers/net/tulip/de4x5.c 2011-11-15 19:59:43.000000000 -0500
37197 @@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, stru
37198 for (i=0; i<ETH_ALEN; i++) {
37199 tmp.addr[i] = dev->dev_addr[i];
37200 }
37201 - if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
37202 + if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
37203 break;
37204
37205 case DE4X5_SET_HWADDR: /* Set the hardware address */
37206 @@ -5512,7 +5512,7 @@ de4x5_ioctl(struct net_device *dev, stru
37207 spin_lock_irqsave(&lp->lock, flags);
37208 memcpy(&statbuf, &lp->pktStats, ioc->len);
37209 spin_unlock_irqrestore(&lp->lock, flags);
37210 - if (copy_to_user(ioc->data, &statbuf, ioc->len))
37211 + if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
37212 return -EFAULT;
37213 break;
37214 }
37215 diff -urNp linux-2.6.32.49/drivers/net/tulip/eeprom.c linux-2.6.32.49/drivers/net/tulip/eeprom.c
37216 --- linux-2.6.32.49/drivers/net/tulip/eeprom.c 2011-11-08 19:02:43.000000000 -0500
37217 +++ linux-2.6.32.49/drivers/net/tulip/eeprom.c 2011-11-18 18:01:55.000000000 -0500
37218 @@ -80,7 +80,7 @@ static struct eeprom_fixup eeprom_fixups
37219 {NULL}};
37220
37221
37222 -static const char *block_name[] __devinitdata = {
37223 +static const char *block_name[] __devinitconst = {
37224 "21140 non-MII",
37225 "21140 MII PHY",
37226 "21142 Serial PHY",
37227 diff -urNp linux-2.6.32.49/drivers/net/tulip/winbond-840.c linux-2.6.32.49/drivers/net/tulip/winbond-840.c
37228 --- linux-2.6.32.49/drivers/net/tulip/winbond-840.c 2011-11-08 19:02:43.000000000 -0500
37229 +++ linux-2.6.32.49/drivers/net/tulip/winbond-840.c 2011-11-18 18:01:55.000000000 -0500
37230 @@ -235,7 +235,7 @@ struct pci_id_info {
37231 int drv_flags; /* Driver use, intended as capability flags. */
37232 };
37233
37234 -static const struct pci_id_info pci_id_tbl[] __devinitdata = {
37235 +static const struct pci_id_info pci_id_tbl[] __devinitconst = {
37236 { /* Sometime a Level-One switch card. */
37237 "Winbond W89c840", CanHaveMII | HasBrokenTx | FDXOnNoMII},
37238 { "Winbond W89c840", CanHaveMII | HasBrokenTx},
37239 diff -urNp linux-2.6.32.49/drivers/net/usb/hso.c linux-2.6.32.49/drivers/net/usb/hso.c
37240 --- linux-2.6.32.49/drivers/net/usb/hso.c 2011-11-08 19:02:43.000000000 -0500
37241 +++ linux-2.6.32.49/drivers/net/usb/hso.c 2011-11-15 19:59:43.000000000 -0500
37242 @@ -71,7 +71,7 @@
37243 #include <asm/byteorder.h>
37244 #include <linux/serial_core.h>
37245 #include <linux/serial.h>
37246 -
37247 +#include <asm/local.h>
37248
37249 #define DRIVER_VERSION "1.2"
37250 #define MOD_AUTHOR "Option Wireless"
37251 @@ -258,7 +258,7 @@ struct hso_serial {
37252
37253 /* from usb_serial_port */
37254 struct tty_struct *tty;
37255 - int open_count;
37256 + local_t open_count;
37257 spinlock_t serial_lock;
37258
37259 int (*write_data) (struct hso_serial *serial);
37260 @@ -1180,7 +1180,7 @@ static void put_rxbuf_data_and_resubmit_
37261 struct urb *urb;
37262
37263 urb = serial->rx_urb[0];
37264 - if (serial->open_count > 0) {
37265 + if (local_read(&serial->open_count) > 0) {
37266 count = put_rxbuf_data(urb, serial);
37267 if (count == -1)
37268 return;
37269 @@ -1216,7 +1216,7 @@ static void hso_std_serial_read_bulk_cal
37270 DUMP1(urb->transfer_buffer, urb->actual_length);
37271
37272 /* Anyone listening? */
37273 - if (serial->open_count == 0)
37274 + if (local_read(&serial->open_count) == 0)
37275 return;
37276
37277 if (status == 0) {
37278 @@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
37279 spin_unlock_irq(&serial->serial_lock);
37280
37281 /* check for port already opened, if not set the termios */
37282 - serial->open_count++;
37283 - if (serial->open_count == 1) {
37284 + if (local_inc_return(&serial->open_count) == 1) {
37285 tty->low_latency = 1;
37286 serial->rx_state = RX_IDLE;
37287 /* Force default termio settings */
37288 @@ -1325,7 +1324,7 @@ static int hso_serial_open(struct tty_st
37289 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
37290 if (result) {
37291 hso_stop_serial_device(serial->parent);
37292 - serial->open_count--;
37293 + local_dec(&serial->open_count);
37294 kref_put(&serial->parent->ref, hso_serial_ref_free);
37295 }
37296 } else {
37297 @@ -1362,10 +1361,10 @@ static void hso_serial_close(struct tty_
37298
37299 /* reset the rts and dtr */
37300 /* do the actual close */
37301 - serial->open_count--;
37302 + local_dec(&serial->open_count);
37303
37304 - if (serial->open_count <= 0) {
37305 - serial->open_count = 0;
37306 + if (local_read(&serial->open_count) <= 0) {
37307 + local_set(&serial->open_count, 0);
37308 spin_lock_irq(&serial->serial_lock);
37309 if (serial->tty == tty) {
37310 serial->tty->driver_data = NULL;
37311 @@ -1447,7 +1446,7 @@ static void hso_serial_set_termios(struc
37312
37313 /* the actual setup */
37314 spin_lock_irqsave(&serial->serial_lock, flags);
37315 - if (serial->open_count)
37316 + if (local_read(&serial->open_count))
37317 _hso_serial_set_termios(tty, old);
37318 else
37319 tty->termios = old;
37320 @@ -3097,7 +3096,7 @@ static int hso_resume(struct usb_interfa
37321 /* Start all serial ports */
37322 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
37323 if (serial_table[i] && (serial_table[i]->interface == iface)) {
37324 - if (dev2ser(serial_table[i])->open_count) {
37325 + if (local_read(&dev2ser(serial_table[i])->open_count)) {
37326 result =
37327 hso_start_serial_device(serial_table[i], GFP_NOIO);
37328 hso_kick_transmit(dev2ser(serial_table[i]));
37329 diff -urNp linux-2.6.32.49/drivers/net/vxge/vxge-config.h linux-2.6.32.49/drivers/net/vxge/vxge-config.h
37330 --- linux-2.6.32.49/drivers/net/vxge/vxge-config.h 2011-11-08 19:02:43.000000000 -0500
37331 +++ linux-2.6.32.49/drivers/net/vxge/vxge-config.h 2011-11-15 19:59:43.000000000 -0500
37332 @@ -474,7 +474,7 @@ struct vxge_hw_uld_cbs {
37333 void (*link_down)(struct __vxge_hw_device *devh);
37334 void (*crit_err)(struct __vxge_hw_device *devh,
37335 enum vxge_hw_event type, u64 ext_data);
37336 -};
37337 +} __no_const;
37338
37339 /*
37340 * struct __vxge_hw_blockpool_entry - Block private data structure
37341 diff -urNp linux-2.6.32.49/drivers/net/vxge/vxge-main.c linux-2.6.32.49/drivers/net/vxge/vxge-main.c
37342 --- linux-2.6.32.49/drivers/net/vxge/vxge-main.c 2011-11-08 19:02:43.000000000 -0500
37343 +++ linux-2.6.32.49/drivers/net/vxge/vxge-main.c 2011-11-15 19:59:43.000000000 -0500
37344 @@ -93,6 +93,8 @@ static inline void VXGE_COMPLETE_VPATH_T
37345 struct sk_buff *completed[NR_SKB_COMPLETED];
37346 int more;
37347
37348 + pax_track_stack();
37349 +
37350 do {
37351 more = 0;
37352 skb_ptr = completed;
37353 @@ -1779,6 +1781,8 @@ static enum vxge_hw_status vxge_rth_conf
37354 u8 mtable[256] = {0}; /* CPU to vpath mapping */
37355 int index;
37356
37357 + pax_track_stack();
37358 +
37359 /*
37360 * Filling
37361 * - itable with bucket numbers
37362 diff -urNp linux-2.6.32.49/drivers/net/vxge/vxge-traffic.h linux-2.6.32.49/drivers/net/vxge/vxge-traffic.h
37363 --- linux-2.6.32.49/drivers/net/vxge/vxge-traffic.h 2011-11-08 19:02:43.000000000 -0500
37364 +++ linux-2.6.32.49/drivers/net/vxge/vxge-traffic.h 2011-11-15 19:59:43.000000000 -0500
37365 @@ -2123,7 +2123,7 @@ struct vxge_hw_mempool_cbs {
37366 struct vxge_hw_mempool_dma *dma_object,
37367 u32 index,
37368 u32 is_last);
37369 -};
37370 +} __no_const;
37371
37372 void
37373 __vxge_hw_mempool_destroy(
37374 diff -urNp linux-2.6.32.49/drivers/net/wan/cycx_x25.c linux-2.6.32.49/drivers/net/wan/cycx_x25.c
37375 --- linux-2.6.32.49/drivers/net/wan/cycx_x25.c 2011-11-08 19:02:43.000000000 -0500
37376 +++ linux-2.6.32.49/drivers/net/wan/cycx_x25.c 2011-11-15 19:59:43.000000000 -0500
37377 @@ -1017,6 +1017,8 @@ static void hex_dump(char *msg, unsigned
37378 unsigned char hex[1024],
37379 * phex = hex;
37380
37381 + pax_track_stack();
37382 +
37383 if (len >= (sizeof(hex) / 2))
37384 len = (sizeof(hex) / 2) - 1;
37385
37386 diff -urNp linux-2.6.32.49/drivers/net/wan/hdlc_x25.c linux-2.6.32.49/drivers/net/wan/hdlc_x25.c
37387 --- linux-2.6.32.49/drivers/net/wan/hdlc_x25.c 2011-11-08 19:02:43.000000000 -0500
37388 +++ linux-2.6.32.49/drivers/net/wan/hdlc_x25.c 2011-11-15 19:59:43.000000000 -0500
37389 @@ -136,16 +136,16 @@ static netdev_tx_t x25_xmit(struct sk_bu
37390
37391 static int x25_open(struct net_device *dev)
37392 {
37393 - struct lapb_register_struct cb;
37394 + static struct lapb_register_struct cb = {
37395 + .connect_confirmation = x25_connected,
37396 + .connect_indication = x25_connected,
37397 + .disconnect_confirmation = x25_disconnected,
37398 + .disconnect_indication = x25_disconnected,
37399 + .data_indication = x25_data_indication,
37400 + .data_transmit = x25_data_transmit
37401 + };
37402 int result;
37403
37404 - cb.connect_confirmation = x25_connected;
37405 - cb.connect_indication = x25_connected;
37406 - cb.disconnect_confirmation = x25_disconnected;
37407 - cb.disconnect_indication = x25_disconnected;
37408 - cb.data_indication = x25_data_indication;
37409 - cb.data_transmit = x25_data_transmit;
37410 -
37411 result = lapb_register(dev, &cb);
37412 if (result != LAPB_OK)
37413 return result;
37414 diff -urNp linux-2.6.32.49/drivers/net/wimax/i2400m/usb-fw.c linux-2.6.32.49/drivers/net/wimax/i2400m/usb-fw.c
37415 --- linux-2.6.32.49/drivers/net/wimax/i2400m/usb-fw.c 2011-11-08 19:02:43.000000000 -0500
37416 +++ linux-2.6.32.49/drivers/net/wimax/i2400m/usb-fw.c 2011-11-15 19:59:43.000000000 -0500
37417 @@ -263,6 +263,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(stru
37418 int do_autopm = 1;
37419 DECLARE_COMPLETION_ONSTACK(notif_completion);
37420
37421 + pax_track_stack();
37422 +
37423 d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
37424 i2400m, ack, ack_size);
37425 BUG_ON(_ack == i2400m->bm_ack_buf);
37426 diff -urNp linux-2.6.32.49/drivers/net/wireless/airo.c linux-2.6.32.49/drivers/net/wireless/airo.c
37427 --- linux-2.6.32.49/drivers/net/wireless/airo.c 2011-11-08 19:02:43.000000000 -0500
37428 +++ linux-2.6.32.49/drivers/net/wireless/airo.c 2011-11-15 19:59:43.000000000 -0500
37429 @@ -3003,6 +3003,8 @@ static void airo_process_scan_results (s
37430 BSSListElement * loop_net;
37431 BSSListElement * tmp_net;
37432
37433 + pax_track_stack();
37434 +
37435 /* Blow away current list of scan results */
37436 list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
37437 list_move_tail (&loop_net->list, &ai->network_free_list);
37438 @@ -3783,6 +3785,8 @@ static u16 setup_card(struct airo_info *
37439 WepKeyRid wkr;
37440 int rc;
37441
37442 + pax_track_stack();
37443 +
37444 memset( &mySsid, 0, sizeof( mySsid ) );
37445 kfree (ai->flash);
37446 ai->flash = NULL;
37447 @@ -4758,6 +4762,8 @@ static int proc_stats_rid_open( struct i
37448 __le32 *vals = stats.vals;
37449 int len;
37450
37451 + pax_track_stack();
37452 +
37453 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
37454 return -ENOMEM;
37455 data = (struct proc_data *)file->private_data;
37456 @@ -5487,6 +5493,8 @@ static int proc_BSSList_open( struct ino
37457 /* If doLoseSync is not 1, we won't do a Lose Sync */
37458 int doLoseSync = -1;
37459
37460 + pax_track_stack();
37461 +
37462 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
37463 return -ENOMEM;
37464 data = (struct proc_data *)file->private_data;
37465 @@ -7193,6 +7201,8 @@ static int airo_get_aplist(struct net_de
37466 int i;
37467 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
37468
37469 + pax_track_stack();
37470 +
37471 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
37472 if (!qual)
37473 return -ENOMEM;
37474 @@ -7753,6 +7763,8 @@ static void airo_read_wireless_stats(str
37475 CapabilityRid cap_rid;
37476 __le32 *vals = stats_rid.vals;
37477
37478 + pax_track_stack();
37479 +
37480 /* Get stats out of the card */
37481 clear_bit(JOB_WSTATS, &local->jobs);
37482 if (local->power.event) {
37483 diff -urNp linux-2.6.32.49/drivers/net/wireless/ath/ath5k/debug.c linux-2.6.32.49/drivers/net/wireless/ath/ath5k/debug.c
37484 --- linux-2.6.32.49/drivers/net/wireless/ath/ath5k/debug.c 2011-11-08 19:02:43.000000000 -0500
37485 +++ linux-2.6.32.49/drivers/net/wireless/ath/ath5k/debug.c 2011-11-15 19:59:43.000000000 -0500
37486 @@ -205,6 +205,8 @@ static ssize_t read_file_beacon(struct f
37487 unsigned int v;
37488 u64 tsf;
37489
37490 + pax_track_stack();
37491 +
37492 v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
37493 len += snprintf(buf+len, sizeof(buf)-len,
37494 "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
37495 @@ -318,6 +320,8 @@ static ssize_t read_file_debug(struct fi
37496 unsigned int len = 0;
37497 unsigned int i;
37498
37499 + pax_track_stack();
37500 +
37501 len += snprintf(buf+len, sizeof(buf)-len,
37502 "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
37503
37504 diff -urNp linux-2.6.32.49/drivers/net/wireless/ath/ath9k/debug.c linux-2.6.32.49/drivers/net/wireless/ath/ath9k/debug.c
37505 --- linux-2.6.32.49/drivers/net/wireless/ath/ath9k/debug.c 2011-11-08 19:02:43.000000000 -0500
37506 +++ linux-2.6.32.49/drivers/net/wireless/ath/ath9k/debug.c 2011-11-15 19:59:43.000000000 -0500
37507 @@ -220,6 +220,8 @@ static ssize_t read_file_interrupt(struc
37508 char buf[512];
37509 unsigned int len = 0;
37510
37511 + pax_track_stack();
37512 +
37513 len += snprintf(buf + len, sizeof(buf) - len,
37514 "%8s: %10u\n", "RX", sc->debug.stats.istats.rxok);
37515 len += snprintf(buf + len, sizeof(buf) - len,
37516 @@ -360,6 +362,8 @@ static ssize_t read_file_wiphy(struct fi
37517 int i;
37518 u8 addr[ETH_ALEN];
37519
37520 + pax_track_stack();
37521 +
37522 len += snprintf(buf + len, sizeof(buf) - len,
37523 "primary: %s (%s chan=%d ht=%d)\n",
37524 wiphy_name(sc->pri_wiphy->hw->wiphy),
37525 diff -urNp linux-2.6.32.49/drivers/net/wireless/b43/debugfs.c linux-2.6.32.49/drivers/net/wireless/b43/debugfs.c
37526 --- linux-2.6.32.49/drivers/net/wireless/b43/debugfs.c 2011-11-08 19:02:43.000000000 -0500
37527 +++ linux-2.6.32.49/drivers/net/wireless/b43/debugfs.c 2011-11-15 19:59:43.000000000 -0500
37528 @@ -43,7 +43,7 @@ static struct dentry *rootdir;
37529 struct b43_debugfs_fops {
37530 ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
37531 int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
37532 - struct file_operations fops;
37533 + const struct file_operations fops;
37534 /* Offset of struct b43_dfs_file in struct b43_dfsentry */
37535 size_t file_struct_offset;
37536 };
37537 diff -urNp linux-2.6.32.49/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.32.49/drivers/net/wireless/b43legacy/debugfs.c
37538 --- linux-2.6.32.49/drivers/net/wireless/b43legacy/debugfs.c 2011-11-08 19:02:43.000000000 -0500
37539 +++ linux-2.6.32.49/drivers/net/wireless/b43legacy/debugfs.c 2011-11-15 19:59:43.000000000 -0500
37540 @@ -44,7 +44,7 @@ static struct dentry *rootdir;
37541 struct b43legacy_debugfs_fops {
37542 ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
37543 int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
37544 - struct file_operations fops;
37545 + const struct file_operations fops;
37546 /* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
37547 size_t file_struct_offset;
37548 /* Take wl->irq_lock before calling read/write? */
37549 diff -urNp linux-2.6.32.49/drivers/net/wireless/ipw2x00/ipw2100.c linux-2.6.32.49/drivers/net/wireless/ipw2x00/ipw2100.c
37550 --- linux-2.6.32.49/drivers/net/wireless/ipw2x00/ipw2100.c 2011-11-08 19:02:43.000000000 -0500
37551 +++ linux-2.6.32.49/drivers/net/wireless/ipw2x00/ipw2100.c 2011-11-15 19:59:43.000000000 -0500
37552 @@ -2014,6 +2014,8 @@ static int ipw2100_set_essid(struct ipw2
37553 int err;
37554 DECLARE_SSID_BUF(ssid);
37555
37556 + pax_track_stack();
37557 +
37558 IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
37559
37560 if (ssid_len)
37561 @@ -5380,6 +5382,8 @@ static int ipw2100_set_key(struct ipw210
37562 struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
37563 int err;
37564
37565 + pax_track_stack();
37566 +
37567 IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
37568 idx, keylen, len);
37569
37570 diff -urNp linux-2.6.32.49/drivers/net/wireless/ipw2x00/libipw_rx.c linux-2.6.32.49/drivers/net/wireless/ipw2x00/libipw_rx.c
37571 --- linux-2.6.32.49/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-11-08 19:02:43.000000000 -0500
37572 +++ linux-2.6.32.49/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-11-15 19:59:43.000000000 -0500
37573 @@ -1566,6 +1566,8 @@ static void libipw_process_probe_respons
37574 unsigned long flags;
37575 DECLARE_SSID_BUF(ssid);
37576
37577 + pax_track_stack();
37578 +
37579 LIBIPW_DEBUG_SCAN("'%s' (%pM"
37580 "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
37581 print_ssid(ssid, info_element->data, info_element->len),
37582 diff -urNp linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-1000.c
37583 --- linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-1000.c 2011-11-08 19:02:43.000000000 -0500
37584 +++ linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-1000.c 2011-11-15 19:59:43.000000000 -0500
37585 @@ -137,7 +137,7 @@ static struct iwl_lib_ops iwl1000_lib =
37586 },
37587 };
37588
37589 -static struct iwl_ops iwl1000_ops = {
37590 +static const struct iwl_ops iwl1000_ops = {
37591 .ucode = &iwl5000_ucode,
37592 .lib = &iwl1000_lib,
37593 .hcmd = &iwl5000_hcmd,
37594 diff -urNp linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl3945-base.c linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl3945-base.c
37595 --- linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl3945-base.c 2011-11-08 19:02:43.000000000 -0500
37596 +++ linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl3945-base.c 2011-11-15 19:59:43.000000000 -0500
37597 @@ -3927,7 +3927,9 @@ static int iwl3945_pci_probe(struct pci_
37598 */
37599 if (iwl3945_mod_params.disable_hw_scan) {
37600 IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
37601 - iwl3945_hw_ops.hw_scan = NULL;
37602 + pax_open_kernel();
37603 + *(void **)&iwl3945_hw_ops.hw_scan = NULL;
37604 + pax_close_kernel();
37605 }
37606
37607
37608 diff -urNp linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-3945.c
37609 --- linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-3945.c 2011-11-08 19:02:43.000000000 -0500
37610 +++ linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-3945.c 2011-11-15 19:59:43.000000000 -0500
37611 @@ -2874,7 +2874,7 @@ static struct iwl_hcmd_utils_ops iwl3945
37612 .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
37613 };
37614
37615 -static struct iwl_ops iwl3945_ops = {
37616 +static const struct iwl_ops iwl3945_ops = {
37617 .ucode = &iwl3945_ucode,
37618 .lib = &iwl3945_lib,
37619 .hcmd = &iwl3945_hcmd,
37620 diff -urNp linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-4965.c
37621 --- linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-4965.c 2011-11-08 19:02:43.000000000 -0500
37622 +++ linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-4965.c 2011-11-15 19:59:43.000000000 -0500
37623 @@ -2345,7 +2345,7 @@ static struct iwl_lib_ops iwl4965_lib =
37624 },
37625 };
37626
37627 -static struct iwl_ops iwl4965_ops = {
37628 +static const struct iwl_ops iwl4965_ops = {
37629 .ucode = &iwl4965_ucode,
37630 .lib = &iwl4965_lib,
37631 .hcmd = &iwl4965_hcmd,
37632 diff -urNp linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-5000.c
37633 --- linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-5000.c 2011-11-08 19:02:43.000000000 -0500
37634 +++ linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-5000.c 2011-11-15 19:59:43.000000000 -0500
37635 @@ -1633,14 +1633,14 @@ static struct iwl_lib_ops iwl5150_lib =
37636 },
37637 };
37638
37639 -struct iwl_ops iwl5000_ops = {
37640 +const struct iwl_ops iwl5000_ops = {
37641 .ucode = &iwl5000_ucode,
37642 .lib = &iwl5000_lib,
37643 .hcmd = &iwl5000_hcmd,
37644 .utils = &iwl5000_hcmd_utils,
37645 };
37646
37647 -static struct iwl_ops iwl5150_ops = {
37648 +static const struct iwl_ops iwl5150_ops = {
37649 .ucode = &iwl5000_ucode,
37650 .lib = &iwl5150_lib,
37651 .hcmd = &iwl5000_hcmd,
37652 diff -urNp linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-6000.c
37653 --- linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-11-08 19:02:43.000000000 -0500
37654 +++ linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-11-15 19:59:43.000000000 -0500
37655 @@ -146,7 +146,7 @@ static struct iwl_hcmd_utils_ops iwl6000
37656 .calc_rssi = iwl5000_calc_rssi,
37657 };
37658
37659 -static struct iwl_ops iwl6000_ops = {
37660 +static const struct iwl_ops iwl6000_ops = {
37661 .ucode = &iwl5000_ucode,
37662 .lib = &iwl6000_lib,
37663 .hcmd = &iwl5000_hcmd,
37664 diff -urNp linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-agn.c linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-agn.c
37665 --- linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-agn.c 2011-11-08 19:02:43.000000000 -0500
37666 +++ linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-agn.c 2011-11-15 19:59:43.000000000 -0500
37667 @@ -2911,7 +2911,9 @@ static int iwl_pci_probe(struct pci_dev
37668 if (iwl_debug_level & IWL_DL_INFO)
37669 dev_printk(KERN_DEBUG, &(pdev->dev),
37670 "Disabling hw_scan\n");
37671 - iwl_hw_ops.hw_scan = NULL;
37672 + pax_open_kernel();
37673 + *(void **)&iwl_hw_ops.hw_scan = NULL;
37674 + pax_close_kernel();
37675 }
37676
37677 hw = iwl_alloc_all(cfg, &iwl_hw_ops);
37678 diff -urNp linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
37679 --- linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-11-08 19:02:43.000000000 -0500
37680 +++ linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-11-15 19:59:43.000000000 -0500
37681 @@ -857,6 +857,8 @@ static void rs_tx_status(void *priv_r, s
37682 u8 active_index = 0;
37683 s32 tpt = 0;
37684
37685 + pax_track_stack();
37686 +
37687 IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
37688
37689 if (!ieee80211_is_data(hdr->frame_control) ||
37690 @@ -2722,6 +2724,8 @@ static void rs_fill_link_cmd(struct iwl_
37691 u8 valid_tx_ant = 0;
37692 struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
37693
37694 + pax_track_stack();
37695 +
37696 /* Override starting rate (index 0) if needed for debug purposes */
37697 rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
37698
37699 diff -urNp linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-debugfs.c
37700 --- linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-11-08 19:02:43.000000000 -0500
37701 +++ linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-11-15 19:59:43.000000000 -0500
37702 @@ -524,6 +524,8 @@ static ssize_t iwl_dbgfs_status_read(str
37703 int pos = 0;
37704 const size_t bufsz = sizeof(buf);
37705
37706 + pax_track_stack();
37707 +
37708 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
37709 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
37710 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_SYNC_ACTIVE: %d\n",
37711 @@ -658,6 +660,8 @@ static ssize_t iwl_dbgfs_qos_read(struct
37712 const size_t bufsz = sizeof(buf);
37713 ssize_t ret;
37714
37715 + pax_track_stack();
37716 +
37717 for (i = 0; i < AC_NUM; i++) {
37718 pos += scnprintf(buf + pos, bufsz - pos,
37719 "\tcw_min\tcw_max\taifsn\ttxop\n");
37720 diff -urNp linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-debug.h
37721 --- linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-11-08 19:02:43.000000000 -0500
37722 +++ linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-11-15 19:59:43.000000000 -0500
37723 @@ -118,8 +118,8 @@ void iwl_dbgfs_unregister(struct iwl_pri
37724 #endif
37725
37726 #else
37727 -#define IWL_DEBUG(__priv, level, fmt, args...)
37728 -#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
37729 +#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
37730 +#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
37731 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
37732 void *p, u32 len)
37733 {}
37734 diff -urNp linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-dev.h linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-dev.h
37735 --- linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-dev.h 2011-11-08 19:02:43.000000000 -0500
37736 +++ linux-2.6.32.49/drivers/net/wireless/iwlwifi/iwl-dev.h 2011-11-15 19:59:43.000000000 -0500
37737 @@ -68,7 +68,7 @@ struct iwl_tx_queue;
37738
37739 /* shared structures from iwl-5000.c */
37740 extern struct iwl_mod_params iwl50_mod_params;
37741 -extern struct iwl_ops iwl5000_ops;
37742 +extern const struct iwl_ops iwl5000_ops;
37743 extern struct iwl_ucode_ops iwl5000_ucode;
37744 extern struct iwl_lib_ops iwl5000_lib;
37745 extern struct iwl_hcmd_ops iwl5000_hcmd;
37746 diff -urNp linux-2.6.32.49/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-2.6.32.49/drivers/net/wireless/iwmc3200wifi/debugfs.c
37747 --- linux-2.6.32.49/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-11-08 19:02:43.000000000 -0500
37748 +++ linux-2.6.32.49/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-11-15 19:59:43.000000000 -0500
37749 @@ -299,6 +299,8 @@ static ssize_t iwm_debugfs_fw_err_read(s
37750 int buf_len = 512;
37751 size_t len = 0;
37752
37753 + pax_track_stack();
37754 +
37755 if (*ppos != 0)
37756 return 0;
37757 if (count < sizeof(buf))
37758 diff -urNp linux-2.6.32.49/drivers/net/wireless/libertas/debugfs.c linux-2.6.32.49/drivers/net/wireless/libertas/debugfs.c
37759 --- linux-2.6.32.49/drivers/net/wireless/libertas/debugfs.c 2011-11-08 19:02:43.000000000 -0500
37760 +++ linux-2.6.32.49/drivers/net/wireless/libertas/debugfs.c 2011-11-15 19:59:43.000000000 -0500
37761 @@ -708,7 +708,7 @@ out_unlock:
37762 struct lbs_debugfs_files {
37763 const char *name;
37764 int perm;
37765 - struct file_operations fops;
37766 + const struct file_operations fops;
37767 };
37768
37769 static const struct lbs_debugfs_files debugfs_files[] = {
37770 diff -urNp linux-2.6.32.49/drivers/net/wireless/rndis_wlan.c linux-2.6.32.49/drivers/net/wireless/rndis_wlan.c
37771 --- linux-2.6.32.49/drivers/net/wireless/rndis_wlan.c 2011-11-08 19:02:43.000000000 -0500
37772 +++ linux-2.6.32.49/drivers/net/wireless/rndis_wlan.c 2011-11-15 19:59:43.000000000 -0500
37773 @@ -1176,7 +1176,7 @@ static int set_rts_threshold(struct usbn
37774
37775 devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
37776
37777 - if (rts_threshold < 0 || rts_threshold > 2347)
37778 + if (rts_threshold > 2347)
37779 rts_threshold = 2347;
37780
37781 tmp = cpu_to_le32(rts_threshold);
37782 diff -urNp linux-2.6.32.49/drivers/oprofile/buffer_sync.c linux-2.6.32.49/drivers/oprofile/buffer_sync.c
37783 --- linux-2.6.32.49/drivers/oprofile/buffer_sync.c 2011-11-08 19:02:43.000000000 -0500
37784 +++ linux-2.6.32.49/drivers/oprofile/buffer_sync.c 2011-11-15 19:59:43.000000000 -0500
37785 @@ -341,7 +341,7 @@ static void add_data(struct op_entry *en
37786 if (cookie == NO_COOKIE)
37787 offset = pc;
37788 if (cookie == INVALID_COOKIE) {
37789 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
37790 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
37791 offset = pc;
37792 }
37793 if (cookie != last_cookie) {
37794 @@ -385,14 +385,14 @@ add_sample(struct mm_struct *mm, struct
37795 /* add userspace sample */
37796
37797 if (!mm) {
37798 - atomic_inc(&oprofile_stats.sample_lost_no_mm);
37799 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
37800 return 0;
37801 }
37802
37803 cookie = lookup_dcookie(mm, s->eip, &offset);
37804
37805 if (cookie == INVALID_COOKIE) {
37806 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
37807 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
37808 return 0;
37809 }
37810
37811 @@ -561,7 +561,7 @@ void sync_buffer(int cpu)
37812 /* ignore backtraces if failed to add a sample */
37813 if (state == sb_bt_start) {
37814 state = sb_bt_ignore;
37815 - atomic_inc(&oprofile_stats.bt_lost_no_mapping);
37816 + atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
37817 }
37818 }
37819 release_mm(mm);
37820 diff -urNp linux-2.6.32.49/drivers/oprofile/event_buffer.c linux-2.6.32.49/drivers/oprofile/event_buffer.c
37821 --- linux-2.6.32.49/drivers/oprofile/event_buffer.c 2011-11-08 19:02:43.000000000 -0500
37822 +++ linux-2.6.32.49/drivers/oprofile/event_buffer.c 2011-11-15 19:59:43.000000000 -0500
37823 @@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
37824 }
37825
37826 if (buffer_pos == buffer_size) {
37827 - atomic_inc(&oprofile_stats.event_lost_overflow);
37828 + atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
37829 return;
37830 }
37831
37832 diff -urNp linux-2.6.32.49/drivers/oprofile/oprof.c linux-2.6.32.49/drivers/oprofile/oprof.c
37833 --- linux-2.6.32.49/drivers/oprofile/oprof.c 2011-11-08 19:02:43.000000000 -0500
37834 +++ linux-2.6.32.49/drivers/oprofile/oprof.c 2011-11-15 19:59:43.000000000 -0500
37835 @@ -110,7 +110,7 @@ static void switch_worker(struct work_st
37836 if (oprofile_ops.switch_events())
37837 return;
37838
37839 - atomic_inc(&oprofile_stats.multiplex_counter);
37840 + atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
37841 start_switch_worker();
37842 }
37843
37844 diff -urNp linux-2.6.32.49/drivers/oprofile/oprofilefs.c linux-2.6.32.49/drivers/oprofile/oprofilefs.c
37845 --- linux-2.6.32.49/drivers/oprofile/oprofilefs.c 2011-11-08 19:02:43.000000000 -0500
37846 +++ linux-2.6.32.49/drivers/oprofile/oprofilefs.c 2011-11-15 19:59:43.000000000 -0500
37847 @@ -187,7 +187,7 @@ static const struct file_operations atom
37848
37849
37850 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
37851 - char const *name, atomic_t *val)
37852 + char const *name, atomic_unchecked_t *val)
37853 {
37854 struct dentry *d = __oprofilefs_create_file(sb, root, name,
37855 &atomic_ro_fops, 0444);
37856 diff -urNp linux-2.6.32.49/drivers/oprofile/oprofile_stats.c linux-2.6.32.49/drivers/oprofile/oprofile_stats.c
37857 --- linux-2.6.32.49/drivers/oprofile/oprofile_stats.c 2011-11-08 19:02:43.000000000 -0500
37858 +++ linux-2.6.32.49/drivers/oprofile/oprofile_stats.c 2011-11-15 19:59:43.000000000 -0500
37859 @@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
37860 cpu_buf->sample_invalid_eip = 0;
37861 }
37862
37863 - atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
37864 - atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
37865 - atomic_set(&oprofile_stats.event_lost_overflow, 0);
37866 - atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
37867 - atomic_set(&oprofile_stats.multiplex_counter, 0);
37868 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
37869 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
37870 + atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
37871 + atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
37872 + atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
37873 }
37874
37875
37876 diff -urNp linux-2.6.32.49/drivers/oprofile/oprofile_stats.h linux-2.6.32.49/drivers/oprofile/oprofile_stats.h
37877 --- linux-2.6.32.49/drivers/oprofile/oprofile_stats.h 2011-11-08 19:02:43.000000000 -0500
37878 +++ linux-2.6.32.49/drivers/oprofile/oprofile_stats.h 2011-11-15 19:59:43.000000000 -0500
37879 @@ -13,11 +13,11 @@
37880 #include <asm/atomic.h>
37881
37882 struct oprofile_stat_struct {
37883 - atomic_t sample_lost_no_mm;
37884 - atomic_t sample_lost_no_mapping;
37885 - atomic_t bt_lost_no_mapping;
37886 - atomic_t event_lost_overflow;
37887 - atomic_t multiplex_counter;
37888 + atomic_unchecked_t sample_lost_no_mm;
37889 + atomic_unchecked_t sample_lost_no_mapping;
37890 + atomic_unchecked_t bt_lost_no_mapping;
37891 + atomic_unchecked_t event_lost_overflow;
37892 + atomic_unchecked_t multiplex_counter;
37893 };
37894
37895 extern struct oprofile_stat_struct oprofile_stats;
37896 diff -urNp linux-2.6.32.49/drivers/parisc/pdc_stable.c linux-2.6.32.49/drivers/parisc/pdc_stable.c
37897 --- linux-2.6.32.49/drivers/parisc/pdc_stable.c 2011-11-08 19:02:43.000000000 -0500
37898 +++ linux-2.6.32.49/drivers/parisc/pdc_stable.c 2011-11-15 19:59:43.000000000 -0500
37899 @@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj
37900 return ret;
37901 }
37902
37903 -static struct sysfs_ops pdcspath_attr_ops = {
37904 +static const struct sysfs_ops pdcspath_attr_ops = {
37905 .show = pdcspath_attr_show,
37906 .store = pdcspath_attr_store,
37907 };
37908 diff -urNp linux-2.6.32.49/drivers/parport/procfs.c linux-2.6.32.49/drivers/parport/procfs.c
37909 --- linux-2.6.32.49/drivers/parport/procfs.c 2011-11-08 19:02:43.000000000 -0500
37910 +++ linux-2.6.32.49/drivers/parport/procfs.c 2011-11-15 19:59:43.000000000 -0500
37911 @@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
37912
37913 *ppos += len;
37914
37915 - return copy_to_user(result, buffer, len) ? -EFAULT : 0;
37916 + return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
37917 }
37918
37919 #ifdef CONFIG_PARPORT_1284
37920 @@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
37921
37922 *ppos += len;
37923
37924 - return copy_to_user (result, buffer, len) ? -EFAULT : 0;
37925 + return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
37926 }
37927 #endif /* IEEE1284.3 support. */
37928
37929 diff -urNp linux-2.6.32.49/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.32.49/drivers/pci/hotplug/acpiphp_glue.c
37930 --- linux-2.6.32.49/drivers/pci/hotplug/acpiphp_glue.c 2011-11-08 19:02:43.000000000 -0500
37931 +++ linux-2.6.32.49/drivers/pci/hotplug/acpiphp_glue.c 2011-11-15 19:59:43.000000000 -0500
37932 @@ -111,7 +111,7 @@ static int post_dock_fixups(struct notif
37933 }
37934
37935
37936 -static struct acpi_dock_ops acpiphp_dock_ops = {
37937 +static const struct acpi_dock_ops acpiphp_dock_ops = {
37938 .handler = handle_hotplug_event_func,
37939 };
37940
37941 diff -urNp linux-2.6.32.49/drivers/pci/hotplug/cpci_hotplug.h linux-2.6.32.49/drivers/pci/hotplug/cpci_hotplug.h
37942 --- linux-2.6.32.49/drivers/pci/hotplug/cpci_hotplug.h 2011-11-08 19:02:43.000000000 -0500
37943 +++ linux-2.6.32.49/drivers/pci/hotplug/cpci_hotplug.h 2011-11-15 19:59:43.000000000 -0500
37944 @@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
37945 int (*hardware_test) (struct slot* slot, u32 value);
37946 u8 (*get_power) (struct slot* slot);
37947 int (*set_power) (struct slot* slot, int value);
37948 -};
37949 +} __no_const;
37950
37951 struct cpci_hp_controller {
37952 unsigned int irq;
37953 diff -urNp linux-2.6.32.49/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.32.49/drivers/pci/hotplug/cpqphp_nvram.c
37954 --- linux-2.6.32.49/drivers/pci/hotplug/cpqphp_nvram.c 2011-11-08 19:02:43.000000000 -0500
37955 +++ linux-2.6.32.49/drivers/pci/hotplug/cpqphp_nvram.c 2011-11-15 19:59:43.000000000 -0500
37956 @@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
37957
37958 void compaq_nvram_init (void __iomem *rom_start)
37959 {
37960 +
37961 +#ifndef CONFIG_PAX_KERNEXEC
37962 if (rom_start) {
37963 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
37964 }
37965 +#endif
37966 +
37967 dbg("int15 entry = %p\n", compaq_int15_entry_point);
37968
37969 /* initialize our int15 lock */
37970 diff -urNp linux-2.6.32.49/drivers/pci/hotplug/fakephp.c linux-2.6.32.49/drivers/pci/hotplug/fakephp.c
37971 --- linux-2.6.32.49/drivers/pci/hotplug/fakephp.c 2011-11-08 19:02:43.000000000 -0500
37972 +++ linux-2.6.32.49/drivers/pci/hotplug/fakephp.c 2011-11-15 19:59:43.000000000 -0500
37973 @@ -73,7 +73,7 @@ static void legacy_release(struct kobjec
37974 }
37975
37976 static struct kobj_type legacy_ktype = {
37977 - .sysfs_ops = &(struct sysfs_ops){
37978 + .sysfs_ops = &(const struct sysfs_ops){
37979 .store = legacy_store, .show = legacy_show
37980 },
37981 .release = &legacy_release,
37982 diff -urNp linux-2.6.32.49/drivers/pci/intel-iommu.c linux-2.6.32.49/drivers/pci/intel-iommu.c
37983 --- linux-2.6.32.49/drivers/pci/intel-iommu.c 2011-11-08 19:02:43.000000000 -0500
37984 +++ linux-2.6.32.49/drivers/pci/intel-iommu.c 2011-11-15 19:59:43.000000000 -0500
37985 @@ -2643,7 +2643,7 @@ error:
37986 return 0;
37987 }
37988
37989 -static dma_addr_t intel_map_page(struct device *dev, struct page *page,
37990 +dma_addr_t intel_map_page(struct device *dev, struct page *page,
37991 unsigned long offset, size_t size,
37992 enum dma_data_direction dir,
37993 struct dma_attrs *attrs)
37994 @@ -2719,7 +2719,7 @@ static void add_unmap(struct dmar_domain
37995 spin_unlock_irqrestore(&async_umap_flush_lock, flags);
37996 }
37997
37998 -static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
37999 +void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
38000 size_t size, enum dma_data_direction dir,
38001 struct dma_attrs *attrs)
38002 {
38003 @@ -2768,7 +2768,7 @@ static void intel_unmap_page(struct devi
38004 }
38005 }
38006
38007 -static void *intel_alloc_coherent(struct device *hwdev, size_t size,
38008 +void *intel_alloc_coherent(struct device *hwdev, size_t size,
38009 dma_addr_t *dma_handle, gfp_t flags)
38010 {
38011 void *vaddr;
38012 @@ -2800,7 +2800,7 @@ static void *intel_alloc_coherent(struct
38013 return NULL;
38014 }
38015
38016 -static void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
38017 +void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
38018 dma_addr_t dma_handle)
38019 {
38020 int order;
38021 @@ -2812,7 +2812,7 @@ static void intel_free_coherent(struct d
38022 free_pages((unsigned long)vaddr, order);
38023 }
38024
38025 -static void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
38026 +void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
38027 int nelems, enum dma_data_direction dir,
38028 struct dma_attrs *attrs)
38029 {
38030 @@ -2872,7 +2872,7 @@ static int intel_nontranslate_map_sg(str
38031 return nelems;
38032 }
38033
38034 -static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
38035 +int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
38036 enum dma_data_direction dir, struct dma_attrs *attrs)
38037 {
38038 int i;
38039 @@ -2941,12 +2941,12 @@ static int intel_map_sg(struct device *h
38040 return nelems;
38041 }
38042
38043 -static int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
38044 +int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
38045 {
38046 return !dma_addr;
38047 }
38048
38049 -struct dma_map_ops intel_dma_ops = {
38050 +const struct dma_map_ops intel_dma_ops = {
38051 .alloc_coherent = intel_alloc_coherent,
38052 .free_coherent = intel_free_coherent,
38053 .map_sg = intel_map_sg,
38054 diff -urNp linux-2.6.32.49/drivers/pci/pcie/aspm.c linux-2.6.32.49/drivers/pci/pcie/aspm.c
38055 --- linux-2.6.32.49/drivers/pci/pcie/aspm.c 2011-11-08 19:02:43.000000000 -0500
38056 +++ linux-2.6.32.49/drivers/pci/pcie/aspm.c 2011-11-15 19:59:43.000000000 -0500
38057 @@ -27,9 +27,9 @@
38058 #define MODULE_PARAM_PREFIX "pcie_aspm."
38059
38060 /* Note: those are not register definitions */
38061 -#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
38062 -#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
38063 -#define ASPM_STATE_L1 (4) /* L1 state */
38064 +#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
38065 +#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
38066 +#define ASPM_STATE_L1 (4U) /* L1 state */
38067 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
38068 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
38069
38070 diff -urNp linux-2.6.32.49/drivers/pci/probe.c linux-2.6.32.49/drivers/pci/probe.c
38071 --- linux-2.6.32.49/drivers/pci/probe.c 2011-11-08 19:02:43.000000000 -0500
38072 +++ linux-2.6.32.49/drivers/pci/probe.c 2011-11-15 19:59:43.000000000 -0500
38073 @@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
38074 return ret;
38075 }
38076
38077 -static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
38078 +static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
38079 struct device_attribute *attr,
38080 char *buf)
38081 {
38082 return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
38083 }
38084
38085 -static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
38086 +static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
38087 struct device_attribute *attr,
38088 char *buf)
38089 {
38090 diff -urNp linux-2.6.32.49/drivers/pci/proc.c linux-2.6.32.49/drivers/pci/proc.c
38091 --- linux-2.6.32.49/drivers/pci/proc.c 2011-11-08 19:02:43.000000000 -0500
38092 +++ linux-2.6.32.49/drivers/pci/proc.c 2011-11-15 19:59:43.000000000 -0500
38093 @@ -480,7 +480,16 @@ static const struct file_operations proc
38094 static int __init pci_proc_init(void)
38095 {
38096 struct pci_dev *dev = NULL;
38097 +
38098 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
38099 +#ifdef CONFIG_GRKERNSEC_PROC_USER
38100 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
38101 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
38102 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
38103 +#endif
38104 +#else
38105 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
38106 +#endif
38107 proc_create("devices", 0, proc_bus_pci_dir,
38108 &proc_bus_pci_dev_operations);
38109 proc_initialized = 1;
38110 diff -urNp linux-2.6.32.49/drivers/pci/slot.c linux-2.6.32.49/drivers/pci/slot.c
38111 --- linux-2.6.32.49/drivers/pci/slot.c 2011-11-08 19:02:43.000000000 -0500
38112 +++ linux-2.6.32.49/drivers/pci/slot.c 2011-11-15 19:59:43.000000000 -0500
38113 @@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struc
38114 return attribute->store ? attribute->store(slot, buf, len) : -EIO;
38115 }
38116
38117 -static struct sysfs_ops pci_slot_sysfs_ops = {
38118 +static const struct sysfs_ops pci_slot_sysfs_ops = {
38119 .show = pci_slot_attr_show,
38120 .store = pci_slot_attr_store,
38121 };
38122 diff -urNp linux-2.6.32.49/drivers/pcmcia/pcmcia_ioctl.c linux-2.6.32.49/drivers/pcmcia/pcmcia_ioctl.c
38123 --- linux-2.6.32.49/drivers/pcmcia/pcmcia_ioctl.c 2011-11-08 19:02:43.000000000 -0500
38124 +++ linux-2.6.32.49/drivers/pcmcia/pcmcia_ioctl.c 2011-11-15 19:59:43.000000000 -0500
38125 @@ -819,7 +819,7 @@ static int ds_ioctl(struct inode * inode
38126 return -EFAULT;
38127 }
38128 }
38129 - buf = kmalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
38130 + buf = kzalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
38131 if (!buf)
38132 return -ENOMEM;
38133
38134 diff -urNp linux-2.6.32.49/drivers/platform/x86/acer-wmi.c linux-2.6.32.49/drivers/platform/x86/acer-wmi.c
38135 --- linux-2.6.32.49/drivers/platform/x86/acer-wmi.c 2011-11-08 19:02:43.000000000 -0500
38136 +++ linux-2.6.32.49/drivers/platform/x86/acer-wmi.c 2011-11-15 19:59:43.000000000 -0500
38137 @@ -918,7 +918,7 @@ static int update_bl_status(struct backl
38138 return 0;
38139 }
38140
38141 -static struct backlight_ops acer_bl_ops = {
38142 +static const struct backlight_ops acer_bl_ops = {
38143 .get_brightness = read_brightness,
38144 .update_status = update_bl_status,
38145 };
38146 diff -urNp linux-2.6.32.49/drivers/platform/x86/asus_acpi.c linux-2.6.32.49/drivers/platform/x86/asus_acpi.c
38147 --- linux-2.6.32.49/drivers/platform/x86/asus_acpi.c 2011-11-08 19:02:43.000000000 -0500
38148 +++ linux-2.6.32.49/drivers/platform/x86/asus_acpi.c 2011-11-15 19:59:43.000000000 -0500
38149 @@ -1396,7 +1396,7 @@ static int asus_hotk_remove(struct acpi_
38150 return 0;
38151 }
38152
38153 -static struct backlight_ops asus_backlight_data = {
38154 +static const struct backlight_ops asus_backlight_data = {
38155 .get_brightness = read_brightness,
38156 .update_status = set_brightness_status,
38157 };
38158 diff -urNp linux-2.6.32.49/drivers/platform/x86/asus-laptop.c linux-2.6.32.49/drivers/platform/x86/asus-laptop.c
38159 --- linux-2.6.32.49/drivers/platform/x86/asus-laptop.c 2011-11-08 19:02:43.000000000 -0500
38160 +++ linux-2.6.32.49/drivers/platform/x86/asus-laptop.c 2011-11-15 19:59:43.000000000 -0500
38161 @@ -250,7 +250,7 @@ static struct backlight_device *asus_bac
38162 */
38163 static int read_brightness(struct backlight_device *bd);
38164 static int update_bl_status(struct backlight_device *bd);
38165 -static struct backlight_ops asusbl_ops = {
38166 +static const struct backlight_ops asusbl_ops = {
38167 .get_brightness = read_brightness,
38168 .update_status = update_bl_status,
38169 };
38170 diff -urNp linux-2.6.32.49/drivers/platform/x86/compal-laptop.c linux-2.6.32.49/drivers/platform/x86/compal-laptop.c
38171 --- linux-2.6.32.49/drivers/platform/x86/compal-laptop.c 2011-11-08 19:02:43.000000000 -0500
38172 +++ linux-2.6.32.49/drivers/platform/x86/compal-laptop.c 2011-11-15 19:59:43.000000000 -0500
38173 @@ -163,7 +163,7 @@ static int bl_update_status(struct backl
38174 return set_lcd_level(b->props.brightness);
38175 }
38176
38177 -static struct backlight_ops compalbl_ops = {
38178 +static const struct backlight_ops compalbl_ops = {
38179 .get_brightness = bl_get_brightness,
38180 .update_status = bl_update_status,
38181 };
38182 diff -urNp linux-2.6.32.49/drivers/platform/x86/dell-laptop.c linux-2.6.32.49/drivers/platform/x86/dell-laptop.c
38183 --- linux-2.6.32.49/drivers/platform/x86/dell-laptop.c 2011-11-08 19:02:43.000000000 -0500
38184 +++ linux-2.6.32.49/drivers/platform/x86/dell-laptop.c 2011-11-15 19:59:43.000000000 -0500
38185 @@ -318,7 +318,7 @@ static int dell_get_intensity(struct bac
38186 return buffer.output[1];
38187 }
38188
38189 -static struct backlight_ops dell_ops = {
38190 +static const struct backlight_ops dell_ops = {
38191 .get_brightness = dell_get_intensity,
38192 .update_status = dell_send_intensity,
38193 };
38194 diff -urNp linux-2.6.32.49/drivers/platform/x86/eeepc-laptop.c linux-2.6.32.49/drivers/platform/x86/eeepc-laptop.c
38195 --- linux-2.6.32.49/drivers/platform/x86/eeepc-laptop.c 2011-11-08 19:02:43.000000000 -0500
38196 +++ linux-2.6.32.49/drivers/platform/x86/eeepc-laptop.c 2011-11-15 19:59:43.000000000 -0500
38197 @@ -245,7 +245,7 @@ static struct device *eeepc_hwmon_device
38198 */
38199 static int read_brightness(struct backlight_device *bd);
38200 static int update_bl_status(struct backlight_device *bd);
38201 -static struct backlight_ops eeepcbl_ops = {
38202 +static const struct backlight_ops eeepcbl_ops = {
38203 .get_brightness = read_brightness,
38204 .update_status = update_bl_status,
38205 };
38206 diff -urNp linux-2.6.32.49/drivers/platform/x86/fujitsu-laptop.c linux-2.6.32.49/drivers/platform/x86/fujitsu-laptop.c
38207 --- linux-2.6.32.49/drivers/platform/x86/fujitsu-laptop.c 2011-11-08 19:02:43.000000000 -0500
38208 +++ linux-2.6.32.49/drivers/platform/x86/fujitsu-laptop.c 2011-11-15 19:59:43.000000000 -0500
38209 @@ -436,7 +436,7 @@ static int bl_update_status(struct backl
38210 return ret;
38211 }
38212
38213 -static struct backlight_ops fujitsubl_ops = {
38214 +static const struct backlight_ops fujitsubl_ops = {
38215 .get_brightness = bl_get_brightness,
38216 .update_status = bl_update_status,
38217 };
38218 diff -urNp linux-2.6.32.49/drivers/platform/x86/msi-laptop.c linux-2.6.32.49/drivers/platform/x86/msi-laptop.c
38219 --- linux-2.6.32.49/drivers/platform/x86/msi-laptop.c 2011-11-08 19:02:43.000000000 -0500
38220 +++ linux-2.6.32.49/drivers/platform/x86/msi-laptop.c 2011-11-15 19:59:43.000000000 -0500
38221 @@ -161,7 +161,7 @@ static int bl_update_status(struct backl
38222 return set_lcd_level(b->props.brightness);
38223 }
38224
38225 -static struct backlight_ops msibl_ops = {
38226 +static const struct backlight_ops msibl_ops = {
38227 .get_brightness = bl_get_brightness,
38228 .update_status = bl_update_status,
38229 };
38230 diff -urNp linux-2.6.32.49/drivers/platform/x86/panasonic-laptop.c linux-2.6.32.49/drivers/platform/x86/panasonic-laptop.c
38231 --- linux-2.6.32.49/drivers/platform/x86/panasonic-laptop.c 2011-11-08 19:02:43.000000000 -0500
38232 +++ linux-2.6.32.49/drivers/platform/x86/panasonic-laptop.c 2011-11-15 19:59:43.000000000 -0500
38233 @@ -352,7 +352,7 @@ static int bl_set_status(struct backligh
38234 return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
38235 }
38236
38237 -static struct backlight_ops pcc_backlight_ops = {
38238 +static const struct backlight_ops pcc_backlight_ops = {
38239 .get_brightness = bl_get,
38240 .update_status = bl_set_status,
38241 };
38242 diff -urNp linux-2.6.32.49/drivers/platform/x86/sony-laptop.c linux-2.6.32.49/drivers/platform/x86/sony-laptop.c
38243 --- linux-2.6.32.49/drivers/platform/x86/sony-laptop.c 2011-11-08 19:02:43.000000000 -0500
38244 +++ linux-2.6.32.49/drivers/platform/x86/sony-laptop.c 2011-11-15 19:59:43.000000000 -0500
38245 @@ -850,7 +850,7 @@ static int sony_backlight_get_brightness
38246 }
38247
38248 static struct backlight_device *sony_backlight_device;
38249 -static struct backlight_ops sony_backlight_ops = {
38250 +static const struct backlight_ops sony_backlight_ops = {
38251 .update_status = sony_backlight_update_status,
38252 .get_brightness = sony_backlight_get_brightness,
38253 };
38254 diff -urNp linux-2.6.32.49/drivers/platform/x86/thinkpad_acpi.c linux-2.6.32.49/drivers/platform/x86/thinkpad_acpi.c
38255 --- linux-2.6.32.49/drivers/platform/x86/thinkpad_acpi.c 2011-11-08 19:02:43.000000000 -0500
38256 +++ linux-2.6.32.49/drivers/platform/x86/thinkpad_acpi.c 2011-11-15 19:59:43.000000000 -0500
38257 @@ -2139,7 +2139,7 @@ static int hotkey_mask_get(void)
38258 return 0;
38259 }
38260
38261 -void static hotkey_mask_warn_incomplete_mask(void)
38262 +static void hotkey_mask_warn_incomplete_mask(void)
38263 {
38264 /* log only what the user can fix... */
38265 const u32 wantedmask = hotkey_driver_mask &
38266 @@ -6125,7 +6125,7 @@ static void tpacpi_brightness_notify_cha
38267 BACKLIGHT_UPDATE_HOTKEY);
38268 }
38269
38270 -static struct backlight_ops ibm_backlight_data = {
38271 +static const struct backlight_ops ibm_backlight_data = {
38272 .get_brightness = brightness_get,
38273 .update_status = brightness_update_status,
38274 };
38275 diff -urNp linux-2.6.32.49/drivers/platform/x86/toshiba_acpi.c linux-2.6.32.49/drivers/platform/x86/toshiba_acpi.c
38276 --- linux-2.6.32.49/drivers/platform/x86/toshiba_acpi.c 2011-11-08 19:02:43.000000000 -0500
38277 +++ linux-2.6.32.49/drivers/platform/x86/toshiba_acpi.c 2011-11-15 19:59:43.000000000 -0500
38278 @@ -671,7 +671,7 @@ static acpi_status remove_device(void)
38279 return AE_OK;
38280 }
38281
38282 -static struct backlight_ops toshiba_backlight_data = {
38283 +static const struct backlight_ops toshiba_backlight_data = {
38284 .get_brightness = get_lcd,
38285 .update_status = set_lcd_status,
38286 };
38287 diff -urNp linux-2.6.32.49/drivers/pnp/pnpbios/bioscalls.c linux-2.6.32.49/drivers/pnp/pnpbios/bioscalls.c
38288 --- linux-2.6.32.49/drivers/pnp/pnpbios/bioscalls.c 2011-11-08 19:02:43.000000000 -0500
38289 +++ linux-2.6.32.49/drivers/pnp/pnpbios/bioscalls.c 2011-11-15 19:59:43.000000000 -0500
38290 @@ -60,7 +60,7 @@ do { \
38291 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
38292 } while(0)
38293
38294 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
38295 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
38296 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
38297
38298 /*
38299 @@ -97,7 +97,10 @@ static inline u16 call_pnp_bios(u16 func
38300
38301 cpu = get_cpu();
38302 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
38303 +
38304 + pax_open_kernel();
38305 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
38306 + pax_close_kernel();
38307
38308 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
38309 spin_lock_irqsave(&pnp_bios_lock, flags);
38310 @@ -135,7 +138,10 @@ static inline u16 call_pnp_bios(u16 func
38311 :"memory");
38312 spin_unlock_irqrestore(&pnp_bios_lock, flags);
38313
38314 + pax_open_kernel();
38315 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
38316 + pax_close_kernel();
38317 +
38318 put_cpu();
38319
38320 /* If we get here and this is set then the PnP BIOS faulted on us. */
38321 @@ -469,7 +475,7 @@ int pnp_bios_read_escd(char *data, u32 n
38322 return status;
38323 }
38324
38325 -void pnpbios_calls_init(union pnp_bios_install_struct *header)
38326 +void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
38327 {
38328 int i;
38329
38330 @@ -477,6 +483,8 @@ void pnpbios_calls_init(union pnp_bios_i
38331 pnp_bios_callpoint.offset = header->fields.pm16offset;
38332 pnp_bios_callpoint.segment = PNP_CS16;
38333
38334 + pax_open_kernel();
38335 +
38336 for_each_possible_cpu(i) {
38337 struct desc_struct *gdt = get_cpu_gdt_table(i);
38338 if (!gdt)
38339 @@ -488,4 +496,6 @@ void pnpbios_calls_init(union pnp_bios_i
38340 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
38341 (unsigned long)__va(header->fields.pm16dseg));
38342 }
38343 +
38344 + pax_close_kernel();
38345 }
38346 diff -urNp linux-2.6.32.49/drivers/pnp/resource.c linux-2.6.32.49/drivers/pnp/resource.c
38347 --- linux-2.6.32.49/drivers/pnp/resource.c 2011-11-08 19:02:43.000000000 -0500
38348 +++ linux-2.6.32.49/drivers/pnp/resource.c 2011-11-15 19:59:43.000000000 -0500
38349 @@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
38350 return 1;
38351
38352 /* check if the resource is valid */
38353 - if (*irq < 0 || *irq > 15)
38354 + if (*irq > 15)
38355 return 0;
38356
38357 /* check if the resource is reserved */
38358 @@ -419,7 +419,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
38359 return 1;
38360
38361 /* check if the resource is valid */
38362 - if (*dma < 0 || *dma == 4 || *dma > 7)
38363 + if (*dma == 4 || *dma > 7)
38364 return 0;
38365
38366 /* check if the resource is reserved */
38367 diff -urNp linux-2.6.32.49/drivers/power/bq27x00_battery.c linux-2.6.32.49/drivers/power/bq27x00_battery.c
38368 --- linux-2.6.32.49/drivers/power/bq27x00_battery.c 2011-11-08 19:02:43.000000000 -0500
38369 +++ linux-2.6.32.49/drivers/power/bq27x00_battery.c 2011-11-15 19:59:43.000000000 -0500
38370 @@ -44,7 +44,7 @@ struct bq27x00_device_info;
38371 struct bq27x00_access_methods {
38372 int (*read)(u8 reg, int *rt_value, int b_single,
38373 struct bq27x00_device_info *di);
38374 -};
38375 +} __no_const;
38376
38377 struct bq27x00_device_info {
38378 struct device *dev;
38379 diff -urNp linux-2.6.32.49/drivers/rtc/rtc-dev.c linux-2.6.32.49/drivers/rtc/rtc-dev.c
38380 --- linux-2.6.32.49/drivers/rtc/rtc-dev.c 2011-11-08 19:02:43.000000000 -0500
38381 +++ linux-2.6.32.49/drivers/rtc/rtc-dev.c 2011-11-15 19:59:43.000000000 -0500
38382 @@ -14,6 +14,7 @@
38383 #include <linux/module.h>
38384 #include <linux/rtc.h>
38385 #include <linux/sched.h>
38386 +#include <linux/grsecurity.h>
38387 #include "rtc-core.h"
38388
38389 static dev_t rtc_devt;
38390 @@ -357,6 +358,8 @@ static long rtc_dev_ioctl(struct file *f
38391 if (copy_from_user(&tm, uarg, sizeof(tm)))
38392 return -EFAULT;
38393
38394 + gr_log_timechange();
38395 +
38396 return rtc_set_time(rtc, &tm);
38397
38398 case RTC_PIE_ON:
38399 diff -urNp linux-2.6.32.49/drivers/s390/cio/qdio_perf.c linux-2.6.32.49/drivers/s390/cio/qdio_perf.c
38400 --- linux-2.6.32.49/drivers/s390/cio/qdio_perf.c 2011-11-08 19:02:43.000000000 -0500
38401 +++ linux-2.6.32.49/drivers/s390/cio/qdio_perf.c 2011-11-15 19:59:43.000000000 -0500
38402 @@ -31,51 +31,51 @@ static struct proc_dir_entry *qdio_perf_
38403 static int qdio_perf_proc_show(struct seq_file *m, void *v)
38404 {
38405 seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
38406 - (long)atomic_long_read(&perf_stats.qdio_int));
38407 + (long)atomic_long_read_unchecked(&perf_stats.qdio_int));
38408 seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
38409 - (long)atomic_long_read(&perf_stats.pci_int));
38410 + (long)atomic_long_read_unchecked(&perf_stats.pci_int));
38411 seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
38412 - (long)atomic_long_read(&perf_stats.thin_int));
38413 + (long)atomic_long_read_unchecked(&perf_stats.thin_int));
38414 seq_printf(m, "\n");
38415 seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
38416 - (long)atomic_long_read(&perf_stats.tasklet_inbound));
38417 + (long)atomic_long_read_unchecked(&perf_stats.tasklet_inbound));
38418 seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
38419 - (long)atomic_long_read(&perf_stats.tasklet_outbound));
38420 + (long)atomic_long_read_unchecked(&perf_stats.tasklet_outbound));
38421 seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
38422 - (long)atomic_long_read(&perf_stats.tasklet_thinint),
38423 - (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
38424 + (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint),
38425 + (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint_loop));
38426 seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
38427 - (long)atomic_long_read(&perf_stats.thinint_inbound),
38428 - (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
38429 + (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound),
38430 + (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop));
38431 seq_printf(m, "\n");
38432 seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
38433 - (long)atomic_long_read(&perf_stats.siga_in));
38434 + (long)atomic_long_read_unchecked(&perf_stats.siga_in));
38435 seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
38436 - (long)atomic_long_read(&perf_stats.siga_out));
38437 + (long)atomic_long_read_unchecked(&perf_stats.siga_out));
38438 seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
38439 - (long)atomic_long_read(&perf_stats.siga_sync));
38440 + (long)atomic_long_read_unchecked(&perf_stats.siga_sync));
38441 seq_printf(m, "\n");
38442 seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
38443 - (long)atomic_long_read(&perf_stats.inbound_handler));
38444 + (long)atomic_long_read_unchecked(&perf_stats.inbound_handler));
38445 seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
38446 - (long)atomic_long_read(&perf_stats.outbound_handler));
38447 + (long)atomic_long_read_unchecked(&perf_stats.outbound_handler));
38448 seq_printf(m, "\n");
38449 seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
38450 - (long)atomic_long_read(&perf_stats.fast_requeue));
38451 + (long)atomic_long_read_unchecked(&perf_stats.fast_requeue));
38452 seq_printf(m, "Number of outbound target full condition\t: %li\n",
38453 - (long)atomic_long_read(&perf_stats.outbound_target_full));
38454 + (long)atomic_long_read_unchecked(&perf_stats.outbound_target_full));
38455 seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
38456 - (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
38457 + (long)atomic_long_read_unchecked(&perf_stats.debug_tl_out_timer));
38458 seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
38459 - (long)atomic_long_read(&perf_stats.debug_stop_polling));
38460 + (long)atomic_long_read_unchecked(&perf_stats.debug_stop_polling));
38461 seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
38462 - (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
38463 + (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop2));
38464 seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
38465 - (long)atomic_long_read(&perf_stats.debug_eqbs_all),
38466 - (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
38467 + (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_all),
38468 + (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_incomplete));
38469 seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
38470 - (long)atomic_long_read(&perf_stats.debug_sqbs_all),
38471 - (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
38472 + (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_all),
38473 + (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_incomplete));
38474 seq_printf(m, "\n");
38475 return 0;
38476 }
38477 diff -urNp linux-2.6.32.49/drivers/s390/cio/qdio_perf.h linux-2.6.32.49/drivers/s390/cio/qdio_perf.h
38478 --- linux-2.6.32.49/drivers/s390/cio/qdio_perf.h 2011-11-08 19:02:43.000000000 -0500
38479 +++ linux-2.6.32.49/drivers/s390/cio/qdio_perf.h 2011-11-15 19:59:43.000000000 -0500
38480 @@ -13,46 +13,46 @@
38481
38482 struct qdio_perf_stats {
38483 /* interrupt handler calls */
38484 - atomic_long_t qdio_int;
38485 - atomic_long_t pci_int;
38486 - atomic_long_t thin_int;
38487 + atomic_long_unchecked_t qdio_int;
38488 + atomic_long_unchecked_t pci_int;
38489 + atomic_long_unchecked_t thin_int;
38490
38491 /* tasklet runs */
38492 - atomic_long_t tasklet_inbound;
38493 - atomic_long_t tasklet_outbound;
38494 - atomic_long_t tasklet_thinint;
38495 - atomic_long_t tasklet_thinint_loop;
38496 - atomic_long_t thinint_inbound;
38497 - atomic_long_t thinint_inbound_loop;
38498 - atomic_long_t thinint_inbound_loop2;
38499 + atomic_long_unchecked_t tasklet_inbound;
38500 + atomic_long_unchecked_t tasklet_outbound;
38501 + atomic_long_unchecked_t tasklet_thinint;
38502 + atomic_long_unchecked_t tasklet_thinint_loop;
38503 + atomic_long_unchecked_t thinint_inbound;
38504 + atomic_long_unchecked_t thinint_inbound_loop;
38505 + atomic_long_unchecked_t thinint_inbound_loop2;
38506
38507 /* signal adapter calls */
38508 - atomic_long_t siga_out;
38509 - atomic_long_t siga_in;
38510 - atomic_long_t siga_sync;
38511 + atomic_long_unchecked_t siga_out;
38512 + atomic_long_unchecked_t siga_in;
38513 + atomic_long_unchecked_t siga_sync;
38514
38515 /* misc */
38516 - atomic_long_t inbound_handler;
38517 - atomic_long_t outbound_handler;
38518 - atomic_long_t fast_requeue;
38519 - atomic_long_t outbound_target_full;
38520 + atomic_long_unchecked_t inbound_handler;
38521 + atomic_long_unchecked_t outbound_handler;
38522 + atomic_long_unchecked_t fast_requeue;
38523 + atomic_long_unchecked_t outbound_target_full;
38524
38525 /* for debugging */
38526 - atomic_long_t debug_tl_out_timer;
38527 - atomic_long_t debug_stop_polling;
38528 - atomic_long_t debug_eqbs_all;
38529 - atomic_long_t debug_eqbs_incomplete;
38530 - atomic_long_t debug_sqbs_all;
38531 - atomic_long_t debug_sqbs_incomplete;
38532 + atomic_long_unchecked_t debug_tl_out_timer;
38533 + atomic_long_unchecked_t debug_stop_polling;
38534 + atomic_long_unchecked_t debug_eqbs_all;
38535 + atomic_long_unchecked_t debug_eqbs_incomplete;
38536 + atomic_long_unchecked_t debug_sqbs_all;
38537 + atomic_long_unchecked_t debug_sqbs_incomplete;
38538 };
38539
38540 extern struct qdio_perf_stats perf_stats;
38541 extern int qdio_performance_stats;
38542
38543 -static inline void qdio_perf_stat_inc(atomic_long_t *count)
38544 +static inline void qdio_perf_stat_inc(atomic_long_unchecked_t *count)
38545 {
38546 if (qdio_performance_stats)
38547 - atomic_long_inc(count);
38548 + atomic_long_inc_unchecked(count);
38549 }
38550
38551 int qdio_setup_perf_stats(void);
38552 diff -urNp linux-2.6.32.49/drivers/scsi/aacraid/aacraid.h linux-2.6.32.49/drivers/scsi/aacraid/aacraid.h
38553 --- linux-2.6.32.49/drivers/scsi/aacraid/aacraid.h 2011-11-08 19:02:43.000000000 -0500
38554 +++ linux-2.6.32.49/drivers/scsi/aacraid/aacraid.h 2011-11-15 19:59:43.000000000 -0500
38555 @@ -471,7 +471,7 @@ struct adapter_ops
38556 int (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
38557 /* Administrative operations */
38558 int (*adapter_comm)(struct aac_dev * dev, int comm);
38559 -};
38560 +} __no_const;
38561
38562 /*
38563 * Define which interrupt handler needs to be installed
38564 diff -urNp linux-2.6.32.49/drivers/scsi/aacraid/commctrl.c linux-2.6.32.49/drivers/scsi/aacraid/commctrl.c
38565 --- linux-2.6.32.49/drivers/scsi/aacraid/commctrl.c 2011-11-08 19:02:43.000000000 -0500
38566 +++ linux-2.6.32.49/drivers/scsi/aacraid/commctrl.c 2011-11-15 19:59:43.000000000 -0500
38567 @@ -481,6 +481,7 @@ static int aac_send_raw_srb(struct aac_d
38568 u32 actual_fibsize64, actual_fibsize = 0;
38569 int i;
38570
38571 + pax_track_stack();
38572
38573 if (dev->in_reset) {
38574 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
38575 diff -urNp linux-2.6.32.49/drivers/scsi/aacraid/linit.c linux-2.6.32.49/drivers/scsi/aacraid/linit.c
38576 --- linux-2.6.32.49/drivers/scsi/aacraid/linit.c 2011-11-08 19:02:43.000000000 -0500
38577 +++ linux-2.6.32.49/drivers/scsi/aacraid/linit.c 2011-11-18 18:01:55.000000000 -0500
38578 @@ -91,7 +91,7 @@ static DECLARE_PCI_DEVICE_TABLE(aac_pci_
38579 #elif defined(__devinitconst)
38580 static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
38581 #else
38582 -static const struct pci_device_id aac_pci_tbl[] __devinitdata = {
38583 +static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
38584 #endif
38585 { 0x1028, 0x0001, 0x1028, 0x0001, 0, 0, 0 }, /* PERC 2/Si (Iguana/PERC2Si) */
38586 { 0x1028, 0x0002, 0x1028, 0x0002, 0, 0, 1 }, /* PERC 3/Di (Opal/PERC3Di) */
38587 diff -urNp linux-2.6.32.49/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.32.49/drivers/scsi/aic94xx/aic94xx_init.c
38588 --- linux-2.6.32.49/drivers/scsi/aic94xx/aic94xx_init.c 2011-11-08 19:02:43.000000000 -0500
38589 +++ linux-2.6.32.49/drivers/scsi/aic94xx/aic94xx_init.c 2011-11-18 18:01:55.000000000 -0500
38590 @@ -485,7 +485,7 @@ static ssize_t asd_show_update_bios(stru
38591 flash_error_table[i].reason);
38592 }
38593
38594 -static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUGO,
38595 +static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUSR,
38596 asd_show_update_bios, asd_store_update_bios);
38597
38598 static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
38599 @@ -1011,7 +1011,7 @@ static struct sas_domain_function_templa
38600 .lldd_control_phy = asd_control_phy,
38601 };
38602
38603 -static const struct pci_device_id aic94xx_pci_table[] __devinitdata = {
38604 +static const struct pci_device_id aic94xx_pci_table[] __devinitconst = {
38605 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x410),0, 0, 1},
38606 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x412),0, 0, 1},
38607 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x416),0, 0, 1},
38608 diff -urNp linux-2.6.32.49/drivers/scsi/bfa/bfa_iocfc.h linux-2.6.32.49/drivers/scsi/bfa/bfa_iocfc.h
38609 --- linux-2.6.32.49/drivers/scsi/bfa/bfa_iocfc.h 2011-11-08 19:02:43.000000000 -0500
38610 +++ linux-2.6.32.49/drivers/scsi/bfa/bfa_iocfc.h 2011-11-15 19:59:43.000000000 -0500
38611 @@ -61,7 +61,7 @@ struct bfa_hwif_s {
38612 void (*hw_isr_mode_set)(struct bfa_s *bfa, bfa_boolean_t msix);
38613 void (*hw_msix_getvecs)(struct bfa_s *bfa, u32 *vecmap,
38614 u32 *nvecs, u32 *maxvec);
38615 -};
38616 +} __no_const;
38617 typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
38618
38619 struct bfa_iocfc_s {
38620 diff -urNp linux-2.6.32.49/drivers/scsi/bfa/bfa_ioc.h linux-2.6.32.49/drivers/scsi/bfa/bfa_ioc.h
38621 --- linux-2.6.32.49/drivers/scsi/bfa/bfa_ioc.h 2011-11-08 19:02:43.000000000 -0500
38622 +++ linux-2.6.32.49/drivers/scsi/bfa/bfa_ioc.h 2011-11-15 19:59:43.000000000 -0500
38623 @@ -127,7 +127,7 @@ struct bfa_ioc_cbfn_s {
38624 bfa_ioc_disable_cbfn_t disable_cbfn;
38625 bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
38626 bfa_ioc_reset_cbfn_t reset_cbfn;
38627 -};
38628 +} __no_const;
38629
38630 /**
38631 * Heartbeat failure notification queue element.
38632 diff -urNp linux-2.6.32.49/drivers/scsi/BusLogic.c linux-2.6.32.49/drivers/scsi/BusLogic.c
38633 --- linux-2.6.32.49/drivers/scsi/BusLogic.c 2011-11-08 19:02:43.000000000 -0500
38634 +++ linux-2.6.32.49/drivers/scsi/BusLogic.c 2011-11-15 19:59:43.000000000 -0500
38635 @@ -961,6 +961,8 @@ static int __init BusLogic_InitializeFla
38636 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
38637 *PrototypeHostAdapter)
38638 {
38639 + pax_track_stack();
38640 +
38641 /*
38642 If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
38643 Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
38644 diff -urNp linux-2.6.32.49/drivers/scsi/dpt_i2o.c linux-2.6.32.49/drivers/scsi/dpt_i2o.c
38645 --- linux-2.6.32.49/drivers/scsi/dpt_i2o.c 2011-11-08 19:02:43.000000000 -0500
38646 +++ linux-2.6.32.49/drivers/scsi/dpt_i2o.c 2011-11-15 19:59:43.000000000 -0500
38647 @@ -1804,6 +1804,8 @@ static int adpt_i2o_passthru(adpt_hba* p
38648 dma_addr_t addr;
38649 ulong flags = 0;
38650
38651 + pax_track_stack();
38652 +
38653 memset(&msg, 0, MAX_MESSAGE_SIZE*4);
38654 // get user msg size in u32s
38655 if(get_user(size, &user_msg[0])){
38656 @@ -2297,6 +2299,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pH
38657 s32 rcode;
38658 dma_addr_t addr;
38659
38660 + pax_track_stack();
38661 +
38662 memset(msg, 0 , sizeof(msg));
38663 len = scsi_bufflen(cmd);
38664 direction = 0x00000000;
38665 diff -urNp linux-2.6.32.49/drivers/scsi/eata.c linux-2.6.32.49/drivers/scsi/eata.c
38666 --- linux-2.6.32.49/drivers/scsi/eata.c 2011-11-08 19:02:43.000000000 -0500
38667 +++ linux-2.6.32.49/drivers/scsi/eata.c 2011-11-15 19:59:43.000000000 -0500
38668 @@ -1087,6 +1087,8 @@ static int port_detect(unsigned long por
38669 struct hostdata *ha;
38670 char name[16];
38671
38672 + pax_track_stack();
38673 +
38674 sprintf(name, "%s%d", driver_name, j);
38675
38676 if (!request_region(port_base, REGION_SIZE, driver_name)) {
38677 diff -urNp linux-2.6.32.49/drivers/scsi/fcoe/libfcoe.c linux-2.6.32.49/drivers/scsi/fcoe/libfcoe.c
38678 --- linux-2.6.32.49/drivers/scsi/fcoe/libfcoe.c 2011-11-08 19:02:43.000000000 -0500
38679 +++ linux-2.6.32.49/drivers/scsi/fcoe/libfcoe.c 2011-11-15 19:59:43.000000000 -0500
38680 @@ -809,6 +809,8 @@ static void fcoe_ctlr_recv_els(struct fc
38681 size_t rlen;
38682 size_t dlen;
38683
38684 + pax_track_stack();
38685 +
38686 fiph = (struct fip_header *)skb->data;
38687 sub = fiph->fip_subcode;
38688 if (sub != FIP_SC_REQ && sub != FIP_SC_REP)
38689 diff -urNp linux-2.6.32.49/drivers/scsi/fnic/fnic_main.c linux-2.6.32.49/drivers/scsi/fnic/fnic_main.c
38690 --- linux-2.6.32.49/drivers/scsi/fnic/fnic_main.c 2011-11-08 19:02:43.000000000 -0500
38691 +++ linux-2.6.32.49/drivers/scsi/fnic/fnic_main.c 2011-11-15 19:59:43.000000000 -0500
38692 @@ -669,7 +669,7 @@ static int __devinit fnic_probe(struct p
38693 /* Start local port initiatialization */
38694
38695 lp->link_up = 0;
38696 - lp->tt = fnic_transport_template;
38697 + memcpy((void *)&lp->tt, &fnic_transport_template, sizeof(fnic_transport_template));
38698
38699 lp->max_retry_count = fnic->config.flogi_retries;
38700 lp->max_rport_retry_count = fnic->config.plogi_retries;
38701 diff -urNp linux-2.6.32.49/drivers/scsi/gdth.c linux-2.6.32.49/drivers/scsi/gdth.c
38702 --- linux-2.6.32.49/drivers/scsi/gdth.c 2011-11-08 19:02:43.000000000 -0500
38703 +++ linux-2.6.32.49/drivers/scsi/gdth.c 2011-11-15 19:59:43.000000000 -0500
38704 @@ -4102,6 +4102,8 @@ static int ioc_lockdrv(void __user *arg)
38705 ulong flags;
38706 gdth_ha_str *ha;
38707
38708 + pax_track_stack();
38709 +
38710 if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
38711 return -EFAULT;
38712 ha = gdth_find_ha(ldrv.ionode);
38713 @@ -4134,6 +4136,8 @@ static int ioc_resetdrv(void __user *arg
38714 gdth_ha_str *ha;
38715 int rval;
38716
38717 + pax_track_stack();
38718 +
38719 if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
38720 res.number >= MAX_HDRIVES)
38721 return -EFAULT;
38722 @@ -4169,6 +4173,8 @@ static int ioc_general(void __user *arg,
38723 gdth_ha_str *ha;
38724 int rval;
38725
38726 + pax_track_stack();
38727 +
38728 if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
38729 return -EFAULT;
38730 ha = gdth_find_ha(gen.ionode);
38731 @@ -4625,6 +4631,9 @@ static void gdth_flush(gdth_ha_str *ha)
38732 int i;
38733 gdth_cmd_str gdtcmd;
38734 char cmnd[MAX_COMMAND_SIZE];
38735 +
38736 + pax_track_stack();
38737 +
38738 memset(cmnd, 0xff, MAX_COMMAND_SIZE);
38739
38740 TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
38741 diff -urNp linux-2.6.32.49/drivers/scsi/gdth_proc.c linux-2.6.32.49/drivers/scsi/gdth_proc.c
38742 --- linux-2.6.32.49/drivers/scsi/gdth_proc.c 2011-11-08 19:02:43.000000000 -0500
38743 +++ linux-2.6.32.49/drivers/scsi/gdth_proc.c 2011-11-15 19:59:43.000000000 -0500
38744 @@ -46,6 +46,9 @@ static int gdth_set_asc_info(struct Scsi
38745 ulong64 paddr;
38746
38747 char cmnd[MAX_COMMAND_SIZE];
38748 +
38749 + pax_track_stack();
38750 +
38751 memset(cmnd, 0xff, 12);
38752 memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
38753
38754 @@ -174,6 +177,8 @@ static int gdth_get_info(char *buffer,ch
38755 gdth_hget_str *phg;
38756 char cmnd[MAX_COMMAND_SIZE];
38757
38758 + pax_track_stack();
38759 +
38760 gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
38761 estr = kmalloc(sizeof(*estr), GFP_KERNEL);
38762 if (!gdtcmd || !estr)
38763 diff -urNp linux-2.6.32.49/drivers/scsi/hosts.c linux-2.6.32.49/drivers/scsi/hosts.c
38764 --- linux-2.6.32.49/drivers/scsi/hosts.c 2011-11-26 19:44:53.000000000 -0500
38765 +++ linux-2.6.32.49/drivers/scsi/hosts.c 2011-11-26 19:45:06.000000000 -0500
38766 @@ -40,7 +40,7 @@
38767 #include "scsi_logging.h"
38768
38769
38770 -static atomic_t scsi_host_next_hn; /* host_no for next new host */
38771 +static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
38772
38773
38774 static void scsi_host_cls_release(struct device *dev)
38775 @@ -347,7 +347,7 @@ struct Scsi_Host *scsi_host_alloc(struct
38776 * subtract one because we increment first then return, but we need to
38777 * know what the next host number was before increment
38778 */
38779 - shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
38780 + shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
38781 shost->dma_channel = 0xff;
38782
38783 /* These three are default values which can be overridden */
38784 diff -urNp linux-2.6.32.49/drivers/scsi/ipr.c linux-2.6.32.49/drivers/scsi/ipr.c
38785 --- linux-2.6.32.49/drivers/scsi/ipr.c 2011-11-08 19:02:43.000000000 -0500
38786 +++ linux-2.6.32.49/drivers/scsi/ipr.c 2011-11-15 19:59:43.000000000 -0500
38787 @@ -5286,7 +5286,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
38788 return true;
38789 }
38790
38791 -static struct ata_port_operations ipr_sata_ops = {
38792 +static const struct ata_port_operations ipr_sata_ops = {
38793 .phy_reset = ipr_ata_phy_reset,
38794 .hardreset = ipr_sata_reset,
38795 .post_internal_cmd = ipr_ata_post_internal,
38796 diff -urNp linux-2.6.32.49/drivers/scsi/ips.h linux-2.6.32.49/drivers/scsi/ips.h
38797 --- linux-2.6.32.49/drivers/scsi/ips.h 2011-11-08 19:02:43.000000000 -0500
38798 +++ linux-2.6.32.49/drivers/scsi/ips.h 2011-11-15 19:59:43.000000000 -0500
38799 @@ -1027,7 +1027,7 @@ typedef struct {
38800 int (*intr)(struct ips_ha *);
38801 void (*enableint)(struct ips_ha *);
38802 uint32_t (*statupd)(struct ips_ha *);
38803 -} ips_hw_func_t;
38804 +} __no_const ips_hw_func_t;
38805
38806 typedef struct ips_ha {
38807 uint8_t ha_id[IPS_MAX_CHANNELS+1];
38808 diff -urNp linux-2.6.32.49/drivers/scsi/libfc/fc_exch.c linux-2.6.32.49/drivers/scsi/libfc/fc_exch.c
38809 --- linux-2.6.32.49/drivers/scsi/libfc/fc_exch.c 2011-11-08 19:02:43.000000000 -0500
38810 +++ linux-2.6.32.49/drivers/scsi/libfc/fc_exch.c 2011-11-15 19:59:43.000000000 -0500
38811 @@ -86,12 +86,12 @@ struct fc_exch_mgr {
38812 * all together if not used XXX
38813 */
38814 struct {
38815 - atomic_t no_free_exch;
38816 - atomic_t no_free_exch_xid;
38817 - atomic_t xid_not_found;
38818 - atomic_t xid_busy;
38819 - atomic_t seq_not_found;
38820 - atomic_t non_bls_resp;
38821 + atomic_unchecked_t no_free_exch;
38822 + atomic_unchecked_t no_free_exch_xid;
38823 + atomic_unchecked_t xid_not_found;
38824 + atomic_unchecked_t xid_busy;
38825 + atomic_unchecked_t seq_not_found;
38826 + atomic_unchecked_t non_bls_resp;
38827 } stats;
38828 };
38829 #define fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
38830 @@ -510,7 +510,7 @@ static struct fc_exch *fc_exch_em_alloc(
38831 /* allocate memory for exchange */
38832 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
38833 if (!ep) {
38834 - atomic_inc(&mp->stats.no_free_exch);
38835 + atomic_inc_unchecked(&mp->stats.no_free_exch);
38836 goto out;
38837 }
38838 memset(ep, 0, sizeof(*ep));
38839 @@ -557,7 +557,7 @@ out:
38840 return ep;
38841 err:
38842 spin_unlock_bh(&pool->lock);
38843 - atomic_inc(&mp->stats.no_free_exch_xid);
38844 + atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
38845 mempool_free(ep, mp->ep_pool);
38846 return NULL;
38847 }
38848 @@ -690,7 +690,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38849 xid = ntohs(fh->fh_ox_id); /* we originated exch */
38850 ep = fc_exch_find(mp, xid);
38851 if (!ep) {
38852 - atomic_inc(&mp->stats.xid_not_found);
38853 + atomic_inc_unchecked(&mp->stats.xid_not_found);
38854 reject = FC_RJT_OX_ID;
38855 goto out;
38856 }
38857 @@ -720,7 +720,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38858 ep = fc_exch_find(mp, xid);
38859 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
38860 if (ep) {
38861 - atomic_inc(&mp->stats.xid_busy);
38862 + atomic_inc_unchecked(&mp->stats.xid_busy);
38863 reject = FC_RJT_RX_ID;
38864 goto rel;
38865 }
38866 @@ -731,7 +731,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38867 }
38868 xid = ep->xid; /* get our XID */
38869 } else if (!ep) {
38870 - atomic_inc(&mp->stats.xid_not_found);
38871 + atomic_inc_unchecked(&mp->stats.xid_not_found);
38872 reject = FC_RJT_RX_ID; /* XID not found */
38873 goto out;
38874 }
38875 @@ -752,7 +752,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38876 } else {
38877 sp = &ep->seq;
38878 if (sp->id != fh->fh_seq_id) {
38879 - atomic_inc(&mp->stats.seq_not_found);
38880 + atomic_inc_unchecked(&mp->stats.seq_not_found);
38881 reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
38882 goto rel;
38883 }
38884 @@ -1163,22 +1163,22 @@ static void fc_exch_recv_seq_resp(struct
38885
38886 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
38887 if (!ep) {
38888 - atomic_inc(&mp->stats.xid_not_found);
38889 + atomic_inc_unchecked(&mp->stats.xid_not_found);
38890 goto out;
38891 }
38892 if (ep->esb_stat & ESB_ST_COMPLETE) {
38893 - atomic_inc(&mp->stats.xid_not_found);
38894 + atomic_inc_unchecked(&mp->stats.xid_not_found);
38895 goto out;
38896 }
38897 if (ep->rxid == FC_XID_UNKNOWN)
38898 ep->rxid = ntohs(fh->fh_rx_id);
38899 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
38900 - atomic_inc(&mp->stats.xid_not_found);
38901 + atomic_inc_unchecked(&mp->stats.xid_not_found);
38902 goto rel;
38903 }
38904 if (ep->did != ntoh24(fh->fh_s_id) &&
38905 ep->did != FC_FID_FLOGI) {
38906 - atomic_inc(&mp->stats.xid_not_found);
38907 + atomic_inc_unchecked(&mp->stats.xid_not_found);
38908 goto rel;
38909 }
38910 sof = fr_sof(fp);
38911 @@ -1189,7 +1189,7 @@ static void fc_exch_recv_seq_resp(struct
38912 } else {
38913 sp = &ep->seq;
38914 if (sp->id != fh->fh_seq_id) {
38915 - atomic_inc(&mp->stats.seq_not_found);
38916 + atomic_inc_unchecked(&mp->stats.seq_not_found);
38917 goto rel;
38918 }
38919 }
38920 @@ -1249,9 +1249,9 @@ static void fc_exch_recv_resp(struct fc_
38921 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
38922
38923 if (!sp)
38924 - atomic_inc(&mp->stats.xid_not_found);
38925 + atomic_inc_unchecked(&mp->stats.xid_not_found);
38926 else
38927 - atomic_inc(&mp->stats.non_bls_resp);
38928 + atomic_inc_unchecked(&mp->stats.non_bls_resp);
38929
38930 fc_frame_free(fp);
38931 }
38932 diff -urNp linux-2.6.32.49/drivers/scsi/libsas/sas_ata.c linux-2.6.32.49/drivers/scsi/libsas/sas_ata.c
38933 --- linux-2.6.32.49/drivers/scsi/libsas/sas_ata.c 2011-11-08 19:02:43.000000000 -0500
38934 +++ linux-2.6.32.49/drivers/scsi/libsas/sas_ata.c 2011-11-15 19:59:43.000000000 -0500
38935 @@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_l
38936 }
38937 }
38938
38939 -static struct ata_port_operations sas_sata_ops = {
38940 +static const struct ata_port_operations sas_sata_ops = {
38941 .phy_reset = sas_ata_phy_reset,
38942 .post_internal_cmd = sas_ata_post_internal,
38943 .qc_defer = ata_std_qc_defer,
38944 diff -urNp linux-2.6.32.49/drivers/scsi/lpfc/lpfc_debugfs.c linux-2.6.32.49/drivers/scsi/lpfc/lpfc_debugfs.c
38945 --- linux-2.6.32.49/drivers/scsi/lpfc/lpfc_debugfs.c 2011-11-08 19:02:43.000000000 -0500
38946 +++ linux-2.6.32.49/drivers/scsi/lpfc/lpfc_debugfs.c 2011-11-15 19:59:43.000000000 -0500
38947 @@ -124,7 +124,7 @@ struct lpfc_debug {
38948 int len;
38949 };
38950
38951 -static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
38952 +static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
38953 static unsigned long lpfc_debugfs_start_time = 0L;
38954
38955 /**
38956 @@ -158,7 +158,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_v
38957 lpfc_debugfs_enable = 0;
38958
38959 len = 0;
38960 - index = (atomic_read(&vport->disc_trc_cnt) + 1) &
38961 + index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
38962 (lpfc_debugfs_max_disc_trc - 1);
38963 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
38964 dtp = vport->disc_trc + i;
38965 @@ -219,7 +219,7 @@ lpfc_debugfs_slow_ring_trc_data(struct l
38966 lpfc_debugfs_enable = 0;
38967
38968 len = 0;
38969 - index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
38970 + index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
38971 (lpfc_debugfs_max_slow_ring_trc - 1);
38972 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
38973 dtp = phba->slow_ring_trc + i;
38974 @@ -397,6 +397,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpf
38975 uint32_t *ptr;
38976 char buffer[1024];
38977
38978 + pax_track_stack();
38979 +
38980 off = 0;
38981 spin_lock_irq(&phba->hbalock);
38982
38983 @@ -634,14 +636,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport
38984 !vport || !vport->disc_trc)
38985 return;
38986
38987 - index = atomic_inc_return(&vport->disc_trc_cnt) &
38988 + index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
38989 (lpfc_debugfs_max_disc_trc - 1);
38990 dtp = vport->disc_trc + index;
38991 dtp->fmt = fmt;
38992 dtp->data1 = data1;
38993 dtp->data2 = data2;
38994 dtp->data3 = data3;
38995 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
38996 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
38997 dtp->jif = jiffies;
38998 #endif
38999 return;
39000 @@ -672,14 +674,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_h
39001 !phba || !phba->slow_ring_trc)
39002 return;
39003
39004 - index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
39005 + index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
39006 (lpfc_debugfs_max_slow_ring_trc - 1);
39007 dtp = phba->slow_ring_trc + index;
39008 dtp->fmt = fmt;
39009 dtp->data1 = data1;
39010 dtp->data2 = data2;
39011 dtp->data3 = data3;
39012 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
39013 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
39014 dtp->jif = jiffies;
39015 #endif
39016 return;
39017 @@ -1364,7 +1366,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
39018 "slow_ring buffer\n");
39019 goto debug_failed;
39020 }
39021 - atomic_set(&phba->slow_ring_trc_cnt, 0);
39022 + atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
39023 memset(phba->slow_ring_trc, 0,
39024 (sizeof(struct lpfc_debugfs_trc) *
39025 lpfc_debugfs_max_slow_ring_trc));
39026 @@ -1410,7 +1412,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
39027 "buffer\n");
39028 goto debug_failed;
39029 }
39030 - atomic_set(&vport->disc_trc_cnt, 0);
39031 + atomic_set_unchecked(&vport->disc_trc_cnt, 0);
39032
39033 snprintf(name, sizeof(name), "discovery_trace");
39034 vport->debug_disc_trc =
39035 diff -urNp linux-2.6.32.49/drivers/scsi/lpfc/lpfc.h linux-2.6.32.49/drivers/scsi/lpfc/lpfc.h
39036 --- linux-2.6.32.49/drivers/scsi/lpfc/lpfc.h 2011-11-08 19:02:43.000000000 -0500
39037 +++ linux-2.6.32.49/drivers/scsi/lpfc/lpfc.h 2011-11-15 19:59:43.000000000 -0500
39038 @@ -400,7 +400,7 @@ struct lpfc_vport {
39039 struct dentry *debug_nodelist;
39040 struct dentry *vport_debugfs_root;
39041 struct lpfc_debugfs_trc *disc_trc;
39042 - atomic_t disc_trc_cnt;
39043 + atomic_unchecked_t disc_trc_cnt;
39044 #endif
39045 uint8_t stat_data_enabled;
39046 uint8_t stat_data_blocked;
39047 @@ -725,8 +725,8 @@ struct lpfc_hba {
39048 struct timer_list fabric_block_timer;
39049 unsigned long bit_flags;
39050 #define FABRIC_COMANDS_BLOCKED 0
39051 - atomic_t num_rsrc_err;
39052 - atomic_t num_cmd_success;
39053 + atomic_unchecked_t num_rsrc_err;
39054 + atomic_unchecked_t num_cmd_success;
39055 unsigned long last_rsrc_error_time;
39056 unsigned long last_ramp_down_time;
39057 unsigned long last_ramp_up_time;
39058 @@ -740,7 +740,7 @@ struct lpfc_hba {
39059 struct dentry *debug_dumpDif; /* BlockGuard BPL*/
39060 struct dentry *debug_slow_ring_trc;
39061 struct lpfc_debugfs_trc *slow_ring_trc;
39062 - atomic_t slow_ring_trc_cnt;
39063 + atomic_unchecked_t slow_ring_trc_cnt;
39064 #endif
39065
39066 /* Used for deferred freeing of ELS data buffers */
39067 diff -urNp linux-2.6.32.49/drivers/scsi/lpfc/lpfc_init.c linux-2.6.32.49/drivers/scsi/lpfc/lpfc_init.c
39068 --- linux-2.6.32.49/drivers/scsi/lpfc/lpfc_init.c 2011-11-08 19:02:43.000000000 -0500
39069 +++ linux-2.6.32.49/drivers/scsi/lpfc/lpfc_init.c 2011-11-15 19:59:43.000000000 -0500
39070 @@ -8021,8 +8021,10 @@ lpfc_init(void)
39071 printk(LPFC_COPYRIGHT "\n");
39072
39073 if (lpfc_enable_npiv) {
39074 - lpfc_transport_functions.vport_create = lpfc_vport_create;
39075 - lpfc_transport_functions.vport_delete = lpfc_vport_delete;
39076 + pax_open_kernel();
39077 + *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
39078 + *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
39079 + pax_close_kernel();
39080 }
39081 lpfc_transport_template =
39082 fc_attach_transport(&lpfc_transport_functions);
39083 diff -urNp linux-2.6.32.49/drivers/scsi/lpfc/lpfc_scsi.c linux-2.6.32.49/drivers/scsi/lpfc/lpfc_scsi.c
39084 --- linux-2.6.32.49/drivers/scsi/lpfc/lpfc_scsi.c 2011-11-08 19:02:43.000000000 -0500
39085 +++ linux-2.6.32.49/drivers/scsi/lpfc/lpfc_scsi.c 2011-11-15 19:59:43.000000000 -0500
39086 @@ -259,7 +259,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hb
39087 uint32_t evt_posted;
39088
39089 spin_lock_irqsave(&phba->hbalock, flags);
39090 - atomic_inc(&phba->num_rsrc_err);
39091 + atomic_inc_unchecked(&phba->num_rsrc_err);
39092 phba->last_rsrc_error_time = jiffies;
39093
39094 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
39095 @@ -300,7 +300,7 @@ lpfc_rampup_queue_depth(struct lpfc_vpor
39096 unsigned long flags;
39097 struct lpfc_hba *phba = vport->phba;
39098 uint32_t evt_posted;
39099 - atomic_inc(&phba->num_cmd_success);
39100 + atomic_inc_unchecked(&phba->num_cmd_success);
39101
39102 if (vport->cfg_lun_queue_depth <= queue_depth)
39103 return;
39104 @@ -343,8 +343,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
39105 int i;
39106 struct lpfc_rport_data *rdata;
39107
39108 - num_rsrc_err = atomic_read(&phba->num_rsrc_err);
39109 - num_cmd_success = atomic_read(&phba->num_cmd_success);
39110 + num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
39111 + num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
39112
39113 vports = lpfc_create_vport_work_array(phba);
39114 if (vports != NULL)
39115 @@ -378,8 +378,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
39116 }
39117 }
39118 lpfc_destroy_vport_work_array(phba, vports);
39119 - atomic_set(&phba->num_rsrc_err, 0);
39120 - atomic_set(&phba->num_cmd_success, 0);
39121 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
39122 + atomic_set_unchecked(&phba->num_cmd_success, 0);
39123 }
39124
39125 /**
39126 @@ -427,8 +427,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_h
39127 }
39128 }
39129 lpfc_destroy_vport_work_array(phba, vports);
39130 - atomic_set(&phba->num_rsrc_err, 0);
39131 - atomic_set(&phba->num_cmd_success, 0);
39132 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
39133 + atomic_set_unchecked(&phba->num_cmd_success, 0);
39134 }
39135
39136 /**
39137 diff -urNp linux-2.6.32.49/drivers/scsi/megaraid/megaraid_mbox.c linux-2.6.32.49/drivers/scsi/megaraid/megaraid_mbox.c
39138 --- linux-2.6.32.49/drivers/scsi/megaraid/megaraid_mbox.c 2011-11-08 19:02:43.000000000 -0500
39139 +++ linux-2.6.32.49/drivers/scsi/megaraid/megaraid_mbox.c 2011-11-15 19:59:43.000000000 -0500
39140 @@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter
39141 int rval;
39142 int i;
39143
39144 + pax_track_stack();
39145 +
39146 // Allocate memory for the base list of scb for management module.
39147 adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
39148
39149 diff -urNp linux-2.6.32.49/drivers/scsi/osd/osd_initiator.c linux-2.6.32.49/drivers/scsi/osd/osd_initiator.c
39150 --- linux-2.6.32.49/drivers/scsi/osd/osd_initiator.c 2011-11-08 19:02:43.000000000 -0500
39151 +++ linux-2.6.32.49/drivers/scsi/osd/osd_initiator.c 2011-11-15 19:59:43.000000000 -0500
39152 @@ -94,6 +94,8 @@ static int _osd_print_system_info(struct
39153 int nelem = ARRAY_SIZE(get_attrs), a = 0;
39154 int ret;
39155
39156 + pax_track_stack();
39157 +
39158 or = osd_start_request(od, GFP_KERNEL);
39159 if (!or)
39160 return -ENOMEM;
39161 diff -urNp linux-2.6.32.49/drivers/scsi/pmcraid.c linux-2.6.32.49/drivers/scsi/pmcraid.c
39162 --- linux-2.6.32.49/drivers/scsi/pmcraid.c 2011-11-08 19:02:43.000000000 -0500
39163 +++ linux-2.6.32.49/drivers/scsi/pmcraid.c 2011-11-15 19:59:43.000000000 -0500
39164 @@ -189,8 +189,8 @@ static int pmcraid_slave_alloc(struct sc
39165 res->scsi_dev = scsi_dev;
39166 scsi_dev->hostdata = res;
39167 res->change_detected = 0;
39168 - atomic_set(&res->read_failures, 0);
39169 - atomic_set(&res->write_failures, 0);
39170 + atomic_set_unchecked(&res->read_failures, 0);
39171 + atomic_set_unchecked(&res->write_failures, 0);
39172 rc = 0;
39173 }
39174 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
39175 @@ -2396,9 +2396,9 @@ static int pmcraid_error_handler(struct
39176
39177 /* If this was a SCSI read/write command keep count of errors */
39178 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
39179 - atomic_inc(&res->read_failures);
39180 + atomic_inc_unchecked(&res->read_failures);
39181 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
39182 - atomic_inc(&res->write_failures);
39183 + atomic_inc_unchecked(&res->write_failures);
39184
39185 if (!RES_IS_GSCSI(res->cfg_entry) &&
39186 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
39187 @@ -4116,7 +4116,7 @@ static void pmcraid_worker_function(stru
39188
39189 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
39190 /* add resources only after host is added into system */
39191 - if (!atomic_read(&pinstance->expose_resources))
39192 + if (!atomic_read_unchecked(&pinstance->expose_resources))
39193 return;
39194
39195 spin_lock_irqsave(&pinstance->resource_lock, lock_flags);
39196 @@ -4850,7 +4850,7 @@ static int __devinit pmcraid_init_instan
39197 init_waitqueue_head(&pinstance->reset_wait_q);
39198
39199 atomic_set(&pinstance->outstanding_cmds, 0);
39200 - atomic_set(&pinstance->expose_resources, 0);
39201 + atomic_set_unchecked(&pinstance->expose_resources, 0);
39202
39203 INIT_LIST_HEAD(&pinstance->free_res_q);
39204 INIT_LIST_HEAD(&pinstance->used_res_q);
39205 @@ -5502,7 +5502,7 @@ static int __devinit pmcraid_probe(
39206 /* Schedule worker thread to handle CCN and take care of adding and
39207 * removing devices to OS
39208 */
39209 - atomic_set(&pinstance->expose_resources, 1);
39210 + atomic_set_unchecked(&pinstance->expose_resources, 1);
39211 schedule_work(&pinstance->worker_q);
39212 return rc;
39213
39214 diff -urNp linux-2.6.32.49/drivers/scsi/pmcraid.h linux-2.6.32.49/drivers/scsi/pmcraid.h
39215 --- linux-2.6.32.49/drivers/scsi/pmcraid.h 2011-11-08 19:02:43.000000000 -0500
39216 +++ linux-2.6.32.49/drivers/scsi/pmcraid.h 2011-11-15 19:59:43.000000000 -0500
39217 @@ -690,7 +690,7 @@ struct pmcraid_instance {
39218 atomic_t outstanding_cmds;
39219
39220 /* should add/delete resources to mid-layer now ?*/
39221 - atomic_t expose_resources;
39222 + atomic_unchecked_t expose_resources;
39223
39224 /* Tasklet to handle deferred processing */
39225 struct tasklet_struct isr_tasklet[PMCRAID_NUM_MSIX_VECTORS];
39226 @@ -727,8 +727,8 @@ struct pmcraid_resource_entry {
39227 struct list_head queue; /* link to "to be exposed" resources */
39228 struct pmcraid_config_table_entry cfg_entry;
39229 struct scsi_device *scsi_dev; /* Link scsi_device structure */
39230 - atomic_t read_failures; /* count of failed READ commands */
39231 - atomic_t write_failures; /* count of failed WRITE commands */
39232 + atomic_unchecked_t read_failures; /* count of failed READ commands */
39233 + atomic_unchecked_t write_failures; /* count of failed WRITE commands */
39234
39235 /* To indicate add/delete/modify during CCN */
39236 u8 change_detected;
39237 diff -urNp linux-2.6.32.49/drivers/scsi/qla2xxx/qla_def.h linux-2.6.32.49/drivers/scsi/qla2xxx/qla_def.h
39238 --- linux-2.6.32.49/drivers/scsi/qla2xxx/qla_def.h 2011-11-08 19:02:43.000000000 -0500
39239 +++ linux-2.6.32.49/drivers/scsi/qla2xxx/qla_def.h 2011-11-15 19:59:43.000000000 -0500
39240 @@ -2089,7 +2089,7 @@ struct isp_operations {
39241
39242 int (*get_flash_version) (struct scsi_qla_host *, void *);
39243 int (*start_scsi) (srb_t *);
39244 -};
39245 +} __no_const;
39246
39247 /* MSI-X Support *************************************************************/
39248
39249 diff -urNp linux-2.6.32.49/drivers/scsi/qla4xxx/ql4_def.h linux-2.6.32.49/drivers/scsi/qla4xxx/ql4_def.h
39250 --- linux-2.6.32.49/drivers/scsi/qla4xxx/ql4_def.h 2011-11-08 19:02:43.000000000 -0500
39251 +++ linux-2.6.32.49/drivers/scsi/qla4xxx/ql4_def.h 2011-11-15 19:59:43.000000000 -0500
39252 @@ -240,7 +240,7 @@ struct ddb_entry {
39253 atomic_t retry_relogin_timer; /* Min Time between relogins
39254 * (4000 only) */
39255 atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
39256 - atomic_t relogin_retry_count; /* Num of times relogin has been
39257 + atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
39258 * retried */
39259
39260 uint16_t port;
39261 diff -urNp linux-2.6.32.49/drivers/scsi/qla4xxx/ql4_init.c linux-2.6.32.49/drivers/scsi/qla4xxx/ql4_init.c
39262 --- linux-2.6.32.49/drivers/scsi/qla4xxx/ql4_init.c 2011-11-08 19:02:43.000000000 -0500
39263 +++ linux-2.6.32.49/drivers/scsi/qla4xxx/ql4_init.c 2011-11-15 19:59:43.000000000 -0500
39264 @@ -482,7 +482,7 @@ static struct ddb_entry * qla4xxx_alloc_
39265 atomic_set(&ddb_entry->port_down_timer, ha->port_down_retry_count);
39266 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
39267 atomic_set(&ddb_entry->relogin_timer, 0);
39268 - atomic_set(&ddb_entry->relogin_retry_count, 0);
39269 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
39270 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
39271 list_add_tail(&ddb_entry->list, &ha->ddb_list);
39272 ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
39273 @@ -1308,7 +1308,7 @@ int qla4xxx_process_ddb_changed(struct s
39274 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
39275 atomic_set(&ddb_entry->port_down_timer,
39276 ha->port_down_retry_count);
39277 - atomic_set(&ddb_entry->relogin_retry_count, 0);
39278 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
39279 atomic_set(&ddb_entry->relogin_timer, 0);
39280 clear_bit(DF_RELOGIN, &ddb_entry->flags);
39281 clear_bit(DF_NO_RELOGIN, &ddb_entry->flags);
39282 diff -urNp linux-2.6.32.49/drivers/scsi/qla4xxx/ql4_os.c linux-2.6.32.49/drivers/scsi/qla4xxx/ql4_os.c
39283 --- linux-2.6.32.49/drivers/scsi/qla4xxx/ql4_os.c 2011-11-08 19:02:43.000000000 -0500
39284 +++ linux-2.6.32.49/drivers/scsi/qla4xxx/ql4_os.c 2011-11-15 19:59:43.000000000 -0500
39285 @@ -641,13 +641,13 @@ static void qla4xxx_timer(struct scsi_ql
39286 ddb_entry->fw_ddb_device_state ==
39287 DDB_DS_SESSION_FAILED) {
39288 /* Reset retry relogin timer */
39289 - atomic_inc(&ddb_entry->relogin_retry_count);
39290 + atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
39291 DEBUG2(printk("scsi%ld: index[%d] relogin"
39292 " timed out-retrying"
39293 " relogin (%d)\n",
39294 ha->host_no,
39295 ddb_entry->fw_ddb_index,
39296 - atomic_read(&ddb_entry->
39297 + atomic_read_unchecked(&ddb_entry->
39298 relogin_retry_count))
39299 );
39300 start_dpc++;
39301 diff -urNp linux-2.6.32.49/drivers/scsi/scsi.c linux-2.6.32.49/drivers/scsi/scsi.c
39302 --- linux-2.6.32.49/drivers/scsi/scsi.c 2011-11-08 19:02:43.000000000 -0500
39303 +++ linux-2.6.32.49/drivers/scsi/scsi.c 2011-11-15 19:59:43.000000000 -0500
39304 @@ -652,7 +652,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *
39305 unsigned long timeout;
39306 int rtn = 0;
39307
39308 - atomic_inc(&cmd->device->iorequest_cnt);
39309 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
39310
39311 /* check if the device is still usable */
39312 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
39313 diff -urNp linux-2.6.32.49/drivers/scsi/scsi_debug.c linux-2.6.32.49/drivers/scsi/scsi_debug.c
39314 --- linux-2.6.32.49/drivers/scsi/scsi_debug.c 2011-11-08 19:02:43.000000000 -0500
39315 +++ linux-2.6.32.49/drivers/scsi/scsi_debug.c 2011-11-15 19:59:43.000000000 -0500
39316 @@ -1395,6 +1395,8 @@ static int resp_mode_select(struct scsi_
39317 unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
39318 unsigned char *cmd = (unsigned char *)scp->cmnd;
39319
39320 + pax_track_stack();
39321 +
39322 if ((errsts = check_readiness(scp, 1, devip)))
39323 return errsts;
39324 memset(arr, 0, sizeof(arr));
39325 @@ -1492,6 +1494,8 @@ static int resp_log_sense(struct scsi_cm
39326 unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
39327 unsigned char *cmd = (unsigned char *)scp->cmnd;
39328
39329 + pax_track_stack();
39330 +
39331 if ((errsts = check_readiness(scp, 1, devip)))
39332 return errsts;
39333 memset(arr, 0, sizeof(arr));
39334 diff -urNp linux-2.6.32.49/drivers/scsi/scsi_lib.c linux-2.6.32.49/drivers/scsi/scsi_lib.c
39335 --- linux-2.6.32.49/drivers/scsi/scsi_lib.c 2011-11-26 19:44:53.000000000 -0500
39336 +++ linux-2.6.32.49/drivers/scsi/scsi_lib.c 2011-11-26 19:45:06.000000000 -0500
39337 @@ -1384,7 +1384,7 @@ static void scsi_kill_request(struct req
39338
39339 scsi_init_cmd_errh(cmd);
39340 cmd->result = DID_NO_CONNECT << 16;
39341 - atomic_inc(&cmd->device->iorequest_cnt);
39342 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
39343
39344 /*
39345 * SCSI request completion path will do scsi_device_unbusy(),
39346 @@ -1415,9 +1415,9 @@ static void scsi_softirq_done(struct req
39347 */
39348 cmd->serial_number = 0;
39349
39350 - atomic_inc(&cmd->device->iodone_cnt);
39351 + atomic_inc_unchecked(&cmd->device->iodone_cnt);
39352 if (cmd->result)
39353 - atomic_inc(&cmd->device->ioerr_cnt);
39354 + atomic_inc_unchecked(&cmd->device->ioerr_cnt);
39355
39356 disposition = scsi_decide_disposition(cmd);
39357 if (disposition != SUCCESS &&
39358 diff -urNp linux-2.6.32.49/drivers/scsi/scsi_sysfs.c linux-2.6.32.49/drivers/scsi/scsi_sysfs.c
39359 --- linux-2.6.32.49/drivers/scsi/scsi_sysfs.c 2011-11-08 19:02:43.000000000 -0500
39360 +++ linux-2.6.32.49/drivers/scsi/scsi_sysfs.c 2011-11-15 19:59:43.000000000 -0500
39361 @@ -662,7 +662,7 @@ show_iostat_##field(struct device *dev,
39362 char *buf) \
39363 { \
39364 struct scsi_device *sdev = to_scsi_device(dev); \
39365 - unsigned long long count = atomic_read(&sdev->field); \
39366 + unsigned long long count = atomic_read_unchecked(&sdev->field); \
39367 return snprintf(buf, 20, "0x%llx\n", count); \
39368 } \
39369 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
39370 diff -urNp linux-2.6.32.49/drivers/scsi/scsi_tgt_lib.c linux-2.6.32.49/drivers/scsi/scsi_tgt_lib.c
39371 --- linux-2.6.32.49/drivers/scsi/scsi_tgt_lib.c 2011-11-08 19:02:43.000000000 -0500
39372 +++ linux-2.6.32.49/drivers/scsi/scsi_tgt_lib.c 2011-11-15 19:59:43.000000000 -0500
39373 @@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct sc
39374 int err;
39375
39376 dprintk("%lx %u\n", uaddr, len);
39377 - err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
39378 + err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL);
39379 if (err) {
39380 /*
39381 * TODO: need to fixup sg_tablesize, max_segment_size,
39382 diff -urNp linux-2.6.32.49/drivers/scsi/scsi_transport_fc.c linux-2.6.32.49/drivers/scsi/scsi_transport_fc.c
39383 --- linux-2.6.32.49/drivers/scsi/scsi_transport_fc.c 2011-11-08 19:02:43.000000000 -0500
39384 +++ linux-2.6.32.49/drivers/scsi/scsi_transport_fc.c 2011-11-15 19:59:43.000000000 -0500
39385 @@ -480,7 +480,7 @@ MODULE_PARM_DESC(dev_loss_tmo,
39386 * Netlink Infrastructure
39387 */
39388
39389 -static atomic_t fc_event_seq;
39390 +static atomic_unchecked_t fc_event_seq;
39391
39392 /**
39393 * fc_get_event_number - Obtain the next sequential FC event number
39394 @@ -493,7 +493,7 @@ static atomic_t fc_event_seq;
39395 u32
39396 fc_get_event_number(void)
39397 {
39398 - return atomic_add_return(1, &fc_event_seq);
39399 + return atomic_add_return_unchecked(1, &fc_event_seq);
39400 }
39401 EXPORT_SYMBOL(fc_get_event_number);
39402
39403 @@ -641,7 +641,7 @@ static __init int fc_transport_init(void
39404 {
39405 int error;
39406
39407 - atomic_set(&fc_event_seq, 0);
39408 + atomic_set_unchecked(&fc_event_seq, 0);
39409
39410 error = transport_class_register(&fc_host_class);
39411 if (error)
39412 diff -urNp linux-2.6.32.49/drivers/scsi/scsi_transport_iscsi.c linux-2.6.32.49/drivers/scsi/scsi_transport_iscsi.c
39413 --- linux-2.6.32.49/drivers/scsi/scsi_transport_iscsi.c 2011-11-08 19:02:43.000000000 -0500
39414 +++ linux-2.6.32.49/drivers/scsi/scsi_transport_iscsi.c 2011-11-15 19:59:43.000000000 -0500
39415 @@ -81,7 +81,7 @@ struct iscsi_internal {
39416 struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
39417 };
39418
39419 -static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
39420 +static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
39421 static struct workqueue_struct *iscsi_eh_timer_workq;
39422
39423 /*
39424 @@ -728,7 +728,7 @@ int iscsi_add_session(struct iscsi_cls_s
39425 int err;
39426
39427 ihost = shost->shost_data;
39428 - session->sid = atomic_add_return(1, &iscsi_session_nr);
39429 + session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
39430
39431 if (id == ISCSI_MAX_TARGET) {
39432 for (id = 0; id < ISCSI_MAX_TARGET; id++) {
39433 @@ -2060,7 +2060,7 @@ static __init int iscsi_transport_init(v
39434 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
39435 ISCSI_TRANSPORT_VERSION);
39436
39437 - atomic_set(&iscsi_session_nr, 0);
39438 + atomic_set_unchecked(&iscsi_session_nr, 0);
39439
39440 err = class_register(&iscsi_transport_class);
39441 if (err)
39442 diff -urNp linux-2.6.32.49/drivers/scsi/scsi_transport_srp.c linux-2.6.32.49/drivers/scsi/scsi_transport_srp.c
39443 --- linux-2.6.32.49/drivers/scsi/scsi_transport_srp.c 2011-11-08 19:02:43.000000000 -0500
39444 +++ linux-2.6.32.49/drivers/scsi/scsi_transport_srp.c 2011-11-15 19:59:43.000000000 -0500
39445 @@ -33,7 +33,7 @@
39446 #include "scsi_transport_srp_internal.h"
39447
39448 struct srp_host_attrs {
39449 - atomic_t next_port_id;
39450 + atomic_unchecked_t next_port_id;
39451 };
39452 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
39453
39454 @@ -62,7 +62,7 @@ static int srp_host_setup(struct transpo
39455 struct Scsi_Host *shost = dev_to_shost(dev);
39456 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
39457
39458 - atomic_set(&srp_host->next_port_id, 0);
39459 + atomic_set_unchecked(&srp_host->next_port_id, 0);
39460 return 0;
39461 }
39462
39463 @@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct S
39464 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
39465 rport->roles = ids->roles;
39466
39467 - id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
39468 + id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
39469 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
39470
39471 transport_setup_device(&rport->dev);
39472 diff -urNp linux-2.6.32.49/drivers/scsi/sg.c linux-2.6.32.49/drivers/scsi/sg.c
39473 --- linux-2.6.32.49/drivers/scsi/sg.c 2011-11-08 19:02:43.000000000 -0500
39474 +++ linux-2.6.32.49/drivers/scsi/sg.c 2011-11-15 19:59:43.000000000 -0500
39475 @@ -1064,7 +1064,7 @@ sg_ioctl(struct inode *inode, struct fil
39476 sdp->disk->disk_name,
39477 MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
39478 NULL,
39479 - (char *)arg);
39480 + (char __user *)arg);
39481 case BLKTRACESTART:
39482 return blk_trace_startstop(sdp->device->request_queue, 1);
39483 case BLKTRACESTOP:
39484 @@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
39485 const struct file_operations * fops;
39486 };
39487
39488 -static struct sg_proc_leaf sg_proc_leaf_arr[] = {
39489 +static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
39490 {"allow_dio", &adio_fops},
39491 {"debug", &debug_fops},
39492 {"def_reserved_size", &dressz_fops},
39493 @@ -2307,7 +2307,7 @@ sg_proc_init(void)
39494 {
39495 int k, mask;
39496 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
39497 - struct sg_proc_leaf * leaf;
39498 + const struct sg_proc_leaf * leaf;
39499
39500 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
39501 if (!sg_proc_sgp)
39502 diff -urNp linux-2.6.32.49/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.32.49/drivers/scsi/sym53c8xx_2/sym_glue.c
39503 --- linux-2.6.32.49/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-11-08 19:02:43.000000000 -0500
39504 +++ linux-2.6.32.49/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-11-15 19:59:43.000000000 -0500
39505 @@ -1754,6 +1754,8 @@ static int __devinit sym2_probe(struct p
39506 int do_iounmap = 0;
39507 int do_disable_device = 1;
39508
39509 + pax_track_stack();
39510 +
39511 memset(&sym_dev, 0, sizeof(sym_dev));
39512 memset(&nvram, 0, sizeof(nvram));
39513 sym_dev.pdev = pdev;
39514 diff -urNp linux-2.6.32.49/drivers/serial/kgdboc.c linux-2.6.32.49/drivers/serial/kgdboc.c
39515 --- linux-2.6.32.49/drivers/serial/kgdboc.c 2011-11-08 19:02:43.000000000 -0500
39516 +++ linux-2.6.32.49/drivers/serial/kgdboc.c 2011-11-15 19:59:43.000000000 -0500
39517 @@ -18,7 +18,7 @@
39518
39519 #define MAX_CONFIG_LEN 40
39520
39521 -static struct kgdb_io kgdboc_io_ops;
39522 +static const struct kgdb_io kgdboc_io_ops;
39523
39524 /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
39525 static int configured = -1;
39526 @@ -154,7 +154,7 @@ static void kgdboc_post_exp_handler(void
39527 module_put(THIS_MODULE);
39528 }
39529
39530 -static struct kgdb_io kgdboc_io_ops = {
39531 +static const struct kgdb_io kgdboc_io_ops = {
39532 .name = "kgdboc",
39533 .read_char = kgdboc_get_char,
39534 .write_char = kgdboc_put_char,
39535 diff -urNp linux-2.6.32.49/drivers/spi/spi.c linux-2.6.32.49/drivers/spi/spi.c
39536 --- linux-2.6.32.49/drivers/spi/spi.c 2011-11-08 19:02:43.000000000 -0500
39537 +++ linux-2.6.32.49/drivers/spi/spi.c 2011-11-15 19:59:43.000000000 -0500
39538 @@ -774,7 +774,7 @@ int spi_sync(struct spi_device *spi, str
39539 EXPORT_SYMBOL_GPL(spi_sync);
39540
39541 /* portable code must never pass more than 32 bytes */
39542 -#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
39543 +#define SPI_BUFSIZ max(32U,SMP_CACHE_BYTES)
39544
39545 static u8 *buf;
39546
39547 diff -urNp linux-2.6.32.49/drivers/staging/android/binder.c linux-2.6.32.49/drivers/staging/android/binder.c
39548 --- linux-2.6.32.49/drivers/staging/android/binder.c 2011-11-08 19:02:43.000000000 -0500
39549 +++ linux-2.6.32.49/drivers/staging/android/binder.c 2011-11-15 19:59:43.000000000 -0500
39550 @@ -2756,7 +2756,7 @@ static void binder_vma_close(struct vm_a
39551 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
39552 }
39553
39554 -static struct vm_operations_struct binder_vm_ops = {
39555 +static const struct vm_operations_struct binder_vm_ops = {
39556 .open = binder_vma_open,
39557 .close = binder_vma_close,
39558 };
39559 diff -urNp linux-2.6.32.49/drivers/staging/b3dfg/b3dfg.c linux-2.6.32.49/drivers/staging/b3dfg/b3dfg.c
39560 --- linux-2.6.32.49/drivers/staging/b3dfg/b3dfg.c 2011-11-08 19:02:43.000000000 -0500
39561 +++ linux-2.6.32.49/drivers/staging/b3dfg/b3dfg.c 2011-11-15 19:59:43.000000000 -0500
39562 @@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_are
39563 return VM_FAULT_NOPAGE;
39564 }
39565
39566 -static struct vm_operations_struct b3dfg_vm_ops = {
39567 +static const struct vm_operations_struct b3dfg_vm_ops = {
39568 .fault = b3dfg_vma_fault,
39569 };
39570
39571 @@ -848,7 +848,7 @@ static int b3dfg_mmap(struct file *filp,
39572 return r;
39573 }
39574
39575 -static struct file_operations b3dfg_fops = {
39576 +static const struct file_operations b3dfg_fops = {
39577 .owner = THIS_MODULE,
39578 .open = b3dfg_open,
39579 .release = b3dfg_release,
39580 diff -urNp linux-2.6.32.49/drivers/staging/comedi/comedi_fops.c linux-2.6.32.49/drivers/staging/comedi/comedi_fops.c
39581 --- linux-2.6.32.49/drivers/staging/comedi/comedi_fops.c 2011-11-08 19:02:43.000000000 -0500
39582 +++ linux-2.6.32.49/drivers/staging/comedi/comedi_fops.c 2011-11-15 19:59:43.000000000 -0500
39583 @@ -1389,7 +1389,7 @@ void comedi_unmap(struct vm_area_struct
39584 mutex_unlock(&dev->mutex);
39585 }
39586
39587 -static struct vm_operations_struct comedi_vm_ops = {
39588 +static const struct vm_operations_struct comedi_vm_ops = {
39589 .close = comedi_unmap,
39590 };
39591
39592 diff -urNp linux-2.6.32.49/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.32.49/drivers/staging/dream/qdsp5/adsp_driver.c
39593 --- linux-2.6.32.49/drivers/staging/dream/qdsp5/adsp_driver.c 2011-11-08 19:02:43.000000000 -0500
39594 +++ linux-2.6.32.49/drivers/staging/dream/qdsp5/adsp_driver.c 2011-11-15 19:59:43.000000000 -0500
39595 @@ -576,7 +576,7 @@ static struct adsp_device *inode_to_devi
39596 static dev_t adsp_devno;
39597 static struct class *adsp_class;
39598
39599 -static struct file_operations adsp_fops = {
39600 +static const struct file_operations adsp_fops = {
39601 .owner = THIS_MODULE,
39602 .open = adsp_open,
39603 .unlocked_ioctl = adsp_ioctl,
39604 diff -urNp linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_aac.c
39605 --- linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_aac.c 2011-11-08 19:02:43.000000000 -0500
39606 +++ linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_aac.c 2011-11-15 19:59:43.000000000 -0500
39607 @@ -1022,7 +1022,7 @@ done:
39608 return rc;
39609 }
39610
39611 -static struct file_operations audio_aac_fops = {
39612 +static const struct file_operations audio_aac_fops = {
39613 .owner = THIS_MODULE,
39614 .open = audio_open,
39615 .release = audio_release,
39616 diff -urNp linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_amrnb.c
39617 --- linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_amrnb.c 2011-11-08 19:02:43.000000000 -0500
39618 +++ linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_amrnb.c 2011-11-15 19:59:43.000000000 -0500
39619 @@ -833,7 +833,7 @@ done:
39620 return rc;
39621 }
39622
39623 -static struct file_operations audio_amrnb_fops = {
39624 +static const struct file_operations audio_amrnb_fops = {
39625 .owner = THIS_MODULE,
39626 .open = audamrnb_open,
39627 .release = audamrnb_release,
39628 diff -urNp linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_evrc.c
39629 --- linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_evrc.c 2011-11-08 19:02:43.000000000 -0500
39630 +++ linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_evrc.c 2011-11-15 19:59:43.000000000 -0500
39631 @@ -805,7 +805,7 @@ dma_fail:
39632 return rc;
39633 }
39634
39635 -static struct file_operations audio_evrc_fops = {
39636 +static const struct file_operations audio_evrc_fops = {
39637 .owner = THIS_MODULE,
39638 .open = audevrc_open,
39639 .release = audevrc_release,
39640 diff -urNp linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_in.c
39641 --- linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_in.c 2011-11-08 19:02:43.000000000 -0500
39642 +++ linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_in.c 2011-11-15 19:59:43.000000000 -0500
39643 @@ -913,7 +913,7 @@ static int audpre_open(struct inode *ino
39644 return 0;
39645 }
39646
39647 -static struct file_operations audio_fops = {
39648 +static const struct file_operations audio_fops = {
39649 .owner = THIS_MODULE,
39650 .open = audio_in_open,
39651 .release = audio_in_release,
39652 @@ -922,7 +922,7 @@ static struct file_operations audio_fops
39653 .unlocked_ioctl = audio_in_ioctl,
39654 };
39655
39656 -static struct file_operations audpre_fops = {
39657 +static const struct file_operations audpre_fops = {
39658 .owner = THIS_MODULE,
39659 .open = audpre_open,
39660 .unlocked_ioctl = audpre_ioctl,
39661 diff -urNp linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_mp3.c
39662 --- linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_mp3.c 2011-11-08 19:02:43.000000000 -0500
39663 +++ linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_mp3.c 2011-11-15 19:59:43.000000000 -0500
39664 @@ -941,7 +941,7 @@ done:
39665 return rc;
39666 }
39667
39668 -static struct file_operations audio_mp3_fops = {
39669 +static const struct file_operations audio_mp3_fops = {
39670 .owner = THIS_MODULE,
39671 .open = audio_open,
39672 .release = audio_release,
39673 diff -urNp linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_out.c
39674 --- linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_out.c 2011-11-08 19:02:43.000000000 -0500
39675 +++ linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_out.c 2011-11-15 19:59:43.000000000 -0500
39676 @@ -810,7 +810,7 @@ static int audpp_open(struct inode *inod
39677 return 0;
39678 }
39679
39680 -static struct file_operations audio_fops = {
39681 +static const struct file_operations audio_fops = {
39682 .owner = THIS_MODULE,
39683 .open = audio_open,
39684 .release = audio_release,
39685 @@ -819,7 +819,7 @@ static struct file_operations audio_fops
39686 .unlocked_ioctl = audio_ioctl,
39687 };
39688
39689 -static struct file_operations audpp_fops = {
39690 +static const struct file_operations audpp_fops = {
39691 .owner = THIS_MODULE,
39692 .open = audpp_open,
39693 .unlocked_ioctl = audpp_ioctl,
39694 diff -urNp linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_qcelp.c
39695 --- linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_qcelp.c 2011-11-08 19:02:43.000000000 -0500
39696 +++ linux-2.6.32.49/drivers/staging/dream/qdsp5/audio_qcelp.c 2011-11-15 19:59:43.000000000 -0500
39697 @@ -816,7 +816,7 @@ err:
39698 return rc;
39699 }
39700
39701 -static struct file_operations audio_qcelp_fops = {
39702 +static const struct file_operations audio_qcelp_fops = {
39703 .owner = THIS_MODULE,
39704 .open = audqcelp_open,
39705 .release = audqcelp_release,
39706 diff -urNp linux-2.6.32.49/drivers/staging/dream/qdsp5/snd.c linux-2.6.32.49/drivers/staging/dream/qdsp5/snd.c
39707 --- linux-2.6.32.49/drivers/staging/dream/qdsp5/snd.c 2011-11-08 19:02:43.000000000 -0500
39708 +++ linux-2.6.32.49/drivers/staging/dream/qdsp5/snd.c 2011-11-15 19:59:43.000000000 -0500
39709 @@ -242,7 +242,7 @@ err:
39710 return rc;
39711 }
39712
39713 -static struct file_operations snd_fops = {
39714 +static const struct file_operations snd_fops = {
39715 .owner = THIS_MODULE,
39716 .open = snd_open,
39717 .release = snd_release,
39718 diff -urNp linux-2.6.32.49/drivers/staging/dream/smd/smd_qmi.c linux-2.6.32.49/drivers/staging/dream/smd/smd_qmi.c
39719 --- linux-2.6.32.49/drivers/staging/dream/smd/smd_qmi.c 2011-11-08 19:02:43.000000000 -0500
39720 +++ linux-2.6.32.49/drivers/staging/dream/smd/smd_qmi.c 2011-11-15 19:59:43.000000000 -0500
39721 @@ -793,7 +793,7 @@ static int qmi_release(struct inode *ip,
39722 return 0;
39723 }
39724
39725 -static struct file_operations qmi_fops = {
39726 +static const struct file_operations qmi_fops = {
39727 .owner = THIS_MODULE,
39728 .read = qmi_read,
39729 .write = qmi_write,
39730 diff -urNp linux-2.6.32.49/drivers/staging/dream/smd/smd_rpcrouter_device.c linux-2.6.32.49/drivers/staging/dream/smd/smd_rpcrouter_device.c
39731 --- linux-2.6.32.49/drivers/staging/dream/smd/smd_rpcrouter_device.c 2011-11-08 19:02:43.000000000 -0500
39732 +++ linux-2.6.32.49/drivers/staging/dream/smd/smd_rpcrouter_device.c 2011-11-15 19:59:43.000000000 -0500
39733 @@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file
39734 return rc;
39735 }
39736
39737 -static struct file_operations rpcrouter_server_fops = {
39738 +static const struct file_operations rpcrouter_server_fops = {
39739 .owner = THIS_MODULE,
39740 .open = rpcrouter_open,
39741 .release = rpcrouter_release,
39742 @@ -224,7 +224,7 @@ static struct file_operations rpcrouter_
39743 .unlocked_ioctl = rpcrouter_ioctl,
39744 };
39745
39746 -static struct file_operations rpcrouter_router_fops = {
39747 +static const struct file_operations rpcrouter_router_fops = {
39748 .owner = THIS_MODULE,
39749 .open = rpcrouter_open,
39750 .release = rpcrouter_release,
39751 diff -urNp linux-2.6.32.49/drivers/staging/dst/dcore.c linux-2.6.32.49/drivers/staging/dst/dcore.c
39752 --- linux-2.6.32.49/drivers/staging/dst/dcore.c 2011-11-08 19:02:43.000000000 -0500
39753 +++ linux-2.6.32.49/drivers/staging/dst/dcore.c 2011-11-15 19:59:43.000000000 -0500
39754 @@ -149,7 +149,7 @@ static int dst_bdev_release(struct gendi
39755 return 0;
39756 }
39757
39758 -static struct block_device_operations dst_blk_ops = {
39759 +static const struct block_device_operations dst_blk_ops = {
39760 .open = dst_bdev_open,
39761 .release = dst_bdev_release,
39762 .owner = THIS_MODULE,
39763 @@ -588,7 +588,7 @@ static struct dst_node *dst_alloc_node(s
39764 n->size = ctl->size;
39765
39766 atomic_set(&n->refcnt, 1);
39767 - atomic_long_set(&n->gen, 0);
39768 + atomic_long_set_unchecked(&n->gen, 0);
39769 snprintf(n->name, sizeof(n->name), "%s", ctl->name);
39770
39771 err = dst_node_sysfs_init(n);
39772 diff -urNp linux-2.6.32.49/drivers/staging/dst/trans.c linux-2.6.32.49/drivers/staging/dst/trans.c
39773 --- linux-2.6.32.49/drivers/staging/dst/trans.c 2011-11-08 19:02:43.000000000 -0500
39774 +++ linux-2.6.32.49/drivers/staging/dst/trans.c 2011-11-15 19:59:43.000000000 -0500
39775 @@ -169,7 +169,7 @@ int dst_process_bio(struct dst_node *n,
39776 t->error = 0;
39777 t->retries = 0;
39778 atomic_set(&t->refcnt, 1);
39779 - t->gen = atomic_long_inc_return(&n->gen);
39780 + t->gen = atomic_long_inc_return_unchecked(&n->gen);
39781
39782 t->enc = bio_data_dir(bio);
39783 dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
39784 diff -urNp linux-2.6.32.49/drivers/staging/et131x/et1310_tx.c linux-2.6.32.49/drivers/staging/et131x/et1310_tx.c
39785 --- linux-2.6.32.49/drivers/staging/et131x/et1310_tx.c 2011-11-08 19:02:43.000000000 -0500
39786 +++ linux-2.6.32.49/drivers/staging/et131x/et1310_tx.c 2011-11-15 19:59:43.000000000 -0500
39787 @@ -710,11 +710,11 @@ inline void et131x_free_send_packet(stru
39788 struct net_device_stats *stats = &etdev->net_stats;
39789
39790 if (pMpTcb->Flags & fMP_DEST_BROAD)
39791 - atomic_inc(&etdev->Stats.brdcstxmt);
39792 + atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
39793 else if (pMpTcb->Flags & fMP_DEST_MULTI)
39794 - atomic_inc(&etdev->Stats.multixmt);
39795 + atomic_inc_unchecked(&etdev->Stats.multixmt);
39796 else
39797 - atomic_inc(&etdev->Stats.unixmt);
39798 + atomic_inc_unchecked(&etdev->Stats.unixmt);
39799
39800 if (pMpTcb->Packet) {
39801 stats->tx_bytes += pMpTcb->Packet->len;
39802 diff -urNp linux-2.6.32.49/drivers/staging/et131x/et131x_adapter.h linux-2.6.32.49/drivers/staging/et131x/et131x_adapter.h
39803 --- linux-2.6.32.49/drivers/staging/et131x/et131x_adapter.h 2011-11-08 19:02:43.000000000 -0500
39804 +++ linux-2.6.32.49/drivers/staging/et131x/et131x_adapter.h 2011-11-15 19:59:43.000000000 -0500
39805 @@ -145,11 +145,11 @@ typedef struct _ce_stats_t {
39806 * operations
39807 */
39808 u32 unircv; /* # multicast packets received */
39809 - atomic_t unixmt; /* # multicast packets for Tx */
39810 + atomic_unchecked_t unixmt; /* # multicast packets for Tx */
39811 u32 multircv; /* # multicast packets received */
39812 - atomic_t multixmt; /* # multicast packets for Tx */
39813 + atomic_unchecked_t multixmt; /* # multicast packets for Tx */
39814 u32 brdcstrcv; /* # broadcast packets received */
39815 - atomic_t brdcstxmt; /* # broadcast packets for Tx */
39816 + atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
39817 u32 norcvbuf; /* # Rx packets discarded */
39818 u32 noxmtbuf; /* # Tx packets discarded */
39819
39820 diff -urNp linux-2.6.32.49/drivers/staging/go7007/go7007-v4l2.c linux-2.6.32.49/drivers/staging/go7007/go7007-v4l2.c
39821 --- linux-2.6.32.49/drivers/staging/go7007/go7007-v4l2.c 2011-11-08 19:02:43.000000000 -0500
39822 +++ linux-2.6.32.49/drivers/staging/go7007/go7007-v4l2.c 2011-11-15 19:59:43.000000000 -0500
39823 @@ -1700,7 +1700,7 @@ static int go7007_vm_fault(struct vm_are
39824 return 0;
39825 }
39826
39827 -static struct vm_operations_struct go7007_vm_ops = {
39828 +static const struct vm_operations_struct go7007_vm_ops = {
39829 .open = go7007_vm_open,
39830 .close = go7007_vm_close,
39831 .fault = go7007_vm_fault,
39832 diff -urNp linux-2.6.32.49/drivers/staging/hv/blkvsc_drv.c linux-2.6.32.49/drivers/staging/hv/blkvsc_drv.c
39833 --- linux-2.6.32.49/drivers/staging/hv/blkvsc_drv.c 2011-11-08 19:02:43.000000000 -0500
39834 +++ linux-2.6.32.49/drivers/staging/hv/blkvsc_drv.c 2011-11-15 19:59:43.000000000 -0500
39835 @@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKV
39836 /* The one and only one */
39837 static struct blkvsc_driver_context g_blkvsc_drv;
39838
39839 -static struct block_device_operations block_ops = {
39840 +static const struct block_device_operations block_ops = {
39841 .owner = THIS_MODULE,
39842 .open = blkvsc_open,
39843 .release = blkvsc_release,
39844 diff -urNp linux-2.6.32.49/drivers/staging/hv/Channel.c linux-2.6.32.49/drivers/staging/hv/Channel.c
39845 --- linux-2.6.32.49/drivers/staging/hv/Channel.c 2011-11-08 19:02:43.000000000 -0500
39846 +++ linux-2.6.32.49/drivers/staging/hv/Channel.c 2011-11-15 19:59:43.000000000 -0500
39847 @@ -464,8 +464,8 @@ int VmbusChannelEstablishGpadl(struct vm
39848
39849 DPRINT_ENTER(VMBUS);
39850
39851 - nextGpadlHandle = atomic_read(&gVmbusConnection.NextGpadlHandle);
39852 - atomic_inc(&gVmbusConnection.NextGpadlHandle);
39853 + nextGpadlHandle = atomic_read_unchecked(&gVmbusConnection.NextGpadlHandle);
39854 + atomic_inc_unchecked(&gVmbusConnection.NextGpadlHandle);
39855
39856 VmbusChannelCreateGpadlHeader(Kbuffer, Size, &msgInfo, &msgCount);
39857 ASSERT(msgInfo != NULL);
39858 diff -urNp linux-2.6.32.49/drivers/staging/hv/Hv.c linux-2.6.32.49/drivers/staging/hv/Hv.c
39859 --- linux-2.6.32.49/drivers/staging/hv/Hv.c 2011-11-08 19:02:43.000000000 -0500
39860 +++ linux-2.6.32.49/drivers/staging/hv/Hv.c 2011-11-15 19:59:43.000000000 -0500
39861 @@ -161,7 +161,7 @@ static u64 HvDoHypercall(u64 Control, vo
39862 u64 outputAddress = (Output) ? virt_to_phys(Output) : 0;
39863 u32 outputAddressHi = outputAddress >> 32;
39864 u32 outputAddressLo = outputAddress & 0xFFFFFFFF;
39865 - volatile void *hypercallPage = gHvContext.HypercallPage;
39866 + volatile void *hypercallPage = ktva_ktla(gHvContext.HypercallPage);
39867
39868 DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
39869 Control, Input, Output);
39870 diff -urNp linux-2.6.32.49/drivers/staging/hv/VmbusApi.h linux-2.6.32.49/drivers/staging/hv/VmbusApi.h
39871 --- linux-2.6.32.49/drivers/staging/hv/VmbusApi.h 2011-11-08 19:02:43.000000000 -0500
39872 +++ linux-2.6.32.49/drivers/staging/hv/VmbusApi.h 2011-11-15 19:59:43.000000000 -0500
39873 @@ -109,7 +109,7 @@ struct vmbus_channel_interface {
39874 u32 *GpadlHandle);
39875 int (*TeardownGpadl)(struct hv_device *device, u32 GpadlHandle);
39876 void (*GetInfo)(struct hv_device *dev, struct hv_device_info *devinfo);
39877 -};
39878 +} __no_const;
39879
39880 /* Base driver object */
39881 struct hv_driver {
39882 diff -urNp linux-2.6.32.49/drivers/staging/hv/vmbus_drv.c linux-2.6.32.49/drivers/staging/hv/vmbus_drv.c
39883 --- linux-2.6.32.49/drivers/staging/hv/vmbus_drv.c 2011-11-08 19:02:43.000000000 -0500
39884 +++ linux-2.6.32.49/drivers/staging/hv/vmbus_drv.c 2011-11-15 19:59:43.000000000 -0500
39885 @@ -532,7 +532,7 @@ static int vmbus_child_device_register(s
39886 to_device_context(root_device_obj);
39887 struct device_context *child_device_ctx =
39888 to_device_context(child_device_obj);
39889 - static atomic_t device_num = ATOMIC_INIT(0);
39890 + static atomic_unchecked_t device_num = ATOMIC_INIT(0);
39891
39892 DPRINT_ENTER(VMBUS_DRV);
39893
39894 @@ -541,7 +541,7 @@ static int vmbus_child_device_register(s
39895
39896 /* Set the device name. Otherwise, device_register() will fail. */
39897 dev_set_name(&child_device_ctx->device, "vmbus_0_%d",
39898 - atomic_inc_return(&device_num));
39899 + atomic_inc_return_unchecked(&device_num));
39900
39901 /* The new device belongs to this bus */
39902 child_device_ctx->device.bus = &g_vmbus_drv.bus; /* device->dev.bus; */
39903 diff -urNp linux-2.6.32.49/drivers/staging/hv/VmbusPrivate.h linux-2.6.32.49/drivers/staging/hv/VmbusPrivate.h
39904 --- linux-2.6.32.49/drivers/staging/hv/VmbusPrivate.h 2011-11-08 19:02:43.000000000 -0500
39905 +++ linux-2.6.32.49/drivers/staging/hv/VmbusPrivate.h 2011-11-15 19:59:43.000000000 -0500
39906 @@ -59,7 +59,7 @@ enum VMBUS_CONNECT_STATE {
39907 struct VMBUS_CONNECTION {
39908 enum VMBUS_CONNECT_STATE ConnectState;
39909
39910 - atomic_t NextGpadlHandle;
39911 + atomic_unchecked_t NextGpadlHandle;
39912
39913 /*
39914 * Represents channel interrupts. Each bit position represents a
39915 diff -urNp linux-2.6.32.49/drivers/staging/iio/ring_generic.h linux-2.6.32.49/drivers/staging/iio/ring_generic.h
39916 --- linux-2.6.32.49/drivers/staging/iio/ring_generic.h 2011-11-08 19:02:43.000000000 -0500
39917 +++ linux-2.6.32.49/drivers/staging/iio/ring_generic.h 2011-11-15 19:59:43.000000000 -0500
39918 @@ -87,7 +87,7 @@ struct iio_ring_access_funcs {
39919
39920 int (*is_enabled)(struct iio_ring_buffer *ring);
39921 int (*enable)(struct iio_ring_buffer *ring);
39922 -};
39923 +} __no_const;
39924
39925 /**
39926 * struct iio_ring_buffer - general ring buffer structure
39927 diff -urNp linux-2.6.32.49/drivers/staging/octeon/ethernet.c linux-2.6.32.49/drivers/staging/octeon/ethernet.c
39928 --- linux-2.6.32.49/drivers/staging/octeon/ethernet.c 2011-11-08 19:02:43.000000000 -0500
39929 +++ linux-2.6.32.49/drivers/staging/octeon/ethernet.c 2011-11-15 19:59:43.000000000 -0500
39930 @@ -294,11 +294,11 @@ static struct net_device_stats *cvm_oct_
39931 * since the RX tasklet also increments it.
39932 */
39933 #ifdef CONFIG_64BIT
39934 - atomic64_add(rx_status.dropped_packets,
39935 - (atomic64_t *)&priv->stats.rx_dropped);
39936 + atomic64_add_unchecked(rx_status.dropped_packets,
39937 + (atomic64_unchecked_t *)&priv->stats.rx_dropped);
39938 #else
39939 - atomic_add(rx_status.dropped_packets,
39940 - (atomic_t *)&priv->stats.rx_dropped);
39941 + atomic_add_unchecked(rx_status.dropped_packets,
39942 + (atomic_unchecked_t *)&priv->stats.rx_dropped);
39943 #endif
39944 }
39945
39946 diff -urNp linux-2.6.32.49/drivers/staging/octeon/ethernet-rx.c linux-2.6.32.49/drivers/staging/octeon/ethernet-rx.c
39947 --- linux-2.6.32.49/drivers/staging/octeon/ethernet-rx.c 2011-11-08 19:02:43.000000000 -0500
39948 +++ linux-2.6.32.49/drivers/staging/octeon/ethernet-rx.c 2011-11-15 19:59:43.000000000 -0500
39949 @@ -406,11 +406,11 @@ void cvm_oct_tasklet_rx(unsigned long un
39950 /* Increment RX stats for virtual ports */
39951 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
39952 #ifdef CONFIG_64BIT
39953 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
39954 - atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
39955 + atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
39956 + atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
39957 #else
39958 - atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
39959 - atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
39960 + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
39961 + atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
39962 #endif
39963 }
39964 netif_receive_skb(skb);
39965 @@ -424,9 +424,9 @@ void cvm_oct_tasklet_rx(unsigned long un
39966 dev->name);
39967 */
39968 #ifdef CONFIG_64BIT
39969 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
39970 + atomic64_add_unchecked(1, (atomic64_t *)&priv->stats.rx_dropped);
39971 #else
39972 - atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
39973 + atomic_add_unchecked(1, (atomic_t *)&priv->stats.rx_dropped);
39974 #endif
39975 dev_kfree_skb_irq(skb);
39976 }
39977 diff -urNp linux-2.6.32.49/drivers/staging/otus/80211core/pub_zfi.h linux-2.6.32.49/drivers/staging/otus/80211core/pub_zfi.h
39978 --- linux-2.6.32.49/drivers/staging/otus/80211core/pub_zfi.h 2011-11-08 19:02:43.000000000 -0500
39979 +++ linux-2.6.32.49/drivers/staging/otus/80211core/pub_zfi.h 2011-11-18 18:01:55.000000000 -0500
39980 @@ -531,7 +531,7 @@ struct zsCbFuncTbl
39981 u8_t (*zfcbClassifyTxPacket)(zdev_t* dev, zbuf_t* buf);
39982
39983 void (*zfcbHwWatchDogNotify)(zdev_t* dev);
39984 -};
39985 +} __no_const;
39986
39987 extern void zfZeroMemory(u8_t* va, u16_t length);
39988 #define ZM_INIT_CB_FUNC_TABLE(p) zfZeroMemory((u8_t *)p, sizeof(struct zsCbFuncTbl));
39989 diff -urNp linux-2.6.32.49/drivers/staging/panel/panel.c linux-2.6.32.49/drivers/staging/panel/panel.c
39990 --- linux-2.6.32.49/drivers/staging/panel/panel.c 2011-11-08 19:02:43.000000000 -0500
39991 +++ linux-2.6.32.49/drivers/staging/panel/panel.c 2011-11-15 19:59:43.000000000 -0500
39992 @@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *ino
39993 return 0;
39994 }
39995
39996 -static struct file_operations lcd_fops = {
39997 +static const struct file_operations lcd_fops = {
39998 .write = lcd_write,
39999 .open = lcd_open,
40000 .release = lcd_release,
40001 @@ -1565,7 +1565,7 @@ static int keypad_release(struct inode *
40002 return 0;
40003 }
40004
40005 -static struct file_operations keypad_fops = {
40006 +static const struct file_operations keypad_fops = {
40007 .read = keypad_read, /* read */
40008 .open = keypad_open, /* open */
40009 .release = keypad_release, /* close */
40010 diff -urNp linux-2.6.32.49/drivers/staging/phison/phison.c linux-2.6.32.49/drivers/staging/phison/phison.c
40011 --- linux-2.6.32.49/drivers/staging/phison/phison.c 2011-11-08 19:02:43.000000000 -0500
40012 +++ linux-2.6.32.49/drivers/staging/phison/phison.c 2011-11-15 19:59:43.000000000 -0500
40013 @@ -43,7 +43,7 @@ static struct scsi_host_template phison_
40014 ATA_BMDMA_SHT(DRV_NAME),
40015 };
40016
40017 -static struct ata_port_operations phison_ops = {
40018 +static const struct ata_port_operations phison_ops = {
40019 .inherits = &ata_bmdma_port_ops,
40020 .prereset = phison_pre_reset,
40021 };
40022 diff -urNp linux-2.6.32.49/drivers/staging/poch/poch.c linux-2.6.32.49/drivers/staging/poch/poch.c
40023 --- linux-2.6.32.49/drivers/staging/poch/poch.c 2011-11-08 19:02:43.000000000 -0500
40024 +++ linux-2.6.32.49/drivers/staging/poch/poch.c 2011-11-15 19:59:43.000000000 -0500
40025 @@ -1057,7 +1057,7 @@ static int poch_ioctl(struct inode *inod
40026 return 0;
40027 }
40028
40029 -static struct file_operations poch_fops = {
40030 +static const struct file_operations poch_fops = {
40031 .owner = THIS_MODULE,
40032 .open = poch_open,
40033 .release = poch_release,
40034 diff -urNp linux-2.6.32.49/drivers/staging/pohmelfs/inode.c linux-2.6.32.49/drivers/staging/pohmelfs/inode.c
40035 --- linux-2.6.32.49/drivers/staging/pohmelfs/inode.c 2011-11-08 19:02:43.000000000 -0500
40036 +++ linux-2.6.32.49/drivers/staging/pohmelfs/inode.c 2011-11-15 19:59:43.000000000 -0500
40037 @@ -1850,7 +1850,7 @@ static int pohmelfs_fill_super(struct su
40038 mutex_init(&psb->mcache_lock);
40039 psb->mcache_root = RB_ROOT;
40040 psb->mcache_timeout = msecs_to_jiffies(5000);
40041 - atomic_long_set(&psb->mcache_gen, 0);
40042 + atomic_long_set_unchecked(&psb->mcache_gen, 0);
40043
40044 psb->trans_max_pages = 100;
40045
40046 @@ -1865,7 +1865,7 @@ static int pohmelfs_fill_super(struct su
40047 INIT_LIST_HEAD(&psb->crypto_ready_list);
40048 INIT_LIST_HEAD(&psb->crypto_active_list);
40049
40050 - atomic_set(&psb->trans_gen, 1);
40051 + atomic_set_unchecked(&psb->trans_gen, 1);
40052 atomic_long_set(&psb->total_inodes, 0);
40053
40054 mutex_init(&psb->state_lock);
40055 diff -urNp linux-2.6.32.49/drivers/staging/pohmelfs/mcache.c linux-2.6.32.49/drivers/staging/pohmelfs/mcache.c
40056 --- linux-2.6.32.49/drivers/staging/pohmelfs/mcache.c 2011-11-08 19:02:43.000000000 -0500
40057 +++ linux-2.6.32.49/drivers/staging/pohmelfs/mcache.c 2011-11-15 19:59:43.000000000 -0500
40058 @@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
40059 m->data = data;
40060 m->start = start;
40061 m->size = size;
40062 - m->gen = atomic_long_inc_return(&psb->mcache_gen);
40063 + m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
40064
40065 mutex_lock(&psb->mcache_lock);
40066 err = pohmelfs_mcache_insert(psb, m);
40067 diff -urNp linux-2.6.32.49/drivers/staging/pohmelfs/netfs.h linux-2.6.32.49/drivers/staging/pohmelfs/netfs.h
40068 --- linux-2.6.32.49/drivers/staging/pohmelfs/netfs.h 2011-11-08 19:02:43.000000000 -0500
40069 +++ linux-2.6.32.49/drivers/staging/pohmelfs/netfs.h 2011-11-15 19:59:43.000000000 -0500
40070 @@ -570,14 +570,14 @@ struct pohmelfs_config;
40071 struct pohmelfs_sb {
40072 struct rb_root mcache_root;
40073 struct mutex mcache_lock;
40074 - atomic_long_t mcache_gen;
40075 + atomic_long_unchecked_t mcache_gen;
40076 unsigned long mcache_timeout;
40077
40078 unsigned int idx;
40079
40080 unsigned int trans_retries;
40081
40082 - atomic_t trans_gen;
40083 + atomic_unchecked_t trans_gen;
40084
40085 unsigned int crypto_attached_size;
40086 unsigned int crypto_align_size;
40087 diff -urNp linux-2.6.32.49/drivers/staging/pohmelfs/trans.c linux-2.6.32.49/drivers/staging/pohmelfs/trans.c
40088 --- linux-2.6.32.49/drivers/staging/pohmelfs/trans.c 2011-11-08 19:02:43.000000000 -0500
40089 +++ linux-2.6.32.49/drivers/staging/pohmelfs/trans.c 2011-11-15 19:59:43.000000000 -0500
40090 @@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_tran
40091 int err;
40092 struct netfs_cmd *cmd = t->iovec.iov_base;
40093
40094 - t->gen = atomic_inc_return(&psb->trans_gen);
40095 + t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
40096
40097 cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
40098 t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
40099 diff -urNp linux-2.6.32.49/drivers/staging/sep/sep_driver.c linux-2.6.32.49/drivers/staging/sep/sep_driver.c
40100 --- linux-2.6.32.49/drivers/staging/sep/sep_driver.c 2011-11-08 19:02:43.000000000 -0500
40101 +++ linux-2.6.32.49/drivers/staging/sep/sep_driver.c 2011-11-15 19:59:43.000000000 -0500
40102 @@ -2603,7 +2603,7 @@ static struct pci_driver sep_pci_driver
40103 static dev_t sep_devno;
40104
40105 /* the files operations structure of the driver */
40106 -static struct file_operations sep_file_operations = {
40107 +static const struct file_operations sep_file_operations = {
40108 .owner = THIS_MODULE,
40109 .ioctl = sep_ioctl,
40110 .poll = sep_poll,
40111 diff -urNp linux-2.6.32.49/drivers/staging/usbip/usbip_common.h linux-2.6.32.49/drivers/staging/usbip/usbip_common.h
40112 --- linux-2.6.32.49/drivers/staging/usbip/usbip_common.h 2011-11-08 19:02:43.000000000 -0500
40113 +++ linux-2.6.32.49/drivers/staging/usbip/usbip_common.h 2011-11-15 19:59:43.000000000 -0500
40114 @@ -374,7 +374,7 @@ struct usbip_device {
40115 void (*shutdown)(struct usbip_device *);
40116 void (*reset)(struct usbip_device *);
40117 void (*unusable)(struct usbip_device *);
40118 - } eh_ops;
40119 + } __no_const eh_ops;
40120 };
40121
40122
40123 diff -urNp linux-2.6.32.49/drivers/staging/usbip/vhci.h linux-2.6.32.49/drivers/staging/usbip/vhci.h
40124 --- linux-2.6.32.49/drivers/staging/usbip/vhci.h 2011-11-08 19:02:43.000000000 -0500
40125 +++ linux-2.6.32.49/drivers/staging/usbip/vhci.h 2011-11-15 19:59:43.000000000 -0500
40126 @@ -92,7 +92,7 @@ struct vhci_hcd {
40127 unsigned resuming:1;
40128 unsigned long re_timeout;
40129
40130 - atomic_t seqnum;
40131 + atomic_unchecked_t seqnum;
40132
40133 /*
40134 * NOTE:
40135 diff -urNp linux-2.6.32.49/drivers/staging/usbip/vhci_hcd.c linux-2.6.32.49/drivers/staging/usbip/vhci_hcd.c
40136 --- linux-2.6.32.49/drivers/staging/usbip/vhci_hcd.c 2011-11-08 19:02:43.000000000 -0500
40137 +++ linux-2.6.32.49/drivers/staging/usbip/vhci_hcd.c 2011-11-15 19:59:43.000000000 -0500
40138 @@ -534,7 +534,7 @@ static void vhci_tx_urb(struct urb *urb)
40139 return;
40140 }
40141
40142 - priv->seqnum = atomic_inc_return(&the_controller->seqnum);
40143 + priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
40144 if (priv->seqnum == 0xffff)
40145 usbip_uinfo("seqnum max\n");
40146
40147 @@ -793,7 +793,7 @@ static int vhci_urb_dequeue(struct usb_h
40148 return -ENOMEM;
40149 }
40150
40151 - unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
40152 + unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
40153 if (unlink->seqnum == 0xffff)
40154 usbip_uinfo("seqnum max\n");
40155
40156 @@ -988,7 +988,7 @@ static int vhci_start(struct usb_hcd *hc
40157 vdev->rhport = rhport;
40158 }
40159
40160 - atomic_set(&vhci->seqnum, 0);
40161 + atomic_set_unchecked(&vhci->seqnum, 0);
40162 spin_lock_init(&vhci->lock);
40163
40164
40165 diff -urNp linux-2.6.32.49/drivers/staging/usbip/vhci_rx.c linux-2.6.32.49/drivers/staging/usbip/vhci_rx.c
40166 --- linux-2.6.32.49/drivers/staging/usbip/vhci_rx.c 2011-11-08 19:02:43.000000000 -0500
40167 +++ linux-2.6.32.49/drivers/staging/usbip/vhci_rx.c 2011-11-15 19:59:43.000000000 -0500
40168 @@ -78,7 +78,7 @@ static void vhci_recv_ret_submit(struct
40169 usbip_uerr("cannot find a urb of seqnum %u\n",
40170 pdu->base.seqnum);
40171 usbip_uinfo("max seqnum %d\n",
40172 - atomic_read(&the_controller->seqnum));
40173 + atomic_read_unchecked(&the_controller->seqnum));
40174 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
40175 return;
40176 }
40177 diff -urNp linux-2.6.32.49/drivers/staging/vme/devices/vme_user.c linux-2.6.32.49/drivers/staging/vme/devices/vme_user.c
40178 --- linux-2.6.32.49/drivers/staging/vme/devices/vme_user.c 2011-11-08 19:02:43.000000000 -0500
40179 +++ linux-2.6.32.49/drivers/staging/vme/devices/vme_user.c 2011-11-15 19:59:43.000000000 -0500
40180 @@ -136,7 +136,7 @@ static int vme_user_ioctl(struct inode *
40181 static int __init vme_user_probe(struct device *, int, int);
40182 static int __exit vme_user_remove(struct device *, int, int);
40183
40184 -static struct file_operations vme_user_fops = {
40185 +static const struct file_operations vme_user_fops = {
40186 .open = vme_user_open,
40187 .release = vme_user_release,
40188 .read = vme_user_read,
40189 diff -urNp linux-2.6.32.49/drivers/staging/vt6655/hostap.c linux-2.6.32.49/drivers/staging/vt6655/hostap.c
40190 --- linux-2.6.32.49/drivers/staging/vt6655/hostap.c 2011-11-08 19:02:43.000000000 -0500
40191 +++ linux-2.6.32.49/drivers/staging/vt6655/hostap.c 2011-11-15 19:59:43.000000000 -0500
40192 @@ -84,7 +84,7 @@ static int hostap_enable_hostapd(PSDevic
40193 PSDevice apdev_priv;
40194 struct net_device *dev = pDevice->dev;
40195 int ret;
40196 - const struct net_device_ops apdev_netdev_ops = {
40197 + net_device_ops_no_const apdev_netdev_ops = {
40198 .ndo_start_xmit = pDevice->tx_80211,
40199 };
40200
40201 diff -urNp linux-2.6.32.49/drivers/staging/vt6656/hostap.c linux-2.6.32.49/drivers/staging/vt6656/hostap.c
40202 --- linux-2.6.32.49/drivers/staging/vt6656/hostap.c 2011-11-08 19:02:43.000000000 -0500
40203 +++ linux-2.6.32.49/drivers/staging/vt6656/hostap.c 2011-11-15 19:59:43.000000000 -0500
40204 @@ -86,7 +86,7 @@ static int hostap_enable_hostapd(PSDevic
40205 PSDevice apdev_priv;
40206 struct net_device *dev = pDevice->dev;
40207 int ret;
40208 - const struct net_device_ops apdev_netdev_ops = {
40209 + net_device_ops_no_const apdev_netdev_ops = {
40210 .ndo_start_xmit = pDevice->tx_80211,
40211 };
40212
40213 diff -urNp linux-2.6.32.49/drivers/staging/wlan-ng/hfa384x_usb.c linux-2.6.32.49/drivers/staging/wlan-ng/hfa384x_usb.c
40214 --- linux-2.6.32.49/drivers/staging/wlan-ng/hfa384x_usb.c 2011-11-08 19:02:43.000000000 -0500
40215 +++ linux-2.6.32.49/drivers/staging/wlan-ng/hfa384x_usb.c 2011-11-15 19:59:43.000000000 -0500
40216 @@ -205,7 +205,7 @@ static void unlocked_usbctlx_complete(hf
40217
40218 struct usbctlx_completor {
40219 int (*complete) (struct usbctlx_completor *);
40220 -};
40221 +} __no_const;
40222 typedef struct usbctlx_completor usbctlx_completor_t;
40223
40224 static int
40225 diff -urNp linux-2.6.32.49/drivers/telephony/ixj.c linux-2.6.32.49/drivers/telephony/ixj.c
40226 --- linux-2.6.32.49/drivers/telephony/ixj.c 2011-11-08 19:02:43.000000000 -0500
40227 +++ linux-2.6.32.49/drivers/telephony/ixj.c 2011-11-15 19:59:43.000000000 -0500
40228 @@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
40229 bool mContinue;
40230 char *pIn, *pOut;
40231
40232 + pax_track_stack();
40233 +
40234 if (!SCI_Prepare(j))
40235 return 0;
40236
40237 diff -urNp linux-2.6.32.49/drivers/uio/uio.c linux-2.6.32.49/drivers/uio/uio.c
40238 --- linux-2.6.32.49/drivers/uio/uio.c 2011-11-08 19:02:43.000000000 -0500
40239 +++ linux-2.6.32.49/drivers/uio/uio.c 2011-11-15 19:59:43.000000000 -0500
40240 @@ -23,6 +23,7 @@
40241 #include <linux/string.h>
40242 #include <linux/kobject.h>
40243 #include <linux/uio_driver.h>
40244 +#include <asm/local.h>
40245
40246 #define UIO_MAX_DEVICES 255
40247
40248 @@ -30,10 +31,10 @@ struct uio_device {
40249 struct module *owner;
40250 struct device *dev;
40251 int minor;
40252 - atomic_t event;
40253 + atomic_unchecked_t event;
40254 struct fasync_struct *async_queue;
40255 wait_queue_head_t wait;
40256 - int vma_count;
40257 + local_t vma_count;
40258 struct uio_info *info;
40259 struct kobject *map_dir;
40260 struct kobject *portio_dir;
40261 @@ -129,7 +130,7 @@ static ssize_t map_type_show(struct kobj
40262 return entry->show(mem, buf);
40263 }
40264
40265 -static struct sysfs_ops map_sysfs_ops = {
40266 +static const struct sysfs_ops map_sysfs_ops = {
40267 .show = map_type_show,
40268 };
40269
40270 @@ -217,7 +218,7 @@ static ssize_t portio_type_show(struct k
40271 return entry->show(port, buf);
40272 }
40273
40274 -static struct sysfs_ops portio_sysfs_ops = {
40275 +static const struct sysfs_ops portio_sysfs_ops = {
40276 .show = portio_type_show,
40277 };
40278
40279 @@ -255,7 +256,7 @@ static ssize_t show_event(struct device
40280 struct uio_device *idev = dev_get_drvdata(dev);
40281 if (idev)
40282 return sprintf(buf, "%u\n",
40283 - (unsigned int)atomic_read(&idev->event));
40284 + (unsigned int)atomic_read_unchecked(&idev->event));
40285 else
40286 return -ENODEV;
40287 }
40288 @@ -424,7 +425,7 @@ void uio_event_notify(struct uio_info *i
40289 {
40290 struct uio_device *idev = info->uio_dev;
40291
40292 - atomic_inc(&idev->event);
40293 + atomic_inc_unchecked(&idev->event);
40294 wake_up_interruptible(&idev->wait);
40295 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
40296 }
40297 @@ -477,7 +478,7 @@ static int uio_open(struct inode *inode,
40298 }
40299
40300 listener->dev = idev;
40301 - listener->event_count = atomic_read(&idev->event);
40302 + listener->event_count = atomic_read_unchecked(&idev->event);
40303 filep->private_data = listener;
40304
40305 if (idev->info->open) {
40306 @@ -528,7 +529,7 @@ static unsigned int uio_poll(struct file
40307 return -EIO;
40308
40309 poll_wait(filep, &idev->wait, wait);
40310 - if (listener->event_count != atomic_read(&idev->event))
40311 + if (listener->event_count != atomic_read_unchecked(&idev->event))
40312 return POLLIN | POLLRDNORM;
40313 return 0;
40314 }
40315 @@ -553,7 +554,7 @@ static ssize_t uio_read(struct file *fil
40316 do {
40317 set_current_state(TASK_INTERRUPTIBLE);
40318
40319 - event_count = atomic_read(&idev->event);
40320 + event_count = atomic_read_unchecked(&idev->event);
40321 if (event_count != listener->event_count) {
40322 if (copy_to_user(buf, &event_count, count))
40323 retval = -EFAULT;
40324 @@ -624,13 +625,13 @@ static int uio_find_mem_index(struct vm_
40325 static void uio_vma_open(struct vm_area_struct *vma)
40326 {
40327 struct uio_device *idev = vma->vm_private_data;
40328 - idev->vma_count++;
40329 + local_inc(&idev->vma_count);
40330 }
40331
40332 static void uio_vma_close(struct vm_area_struct *vma)
40333 {
40334 struct uio_device *idev = vma->vm_private_data;
40335 - idev->vma_count--;
40336 + local_dec(&idev->vma_count);
40337 }
40338
40339 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
40340 @@ -840,7 +841,7 @@ int __uio_register_device(struct module
40341 idev->owner = owner;
40342 idev->info = info;
40343 init_waitqueue_head(&idev->wait);
40344 - atomic_set(&idev->event, 0);
40345 + atomic_set_unchecked(&idev->event, 0);
40346
40347 ret = uio_get_minor(idev);
40348 if (ret)
40349 diff -urNp linux-2.6.32.49/drivers/usb/atm/usbatm.c linux-2.6.32.49/drivers/usb/atm/usbatm.c
40350 --- linux-2.6.32.49/drivers/usb/atm/usbatm.c 2011-11-08 19:02:43.000000000 -0500
40351 +++ linux-2.6.32.49/drivers/usb/atm/usbatm.c 2011-11-15 19:59:43.000000000 -0500
40352 @@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(stru
40353 if (printk_ratelimit())
40354 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
40355 __func__, vpi, vci);
40356 - atomic_inc(&vcc->stats->rx_err);
40357 + atomic_inc_unchecked(&vcc->stats->rx_err);
40358 return;
40359 }
40360
40361 @@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(stru
40362 if (length > ATM_MAX_AAL5_PDU) {
40363 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
40364 __func__, length, vcc);
40365 - atomic_inc(&vcc->stats->rx_err);
40366 + atomic_inc_unchecked(&vcc->stats->rx_err);
40367 goto out;
40368 }
40369
40370 @@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(stru
40371 if (sarb->len < pdu_length) {
40372 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
40373 __func__, pdu_length, sarb->len, vcc);
40374 - atomic_inc(&vcc->stats->rx_err);
40375 + atomic_inc_unchecked(&vcc->stats->rx_err);
40376 goto out;
40377 }
40378
40379 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
40380 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
40381 __func__, vcc);
40382 - atomic_inc(&vcc->stats->rx_err);
40383 + atomic_inc_unchecked(&vcc->stats->rx_err);
40384 goto out;
40385 }
40386
40387 @@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(stru
40388 if (printk_ratelimit())
40389 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
40390 __func__, length);
40391 - atomic_inc(&vcc->stats->rx_drop);
40392 + atomic_inc_unchecked(&vcc->stats->rx_drop);
40393 goto out;
40394 }
40395
40396 @@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(stru
40397
40398 vcc->push(vcc, skb);
40399
40400 - atomic_inc(&vcc->stats->rx);
40401 + atomic_inc_unchecked(&vcc->stats->rx);
40402 out:
40403 skb_trim(sarb, 0);
40404 }
40405 @@ -616,7 +616,7 @@ static void usbatm_tx_process(unsigned l
40406 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
40407
40408 usbatm_pop(vcc, skb);
40409 - atomic_inc(&vcc->stats->tx);
40410 + atomic_inc_unchecked(&vcc->stats->tx);
40411
40412 skb = skb_dequeue(&instance->sndqueue);
40413 }
40414 @@ -775,11 +775,11 @@ static int usbatm_atm_proc_read(struct a
40415 if (!left--)
40416 return sprintf(page,
40417 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
40418 - atomic_read(&atm_dev->stats.aal5.tx),
40419 - atomic_read(&atm_dev->stats.aal5.tx_err),
40420 - atomic_read(&atm_dev->stats.aal5.rx),
40421 - atomic_read(&atm_dev->stats.aal5.rx_err),
40422 - atomic_read(&atm_dev->stats.aal5.rx_drop));
40423 + atomic_read_unchecked(&atm_dev->stats.aal5.tx),
40424 + atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
40425 + atomic_read_unchecked(&atm_dev->stats.aal5.rx),
40426 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
40427 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
40428
40429 if (!left--) {
40430 if (instance->disconnected)
40431 diff -urNp linux-2.6.32.49/drivers/usb/class/cdc-wdm.c linux-2.6.32.49/drivers/usb/class/cdc-wdm.c
40432 --- linux-2.6.32.49/drivers/usb/class/cdc-wdm.c 2011-11-08 19:02:43.000000000 -0500
40433 +++ linux-2.6.32.49/drivers/usb/class/cdc-wdm.c 2011-11-15 19:59:43.000000000 -0500
40434 @@ -314,7 +314,7 @@ static ssize_t wdm_write
40435 if (r < 0)
40436 goto outnp;
40437
40438 - if (!file->f_flags && O_NONBLOCK)
40439 + if (!(file->f_flags & O_NONBLOCK))
40440 r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
40441 &desc->flags));
40442 else
40443 diff -urNp linux-2.6.32.49/drivers/usb/core/hcd.c linux-2.6.32.49/drivers/usb/core/hcd.c
40444 --- linux-2.6.32.49/drivers/usb/core/hcd.c 2011-11-08 19:02:43.000000000 -0500
40445 +++ linux-2.6.32.49/drivers/usb/core/hcd.c 2011-11-15 19:59:43.000000000 -0500
40446 @@ -2216,7 +2216,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
40447
40448 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
40449
40450 -struct usb_mon_operations *mon_ops;
40451 +const struct usb_mon_operations *mon_ops;
40452
40453 /*
40454 * The registration is unlocked.
40455 @@ -2226,7 +2226,7 @@ struct usb_mon_operations *mon_ops;
40456 * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
40457 */
40458
40459 -int usb_mon_register (struct usb_mon_operations *ops)
40460 +int usb_mon_register (const struct usb_mon_operations *ops)
40461 {
40462
40463 if (mon_ops)
40464 diff -urNp linux-2.6.32.49/drivers/usb/core/hcd.h linux-2.6.32.49/drivers/usb/core/hcd.h
40465 --- linux-2.6.32.49/drivers/usb/core/hcd.h 2011-11-08 19:02:43.000000000 -0500
40466 +++ linux-2.6.32.49/drivers/usb/core/hcd.h 2011-11-15 19:59:43.000000000 -0500
40467 @@ -486,13 +486,13 @@ static inline void usbfs_cleanup(void) {
40468 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
40469
40470 struct usb_mon_operations {
40471 - void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
40472 - void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
40473 - void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
40474 + void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
40475 + void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
40476 + void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
40477 /* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
40478 };
40479
40480 -extern struct usb_mon_operations *mon_ops;
40481 +extern const struct usb_mon_operations *mon_ops;
40482
40483 static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
40484 {
40485 @@ -514,7 +514,7 @@ static inline void usbmon_urb_complete(s
40486 (*mon_ops->urb_complete)(bus, urb, status);
40487 }
40488
40489 -int usb_mon_register(struct usb_mon_operations *ops);
40490 +int usb_mon_register(const struct usb_mon_operations *ops);
40491 void usb_mon_deregister(void);
40492
40493 #else
40494 diff -urNp linux-2.6.32.49/drivers/usb/core/message.c linux-2.6.32.49/drivers/usb/core/message.c
40495 --- linux-2.6.32.49/drivers/usb/core/message.c 2011-11-08 19:02:43.000000000 -0500
40496 +++ linux-2.6.32.49/drivers/usb/core/message.c 2011-11-15 19:59:43.000000000 -0500
40497 @@ -914,8 +914,8 @@ char *usb_cache_string(struct usb_device
40498 buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
40499 if (buf) {
40500 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
40501 - if (len > 0) {
40502 - smallbuf = kmalloc(++len, GFP_NOIO);
40503 + if (len++ > 0) {
40504 + smallbuf = kmalloc(len, GFP_NOIO);
40505 if (!smallbuf)
40506 return buf;
40507 memcpy(smallbuf, buf, len);
40508 diff -urNp linux-2.6.32.49/drivers/usb/misc/appledisplay.c linux-2.6.32.49/drivers/usb/misc/appledisplay.c
40509 --- linux-2.6.32.49/drivers/usb/misc/appledisplay.c 2011-11-08 19:02:43.000000000 -0500
40510 +++ linux-2.6.32.49/drivers/usb/misc/appledisplay.c 2011-11-15 19:59:43.000000000 -0500
40511 @@ -178,7 +178,7 @@ static int appledisplay_bl_get_brightnes
40512 return pdata->msgdata[1];
40513 }
40514
40515 -static struct backlight_ops appledisplay_bl_data = {
40516 +static const struct backlight_ops appledisplay_bl_data = {
40517 .get_brightness = appledisplay_bl_get_brightness,
40518 .update_status = appledisplay_bl_update_status,
40519 };
40520 diff -urNp linux-2.6.32.49/drivers/usb/mon/mon_main.c linux-2.6.32.49/drivers/usb/mon/mon_main.c
40521 --- linux-2.6.32.49/drivers/usb/mon/mon_main.c 2011-11-08 19:02:43.000000000 -0500
40522 +++ linux-2.6.32.49/drivers/usb/mon/mon_main.c 2011-11-15 19:59:43.000000000 -0500
40523 @@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
40524 /*
40525 * Ops
40526 */
40527 -static struct usb_mon_operations mon_ops_0 = {
40528 +static const struct usb_mon_operations mon_ops_0 = {
40529 .urb_submit = mon_submit,
40530 .urb_submit_error = mon_submit_error,
40531 .urb_complete = mon_complete,
40532 diff -urNp linux-2.6.32.49/drivers/usb/wusbcore/wa-hc.h linux-2.6.32.49/drivers/usb/wusbcore/wa-hc.h
40533 --- linux-2.6.32.49/drivers/usb/wusbcore/wa-hc.h 2011-11-08 19:02:43.000000000 -0500
40534 +++ linux-2.6.32.49/drivers/usb/wusbcore/wa-hc.h 2011-11-15 19:59:43.000000000 -0500
40535 @@ -192,7 +192,7 @@ struct wahc {
40536 struct list_head xfer_delayed_list;
40537 spinlock_t xfer_list_lock;
40538 struct work_struct xfer_work;
40539 - atomic_t xfer_id_count;
40540 + atomic_unchecked_t xfer_id_count;
40541 };
40542
40543
40544 @@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *
40545 INIT_LIST_HEAD(&wa->xfer_delayed_list);
40546 spin_lock_init(&wa->xfer_list_lock);
40547 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
40548 - atomic_set(&wa->xfer_id_count, 1);
40549 + atomic_set_unchecked(&wa->xfer_id_count, 1);
40550 }
40551
40552 /**
40553 diff -urNp linux-2.6.32.49/drivers/usb/wusbcore/wa-xfer.c linux-2.6.32.49/drivers/usb/wusbcore/wa-xfer.c
40554 --- linux-2.6.32.49/drivers/usb/wusbcore/wa-xfer.c 2011-11-08 19:02:43.000000000 -0500
40555 +++ linux-2.6.32.49/drivers/usb/wusbcore/wa-xfer.c 2011-11-15 19:59:43.000000000 -0500
40556 @@ -293,7 +293,7 @@ out:
40557 */
40558 static void wa_xfer_id_init(struct wa_xfer *xfer)
40559 {
40560 - xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
40561 + xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
40562 }
40563
40564 /*
40565 diff -urNp linux-2.6.32.49/drivers/uwb/wlp/messages.c linux-2.6.32.49/drivers/uwb/wlp/messages.c
40566 --- linux-2.6.32.49/drivers/uwb/wlp/messages.c 2011-11-08 19:02:43.000000000 -0500
40567 +++ linux-2.6.32.49/drivers/uwb/wlp/messages.c 2011-11-15 19:59:43.000000000 -0500
40568 @@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct
40569 size_t len = skb->len;
40570 size_t used;
40571 ssize_t result;
40572 - struct wlp_nonce enonce, rnonce;
40573 + struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
40574 enum wlp_assc_error assc_err;
40575 char enonce_buf[WLP_WSS_NONCE_STRSIZE];
40576 char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
40577 diff -urNp linux-2.6.32.49/drivers/uwb/wlp/sysfs.c linux-2.6.32.49/drivers/uwb/wlp/sysfs.c
40578 --- linux-2.6.32.49/drivers/uwb/wlp/sysfs.c 2011-11-08 19:02:43.000000000 -0500
40579 +++ linux-2.6.32.49/drivers/uwb/wlp/sysfs.c 2011-11-15 19:59:43.000000000 -0500
40580 @@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobjec
40581 return ret;
40582 }
40583
40584 -static
40585 -struct sysfs_ops wss_sysfs_ops = {
40586 +static const struct sysfs_ops wss_sysfs_ops = {
40587 .show = wlp_wss_attr_show,
40588 .store = wlp_wss_attr_store,
40589 };
40590 diff -urNp linux-2.6.32.49/drivers/video/atmel_lcdfb.c linux-2.6.32.49/drivers/video/atmel_lcdfb.c
40591 --- linux-2.6.32.49/drivers/video/atmel_lcdfb.c 2011-11-08 19:02:43.000000000 -0500
40592 +++ linux-2.6.32.49/drivers/video/atmel_lcdfb.c 2011-11-15 19:59:43.000000000 -0500
40593 @@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struc
40594 return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
40595 }
40596
40597 -static struct backlight_ops atmel_lcdc_bl_ops = {
40598 +static const struct backlight_ops atmel_lcdc_bl_ops = {
40599 .update_status = atmel_bl_update_status,
40600 .get_brightness = atmel_bl_get_brightness,
40601 };
40602 diff -urNp linux-2.6.32.49/drivers/video/aty/aty128fb.c linux-2.6.32.49/drivers/video/aty/aty128fb.c
40603 --- linux-2.6.32.49/drivers/video/aty/aty128fb.c 2011-11-08 19:02:43.000000000 -0500
40604 +++ linux-2.6.32.49/drivers/video/aty/aty128fb.c 2011-11-18 18:01:55.000000000 -0500
40605 @@ -149,7 +149,7 @@ enum {
40606 };
40607
40608 /* Must match above enum */
40609 -static const char *r128_family[] __devinitdata = {
40610 +static const char *r128_family[] __devinitconst = {
40611 "AGP",
40612 "PCI",
40613 "PRO AGP",
40614 @@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(stru
40615 return bd->props.brightness;
40616 }
40617
40618 -static struct backlight_ops aty128_bl_data = {
40619 +static const struct backlight_ops aty128_bl_data = {
40620 .get_brightness = aty128_bl_get_brightness,
40621 .update_status = aty128_bl_update_status,
40622 };
40623 diff -urNp linux-2.6.32.49/drivers/video/aty/atyfb_base.c linux-2.6.32.49/drivers/video/aty/atyfb_base.c
40624 --- linux-2.6.32.49/drivers/video/aty/atyfb_base.c 2011-11-08 19:02:43.000000000 -0500
40625 +++ linux-2.6.32.49/drivers/video/aty/atyfb_base.c 2011-11-15 19:59:43.000000000 -0500
40626 @@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct
40627 return bd->props.brightness;
40628 }
40629
40630 -static struct backlight_ops aty_bl_data = {
40631 +static const struct backlight_ops aty_bl_data = {
40632 .get_brightness = aty_bl_get_brightness,
40633 .update_status = aty_bl_update_status,
40634 };
40635 diff -urNp linux-2.6.32.49/drivers/video/aty/radeon_backlight.c linux-2.6.32.49/drivers/video/aty/radeon_backlight.c
40636 --- linux-2.6.32.49/drivers/video/aty/radeon_backlight.c 2011-11-08 19:02:43.000000000 -0500
40637 +++ linux-2.6.32.49/drivers/video/aty/radeon_backlight.c 2011-11-15 19:59:43.000000000 -0500
40638 @@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(stru
40639 return bd->props.brightness;
40640 }
40641
40642 -static struct backlight_ops radeon_bl_data = {
40643 +static const struct backlight_ops radeon_bl_data = {
40644 .get_brightness = radeon_bl_get_brightness,
40645 .update_status = radeon_bl_update_status,
40646 };
40647 diff -urNp linux-2.6.32.49/drivers/video/backlight/adp5520_bl.c linux-2.6.32.49/drivers/video/backlight/adp5520_bl.c
40648 --- linux-2.6.32.49/drivers/video/backlight/adp5520_bl.c 2011-11-08 19:02:43.000000000 -0500
40649 +++ linux-2.6.32.49/drivers/video/backlight/adp5520_bl.c 2011-11-15 19:59:43.000000000 -0500
40650 @@ -84,7 +84,7 @@ static int adp5520_bl_get_brightness(str
40651 return error ? data->current_brightness : reg_val;
40652 }
40653
40654 -static struct backlight_ops adp5520_bl_ops = {
40655 +static const struct backlight_ops adp5520_bl_ops = {
40656 .update_status = adp5520_bl_update_status,
40657 .get_brightness = adp5520_bl_get_brightness,
40658 };
40659 diff -urNp linux-2.6.32.49/drivers/video/backlight/adx_bl.c linux-2.6.32.49/drivers/video/backlight/adx_bl.c
40660 --- linux-2.6.32.49/drivers/video/backlight/adx_bl.c 2011-11-08 19:02:43.000000000 -0500
40661 +++ linux-2.6.32.49/drivers/video/backlight/adx_bl.c 2011-11-15 19:59:43.000000000 -0500
40662 @@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct
40663 return 1;
40664 }
40665
40666 -static struct backlight_ops adx_backlight_ops = {
40667 +static const struct backlight_ops adx_backlight_ops = {
40668 .options = 0,
40669 .update_status = adx_backlight_update_status,
40670 .get_brightness = adx_backlight_get_brightness,
40671 diff -urNp linux-2.6.32.49/drivers/video/backlight/atmel-pwm-bl.c linux-2.6.32.49/drivers/video/backlight/atmel-pwm-bl.c
40672 --- linux-2.6.32.49/drivers/video/backlight/atmel-pwm-bl.c 2011-11-08 19:02:43.000000000 -0500
40673 +++ linux-2.6.32.49/drivers/video/backlight/atmel-pwm-bl.c 2011-11-15 19:59:43.000000000 -0500
40674 @@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct
40675 return pwm_channel_enable(&pwmbl->pwmc);
40676 }
40677
40678 -static struct backlight_ops atmel_pwm_bl_ops = {
40679 +static const struct backlight_ops atmel_pwm_bl_ops = {
40680 .get_brightness = atmel_pwm_bl_get_intensity,
40681 .update_status = atmel_pwm_bl_set_intensity,
40682 };
40683 diff -urNp linux-2.6.32.49/drivers/video/backlight/backlight.c linux-2.6.32.49/drivers/video/backlight/backlight.c
40684 --- linux-2.6.32.49/drivers/video/backlight/backlight.c 2011-11-08 19:02:43.000000000 -0500
40685 +++ linux-2.6.32.49/drivers/video/backlight/backlight.c 2011-11-15 19:59:43.000000000 -0500
40686 @@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
40687 * ERR_PTR() or a pointer to the newly allocated device.
40688 */
40689 struct backlight_device *backlight_device_register(const char *name,
40690 - struct device *parent, void *devdata, struct backlight_ops *ops)
40691 + struct device *parent, void *devdata, const struct backlight_ops *ops)
40692 {
40693 struct backlight_device *new_bd;
40694 int rc;
40695 diff -urNp linux-2.6.32.49/drivers/video/backlight/corgi_lcd.c linux-2.6.32.49/drivers/video/backlight/corgi_lcd.c
40696 --- linux-2.6.32.49/drivers/video/backlight/corgi_lcd.c 2011-11-08 19:02:43.000000000 -0500
40697 +++ linux-2.6.32.49/drivers/video/backlight/corgi_lcd.c 2011-11-15 19:59:43.000000000 -0500
40698 @@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit
40699 }
40700 EXPORT_SYMBOL(corgi_lcd_limit_intensity);
40701
40702 -static struct backlight_ops corgi_bl_ops = {
40703 +static const struct backlight_ops corgi_bl_ops = {
40704 .get_brightness = corgi_bl_get_intensity,
40705 .update_status = corgi_bl_update_status,
40706 };
40707 diff -urNp linux-2.6.32.49/drivers/video/backlight/cr_bllcd.c linux-2.6.32.49/drivers/video/backlight/cr_bllcd.c
40708 --- linux-2.6.32.49/drivers/video/backlight/cr_bllcd.c 2011-11-08 19:02:43.000000000 -0500
40709 +++ linux-2.6.32.49/drivers/video/backlight/cr_bllcd.c 2011-11-15 19:59:43.000000000 -0500
40710 @@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(st
40711 return intensity;
40712 }
40713
40714 -static struct backlight_ops cr_backlight_ops = {
40715 +static const struct backlight_ops cr_backlight_ops = {
40716 .get_brightness = cr_backlight_get_intensity,
40717 .update_status = cr_backlight_set_intensity,
40718 };
40719 diff -urNp linux-2.6.32.49/drivers/video/backlight/da903x_bl.c linux-2.6.32.49/drivers/video/backlight/da903x_bl.c
40720 --- linux-2.6.32.49/drivers/video/backlight/da903x_bl.c 2011-11-08 19:02:43.000000000 -0500
40721 +++ linux-2.6.32.49/drivers/video/backlight/da903x_bl.c 2011-11-15 19:59:43.000000000 -0500
40722 @@ -94,7 +94,7 @@ static int da903x_backlight_get_brightne
40723 return data->current_brightness;
40724 }
40725
40726 -static struct backlight_ops da903x_backlight_ops = {
40727 +static const struct backlight_ops da903x_backlight_ops = {
40728 .update_status = da903x_backlight_update_status,
40729 .get_brightness = da903x_backlight_get_brightness,
40730 };
40731 diff -urNp linux-2.6.32.49/drivers/video/backlight/generic_bl.c linux-2.6.32.49/drivers/video/backlight/generic_bl.c
40732 --- linux-2.6.32.49/drivers/video/backlight/generic_bl.c 2011-11-08 19:02:43.000000000 -0500
40733 +++ linux-2.6.32.49/drivers/video/backlight/generic_bl.c 2011-11-15 19:59:43.000000000 -0500
40734 @@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
40735 }
40736 EXPORT_SYMBOL(corgibl_limit_intensity);
40737
40738 -static struct backlight_ops genericbl_ops = {
40739 +static const struct backlight_ops genericbl_ops = {
40740 .options = BL_CORE_SUSPENDRESUME,
40741 .get_brightness = genericbl_get_intensity,
40742 .update_status = genericbl_send_intensity,
40743 diff -urNp linux-2.6.32.49/drivers/video/backlight/hp680_bl.c linux-2.6.32.49/drivers/video/backlight/hp680_bl.c
40744 --- linux-2.6.32.49/drivers/video/backlight/hp680_bl.c 2011-11-08 19:02:43.000000000 -0500
40745 +++ linux-2.6.32.49/drivers/video/backlight/hp680_bl.c 2011-11-15 19:59:43.000000000 -0500
40746 @@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct
40747 return current_intensity;
40748 }
40749
40750 -static struct backlight_ops hp680bl_ops = {
40751 +static const struct backlight_ops hp680bl_ops = {
40752 .get_brightness = hp680bl_get_intensity,
40753 .update_status = hp680bl_set_intensity,
40754 };
40755 diff -urNp linux-2.6.32.49/drivers/video/backlight/jornada720_bl.c linux-2.6.32.49/drivers/video/backlight/jornada720_bl.c
40756 --- linux-2.6.32.49/drivers/video/backlight/jornada720_bl.c 2011-11-08 19:02:43.000000000 -0500
40757 +++ linux-2.6.32.49/drivers/video/backlight/jornada720_bl.c 2011-11-15 19:59:43.000000000 -0500
40758 @@ -93,7 +93,7 @@ out:
40759 return ret;
40760 }
40761
40762 -static struct backlight_ops jornada_bl_ops = {
40763 +static const struct backlight_ops jornada_bl_ops = {
40764 .get_brightness = jornada_bl_get_brightness,
40765 .update_status = jornada_bl_update_status,
40766 .options = BL_CORE_SUSPENDRESUME,
40767 diff -urNp linux-2.6.32.49/drivers/video/backlight/kb3886_bl.c linux-2.6.32.49/drivers/video/backlight/kb3886_bl.c
40768 --- linux-2.6.32.49/drivers/video/backlight/kb3886_bl.c 2011-11-08 19:02:43.000000000 -0500
40769 +++ linux-2.6.32.49/drivers/video/backlight/kb3886_bl.c 2011-11-15 19:59:43.000000000 -0500
40770 @@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct
40771 return kb3886bl_intensity;
40772 }
40773
40774 -static struct backlight_ops kb3886bl_ops = {
40775 +static const struct backlight_ops kb3886bl_ops = {
40776 .get_brightness = kb3886bl_get_intensity,
40777 .update_status = kb3886bl_send_intensity,
40778 };
40779 diff -urNp linux-2.6.32.49/drivers/video/backlight/locomolcd.c linux-2.6.32.49/drivers/video/backlight/locomolcd.c
40780 --- linux-2.6.32.49/drivers/video/backlight/locomolcd.c 2011-11-08 19:02:43.000000000 -0500
40781 +++ linux-2.6.32.49/drivers/video/backlight/locomolcd.c 2011-11-15 19:59:43.000000000 -0500
40782 @@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struc
40783 return current_intensity;
40784 }
40785
40786 -static struct backlight_ops locomobl_data = {
40787 +static const struct backlight_ops locomobl_data = {
40788 .get_brightness = locomolcd_get_intensity,
40789 .update_status = locomolcd_set_intensity,
40790 };
40791 diff -urNp linux-2.6.32.49/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.32.49/drivers/video/backlight/mbp_nvidia_bl.c
40792 --- linux-2.6.32.49/drivers/video/backlight/mbp_nvidia_bl.c 2011-11-08 19:02:43.000000000 -0500
40793 +++ linux-2.6.32.49/drivers/video/backlight/mbp_nvidia_bl.c 2011-11-15 19:59:43.000000000 -0500
40794 @@ -33,7 +33,7 @@ struct dmi_match_data {
40795 unsigned long iostart;
40796 unsigned long iolen;
40797 /* Backlight operations structure. */
40798 - struct backlight_ops backlight_ops;
40799 + const struct backlight_ops backlight_ops;
40800 };
40801
40802 /* Module parameters. */
40803 diff -urNp linux-2.6.32.49/drivers/video/backlight/omap1_bl.c linux-2.6.32.49/drivers/video/backlight/omap1_bl.c
40804 --- linux-2.6.32.49/drivers/video/backlight/omap1_bl.c 2011-11-08 19:02:43.000000000 -0500
40805 +++ linux-2.6.32.49/drivers/video/backlight/omap1_bl.c 2011-11-15 19:59:43.000000000 -0500
40806 @@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct b
40807 return bl->current_intensity;
40808 }
40809
40810 -static struct backlight_ops omapbl_ops = {
40811 +static const struct backlight_ops omapbl_ops = {
40812 .get_brightness = omapbl_get_intensity,
40813 .update_status = omapbl_update_status,
40814 };
40815 diff -urNp linux-2.6.32.49/drivers/video/backlight/progear_bl.c linux-2.6.32.49/drivers/video/backlight/progear_bl.c
40816 --- linux-2.6.32.49/drivers/video/backlight/progear_bl.c 2011-11-08 19:02:43.000000000 -0500
40817 +++ linux-2.6.32.49/drivers/video/backlight/progear_bl.c 2011-11-15 19:59:43.000000000 -0500
40818 @@ -54,7 +54,7 @@ static int progearbl_get_intensity(struc
40819 return intensity - HW_LEVEL_MIN;
40820 }
40821
40822 -static struct backlight_ops progearbl_ops = {
40823 +static const struct backlight_ops progearbl_ops = {
40824 .get_brightness = progearbl_get_intensity,
40825 .update_status = progearbl_set_intensity,
40826 };
40827 diff -urNp linux-2.6.32.49/drivers/video/backlight/pwm_bl.c linux-2.6.32.49/drivers/video/backlight/pwm_bl.c
40828 --- linux-2.6.32.49/drivers/video/backlight/pwm_bl.c 2011-11-08 19:02:43.000000000 -0500
40829 +++ linux-2.6.32.49/drivers/video/backlight/pwm_bl.c 2011-11-15 19:59:43.000000000 -0500
40830 @@ -56,7 +56,7 @@ static int pwm_backlight_get_brightness(
40831 return bl->props.brightness;
40832 }
40833
40834 -static struct backlight_ops pwm_backlight_ops = {
40835 +static const struct backlight_ops pwm_backlight_ops = {
40836 .update_status = pwm_backlight_update_status,
40837 .get_brightness = pwm_backlight_get_brightness,
40838 };
40839 diff -urNp linux-2.6.32.49/drivers/video/backlight/tosa_bl.c linux-2.6.32.49/drivers/video/backlight/tosa_bl.c
40840 --- linux-2.6.32.49/drivers/video/backlight/tosa_bl.c 2011-11-08 19:02:43.000000000 -0500
40841 +++ linux-2.6.32.49/drivers/video/backlight/tosa_bl.c 2011-11-15 19:59:43.000000000 -0500
40842 @@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct
40843 return props->brightness;
40844 }
40845
40846 -static struct backlight_ops bl_ops = {
40847 +static const struct backlight_ops bl_ops = {
40848 .get_brightness = tosa_bl_get_brightness,
40849 .update_status = tosa_bl_update_status,
40850 };
40851 diff -urNp linux-2.6.32.49/drivers/video/backlight/wm831x_bl.c linux-2.6.32.49/drivers/video/backlight/wm831x_bl.c
40852 --- linux-2.6.32.49/drivers/video/backlight/wm831x_bl.c 2011-11-08 19:02:43.000000000 -0500
40853 +++ linux-2.6.32.49/drivers/video/backlight/wm831x_bl.c 2011-11-15 19:59:43.000000000 -0500
40854 @@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightne
40855 return data->current_brightness;
40856 }
40857
40858 -static struct backlight_ops wm831x_backlight_ops = {
40859 +static const struct backlight_ops wm831x_backlight_ops = {
40860 .options = BL_CORE_SUSPENDRESUME,
40861 .update_status = wm831x_backlight_update_status,
40862 .get_brightness = wm831x_backlight_get_brightness,
40863 diff -urNp linux-2.6.32.49/drivers/video/bf54x-lq043fb.c linux-2.6.32.49/drivers/video/bf54x-lq043fb.c
40864 --- linux-2.6.32.49/drivers/video/bf54x-lq043fb.c 2011-11-08 19:02:43.000000000 -0500
40865 +++ linux-2.6.32.49/drivers/video/bf54x-lq043fb.c 2011-11-15 19:59:43.000000000 -0500
40866 @@ -463,7 +463,7 @@ static int bl_get_brightness(struct back
40867 return 0;
40868 }
40869
40870 -static struct backlight_ops bfin_lq043fb_bl_ops = {
40871 +static const struct backlight_ops bfin_lq043fb_bl_ops = {
40872 .get_brightness = bl_get_brightness,
40873 };
40874
40875 diff -urNp linux-2.6.32.49/drivers/video/bfin-t350mcqb-fb.c linux-2.6.32.49/drivers/video/bfin-t350mcqb-fb.c
40876 --- linux-2.6.32.49/drivers/video/bfin-t350mcqb-fb.c 2011-11-08 19:02:43.000000000 -0500
40877 +++ linux-2.6.32.49/drivers/video/bfin-t350mcqb-fb.c 2011-11-15 19:59:43.000000000 -0500
40878 @@ -381,7 +381,7 @@ static int bl_get_brightness(struct back
40879 return 0;
40880 }
40881
40882 -static struct backlight_ops bfin_lq043fb_bl_ops = {
40883 +static const struct backlight_ops bfin_lq043fb_bl_ops = {
40884 .get_brightness = bl_get_brightness,
40885 };
40886
40887 diff -urNp linux-2.6.32.49/drivers/video/fbcmap.c linux-2.6.32.49/drivers/video/fbcmap.c
40888 --- linux-2.6.32.49/drivers/video/fbcmap.c 2011-11-08 19:02:43.000000000 -0500
40889 +++ linux-2.6.32.49/drivers/video/fbcmap.c 2011-11-15 19:59:43.000000000 -0500
40890 @@ -266,8 +266,7 @@ int fb_set_user_cmap(struct fb_cmap_user
40891 rc = -ENODEV;
40892 goto out;
40893 }
40894 - if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
40895 - !info->fbops->fb_setcmap)) {
40896 + if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
40897 rc = -EINVAL;
40898 goto out1;
40899 }
40900 diff -urNp linux-2.6.32.49/drivers/video/fbmem.c linux-2.6.32.49/drivers/video/fbmem.c
40901 --- linux-2.6.32.49/drivers/video/fbmem.c 2011-11-08 19:02:43.000000000 -0500
40902 +++ linux-2.6.32.49/drivers/video/fbmem.c 2011-11-15 19:59:43.000000000 -0500
40903 @@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_in
40904 image->dx += image->width + 8;
40905 }
40906 } else if (rotate == FB_ROTATE_UD) {
40907 - for (x = 0; x < num && image->dx >= 0; x++) {
40908 + for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
40909 info->fbops->fb_imageblit(info, image);
40910 image->dx -= image->width + 8;
40911 }
40912 @@ -415,7 +415,7 @@ static void fb_do_show_logo(struct fb_in
40913 image->dy += image->height + 8;
40914 }
40915 } else if (rotate == FB_ROTATE_CCW) {
40916 - for (x = 0; x < num && image->dy >= 0; x++) {
40917 + for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
40918 info->fbops->fb_imageblit(info, image);
40919 image->dy -= image->height + 8;
40920 }
40921 @@ -915,6 +915,8 @@ fb_set_var(struct fb_info *info, struct
40922 int flags = info->flags;
40923 int ret = 0;
40924
40925 + pax_track_stack();
40926 +
40927 if (var->activate & FB_ACTIVATE_INV_MODE) {
40928 struct fb_videomode mode1, mode2;
40929
40930 @@ -1040,6 +1042,8 @@ static long do_fb_ioctl(struct fb_info *
40931 void __user *argp = (void __user *)arg;
40932 long ret = 0;
40933
40934 + pax_track_stack();
40935 +
40936 switch (cmd) {
40937 case FBIOGET_VSCREENINFO:
40938 if (!lock_fb_info(info))
40939 @@ -1119,7 +1123,7 @@ static long do_fb_ioctl(struct fb_info *
40940 return -EFAULT;
40941 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
40942 return -EINVAL;
40943 - if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
40944 + if (con2fb.framebuffer >= FB_MAX)
40945 return -EINVAL;
40946 if (!registered_fb[con2fb.framebuffer])
40947 request_module("fb%d", con2fb.framebuffer);
40948 diff -urNp linux-2.6.32.49/drivers/video/geode/gx1fb_core.c linux-2.6.32.49/drivers/video/geode/gx1fb_core.c
40949 --- linux-2.6.32.49/drivers/video/geode/gx1fb_core.c 2011-11-08 19:02:43.000000000 -0500
40950 +++ linux-2.6.32.49/drivers/video/geode/gx1fb_core.c 2011-11-18 18:01:55.000000000 -0500
40951 @@ -30,7 +30,7 @@ static int crt_option = 1;
40952 static char panel_option[32] = "";
40953
40954 /* Modes relevant to the GX1 (taken from modedb.c) */
40955 -static const struct fb_videomode __initdata gx1_modedb[] = {
40956 +static const struct fb_videomode __initconst gx1_modedb[] = {
40957 /* 640x480-60 VESA */
40958 { NULL, 60, 640, 480, 39682, 48, 16, 33, 10, 96, 2,
40959 0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
40960 diff -urNp linux-2.6.32.49/drivers/video/gxt4500.c linux-2.6.32.49/drivers/video/gxt4500.c
40961 --- linux-2.6.32.49/drivers/video/gxt4500.c 2011-11-08 19:02:43.000000000 -0500
40962 +++ linux-2.6.32.49/drivers/video/gxt4500.c 2011-11-18 18:01:55.000000000 -0500
40963 @@ -156,7 +156,7 @@ struct gxt4500_par {
40964 static char *mode_option;
40965
40966 /* default mode: 1280x1024 @ 60 Hz, 8 bpp */
40967 -static const struct fb_videomode defaultmode __devinitdata = {
40968 +static const struct fb_videomode defaultmode __devinitconst = {
40969 .refresh = 60,
40970 .xres = 1280,
40971 .yres = 1024,
40972 @@ -581,7 +581,7 @@ static int gxt4500_blank(int blank, stru
40973 return 0;
40974 }
40975
40976 -static const struct fb_fix_screeninfo gxt4500_fix __devinitdata = {
40977 +static const struct fb_fix_screeninfo gxt4500_fix __devinitconst = {
40978 .id = "IBM GXT4500P",
40979 .type = FB_TYPE_PACKED_PIXELS,
40980 .visual = FB_VISUAL_PSEUDOCOLOR,
40981 diff -urNp linux-2.6.32.49/drivers/video/i810/i810_accel.c linux-2.6.32.49/drivers/video/i810/i810_accel.c
40982 --- linux-2.6.32.49/drivers/video/i810/i810_accel.c 2011-11-08 19:02:43.000000000 -0500
40983 +++ linux-2.6.32.49/drivers/video/i810/i810_accel.c 2011-11-15 19:59:43.000000000 -0500
40984 @@ -73,6 +73,7 @@ static inline int wait_for_space(struct
40985 }
40986 }
40987 printk("ringbuffer lockup!!!\n");
40988 + printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
40989 i810_report_error(mmio);
40990 par->dev_flags |= LOCKUP;
40991 info->pixmap.scan_align = 1;
40992 diff -urNp linux-2.6.32.49/drivers/video/i810/i810_main.c linux-2.6.32.49/drivers/video/i810/i810_main.c
40993 --- linux-2.6.32.49/drivers/video/i810/i810_main.c 2011-11-08 19:02:43.000000000 -0500
40994 +++ linux-2.6.32.49/drivers/video/i810/i810_main.c 2011-11-18 18:01:55.000000000 -0500
40995 @@ -97,7 +97,7 @@ static int i810fb_blank (int blank_
40996 static void i810fb_release_resource (struct fb_info *info, struct i810fb_par *par);
40997
40998 /* PCI */
40999 -static const char *i810_pci_list[] __devinitdata = {
41000 +static const char *i810_pci_list[] __devinitconst = {
41001 "Intel(R) 810 Framebuffer Device" ,
41002 "Intel(R) 810-DC100 Framebuffer Device" ,
41003 "Intel(R) 810E Framebuffer Device" ,
41004 diff -urNp linux-2.6.32.49/drivers/video/logo/logo_linux_clut224.ppm linux-2.6.32.49/drivers/video/logo/logo_linux_clut224.ppm
41005 --- linux-2.6.32.49/drivers/video/logo/logo_linux_clut224.ppm 2011-11-08 19:02:43.000000000 -0500
41006 +++ linux-2.6.32.49/drivers/video/logo/logo_linux_clut224.ppm 2011-11-15 19:59:43.000000000 -0500
41007 @@ -1,1604 +1,1123 @@
41008 P3
41009 -# Standard 224-color Linux logo
41010 80 80
41011 255
41012 - 0 0 0 0 0 0 0 0 0 0 0 0
41013 - 0 0 0 0 0 0 0 0 0 0 0 0
41014 - 0 0 0 0 0 0 0 0 0 0 0 0
41015 - 0 0 0 0 0 0 0 0 0 0 0 0
41016 - 0 0 0 0 0 0 0 0 0 0 0 0
41017 - 0 0 0 0 0 0 0 0 0 0 0 0
41018 - 0 0 0 0 0 0 0 0 0 0 0 0
41019 - 0 0 0 0 0 0 0 0 0 0 0 0
41020 - 0 0 0 0 0 0 0 0 0 0 0 0
41021 - 6 6 6 6 6 6 10 10 10 10 10 10
41022 - 10 10 10 6 6 6 6 6 6 6 6 6
41023 - 0 0 0 0 0 0 0 0 0 0 0 0
41024 - 0 0 0 0 0 0 0 0 0 0 0 0
41025 - 0 0 0 0 0 0 0 0 0 0 0 0
41026 - 0 0 0 0 0 0 0 0 0 0 0 0
41027 - 0 0 0 0 0 0 0 0 0 0 0 0
41028 - 0 0 0 0 0 0 0 0 0 0 0 0
41029 - 0 0 0 0 0 0 0 0 0 0 0 0
41030 - 0 0 0 0 0 0 0 0 0 0 0 0
41031 - 0 0 0 0 0 0 0 0 0 0 0 0
41032 - 0 0 0 0 0 0 0 0 0 0 0 0
41033 - 0 0 0 0 0 0 0 0 0 0 0 0
41034 - 0 0 0 0 0 0 0 0 0 0 0 0
41035 - 0 0 0 0 0 0 0 0 0 0 0 0
41036 - 0 0 0 0 0 0 0 0 0 0 0 0
41037 - 0 0 0 0 0 0 0 0 0 0 0 0
41038 - 0 0 0 0 0 0 0 0 0 0 0 0
41039 - 0 0 0 0 0 0 0 0 0 0 0 0
41040 - 0 0 0 6 6 6 10 10 10 14 14 14
41041 - 22 22 22 26 26 26 30 30 30 34 34 34
41042 - 30 30 30 30 30 30 26 26 26 18 18 18
41043 - 14 14 14 10 10 10 6 6 6 0 0 0
41044 - 0 0 0 0 0 0 0 0 0 0 0 0
41045 - 0 0 0 0 0 0 0 0 0 0 0 0
41046 - 0 0 0 0 0 0 0 0 0 0 0 0
41047 - 0 0 0 0 0 0 0 0 0 0 0 0
41048 - 0 0 0 0 0 0 0 0 0 0 0 0
41049 - 0 0 0 0 0 0 0 0 0 0 0 0
41050 - 0 0 0 0 0 0 0 0 0 0 0 0
41051 - 0 0 0 0 0 0 0 0 0 0 0 0
41052 - 0 0 0 0 0 0 0 0 0 0 0 0
41053 - 0 0 0 0 0 1 0 0 1 0 0 0
41054 - 0 0 0 0 0 0 0 0 0 0 0 0
41055 - 0 0 0 0 0 0 0 0 0 0 0 0
41056 - 0 0 0 0 0 0 0 0 0 0 0 0
41057 - 0 0 0 0 0 0 0 0 0 0 0 0
41058 - 0 0 0 0 0 0 0 0 0 0 0 0
41059 - 0 0 0 0 0 0 0 0 0 0 0 0
41060 - 6 6 6 14 14 14 26 26 26 42 42 42
41061 - 54 54 54 66 66 66 78 78 78 78 78 78
41062 - 78 78 78 74 74 74 66 66 66 54 54 54
41063 - 42 42 42 26 26 26 18 18 18 10 10 10
41064 - 6 6 6 0 0 0 0 0 0 0 0 0
41065 - 0 0 0 0 0 0 0 0 0 0 0 0
41066 - 0 0 0 0 0 0 0 0 0 0 0 0
41067 - 0 0 0 0 0 0 0 0 0 0 0 0
41068 - 0 0 0 0 0 0 0 0 0 0 0 0
41069 - 0 0 0 0 0 0 0 0 0 0 0 0
41070 - 0 0 0 0 0 0 0 0 0 0 0 0
41071 - 0 0 0 0 0 0 0 0 0 0 0 0
41072 - 0 0 0 0 0 0 0 0 0 0 0 0
41073 - 0 0 1 0 0 0 0 0 0 0 0 0
41074 - 0 0 0 0 0 0 0 0 0 0 0 0
41075 - 0 0 0 0 0 0 0 0 0 0 0 0
41076 - 0 0 0 0 0 0 0 0 0 0 0 0
41077 - 0 0 0 0 0 0 0 0 0 0 0 0
41078 - 0 0 0 0 0 0 0 0 0 0 0 0
41079 - 0 0 0 0 0 0 0 0 0 10 10 10
41080 - 22 22 22 42 42 42 66 66 66 86 86 86
41081 - 66 66 66 38 38 38 38 38 38 22 22 22
41082 - 26 26 26 34 34 34 54 54 54 66 66 66
41083 - 86 86 86 70 70 70 46 46 46 26 26 26
41084 - 14 14 14 6 6 6 0 0 0 0 0 0
41085 - 0 0 0 0 0 0 0 0 0 0 0 0
41086 - 0 0 0 0 0 0 0 0 0 0 0 0
41087 - 0 0 0 0 0 0 0 0 0 0 0 0
41088 - 0 0 0 0 0 0 0 0 0 0 0 0
41089 - 0 0 0 0 0 0 0 0 0 0 0 0
41090 - 0 0 0 0 0 0 0 0 0 0 0 0
41091 - 0 0 0 0 0 0 0 0 0 0 0 0
41092 - 0 0 0 0 0 0 0 0 0 0 0 0
41093 - 0 0 1 0 0 1 0 0 1 0 0 0
41094 - 0 0 0 0 0 0 0 0 0 0 0 0
41095 - 0 0 0 0 0 0 0 0 0 0 0 0
41096 - 0 0 0 0 0 0 0 0 0 0 0 0
41097 - 0 0 0 0 0 0 0 0 0 0 0 0
41098 - 0 0 0 0 0 0 0 0 0 0 0 0
41099 - 0 0 0 0 0 0 10 10 10 26 26 26
41100 - 50 50 50 82 82 82 58 58 58 6 6 6
41101 - 2 2 6 2 2 6 2 2 6 2 2 6
41102 - 2 2 6 2 2 6 2 2 6 2 2 6
41103 - 6 6 6 54 54 54 86 86 86 66 66 66
41104 - 38 38 38 18 18 18 6 6 6 0 0 0
41105 - 0 0 0 0 0 0 0 0 0 0 0 0
41106 - 0 0 0 0 0 0 0 0 0 0 0 0
41107 - 0 0 0 0 0 0 0 0 0 0 0 0
41108 - 0 0 0 0 0 0 0 0 0 0 0 0
41109 - 0 0 0 0 0 0 0 0 0 0 0 0
41110 - 0 0 0 0 0 0 0 0 0 0 0 0
41111 - 0 0 0 0 0 0 0 0 0 0 0 0
41112 - 0 0 0 0 0 0 0 0 0 0 0 0
41113 - 0 0 0 0 0 0 0 0 0 0 0 0
41114 - 0 0 0 0 0 0 0 0 0 0 0 0
41115 - 0 0 0 0 0 0 0 0 0 0 0 0
41116 - 0 0 0 0 0 0 0 0 0 0 0 0
41117 - 0 0 0 0 0 0 0 0 0 0 0 0
41118 - 0 0 0 0 0 0 0 0 0 0 0 0
41119 - 0 0 0 6 6 6 22 22 22 50 50 50
41120 - 78 78 78 34 34 34 2 2 6 2 2 6
41121 - 2 2 6 2 2 6 2 2 6 2 2 6
41122 - 2 2 6 2 2 6 2 2 6 2 2 6
41123 - 2 2 6 2 2 6 6 6 6 70 70 70
41124 - 78 78 78 46 46 46 22 22 22 6 6 6
41125 - 0 0 0 0 0 0 0 0 0 0 0 0
41126 - 0 0 0 0 0 0 0 0 0 0 0 0
41127 - 0 0 0 0 0 0 0 0 0 0 0 0
41128 - 0 0 0 0 0 0 0 0 0 0 0 0
41129 - 0 0 0 0 0 0 0 0 0 0 0 0
41130 - 0 0 0 0 0 0 0 0 0 0 0 0
41131 - 0 0 0 0 0 0 0 0 0 0 0 0
41132 - 0 0 0 0 0 0 0 0 0 0 0 0
41133 - 0 0 1 0 0 1 0 0 1 0 0 0
41134 - 0 0 0 0 0 0 0 0 0 0 0 0
41135 - 0 0 0 0 0 0 0 0 0 0 0 0
41136 - 0 0 0 0 0 0 0 0 0 0 0 0
41137 - 0 0 0 0 0 0 0 0 0 0 0 0
41138 - 0 0 0 0 0 0 0 0 0 0 0 0
41139 - 6 6 6 18 18 18 42 42 42 82 82 82
41140 - 26 26 26 2 2 6 2 2 6 2 2 6
41141 - 2 2 6 2 2 6 2 2 6 2 2 6
41142 - 2 2 6 2 2 6 2 2 6 14 14 14
41143 - 46 46 46 34 34 34 6 6 6 2 2 6
41144 - 42 42 42 78 78 78 42 42 42 18 18 18
41145 - 6 6 6 0 0 0 0 0 0 0 0 0
41146 - 0 0 0 0 0 0 0 0 0 0 0 0
41147 - 0 0 0 0 0 0 0 0 0 0 0 0
41148 - 0 0 0 0 0 0 0 0 0 0 0 0
41149 - 0 0 0 0 0 0 0 0 0 0 0 0
41150 - 0 0 0 0 0 0 0 0 0 0 0 0
41151 - 0 0 0 0 0 0 0 0 0 0 0 0
41152 - 0 0 0 0 0 0 0 0 0 0 0 0
41153 - 0 0 1 0 0 0 0 0 1 0 0 0
41154 - 0 0 0 0 0 0 0 0 0 0 0 0
41155 - 0 0 0 0 0 0 0 0 0 0 0 0
41156 - 0 0 0 0 0 0 0 0 0 0 0 0
41157 - 0 0 0 0 0 0 0 0 0 0 0 0
41158 - 0 0 0 0 0 0 0 0 0 0 0 0
41159 - 10 10 10 30 30 30 66 66 66 58 58 58
41160 - 2 2 6 2 2 6 2 2 6 2 2 6
41161 - 2 2 6 2 2 6 2 2 6 2 2 6
41162 - 2 2 6 2 2 6 2 2 6 26 26 26
41163 - 86 86 86 101 101 101 46 46 46 10 10 10
41164 - 2 2 6 58 58 58 70 70 70 34 34 34
41165 - 10 10 10 0 0 0 0 0 0 0 0 0
41166 - 0 0 0 0 0 0 0 0 0 0 0 0
41167 - 0 0 0 0 0 0 0 0 0 0 0 0
41168 - 0 0 0 0 0 0 0 0 0 0 0 0
41169 - 0 0 0 0 0 0 0 0 0 0 0 0
41170 - 0 0 0 0 0 0 0 0 0 0 0 0
41171 - 0 0 0 0 0 0 0 0 0 0 0 0
41172 - 0 0 0 0 0 0 0 0 0 0 0 0
41173 - 0 0 1 0 0 1 0 0 1 0 0 0
41174 - 0 0 0 0 0 0 0 0 0 0 0 0
41175 - 0 0 0 0 0 0 0 0 0 0 0 0
41176 - 0 0 0 0 0 0 0 0 0 0 0 0
41177 - 0 0 0 0 0 0 0 0 0 0 0 0
41178 - 0 0 0 0 0 0 0 0 0 0 0 0
41179 - 14 14 14 42 42 42 86 86 86 10 10 10
41180 - 2 2 6 2 2 6 2 2 6 2 2 6
41181 - 2 2 6 2 2 6 2 2 6 2 2 6
41182 - 2 2 6 2 2 6 2 2 6 30 30 30
41183 - 94 94 94 94 94 94 58 58 58 26 26 26
41184 - 2 2 6 6 6 6 78 78 78 54 54 54
41185 - 22 22 22 6 6 6 0 0 0 0 0 0
41186 - 0 0 0 0 0 0 0 0 0 0 0 0
41187 - 0 0 0 0 0 0 0 0 0 0 0 0
41188 - 0 0 0 0 0 0 0 0 0 0 0 0
41189 - 0 0 0 0 0 0 0 0 0 0 0 0
41190 - 0 0 0 0 0 0 0 0 0 0 0 0
41191 - 0 0 0 0 0 0 0 0 0 0 0 0
41192 - 0 0 0 0 0 0 0 0 0 0 0 0
41193 - 0 0 0 0 0 0 0 0 0 0 0 0
41194 - 0 0 0 0 0 0 0 0 0 0 0 0
41195 - 0 0 0 0 0 0 0 0 0 0 0 0
41196 - 0 0 0 0 0 0 0 0 0 0 0 0
41197 - 0 0 0 0 0 0 0 0 0 0 0 0
41198 - 0 0 0 0 0 0 0 0 0 6 6 6
41199 - 22 22 22 62 62 62 62 62 62 2 2 6
41200 - 2 2 6 2 2 6 2 2 6 2 2 6
41201 - 2 2 6 2 2 6 2 2 6 2 2 6
41202 - 2 2 6 2 2 6 2 2 6 26 26 26
41203 - 54 54 54 38 38 38 18 18 18 10 10 10
41204 - 2 2 6 2 2 6 34 34 34 82 82 82
41205 - 38 38 38 14 14 14 0 0 0 0 0 0
41206 - 0 0 0 0 0 0 0 0 0 0 0 0
41207 - 0 0 0 0 0 0 0 0 0 0 0 0
41208 - 0 0 0 0 0 0 0 0 0 0 0 0
41209 - 0 0 0 0 0 0 0 0 0 0 0 0
41210 - 0 0 0 0 0 0 0 0 0 0 0 0
41211 - 0 0 0 0 0 0 0 0 0 0 0 0
41212 - 0 0 0 0 0 0 0 0 0 0 0 0
41213 - 0 0 0 0 0 1 0 0 1 0 0 0
41214 - 0 0 0 0 0 0 0 0 0 0 0 0
41215 - 0 0 0 0 0 0 0 0 0 0 0 0
41216 - 0 0 0 0 0 0 0 0 0 0 0 0
41217 - 0 0 0 0 0 0 0 0 0 0 0 0
41218 - 0 0 0 0 0 0 0 0 0 6 6 6
41219 - 30 30 30 78 78 78 30 30 30 2 2 6
41220 - 2 2 6 2 2 6 2 2 6 2 2 6
41221 - 2 2 6 2 2 6 2 2 6 2 2 6
41222 - 2 2 6 2 2 6 2 2 6 10 10 10
41223 - 10 10 10 2 2 6 2 2 6 2 2 6
41224 - 2 2 6 2 2 6 2 2 6 78 78 78
41225 - 50 50 50 18 18 18 6 6 6 0 0 0
41226 - 0 0 0 0 0 0 0 0 0 0 0 0
41227 - 0 0 0 0 0 0 0 0 0 0 0 0
41228 - 0 0 0 0 0 0 0 0 0 0 0 0
41229 - 0 0 0 0 0 0 0 0 0 0 0 0
41230 - 0 0 0 0 0 0 0 0 0 0 0 0
41231 - 0 0 0 0 0 0 0 0 0 0 0 0
41232 - 0 0 0 0 0 0 0 0 0 0 0 0
41233 - 0 0 1 0 0 0 0 0 0 0 0 0
41234 - 0 0 0 0 0 0 0 0 0 0 0 0
41235 - 0 0 0 0 0 0 0 0 0 0 0 0
41236 - 0 0 0 0 0 0 0 0 0 0 0 0
41237 - 0 0 0 0 0 0 0 0 0 0 0 0
41238 - 0 0 0 0 0 0 0 0 0 10 10 10
41239 - 38 38 38 86 86 86 14 14 14 2 2 6
41240 - 2 2 6 2 2 6 2 2 6 2 2 6
41241 - 2 2 6 2 2 6 2 2 6 2 2 6
41242 - 2 2 6 2 2 6 2 2 6 2 2 6
41243 - 2 2 6 2 2 6 2 2 6 2 2 6
41244 - 2 2 6 2 2 6 2 2 6 54 54 54
41245 - 66 66 66 26 26 26 6 6 6 0 0 0
41246 - 0 0 0 0 0 0 0 0 0 0 0 0
41247 - 0 0 0 0 0 0 0 0 0 0 0 0
41248 - 0 0 0 0 0 0 0 0 0 0 0 0
41249 - 0 0 0 0 0 0 0 0 0 0 0 0
41250 - 0 0 0 0 0 0 0 0 0 0 0 0
41251 - 0 0 0 0 0 0 0 0 0 0 0 0
41252 - 0 0 0 0 0 0 0 0 0 0 0 0
41253 - 0 0 0 0 0 1 0 0 1 0 0 0
41254 - 0 0 0 0 0 0 0 0 0 0 0 0
41255 - 0 0 0 0 0 0 0 0 0 0 0 0
41256 - 0 0 0 0 0 0 0 0 0 0 0 0
41257 - 0 0 0 0 0 0 0 0 0 0 0 0
41258 - 0 0 0 0 0 0 0 0 0 14 14 14
41259 - 42 42 42 82 82 82 2 2 6 2 2 6
41260 - 2 2 6 6 6 6 10 10 10 2 2 6
41261 - 2 2 6 2 2 6 2 2 6 2 2 6
41262 - 2 2 6 2 2 6 2 2 6 6 6 6
41263 - 14 14 14 10 10 10 2 2 6 2 2 6
41264 - 2 2 6 2 2 6 2 2 6 18 18 18
41265 - 82 82 82 34 34 34 10 10 10 0 0 0
41266 - 0 0 0 0 0 0 0 0 0 0 0 0
41267 - 0 0 0 0 0 0 0 0 0 0 0 0
41268 - 0 0 0 0 0 0 0 0 0 0 0 0
41269 - 0 0 0 0 0 0 0 0 0 0 0 0
41270 - 0 0 0 0 0 0 0 0 0 0 0 0
41271 - 0 0 0 0 0 0 0 0 0 0 0 0
41272 - 0 0 0 0 0 0 0 0 0 0 0 0
41273 - 0 0 1 0 0 0 0 0 0 0 0 0
41274 - 0 0 0 0 0 0 0 0 0 0 0 0
41275 - 0 0 0 0 0 0 0 0 0 0 0 0
41276 - 0 0 0 0 0 0 0 0 0 0 0 0
41277 - 0 0 0 0 0 0 0 0 0 0 0 0
41278 - 0 0 0 0 0 0 0 0 0 14 14 14
41279 - 46 46 46 86 86 86 2 2 6 2 2 6
41280 - 6 6 6 6 6 6 22 22 22 34 34 34
41281 - 6 6 6 2 2 6 2 2 6 2 2 6
41282 - 2 2 6 2 2 6 18 18 18 34 34 34
41283 - 10 10 10 50 50 50 22 22 22 2 2 6
41284 - 2 2 6 2 2 6 2 2 6 10 10 10
41285 - 86 86 86 42 42 42 14 14 14 0 0 0
41286 - 0 0 0 0 0 0 0 0 0 0 0 0
41287 - 0 0 0 0 0 0 0 0 0 0 0 0
41288 - 0 0 0 0 0 0 0 0 0 0 0 0
41289 - 0 0 0 0 0 0 0 0 0 0 0 0
41290 - 0 0 0 0 0 0 0 0 0 0 0 0
41291 - 0 0 0 0 0 0 0 0 0 0 0 0
41292 - 0 0 0 0 0 0 0 0 0 0 0 0
41293 - 0 0 1 0 0 1 0 0 1 0 0 0
41294 - 0 0 0 0 0 0 0 0 0 0 0 0
41295 - 0 0 0 0 0 0 0 0 0 0 0 0
41296 - 0 0 0 0 0 0 0 0 0 0 0 0
41297 - 0 0 0 0 0 0 0 0 0 0 0 0
41298 - 0 0 0 0 0 0 0 0 0 14 14 14
41299 - 46 46 46 86 86 86 2 2 6 2 2 6
41300 - 38 38 38 116 116 116 94 94 94 22 22 22
41301 - 22 22 22 2 2 6 2 2 6 2 2 6
41302 - 14 14 14 86 86 86 138 138 138 162 162 162
41303 -154 154 154 38 38 38 26 26 26 6 6 6
41304 - 2 2 6 2 2 6 2 2 6 2 2 6
41305 - 86 86 86 46 46 46 14 14 14 0 0 0
41306 - 0 0 0 0 0 0 0 0 0 0 0 0
41307 - 0 0 0 0 0 0 0 0 0 0 0 0
41308 - 0 0 0 0 0 0 0 0 0 0 0 0
41309 - 0 0 0 0 0 0 0 0 0 0 0 0
41310 - 0 0 0 0 0 0 0 0 0 0 0 0
41311 - 0 0 0 0 0 0 0 0 0 0 0 0
41312 - 0 0 0 0 0 0 0 0 0 0 0 0
41313 - 0 0 0 0 0 0 0 0 0 0 0 0
41314 - 0 0 0 0 0 0 0 0 0 0 0 0
41315 - 0 0 0 0 0 0 0 0 0 0 0 0
41316 - 0 0 0 0 0 0 0 0 0 0 0 0
41317 - 0 0 0 0 0 0 0 0 0 0 0 0
41318 - 0 0 0 0 0 0 0 0 0 14 14 14
41319 - 46 46 46 86 86 86 2 2 6 14 14 14
41320 -134 134 134 198 198 198 195 195 195 116 116 116
41321 - 10 10 10 2 2 6 2 2 6 6 6 6
41322 -101 98 89 187 187 187 210 210 210 218 218 218
41323 -214 214 214 134 134 134 14 14 14 6 6 6
41324 - 2 2 6 2 2 6 2 2 6 2 2 6
41325 - 86 86 86 50 50 50 18 18 18 6 6 6
41326 - 0 0 0 0 0 0 0 0 0 0 0 0
41327 - 0 0 0 0 0 0 0 0 0 0 0 0
41328 - 0 0 0 0 0 0 0 0 0 0 0 0
41329 - 0 0 0 0 0 0 0 0 0 0 0 0
41330 - 0 0 0 0 0 0 0 0 0 0 0 0
41331 - 0 0 0 0 0 0 0 0 0 0 0 0
41332 - 0 0 0 0 0 0 0 0 1 0 0 0
41333 - 0 0 1 0 0 1 0 0 1 0 0 0
41334 - 0 0 0 0 0 0 0 0 0 0 0 0
41335 - 0 0 0 0 0 0 0 0 0 0 0 0
41336 - 0 0 0 0 0 0 0 0 0 0 0 0
41337 - 0 0 0 0 0 0 0 0 0 0 0 0
41338 - 0 0 0 0 0 0 0 0 0 14 14 14
41339 - 46 46 46 86 86 86 2 2 6 54 54 54
41340 -218 218 218 195 195 195 226 226 226 246 246 246
41341 - 58 58 58 2 2 6 2 2 6 30 30 30
41342 -210 210 210 253 253 253 174 174 174 123 123 123
41343 -221 221 221 234 234 234 74 74 74 2 2 6
41344 - 2 2 6 2 2 6 2 2 6 2 2 6
41345 - 70 70 70 58 58 58 22 22 22 6 6 6
41346 - 0 0 0 0 0 0 0 0 0 0 0 0
41347 - 0 0 0 0 0 0 0 0 0 0 0 0
41348 - 0 0 0 0 0 0 0 0 0 0 0 0
41349 - 0 0 0 0 0 0 0 0 0 0 0 0
41350 - 0 0 0 0 0 0 0 0 0 0 0 0
41351 - 0 0 0 0 0 0 0 0 0 0 0 0
41352 - 0 0 0 0 0 0 0 0 0 0 0 0
41353 - 0 0 0 0 0 0 0 0 0 0 0 0
41354 - 0 0 0 0 0 0 0 0 0 0 0 0
41355 - 0 0 0 0 0 0 0 0 0 0 0 0
41356 - 0 0 0 0 0 0 0 0 0 0 0 0
41357 - 0 0 0 0 0 0 0 0 0 0 0 0
41358 - 0 0 0 0 0 0 0 0 0 14 14 14
41359 - 46 46 46 82 82 82 2 2 6 106 106 106
41360 -170 170 170 26 26 26 86 86 86 226 226 226
41361 -123 123 123 10 10 10 14 14 14 46 46 46
41362 -231 231 231 190 190 190 6 6 6 70 70 70
41363 - 90 90 90 238 238 238 158 158 158 2 2 6
41364 - 2 2 6 2 2 6 2 2 6 2 2 6
41365 - 70 70 70 58 58 58 22 22 22 6 6 6
41366 - 0 0 0 0 0 0 0 0 0 0 0 0
41367 - 0 0 0 0 0 0 0 0 0 0 0 0
41368 - 0 0 0 0 0 0 0 0 0 0 0 0
41369 - 0 0 0 0 0 0 0 0 0 0 0 0
41370 - 0 0 0 0 0 0 0 0 0 0 0 0
41371 - 0 0 0 0 0 0 0 0 0 0 0 0
41372 - 0 0 0 0 0 0 0 0 1 0 0 0
41373 - 0 0 1 0 0 1 0 0 1 0 0 0
41374 - 0 0 0 0 0 0 0 0 0 0 0 0
41375 - 0 0 0 0 0 0 0 0 0 0 0 0
41376 - 0 0 0 0 0 0 0 0 0 0 0 0
41377 - 0 0 0 0 0 0 0 0 0 0 0 0
41378 - 0 0 0 0 0 0 0 0 0 14 14 14
41379 - 42 42 42 86 86 86 6 6 6 116 116 116
41380 -106 106 106 6 6 6 70 70 70 149 149 149
41381 -128 128 128 18 18 18 38 38 38 54 54 54
41382 -221 221 221 106 106 106 2 2 6 14 14 14
41383 - 46 46 46 190 190 190 198 198 198 2 2 6
41384 - 2 2 6 2 2 6 2 2 6 2 2 6
41385 - 74 74 74 62 62 62 22 22 22 6 6 6
41386 - 0 0 0 0 0 0 0 0 0 0 0 0
41387 - 0 0 0 0 0 0 0 0 0 0 0 0
41388 - 0 0 0 0 0 0 0 0 0 0 0 0
41389 - 0 0 0 0 0 0 0 0 0 0 0 0
41390 - 0 0 0 0 0 0 0 0 0 0 0 0
41391 - 0 0 0 0 0 0 0 0 0 0 0 0
41392 - 0 0 0 0 0 0 0 0 1 0 0 0
41393 - 0 0 1 0 0 0 0 0 1 0 0 0
41394 - 0 0 0 0 0 0 0 0 0 0 0 0
41395 - 0 0 0 0 0 0 0 0 0 0 0 0
41396 - 0 0 0 0 0 0 0 0 0 0 0 0
41397 - 0 0 0 0 0 0 0 0 0 0 0 0
41398 - 0 0 0 0 0 0 0 0 0 14 14 14
41399 - 42 42 42 94 94 94 14 14 14 101 101 101
41400 -128 128 128 2 2 6 18 18 18 116 116 116
41401 -118 98 46 121 92 8 121 92 8 98 78 10
41402 -162 162 162 106 106 106 2 2 6 2 2 6
41403 - 2 2 6 195 195 195 195 195 195 6 6 6
41404 - 2 2 6 2 2 6 2 2 6 2 2 6
41405 - 74 74 74 62 62 62 22 22 22 6 6 6
41406 - 0 0 0 0 0 0 0 0 0 0 0 0
41407 - 0 0 0 0 0 0 0 0 0 0 0 0
41408 - 0 0 0 0 0 0 0 0 0 0 0 0
41409 - 0 0 0 0 0 0 0 0 0 0 0 0
41410 - 0 0 0 0 0 0 0 0 0 0 0 0
41411 - 0 0 0 0 0 0 0 0 0 0 0 0
41412 - 0 0 0 0 0 0 0 0 1 0 0 1
41413 - 0 0 1 0 0 0 0 0 1 0 0 0
41414 - 0 0 0 0 0 0 0 0 0 0 0 0
41415 - 0 0 0 0 0 0 0 0 0 0 0 0
41416 - 0 0 0 0 0 0 0 0 0 0 0 0
41417 - 0 0 0 0 0 0 0 0 0 0 0 0
41418 - 0 0 0 0 0 0 0 0 0 10 10 10
41419 - 38 38 38 90 90 90 14 14 14 58 58 58
41420 -210 210 210 26 26 26 54 38 6 154 114 10
41421 -226 170 11 236 186 11 225 175 15 184 144 12
41422 -215 174 15 175 146 61 37 26 9 2 2 6
41423 - 70 70 70 246 246 246 138 138 138 2 2 6
41424 - 2 2 6 2 2 6 2 2 6 2 2 6
41425 - 70 70 70 66 66 66 26 26 26 6 6 6
41426 - 0 0 0 0 0 0 0 0 0 0 0 0
41427 - 0 0 0 0 0 0 0 0 0 0 0 0
41428 - 0 0 0 0 0 0 0 0 0 0 0 0
41429 - 0 0 0 0 0 0 0 0 0 0 0 0
41430 - 0 0 0 0 0 0 0 0 0 0 0 0
41431 - 0 0 0 0 0 0 0 0 0 0 0 0
41432 - 0 0 0 0 0 0 0 0 0 0 0 0
41433 - 0 0 0 0 0 0 0 0 0 0 0 0
41434 - 0 0 0 0 0 0 0 0 0 0 0 0
41435 - 0 0 0 0 0 0 0 0 0 0 0 0
41436 - 0 0 0 0 0 0 0 0 0 0 0 0
41437 - 0 0 0 0 0 0 0 0 0 0 0 0
41438 - 0 0 0 0 0 0 0 0 0 10 10 10
41439 - 38 38 38 86 86 86 14 14 14 10 10 10
41440 -195 195 195 188 164 115 192 133 9 225 175 15
41441 -239 182 13 234 190 10 232 195 16 232 200 30
41442 -245 207 45 241 208 19 232 195 16 184 144 12
41443 -218 194 134 211 206 186 42 42 42 2 2 6
41444 - 2 2 6 2 2 6 2 2 6 2 2 6
41445 - 50 50 50 74 74 74 30 30 30 6 6 6
41446 - 0 0 0 0 0 0 0 0 0 0 0 0
41447 - 0 0 0 0 0 0 0 0 0 0 0 0
41448 - 0 0 0 0 0 0 0 0 0 0 0 0
41449 - 0 0 0 0 0 0 0 0 0 0 0 0
41450 - 0 0 0 0 0 0 0 0 0 0 0 0
41451 - 0 0 0 0 0 0 0 0 0 0 0 0
41452 - 0 0 0 0 0 0 0 0 0 0 0 0
41453 - 0 0 0 0 0 0 0 0 0 0 0 0
41454 - 0 0 0 0 0 0 0 0 0 0 0 0
41455 - 0 0 0 0 0 0 0 0 0 0 0 0
41456 - 0 0 0 0 0 0 0 0 0 0 0 0
41457 - 0 0 0 0 0 0 0 0 0 0 0 0
41458 - 0 0 0 0 0 0 0 0 0 10 10 10
41459 - 34 34 34 86 86 86 14 14 14 2 2 6
41460 -121 87 25 192 133 9 219 162 10 239 182 13
41461 -236 186 11 232 195 16 241 208 19 244 214 54
41462 -246 218 60 246 218 38 246 215 20 241 208 19
41463 -241 208 19 226 184 13 121 87 25 2 2 6
41464 - 2 2 6 2 2 6 2 2 6 2 2 6
41465 - 50 50 50 82 82 82 34 34 34 10 10 10
41466 - 0 0 0 0 0 0 0 0 0 0 0 0
41467 - 0 0 0 0 0 0 0 0 0 0 0 0
41468 - 0 0 0 0 0 0 0 0 0 0 0 0
41469 - 0 0 0 0 0 0 0 0 0 0 0 0
41470 - 0 0 0 0 0 0 0 0 0 0 0 0
41471 - 0 0 0 0 0 0 0 0 0 0 0 0
41472 - 0 0 0 0 0 0 0 0 0 0 0 0
41473 - 0 0 0 0 0 0 0 0 0 0 0 0
41474 - 0 0 0 0 0 0 0 0 0 0 0 0
41475 - 0 0 0 0 0 0 0 0 0 0 0 0
41476 - 0 0 0 0 0 0 0 0 0 0 0 0
41477 - 0 0 0 0 0 0 0 0 0 0 0 0
41478 - 0 0 0 0 0 0 0 0 0 10 10 10
41479 - 34 34 34 82 82 82 30 30 30 61 42 6
41480 -180 123 7 206 145 10 230 174 11 239 182 13
41481 -234 190 10 238 202 15 241 208 19 246 218 74
41482 -246 218 38 246 215 20 246 215 20 246 215 20
41483 -226 184 13 215 174 15 184 144 12 6 6 6
41484 - 2 2 6 2 2 6 2 2 6 2 2 6
41485 - 26 26 26 94 94 94 42 42 42 14 14 14
41486 - 0 0 0 0 0 0 0 0 0 0 0 0
41487 - 0 0 0 0 0 0 0 0 0 0 0 0
41488 - 0 0 0 0 0 0 0 0 0 0 0 0
41489 - 0 0 0 0 0 0 0 0 0 0 0 0
41490 - 0 0 0 0 0 0 0 0 0 0 0 0
41491 - 0 0 0 0 0 0 0 0 0 0 0 0
41492 - 0 0 0 0 0 0 0 0 0 0 0 0
41493 - 0 0 0 0 0 0 0 0 0 0 0 0
41494 - 0 0 0 0 0 0 0 0 0 0 0 0
41495 - 0 0 0 0 0 0 0 0 0 0 0 0
41496 - 0 0 0 0 0 0 0 0 0 0 0 0
41497 - 0 0 0 0 0 0 0 0 0 0 0 0
41498 - 0 0 0 0 0 0 0 0 0 10 10 10
41499 - 30 30 30 78 78 78 50 50 50 104 69 6
41500 -192 133 9 216 158 10 236 178 12 236 186 11
41501 -232 195 16 241 208 19 244 214 54 245 215 43
41502 -246 215 20 246 215 20 241 208 19 198 155 10
41503 -200 144 11 216 158 10 156 118 10 2 2 6
41504 - 2 2 6 2 2 6 2 2 6 2 2 6
41505 - 6 6 6 90 90 90 54 54 54 18 18 18
41506 - 6 6 6 0 0 0 0 0 0 0 0 0
41507 - 0 0 0 0 0 0 0 0 0 0 0 0
41508 - 0 0 0 0 0 0 0 0 0 0 0 0
41509 - 0 0 0 0 0 0 0 0 0 0 0 0
41510 - 0 0 0 0 0 0 0 0 0 0 0 0
41511 - 0 0 0 0 0 0 0 0 0 0 0 0
41512 - 0 0 0 0 0 0 0 0 0 0 0 0
41513 - 0 0 0 0 0 0 0 0 0 0 0 0
41514 - 0 0 0 0 0 0 0 0 0 0 0 0
41515 - 0 0 0 0 0 0 0 0 0 0 0 0
41516 - 0 0 0 0 0 0 0 0 0 0 0 0
41517 - 0 0 0 0 0 0 0 0 0 0 0 0
41518 - 0 0 0 0 0 0 0 0 0 10 10 10
41519 - 30 30 30 78 78 78 46 46 46 22 22 22
41520 -137 92 6 210 162 10 239 182 13 238 190 10
41521 -238 202 15 241 208 19 246 215 20 246 215 20
41522 -241 208 19 203 166 17 185 133 11 210 150 10
41523 -216 158 10 210 150 10 102 78 10 2 2 6
41524 - 6 6 6 54 54 54 14 14 14 2 2 6
41525 - 2 2 6 62 62 62 74 74 74 30 30 30
41526 - 10 10 10 0 0 0 0 0 0 0 0 0
41527 - 0 0 0 0 0 0 0 0 0 0 0 0
41528 - 0 0 0 0 0 0 0 0 0 0 0 0
41529 - 0 0 0 0 0 0 0 0 0 0 0 0
41530 - 0 0 0 0 0 0 0 0 0 0 0 0
41531 - 0 0 0 0 0 0 0 0 0 0 0 0
41532 - 0 0 0 0 0 0 0 0 0 0 0 0
41533 - 0 0 0 0 0 0 0 0 0 0 0 0
41534 - 0 0 0 0 0 0 0 0 0 0 0 0
41535 - 0 0 0 0 0 0 0 0 0 0 0 0
41536 - 0 0 0 0 0 0 0 0 0 0 0 0
41537 - 0 0 0 0 0 0 0 0 0 0 0 0
41538 - 0 0 0 0 0 0 0 0 0 10 10 10
41539 - 34 34 34 78 78 78 50 50 50 6 6 6
41540 - 94 70 30 139 102 15 190 146 13 226 184 13
41541 -232 200 30 232 195 16 215 174 15 190 146 13
41542 -168 122 10 192 133 9 210 150 10 213 154 11
41543 -202 150 34 182 157 106 101 98 89 2 2 6
41544 - 2 2 6 78 78 78 116 116 116 58 58 58
41545 - 2 2 6 22 22 22 90 90 90 46 46 46
41546 - 18 18 18 6 6 6 0 0 0 0 0 0
41547 - 0 0 0 0 0 0 0 0 0 0 0 0
41548 - 0 0 0 0 0 0 0 0 0 0 0 0
41549 - 0 0 0 0 0 0 0 0 0 0 0 0
41550 - 0 0 0 0 0 0 0 0 0 0 0 0
41551 - 0 0 0 0 0 0 0 0 0 0 0 0
41552 - 0 0 0 0 0 0 0 0 0 0 0 0
41553 - 0 0 0 0 0 0 0 0 0 0 0 0
41554 - 0 0 0 0 0 0 0 0 0 0 0 0
41555 - 0 0 0 0 0 0 0 0 0 0 0 0
41556 - 0 0 0 0 0 0 0 0 0 0 0 0
41557 - 0 0 0 0 0 0 0 0 0 0 0 0
41558 - 0 0 0 0 0 0 0 0 0 10 10 10
41559 - 38 38 38 86 86 86 50 50 50 6 6 6
41560 -128 128 128 174 154 114 156 107 11 168 122 10
41561 -198 155 10 184 144 12 197 138 11 200 144 11
41562 -206 145 10 206 145 10 197 138 11 188 164 115
41563 -195 195 195 198 198 198 174 174 174 14 14 14
41564 - 2 2 6 22 22 22 116 116 116 116 116 116
41565 - 22 22 22 2 2 6 74 74 74 70 70 70
41566 - 30 30 30 10 10 10 0 0 0 0 0 0
41567 - 0 0 0 0 0 0 0 0 0 0 0 0
41568 - 0 0 0 0 0 0 0 0 0 0 0 0
41569 - 0 0 0 0 0 0 0 0 0 0 0 0
41570 - 0 0 0 0 0 0 0 0 0 0 0 0
41571 - 0 0 0 0 0 0 0 0 0 0 0 0
41572 - 0 0 0 0 0 0 0 0 0 0 0 0
41573 - 0 0 0 0 0 0 0 0 0 0 0 0
41574 - 0 0 0 0 0 0 0 0 0 0 0 0
41575 - 0 0 0 0 0 0 0 0 0 0 0 0
41576 - 0 0 0 0 0 0 0 0 0 0 0 0
41577 - 0 0 0 0 0 0 0 0 0 0 0 0
41578 - 0 0 0 0 0 0 6 6 6 18 18 18
41579 - 50 50 50 101 101 101 26 26 26 10 10 10
41580 -138 138 138 190 190 190 174 154 114 156 107 11
41581 -197 138 11 200 144 11 197 138 11 192 133 9
41582 -180 123 7 190 142 34 190 178 144 187 187 187
41583 -202 202 202 221 221 221 214 214 214 66 66 66
41584 - 2 2 6 2 2 6 50 50 50 62 62 62
41585 - 6 6 6 2 2 6 10 10 10 90 90 90
41586 - 50 50 50 18 18 18 6 6 6 0 0 0
41587 - 0 0 0 0 0 0 0 0 0 0 0 0
41588 - 0 0 0 0 0 0 0 0 0 0 0 0
41589 - 0 0 0 0 0 0 0 0 0 0 0 0
41590 - 0 0 0 0 0 0 0 0 0 0 0 0
41591 - 0 0 0 0 0 0 0 0 0 0 0 0
41592 - 0 0 0 0 0 0 0 0 0 0 0 0
41593 - 0 0 0 0 0 0 0 0 0 0 0 0
41594 - 0 0 0 0 0 0 0 0 0 0 0 0
41595 - 0 0 0 0 0 0 0 0 0 0 0 0
41596 - 0 0 0 0 0 0 0 0 0 0 0 0
41597 - 0 0 0 0 0 0 0 0 0 0 0 0
41598 - 0 0 0 0 0 0 10 10 10 34 34 34
41599 - 74 74 74 74 74 74 2 2 6 6 6 6
41600 -144 144 144 198 198 198 190 190 190 178 166 146
41601 -154 121 60 156 107 11 156 107 11 168 124 44
41602 -174 154 114 187 187 187 190 190 190 210 210 210
41603 -246 246 246 253 253 253 253 253 253 182 182 182
41604 - 6 6 6 2 2 6 2 2 6 2 2 6
41605 - 2 2 6 2 2 6 2 2 6 62 62 62
41606 - 74 74 74 34 34 34 14 14 14 0 0 0
41607 - 0 0 0 0 0 0 0 0 0 0 0 0
41608 - 0 0 0 0 0 0 0 0 0 0 0 0
41609 - 0 0 0 0 0 0 0 0 0 0 0 0
41610 - 0 0 0 0 0 0 0 0 0 0 0 0
41611 - 0 0 0 0 0 0 0 0 0 0 0 0
41612 - 0 0 0 0 0 0 0 0 0 0 0 0
41613 - 0 0 0 0 0 0 0 0 0 0 0 0
41614 - 0 0 0 0 0 0 0 0 0 0 0 0
41615 - 0 0 0 0 0 0 0 0 0 0 0 0
41616 - 0 0 0 0 0 0 0 0 0 0 0 0
41617 - 0 0 0 0 0 0 0 0 0 0 0 0
41618 - 0 0 0 10 10 10 22 22 22 54 54 54
41619 - 94 94 94 18 18 18 2 2 6 46 46 46
41620 -234 234 234 221 221 221 190 190 190 190 190 190
41621 -190 190 190 187 187 187 187 187 187 190 190 190
41622 -190 190 190 195 195 195 214 214 214 242 242 242
41623 -253 253 253 253 253 253 253 253 253 253 253 253
41624 - 82 82 82 2 2 6 2 2 6 2 2 6
41625 - 2 2 6 2 2 6 2 2 6 14 14 14
41626 - 86 86 86 54 54 54 22 22 22 6 6 6
41627 - 0 0 0 0 0 0 0 0 0 0 0 0
41628 - 0 0 0 0 0 0 0 0 0 0 0 0
41629 - 0 0 0 0 0 0 0 0 0 0 0 0
41630 - 0 0 0 0 0 0 0 0 0 0 0 0
41631 - 0 0 0 0 0 0 0 0 0 0 0 0
41632 - 0 0 0 0 0 0 0 0 0 0 0 0
41633 - 0 0 0 0 0 0 0 0 0 0 0 0
41634 - 0 0 0 0 0 0 0 0 0 0 0 0
41635 - 0 0 0 0 0 0 0 0 0 0 0 0
41636 - 0 0 0 0 0 0 0 0 0 0 0 0
41637 - 0 0 0 0 0 0 0 0 0 0 0 0
41638 - 6 6 6 18 18 18 46 46 46 90 90 90
41639 - 46 46 46 18 18 18 6 6 6 182 182 182
41640 -253 253 253 246 246 246 206 206 206 190 190 190
41641 -190 190 190 190 190 190 190 190 190 190 190 190
41642 -206 206 206 231 231 231 250 250 250 253 253 253
41643 -253 253 253 253 253 253 253 253 253 253 253 253
41644 -202 202 202 14 14 14 2 2 6 2 2 6
41645 - 2 2 6 2 2 6 2 2 6 2 2 6
41646 - 42 42 42 86 86 86 42 42 42 18 18 18
41647 - 6 6 6 0 0 0 0 0 0 0 0 0
41648 - 0 0 0 0 0 0 0 0 0 0 0 0
41649 - 0 0 0 0 0 0 0 0 0 0 0 0
41650 - 0 0 0 0 0 0 0 0 0 0 0 0
41651 - 0 0 0 0 0 0 0 0 0 0 0 0
41652 - 0 0 0 0 0 0 0 0 0 0 0 0
41653 - 0 0 0 0 0 0 0 0 0 0 0 0
41654 - 0 0 0 0 0 0 0 0 0 0 0 0
41655 - 0 0 0 0 0 0 0 0 0 0 0 0
41656 - 0 0 0 0 0 0 0 0 0 0 0 0
41657 - 0 0 0 0 0 0 0 0 0 6 6 6
41658 - 14 14 14 38 38 38 74 74 74 66 66 66
41659 - 2 2 6 6 6 6 90 90 90 250 250 250
41660 -253 253 253 253 253 253 238 238 238 198 198 198
41661 -190 190 190 190 190 190 195 195 195 221 221 221
41662 -246 246 246 253 253 253 253 253 253 253 253 253
41663 -253 253 253 253 253 253 253 253 253 253 253 253
41664 -253 253 253 82 82 82 2 2 6 2 2 6
41665 - 2 2 6 2 2 6 2 2 6 2 2 6
41666 - 2 2 6 78 78 78 70 70 70 34 34 34
41667 - 14 14 14 6 6 6 0 0 0 0 0 0
41668 - 0 0 0 0 0 0 0 0 0 0 0 0
41669 - 0 0 0 0 0 0 0 0 0 0 0 0
41670 - 0 0 0 0 0 0 0 0 0 0 0 0
41671 - 0 0 0 0 0 0 0 0 0 0 0 0
41672 - 0 0 0 0 0 0 0 0 0 0 0 0
41673 - 0 0 0 0 0 0 0 0 0 0 0 0
41674 - 0 0 0 0 0 0 0 0 0 0 0 0
41675 - 0 0 0 0 0 0 0 0 0 0 0 0
41676 - 0 0 0 0 0 0 0 0 0 0 0 0
41677 - 0 0 0 0 0 0 0 0 0 14 14 14
41678 - 34 34 34 66 66 66 78 78 78 6 6 6
41679 - 2 2 6 18 18 18 218 218 218 253 253 253
41680 -253 253 253 253 253 253 253 253 253 246 246 246
41681 -226 226 226 231 231 231 246 246 246 253 253 253
41682 -253 253 253 253 253 253 253 253 253 253 253 253
41683 -253 253 253 253 253 253 253 253 253 253 253 253
41684 -253 253 253 178 178 178 2 2 6 2 2 6
41685 - 2 2 6 2 2 6 2 2 6 2 2 6
41686 - 2 2 6 18 18 18 90 90 90 62 62 62
41687 - 30 30 30 10 10 10 0 0 0 0 0 0
41688 - 0 0 0 0 0 0 0 0 0 0 0 0
41689 - 0 0 0 0 0 0 0 0 0 0 0 0
41690 - 0 0 0 0 0 0 0 0 0 0 0 0
41691 - 0 0 0 0 0 0 0 0 0 0 0 0
41692 - 0 0 0 0 0 0 0 0 0 0 0 0
41693 - 0 0 0 0 0 0 0 0 0 0 0 0
41694 - 0 0 0 0 0 0 0 0 0 0 0 0
41695 - 0 0 0 0 0 0 0 0 0 0 0 0
41696 - 0 0 0 0 0 0 0 0 0 0 0 0
41697 - 0 0 0 0 0 0 10 10 10 26 26 26
41698 - 58 58 58 90 90 90 18 18 18 2 2 6
41699 - 2 2 6 110 110 110 253 253 253 253 253 253
41700 -253 253 253 253 253 253 253 253 253 253 253 253
41701 -250 250 250 253 253 253 253 253 253 253 253 253
41702 -253 253 253 253 253 253 253 253 253 253 253 253
41703 -253 253 253 253 253 253 253 253 253 253 253 253
41704 -253 253 253 231 231 231 18 18 18 2 2 6
41705 - 2 2 6 2 2 6 2 2 6 2 2 6
41706 - 2 2 6 2 2 6 18 18 18 94 94 94
41707 - 54 54 54 26 26 26 10 10 10 0 0 0
41708 - 0 0 0 0 0 0 0 0 0 0 0 0
41709 - 0 0 0 0 0 0 0 0 0 0 0 0
41710 - 0 0 0 0 0 0 0 0 0 0 0 0
41711 - 0 0 0 0 0 0 0 0 0 0 0 0
41712 - 0 0 0 0 0 0 0 0 0 0 0 0
41713 - 0 0 0 0 0 0 0 0 0 0 0 0
41714 - 0 0 0 0 0 0 0 0 0 0 0 0
41715 - 0 0 0 0 0 0 0 0 0 0 0 0
41716 - 0 0 0 0 0 0 0 0 0 0 0 0
41717 - 0 0 0 6 6 6 22 22 22 50 50 50
41718 - 90 90 90 26 26 26 2 2 6 2 2 6
41719 - 14 14 14 195 195 195 250 250 250 253 253 253
41720 -253 253 253 253 253 253 253 253 253 253 253 253
41721 -253 253 253 253 253 253 253 253 253 253 253 253
41722 -253 253 253 253 253 253 253 253 253 253 253 253
41723 -253 253 253 253 253 253 253 253 253 253 253 253
41724 -250 250 250 242 242 242 54 54 54 2 2 6
41725 - 2 2 6 2 2 6 2 2 6 2 2 6
41726 - 2 2 6 2 2 6 2 2 6 38 38 38
41727 - 86 86 86 50 50 50 22 22 22 6 6 6
41728 - 0 0 0 0 0 0 0 0 0 0 0 0
41729 - 0 0 0 0 0 0 0 0 0 0 0 0
41730 - 0 0 0 0 0 0 0 0 0 0 0 0
41731 - 0 0 0 0 0 0 0 0 0 0 0 0
41732 - 0 0 0 0 0 0 0 0 0 0 0 0
41733 - 0 0 0 0 0 0 0 0 0 0 0 0
41734 - 0 0 0 0 0 0 0 0 0 0 0 0
41735 - 0 0 0 0 0 0 0 0 0 0 0 0
41736 - 0 0 0 0 0 0 0 0 0 0 0 0
41737 - 6 6 6 14 14 14 38 38 38 82 82 82
41738 - 34 34 34 2 2 6 2 2 6 2 2 6
41739 - 42 42 42 195 195 195 246 246 246 253 253 253
41740 -253 253 253 253 253 253 253 253 253 250 250 250
41741 -242 242 242 242 242 242 250 250 250 253 253 253
41742 -253 253 253 253 253 253 253 253 253 253 253 253
41743 -253 253 253 250 250 250 246 246 246 238 238 238
41744 -226 226 226 231 231 231 101 101 101 6 6 6
41745 - 2 2 6 2 2 6 2 2 6 2 2 6
41746 - 2 2 6 2 2 6 2 2 6 2 2 6
41747 - 38 38 38 82 82 82 42 42 42 14 14 14
41748 - 6 6 6 0 0 0 0 0 0 0 0 0
41749 - 0 0 0 0 0 0 0 0 0 0 0 0
41750 - 0 0 0 0 0 0 0 0 0 0 0 0
41751 - 0 0 0 0 0 0 0 0 0 0 0 0
41752 - 0 0 0 0 0 0 0 0 0 0 0 0
41753 - 0 0 0 0 0 0 0 0 0 0 0 0
41754 - 0 0 0 0 0 0 0 0 0 0 0 0
41755 - 0 0 0 0 0 0 0 0 0 0 0 0
41756 - 0 0 0 0 0 0 0 0 0 0 0 0
41757 - 10 10 10 26 26 26 62 62 62 66 66 66
41758 - 2 2 6 2 2 6 2 2 6 6 6 6
41759 - 70 70 70 170 170 170 206 206 206 234 234 234
41760 -246 246 246 250 250 250 250 250 250 238 238 238
41761 -226 226 226 231 231 231 238 238 238 250 250 250
41762 -250 250 250 250 250 250 246 246 246 231 231 231
41763 -214 214 214 206 206 206 202 202 202 202 202 202
41764 -198 198 198 202 202 202 182 182 182 18 18 18
41765 - 2 2 6 2 2 6 2 2 6 2 2 6
41766 - 2 2 6 2 2 6 2 2 6 2 2 6
41767 - 2 2 6 62 62 62 66 66 66 30 30 30
41768 - 10 10 10 0 0 0 0 0 0 0 0 0
41769 - 0 0 0 0 0 0 0 0 0 0 0 0
41770 - 0 0 0 0 0 0 0 0 0 0 0 0
41771 - 0 0 0 0 0 0 0 0 0 0 0 0
41772 - 0 0 0 0 0 0 0 0 0 0 0 0
41773 - 0 0 0 0 0 0 0 0 0 0 0 0
41774 - 0 0 0 0 0 0 0 0 0 0 0 0
41775 - 0 0 0 0 0 0 0 0 0 0 0 0
41776 - 0 0 0 0 0 0 0 0 0 0 0 0
41777 - 14 14 14 42 42 42 82 82 82 18 18 18
41778 - 2 2 6 2 2 6 2 2 6 10 10 10
41779 - 94 94 94 182 182 182 218 218 218 242 242 242
41780 -250 250 250 253 253 253 253 253 253 250 250 250
41781 -234 234 234 253 253 253 253 253 253 253 253 253
41782 -253 253 253 253 253 253 253 253 253 246 246 246
41783 -238 238 238 226 226 226 210 210 210 202 202 202
41784 -195 195 195 195 195 195 210 210 210 158 158 158
41785 - 6 6 6 14 14 14 50 50 50 14 14 14
41786 - 2 2 6 2 2 6 2 2 6 2 2 6
41787 - 2 2 6 6 6 6 86 86 86 46 46 46
41788 - 18 18 18 6 6 6 0 0 0 0 0 0
41789 - 0 0 0 0 0 0 0 0 0 0 0 0
41790 - 0 0 0 0 0 0 0 0 0 0 0 0
41791 - 0 0 0 0 0 0 0 0 0 0 0 0
41792 - 0 0 0 0 0 0 0 0 0 0 0 0
41793 - 0 0 0 0 0 0 0 0 0 0 0 0
41794 - 0 0 0 0 0 0 0 0 0 0 0 0
41795 - 0 0 0 0 0 0 0 0 0 0 0 0
41796 - 0 0 0 0 0 0 0 0 0 6 6 6
41797 - 22 22 22 54 54 54 70 70 70 2 2 6
41798 - 2 2 6 10 10 10 2 2 6 22 22 22
41799 -166 166 166 231 231 231 250 250 250 253 253 253
41800 -253 253 253 253 253 253 253 253 253 250 250 250
41801 -242 242 242 253 253 253 253 253 253 253 253 253
41802 -253 253 253 253 253 253 253 253 253 253 253 253
41803 -253 253 253 253 253 253 253 253 253 246 246 246
41804 -231 231 231 206 206 206 198 198 198 226 226 226
41805 - 94 94 94 2 2 6 6 6 6 38 38 38
41806 - 30 30 30 2 2 6 2 2 6 2 2 6
41807 - 2 2 6 2 2 6 62 62 62 66 66 66
41808 - 26 26 26 10 10 10 0 0 0 0 0 0
41809 - 0 0 0 0 0 0 0 0 0 0 0 0
41810 - 0 0 0 0 0 0 0 0 0 0 0 0
41811 - 0 0 0 0 0 0 0 0 0 0 0 0
41812 - 0 0 0 0 0 0 0 0 0 0 0 0
41813 - 0 0 0 0 0 0 0 0 0 0 0 0
41814 - 0 0 0 0 0 0 0 0 0 0 0 0
41815 - 0 0 0 0 0 0 0 0 0 0 0 0
41816 - 0 0 0 0 0 0 0 0 0 10 10 10
41817 - 30 30 30 74 74 74 50 50 50 2 2 6
41818 - 26 26 26 26 26 26 2 2 6 106 106 106
41819 -238 238 238 253 253 253 253 253 253 253 253 253
41820 -253 253 253 253 253 253 253 253 253 253 253 253
41821 -253 253 253 253 253 253 253 253 253 253 253 253
41822 -253 253 253 253 253 253 253 253 253 253 253 253
41823 -253 253 253 253 253 253 253 253 253 253 253 253
41824 -253 253 253 246 246 246 218 218 218 202 202 202
41825 -210 210 210 14 14 14 2 2 6 2 2 6
41826 - 30 30 30 22 22 22 2 2 6 2 2 6
41827 - 2 2 6 2 2 6 18 18 18 86 86 86
41828 - 42 42 42 14 14 14 0 0 0 0 0 0
41829 - 0 0 0 0 0 0 0 0 0 0 0 0
41830 - 0 0 0 0 0 0 0 0 0 0 0 0
41831 - 0 0 0 0 0 0 0 0 0 0 0 0
41832 - 0 0 0 0 0 0 0 0 0 0 0 0
41833 - 0 0 0 0 0 0 0 0 0 0 0 0
41834 - 0 0 0 0 0 0 0 0 0 0 0 0
41835 - 0 0 0 0 0 0 0 0 0 0 0 0
41836 - 0 0 0 0 0 0 0 0 0 14 14 14
41837 - 42 42 42 90 90 90 22 22 22 2 2 6
41838 - 42 42 42 2 2 6 18 18 18 218 218 218
41839 -253 253 253 253 253 253 253 253 253 253 253 253
41840 -253 253 253 253 253 253 253 253 253 253 253 253
41841 -253 253 253 253 253 253 253 253 253 253 253 253
41842 -253 253 253 253 253 253 253 253 253 253 253 253
41843 -253 253 253 253 253 253 253 253 253 253 253 253
41844 -253 253 253 253 253 253 250 250 250 221 221 221
41845 -218 218 218 101 101 101 2 2 6 14 14 14
41846 - 18 18 18 38 38 38 10 10 10 2 2 6
41847 - 2 2 6 2 2 6 2 2 6 78 78 78
41848 - 58 58 58 22 22 22 6 6 6 0 0 0
41849 - 0 0 0 0 0 0 0 0 0 0 0 0
41850 - 0 0 0 0 0 0 0 0 0 0 0 0
41851 - 0 0 0 0 0 0 0 0 0 0 0 0
41852 - 0 0 0 0 0 0 0 0 0 0 0 0
41853 - 0 0 0 0 0 0 0 0 0 0 0 0
41854 - 0 0 0 0 0 0 0 0 0 0 0 0
41855 - 0 0 0 0 0 0 0 0 0 0 0 0
41856 - 0 0 0 0 0 0 6 6 6 18 18 18
41857 - 54 54 54 82 82 82 2 2 6 26 26 26
41858 - 22 22 22 2 2 6 123 123 123 253 253 253
41859 -253 253 253 253 253 253 253 253 253 253 253 253
41860 -253 253 253 253 253 253 253 253 253 253 253 253
41861 -253 253 253 253 253 253 253 253 253 253 253 253
41862 -253 253 253 253 253 253 253 253 253 253 253 253
41863 -253 253 253 253 253 253 253 253 253 253 253 253
41864 -253 253 253 253 253 253 253 253 253 250 250 250
41865 -238 238 238 198 198 198 6 6 6 38 38 38
41866 - 58 58 58 26 26 26 38 38 38 2 2 6
41867 - 2 2 6 2 2 6 2 2 6 46 46 46
41868 - 78 78 78 30 30 30 10 10 10 0 0 0
41869 - 0 0 0 0 0 0 0 0 0 0 0 0
41870 - 0 0 0 0 0 0 0 0 0 0 0 0
41871 - 0 0 0 0 0 0 0 0 0 0 0 0
41872 - 0 0 0 0 0 0 0 0 0 0 0 0
41873 - 0 0 0 0 0 0 0 0 0 0 0 0
41874 - 0 0 0 0 0 0 0 0 0 0 0 0
41875 - 0 0 0 0 0 0 0 0 0 0 0 0
41876 - 0 0 0 0 0 0 10 10 10 30 30 30
41877 - 74 74 74 58 58 58 2 2 6 42 42 42
41878 - 2 2 6 22 22 22 231 231 231 253 253 253
41879 -253 253 253 253 253 253 253 253 253 253 253 253
41880 -253 253 253 253 253 253 253 253 253 250 250 250
41881 -253 253 253 253 253 253 253 253 253 253 253 253
41882 -253 253 253 253 253 253 253 253 253 253 253 253
41883 -253 253 253 253 253 253 253 253 253 253 253 253
41884 -253 253 253 253 253 253 253 253 253 253 253 253
41885 -253 253 253 246 246 246 46 46 46 38 38 38
41886 - 42 42 42 14 14 14 38 38 38 14 14 14
41887 - 2 2 6 2 2 6 2 2 6 6 6 6
41888 - 86 86 86 46 46 46 14 14 14 0 0 0
41889 - 0 0 0 0 0 0 0 0 0 0 0 0
41890 - 0 0 0 0 0 0 0 0 0 0 0 0
41891 - 0 0 0 0 0 0 0 0 0 0 0 0
41892 - 0 0 0 0 0 0 0 0 0 0 0 0
41893 - 0 0 0 0 0 0 0 0 0 0 0 0
41894 - 0 0 0 0 0 0 0 0 0 0 0 0
41895 - 0 0 0 0 0 0 0 0 0 0 0 0
41896 - 0 0 0 6 6 6 14 14 14 42 42 42
41897 - 90 90 90 18 18 18 18 18 18 26 26 26
41898 - 2 2 6 116 116 116 253 253 253 253 253 253
41899 -253 253 253 253 253 253 253 253 253 253 253 253
41900 -253 253 253 253 253 253 250 250 250 238 238 238
41901 -253 253 253 253 253 253 253 253 253 253 253 253
41902 -253 253 253 253 253 253 253 253 253 253 253 253
41903 -253 253 253 253 253 253 253 253 253 253 253 253
41904 -253 253 253 253 253 253 253 253 253 253 253 253
41905 -253 253 253 253 253 253 94 94 94 6 6 6
41906 - 2 2 6 2 2 6 10 10 10 34 34 34
41907 - 2 2 6 2 2 6 2 2 6 2 2 6
41908 - 74 74 74 58 58 58 22 22 22 6 6 6
41909 - 0 0 0 0 0 0 0 0 0 0 0 0
41910 - 0 0 0 0 0 0 0 0 0 0 0 0
41911 - 0 0 0 0 0 0 0 0 0 0 0 0
41912 - 0 0 0 0 0 0 0 0 0 0 0 0
41913 - 0 0 0 0 0 0 0 0 0 0 0 0
41914 - 0 0 0 0 0 0 0 0 0 0 0 0
41915 - 0 0 0 0 0 0 0 0 0 0 0 0
41916 - 0 0 0 10 10 10 26 26 26 66 66 66
41917 - 82 82 82 2 2 6 38 38 38 6 6 6
41918 - 14 14 14 210 210 210 253 253 253 253 253 253
41919 -253 253 253 253 253 253 253 253 253 253 253 253
41920 -253 253 253 253 253 253 246 246 246 242 242 242
41921 -253 253 253 253 253 253 253 253 253 253 253 253
41922 -253 253 253 253 253 253 253 253 253 253 253 253
41923 -253 253 253 253 253 253 253 253 253 253 253 253
41924 -253 253 253 253 253 253 253 253 253 253 253 253
41925 -253 253 253 253 253 253 144 144 144 2 2 6
41926 - 2 2 6 2 2 6 2 2 6 46 46 46
41927 - 2 2 6 2 2 6 2 2 6 2 2 6
41928 - 42 42 42 74 74 74 30 30 30 10 10 10
41929 - 0 0 0 0 0 0 0 0 0 0 0 0
41930 - 0 0 0 0 0 0 0 0 0 0 0 0
41931 - 0 0 0 0 0 0 0 0 0 0 0 0
41932 - 0 0 0 0 0 0 0 0 0 0 0 0
41933 - 0 0 0 0 0 0 0 0 0 0 0 0
41934 - 0 0 0 0 0 0 0 0 0 0 0 0
41935 - 0 0 0 0 0 0 0 0 0 0 0 0
41936 - 6 6 6 14 14 14 42 42 42 90 90 90
41937 - 26 26 26 6 6 6 42 42 42 2 2 6
41938 - 74 74 74 250 250 250 253 253 253 253 253 253
41939 -253 253 253 253 253 253 253 253 253 253 253 253
41940 -253 253 253 253 253 253 242 242 242 242 242 242
41941 -253 253 253 253 253 253 253 253 253 253 253 253
41942 -253 253 253 253 253 253 253 253 253 253 253 253
41943 -253 253 253 253 253 253 253 253 253 253 253 253
41944 -253 253 253 253 253 253 253 253 253 253 253 253
41945 -253 253 253 253 253 253 182 182 182 2 2 6
41946 - 2 2 6 2 2 6 2 2 6 46 46 46
41947 - 2 2 6 2 2 6 2 2 6 2 2 6
41948 - 10 10 10 86 86 86 38 38 38 10 10 10
41949 - 0 0 0 0 0 0 0 0 0 0 0 0
41950 - 0 0 0 0 0 0 0 0 0 0 0 0
41951 - 0 0 0 0 0 0 0 0 0 0 0 0
41952 - 0 0 0 0 0 0 0 0 0 0 0 0
41953 - 0 0 0 0 0 0 0 0 0 0 0 0
41954 - 0 0 0 0 0 0 0 0 0 0 0 0
41955 - 0 0 0 0 0 0 0 0 0 0 0 0
41956 - 10 10 10 26 26 26 66 66 66 82 82 82
41957 - 2 2 6 22 22 22 18 18 18 2 2 6
41958 -149 149 149 253 253 253 253 253 253 253 253 253
41959 -253 253 253 253 253 253 253 253 253 253 253 253
41960 -253 253 253 253 253 253 234 234 234 242 242 242
41961 -253 253 253 253 253 253 253 253 253 253 253 253
41962 -253 253 253 253 253 253 253 253 253 253 253 253
41963 -253 253 253 253 253 253 253 253 253 253 253 253
41964 -253 253 253 253 253 253 253 253 253 253 253 253
41965 -253 253 253 253 253 253 206 206 206 2 2 6
41966 - 2 2 6 2 2 6 2 2 6 38 38 38
41967 - 2 2 6 2 2 6 2 2 6 2 2 6
41968 - 6 6 6 86 86 86 46 46 46 14 14 14
41969 - 0 0 0 0 0 0 0 0 0 0 0 0
41970 - 0 0 0 0 0 0 0 0 0 0 0 0
41971 - 0 0 0 0 0 0 0 0 0 0 0 0
41972 - 0 0 0 0 0 0 0 0 0 0 0 0
41973 - 0 0 0 0 0 0 0 0 0 0 0 0
41974 - 0 0 0 0 0 0 0 0 0 0 0 0
41975 - 0 0 0 0 0 0 0 0 0 6 6 6
41976 - 18 18 18 46 46 46 86 86 86 18 18 18
41977 - 2 2 6 34 34 34 10 10 10 6 6 6
41978 -210 210 210 253 253 253 253 253 253 253 253 253
41979 -253 253 253 253 253 253 253 253 253 253 253 253
41980 -253 253 253 253 253 253 234 234 234 242 242 242
41981 -253 253 253 253 253 253 253 253 253 253 253 253
41982 -253 253 253 253 253 253 253 253 253 253 253 253
41983 -253 253 253 253 253 253 253 253 253 253 253 253
41984 -253 253 253 253 253 253 253 253 253 253 253 253
41985 -253 253 253 253 253 253 221 221 221 6 6 6
41986 - 2 2 6 2 2 6 6 6 6 30 30 30
41987 - 2 2 6 2 2 6 2 2 6 2 2 6
41988 - 2 2 6 82 82 82 54 54 54 18 18 18
41989 - 6 6 6 0 0 0 0 0 0 0 0 0
41990 - 0 0 0 0 0 0 0 0 0 0 0 0
41991 - 0 0 0 0 0 0 0 0 0 0 0 0
41992 - 0 0 0 0 0 0 0 0 0 0 0 0
41993 - 0 0 0 0 0 0 0 0 0 0 0 0
41994 - 0 0 0 0 0 0 0 0 0 0 0 0
41995 - 0 0 0 0 0 0 0 0 0 10 10 10
41996 - 26 26 26 66 66 66 62 62 62 2 2 6
41997 - 2 2 6 38 38 38 10 10 10 26 26 26
41998 -238 238 238 253 253 253 253 253 253 253 253 253
41999 -253 253 253 253 253 253 253 253 253 253 253 253
42000 -253 253 253 253 253 253 231 231 231 238 238 238
42001 -253 253 253 253 253 253 253 253 253 253 253 253
42002 -253 253 253 253 253 253 253 253 253 253 253 253
42003 -253 253 253 253 253 253 253 253 253 253 253 253
42004 -253 253 253 253 253 253 253 253 253 253 253 253
42005 -253 253 253 253 253 253 231 231 231 6 6 6
42006 - 2 2 6 2 2 6 10 10 10 30 30 30
42007 - 2 2 6 2 2 6 2 2 6 2 2 6
42008 - 2 2 6 66 66 66 58 58 58 22 22 22
42009 - 6 6 6 0 0 0 0 0 0 0 0 0
42010 - 0 0 0 0 0 0 0 0 0 0 0 0
42011 - 0 0 0 0 0 0 0 0 0 0 0 0
42012 - 0 0 0 0 0 0 0 0 0 0 0 0
42013 - 0 0 0 0 0 0 0 0 0 0 0 0
42014 - 0 0 0 0 0 0 0 0 0 0 0 0
42015 - 0 0 0 0 0 0 0 0 0 10 10 10
42016 - 38 38 38 78 78 78 6 6 6 2 2 6
42017 - 2 2 6 46 46 46 14 14 14 42 42 42
42018 -246 246 246 253 253 253 253 253 253 253 253 253
42019 -253 253 253 253 253 253 253 253 253 253 253 253
42020 -253 253 253 253 253 253 231 231 231 242 242 242
42021 -253 253 253 253 253 253 253 253 253 253 253 253
42022 -253 253 253 253 253 253 253 253 253 253 253 253
42023 -253 253 253 253 253 253 253 253 253 253 253 253
42024 -253 253 253 253 253 253 253 253 253 253 253 253
42025 -253 253 253 253 253 253 234 234 234 10 10 10
42026 - 2 2 6 2 2 6 22 22 22 14 14 14
42027 - 2 2 6 2 2 6 2 2 6 2 2 6
42028 - 2 2 6 66 66 66 62 62 62 22 22 22
42029 - 6 6 6 0 0 0 0 0 0 0 0 0
42030 - 0 0 0 0 0 0 0 0 0 0 0 0
42031 - 0 0 0 0 0 0 0 0 0 0 0 0
42032 - 0 0 0 0 0 0 0 0 0 0 0 0
42033 - 0 0 0 0 0 0 0 0 0 0 0 0
42034 - 0 0 0 0 0 0 0 0 0 0 0 0
42035 - 0 0 0 0 0 0 6 6 6 18 18 18
42036 - 50 50 50 74 74 74 2 2 6 2 2 6
42037 - 14 14 14 70 70 70 34 34 34 62 62 62
42038 -250 250 250 253 253 253 253 253 253 253 253 253
42039 -253 253 253 253 253 253 253 253 253 253 253 253
42040 -253 253 253 253 253 253 231 231 231 246 246 246
42041 -253 253 253 253 253 253 253 253 253 253 253 253
42042 -253 253 253 253 253 253 253 253 253 253 253 253
42043 -253 253 253 253 253 253 253 253 253 253 253 253
42044 -253 253 253 253 253 253 253 253 253 253 253 253
42045 -253 253 253 253 253 253 234 234 234 14 14 14
42046 - 2 2 6 2 2 6 30 30 30 2 2 6
42047 - 2 2 6 2 2 6 2 2 6 2 2 6
42048 - 2 2 6 66 66 66 62 62 62 22 22 22
42049 - 6 6 6 0 0 0 0 0 0 0 0 0
42050 - 0 0 0 0 0 0 0 0 0 0 0 0
42051 - 0 0 0 0 0 0 0 0 0 0 0 0
42052 - 0 0 0 0 0 0 0 0 0 0 0 0
42053 - 0 0 0 0 0 0 0 0 0 0 0 0
42054 - 0 0 0 0 0 0 0 0 0 0 0 0
42055 - 0 0 0 0 0 0 6 6 6 18 18 18
42056 - 54 54 54 62 62 62 2 2 6 2 2 6
42057 - 2 2 6 30 30 30 46 46 46 70 70 70
42058 -250 250 250 253 253 253 253 253 253 253 253 253
42059 -253 253 253 253 253 253 253 253 253 253 253 253
42060 -253 253 253 253 253 253 231 231 231 246 246 246
42061 -253 253 253 253 253 253 253 253 253 253 253 253
42062 -253 253 253 253 253 253 253 253 253 253 253 253
42063 -253 253 253 253 253 253 253 253 253 253 253 253
42064 -253 253 253 253 253 253 253 253 253 253 253 253
42065 -253 253 253 253 253 253 226 226 226 10 10 10
42066 - 2 2 6 6 6 6 30 30 30 2 2 6
42067 - 2 2 6 2 2 6 2 2 6 2 2 6
42068 - 2 2 6 66 66 66 58 58 58 22 22 22
42069 - 6 6 6 0 0 0 0 0 0 0 0 0
42070 - 0 0 0 0 0 0 0 0 0 0 0 0
42071 - 0 0 0 0 0 0 0 0 0 0 0 0
42072 - 0 0 0 0 0 0 0 0 0 0 0 0
42073 - 0 0 0 0 0 0 0 0 0 0 0 0
42074 - 0 0 0 0 0 0 0 0 0 0 0 0
42075 - 0 0 0 0 0 0 6 6 6 22 22 22
42076 - 58 58 58 62 62 62 2 2 6 2 2 6
42077 - 2 2 6 2 2 6 30 30 30 78 78 78
42078 -250 250 250 253 253 253 253 253 253 253 253 253
42079 -253 253 253 253 253 253 253 253 253 253 253 253
42080 -253 253 253 253 253 253 231 231 231 246 246 246
42081 -253 253 253 253 253 253 253 253 253 253 253 253
42082 -253 253 253 253 253 253 253 253 253 253 253 253
42083 -253 253 253 253 253 253 253 253 253 253 253 253
42084 -253 253 253 253 253 253 253 253 253 253 253 253
42085 -253 253 253 253 253 253 206 206 206 2 2 6
42086 - 22 22 22 34 34 34 18 14 6 22 22 22
42087 - 26 26 26 18 18 18 6 6 6 2 2 6
42088 - 2 2 6 82 82 82 54 54 54 18 18 18
42089 - 6 6 6 0 0 0 0 0 0 0 0 0
42090 - 0 0 0 0 0 0 0 0 0 0 0 0
42091 - 0 0 0 0 0 0 0 0 0 0 0 0
42092 - 0 0 0 0 0 0 0 0 0 0 0 0
42093 - 0 0 0 0 0 0 0 0 0 0 0 0
42094 - 0 0 0 0 0 0 0 0 0 0 0 0
42095 - 0 0 0 0 0 0 6 6 6 26 26 26
42096 - 62 62 62 106 106 106 74 54 14 185 133 11
42097 -210 162 10 121 92 8 6 6 6 62 62 62
42098 -238 238 238 253 253 253 253 253 253 253 253 253
42099 -253 253 253 253 253 253 253 253 253 253 253 253
42100 -253 253 253 253 253 253 231 231 231 246 246 246
42101 -253 253 253 253 253 253 253 253 253 253 253 253
42102 -253 253 253 253 253 253 253 253 253 253 253 253
42103 -253 253 253 253 253 253 253 253 253 253 253 253
42104 -253 253 253 253 253 253 253 253 253 253 253 253
42105 -253 253 253 253 253 253 158 158 158 18 18 18
42106 - 14 14 14 2 2 6 2 2 6 2 2 6
42107 - 6 6 6 18 18 18 66 66 66 38 38 38
42108 - 6 6 6 94 94 94 50 50 50 18 18 18
42109 - 6 6 6 0 0 0 0 0 0 0 0 0
42110 - 0 0 0 0 0 0 0 0 0 0 0 0
42111 - 0 0 0 0 0 0 0 0 0 0 0 0
42112 - 0 0 0 0 0 0 0 0 0 0 0 0
42113 - 0 0 0 0 0 0 0 0 0 0 0 0
42114 - 0 0 0 0 0 0 0 0 0 6 6 6
42115 - 10 10 10 10 10 10 18 18 18 38 38 38
42116 - 78 78 78 142 134 106 216 158 10 242 186 14
42117 -246 190 14 246 190 14 156 118 10 10 10 10
42118 - 90 90 90 238 238 238 253 253 253 253 253 253
42119 -253 253 253 253 253 253 253 253 253 253 253 253
42120 -253 253 253 253 253 253 231 231 231 250 250 250
42121 -253 253 253 253 253 253 253 253 253 253 253 253
42122 -253 253 253 253 253 253 253 253 253 253 253 253
42123 -253 253 253 253 253 253 253 253 253 253 253 253
42124 -253 253 253 253 253 253 253 253 253 246 230 190
42125 -238 204 91 238 204 91 181 142 44 37 26 9
42126 - 2 2 6 2 2 6 2 2 6 2 2 6
42127 - 2 2 6 2 2 6 38 38 38 46 46 46
42128 - 26 26 26 106 106 106 54 54 54 18 18 18
42129 - 6 6 6 0 0 0 0 0 0 0 0 0
42130 - 0 0 0 0 0 0 0 0 0 0 0 0
42131 - 0 0 0 0 0 0 0 0 0 0 0 0
42132 - 0 0 0 0 0 0 0 0 0 0 0 0
42133 - 0 0 0 0 0 0 0 0 0 0 0 0
42134 - 0 0 0 6 6 6 14 14 14 22 22 22
42135 - 30 30 30 38 38 38 50 50 50 70 70 70
42136 -106 106 106 190 142 34 226 170 11 242 186 14
42137 -246 190 14 246 190 14 246 190 14 154 114 10
42138 - 6 6 6 74 74 74 226 226 226 253 253 253
42139 -253 253 253 253 253 253 253 253 253 253 253 253
42140 -253 253 253 253 253 253 231 231 231 250 250 250
42141 -253 253 253 253 253 253 253 253 253 253 253 253
42142 -253 253 253 253 253 253 253 253 253 253 253 253
42143 -253 253 253 253 253 253 253 253 253 253 253 253
42144 -253 253 253 253 253 253 253 253 253 228 184 62
42145 -241 196 14 241 208 19 232 195 16 38 30 10
42146 - 2 2 6 2 2 6 2 2 6 2 2 6
42147 - 2 2 6 6 6 6 30 30 30 26 26 26
42148 -203 166 17 154 142 90 66 66 66 26 26 26
42149 - 6 6 6 0 0 0 0 0 0 0 0 0
42150 - 0 0 0 0 0 0 0 0 0 0 0 0
42151 - 0 0 0 0 0 0 0 0 0 0 0 0
42152 - 0 0 0 0 0 0 0 0 0 0 0 0
42153 - 0 0 0 0 0 0 0 0 0 0 0 0
42154 - 6 6 6 18 18 18 38 38 38 58 58 58
42155 - 78 78 78 86 86 86 101 101 101 123 123 123
42156 -175 146 61 210 150 10 234 174 13 246 186 14
42157 -246 190 14 246 190 14 246 190 14 238 190 10
42158 -102 78 10 2 2 6 46 46 46 198 198 198
42159 -253 253 253 253 253 253 253 253 253 253 253 253
42160 -253 253 253 253 253 253 234 234 234 242 242 242
42161 -253 253 253 253 253 253 253 253 253 253 253 253
42162 -253 253 253 253 253 253 253 253 253 253 253 253
42163 -253 253 253 253 253 253 253 253 253 253 253 253
42164 -253 253 253 253 253 253 253 253 253 224 178 62
42165 -242 186 14 241 196 14 210 166 10 22 18 6
42166 - 2 2 6 2 2 6 2 2 6 2 2 6
42167 - 2 2 6 2 2 6 6 6 6 121 92 8
42168 -238 202 15 232 195 16 82 82 82 34 34 34
42169 - 10 10 10 0 0 0 0 0 0 0 0 0
42170 - 0 0 0 0 0 0 0 0 0 0 0 0
42171 - 0 0 0 0 0 0 0 0 0 0 0 0
42172 - 0 0 0 0 0 0 0 0 0 0 0 0
42173 - 0 0 0 0 0 0 0 0 0 0 0 0
42174 - 14 14 14 38 38 38 70 70 70 154 122 46
42175 -190 142 34 200 144 11 197 138 11 197 138 11
42176 -213 154 11 226 170 11 242 186 14 246 190 14
42177 -246 190 14 246 190 14 246 190 14 246 190 14
42178 -225 175 15 46 32 6 2 2 6 22 22 22
42179 -158 158 158 250 250 250 253 253 253 253 253 253
42180 -253 253 253 253 253 253 253 253 253 253 253 253
42181 -253 253 253 253 253 253 253 253 253 253 253 253
42182 -253 253 253 253 253 253 253 253 253 253 253 253
42183 -253 253 253 253 253 253 253 253 253 253 253 253
42184 -253 253 253 250 250 250 242 242 242 224 178 62
42185 -239 182 13 236 186 11 213 154 11 46 32 6
42186 - 2 2 6 2 2 6 2 2 6 2 2 6
42187 - 2 2 6 2 2 6 61 42 6 225 175 15
42188 -238 190 10 236 186 11 112 100 78 42 42 42
42189 - 14 14 14 0 0 0 0 0 0 0 0 0
42190 - 0 0 0 0 0 0 0 0 0 0 0 0
42191 - 0 0 0 0 0 0 0 0 0 0 0 0
42192 - 0 0 0 0 0 0 0 0 0 0 0 0
42193 - 0 0 0 0 0 0 0 0 0 6 6 6
42194 - 22 22 22 54 54 54 154 122 46 213 154 11
42195 -226 170 11 230 174 11 226 170 11 226 170 11
42196 -236 178 12 242 186 14 246 190 14 246 190 14
42197 -246 190 14 246 190 14 246 190 14 246 190 14
42198 -241 196 14 184 144 12 10 10 10 2 2 6
42199 - 6 6 6 116 116 116 242 242 242 253 253 253
42200 -253 253 253 253 253 253 253 253 253 253 253 253
42201 -253 253 253 253 253 253 253 253 253 253 253 253
42202 -253 253 253 253 253 253 253 253 253 253 253 253
42203 -253 253 253 253 253 253 253 253 253 253 253 253
42204 -253 253 253 231 231 231 198 198 198 214 170 54
42205 -236 178 12 236 178 12 210 150 10 137 92 6
42206 - 18 14 6 2 2 6 2 2 6 2 2 6
42207 - 6 6 6 70 47 6 200 144 11 236 178 12
42208 -239 182 13 239 182 13 124 112 88 58 58 58
42209 - 22 22 22 6 6 6 0 0 0 0 0 0
42210 - 0 0 0 0 0 0 0 0 0 0 0 0
42211 - 0 0 0 0 0 0 0 0 0 0 0 0
42212 - 0 0 0 0 0 0 0 0 0 0 0 0
42213 - 0 0 0 0 0 0 0 0 0 10 10 10
42214 - 30 30 30 70 70 70 180 133 36 226 170 11
42215 -239 182 13 242 186 14 242 186 14 246 186 14
42216 -246 190 14 246 190 14 246 190 14 246 190 14
42217 -246 190 14 246 190 14 246 190 14 246 190 14
42218 -246 190 14 232 195 16 98 70 6 2 2 6
42219 - 2 2 6 2 2 6 66 66 66 221 221 221
42220 -253 253 253 253 253 253 253 253 253 253 253 253
42221 -253 253 253 253 253 253 253 253 253 253 253 253
42222 -253 253 253 253 253 253 253 253 253 253 253 253
42223 -253 253 253 253 253 253 253 253 253 253 253 253
42224 -253 253 253 206 206 206 198 198 198 214 166 58
42225 -230 174 11 230 174 11 216 158 10 192 133 9
42226 -163 110 8 116 81 8 102 78 10 116 81 8
42227 -167 114 7 197 138 11 226 170 11 239 182 13
42228 -242 186 14 242 186 14 162 146 94 78 78 78
42229 - 34 34 34 14 14 14 6 6 6 0 0 0
42230 - 0 0 0 0 0 0 0 0 0 0 0 0
42231 - 0 0 0 0 0 0 0 0 0 0 0 0
42232 - 0 0 0 0 0 0 0 0 0 0 0 0
42233 - 0 0 0 0 0 0 0 0 0 6 6 6
42234 - 30 30 30 78 78 78 190 142 34 226 170 11
42235 -239 182 13 246 190 14 246 190 14 246 190 14
42236 -246 190 14 246 190 14 246 190 14 246 190 14
42237 -246 190 14 246 190 14 246 190 14 246 190 14
42238 -246 190 14 241 196 14 203 166 17 22 18 6
42239 - 2 2 6 2 2 6 2 2 6 38 38 38
42240 -218 218 218 253 253 253 253 253 253 253 253 253
42241 -253 253 253 253 253 253 253 253 253 253 253 253
42242 -253 253 253 253 253 253 253 253 253 253 253 253
42243 -253 253 253 253 253 253 253 253 253 253 253 253
42244 -250 250 250 206 206 206 198 198 198 202 162 69
42245 -226 170 11 236 178 12 224 166 10 210 150 10
42246 -200 144 11 197 138 11 192 133 9 197 138 11
42247 -210 150 10 226 170 11 242 186 14 246 190 14
42248 -246 190 14 246 186 14 225 175 15 124 112 88
42249 - 62 62 62 30 30 30 14 14 14 6 6 6
42250 - 0 0 0 0 0 0 0 0 0 0 0 0
42251 - 0 0 0 0 0 0 0 0 0 0 0 0
42252 - 0 0 0 0 0 0 0 0 0 0 0 0
42253 - 0 0 0 0 0 0 0 0 0 10 10 10
42254 - 30 30 30 78 78 78 174 135 50 224 166 10
42255 -239 182 13 246 190 14 246 190 14 246 190 14
42256 -246 190 14 246 190 14 246 190 14 246 190 14
42257 -246 190 14 246 190 14 246 190 14 246 190 14
42258 -246 190 14 246 190 14 241 196 14 139 102 15
42259 - 2 2 6 2 2 6 2 2 6 2 2 6
42260 - 78 78 78 250 250 250 253 253 253 253 253 253
42261 -253 253 253 253 253 253 253 253 253 253 253 253
42262 -253 253 253 253 253 253 253 253 253 253 253 253
42263 -253 253 253 253 253 253 253 253 253 253 253 253
42264 -250 250 250 214 214 214 198 198 198 190 150 46
42265 -219 162 10 236 178 12 234 174 13 224 166 10
42266 -216 158 10 213 154 11 213 154 11 216 158 10
42267 -226 170 11 239 182 13 246 190 14 246 190 14
42268 -246 190 14 246 190 14 242 186 14 206 162 42
42269 -101 101 101 58 58 58 30 30 30 14 14 14
42270 - 6 6 6 0 0 0 0 0 0 0 0 0
42271 - 0 0 0 0 0 0 0 0 0 0 0 0
42272 - 0 0 0 0 0 0 0 0 0 0 0 0
42273 - 0 0 0 0 0 0 0 0 0 10 10 10
42274 - 30 30 30 74 74 74 174 135 50 216 158 10
42275 -236 178 12 246 190 14 246 190 14 246 190 14
42276 -246 190 14 246 190 14 246 190 14 246 190 14
42277 -246 190 14 246 190 14 246 190 14 246 190 14
42278 -246 190 14 246 190 14 241 196 14 226 184 13
42279 - 61 42 6 2 2 6 2 2 6 2 2 6
42280 - 22 22 22 238 238 238 253 253 253 253 253 253
42281 -253 253 253 253 253 253 253 253 253 253 253 253
42282 -253 253 253 253 253 253 253 253 253 253 253 253
42283 -253 253 253 253 253 253 253 253 253 253 253 253
42284 -253 253 253 226 226 226 187 187 187 180 133 36
42285 -216 158 10 236 178 12 239 182 13 236 178 12
42286 -230 174 11 226 170 11 226 170 11 230 174 11
42287 -236 178 12 242 186 14 246 190 14 246 190 14
42288 -246 190 14 246 190 14 246 186 14 239 182 13
42289 -206 162 42 106 106 106 66 66 66 34 34 34
42290 - 14 14 14 6 6 6 0 0 0 0 0 0
42291 - 0 0 0 0 0 0 0 0 0 0 0 0
42292 - 0 0 0 0 0 0 0 0 0 0 0 0
42293 - 0 0 0 0 0 0 0 0 0 6 6 6
42294 - 26 26 26 70 70 70 163 133 67 213 154 11
42295 -236 178 12 246 190 14 246 190 14 246 190 14
42296 -246 190 14 246 190 14 246 190 14 246 190 14
42297 -246 190 14 246 190 14 246 190 14 246 190 14
42298 -246 190 14 246 190 14 246 190 14 241 196 14
42299 -190 146 13 18 14 6 2 2 6 2 2 6
42300 - 46 46 46 246 246 246 253 253 253 253 253 253
42301 -253 253 253 253 253 253 253 253 253 253 253 253
42302 -253 253 253 253 253 253 253 253 253 253 253 253
42303 -253 253 253 253 253 253 253 253 253 253 253 253
42304 -253 253 253 221 221 221 86 86 86 156 107 11
42305 -216 158 10 236 178 12 242 186 14 246 186 14
42306 -242 186 14 239 182 13 239 182 13 242 186 14
42307 -242 186 14 246 186 14 246 190 14 246 190 14
42308 -246 190 14 246 190 14 246 190 14 246 190 14
42309 -242 186 14 225 175 15 142 122 72 66 66 66
42310 - 30 30 30 10 10 10 0 0 0 0 0 0
42311 - 0 0 0 0 0 0 0 0 0 0 0 0
42312 - 0 0 0 0 0 0 0 0 0 0 0 0
42313 - 0 0 0 0 0 0 0 0 0 6 6 6
42314 - 26 26 26 70 70 70 163 133 67 210 150 10
42315 -236 178 12 246 190 14 246 190 14 246 190 14
42316 -246 190 14 246 190 14 246 190 14 246 190 14
42317 -246 190 14 246 190 14 246 190 14 246 190 14
42318 -246 190 14 246 190 14 246 190 14 246 190 14
42319 -232 195 16 121 92 8 34 34 34 106 106 106
42320 -221 221 221 253 253 253 253 253 253 253 253 253
42321 -253 253 253 253 253 253 253 253 253 253 253 253
42322 -253 253 253 253 253 253 253 253 253 253 253 253
42323 -253 253 253 253 253 253 253 253 253 253 253 253
42324 -242 242 242 82 82 82 18 14 6 163 110 8
42325 -216 158 10 236 178 12 242 186 14 246 190 14
42326 -246 190 14 246 190 14 246 190 14 246 190 14
42327 -246 190 14 246 190 14 246 190 14 246 190 14
42328 -246 190 14 246 190 14 246 190 14 246 190 14
42329 -246 190 14 246 190 14 242 186 14 163 133 67
42330 - 46 46 46 18 18 18 6 6 6 0 0 0
42331 - 0 0 0 0 0 0 0 0 0 0 0 0
42332 - 0 0 0 0 0 0 0 0 0 0 0 0
42333 - 0 0 0 0 0 0 0 0 0 10 10 10
42334 - 30 30 30 78 78 78 163 133 67 210 150 10
42335 -236 178 12 246 186 14 246 190 14 246 190 14
42336 -246 190 14 246 190 14 246 190 14 246 190 14
42337 -246 190 14 246 190 14 246 190 14 246 190 14
42338 -246 190 14 246 190 14 246 190 14 246 190 14
42339 -241 196 14 215 174 15 190 178 144 253 253 253
42340 -253 253 253 253 253 253 253 253 253 253 253 253
42341 -253 253 253 253 253 253 253 253 253 253 253 253
42342 -253 253 253 253 253 253 253 253 253 253 253 253
42343 -253 253 253 253 253 253 253 253 253 218 218 218
42344 - 58 58 58 2 2 6 22 18 6 167 114 7
42345 -216 158 10 236 178 12 246 186 14 246 190 14
42346 -246 190 14 246 190 14 246 190 14 246 190 14
42347 -246 190 14 246 190 14 246 190 14 246 190 14
42348 -246 190 14 246 190 14 246 190 14 246 190 14
42349 -246 190 14 246 186 14 242 186 14 190 150 46
42350 - 54 54 54 22 22 22 6 6 6 0 0 0
42351 - 0 0 0 0 0 0 0 0 0 0 0 0
42352 - 0 0 0 0 0 0 0 0 0 0 0 0
42353 - 0 0 0 0 0 0 0 0 0 14 14 14
42354 - 38 38 38 86 86 86 180 133 36 213 154 11
42355 -236 178 12 246 186 14 246 190 14 246 190 14
42356 -246 190 14 246 190 14 246 190 14 246 190 14
42357 -246 190 14 246 190 14 246 190 14 246 190 14
42358 -246 190 14 246 190 14 246 190 14 246 190 14
42359 -246 190 14 232 195 16 190 146 13 214 214 214
42360 -253 253 253 253 253 253 253 253 253 253 253 253
42361 -253 253 253 253 253 253 253 253 253 253 253 253
42362 -253 253 253 253 253 253 253 253 253 253 253 253
42363 -253 253 253 250 250 250 170 170 170 26 26 26
42364 - 2 2 6 2 2 6 37 26 9 163 110 8
42365 -219 162 10 239 182 13 246 186 14 246 190 14
42366 -246 190 14 246 190 14 246 190 14 246 190 14
42367 -246 190 14 246 190 14 246 190 14 246 190 14
42368 -246 190 14 246 190 14 246 190 14 246 190 14
42369 -246 186 14 236 178 12 224 166 10 142 122 72
42370 - 46 46 46 18 18 18 6 6 6 0 0 0
42371 - 0 0 0 0 0 0 0 0 0 0 0 0
42372 - 0 0 0 0 0 0 0 0 0 0 0 0
42373 - 0 0 0 0 0 0 6 6 6 18 18 18
42374 - 50 50 50 109 106 95 192 133 9 224 166 10
42375 -242 186 14 246 190 14 246 190 14 246 190 14
42376 -246 190 14 246 190 14 246 190 14 246 190 14
42377 -246 190 14 246 190 14 246 190 14 246 190 14
42378 -246 190 14 246 190 14 246 190 14 246 190 14
42379 -242 186 14 226 184 13 210 162 10 142 110 46
42380 -226 226 226 253 253 253 253 253 253 253 253 253
42381 -253 253 253 253 253 253 253 253 253 253 253 253
42382 -253 253 253 253 253 253 253 253 253 253 253 253
42383 -198 198 198 66 66 66 2 2 6 2 2 6
42384 - 2 2 6 2 2 6 50 34 6 156 107 11
42385 -219 162 10 239 182 13 246 186 14 246 190 14
42386 -246 190 14 246 190 14 246 190 14 246 190 14
42387 -246 190 14 246 190 14 246 190 14 246 190 14
42388 -246 190 14 246 190 14 246 190 14 242 186 14
42389 -234 174 13 213 154 11 154 122 46 66 66 66
42390 - 30 30 30 10 10 10 0 0 0 0 0 0
42391 - 0 0 0 0 0 0 0 0 0 0 0 0
42392 - 0 0 0 0 0 0 0 0 0 0 0 0
42393 - 0 0 0 0 0 0 6 6 6 22 22 22
42394 - 58 58 58 154 121 60 206 145 10 234 174 13
42395 -242 186 14 246 186 14 246 190 14 246 190 14
42396 -246 190 14 246 190 14 246 190 14 246 190 14
42397 -246 190 14 246 190 14 246 190 14 246 190 14
42398 -246 190 14 246 190 14 246 190 14 246 190 14
42399 -246 186 14 236 178 12 210 162 10 163 110 8
42400 - 61 42 6 138 138 138 218 218 218 250 250 250
42401 -253 253 253 253 253 253 253 253 253 250 250 250
42402 -242 242 242 210 210 210 144 144 144 66 66 66
42403 - 6 6 6 2 2 6 2 2 6 2 2 6
42404 - 2 2 6 2 2 6 61 42 6 163 110 8
42405 -216 158 10 236 178 12 246 190 14 246 190 14
42406 -246 190 14 246 190 14 246 190 14 246 190 14
42407 -246 190 14 246 190 14 246 190 14 246 190 14
42408 -246 190 14 239 182 13 230 174 11 216 158 10
42409 -190 142 34 124 112 88 70 70 70 38 38 38
42410 - 18 18 18 6 6 6 0 0 0 0 0 0
42411 - 0 0 0 0 0 0 0 0 0 0 0 0
42412 - 0 0 0 0 0 0 0 0 0 0 0 0
42413 - 0 0 0 0 0 0 6 6 6 22 22 22
42414 - 62 62 62 168 124 44 206 145 10 224 166 10
42415 -236 178 12 239 182 13 242 186 14 242 186 14
42416 -246 186 14 246 190 14 246 190 14 246 190 14
42417 -246 190 14 246 190 14 246 190 14 246 190 14
42418 -246 190 14 246 190 14 246 190 14 246 190 14
42419 -246 190 14 236 178 12 216 158 10 175 118 6
42420 - 80 54 7 2 2 6 6 6 6 30 30 30
42421 - 54 54 54 62 62 62 50 50 50 38 38 38
42422 - 14 14 14 2 2 6 2 2 6 2 2 6
42423 - 2 2 6 2 2 6 2 2 6 2 2 6
42424 - 2 2 6 6 6 6 80 54 7 167 114 7
42425 -213 154 11 236 178 12 246 190 14 246 190 14
42426 -246 190 14 246 190 14 246 190 14 246 190 14
42427 -246 190 14 242 186 14 239 182 13 239 182 13
42428 -230 174 11 210 150 10 174 135 50 124 112 88
42429 - 82 82 82 54 54 54 34 34 34 18 18 18
42430 - 6 6 6 0 0 0 0 0 0 0 0 0
42431 - 0 0 0 0 0 0 0 0 0 0 0 0
42432 - 0 0 0 0 0 0 0 0 0 0 0 0
42433 - 0 0 0 0 0 0 6 6 6 18 18 18
42434 - 50 50 50 158 118 36 192 133 9 200 144 11
42435 -216 158 10 219 162 10 224 166 10 226 170 11
42436 -230 174 11 236 178 12 239 182 13 239 182 13
42437 -242 186 14 246 186 14 246 190 14 246 190 14
42438 -246 190 14 246 190 14 246 190 14 246 190 14
42439 -246 186 14 230 174 11 210 150 10 163 110 8
42440 -104 69 6 10 10 10 2 2 6 2 2 6
42441 - 2 2 6 2 2 6 2 2 6 2 2 6
42442 - 2 2 6 2 2 6 2 2 6 2 2 6
42443 - 2 2 6 2 2 6 2 2 6 2 2 6
42444 - 2 2 6 6 6 6 91 60 6 167 114 7
42445 -206 145 10 230 174 11 242 186 14 246 190 14
42446 -246 190 14 246 190 14 246 186 14 242 186 14
42447 -239 182 13 230 174 11 224 166 10 213 154 11
42448 -180 133 36 124 112 88 86 86 86 58 58 58
42449 - 38 38 38 22 22 22 10 10 10 6 6 6
42450 - 0 0 0 0 0 0 0 0 0 0 0 0
42451 - 0 0 0 0 0 0 0 0 0 0 0 0
42452 - 0 0 0 0 0 0 0 0 0 0 0 0
42453 - 0 0 0 0 0 0 0 0 0 14 14 14
42454 - 34 34 34 70 70 70 138 110 50 158 118 36
42455 -167 114 7 180 123 7 192 133 9 197 138 11
42456 -200 144 11 206 145 10 213 154 11 219 162 10
42457 -224 166 10 230 174 11 239 182 13 242 186 14
42458 -246 186 14 246 186 14 246 186 14 246 186 14
42459 -239 182 13 216 158 10 185 133 11 152 99 6
42460 -104 69 6 18 14 6 2 2 6 2 2 6
42461 - 2 2 6 2 2 6 2 2 6 2 2 6
42462 - 2 2 6 2 2 6 2 2 6 2 2 6
42463 - 2 2 6 2 2 6 2 2 6 2 2 6
42464 - 2 2 6 6 6 6 80 54 7 152 99 6
42465 -192 133 9 219 162 10 236 178 12 239 182 13
42466 -246 186 14 242 186 14 239 182 13 236 178 12
42467 -224 166 10 206 145 10 192 133 9 154 121 60
42468 - 94 94 94 62 62 62 42 42 42 22 22 22
42469 - 14 14 14 6 6 6 0 0 0 0 0 0
42470 - 0 0 0 0 0 0 0 0 0 0 0 0
42471 - 0 0 0 0 0 0 0 0 0 0 0 0
42472 - 0 0 0 0 0 0 0 0 0 0 0 0
42473 - 0 0 0 0 0 0 0 0 0 6 6 6
42474 - 18 18 18 34 34 34 58 58 58 78 78 78
42475 -101 98 89 124 112 88 142 110 46 156 107 11
42476 -163 110 8 167 114 7 175 118 6 180 123 7
42477 -185 133 11 197 138 11 210 150 10 219 162 10
42478 -226 170 11 236 178 12 236 178 12 234 174 13
42479 -219 162 10 197 138 11 163 110 8 130 83 6
42480 - 91 60 6 10 10 10 2 2 6 2 2 6
42481 - 18 18 18 38 38 38 38 38 38 38 38 38
42482 - 38 38 38 38 38 38 38 38 38 38 38 38
42483 - 38 38 38 38 38 38 26 26 26 2 2 6
42484 - 2 2 6 6 6 6 70 47 6 137 92 6
42485 -175 118 6 200 144 11 219 162 10 230 174 11
42486 -234 174 13 230 174 11 219 162 10 210 150 10
42487 -192 133 9 163 110 8 124 112 88 82 82 82
42488 - 50 50 50 30 30 30 14 14 14 6 6 6
42489 - 0 0 0 0 0 0 0 0 0 0 0 0
42490 - 0 0 0 0 0 0 0 0 0 0 0 0
42491 - 0 0 0 0 0 0 0 0 0 0 0 0
42492 - 0 0 0 0 0 0 0 0 0 0 0 0
42493 - 0 0 0 0 0 0 0 0 0 0 0 0
42494 - 6 6 6 14 14 14 22 22 22 34 34 34
42495 - 42 42 42 58 58 58 74 74 74 86 86 86
42496 -101 98 89 122 102 70 130 98 46 121 87 25
42497 -137 92 6 152 99 6 163 110 8 180 123 7
42498 -185 133 11 197 138 11 206 145 10 200 144 11
42499 -180 123 7 156 107 11 130 83 6 104 69 6
42500 - 50 34 6 54 54 54 110 110 110 101 98 89
42501 - 86 86 86 82 82 82 78 78 78 78 78 78
42502 - 78 78 78 78 78 78 78 78 78 78 78 78
42503 - 78 78 78 82 82 82 86 86 86 94 94 94
42504 -106 106 106 101 101 101 86 66 34 124 80 6
42505 -156 107 11 180 123 7 192 133 9 200 144 11
42506 -206 145 10 200 144 11 192 133 9 175 118 6
42507 -139 102 15 109 106 95 70 70 70 42 42 42
42508 - 22 22 22 10 10 10 0 0 0 0 0 0
42509 - 0 0 0 0 0 0 0 0 0 0 0 0
42510 - 0 0 0 0 0 0 0 0 0 0 0 0
42511 - 0 0 0 0 0 0 0 0 0 0 0 0
42512 - 0 0 0 0 0 0 0 0 0 0 0 0
42513 - 0 0 0 0 0 0 0 0 0 0 0 0
42514 - 0 0 0 0 0 0 6 6 6 10 10 10
42515 - 14 14 14 22 22 22 30 30 30 38 38 38
42516 - 50 50 50 62 62 62 74 74 74 90 90 90
42517 -101 98 89 112 100 78 121 87 25 124 80 6
42518 -137 92 6 152 99 6 152 99 6 152 99 6
42519 -138 86 6 124 80 6 98 70 6 86 66 30
42520 -101 98 89 82 82 82 58 58 58 46 46 46
42521 - 38 38 38 34 34 34 34 34 34 34 34 34
42522 - 34 34 34 34 34 34 34 34 34 34 34 34
42523 - 34 34 34 34 34 34 38 38 38 42 42 42
42524 - 54 54 54 82 82 82 94 86 76 91 60 6
42525 -134 86 6 156 107 11 167 114 7 175 118 6
42526 -175 118 6 167 114 7 152 99 6 121 87 25
42527 -101 98 89 62 62 62 34 34 34 18 18 18
42528 - 6 6 6 0 0 0 0 0 0 0 0 0
42529 - 0 0 0 0 0 0 0 0 0 0 0 0
42530 - 0 0 0 0 0 0 0 0 0 0 0 0
42531 - 0 0 0 0 0 0 0 0 0 0 0 0
42532 - 0 0 0 0 0 0 0 0 0 0 0 0
42533 - 0 0 0 0 0 0 0 0 0 0 0 0
42534 - 0 0 0 0 0 0 0 0 0 0 0 0
42535 - 0 0 0 6 6 6 6 6 6 10 10 10
42536 - 18 18 18 22 22 22 30 30 30 42 42 42
42537 - 50 50 50 66 66 66 86 86 86 101 98 89
42538 -106 86 58 98 70 6 104 69 6 104 69 6
42539 -104 69 6 91 60 6 82 62 34 90 90 90
42540 - 62 62 62 38 38 38 22 22 22 14 14 14
42541 - 10 10 10 10 10 10 10 10 10 10 10 10
42542 - 10 10 10 10 10 10 6 6 6 10 10 10
42543 - 10 10 10 10 10 10 10 10 10 14 14 14
42544 - 22 22 22 42 42 42 70 70 70 89 81 66
42545 - 80 54 7 104 69 6 124 80 6 137 92 6
42546 -134 86 6 116 81 8 100 82 52 86 86 86
42547 - 58 58 58 30 30 30 14 14 14 6 6 6
42548 - 0 0 0 0 0 0 0 0 0 0 0 0
42549 - 0 0 0 0 0 0 0 0 0 0 0 0
42550 - 0 0 0 0 0 0 0 0 0 0 0 0
42551 - 0 0 0 0 0 0 0 0 0 0 0 0
42552 - 0 0 0 0 0 0 0 0 0 0 0 0
42553 - 0 0 0 0 0 0 0 0 0 0 0 0
42554 - 0 0 0 0 0 0 0 0 0 0 0 0
42555 - 0 0 0 0 0 0 0 0 0 0 0 0
42556 - 0 0 0 6 6 6 10 10 10 14 14 14
42557 - 18 18 18 26 26 26 38 38 38 54 54 54
42558 - 70 70 70 86 86 86 94 86 76 89 81 66
42559 - 89 81 66 86 86 86 74 74 74 50 50 50
42560 - 30 30 30 14 14 14 6 6 6 0 0 0
42561 - 0 0 0 0 0 0 0 0 0 0 0 0
42562 - 0 0 0 0 0 0 0 0 0 0 0 0
42563 - 0 0 0 0 0 0 0 0 0 0 0 0
42564 - 6 6 6 18 18 18 34 34 34 58 58 58
42565 - 82 82 82 89 81 66 89 81 66 89 81 66
42566 - 94 86 66 94 86 76 74 74 74 50 50 50
42567 - 26 26 26 14 14 14 6 6 6 0 0 0
42568 - 0 0 0 0 0 0 0 0 0 0 0 0
42569 - 0 0 0 0 0 0 0 0 0 0 0 0
42570 - 0 0 0 0 0 0 0 0 0 0 0 0
42571 - 0 0 0 0 0 0 0 0 0 0 0 0
42572 - 0 0 0 0 0 0 0 0 0 0 0 0
42573 - 0 0 0 0 0 0 0 0 0 0 0 0
42574 - 0 0 0 0 0 0 0 0 0 0 0 0
42575 - 0 0 0 0 0 0 0 0 0 0 0 0
42576 - 0 0 0 0 0 0 0 0 0 0 0 0
42577 - 6 6 6 6 6 6 14 14 14 18 18 18
42578 - 30 30 30 38 38 38 46 46 46 54 54 54
42579 - 50 50 50 42 42 42 30 30 30 18 18 18
42580 - 10 10 10 0 0 0 0 0 0 0 0 0
42581 - 0 0 0 0 0 0 0 0 0 0 0 0
42582 - 0 0 0 0 0 0 0 0 0 0 0 0
42583 - 0 0 0 0 0 0 0 0 0 0 0 0
42584 - 0 0 0 6 6 6 14 14 14 26 26 26
42585 - 38 38 38 50 50 50 58 58 58 58 58 58
42586 - 54 54 54 42 42 42 30 30 30 18 18 18
42587 - 10 10 10 0 0 0 0 0 0 0 0 0
42588 - 0 0 0 0 0 0 0 0 0 0 0 0
42589 - 0 0 0 0 0 0 0 0 0 0 0 0
42590 - 0 0 0 0 0 0 0 0 0 0 0 0
42591 - 0 0 0 0 0 0 0 0 0 0 0 0
42592 - 0 0 0 0 0 0 0 0 0 0 0 0
42593 - 0 0 0 0 0 0 0 0 0 0 0 0
42594 - 0 0 0 0 0 0 0 0 0 0 0 0
42595 - 0 0 0 0 0 0 0 0 0 0 0 0
42596 - 0 0 0 0 0 0 0 0 0 0 0 0
42597 - 0 0 0 0 0 0 0 0 0 6 6 6
42598 - 6 6 6 10 10 10 14 14 14 18 18 18
42599 - 18 18 18 14 14 14 10 10 10 6 6 6
42600 - 0 0 0 0 0 0 0 0 0 0 0 0
42601 - 0 0 0 0 0 0 0 0 0 0 0 0
42602 - 0 0 0 0 0 0 0 0 0 0 0 0
42603 - 0 0 0 0 0 0 0 0 0 0 0 0
42604 - 0 0 0 0 0 0 0 0 0 6 6 6
42605 - 14 14 14 18 18 18 22 22 22 22 22 22
42606 - 18 18 18 14 14 14 10 10 10 6 6 6
42607 - 0 0 0 0 0 0 0 0 0 0 0 0
42608 - 0 0 0 0 0 0 0 0 0 0 0 0
42609 - 0 0 0 0 0 0 0 0 0 0 0 0
42610 - 0 0 0 0 0 0 0 0 0 0 0 0
42611 - 0 0 0 0 0 0 0 0 0 0 0 0
42612 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42613 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42614 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42615 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42616 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42617 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42618 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42619 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42620 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42621 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42622 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42623 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42624 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42625 +4 4 4 4 4 4
42626 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42627 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42628 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42629 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42630 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42631 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42632 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42633 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42634 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42635 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42636 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42637 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42638 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42639 +4 4 4 4 4 4
42640 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42641 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42642 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42643 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42644 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42645 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42646 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42647 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42648 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42649 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42650 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42651 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42652 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42653 +4 4 4 4 4 4
42654 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42655 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42656 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42657 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42658 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42659 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42660 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42661 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42662 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42663 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42664 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42665 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42666 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42667 +4 4 4 4 4 4
42668 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42669 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42670 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42671 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42672 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42673 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42674 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42675 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42676 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42677 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42678 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42679 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42680 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42681 +4 4 4 4 4 4
42682 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42683 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42684 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42685 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42686 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42687 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42688 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42689 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42690 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42691 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42692 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42693 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42694 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42695 +4 4 4 4 4 4
42696 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42697 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42698 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42699 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42700 +4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
42701 +0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
42702 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42703 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42704 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42705 +4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
42706 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
42707 +4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
42708 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42709 +4 4 4 4 4 4
42710 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42711 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42712 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42713 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42714 +4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
42715 +37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
42716 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42717 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42718 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42719 +4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
42720 +2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
42721 +4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
42722 +1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42723 +4 4 4 4 4 4
42724 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42725 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42726 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42727 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42728 +2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
42729 +153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
42730 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
42731 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42732 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42733 +4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
42734 +60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
42735 +4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
42736 +2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
42737 +4 4 4 4 4 4
42738 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42739 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42740 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42741 +4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
42742 +4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
42743 +165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
42744 +1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
42745 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42746 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
42747 +3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
42748 +163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
42749 +0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
42750 +37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
42751 +4 4 4 4 4 4
42752 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42753 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42754 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42755 +4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
42756 +37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
42757 +156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
42758 +125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
42759 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
42760 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
42761 +0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
42762 +174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
42763 +0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
42764 +64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
42765 +4 4 4 4 4 4
42766 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42767 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42768 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
42769 +5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
42770 +156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
42771 +156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
42772 +174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
42773 +1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
42774 +4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
42775 +13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
42776 +174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
42777 +22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
42778 +90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
42779 +4 4 4 4 4 4
42780 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42781 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42782 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
42783 +0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
42784 +174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
42785 +156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
42786 +163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
42787 +4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
42788 +5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
42789 +131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
42790 +190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
42791 +90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
42792 +31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
42793 +4 4 4 4 4 4
42794 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42795 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42796 +4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
42797 +4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
42798 +155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
42799 +167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
42800 +153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
42801 +41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
42802 +1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
42803 +177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
42804 +125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
42805 +136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
42806 +7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
42807 +4 4 4 4 4 4
42808 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42809 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42810 +4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
42811 +125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
42812 +156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
42813 +137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
42814 +156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
42815 +167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
42816 +0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
42817 +166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
42818 +6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
42819 +90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
42820 +1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
42821 +4 4 4 4 4 4
42822 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42823 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42824 +1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
42825 +167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
42826 +157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
42827 +26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
42828 +158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
42829 +165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
42830 +60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
42831 +137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
42832 +52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
42833 +13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
42834 +4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
42835 +4 4 4 4 4 4
42836 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42837 +4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
42838 +0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
42839 +158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
42840 +167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
42841 +4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
42842 +174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
42843 +155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
42844 +137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
42845 +16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
42846 +136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
42847 +2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
42848 +4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
42849 +4 4 4 4 4 4
42850 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
42851 +4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
42852 +37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
42853 +157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
42854 +153 152 153 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
42855 +4 3 3 4 3 3 4 0 0 6 6 6 4 0 0 37 38 37
42856 +125 124 125 174 174 174 174 174 174 165 164 165 156 155 156 154 153 154
42857 +156 155 156 156 155 156 155 154 155 163 162 163 158 157 158 163 162 163
42858 +174 174 174 174 174 174 174 174 174 125 124 125 37 38 37 0 0 0
42859 +4 0 0 6 9 11 41 54 63 90 154 193 136 185 209 146 190 211
42860 +136 185 209 37 112 160 22 40 52 6 10 14 3 6 7 1 1 2
42861 +1 1 2 3 3 3 1 1 2 3 3 3 4 4 4 4 4 4
42862 +2 2 2 2 0 0 16 19 21 37 38 37 24 26 27 0 0 0
42863 +0 0 0 4 4 4
42864 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
42865 +4 4 4 0 0 0 0 0 0 0 0 0 26 28 28 120 125 127
42866 +158 157 158 174 174 174 165 164 165 157 156 157 155 154 155 156 155 156
42867 +153 152 153 153 152 153 167 166 167 174 174 174 174 174 174 125 124 125
42868 +37 38 37 4 0 0 0 0 0 4 0 0 4 3 3 4 4 4
42869 +4 4 4 4 4 4 5 5 5 4 0 0 4 0 0 4 0 0
42870 +4 3 3 43 57 68 137 136 137 174 174 174 174 174 174 165 164 165
42871 +154 153 154 153 152 153 153 152 153 153 152 153 163 162 163 174 174 174
42872 +174 174 174 153 152 153 60 73 81 6 6 6 4 0 0 4 3 3
42873 +32 43 50 80 127 157 136 185 209 146 190 211 146 190 211 90 154 193
42874 +28 67 93 28 67 93 40 71 93 3 6 7 1 1 2 2 5 5
42875 +50 82 103 79 117 143 26 37 45 0 0 0 3 3 3 1 1 1
42876 +0 0 0 41 54 63 137 136 137 174 174 174 153 152 153 60 73 81
42877 +2 0 0 0 0 0
42878 +4 4 4 4 4 4 4 4 4 4 4 4 6 6 6 2 2 2
42879 +0 0 0 2 0 0 24 26 27 60 74 84 153 152 153 174 174 174
42880 +174 174 174 157 156 157 154 153 154 156 155 156 154 153 154 153 152 153
42881 +165 164 165 174 174 174 177 184 187 137 136 137 43 57 68 6 6 6
42882 +4 0 0 2 0 0 3 3 3 5 5 5 5 5 5 4 4 4
42883 +4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 4 3 3
42884 +4 0 0 4 0 0 24 26 27 60 73 81 153 152 153 174 174 174
42885 +174 174 174 158 157 158 158 157 158 174 174 174 174 174 174 158 157 158
42886 +60 74 84 24 26 27 4 0 0 4 0 0 17 23 27 59 113 148
42887 +136 185 209 191 222 234 146 190 211 136 185 209 31 91 132 7 11 13
42888 +22 40 52 101 161 196 90 154 193 6 9 11 3 4 4 43 95 132
42889 +136 185 209 172 205 220 55 98 126 0 0 0 0 0 0 2 0 0
42890 +26 28 28 153 152 153 177 184 187 167 166 167 177 184 187 165 164 165
42891 +37 38 37 0 0 0
42892 +4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
42893 +13 16 17 60 73 81 137 136 137 174 174 174 174 174 174 165 164 165
42894 +153 152 153 153 152 153 155 154 155 154 153 154 158 157 158 174 174 174
42895 +177 184 187 163 162 163 60 73 81 16 19 21 4 0 0 4 0 0
42896 +4 3 3 4 4 4 5 5 5 5 5 5 4 4 4 5 5 5
42897 +5 5 5 5 5 5 5 5 5 4 4 4 4 4 4 5 5 5
42898 +6 6 6 4 0 0 4 0 0 4 0 0 24 26 27 60 74 84
42899 +166 165 166 174 174 174 177 184 187 165 164 165 125 124 125 24 26 27
42900 +4 0 0 4 0 0 5 5 5 50 82 103 136 185 209 172 205 220
42901 +146 190 211 136 185 209 26 108 161 22 40 52 7 12 15 44 81 103
42902 +71 116 144 28 67 93 37 51 59 41 65 82 100 139 164 101 161 196
42903 +90 154 193 90 154 193 28 67 93 0 0 0 0 0 0 26 28 28
42904 +125 124 125 167 166 167 163 162 163 153 152 153 163 162 163 174 174 174
42905 +85 115 134 4 0 0
42906 +4 4 4 5 5 5 4 4 4 1 0 0 4 0 0 34 47 55
42907 +125 124 125 174 174 174 174 174 174 167 166 167 157 156 157 153 152 153
42908 +155 154 155 155 154 155 158 157 158 166 165 166 167 166 167 154 153 154
42909 +125 124 125 26 28 28 4 0 0 4 0 0 4 0 0 5 5 5
42910 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 1 1 1
42911 +0 0 0 0 0 0 1 1 1 4 4 4 4 4 4 4 4 4
42912 +5 5 5 5 5 5 4 3 3 4 0 0 4 0 0 6 6 6
42913 +37 38 37 131 129 131 137 136 137 37 38 37 0 0 0 4 0 0
42914 +4 5 5 43 61 72 90 154 193 172 205 220 146 190 211 136 185 209
42915 +90 154 193 28 67 93 13 20 25 43 61 72 71 116 144 44 81 103
42916 +2 5 5 7 11 13 59 113 148 101 161 196 90 154 193 28 67 93
42917 +13 20 25 6 10 14 0 0 0 13 16 17 60 73 81 137 136 137
42918 +166 165 166 158 157 158 156 155 156 154 153 154 167 166 167 174 174 174
42919 +60 73 81 4 0 0
42920 +4 4 4 4 4 4 0 0 0 3 3 3 60 74 84 174 174 174
42921 +174 174 174 167 166 167 163 162 163 155 154 155 157 156 157 155 154 155
42922 +156 155 156 163 162 163 167 166 167 158 157 158 125 124 125 37 38 37
42923 +4 3 3 4 0 0 4 0 0 6 6 6 6 6 6 5 5 5
42924 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 2 3 3
42925 +10 13 16 7 11 13 1 0 0 0 0 0 2 2 1 4 4 4
42926 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 4 0 0
42927 +4 0 0 7 11 13 13 16 17 4 0 0 3 3 3 34 47 55
42928 +80 127 157 146 190 211 172 205 220 136 185 209 136 185 209 136 185 209
42929 +28 67 93 22 40 52 55 98 126 55 98 126 21 29 34 7 11 13
42930 +50 82 103 101 161 196 101 161 196 35 83 115 13 20 25 2 2 1
42931 +1 1 2 1 1 2 37 51 59 131 129 131 174 174 174 174 174 174
42932 +167 166 167 163 162 163 163 162 163 167 166 167 174 174 174 125 124 125
42933 +16 19 21 4 0 0
42934 +4 4 4 4 0 0 4 0 0 60 74 84 174 174 174 174 174 174
42935 +158 157 158 155 154 155 155 154 155 156 155 156 155 154 155 158 157 158
42936 +167 166 167 165 164 165 131 129 131 60 73 81 13 16 17 4 0 0
42937 +4 0 0 4 3 3 6 6 6 4 3 3 5 5 5 4 4 4
42938 +4 4 4 3 2 2 0 0 0 0 0 0 7 11 13 45 69 86
42939 +80 127 157 71 116 144 43 61 72 7 11 13 0 0 0 1 1 1
42940 +4 3 3 4 4 4 4 4 4 4 4 4 6 6 6 5 5 5
42941 +3 2 2 4 0 0 1 0 0 21 29 34 59 113 148 136 185 209
42942 +146 190 211 136 185 209 136 185 209 136 185 209 136 185 209 136 185 209
42943 +68 124 159 44 81 103 22 40 52 13 16 17 43 61 72 90 154 193
42944 +136 185 209 59 113 148 21 29 34 3 4 3 1 1 1 0 0 0
42945 +24 26 27 125 124 125 163 162 163 174 174 174 166 165 166 165 164 165
42946 +163 162 163 125 124 125 125 124 125 125 124 125 125 124 125 26 28 28
42947 +4 0 0 4 3 3
42948 +3 3 3 0 0 0 24 26 27 153 152 153 177 184 187 158 157 158
42949 +156 155 156 156 155 156 155 154 155 155 154 155 165 164 165 174 174 174
42950 +155 154 155 60 74 84 26 28 28 4 0 0 4 0 0 3 1 0
42951 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3
42952 +2 0 0 0 0 0 0 0 0 32 43 50 72 125 159 101 161 196
42953 +136 185 209 101 161 196 101 161 196 79 117 143 32 43 50 0 0 0
42954 +0 0 0 2 2 2 4 4 4 4 4 4 3 3 3 1 0 0
42955 +0 0 0 4 5 5 49 76 92 101 161 196 146 190 211 146 190 211
42956 +136 185 209 136 185 209 136 185 209 136 185 209 136 185 209 90 154 193
42957 +28 67 93 13 16 17 37 51 59 80 127 157 136 185 209 90 154 193
42958 +22 40 52 6 9 11 3 4 3 2 2 1 16 19 21 60 73 81
42959 +137 136 137 163 162 163 158 157 158 166 165 166 167 166 167 153 152 153
42960 +60 74 84 37 38 37 6 6 6 13 16 17 4 0 0 1 0 0
42961 +3 2 2 4 4 4
42962 +3 2 2 4 0 0 37 38 37 137 136 137 167 166 167 158 157 158
42963 +157 156 157 154 153 154 157 156 157 167 166 167 174 174 174 125 124 125
42964 +37 38 37 4 0 0 4 0 0 4 0 0 4 3 3 4 4 4
42965 +4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
42966 +0 0 0 16 21 25 55 98 126 90 154 193 136 185 209 101 161 196
42967 +101 161 196 101 161 196 136 185 209 136 185 209 101 161 196 55 98 126
42968 +14 17 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
42969 +22 40 52 90 154 193 146 190 211 146 190 211 136 185 209 136 185 209
42970 +136 185 209 136 185 209 136 185 209 101 161 196 35 83 115 7 11 13
42971 +17 23 27 59 113 148 136 185 209 101 161 196 34 86 122 7 12 15
42972 +2 5 5 3 4 3 6 6 6 60 73 81 131 129 131 163 162 163
42973 +166 165 166 174 174 174 174 174 174 163 162 163 125 124 125 41 54 63
42974 +13 16 17 4 0 0 4 0 0 4 0 0 1 0 0 2 2 2
42975 +4 4 4 4 4 4
42976 +1 1 1 2 1 0 43 57 68 137 136 137 153 152 153 153 152 153
42977 +163 162 163 156 155 156 165 164 165 167 166 167 60 74 84 6 6 6
42978 +4 0 0 4 0 0 5 5 5 4 4 4 4 4 4 4 4 4
42979 +4 5 5 6 6 6 4 3 3 0 0 0 0 0 0 11 15 18
42980 +40 71 93 100 139 164 101 161 196 101 161 196 101 161 196 101 161 196
42981 +101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 136 185 209
42982 +101 161 196 45 69 86 6 6 6 0 0 0 17 23 27 55 98 126
42983 +136 185 209 146 190 211 136 185 209 136 185 209 136 185 209 136 185 209
42984 +136 185 209 136 185 209 90 154 193 22 40 52 7 11 13 50 82 103
42985 +136 185 209 136 185 209 53 118 160 22 40 52 7 11 13 2 5 5
42986 +3 4 3 37 38 37 125 124 125 157 156 157 166 165 166 167 166 167
42987 +174 174 174 174 174 174 137 136 137 60 73 81 4 0 0 4 0 0
42988 +4 0 0 4 0 0 5 5 5 3 3 3 3 3 3 4 4 4
42989 +4 4 4 4 4 4
42990 +4 0 0 4 0 0 41 54 63 137 136 137 125 124 125 131 129 131
42991 +155 154 155 167 166 167 174 174 174 60 74 84 6 6 6 4 0 0
42992 +4 3 3 6 6 6 4 4 4 4 4 4 4 4 4 5 5 5
42993 +4 4 4 1 1 1 0 0 0 3 6 7 41 65 82 72 125 159
42994 +101 161 196 101 161 196 101 161 196 90 154 193 90 154 193 101 161 196
42995 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
42996 +136 185 209 136 185 209 80 127 157 55 98 126 101 161 196 146 190 211
42997 +136 185 209 136 185 209 136 185 209 101 161 196 136 185 209 101 161 196
42998 +136 185 209 101 161 196 35 83 115 22 30 35 101 161 196 172 205 220
42999 +90 154 193 28 67 93 7 11 13 2 5 5 3 4 3 13 16 17
43000 +85 115 134 167 166 167 174 174 174 174 174 174 174 174 174 174 174 174
43001 +167 166 167 60 74 84 13 16 17 4 0 0 4 0 0 4 3 3
43002 +6 6 6 5 5 5 4 4 4 5 5 5 4 4 4 5 5 5
43003 +5 5 5 5 5 5
43004 +1 1 1 4 0 0 41 54 63 137 136 137 137 136 137 125 124 125
43005 +131 129 131 167 166 167 157 156 157 37 38 37 6 6 6 4 0 0
43006 +6 6 6 5 5 5 4 4 4 4 4 4 4 5 5 2 2 1
43007 +0 0 0 0 0 0 26 37 45 58 111 146 101 161 196 101 161 196
43008 +101 161 196 90 154 193 90 154 193 90 154 193 101 161 196 101 161 196
43009 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
43010 +101 161 196 136 185 209 136 185 209 136 185 209 146 190 211 136 185 209
43011 +136 185 209 101 161 196 136 185 209 136 185 209 101 161 196 136 185 209
43012 +101 161 196 136 185 209 136 185 209 136 185 209 136 185 209 16 89 141
43013 +7 11 13 2 5 5 2 5 5 13 16 17 60 73 81 154 154 154
43014 +174 174 174 174 174 174 174 174 174 174 174 174 163 162 163 125 124 125
43015 +24 26 27 4 0 0 4 0 0 4 0 0 5 5 5 5 5 5
43016 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
43017 +5 5 5 4 4 4
43018 +4 0 0 6 6 6 37 38 37 137 136 137 137 136 137 131 129 131
43019 +131 129 131 153 152 153 131 129 131 26 28 28 4 0 0 4 3 3
43020 +6 6 6 4 4 4 4 4 4 4 4 4 0 0 0 0 0 0
43021 +13 20 25 51 88 114 90 154 193 101 161 196 101 161 196 90 154 193
43022 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
43023 +101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 101 161 196
43024 +101 161 196 136 185 209 101 161 196 136 185 209 136 185 209 101 161 196
43025 +136 185 209 101 161 196 136 185 209 101 161 196 101 161 196 101 161 196
43026 +136 185 209 136 185 209 136 185 209 37 112 160 21 29 34 5 7 8
43027 +2 5 5 13 16 17 43 57 68 131 129 131 174 174 174 174 174 174
43028 +174 174 174 167 166 167 157 156 157 125 124 125 37 38 37 4 0 0
43029 +4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
43030 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43031 +4 4 4 4 4 4
43032 +1 1 1 4 0 0 41 54 63 153 152 153 137 136 137 137 136 137
43033 +137 136 137 153 152 153 125 124 125 24 26 27 4 0 0 3 2 2
43034 +4 4 4 4 4 4 4 3 3 4 0 0 3 6 7 43 61 72
43035 +64 123 161 101 161 196 90 154 193 90 154 193 90 154 193 90 154 193
43036 +90 154 193 90 154 193 90 154 193 90 154 193 101 161 196 90 154 193
43037 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
43038 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
43039 +136 185 209 101 161 196 101 161 196 136 185 209 136 185 209 101 161 196
43040 +101 161 196 90 154 193 28 67 93 13 16 17 7 11 13 3 6 7
43041 +37 51 59 125 124 125 163 162 163 174 174 174 167 166 167 166 165 166
43042 +167 166 167 131 129 131 60 73 81 4 0 0 4 0 0 4 0 0
43043 +3 3 3 5 5 5 6 6 6 4 4 4 4 4 4 4 4 4
43044 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43045 +4 4 4 4 4 4
43046 +4 0 0 4 0 0 41 54 63 137 136 137 153 152 153 137 136 137
43047 +153 152 153 157 156 157 125 124 125 24 26 27 0 0 0 2 2 2
43048 +4 4 4 4 4 4 2 0 0 0 0 0 28 67 93 90 154 193
43049 +90 154 193 90 154 193 90 154 193 90 154 193 64 123 161 90 154 193
43050 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
43051 +90 154 193 101 161 196 101 161 196 101 161 196 90 154 193 136 185 209
43052 +101 161 196 101 161 196 136 185 209 101 161 196 136 185 209 101 161 196
43053 +101 161 196 101 161 196 136 185 209 101 161 196 101 161 196 90 154 193
43054 +35 83 115 13 16 17 3 6 7 2 5 5 13 16 17 60 74 84
43055 +154 154 154 166 165 166 165 164 165 158 157 158 163 162 163 157 156 157
43056 +60 74 84 13 16 17 4 0 0 4 0 0 3 2 2 4 4 4
43057 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43058 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43059 +4 4 4 4 4 4
43060 +1 1 1 4 0 0 41 54 63 157 156 157 155 154 155 137 136 137
43061 +153 152 153 158 157 158 137 136 137 26 28 28 2 0 0 2 2 2
43062 +4 4 4 4 4 4 1 0 0 6 10 14 34 86 122 90 154 193
43063 +64 123 161 90 154 193 64 123 161 90 154 193 90 154 193 90 154 193
43064 +64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
43065 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
43066 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
43067 +136 185 209 101 161 196 136 185 209 90 154 193 26 108 161 22 40 52
43068 +13 16 17 5 7 8 2 5 5 2 5 5 37 38 37 165 164 165
43069 +174 174 174 163 162 163 154 154 154 165 164 165 167 166 167 60 73 81
43070 +6 6 6 4 0 0 4 0 0 4 4 4 4 4 4 4 4 4
43071 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43072 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43073 +4 4 4 4 4 4
43074 +4 0 0 6 6 6 41 54 63 156 155 156 158 157 158 153 152 153
43075 +156 155 156 165 164 165 137 136 137 26 28 28 0 0 0 2 2 2
43076 +4 4 5 4 4 4 2 0 0 7 12 15 31 96 139 64 123 161
43077 +90 154 193 64 123 161 90 154 193 90 154 193 64 123 161 90 154 193
43078 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
43079 +90 154 193 90 154 193 90 154 193 101 161 196 101 161 196 101 161 196
43080 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
43081 +101 161 196 136 185 209 26 108 161 22 40 52 7 11 13 5 7 8
43082 +2 5 5 2 5 5 2 5 5 2 2 1 37 38 37 158 157 158
43083 +174 174 174 154 154 154 156 155 156 167 166 167 165 164 165 37 38 37
43084 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43085 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43086 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43087 +4 4 4 4 4 4
43088 +3 1 0 4 0 0 60 73 81 157 156 157 163 162 163 153 152 153
43089 +158 157 158 167 166 167 137 136 137 26 28 28 2 0 0 2 2 2
43090 +4 5 5 4 4 4 4 0 0 7 12 15 24 86 132 26 108 161
43091 +37 112 160 64 123 161 90 154 193 64 123 161 90 154 193 90 154 193
43092 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
43093 +90 154 193 101 161 196 90 154 193 101 161 196 101 161 196 101 161 196
43094 +101 161 196 101 161 196 101 161 196 136 185 209 101 161 196 136 185 209
43095 +90 154 193 35 83 115 13 16 17 13 16 17 7 11 13 3 6 7
43096 +5 7 8 6 6 6 3 4 3 2 2 1 30 32 34 154 154 154
43097 +167 166 167 154 154 154 154 154 154 174 174 174 165 164 165 37 38 37
43098 +6 6 6 4 0 0 6 6 6 4 4 4 4 4 4 4 4 4
43099 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43100 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43101 +4 4 4 4 4 4
43102 +4 0 0 4 0 0 41 54 63 163 162 163 166 165 166 154 154 154
43103 +163 162 163 174 174 174 137 136 137 26 28 28 0 0 0 2 2 2
43104 +4 5 5 4 4 5 1 1 2 6 10 14 28 67 93 18 97 151
43105 +18 97 151 18 97 151 26 108 161 37 112 160 37 112 160 90 154 193
43106 +64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
43107 +90 154 193 101 161 196 101 161 196 90 154 193 101 161 196 101 161 196
43108 +101 161 196 101 161 196 101 161 196 136 185 209 90 154 193 16 89 141
43109 +13 20 25 7 11 13 5 7 8 5 7 8 2 5 5 4 5 5
43110 +3 4 3 4 5 5 3 4 3 0 0 0 37 38 37 158 157 158
43111 +174 174 174 158 157 158 158 157 158 167 166 167 174 174 174 41 54 63
43112 +4 0 0 3 2 2 5 5 5 4 4 4 4 4 4 4 4 4
43113 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43114 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43115 +4 4 4 4 4 4
43116 +1 1 1 4 0 0 60 73 81 165 164 165 174 174 174 158 157 158
43117 +167 166 167 174 174 174 153 152 153 26 28 28 2 0 0 2 2 2
43118 +4 5 5 4 4 4 4 0 0 7 12 15 10 87 144 10 87 144
43119 +18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
43120 +26 108 161 37 112 160 53 118 160 90 154 193 90 154 193 90 154 193
43121 +90 154 193 90 154 193 101 161 196 101 161 196 101 161 196 101 161 196
43122 +101 161 196 136 185 209 90 154 193 26 108 161 22 40 52 13 16 17
43123 +7 11 13 3 6 7 5 7 8 5 7 8 2 5 5 4 5 5
43124 +4 5 5 6 6 6 3 4 3 0 0 0 30 32 34 158 157 158
43125 +174 174 174 156 155 156 155 154 155 165 164 165 154 153 154 37 38 37
43126 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43127 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43128 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43129 +4 4 4 4 4 4
43130 +4 0 0 4 0 0 60 73 81 167 166 167 174 174 174 163 162 163
43131 +174 174 174 174 174 174 153 152 153 26 28 28 0 0 0 3 3 3
43132 +5 5 5 4 4 4 1 1 2 7 12 15 28 67 93 18 97 151
43133 +18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
43134 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
43135 +90 154 193 26 108 161 90 154 193 90 154 193 90 154 193 101 161 196
43136 +101 161 196 26 108 161 22 40 52 13 16 17 7 11 13 2 5 5
43137 +2 5 5 6 6 6 2 5 5 4 5 5 4 5 5 4 5 5
43138 +3 4 3 5 5 5 3 4 3 2 0 0 30 32 34 137 136 137
43139 +153 152 153 137 136 137 131 129 131 137 136 137 131 129 131 37 38 37
43140 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43141 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43142 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43143 +4 4 4 4 4 4
43144 +1 1 1 4 0 0 60 73 81 167 166 167 174 174 174 166 165 166
43145 +174 174 174 177 184 187 153 152 153 30 32 34 1 0 0 3 3 3
43146 +5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
43147 +18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
43148 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
43149 +26 108 161 26 108 161 26 108 161 90 154 193 90 154 193 26 108 161
43150 +35 83 115 13 16 17 7 11 13 5 7 8 3 6 7 5 7 8
43151 +2 5 5 6 6 6 4 5 5 4 5 5 3 4 3 4 5 5
43152 +3 4 3 6 6 6 3 4 3 0 0 0 26 28 28 125 124 125
43153 +131 129 131 125 124 125 125 124 125 131 129 131 131 129 131 37 38 37
43154 +4 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43155 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43156 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43157 +4 4 4 4 4 4
43158 +3 1 0 4 0 0 60 73 81 174 174 174 177 184 187 167 166 167
43159 +174 174 174 177 184 187 153 152 153 30 32 34 0 0 0 3 3 3
43160 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
43161 +18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
43162 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
43163 +26 108 161 90 154 193 26 108 161 26 108 161 24 86 132 13 20 25
43164 +7 11 13 13 20 25 22 40 52 5 7 8 3 4 3 3 4 3
43165 +4 5 5 3 4 3 4 5 5 3 4 3 4 5 5 3 4 3
43166 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
43167 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43168 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43169 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43170 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43171 +4 4 4 4 4 4
43172 +1 1 1 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
43173 +174 174 174 190 197 201 157 156 157 30 32 34 1 0 0 3 3 3
43174 +5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
43175 +18 97 151 19 95 150 19 95 150 18 97 151 18 97 151 26 108 161
43176 +18 97 151 26 108 161 26 108 161 26 108 161 26 108 161 90 154 193
43177 +26 108 161 26 108 161 26 108 161 22 40 52 2 5 5 3 4 3
43178 +28 67 93 37 112 160 34 86 122 2 5 5 3 4 3 3 4 3
43179 +3 4 3 3 4 3 3 4 3 2 2 1 3 4 3 4 4 4
43180 +4 5 5 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
43181 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43182 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43183 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43184 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43185 +4 4 4 4 4 4
43186 +4 0 0 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
43187 +174 174 174 190 197 201 158 157 158 30 32 34 0 0 0 2 2 2
43188 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
43189 +10 87 144 19 95 150 19 95 150 18 97 151 18 97 151 18 97 151
43190 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
43191 +18 97 151 22 40 52 2 5 5 2 2 1 22 40 52 26 108 161
43192 +90 154 193 37 112 160 22 40 52 3 4 3 13 20 25 22 30 35
43193 +3 6 7 1 1 1 2 2 2 6 9 11 5 5 5 4 3 3
43194 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
43195 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43196 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43197 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43198 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43199 +4 4 4 4 4 4
43200 +1 1 1 4 0 0 60 73 81 177 184 187 193 200 203 174 174 174
43201 +177 184 187 193 200 203 163 162 163 30 32 34 4 0 0 2 2 2
43202 +5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
43203 +10 87 144 10 87 144 19 95 150 19 95 150 19 95 150 18 97 151
43204 +26 108 161 26 108 161 26 108 161 90 154 193 26 108 161 28 67 93
43205 +6 10 14 2 5 5 13 20 25 24 86 132 37 112 160 90 154 193
43206 +10 87 144 7 12 15 2 5 5 28 67 93 37 112 160 28 67 93
43207 +2 2 1 7 12 15 35 83 115 28 67 93 3 6 7 1 0 0
43208 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
43209 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43210 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43211 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43212 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43213 +4 4 4 4 4 4
43214 +4 0 0 4 0 0 60 73 81 174 174 174 190 197 201 174 174 174
43215 +177 184 187 193 200 203 163 162 163 30 32 34 0 0 0 2 2 2
43216 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
43217 +10 87 144 16 89 141 19 95 150 10 87 144 26 108 161 26 108 161
43218 +26 108 161 26 108 161 26 108 161 28 67 93 6 10 14 1 1 2
43219 +7 12 15 28 67 93 26 108 161 16 89 141 24 86 132 21 29 34
43220 +3 4 3 21 29 34 37 112 160 37 112 160 27 99 146 21 29 34
43221 +21 29 34 26 108 161 90 154 193 35 83 115 1 1 2 2 0 0
43222 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
43223 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43224 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43225 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43226 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43227 +4 4 4 4 4 4
43228 +3 1 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
43229 +190 197 201 193 200 203 165 164 165 37 38 37 4 0 0 2 2 2
43230 +5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
43231 +10 87 144 10 87 144 16 89 141 18 97 151 18 97 151 10 87 144
43232 +24 86 132 24 86 132 13 20 25 4 5 7 4 5 7 22 40 52
43233 +18 97 151 37 112 160 26 108 161 7 12 15 1 1 1 0 0 0
43234 +28 67 93 37 112 160 26 108 161 28 67 93 22 40 52 28 67 93
43235 +26 108 161 90 154 193 26 108 161 10 87 144 0 0 0 2 0 0
43236 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
43237 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43238 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43239 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43240 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43241 +4 4 4 4 4 4
43242 +4 0 0 6 6 6 60 73 81 174 174 174 193 200 203 174 174 174
43243 +190 197 201 193 200 203 165 164 165 30 32 34 0 0 0 2 2 2
43244 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
43245 +10 87 144 10 87 144 10 87 144 18 97 151 28 67 93 6 10 14
43246 +0 0 0 1 1 2 4 5 7 13 20 25 16 89 141 26 108 161
43247 +26 108 161 26 108 161 24 86 132 6 9 11 2 3 3 22 40 52
43248 +37 112 160 16 89 141 22 40 52 28 67 93 26 108 161 26 108 161
43249 +90 154 193 26 108 161 26 108 161 28 67 93 1 1 1 4 0 0
43250 +4 4 4 5 5 5 3 3 3 4 0 0 26 28 28 124 126 130
43251 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43252 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43253 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43254 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43255 +4 4 4 4 4 4
43256 +4 0 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
43257 +193 200 203 193 200 203 167 166 167 37 38 37 4 0 0 2 2 2
43258 +5 5 5 4 4 4 4 0 0 6 10 14 28 67 93 10 87 144
43259 +10 87 144 10 87 144 18 97 151 10 87 144 13 20 25 4 5 7
43260 +1 1 2 1 1 1 22 40 52 26 108 161 26 108 161 26 108 161
43261 +26 108 161 26 108 161 26 108 161 24 86 132 22 40 52 22 40 52
43262 +22 40 52 22 40 52 10 87 144 26 108 161 26 108 161 26 108 161
43263 +26 108 161 26 108 161 90 154 193 10 87 144 0 0 0 4 0 0
43264 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
43265 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43266 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43267 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43268 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43269 +4 4 4 4 4 4
43270 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
43271 +190 197 201 205 212 215 167 166 167 30 32 34 0 0 0 2 2 2
43272 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
43273 +10 87 144 10 87 144 10 87 144 10 87 144 22 40 52 1 1 2
43274 +2 0 0 1 1 2 24 86 132 26 108 161 26 108 161 26 108 161
43275 +26 108 161 19 95 150 16 89 141 10 87 144 22 40 52 22 40 52
43276 +10 87 144 26 108 161 37 112 160 26 108 161 26 108 161 26 108 161
43277 +26 108 161 26 108 161 26 108 161 28 67 93 2 0 0 3 1 0
43278 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
43279 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43280 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43281 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43282 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43283 +4 4 4 4 4 4
43284 +4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
43285 +193 200 203 193 200 203 174 174 174 37 38 37 4 0 0 2 2 2
43286 +5 5 5 4 4 4 3 2 2 1 1 2 13 20 25 10 87 144
43287 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 13 20 25
43288 +13 20 25 22 40 52 10 87 144 18 97 151 18 97 151 26 108 161
43289 +10 87 144 13 20 25 6 10 14 21 29 34 24 86 132 18 97 151
43290 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
43291 +26 108 161 90 154 193 18 97 151 13 20 25 0 0 0 4 3 3
43292 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
43293 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43294 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43295 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43296 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43297 +4 4 4 4 4 4
43298 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
43299 +190 197 201 220 221 221 167 166 167 30 32 34 1 0 0 2 2 2
43300 +5 5 5 4 4 4 4 4 5 2 5 5 4 5 7 13 20 25
43301 +28 67 93 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
43302 +10 87 144 10 87 144 18 97 151 10 87 144 18 97 151 18 97 151
43303 +28 67 93 2 3 3 0 0 0 28 67 93 26 108 161 26 108 161
43304 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
43305 +26 108 161 10 87 144 13 20 25 1 1 2 3 2 2 4 4 4
43306 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
43307 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43308 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43309 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43310 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43311 +4 4 4 4 4 4
43312 +4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
43313 +193 200 203 193 200 203 174 174 174 26 28 28 4 0 0 4 3 3
43314 +5 5 5 4 4 4 4 4 4 4 4 5 1 1 2 2 5 5
43315 +4 5 7 22 40 52 10 87 144 10 87 144 18 97 151 10 87 144
43316 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 18 97 151
43317 +10 87 144 28 67 93 22 40 52 10 87 144 26 108 161 18 97 151
43318 +18 97 151 18 97 151 26 108 161 26 108 161 26 108 161 26 108 161
43319 +22 40 52 1 1 2 0 0 0 2 3 3 4 4 4 4 4 4
43320 +4 4 4 5 5 5 4 4 4 0 0 0 26 28 28 131 129 131
43321 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43322 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43323 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43324 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43325 +4 4 4 4 4 4
43326 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
43327 +190 197 201 220 221 221 190 197 201 41 54 63 4 0 0 2 2 2
43328 +6 6 6 4 4 4 4 4 4 4 4 5 4 4 5 3 3 3
43329 +1 1 2 1 1 2 6 10 14 22 40 52 10 87 144 18 97 151
43330 +18 97 151 10 87 144 10 87 144 10 87 144 18 97 151 10 87 144
43331 +10 87 144 18 97 151 26 108 161 18 97 151 18 97 151 10 87 144
43332 +26 108 161 26 108 161 26 108 161 10 87 144 28 67 93 6 10 14
43333 +1 1 2 1 1 2 4 3 3 4 4 5 4 4 4 4 4 4
43334 +5 5 5 5 5 5 1 1 1 4 0 0 37 51 59 137 136 137
43335 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43336 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43337 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43338 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43339 +4 4 4 4 4 4
43340 +4 0 0 4 0 0 60 73 81 220 221 221 193 200 203 174 174 174
43341 +193 200 203 193 200 203 220 221 221 137 136 137 13 16 17 4 0 0
43342 +2 2 2 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5
43343 +4 4 5 4 3 3 1 1 2 4 5 7 13 20 25 28 67 93
43344 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
43345 +10 87 144 18 97 151 18 97 151 10 87 144 18 97 151 26 108 161
43346 +26 108 161 18 97 151 28 67 93 6 10 14 0 0 0 0 0 0
43347 +2 3 3 4 5 5 4 4 5 4 4 4 4 4 4 5 5 5
43348 +3 3 3 1 1 1 0 0 0 16 19 21 125 124 125 137 136 137
43349 +131 129 131 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43350 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43351 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43352 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43353 +4 4 4 4 4 4
43354 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
43355 +193 200 203 190 197 201 220 221 221 220 221 221 153 152 153 30 32 34
43356 +0 0 0 0 0 0 2 2 2 4 4 4 4 4 4 4 4 4
43357 +4 4 4 4 5 5 4 5 7 1 1 2 1 1 2 4 5 7
43358 +13 20 25 28 67 93 10 87 144 18 97 151 10 87 144 10 87 144
43359 +10 87 144 10 87 144 10 87 144 18 97 151 26 108 161 18 97 151
43360 +28 67 93 7 12 15 0 0 0 0 0 0 2 2 1 4 4 4
43361 +4 5 5 4 5 5 4 4 4 4 4 4 3 3 3 0 0 0
43362 +0 0 0 0 0 0 37 38 37 125 124 125 158 157 158 131 129 131
43363 +125 124 125 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
43364 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43365 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43366 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43367 +4 4 4 4 4 4
43368 +4 3 3 4 0 0 41 54 63 193 200 203 220 221 221 174 174 174
43369 +193 200 203 193 200 203 193 200 203 220 221 221 244 246 246 193 200 203
43370 +120 125 127 5 5 5 1 0 0 0 0 0 1 1 1 4 4 4
43371 +4 4 4 4 4 4 4 5 5 4 5 5 4 4 5 1 1 2
43372 +4 5 7 4 5 7 22 40 52 10 87 144 10 87 144 10 87 144
43373 +10 87 144 10 87 144 18 97 151 10 87 144 10 87 144 13 20 25
43374 +4 5 7 2 3 3 1 1 2 4 4 4 4 5 5 4 4 4
43375 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 1 2
43376 +24 26 27 60 74 84 153 152 153 163 162 163 137 136 137 125 124 125
43377 +125 124 125 125 124 125 125 124 125 137 136 137 125 124 125 26 28 28
43378 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43379 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43380 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43381 +4 4 4 4 4 4
43382 +4 0 0 6 6 6 26 28 28 156 155 156 220 221 221 220 221 221
43383 +174 174 174 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
43384 +220 221 221 167 166 167 60 73 81 7 11 13 0 0 0 0 0 0
43385 +3 3 3 4 4 4 4 4 4 4 4 4 4 4 5 4 4 5
43386 +4 4 5 1 1 2 1 1 2 4 5 7 22 40 52 10 87 144
43387 +10 87 144 10 87 144 10 87 144 22 40 52 4 5 7 1 1 2
43388 +1 1 2 4 4 5 4 4 4 4 4 4 4 4 4 4 4 4
43389 +5 5 5 2 2 2 0 0 0 4 0 0 16 19 21 60 73 81
43390 +137 136 137 167 166 167 158 157 158 137 136 137 131 129 131 131 129 131
43391 +125 124 125 125 124 125 131 129 131 155 154 155 60 74 84 5 7 8
43392 +0 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43393 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43394 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43395 +4 4 4 4 4 4
43396 +5 5 5 4 0 0 4 0 0 60 73 81 193 200 203 220 221 221
43397 +193 200 203 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
43398 +220 221 221 220 221 221 220 221 221 137 136 137 43 57 68 6 6 6
43399 +4 0 0 1 1 1 4 4 4 4 4 4 4 4 4 4 4 4
43400 +4 4 5 4 4 5 3 2 2 1 1 2 2 5 5 13 20 25
43401 +22 40 52 22 40 52 13 20 25 2 3 3 1 1 2 3 3 3
43402 +4 5 7 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43403 +1 1 1 0 0 0 2 3 3 41 54 63 131 129 131 166 165 166
43404 +166 165 166 155 154 155 153 152 153 137 136 137 137 136 137 125 124 125
43405 +125 124 125 137 136 137 137 136 137 125 124 125 37 38 37 4 3 3
43406 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
43407 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43408 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43409 +4 4 4 4 4 4
43410 +4 3 3 6 6 6 6 6 6 13 16 17 60 73 81 167 166 167
43411 +220 221 221 220 221 221 220 221 221 193 200 203 193 200 203 193 200 203
43412 +205 212 215 220 221 221 220 221 221 244 246 246 205 212 215 125 124 125
43413 +24 26 27 0 0 0 0 0 0 2 2 2 5 5 5 5 5 5
43414 +4 4 4 4 4 4 4 4 4 4 4 5 1 1 2 4 5 7
43415 +4 5 7 4 5 7 1 1 2 3 2 2 4 4 5 4 4 4
43416 +4 4 4 4 4 4 5 5 5 4 4 4 0 0 0 0 0 0
43417 +2 0 0 26 28 28 125 124 125 174 174 174 174 174 174 166 165 166
43418 +156 155 156 153 152 153 137 136 137 137 136 137 131 129 131 137 136 137
43419 +137 136 137 137 136 137 60 74 84 30 32 34 4 0 0 4 0 0
43420 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43421 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43422 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43423 +4 4 4 4 4 4
43424 +5 5 5 6 6 6 4 0 0 4 0 0 6 6 6 26 28 28
43425 +125 124 125 174 174 174 220 221 221 220 221 221 220 221 221 193 200 203
43426 +205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
43427 +193 200 203 60 74 84 13 16 17 4 0 0 0 0 0 3 3 3
43428 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 5 3 3 3
43429 +1 1 2 3 3 3 4 4 5 4 4 5 4 4 4 4 4 4
43430 +5 5 5 5 5 5 2 2 2 0 0 0 0 0 0 13 16 17
43431 +60 74 84 174 174 174 193 200 203 174 174 174 167 166 167 163 162 163
43432 +153 152 153 153 152 153 137 136 137 137 136 137 153 152 153 137 136 137
43433 +125 124 125 41 54 63 24 26 27 4 0 0 4 0 0 5 5 5
43434 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43435 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43436 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43437 +4 4 4 4 4 4
43438 +4 3 3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
43439 +6 6 6 37 38 37 131 129 131 220 221 221 220 221 221 220 221 221
43440 +193 200 203 193 200 203 220 221 221 205 212 215 220 221 221 244 246 246
43441 +244 246 246 244 246 246 174 174 174 41 54 63 0 0 0 0 0 0
43442 +0 0 0 4 4 4 5 5 5 5 5 5 4 4 4 4 4 5
43443 +4 4 5 4 4 5 4 4 4 4 4 4 6 6 6 6 6 6
43444 +3 3 3 0 0 0 2 0 0 13 16 17 60 73 81 156 155 156
43445 +220 221 221 193 200 203 174 174 174 165 164 165 163 162 163 154 153 154
43446 +153 152 153 153 152 153 158 157 158 163 162 163 137 136 137 60 73 81
43447 +13 16 17 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
43448 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43449 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43450 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43451 +4 4 4 4 4 4
43452 +5 5 5 4 3 3 4 3 3 6 6 6 6 6 6 6 6 6
43453 +6 6 6 6 6 6 6 6 6 37 38 37 167 166 167 244 246 246
43454 +244 246 246 220 221 221 205 212 215 205 212 215 220 221 221 193 200 203
43455 +220 221 221 244 246 246 244 246 246 244 246 246 137 136 137 37 38 37
43456 +3 2 2 0 0 0 1 1 1 5 5 5 5 5 5 4 4 4
43457 +4 4 4 4 4 4 4 4 4 5 5 5 4 4 4 1 1 1
43458 +0 0 0 5 5 5 43 57 68 153 152 153 193 200 203 220 221 221
43459 +177 184 187 174 174 174 167 166 167 166 165 166 158 157 158 157 156 157
43460 +158 157 158 166 165 166 156 155 156 85 115 134 13 16 17 4 0 0
43461 +4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
43462 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43463 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43464 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43465 +4 4 4 4 4 4
43466 +5 5 5 4 3 3 6 6 6 6 6 6 4 0 0 6 6 6
43467 +6 6 6 6 6 6 6 6 6 6 6 6 13 16 17 60 73 81
43468 +177 184 187 220 221 221 220 221 221 220 221 221 205 212 215 220 221 221
43469 +220 221 221 205 212 215 220 221 221 244 246 246 244 246 246 205 212 215
43470 +125 124 125 30 32 34 0 0 0 0 0 0 2 2 2 5 5 5
43471 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 0 0
43472 +37 38 37 131 129 131 205 212 215 220 221 221 193 200 203 174 174 174
43473 +174 174 174 174 174 174 167 166 167 165 164 165 166 165 166 167 166 167
43474 +158 157 158 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
43475 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
43476 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43477 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43478 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43479 +4 4 4 4 4 4
43480 +4 4 4 5 5 5 4 3 3 4 3 3 6 6 6 6 6 6
43481 +4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
43482 +26 28 28 125 124 125 205 212 215 220 221 221 220 221 221 220 221 221
43483 +205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
43484 +244 246 246 190 197 201 60 74 84 16 19 21 4 0 0 0 0 0
43485 +0 0 0 0 0 0 0 0 0 0 0 0 16 19 21 120 125 127
43486 +177 184 187 220 221 221 205 212 215 177 184 187 174 174 174 177 184 187
43487 +174 174 174 174 174 174 167 166 167 174 174 174 166 165 166 137 136 137
43488 +60 73 81 13 16 17 4 0 0 4 0 0 4 3 3 6 6 6
43489 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43490 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43491 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43492 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43493 +4 4 4 4 4 4
43494 +5 5 5 4 3 3 5 5 5 4 3 3 6 6 6 4 0 0
43495 +6 6 6 6 6 6 4 0 0 6 6 6 4 0 0 6 6 6
43496 +6 6 6 6 6 6 37 38 37 137 136 137 193 200 203 220 221 221
43497 +220 221 221 205 212 215 220 221 221 205 212 215 205 212 215 220 221 221
43498 +220 221 221 220 221 221 244 246 246 166 165 166 43 57 68 2 2 2
43499 +0 0 0 4 0 0 16 19 21 60 73 81 157 156 157 202 210 214
43500 +220 221 221 193 200 203 177 184 187 177 184 187 177 184 187 174 174 174
43501 +174 174 174 174 174 174 174 174 174 157 156 157 60 74 84 24 26 27
43502 +4 0 0 4 0 0 4 0 0 6 6 6 4 4 4 4 4 4
43503 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43504 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43505 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43506 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43507 +4 4 4 4 4 4
43508 +4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
43509 +6 6 6 4 0 0 6 6 6 6 6 6 6 6 6 4 0 0
43510 +4 0 0 4 0 0 6 6 6 24 26 27 60 73 81 167 166 167
43511 +220 221 221 220 221 221 220 221 221 205 212 215 205 212 215 205 212 215
43512 +205 212 215 220 221 221 220 221 221 220 221 221 205 212 215 137 136 137
43513 +60 74 84 125 124 125 137 136 137 190 197 201 220 221 221 193 200 203
43514 +177 184 187 177 184 187 177 184 187 174 174 174 174 174 174 177 184 187
43515 +190 197 201 174 174 174 125 124 125 37 38 37 6 6 6 4 0 0
43516 +4 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43517 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43518 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43519 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43520 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43521 +4 4 4 4 4 4
43522 +4 4 4 4 4 4 5 5 5 5 5 5 4 3 3 6 6 6
43523 +4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 6 6 6
43524 +6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
43525 +125 124 125 193 200 203 244 246 246 220 221 221 205 212 215 205 212 215
43526 +205 212 215 193 200 203 205 212 215 205 212 215 220 221 221 220 221 221
43527 +193 200 203 193 200 203 205 212 215 193 200 203 193 200 203 177 184 187
43528 +190 197 201 190 197 201 174 174 174 190 197 201 193 200 203 190 197 201
43529 +153 152 153 60 73 81 4 0 0 4 0 0 4 0 0 3 2 2
43530 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43531 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43532 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43533 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43534 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43535 +4 4 4 4 4 4
43536 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
43537 +6 6 6 4 3 3 4 3 3 4 3 3 6 6 6 6 6 6
43538 +4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 4 0 0
43539 +4 0 0 26 28 28 131 129 131 220 221 221 244 246 246 220 221 221
43540 +205 212 215 193 200 203 205 212 215 193 200 203 193 200 203 205 212 215
43541 +220 221 221 193 200 203 193 200 203 193 200 203 190 197 201 174 174 174
43542 +174 174 174 190 197 201 193 200 203 193 200 203 167 166 167 125 124 125
43543 +6 6 6 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
43544 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43545 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43546 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43547 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43548 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43549 +4 4 4 4 4 4
43550 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
43551 +5 5 5 4 3 3 5 5 5 6 6 6 4 3 3 5 5 5
43552 +6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
43553 +4 0 0 4 0 0 6 6 6 41 54 63 158 157 158 220 221 221
43554 +220 221 221 220 221 221 193 200 203 193 200 203 193 200 203 190 197 201
43555 +190 197 201 190 197 201 190 197 201 190 197 201 174 174 174 193 200 203
43556 +193 200 203 220 221 221 174 174 174 125 124 125 37 38 37 4 0 0
43557 +4 0 0 4 3 3 6 6 6 4 4 4 4 4 4 4 4 4
43558 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43559 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43560 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43561 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43562 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43563 +4 4 4 4 4 4
43564 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43565 +4 4 4 5 5 5 4 3 3 4 3 3 4 3 3 5 5 5
43566 +4 3 3 6 6 6 5 5 5 4 3 3 6 6 6 6 6 6
43567 +6 6 6 6 6 6 4 0 0 4 0 0 13 16 17 60 73 81
43568 +174 174 174 220 221 221 220 221 221 205 212 215 190 197 201 174 174 174
43569 +193 200 203 174 174 174 190 197 201 174 174 174 193 200 203 220 221 221
43570 +193 200 203 131 129 131 37 38 37 6 6 6 4 0 0 4 0 0
43571 +6 6 6 6 6 6 4 3 3 5 5 5 4 4 4 4 4 4
43572 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43573 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43574 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43575 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43576 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43577 +4 4 4 4 4 4
43578 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43579 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
43580 +5 5 5 4 3 3 4 3 3 5 5 5 4 3 3 4 3 3
43581 +5 5 5 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
43582 +6 6 6 125 124 125 174 174 174 220 221 221 220 221 221 193 200 203
43583 +193 200 203 193 200 203 193 200 203 193 200 203 220 221 221 158 157 158
43584 +60 73 81 6 6 6 4 0 0 4 0 0 5 5 5 6 6 6
43585 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
43586 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43587 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43588 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43589 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43590 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43591 +4 4 4 4 4 4
43592 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43593 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43594 +4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
43595 +5 5 5 5 5 5 6 6 6 6 6 6 4 0 0 4 0 0
43596 +4 0 0 4 0 0 26 28 28 125 124 125 174 174 174 193 200 203
43597 +193 200 203 174 174 174 193 200 203 167 166 167 125 124 125 6 6 6
43598 +6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 5 5 5
43599 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
43600 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43601 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43602 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43603 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43604 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43605 +4 4 4 4 4 4
43606 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43607 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43608 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
43609 +4 3 3 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
43610 +6 6 6 4 0 0 4 0 0 6 6 6 37 38 37 125 124 125
43611 +153 152 153 131 129 131 125 124 125 37 38 37 6 6 6 6 6 6
43612 +6 6 6 4 0 0 6 6 6 6 6 6 4 3 3 5 5 5
43613 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43614 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43615 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43616 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43617 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43618 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43619 +4 4 4 4 4 4
43620 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43621 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43622 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43623 +4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
43624 +6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
43625 +24 26 27 24 26 27 6 6 6 6 6 6 6 6 6 4 0 0
43626 +6 6 6 6 6 6 4 0 0 6 6 6 5 5 5 4 3 3
43627 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43628 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43629 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43630 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43631 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43632 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43633 +4 4 4 4 4 4
43634 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43635 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43636 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43637 +4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
43638 +4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
43639 +6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
43640 +4 0 0 6 6 6 6 6 6 4 3 3 5 5 5 4 4 4
43641 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43642 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43643 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43644 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43645 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43646 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43647 +4 4 4 4 4 4
43648 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43649 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43650 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43651 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 5 5 5
43652 +5 5 5 5 5 5 4 0 0 6 6 6 4 0 0 6 6 6
43653 +6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 4 0 0
43654 +6 6 6 4 3 3 5 5 5 4 3 3 5 5 5 4 4 4
43655 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43656 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43657 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43658 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43659 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43660 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43661 +4 4 4 4 4 4
43662 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43663 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43664 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43665 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
43666 +4 3 3 6 6 6 4 3 3 6 6 6 6 6 6 6 6 6
43667 +4 0 0 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
43668 +6 6 6 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
43669 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43670 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43671 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43672 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43673 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43674 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43675 +4 4 4 4 4 4
43676 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43677 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43678 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43679 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43680 +4 4 4 5 5 5 4 3 3 5 5 5 4 0 0 6 6 6
43681 +6 6 6 4 0 0 6 6 6 6 6 6 4 0 0 6 6 6
43682 +4 3 3 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
43683 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43684 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43685 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43686 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43687 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43688 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43689 +4 4 4 4 4 4
43690 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43691 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43692 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43693 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43694 +4 4 4 5 5 5 4 3 3 5 5 5 6 6 6 4 3 3
43695 +4 3 3 6 6 6 6 6 6 4 3 3 6 6 6 4 3 3
43696 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43697 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43698 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43699 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43700 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43701 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43702 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43703 +4 4 4 4 4 4
43704 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43705 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43706 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43707 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43708 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 6 6 6
43709 +5 5 5 4 3 3 4 3 3 4 3 3 5 5 5 5 5 5
43710 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43711 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43712 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43713 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43714 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43715 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43716 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43717 +4 4 4 4 4 4
43718 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43719 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43720 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43721 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43722 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
43723 +5 5 5 4 3 3 5 5 5 5 5 5 4 4 4 4 4 4
43724 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43725 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43726 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43727 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43728 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43729 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43730 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
43731 +4 4 4 4 4 4
43732 diff -urNp linux-2.6.32.49/drivers/video/nvidia/nv_backlight.c linux-2.6.32.49/drivers/video/nvidia/nv_backlight.c
43733 --- linux-2.6.32.49/drivers/video/nvidia/nv_backlight.c 2011-11-08 19:02:43.000000000 -0500
43734 +++ linux-2.6.32.49/drivers/video/nvidia/nv_backlight.c 2011-11-15 19:59:43.000000000 -0500
43735 @@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(stru
43736 return bd->props.brightness;
43737 }
43738
43739 -static struct backlight_ops nvidia_bl_ops = {
43740 +static const struct backlight_ops nvidia_bl_ops = {
43741 .get_brightness = nvidia_bl_get_brightness,
43742 .update_status = nvidia_bl_update_status,
43743 };
43744 diff -urNp linux-2.6.32.49/drivers/video/riva/fbdev.c linux-2.6.32.49/drivers/video/riva/fbdev.c
43745 --- linux-2.6.32.49/drivers/video/riva/fbdev.c 2011-11-08 19:02:43.000000000 -0500
43746 +++ linux-2.6.32.49/drivers/video/riva/fbdev.c 2011-11-15 19:59:43.000000000 -0500
43747 @@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct
43748 return bd->props.brightness;
43749 }
43750
43751 -static struct backlight_ops riva_bl_ops = {
43752 +static const struct backlight_ops riva_bl_ops = {
43753 .get_brightness = riva_bl_get_brightness,
43754 .update_status = riva_bl_update_status,
43755 };
43756 diff -urNp linux-2.6.32.49/drivers/video/uvesafb.c linux-2.6.32.49/drivers/video/uvesafb.c
43757 --- linux-2.6.32.49/drivers/video/uvesafb.c 2011-11-08 19:02:43.000000000 -0500
43758 +++ linux-2.6.32.49/drivers/video/uvesafb.c 2011-11-15 19:59:43.000000000 -0500
43759 @@ -18,6 +18,7 @@
43760 #include <linux/fb.h>
43761 #include <linux/io.h>
43762 #include <linux/mutex.h>
43763 +#include <linux/moduleloader.h>
43764 #include <video/edid.h>
43765 #include <video/uvesafb.h>
43766 #ifdef CONFIG_X86
43767 @@ -120,7 +121,7 @@ static int uvesafb_helper_start(void)
43768 NULL,
43769 };
43770
43771 - return call_usermodehelper(v86d_path, argv, envp, 1);
43772 + return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
43773 }
43774
43775 /*
43776 @@ -568,10 +569,32 @@ static int __devinit uvesafb_vbe_getpmi(
43777 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
43778 par->pmi_setpal = par->ypan = 0;
43779 } else {
43780 +
43781 +#ifdef CONFIG_PAX_KERNEXEC
43782 +#ifdef CONFIG_MODULES
43783 + par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
43784 +#endif
43785 + if (!par->pmi_code) {
43786 + par->pmi_setpal = par->ypan = 0;
43787 + return 0;
43788 + }
43789 +#endif
43790 +
43791 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
43792 + task->t.regs.edi);
43793 +
43794 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43795 + pax_open_kernel();
43796 + memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
43797 + pax_close_kernel();
43798 +
43799 + par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
43800 + par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
43801 +#else
43802 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
43803 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
43804 +#endif
43805 +
43806 printk(KERN_INFO "uvesafb: protected mode interface info at "
43807 "%04x:%04x\n",
43808 (u16)task->t.regs.es, (u16)task->t.regs.edi);
43809 @@ -1799,6 +1822,11 @@ out:
43810 if (par->vbe_modes)
43811 kfree(par->vbe_modes);
43812
43813 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43814 + if (par->pmi_code)
43815 + module_free_exec(NULL, par->pmi_code);
43816 +#endif
43817 +
43818 framebuffer_release(info);
43819 return err;
43820 }
43821 @@ -1825,6 +1853,12 @@ static int uvesafb_remove(struct platfor
43822 kfree(par->vbe_state_orig);
43823 if (par->vbe_state_saved)
43824 kfree(par->vbe_state_saved);
43825 +
43826 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43827 + if (par->pmi_code)
43828 + module_free_exec(NULL, par->pmi_code);
43829 +#endif
43830 +
43831 }
43832
43833 framebuffer_release(info);
43834 diff -urNp linux-2.6.32.49/drivers/video/vesafb.c linux-2.6.32.49/drivers/video/vesafb.c
43835 --- linux-2.6.32.49/drivers/video/vesafb.c 2011-11-08 19:02:43.000000000 -0500
43836 +++ linux-2.6.32.49/drivers/video/vesafb.c 2011-11-15 19:59:43.000000000 -0500
43837 @@ -9,6 +9,7 @@
43838 */
43839
43840 #include <linux/module.h>
43841 +#include <linux/moduleloader.h>
43842 #include <linux/kernel.h>
43843 #include <linux/errno.h>
43844 #include <linux/string.h>
43845 @@ -53,8 +54,8 @@ static int vram_remap __initdata; /*
43846 static int vram_total __initdata; /* Set total amount of memory */
43847 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
43848 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
43849 -static void (*pmi_start)(void) __read_mostly;
43850 -static void (*pmi_pal) (void) __read_mostly;
43851 +static void (*pmi_start)(void) __read_only;
43852 +static void (*pmi_pal) (void) __read_only;
43853 static int depth __read_mostly;
43854 static int vga_compat __read_mostly;
43855 /* --------------------------------------------------------------------- */
43856 @@ -233,6 +234,7 @@ static int __init vesafb_probe(struct pl
43857 unsigned int size_vmode;
43858 unsigned int size_remap;
43859 unsigned int size_total;
43860 + void *pmi_code = NULL;
43861
43862 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
43863 return -ENODEV;
43864 @@ -275,10 +277,6 @@ static int __init vesafb_probe(struct pl
43865 size_remap = size_total;
43866 vesafb_fix.smem_len = size_remap;
43867
43868 -#ifndef __i386__
43869 - screen_info.vesapm_seg = 0;
43870 -#endif
43871 -
43872 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
43873 printk(KERN_WARNING
43874 "vesafb: cannot reserve video memory at 0x%lx\n",
43875 @@ -315,9 +313,21 @@ static int __init vesafb_probe(struct pl
43876 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
43877 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
43878
43879 +#ifdef __i386__
43880 +
43881 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43882 + pmi_code = module_alloc_exec(screen_info.vesapm_size);
43883 + if (!pmi_code)
43884 +#elif !defined(CONFIG_PAX_KERNEXEC)
43885 + if (0)
43886 +#endif
43887 +
43888 +#endif
43889 + screen_info.vesapm_seg = 0;
43890 +
43891 if (screen_info.vesapm_seg) {
43892 - printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
43893 - screen_info.vesapm_seg,screen_info.vesapm_off);
43894 + printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
43895 + screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
43896 }
43897
43898 if (screen_info.vesapm_seg < 0xc000)
43899 @@ -325,9 +335,25 @@ static int __init vesafb_probe(struct pl
43900
43901 if (ypan || pmi_setpal) {
43902 unsigned short *pmi_base;
43903 +
43904 pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
43905 - pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
43906 - pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
43907 +
43908 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43909 + pax_open_kernel();
43910 + memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
43911 +#else
43912 + pmi_code = pmi_base;
43913 +#endif
43914 +
43915 + pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
43916 + pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
43917 +
43918 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43919 + pmi_start = ktva_ktla(pmi_start);
43920 + pmi_pal = ktva_ktla(pmi_pal);
43921 + pax_close_kernel();
43922 +#endif
43923 +
43924 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
43925 if (pmi_base[3]) {
43926 printk(KERN_INFO "vesafb: pmi: ports = ");
43927 @@ -469,6 +495,11 @@ static int __init vesafb_probe(struct pl
43928 info->node, info->fix.id);
43929 return 0;
43930 err:
43931 +
43932 +#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43933 + module_free_exec(NULL, pmi_code);
43934 +#endif
43935 +
43936 if (info->screen_base)
43937 iounmap(info->screen_base);
43938 framebuffer_release(info);
43939 diff -urNp linux-2.6.32.49/drivers/xen/sys-hypervisor.c linux-2.6.32.49/drivers/xen/sys-hypervisor.c
43940 --- linux-2.6.32.49/drivers/xen/sys-hypervisor.c 2011-11-08 19:02:43.000000000 -0500
43941 +++ linux-2.6.32.49/drivers/xen/sys-hypervisor.c 2011-11-15 19:59:43.000000000 -0500
43942 @@ -425,7 +425,7 @@ static ssize_t hyp_sysfs_store(struct ko
43943 return 0;
43944 }
43945
43946 -static struct sysfs_ops hyp_sysfs_ops = {
43947 +static const struct sysfs_ops hyp_sysfs_ops = {
43948 .show = hyp_sysfs_show,
43949 .store = hyp_sysfs_store,
43950 };
43951 diff -urNp linux-2.6.32.49/fs/9p/vfs_inode.c linux-2.6.32.49/fs/9p/vfs_inode.c
43952 --- linux-2.6.32.49/fs/9p/vfs_inode.c 2011-11-08 19:02:43.000000000 -0500
43953 +++ linux-2.6.32.49/fs/9p/vfs_inode.c 2011-11-15 19:59:43.000000000 -0500
43954 @@ -1079,7 +1079,7 @@ static void *v9fs_vfs_follow_link(struct
43955 static void
43956 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
43957 {
43958 - char *s = nd_get_link(nd);
43959 + const char *s = nd_get_link(nd);
43960
43961 P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
43962 IS_ERR(s) ? "<error>" : s);
43963 diff -urNp linux-2.6.32.49/fs/aio.c linux-2.6.32.49/fs/aio.c
43964 --- linux-2.6.32.49/fs/aio.c 2011-11-08 19:02:43.000000000 -0500
43965 +++ linux-2.6.32.49/fs/aio.c 2011-11-15 19:59:43.000000000 -0500
43966 @@ -115,7 +115,7 @@ static int aio_setup_ring(struct kioctx
43967 size += sizeof(struct io_event) * nr_events;
43968 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
43969
43970 - if (nr_pages < 0)
43971 + if (nr_pages <= 0)
43972 return -EINVAL;
43973
43974 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
43975 @@ -1089,6 +1089,8 @@ static int read_events(struct kioctx *ct
43976 struct aio_timeout to;
43977 int retry = 0;
43978
43979 + pax_track_stack();
43980 +
43981 /* needed to zero any padding within an entry (there shouldn't be
43982 * any, but C is fun!
43983 */
43984 @@ -1382,13 +1384,18 @@ static ssize_t aio_fsync(struct kiocb *i
43985 static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb)
43986 {
43987 ssize_t ret;
43988 + struct iovec iovstack;
43989
43990 ret = rw_copy_check_uvector(type, (struct iovec __user *)kiocb->ki_buf,
43991 kiocb->ki_nbytes, 1,
43992 - &kiocb->ki_inline_vec, &kiocb->ki_iovec);
43993 + &iovstack, &kiocb->ki_iovec);
43994 if (ret < 0)
43995 goto out;
43996
43997 + if (kiocb->ki_iovec == &iovstack) {
43998 + kiocb->ki_inline_vec = iovstack;
43999 + kiocb->ki_iovec = &kiocb->ki_inline_vec;
44000 + }
44001 kiocb->ki_nr_segs = kiocb->ki_nbytes;
44002 kiocb->ki_cur_seg = 0;
44003 /* ki_nbytes/left now reflect bytes instead of segs */
44004 diff -urNp linux-2.6.32.49/fs/attr.c linux-2.6.32.49/fs/attr.c
44005 --- linux-2.6.32.49/fs/attr.c 2011-11-08 19:02:43.000000000 -0500
44006 +++ linux-2.6.32.49/fs/attr.c 2011-11-15 19:59:43.000000000 -0500
44007 @@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode
44008 unsigned long limit;
44009
44010 limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
44011 + gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
44012 if (limit != RLIM_INFINITY && offset > limit)
44013 goto out_sig;
44014 if (offset > inode->i_sb->s_maxbytes)
44015 diff -urNp linux-2.6.32.49/fs/autofs/root.c linux-2.6.32.49/fs/autofs/root.c
44016 --- linux-2.6.32.49/fs/autofs/root.c 2011-11-08 19:02:43.000000000 -0500
44017 +++ linux-2.6.32.49/fs/autofs/root.c 2011-11-15 19:59:43.000000000 -0500
44018 @@ -299,7 +299,8 @@ static int autofs_root_symlink(struct in
44019 set_bit(n,sbi->symlink_bitmap);
44020 sl = &sbi->symlink[n];
44021 sl->len = strlen(symname);
44022 - sl->data = kmalloc(slsize = sl->len+1, GFP_KERNEL);
44023 + slsize = sl->len+1;
44024 + sl->data = kmalloc(slsize, GFP_KERNEL);
44025 if (!sl->data) {
44026 clear_bit(n,sbi->symlink_bitmap);
44027 unlock_kernel();
44028 diff -urNp linux-2.6.32.49/fs/autofs4/symlink.c linux-2.6.32.49/fs/autofs4/symlink.c
44029 --- linux-2.6.32.49/fs/autofs4/symlink.c 2011-11-08 19:02:43.000000000 -0500
44030 +++ linux-2.6.32.49/fs/autofs4/symlink.c 2011-11-15 19:59:43.000000000 -0500
44031 @@ -15,7 +15,7 @@
44032 static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
44033 {
44034 struct autofs_info *ino = autofs4_dentry_ino(dentry);
44035 - nd_set_link(nd, (char *)ino->u.symlink);
44036 + nd_set_link(nd, ino->u.symlink);
44037 return NULL;
44038 }
44039
44040 diff -urNp linux-2.6.32.49/fs/autofs4/waitq.c linux-2.6.32.49/fs/autofs4/waitq.c
44041 --- linux-2.6.32.49/fs/autofs4/waitq.c 2011-11-08 19:02:43.000000000 -0500
44042 +++ linux-2.6.32.49/fs/autofs4/waitq.c 2011-11-15 19:59:43.000000000 -0500
44043 @@ -60,7 +60,7 @@ static int autofs4_write(struct file *fi
44044 {
44045 unsigned long sigpipe, flags;
44046 mm_segment_t fs;
44047 - const char *data = (const char *)addr;
44048 + const char __user *data = (const char __force_user *)addr;
44049 ssize_t wr = 0;
44050
44051 /** WARNING: this is not safe for writing more than PIPE_BUF bytes! **/
44052 diff -urNp linux-2.6.32.49/fs/befs/linuxvfs.c linux-2.6.32.49/fs/befs/linuxvfs.c
44053 --- linux-2.6.32.49/fs/befs/linuxvfs.c 2011-11-08 19:02:43.000000000 -0500
44054 +++ linux-2.6.32.49/fs/befs/linuxvfs.c 2011-11-15 19:59:43.000000000 -0500
44055 @@ -498,7 +498,7 @@ static void befs_put_link(struct dentry
44056 {
44057 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
44058 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
44059 - char *link = nd_get_link(nd);
44060 + const char *link = nd_get_link(nd);
44061 if (!IS_ERR(link))
44062 kfree(link);
44063 }
44064 diff -urNp linux-2.6.32.49/fs/binfmt_aout.c linux-2.6.32.49/fs/binfmt_aout.c
44065 --- linux-2.6.32.49/fs/binfmt_aout.c 2011-11-08 19:02:43.000000000 -0500
44066 +++ linux-2.6.32.49/fs/binfmt_aout.c 2011-11-15 19:59:43.000000000 -0500
44067 @@ -16,6 +16,7 @@
44068 #include <linux/string.h>
44069 #include <linux/fs.h>
44070 #include <linux/file.h>
44071 +#include <linux/security.h>
44072 #include <linux/stat.h>
44073 #include <linux/fcntl.h>
44074 #include <linux/ptrace.h>
44075 @@ -102,6 +103,8 @@ static int aout_core_dump(long signr, st
44076 #endif
44077 # define START_STACK(u) (u.start_stack)
44078
44079 + memset(&dump, 0, sizeof(dump));
44080 +
44081 fs = get_fs();
44082 set_fs(KERNEL_DS);
44083 has_dumped = 1;
44084 @@ -113,10 +116,12 @@ static int aout_core_dump(long signr, st
44085
44086 /* If the size of the dump file exceeds the rlimit, then see what would happen
44087 if we wrote the stack, but not the data area. */
44088 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
44089 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
44090 dump.u_dsize = 0;
44091
44092 /* Make sure we have enough room to write the stack and data areas. */
44093 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
44094 if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
44095 dump.u_ssize = 0;
44096
44097 @@ -146,9 +151,7 @@ static int aout_core_dump(long signr, st
44098 dump_size = dump.u_ssize << PAGE_SHIFT;
44099 DUMP_WRITE(dump_start,dump_size);
44100 }
44101 -/* Finally dump the task struct. Not be used by gdb, but could be useful */
44102 - set_fs(KERNEL_DS);
44103 - DUMP_WRITE(current,sizeof(*current));
44104 +/* Finally, let's not dump the task struct. Not be used by gdb, but could be useful to an attacker */
44105 end_coredump:
44106 set_fs(fs);
44107 return has_dumped;
44108 @@ -249,6 +252,8 @@ static int load_aout_binary(struct linux
44109 rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
44110 if (rlim >= RLIM_INFINITY)
44111 rlim = ~0;
44112 +
44113 + gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
44114 if (ex.a_data + ex.a_bss > rlim)
44115 return -ENOMEM;
44116
44117 @@ -277,6 +282,27 @@ static int load_aout_binary(struct linux
44118 install_exec_creds(bprm);
44119 current->flags &= ~PF_FORKNOEXEC;
44120
44121 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
44122 + current->mm->pax_flags = 0UL;
44123 +#endif
44124 +
44125 +#ifdef CONFIG_PAX_PAGEEXEC
44126 + if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
44127 + current->mm->pax_flags |= MF_PAX_PAGEEXEC;
44128 +
44129 +#ifdef CONFIG_PAX_EMUTRAMP
44130 + if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
44131 + current->mm->pax_flags |= MF_PAX_EMUTRAMP;
44132 +#endif
44133 +
44134 +#ifdef CONFIG_PAX_MPROTECT
44135 + if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
44136 + current->mm->pax_flags |= MF_PAX_MPROTECT;
44137 +#endif
44138 +
44139 + }
44140 +#endif
44141 +
44142 if (N_MAGIC(ex) == OMAGIC) {
44143 unsigned long text_addr, map_size;
44144 loff_t pos;
44145 @@ -349,7 +375,7 @@ static int load_aout_binary(struct linux
44146
44147 down_write(&current->mm->mmap_sem);
44148 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
44149 - PROT_READ | PROT_WRITE | PROT_EXEC,
44150 + PROT_READ | PROT_WRITE,
44151 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
44152 fd_offset + ex.a_text);
44153 up_write(&current->mm->mmap_sem);
44154 diff -urNp linux-2.6.32.49/fs/binfmt_elf.c linux-2.6.32.49/fs/binfmt_elf.c
44155 --- linux-2.6.32.49/fs/binfmt_elf.c 2011-11-08 19:02:43.000000000 -0500
44156 +++ linux-2.6.32.49/fs/binfmt_elf.c 2011-11-18 18:51:56.000000000 -0500
44157 @@ -50,6 +50,10 @@ static int elf_core_dump(long signr, str
44158 #define elf_core_dump NULL
44159 #endif
44160
44161 +#ifdef CONFIG_PAX_MPROTECT
44162 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
44163 +#endif
44164 +
44165 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
44166 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
44167 #else
44168 @@ -69,6 +73,11 @@ static struct linux_binfmt elf_format =
44169 .load_binary = load_elf_binary,
44170 .load_shlib = load_elf_library,
44171 .core_dump = elf_core_dump,
44172 +
44173 +#ifdef CONFIG_PAX_MPROTECT
44174 + .handle_mprotect= elf_handle_mprotect,
44175 +#endif
44176 +
44177 .min_coredump = ELF_EXEC_PAGESIZE,
44178 .hasvdso = 1
44179 };
44180 @@ -77,6 +86,8 @@ static struct linux_binfmt elf_format =
44181
44182 static int set_brk(unsigned long start, unsigned long end)
44183 {
44184 + unsigned long e = end;
44185 +
44186 start = ELF_PAGEALIGN(start);
44187 end = ELF_PAGEALIGN(end);
44188 if (end > start) {
44189 @@ -87,7 +98,7 @@ static int set_brk(unsigned long start,
44190 if (BAD_ADDR(addr))
44191 return addr;
44192 }
44193 - current->mm->start_brk = current->mm->brk = end;
44194 + current->mm->start_brk = current->mm->brk = e;
44195 return 0;
44196 }
44197
44198 @@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *b
44199 elf_addr_t __user *u_rand_bytes;
44200 const char *k_platform = ELF_PLATFORM;
44201 const char *k_base_platform = ELF_BASE_PLATFORM;
44202 - unsigned char k_rand_bytes[16];
44203 + u32 k_rand_bytes[4];
44204 int items;
44205 elf_addr_t *elf_info;
44206 int ei_index = 0;
44207 const struct cred *cred = current_cred();
44208 struct vm_area_struct *vma;
44209 + unsigned long saved_auxv[AT_VECTOR_SIZE];
44210 +
44211 + pax_track_stack();
44212
44213 /*
44214 * In some cases (e.g. Hyper-Threading), we want to avoid L1
44215 @@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *b
44216 * Generate 16 random bytes for userspace PRNG seeding.
44217 */
44218 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
44219 - u_rand_bytes = (elf_addr_t __user *)
44220 - STACK_ALLOC(p, sizeof(k_rand_bytes));
44221 + srandom32(k_rand_bytes[0] ^ random32());
44222 + srandom32(k_rand_bytes[1] ^ random32());
44223 + srandom32(k_rand_bytes[2] ^ random32());
44224 + srandom32(k_rand_bytes[3] ^ random32());
44225 + p = STACK_ROUND(p, sizeof(k_rand_bytes));
44226 + u_rand_bytes = (elf_addr_t __user *) p;
44227 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
44228 return -EFAULT;
44229
44230 @@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *b
44231 return -EFAULT;
44232 current->mm->env_end = p;
44233
44234 + memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
44235 +
44236 /* Put the elf_info on the stack in the right place. */
44237 sp = (elf_addr_t __user *)envp + 1;
44238 - if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
44239 + if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
44240 return -EFAULT;
44241 return 0;
44242 }
44243 @@ -385,10 +405,10 @@ static unsigned long load_elf_interp(str
44244 {
44245 struct elf_phdr *elf_phdata;
44246 struct elf_phdr *eppnt;
44247 - unsigned long load_addr = 0;
44248 + unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
44249 int load_addr_set = 0;
44250 unsigned long last_bss = 0, elf_bss = 0;
44251 - unsigned long error = ~0UL;
44252 + unsigned long error = -EINVAL;
44253 unsigned long total_size;
44254 int retval, i, size;
44255
44256 @@ -434,6 +454,11 @@ static unsigned long load_elf_interp(str
44257 goto out_close;
44258 }
44259
44260 +#ifdef CONFIG_PAX_SEGMEXEC
44261 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
44262 + pax_task_size = SEGMEXEC_TASK_SIZE;
44263 +#endif
44264 +
44265 eppnt = elf_phdata;
44266 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
44267 if (eppnt->p_type == PT_LOAD) {
44268 @@ -477,8 +502,8 @@ static unsigned long load_elf_interp(str
44269 k = load_addr + eppnt->p_vaddr;
44270 if (BAD_ADDR(k) ||
44271 eppnt->p_filesz > eppnt->p_memsz ||
44272 - eppnt->p_memsz > TASK_SIZE ||
44273 - TASK_SIZE - eppnt->p_memsz < k) {
44274 + eppnt->p_memsz > pax_task_size ||
44275 + pax_task_size - eppnt->p_memsz < k) {
44276 error = -ENOMEM;
44277 goto out_close;
44278 }
44279 @@ -532,6 +557,194 @@ out:
44280 return error;
44281 }
44282
44283 +#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
44284 +static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
44285 +{
44286 + unsigned long pax_flags = 0UL;
44287 +
44288 +#ifdef CONFIG_PAX_PAGEEXEC
44289 + if (elf_phdata->p_flags & PF_PAGEEXEC)
44290 + pax_flags |= MF_PAX_PAGEEXEC;
44291 +#endif
44292 +
44293 +#ifdef CONFIG_PAX_SEGMEXEC
44294 + if (elf_phdata->p_flags & PF_SEGMEXEC)
44295 + pax_flags |= MF_PAX_SEGMEXEC;
44296 +#endif
44297 +
44298 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
44299 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
44300 + if (nx_enabled)
44301 + pax_flags &= ~MF_PAX_SEGMEXEC;
44302 + else
44303 + pax_flags &= ~MF_PAX_PAGEEXEC;
44304 + }
44305 +#endif
44306 +
44307 +#ifdef CONFIG_PAX_EMUTRAMP
44308 + if (elf_phdata->p_flags & PF_EMUTRAMP)
44309 + pax_flags |= MF_PAX_EMUTRAMP;
44310 +#endif
44311 +
44312 +#ifdef CONFIG_PAX_MPROTECT
44313 + if (elf_phdata->p_flags & PF_MPROTECT)
44314 + pax_flags |= MF_PAX_MPROTECT;
44315 +#endif
44316 +
44317 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
44318 + if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
44319 + pax_flags |= MF_PAX_RANDMMAP;
44320 +#endif
44321 +
44322 + return pax_flags;
44323 +}
44324 +#endif
44325 +
44326 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
44327 +static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
44328 +{
44329 + unsigned long pax_flags = 0UL;
44330 +
44331 +#ifdef CONFIG_PAX_PAGEEXEC
44332 + if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
44333 + pax_flags |= MF_PAX_PAGEEXEC;
44334 +#endif
44335 +
44336 +#ifdef CONFIG_PAX_SEGMEXEC
44337 + if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
44338 + pax_flags |= MF_PAX_SEGMEXEC;
44339 +#endif
44340 +
44341 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
44342 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
44343 + if (nx_enabled)
44344 + pax_flags &= ~MF_PAX_SEGMEXEC;
44345 + else
44346 + pax_flags &= ~MF_PAX_PAGEEXEC;
44347 + }
44348 +#endif
44349 +
44350 +#ifdef CONFIG_PAX_EMUTRAMP
44351 + if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
44352 + pax_flags |= MF_PAX_EMUTRAMP;
44353 +#endif
44354 +
44355 +#ifdef CONFIG_PAX_MPROTECT
44356 + if (!(elf_phdata->p_flags & PF_NOMPROTECT))
44357 + pax_flags |= MF_PAX_MPROTECT;
44358 +#endif
44359 +
44360 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
44361 + if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
44362 + pax_flags |= MF_PAX_RANDMMAP;
44363 +#endif
44364 +
44365 + return pax_flags;
44366 +}
44367 +#endif
44368 +
44369 +#ifdef CONFIG_PAX_EI_PAX
44370 +static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
44371 +{
44372 + unsigned long pax_flags = 0UL;
44373 +
44374 +#ifdef CONFIG_PAX_PAGEEXEC
44375 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
44376 + pax_flags |= MF_PAX_PAGEEXEC;
44377 +#endif
44378 +
44379 +#ifdef CONFIG_PAX_SEGMEXEC
44380 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
44381 + pax_flags |= MF_PAX_SEGMEXEC;
44382 +#endif
44383 +
44384 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
44385 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
44386 + if (nx_enabled)
44387 + pax_flags &= ~MF_PAX_SEGMEXEC;
44388 + else
44389 + pax_flags &= ~MF_PAX_PAGEEXEC;
44390 + }
44391 +#endif
44392 +
44393 +#ifdef CONFIG_PAX_EMUTRAMP
44394 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
44395 + pax_flags |= MF_PAX_EMUTRAMP;
44396 +#endif
44397 +
44398 +#ifdef CONFIG_PAX_MPROTECT
44399 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
44400 + pax_flags |= MF_PAX_MPROTECT;
44401 +#endif
44402 +
44403 +#ifdef CONFIG_PAX_ASLR
44404 + if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
44405 + pax_flags |= MF_PAX_RANDMMAP;
44406 +#endif
44407 +
44408 + return pax_flags;
44409 +}
44410 +#endif
44411 +
44412 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
44413 +static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
44414 +{
44415 + unsigned long pax_flags = 0UL;
44416 +
44417 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
44418 + unsigned long i;
44419 + int found_flags = 0;
44420 +#endif
44421 +
44422 +#ifdef CONFIG_PAX_EI_PAX
44423 + pax_flags = pax_parse_ei_pax(elf_ex);
44424 +#endif
44425 +
44426 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
44427 + for (i = 0UL; i < elf_ex->e_phnum; i++)
44428 + if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
44429 + if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
44430 + ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
44431 + ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
44432 + ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
44433 + ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
44434 + return -EINVAL;
44435 +
44436 +#ifdef CONFIG_PAX_SOFTMODE
44437 + if (pax_softmode)
44438 + pax_flags = pax_parse_softmode(&elf_phdata[i]);
44439 + else
44440 +#endif
44441 +
44442 + pax_flags = pax_parse_hardmode(&elf_phdata[i]);
44443 + found_flags = 1;
44444 + break;
44445 + }
44446 +#endif
44447 +
44448 +#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
44449 + if (found_flags == 0) {
44450 + struct elf_phdr phdr;
44451 + memset(&phdr, 0, sizeof(phdr));
44452 + phdr.p_flags = PF_NOEMUTRAMP;
44453 +#ifdef CONFIG_PAX_SOFTMODE
44454 + if (pax_softmode)
44455 + pax_flags = pax_parse_softmode(&phdr);
44456 + else
44457 +#endif
44458 + pax_flags = pax_parse_hardmode(&phdr);
44459 + }
44460 +#endif
44461 +
44462 +
44463 + if (0 > pax_check_flags(&pax_flags))
44464 + return -EINVAL;
44465 +
44466 + current->mm->pax_flags = pax_flags;
44467 + return 0;
44468 +}
44469 +#endif
44470 +
44471 /*
44472 * These are the functions used to load ELF style executables and shared
44473 * libraries. There is no binary dependent code anywhere else.
44474 @@ -548,6 +761,11 @@ static unsigned long randomize_stack_top
44475 {
44476 unsigned int random_variable = 0;
44477
44478 +#ifdef CONFIG_PAX_RANDUSTACK
44479 + if (randomize_va_space)
44480 + return stack_top - current->mm->delta_stack;
44481 +#endif
44482 +
44483 if ((current->flags & PF_RANDOMIZE) &&
44484 !(current->personality & ADDR_NO_RANDOMIZE)) {
44485 random_variable = get_random_int() & STACK_RND_MASK;
44486 @@ -566,7 +784,7 @@ static int load_elf_binary(struct linux_
44487 unsigned long load_addr = 0, load_bias = 0;
44488 int load_addr_set = 0;
44489 char * elf_interpreter = NULL;
44490 - unsigned long error;
44491 + unsigned long error = 0;
44492 struct elf_phdr *elf_ppnt, *elf_phdata;
44493 unsigned long elf_bss, elf_brk;
44494 int retval, i;
44495 @@ -576,11 +794,11 @@ static int load_elf_binary(struct linux_
44496 unsigned long start_code, end_code, start_data, end_data;
44497 unsigned long reloc_func_desc = 0;
44498 int executable_stack = EXSTACK_DEFAULT;
44499 - unsigned long def_flags = 0;
44500 struct {
44501 struct elfhdr elf_ex;
44502 struct elfhdr interp_elf_ex;
44503 } *loc;
44504 + unsigned long pax_task_size = TASK_SIZE;
44505
44506 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
44507 if (!loc) {
44508 @@ -718,11 +936,80 @@ static int load_elf_binary(struct linux_
44509
44510 /* OK, This is the point of no return */
44511 current->flags &= ~PF_FORKNOEXEC;
44512 - current->mm->def_flags = def_flags;
44513 +
44514 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
44515 + current->mm->pax_flags = 0UL;
44516 +#endif
44517 +
44518 +#ifdef CONFIG_PAX_DLRESOLVE
44519 + current->mm->call_dl_resolve = 0UL;
44520 +#endif
44521 +
44522 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
44523 + current->mm->call_syscall = 0UL;
44524 +#endif
44525 +
44526 +#ifdef CONFIG_PAX_ASLR
44527 + current->mm->delta_mmap = 0UL;
44528 + current->mm->delta_stack = 0UL;
44529 +#endif
44530 +
44531 + current->mm->def_flags = 0;
44532 +
44533 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
44534 + if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
44535 + send_sig(SIGKILL, current, 0);
44536 + goto out_free_dentry;
44537 + }
44538 +#endif
44539 +
44540 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
44541 + pax_set_initial_flags(bprm);
44542 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
44543 + if (pax_set_initial_flags_func)
44544 + (pax_set_initial_flags_func)(bprm);
44545 +#endif
44546 +
44547 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
44548 + if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !nx_enabled) {
44549 + current->mm->context.user_cs_limit = PAGE_SIZE;
44550 + current->mm->def_flags |= VM_PAGEEXEC;
44551 + }
44552 +#endif
44553 +
44554 +#ifdef CONFIG_PAX_SEGMEXEC
44555 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
44556 + current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
44557 + current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
44558 + pax_task_size = SEGMEXEC_TASK_SIZE;
44559 + }
44560 +#endif
44561 +
44562 +#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
44563 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
44564 + set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
44565 + put_cpu();
44566 + }
44567 +#endif
44568
44569 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
44570 may depend on the personality. */
44571 SET_PERSONALITY(loc->elf_ex);
44572 +
44573 +#ifdef CONFIG_PAX_ASLR
44574 + if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
44575 + current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
44576 + current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
44577 + }
44578 +#endif
44579 +
44580 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
44581 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
44582 + executable_stack = EXSTACK_DISABLE_X;
44583 + current->personality &= ~READ_IMPLIES_EXEC;
44584 + } else
44585 +#endif
44586 +
44587 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
44588 current->personality |= READ_IMPLIES_EXEC;
44589
44590 @@ -800,10 +1087,27 @@ static int load_elf_binary(struct linux_
44591 * might try to exec. This is because the brk will
44592 * follow the loader, and is not movable. */
44593 #ifdef CONFIG_X86
44594 - load_bias = 0;
44595 + if (current->flags & PF_RANDOMIZE)
44596 + load_bias = 0;
44597 + else
44598 + load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
44599 #else
44600 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
44601 #endif
44602 +
44603 +#ifdef CONFIG_PAX_RANDMMAP
44604 + /* PaX: randomize base address at the default exe base if requested */
44605 + if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
44606 +#ifdef CONFIG_SPARC64
44607 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
44608 +#else
44609 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
44610 +#endif
44611 + load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
44612 + elf_flags |= MAP_FIXED;
44613 + }
44614 +#endif
44615 +
44616 }
44617
44618 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
44619 @@ -836,9 +1140,9 @@ static int load_elf_binary(struct linux_
44620 * allowed task size. Note that p_filesz must always be
44621 * <= p_memsz so it is only necessary to check p_memsz.
44622 */
44623 - if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
44624 - elf_ppnt->p_memsz > TASK_SIZE ||
44625 - TASK_SIZE - elf_ppnt->p_memsz < k) {
44626 + if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
44627 + elf_ppnt->p_memsz > pax_task_size ||
44628 + pax_task_size - elf_ppnt->p_memsz < k) {
44629 /* set_brk can never work. Avoid overflows. */
44630 send_sig(SIGKILL, current, 0);
44631 retval = -EINVAL;
44632 @@ -866,6 +1170,11 @@ static int load_elf_binary(struct linux_
44633 start_data += load_bias;
44634 end_data += load_bias;
44635
44636 +#ifdef CONFIG_PAX_RANDMMAP
44637 + if (current->mm->pax_flags & MF_PAX_RANDMMAP)
44638 + elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
44639 +#endif
44640 +
44641 /* Calling set_brk effectively mmaps the pages that we need
44642 * for the bss and break sections. We must do this before
44643 * mapping in the interpreter, to make sure it doesn't wind
44644 @@ -877,9 +1186,11 @@ static int load_elf_binary(struct linux_
44645 goto out_free_dentry;
44646 }
44647 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
44648 - send_sig(SIGSEGV, current, 0);
44649 - retval = -EFAULT; /* Nobody gets to see this, but.. */
44650 - goto out_free_dentry;
44651 + /*
44652 + * This bss-zeroing can fail if the ELF
44653 + * file specifies odd protections. So
44654 + * we don't check the return value
44655 + */
44656 }
44657
44658 if (elf_interpreter) {
44659 @@ -1112,8 +1423,10 @@ static int dump_seek(struct file *file,
44660 unsigned long n = off;
44661 if (n > PAGE_SIZE)
44662 n = PAGE_SIZE;
44663 - if (!dump_write(file, buf, n))
44664 + if (!dump_write(file, buf, n)) {
44665 + free_page((unsigned long)buf);
44666 return 0;
44667 + }
44668 off -= n;
44669 }
44670 free_page((unsigned long)buf);
44671 @@ -1125,7 +1438,7 @@ static int dump_seek(struct file *file,
44672 * Decide what to dump of a segment, part, all or none.
44673 */
44674 static unsigned long vma_dump_size(struct vm_area_struct *vma,
44675 - unsigned long mm_flags)
44676 + unsigned long mm_flags, long signr)
44677 {
44678 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
44679
44680 @@ -1159,7 +1472,7 @@ static unsigned long vma_dump_size(struc
44681 if (vma->vm_file == NULL)
44682 return 0;
44683
44684 - if (FILTER(MAPPED_PRIVATE))
44685 + if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
44686 goto whole;
44687
44688 /*
44689 @@ -1255,8 +1568,11 @@ static int writenote(struct memelfnote *
44690 #undef DUMP_WRITE
44691
44692 #define DUMP_WRITE(addr, nr) \
44693 + do { \
44694 + gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
44695 if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
44696 - goto end_coredump;
44697 + goto end_coredump; \
44698 + } while (0);
44699
44700 static void fill_elf_header(struct elfhdr *elf, int segs,
44701 u16 machine, u32 flags, u8 osabi)
44702 @@ -1385,9 +1701,9 @@ static void fill_auxv_note(struct memelf
44703 {
44704 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
44705 int i = 0;
44706 - do
44707 + do {
44708 i += 2;
44709 - while (auxv[i - 2] != AT_NULL);
44710 + } while (auxv[i - 2] != AT_NULL);
44711 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
44712 }
44713
44714 @@ -1973,7 +2289,7 @@ static int elf_core_dump(long signr, str
44715 phdr.p_offset = offset;
44716 phdr.p_vaddr = vma->vm_start;
44717 phdr.p_paddr = 0;
44718 - phdr.p_filesz = vma_dump_size(vma, mm_flags);
44719 + phdr.p_filesz = vma_dump_size(vma, mm_flags, signr);
44720 phdr.p_memsz = vma->vm_end - vma->vm_start;
44721 offset += phdr.p_filesz;
44722 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
44723 @@ -2006,7 +2322,7 @@ static int elf_core_dump(long signr, str
44724 unsigned long addr;
44725 unsigned long end;
44726
44727 - end = vma->vm_start + vma_dump_size(vma, mm_flags);
44728 + end = vma->vm_start + vma_dump_size(vma, mm_flags, signr);
44729
44730 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
44731 struct page *page;
44732 @@ -2015,6 +2331,7 @@ static int elf_core_dump(long signr, str
44733 page = get_dump_page(addr);
44734 if (page) {
44735 void *kaddr = kmap(page);
44736 + gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
44737 stop = ((size += PAGE_SIZE) > limit) ||
44738 !dump_write(file, kaddr, PAGE_SIZE);
44739 kunmap(page);
44740 @@ -2042,6 +2359,97 @@ out:
44741
44742 #endif /* USE_ELF_CORE_DUMP */
44743
44744 +#ifdef CONFIG_PAX_MPROTECT
44745 +/* PaX: non-PIC ELF libraries need relocations on their executable segments
44746 + * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
44747 + * we'll remove VM_MAYWRITE for good on RELRO segments.
44748 + *
44749 + * The checks favour ld-linux.so behaviour which operates on a per ELF segment
44750 + * basis because we want to allow the common case and not the special ones.
44751 + */
44752 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
44753 +{
44754 + struct elfhdr elf_h;
44755 + struct elf_phdr elf_p;
44756 + unsigned long i;
44757 + unsigned long oldflags;
44758 + bool is_textrel_rw, is_textrel_rx, is_relro;
44759 +
44760 + if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
44761 + return;
44762 +
44763 + oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
44764 + newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
44765 +
44766 +#ifdef CONFIG_PAX_ELFRELOCS
44767 + /* possible TEXTREL */
44768 + is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
44769 + is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
44770 +#else
44771 + is_textrel_rw = false;
44772 + is_textrel_rx = false;
44773 +#endif
44774 +
44775 + /* possible RELRO */
44776 + is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
44777 +
44778 + if (!is_textrel_rw && !is_textrel_rx && !is_relro)
44779 + return;
44780 +
44781 + if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
44782 + memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
44783 +
44784 +#ifdef CONFIG_PAX_ETEXECRELOCS
44785 + ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
44786 +#else
44787 + ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
44788 +#endif
44789 +
44790 + (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
44791 + !elf_check_arch(&elf_h) ||
44792 + elf_h.e_phentsize != sizeof(struct elf_phdr) ||
44793 + elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
44794 + return;
44795 +
44796 + for (i = 0UL; i < elf_h.e_phnum; i++) {
44797 + if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
44798 + return;
44799 + switch (elf_p.p_type) {
44800 + case PT_DYNAMIC:
44801 + if (!is_textrel_rw && !is_textrel_rx)
44802 + continue;
44803 + i = 0UL;
44804 + while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
44805 + elf_dyn dyn;
44806 +
44807 + if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
44808 + return;
44809 + if (dyn.d_tag == DT_NULL)
44810 + return;
44811 + if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
44812 + gr_log_textrel(vma);
44813 + if (is_textrel_rw)
44814 + vma->vm_flags |= VM_MAYWRITE;
44815 + else
44816 + /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
44817 + vma->vm_flags &= ~VM_MAYWRITE;
44818 + return;
44819 + }
44820 + i++;
44821 + }
44822 + return;
44823 +
44824 + case PT_GNU_RELRO:
44825 + if (!is_relro)
44826 + continue;
44827 + if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
44828 + vma->vm_flags &= ~VM_MAYWRITE;
44829 + return;
44830 + }
44831 + }
44832 +}
44833 +#endif
44834 +
44835 static int __init init_elf_binfmt(void)
44836 {
44837 return register_binfmt(&elf_format);
44838 diff -urNp linux-2.6.32.49/fs/binfmt_flat.c linux-2.6.32.49/fs/binfmt_flat.c
44839 --- linux-2.6.32.49/fs/binfmt_flat.c 2011-11-08 19:02:43.000000000 -0500
44840 +++ linux-2.6.32.49/fs/binfmt_flat.c 2011-11-15 19:59:43.000000000 -0500
44841 @@ -564,7 +564,9 @@ static int load_flat_file(struct linux_b
44842 realdatastart = (unsigned long) -ENOMEM;
44843 printk("Unable to allocate RAM for process data, errno %d\n",
44844 (int)-realdatastart);
44845 + down_write(&current->mm->mmap_sem);
44846 do_munmap(current->mm, textpos, text_len);
44847 + up_write(&current->mm->mmap_sem);
44848 ret = realdatastart;
44849 goto err;
44850 }
44851 @@ -588,8 +590,10 @@ static int load_flat_file(struct linux_b
44852 }
44853 if (IS_ERR_VALUE(result)) {
44854 printk("Unable to read data+bss, errno %d\n", (int)-result);
44855 + down_write(&current->mm->mmap_sem);
44856 do_munmap(current->mm, textpos, text_len);
44857 do_munmap(current->mm, realdatastart, data_len + extra);
44858 + up_write(&current->mm->mmap_sem);
44859 ret = result;
44860 goto err;
44861 }
44862 @@ -658,8 +662,10 @@ static int load_flat_file(struct linux_b
44863 }
44864 if (IS_ERR_VALUE(result)) {
44865 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
44866 + down_write(&current->mm->mmap_sem);
44867 do_munmap(current->mm, textpos, text_len + data_len + extra +
44868 MAX_SHARED_LIBS * sizeof(unsigned long));
44869 + up_write(&current->mm->mmap_sem);
44870 ret = result;
44871 goto err;
44872 }
44873 diff -urNp linux-2.6.32.49/fs/bio.c linux-2.6.32.49/fs/bio.c
44874 --- linux-2.6.32.49/fs/bio.c 2011-11-08 19:02:43.000000000 -0500
44875 +++ linux-2.6.32.49/fs/bio.c 2011-11-15 19:59:43.000000000 -0500
44876 @@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_cr
44877
44878 i = 0;
44879 while (i < bio_slab_nr) {
44880 - struct bio_slab *bslab = &bio_slabs[i];
44881 + bslab = &bio_slabs[i];
44882
44883 if (!bslab->slab && entry == -1)
44884 entry = i;
44885 @@ -1236,7 +1236,7 @@ static void bio_copy_kern_endio(struct b
44886 const int read = bio_data_dir(bio) == READ;
44887 struct bio_map_data *bmd = bio->bi_private;
44888 int i;
44889 - char *p = bmd->sgvecs[0].iov_base;
44890 + char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base;
44891
44892 __bio_for_each_segment(bvec, bio, i, 0) {
44893 char *addr = page_address(bvec->bv_page);
44894 diff -urNp linux-2.6.32.49/fs/block_dev.c linux-2.6.32.49/fs/block_dev.c
44895 --- linux-2.6.32.49/fs/block_dev.c 2011-11-08 19:02:43.000000000 -0500
44896 +++ linux-2.6.32.49/fs/block_dev.c 2011-11-15 19:59:43.000000000 -0500
44897 @@ -664,7 +664,7 @@ int bd_claim(struct block_device *bdev,
44898 else if (bdev->bd_contains == bdev)
44899 res = 0; /* is a whole device which isn't held */
44900
44901 - else if (bdev->bd_contains->bd_holder == bd_claim)
44902 + else if (bdev->bd_contains->bd_holder == (void *)bd_claim)
44903 res = 0; /* is a partition of a device that is being partitioned */
44904 else if (bdev->bd_contains->bd_holder != NULL)
44905 res = -EBUSY; /* is a partition of a held device */
44906 diff -urNp linux-2.6.32.49/fs/btrfs/ctree.c linux-2.6.32.49/fs/btrfs/ctree.c
44907 --- linux-2.6.32.49/fs/btrfs/ctree.c 2011-11-08 19:02:43.000000000 -0500
44908 +++ linux-2.6.32.49/fs/btrfs/ctree.c 2011-11-15 19:59:43.000000000 -0500
44909 @@ -461,9 +461,12 @@ static noinline int __btrfs_cow_block(st
44910 free_extent_buffer(buf);
44911 add_root_to_dirty_list(root);
44912 } else {
44913 - if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
44914 - parent_start = parent->start;
44915 - else
44916 + if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
44917 + if (parent)
44918 + parent_start = parent->start;
44919 + else
44920 + parent_start = 0;
44921 + } else
44922 parent_start = 0;
44923
44924 WARN_ON(trans->transid != btrfs_header_generation(parent));
44925 @@ -3645,7 +3648,6 @@ setup_items_for_insert(struct btrfs_tran
44926
44927 ret = 0;
44928 if (slot == 0) {
44929 - struct btrfs_disk_key disk_key;
44930 btrfs_cpu_key_to_disk(&disk_key, cpu_key);
44931 ret = fixup_low_keys(trans, root, path, &disk_key, 1);
44932 }
44933 diff -urNp linux-2.6.32.49/fs/btrfs/disk-io.c linux-2.6.32.49/fs/btrfs/disk-io.c
44934 --- linux-2.6.32.49/fs/btrfs/disk-io.c 2011-11-08 19:02:43.000000000 -0500
44935 +++ linux-2.6.32.49/fs/btrfs/disk-io.c 2011-11-15 19:59:43.000000000 -0500
44936 @@ -39,7 +39,7 @@
44937 #include "tree-log.h"
44938 #include "free-space-cache.h"
44939
44940 -static struct extent_io_ops btree_extent_io_ops;
44941 +static const struct extent_io_ops btree_extent_io_ops;
44942 static void end_workqueue_fn(struct btrfs_work *work);
44943 static void free_fs_root(struct btrfs_root *root);
44944
44945 @@ -2607,7 +2607,7 @@ out:
44946 return 0;
44947 }
44948
44949 -static struct extent_io_ops btree_extent_io_ops = {
44950 +static const struct extent_io_ops btree_extent_io_ops = {
44951 .write_cache_pages_lock_hook = btree_lock_page_hook,
44952 .readpage_end_io_hook = btree_readpage_end_io_hook,
44953 .submit_bio_hook = btree_submit_bio_hook,
44954 diff -urNp linux-2.6.32.49/fs/btrfs/extent_io.h linux-2.6.32.49/fs/btrfs/extent_io.h
44955 --- linux-2.6.32.49/fs/btrfs/extent_io.h 2011-11-08 19:02:43.000000000 -0500
44956 +++ linux-2.6.32.49/fs/btrfs/extent_io.h 2011-11-15 19:59:43.000000000 -0500
44957 @@ -49,36 +49,36 @@ typedef int (extent_submit_bio_hook_t)(s
44958 struct bio *bio, int mirror_num,
44959 unsigned long bio_flags);
44960 struct extent_io_ops {
44961 - int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
44962 + int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
44963 u64 start, u64 end, int *page_started,
44964 unsigned long *nr_written);
44965 - int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
44966 - int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
44967 + int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
44968 + int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
44969 extent_submit_bio_hook_t *submit_bio_hook;
44970 - int (*merge_bio_hook)(struct page *page, unsigned long offset,
44971 + int (* const merge_bio_hook)(struct page *page, unsigned long offset,
44972 size_t size, struct bio *bio,
44973 unsigned long bio_flags);
44974 - int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
44975 - int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
44976 + int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
44977 + int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
44978 u64 start, u64 end,
44979 struct extent_state *state);
44980 - int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
44981 + int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
44982 u64 start, u64 end,
44983 struct extent_state *state);
44984 - int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
44985 + int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
44986 struct extent_state *state);
44987 - int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
44988 + int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
44989 struct extent_state *state, int uptodate);
44990 - int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
44991 + int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
44992 unsigned long old, unsigned long bits);
44993 - int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
44994 + int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
44995 unsigned long bits);
44996 - int (*merge_extent_hook)(struct inode *inode,
44997 + int (* const merge_extent_hook)(struct inode *inode,
44998 struct extent_state *new,
44999 struct extent_state *other);
45000 - int (*split_extent_hook)(struct inode *inode,
45001 + int (* const split_extent_hook)(struct inode *inode,
45002 struct extent_state *orig, u64 split);
45003 - int (*write_cache_pages_lock_hook)(struct page *page);
45004 + int (* const write_cache_pages_lock_hook)(struct page *page);
45005 };
45006
45007 struct extent_io_tree {
45008 @@ -88,7 +88,7 @@ struct extent_io_tree {
45009 u64 dirty_bytes;
45010 spinlock_t lock;
45011 spinlock_t buffer_lock;
45012 - struct extent_io_ops *ops;
45013 + const struct extent_io_ops *ops;
45014 };
45015
45016 struct extent_state {
45017 diff -urNp linux-2.6.32.49/fs/btrfs/extent-tree.c linux-2.6.32.49/fs/btrfs/extent-tree.c
45018 --- linux-2.6.32.49/fs/btrfs/extent-tree.c 2011-11-08 19:02:43.000000000 -0500
45019 +++ linux-2.6.32.49/fs/btrfs/extent-tree.c 2011-11-15 19:59:43.000000000 -0500
45020 @@ -7141,6 +7141,10 @@ static noinline int relocate_one_extent(
45021 u64 group_start = group->key.objectid;
45022 new_extents = kmalloc(sizeof(*new_extents),
45023 GFP_NOFS);
45024 + if (!new_extents) {
45025 + ret = -ENOMEM;
45026 + goto out;
45027 + }
45028 nr_extents = 1;
45029 ret = get_new_locations(reloc_inode,
45030 extent_key,
45031 diff -urNp linux-2.6.32.49/fs/btrfs/free-space-cache.c linux-2.6.32.49/fs/btrfs/free-space-cache.c
45032 --- linux-2.6.32.49/fs/btrfs/free-space-cache.c 2011-11-08 19:02:43.000000000 -0500
45033 +++ linux-2.6.32.49/fs/btrfs/free-space-cache.c 2011-11-15 19:59:43.000000000 -0500
45034 @@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
45035
45036 while(1) {
45037 if (entry->bytes < bytes || entry->offset < min_start) {
45038 - struct rb_node *node;
45039 -
45040 node = rb_next(&entry->offset_index);
45041 if (!node)
45042 break;
45043 @@ -1226,7 +1224,7 @@ again:
45044 */
45045 while (entry->bitmap || found_bitmap ||
45046 (!entry->bitmap && entry->bytes < min_bytes)) {
45047 - struct rb_node *node = rb_next(&entry->offset_index);
45048 + node = rb_next(&entry->offset_index);
45049
45050 if (entry->bitmap && entry->bytes > bytes + empty_size) {
45051 ret = btrfs_bitmap_cluster(block_group, entry, cluster,
45052 diff -urNp linux-2.6.32.49/fs/btrfs/inode.c linux-2.6.32.49/fs/btrfs/inode.c
45053 --- linux-2.6.32.49/fs/btrfs/inode.c 2011-11-08 19:02:43.000000000 -0500
45054 +++ linux-2.6.32.49/fs/btrfs/inode.c 2011-11-15 19:59:43.000000000 -0500
45055 @@ -63,7 +63,7 @@ static const struct inode_operations btr
45056 static const struct address_space_operations btrfs_aops;
45057 static const struct address_space_operations btrfs_symlink_aops;
45058 static const struct file_operations btrfs_dir_file_operations;
45059 -static struct extent_io_ops btrfs_extent_io_ops;
45060 +static const struct extent_io_ops btrfs_extent_io_ops;
45061
45062 static struct kmem_cache *btrfs_inode_cachep;
45063 struct kmem_cache *btrfs_trans_handle_cachep;
45064 @@ -925,6 +925,7 @@ static int cow_file_range_async(struct i
45065 1, 0, NULL, GFP_NOFS);
45066 while (start < end) {
45067 async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
45068 + BUG_ON(!async_cow);
45069 async_cow->inode = inode;
45070 async_cow->root = root;
45071 async_cow->locked_page = locked_page;
45072 @@ -4591,6 +4592,8 @@ static noinline int uncompress_inline(st
45073 inline_size = btrfs_file_extent_inline_item_len(leaf,
45074 btrfs_item_nr(leaf, path->slots[0]));
45075 tmp = kmalloc(inline_size, GFP_NOFS);
45076 + if (!tmp)
45077 + return -ENOMEM;
45078 ptr = btrfs_file_extent_inline_start(item);
45079
45080 read_extent_buffer(leaf, tmp, ptr, inline_size);
45081 @@ -5410,7 +5413,7 @@ fail:
45082 return -ENOMEM;
45083 }
45084
45085 -static int btrfs_getattr(struct vfsmount *mnt,
45086 +int btrfs_getattr(struct vfsmount *mnt,
45087 struct dentry *dentry, struct kstat *stat)
45088 {
45089 struct inode *inode = dentry->d_inode;
45090 @@ -5422,6 +5425,14 @@ static int btrfs_getattr(struct vfsmount
45091 return 0;
45092 }
45093
45094 +EXPORT_SYMBOL(btrfs_getattr);
45095 +
45096 +dev_t get_btrfs_dev_from_inode(struct inode *inode)
45097 +{
45098 + return BTRFS_I(inode)->root->anon_super.s_dev;
45099 +}
45100 +EXPORT_SYMBOL(get_btrfs_dev_from_inode);
45101 +
45102 static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
45103 struct inode *new_dir, struct dentry *new_dentry)
45104 {
45105 @@ -5972,7 +5983,7 @@ static const struct file_operations btrf
45106 .fsync = btrfs_sync_file,
45107 };
45108
45109 -static struct extent_io_ops btrfs_extent_io_ops = {
45110 +static const struct extent_io_ops btrfs_extent_io_ops = {
45111 .fill_delalloc = run_delalloc_range,
45112 .submit_bio_hook = btrfs_submit_bio_hook,
45113 .merge_bio_hook = btrfs_merge_bio_hook,
45114 diff -urNp linux-2.6.32.49/fs/btrfs/relocation.c linux-2.6.32.49/fs/btrfs/relocation.c
45115 --- linux-2.6.32.49/fs/btrfs/relocation.c 2011-11-08 19:02:43.000000000 -0500
45116 +++ linux-2.6.32.49/fs/btrfs/relocation.c 2011-11-15 19:59:43.000000000 -0500
45117 @@ -884,7 +884,7 @@ static int __update_reloc_root(struct bt
45118 }
45119 spin_unlock(&rc->reloc_root_tree.lock);
45120
45121 - BUG_ON((struct btrfs_root *)node->data != root);
45122 + BUG_ON(!node || (struct btrfs_root *)node->data != root);
45123
45124 if (!del) {
45125 spin_lock(&rc->reloc_root_tree.lock);
45126 diff -urNp linux-2.6.32.49/fs/btrfs/sysfs.c linux-2.6.32.49/fs/btrfs/sysfs.c
45127 --- linux-2.6.32.49/fs/btrfs/sysfs.c 2011-11-08 19:02:43.000000000 -0500
45128 +++ linux-2.6.32.49/fs/btrfs/sysfs.c 2011-11-15 19:59:43.000000000 -0500
45129 @@ -164,12 +164,12 @@ static void btrfs_root_release(struct ko
45130 complete(&root->kobj_unregister);
45131 }
45132
45133 -static struct sysfs_ops btrfs_super_attr_ops = {
45134 +static const struct sysfs_ops btrfs_super_attr_ops = {
45135 .show = btrfs_super_attr_show,
45136 .store = btrfs_super_attr_store,
45137 };
45138
45139 -static struct sysfs_ops btrfs_root_attr_ops = {
45140 +static const struct sysfs_ops btrfs_root_attr_ops = {
45141 .show = btrfs_root_attr_show,
45142 .store = btrfs_root_attr_store,
45143 };
45144 diff -urNp linux-2.6.32.49/fs/buffer.c linux-2.6.32.49/fs/buffer.c
45145 --- linux-2.6.32.49/fs/buffer.c 2011-11-08 19:02:43.000000000 -0500
45146 +++ linux-2.6.32.49/fs/buffer.c 2011-11-15 19:59:43.000000000 -0500
45147 @@ -25,6 +25,7 @@
45148 #include <linux/percpu.h>
45149 #include <linux/slab.h>
45150 #include <linux/capability.h>
45151 +#include <linux/security.h>
45152 #include <linux/blkdev.h>
45153 #include <linux/file.h>
45154 #include <linux/quotaops.h>
45155 diff -urNp linux-2.6.32.49/fs/cachefiles/bind.c linux-2.6.32.49/fs/cachefiles/bind.c
45156 --- linux-2.6.32.49/fs/cachefiles/bind.c 2011-11-08 19:02:43.000000000 -0500
45157 +++ linux-2.6.32.49/fs/cachefiles/bind.c 2011-11-15 19:59:43.000000000 -0500
45158 @@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
45159 args);
45160
45161 /* start by checking things over */
45162 - ASSERT(cache->fstop_percent >= 0 &&
45163 - cache->fstop_percent < cache->fcull_percent &&
45164 + ASSERT(cache->fstop_percent < cache->fcull_percent &&
45165 cache->fcull_percent < cache->frun_percent &&
45166 cache->frun_percent < 100);
45167
45168 - ASSERT(cache->bstop_percent >= 0 &&
45169 - cache->bstop_percent < cache->bcull_percent &&
45170 + ASSERT(cache->bstop_percent < cache->bcull_percent &&
45171 cache->bcull_percent < cache->brun_percent &&
45172 cache->brun_percent < 100);
45173
45174 diff -urNp linux-2.6.32.49/fs/cachefiles/daemon.c linux-2.6.32.49/fs/cachefiles/daemon.c
45175 --- linux-2.6.32.49/fs/cachefiles/daemon.c 2011-11-08 19:02:43.000000000 -0500
45176 +++ linux-2.6.32.49/fs/cachefiles/daemon.c 2011-11-15 19:59:43.000000000 -0500
45177 @@ -220,7 +220,7 @@ static ssize_t cachefiles_daemon_write(s
45178 if (test_bit(CACHEFILES_DEAD, &cache->flags))
45179 return -EIO;
45180
45181 - if (datalen < 0 || datalen > PAGE_SIZE - 1)
45182 + if (datalen > PAGE_SIZE - 1)
45183 return -EOPNOTSUPP;
45184
45185 /* drag the command string into the kernel so we can parse it */
45186 @@ -385,7 +385,7 @@ static int cachefiles_daemon_fstop(struc
45187 if (args[0] != '%' || args[1] != '\0')
45188 return -EINVAL;
45189
45190 - if (fstop < 0 || fstop >= cache->fcull_percent)
45191 + if (fstop >= cache->fcull_percent)
45192 return cachefiles_daemon_range_error(cache, args);
45193
45194 cache->fstop_percent = fstop;
45195 @@ -457,7 +457,7 @@ static int cachefiles_daemon_bstop(struc
45196 if (args[0] != '%' || args[1] != '\0')
45197 return -EINVAL;
45198
45199 - if (bstop < 0 || bstop >= cache->bcull_percent)
45200 + if (bstop >= cache->bcull_percent)
45201 return cachefiles_daemon_range_error(cache, args);
45202
45203 cache->bstop_percent = bstop;
45204 diff -urNp linux-2.6.32.49/fs/cachefiles/internal.h linux-2.6.32.49/fs/cachefiles/internal.h
45205 --- linux-2.6.32.49/fs/cachefiles/internal.h 2011-11-08 19:02:43.000000000 -0500
45206 +++ linux-2.6.32.49/fs/cachefiles/internal.h 2011-11-15 19:59:43.000000000 -0500
45207 @@ -56,7 +56,7 @@ struct cachefiles_cache {
45208 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
45209 struct rb_root active_nodes; /* active nodes (can't be culled) */
45210 rwlock_t active_lock; /* lock for active_nodes */
45211 - atomic_t gravecounter; /* graveyard uniquifier */
45212 + atomic_unchecked_t gravecounter; /* graveyard uniquifier */
45213 unsigned frun_percent; /* when to stop culling (% files) */
45214 unsigned fcull_percent; /* when to start culling (% files) */
45215 unsigned fstop_percent; /* when to stop allocating (% files) */
45216 @@ -168,19 +168,19 @@ extern int cachefiles_check_in_use(struc
45217 * proc.c
45218 */
45219 #ifdef CONFIG_CACHEFILES_HISTOGRAM
45220 -extern atomic_t cachefiles_lookup_histogram[HZ];
45221 -extern atomic_t cachefiles_mkdir_histogram[HZ];
45222 -extern atomic_t cachefiles_create_histogram[HZ];
45223 +extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
45224 +extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
45225 +extern atomic_unchecked_t cachefiles_create_histogram[HZ];
45226
45227 extern int __init cachefiles_proc_init(void);
45228 extern void cachefiles_proc_cleanup(void);
45229 static inline
45230 -void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
45231 +void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
45232 {
45233 unsigned long jif = jiffies - start_jif;
45234 if (jif >= HZ)
45235 jif = HZ - 1;
45236 - atomic_inc(&histogram[jif]);
45237 + atomic_inc_unchecked(&histogram[jif]);
45238 }
45239
45240 #else
45241 diff -urNp linux-2.6.32.49/fs/cachefiles/namei.c linux-2.6.32.49/fs/cachefiles/namei.c
45242 --- linux-2.6.32.49/fs/cachefiles/namei.c 2011-11-08 19:02:43.000000000 -0500
45243 +++ linux-2.6.32.49/fs/cachefiles/namei.c 2011-11-15 19:59:43.000000000 -0500
45244 @@ -250,7 +250,7 @@ try_again:
45245 /* first step is to make up a grave dentry in the graveyard */
45246 sprintf(nbuffer, "%08x%08x",
45247 (uint32_t) get_seconds(),
45248 - (uint32_t) atomic_inc_return(&cache->gravecounter));
45249 + (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
45250
45251 /* do the multiway lock magic */
45252 trap = lock_rename(cache->graveyard, dir);
45253 diff -urNp linux-2.6.32.49/fs/cachefiles/proc.c linux-2.6.32.49/fs/cachefiles/proc.c
45254 --- linux-2.6.32.49/fs/cachefiles/proc.c 2011-11-08 19:02:43.000000000 -0500
45255 +++ linux-2.6.32.49/fs/cachefiles/proc.c 2011-11-15 19:59:43.000000000 -0500
45256 @@ -14,9 +14,9 @@
45257 #include <linux/seq_file.h>
45258 #include "internal.h"
45259
45260 -atomic_t cachefiles_lookup_histogram[HZ];
45261 -atomic_t cachefiles_mkdir_histogram[HZ];
45262 -atomic_t cachefiles_create_histogram[HZ];
45263 +atomic_unchecked_t cachefiles_lookup_histogram[HZ];
45264 +atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
45265 +atomic_unchecked_t cachefiles_create_histogram[HZ];
45266
45267 /*
45268 * display the latency histogram
45269 @@ -35,9 +35,9 @@ static int cachefiles_histogram_show(str
45270 return 0;
45271 default:
45272 index = (unsigned long) v - 3;
45273 - x = atomic_read(&cachefiles_lookup_histogram[index]);
45274 - y = atomic_read(&cachefiles_mkdir_histogram[index]);
45275 - z = atomic_read(&cachefiles_create_histogram[index]);
45276 + x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
45277 + y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
45278 + z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
45279 if (x == 0 && y == 0 && z == 0)
45280 return 0;
45281
45282 diff -urNp linux-2.6.32.49/fs/cachefiles/rdwr.c linux-2.6.32.49/fs/cachefiles/rdwr.c
45283 --- linux-2.6.32.49/fs/cachefiles/rdwr.c 2011-11-08 19:02:43.000000000 -0500
45284 +++ linux-2.6.32.49/fs/cachefiles/rdwr.c 2011-11-15 19:59:43.000000000 -0500
45285 @@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache
45286 old_fs = get_fs();
45287 set_fs(KERNEL_DS);
45288 ret = file->f_op->write(
45289 - file, (const void __user *) data, len, &pos);
45290 + file, (const void __force_user *) data, len, &pos);
45291 set_fs(old_fs);
45292 kunmap(page);
45293 if (ret != len)
45294 diff -urNp linux-2.6.32.49/fs/cifs/cifs_debug.c linux-2.6.32.49/fs/cifs/cifs_debug.c
45295 --- linux-2.6.32.49/fs/cifs/cifs_debug.c 2011-11-08 19:02:43.000000000 -0500
45296 +++ linux-2.6.32.49/fs/cifs/cifs_debug.c 2011-11-15 19:59:43.000000000 -0500
45297 @@ -256,25 +256,25 @@ static ssize_t cifs_stats_proc_write(str
45298 tcon = list_entry(tmp3,
45299 struct cifsTconInfo,
45300 tcon_list);
45301 - atomic_set(&tcon->num_smbs_sent, 0);
45302 - atomic_set(&tcon->num_writes, 0);
45303 - atomic_set(&tcon->num_reads, 0);
45304 - atomic_set(&tcon->num_oplock_brks, 0);
45305 - atomic_set(&tcon->num_opens, 0);
45306 - atomic_set(&tcon->num_posixopens, 0);
45307 - atomic_set(&tcon->num_posixmkdirs, 0);
45308 - atomic_set(&tcon->num_closes, 0);
45309 - atomic_set(&tcon->num_deletes, 0);
45310 - atomic_set(&tcon->num_mkdirs, 0);
45311 - atomic_set(&tcon->num_rmdirs, 0);
45312 - atomic_set(&tcon->num_renames, 0);
45313 - atomic_set(&tcon->num_t2renames, 0);
45314 - atomic_set(&tcon->num_ffirst, 0);
45315 - atomic_set(&tcon->num_fnext, 0);
45316 - atomic_set(&tcon->num_fclose, 0);
45317 - atomic_set(&tcon->num_hardlinks, 0);
45318 - atomic_set(&tcon->num_symlinks, 0);
45319 - atomic_set(&tcon->num_locks, 0);
45320 + atomic_set_unchecked(&tcon->num_smbs_sent, 0);
45321 + atomic_set_unchecked(&tcon->num_writes, 0);
45322 + atomic_set_unchecked(&tcon->num_reads, 0);
45323 + atomic_set_unchecked(&tcon->num_oplock_brks, 0);
45324 + atomic_set_unchecked(&tcon->num_opens, 0);
45325 + atomic_set_unchecked(&tcon->num_posixopens, 0);
45326 + atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
45327 + atomic_set_unchecked(&tcon->num_closes, 0);
45328 + atomic_set_unchecked(&tcon->num_deletes, 0);
45329 + atomic_set_unchecked(&tcon->num_mkdirs, 0);
45330 + atomic_set_unchecked(&tcon->num_rmdirs, 0);
45331 + atomic_set_unchecked(&tcon->num_renames, 0);
45332 + atomic_set_unchecked(&tcon->num_t2renames, 0);
45333 + atomic_set_unchecked(&tcon->num_ffirst, 0);
45334 + atomic_set_unchecked(&tcon->num_fnext, 0);
45335 + atomic_set_unchecked(&tcon->num_fclose, 0);
45336 + atomic_set_unchecked(&tcon->num_hardlinks, 0);
45337 + atomic_set_unchecked(&tcon->num_symlinks, 0);
45338 + atomic_set_unchecked(&tcon->num_locks, 0);
45339 }
45340 }
45341 }
45342 @@ -334,41 +334,41 @@ static int cifs_stats_proc_show(struct s
45343 if (tcon->need_reconnect)
45344 seq_puts(m, "\tDISCONNECTED ");
45345 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
45346 - atomic_read(&tcon->num_smbs_sent),
45347 - atomic_read(&tcon->num_oplock_brks));
45348 + atomic_read_unchecked(&tcon->num_smbs_sent),
45349 + atomic_read_unchecked(&tcon->num_oplock_brks));
45350 seq_printf(m, "\nReads: %d Bytes: %lld",
45351 - atomic_read(&tcon->num_reads),
45352 + atomic_read_unchecked(&tcon->num_reads),
45353 (long long)(tcon->bytes_read));
45354 seq_printf(m, "\nWrites: %d Bytes: %lld",
45355 - atomic_read(&tcon->num_writes),
45356 + atomic_read_unchecked(&tcon->num_writes),
45357 (long long)(tcon->bytes_written));
45358 seq_printf(m, "\nFlushes: %d",
45359 - atomic_read(&tcon->num_flushes));
45360 + atomic_read_unchecked(&tcon->num_flushes));
45361 seq_printf(m, "\nLocks: %d HardLinks: %d "
45362 "Symlinks: %d",
45363 - atomic_read(&tcon->num_locks),
45364 - atomic_read(&tcon->num_hardlinks),
45365 - atomic_read(&tcon->num_symlinks));
45366 + atomic_read_unchecked(&tcon->num_locks),
45367 + atomic_read_unchecked(&tcon->num_hardlinks),
45368 + atomic_read_unchecked(&tcon->num_symlinks));
45369 seq_printf(m, "\nOpens: %d Closes: %d "
45370 "Deletes: %d",
45371 - atomic_read(&tcon->num_opens),
45372 - atomic_read(&tcon->num_closes),
45373 - atomic_read(&tcon->num_deletes));
45374 + atomic_read_unchecked(&tcon->num_opens),
45375 + atomic_read_unchecked(&tcon->num_closes),
45376 + atomic_read_unchecked(&tcon->num_deletes));
45377 seq_printf(m, "\nPosix Opens: %d "
45378 "Posix Mkdirs: %d",
45379 - atomic_read(&tcon->num_posixopens),
45380 - atomic_read(&tcon->num_posixmkdirs));
45381 + atomic_read_unchecked(&tcon->num_posixopens),
45382 + atomic_read_unchecked(&tcon->num_posixmkdirs));
45383 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
45384 - atomic_read(&tcon->num_mkdirs),
45385 - atomic_read(&tcon->num_rmdirs));
45386 + atomic_read_unchecked(&tcon->num_mkdirs),
45387 + atomic_read_unchecked(&tcon->num_rmdirs));
45388 seq_printf(m, "\nRenames: %d T2 Renames %d",
45389 - atomic_read(&tcon->num_renames),
45390 - atomic_read(&tcon->num_t2renames));
45391 + atomic_read_unchecked(&tcon->num_renames),
45392 + atomic_read_unchecked(&tcon->num_t2renames));
45393 seq_printf(m, "\nFindFirst: %d FNext %d "
45394 "FClose %d",
45395 - atomic_read(&tcon->num_ffirst),
45396 - atomic_read(&tcon->num_fnext),
45397 - atomic_read(&tcon->num_fclose));
45398 + atomic_read_unchecked(&tcon->num_ffirst),
45399 + atomic_read_unchecked(&tcon->num_fnext),
45400 + atomic_read_unchecked(&tcon->num_fclose));
45401 }
45402 }
45403 }
45404 diff -urNp linux-2.6.32.49/fs/cifs/cifsfs.c linux-2.6.32.49/fs/cifs/cifsfs.c
45405 --- linux-2.6.32.49/fs/cifs/cifsfs.c 2011-11-08 19:02:43.000000000 -0500
45406 +++ linux-2.6.32.49/fs/cifs/cifsfs.c 2011-11-15 19:59:43.000000000 -0500
45407 @@ -869,7 +869,7 @@ cifs_init_request_bufs(void)
45408 cifs_req_cachep = kmem_cache_create("cifs_request",
45409 CIFSMaxBufSize +
45410 MAX_CIFS_HDR_SIZE, 0,
45411 - SLAB_HWCACHE_ALIGN, NULL);
45412 + SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL);
45413 if (cifs_req_cachep == NULL)
45414 return -ENOMEM;
45415
45416 @@ -896,7 +896,7 @@ cifs_init_request_bufs(void)
45417 efficient to alloc 1 per page off the slab compared to 17K (5page)
45418 alloc of large cifs buffers even when page debugging is on */
45419 cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
45420 - MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
45421 + MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY,
45422 NULL);
45423 if (cifs_sm_req_cachep == NULL) {
45424 mempool_destroy(cifs_req_poolp);
45425 @@ -991,8 +991,8 @@ init_cifs(void)
45426 atomic_set(&bufAllocCount, 0);
45427 atomic_set(&smBufAllocCount, 0);
45428 #ifdef CONFIG_CIFS_STATS2
45429 - atomic_set(&totBufAllocCount, 0);
45430 - atomic_set(&totSmBufAllocCount, 0);
45431 + atomic_set_unchecked(&totBufAllocCount, 0);
45432 + atomic_set_unchecked(&totSmBufAllocCount, 0);
45433 #endif /* CONFIG_CIFS_STATS2 */
45434
45435 atomic_set(&midCount, 0);
45436 diff -urNp linux-2.6.32.49/fs/cifs/cifsglob.h linux-2.6.32.49/fs/cifs/cifsglob.h
45437 --- linux-2.6.32.49/fs/cifs/cifsglob.h 2011-11-08 19:02:43.000000000 -0500
45438 +++ linux-2.6.32.49/fs/cifs/cifsglob.h 2011-11-15 19:59:43.000000000 -0500
45439 @@ -252,28 +252,28 @@ struct cifsTconInfo {
45440 __u16 Flags; /* optional support bits */
45441 enum statusEnum tidStatus;
45442 #ifdef CONFIG_CIFS_STATS
45443 - atomic_t num_smbs_sent;
45444 - atomic_t num_writes;
45445 - atomic_t num_reads;
45446 - atomic_t num_flushes;
45447 - atomic_t num_oplock_brks;
45448 - atomic_t num_opens;
45449 - atomic_t num_closes;
45450 - atomic_t num_deletes;
45451 - atomic_t num_mkdirs;
45452 - atomic_t num_posixopens;
45453 - atomic_t num_posixmkdirs;
45454 - atomic_t num_rmdirs;
45455 - atomic_t num_renames;
45456 - atomic_t num_t2renames;
45457 - atomic_t num_ffirst;
45458 - atomic_t num_fnext;
45459 - atomic_t num_fclose;
45460 - atomic_t num_hardlinks;
45461 - atomic_t num_symlinks;
45462 - atomic_t num_locks;
45463 - atomic_t num_acl_get;
45464 - atomic_t num_acl_set;
45465 + atomic_unchecked_t num_smbs_sent;
45466 + atomic_unchecked_t num_writes;
45467 + atomic_unchecked_t num_reads;
45468 + atomic_unchecked_t num_flushes;
45469 + atomic_unchecked_t num_oplock_brks;
45470 + atomic_unchecked_t num_opens;
45471 + atomic_unchecked_t num_closes;
45472 + atomic_unchecked_t num_deletes;
45473 + atomic_unchecked_t num_mkdirs;
45474 + atomic_unchecked_t num_posixopens;
45475 + atomic_unchecked_t num_posixmkdirs;
45476 + atomic_unchecked_t num_rmdirs;
45477 + atomic_unchecked_t num_renames;
45478 + atomic_unchecked_t num_t2renames;
45479 + atomic_unchecked_t num_ffirst;
45480 + atomic_unchecked_t num_fnext;
45481 + atomic_unchecked_t num_fclose;
45482 + atomic_unchecked_t num_hardlinks;
45483 + atomic_unchecked_t num_symlinks;
45484 + atomic_unchecked_t num_locks;
45485 + atomic_unchecked_t num_acl_get;
45486 + atomic_unchecked_t num_acl_set;
45487 #ifdef CONFIG_CIFS_STATS2
45488 unsigned long long time_writes;
45489 unsigned long long time_reads;
45490 @@ -414,7 +414,7 @@ static inline char CIFS_DIR_SEP(const st
45491 }
45492
45493 #ifdef CONFIG_CIFS_STATS
45494 -#define cifs_stats_inc atomic_inc
45495 +#define cifs_stats_inc atomic_inc_unchecked
45496
45497 static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
45498 unsigned int bytes)
45499 @@ -701,8 +701,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnect
45500 /* Various Debug counters */
45501 GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
45502 #ifdef CONFIG_CIFS_STATS2
45503 -GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
45504 -GLOBAL_EXTERN atomic_t totSmBufAllocCount;
45505 +GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */
45506 +GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount;
45507 #endif
45508 GLOBAL_EXTERN atomic_t smBufAllocCount;
45509 GLOBAL_EXTERN atomic_t midCount;
45510 diff -urNp linux-2.6.32.49/fs/cifs/link.c linux-2.6.32.49/fs/cifs/link.c
45511 --- linux-2.6.32.49/fs/cifs/link.c 2011-11-08 19:02:43.000000000 -0500
45512 +++ linux-2.6.32.49/fs/cifs/link.c 2011-11-15 19:59:43.000000000 -0500
45513 @@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct
45514
45515 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
45516 {
45517 - char *p = nd_get_link(nd);
45518 + const char *p = nd_get_link(nd);
45519 if (!IS_ERR(p))
45520 kfree(p);
45521 }
45522 diff -urNp linux-2.6.32.49/fs/cifs/misc.c linux-2.6.32.49/fs/cifs/misc.c
45523 --- linux-2.6.32.49/fs/cifs/misc.c 2011-11-08 19:02:43.000000000 -0500
45524 +++ linux-2.6.32.49/fs/cifs/misc.c 2011-11-15 19:59:43.000000000 -0500
45525 @@ -155,7 +155,7 @@ cifs_buf_get(void)
45526 memset(ret_buf, 0, sizeof(struct smb_hdr) + 3);
45527 atomic_inc(&bufAllocCount);
45528 #ifdef CONFIG_CIFS_STATS2
45529 - atomic_inc(&totBufAllocCount);
45530 + atomic_inc_unchecked(&totBufAllocCount);
45531 #endif /* CONFIG_CIFS_STATS2 */
45532 }
45533
45534 @@ -190,7 +190,7 @@ cifs_small_buf_get(void)
45535 /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
45536 atomic_inc(&smBufAllocCount);
45537 #ifdef CONFIG_CIFS_STATS2
45538 - atomic_inc(&totSmBufAllocCount);
45539 + atomic_inc_unchecked(&totSmBufAllocCount);
45540 #endif /* CONFIG_CIFS_STATS2 */
45541
45542 }
45543 diff -urNp linux-2.6.32.49/fs/coda/cache.c linux-2.6.32.49/fs/coda/cache.c
45544 --- linux-2.6.32.49/fs/coda/cache.c 2011-11-08 19:02:43.000000000 -0500
45545 +++ linux-2.6.32.49/fs/coda/cache.c 2011-11-15 19:59:43.000000000 -0500
45546 @@ -24,14 +24,14 @@
45547 #include <linux/coda_fs_i.h>
45548 #include <linux/coda_cache.h>
45549
45550 -static atomic_t permission_epoch = ATOMIC_INIT(0);
45551 +static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
45552
45553 /* replace or extend an acl cache hit */
45554 void coda_cache_enter(struct inode *inode, int mask)
45555 {
45556 struct coda_inode_info *cii = ITOC(inode);
45557
45558 - cii->c_cached_epoch = atomic_read(&permission_epoch);
45559 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
45560 if (cii->c_uid != current_fsuid()) {
45561 cii->c_uid = current_fsuid();
45562 cii->c_cached_perm = mask;
45563 @@ -43,13 +43,13 @@ void coda_cache_enter(struct inode *inod
45564 void coda_cache_clear_inode(struct inode *inode)
45565 {
45566 struct coda_inode_info *cii = ITOC(inode);
45567 - cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
45568 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
45569 }
45570
45571 /* remove all acl caches */
45572 void coda_cache_clear_all(struct super_block *sb)
45573 {
45574 - atomic_inc(&permission_epoch);
45575 + atomic_inc_unchecked(&permission_epoch);
45576 }
45577
45578
45579 @@ -61,7 +61,7 @@ int coda_cache_check(struct inode *inode
45580
45581 hit = (mask & cii->c_cached_perm) == mask &&
45582 cii->c_uid == current_fsuid() &&
45583 - cii->c_cached_epoch == atomic_read(&permission_epoch);
45584 + cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
45585
45586 return hit;
45587 }
45588 diff -urNp linux-2.6.32.49/fs/compat_binfmt_elf.c linux-2.6.32.49/fs/compat_binfmt_elf.c
45589 --- linux-2.6.32.49/fs/compat_binfmt_elf.c 2011-11-08 19:02:43.000000000 -0500
45590 +++ linux-2.6.32.49/fs/compat_binfmt_elf.c 2011-11-15 19:59:43.000000000 -0500
45591 @@ -29,10 +29,12 @@
45592 #undef elfhdr
45593 #undef elf_phdr
45594 #undef elf_note
45595 +#undef elf_dyn
45596 #undef elf_addr_t
45597 #define elfhdr elf32_hdr
45598 #define elf_phdr elf32_phdr
45599 #define elf_note elf32_note
45600 +#define elf_dyn Elf32_Dyn
45601 #define elf_addr_t Elf32_Addr
45602
45603 /*
45604 diff -urNp linux-2.6.32.49/fs/compat.c linux-2.6.32.49/fs/compat.c
45605 --- linux-2.6.32.49/fs/compat.c 2011-11-08 19:02:43.000000000 -0500
45606 +++ linux-2.6.32.49/fs/compat.c 2011-11-15 19:59:43.000000000 -0500
45607 @@ -133,8 +133,8 @@ asmlinkage long compat_sys_utimes(char _
45608 static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
45609 {
45610 compat_ino_t ino = stat->ino;
45611 - typeof(ubuf->st_uid) uid = 0;
45612 - typeof(ubuf->st_gid) gid = 0;
45613 + typeof(((struct compat_stat *)0)->st_uid) uid = 0;
45614 + typeof(((struct compat_stat *)0)->st_gid) gid = 0;
45615 int err;
45616
45617 SET_UID(uid, stat->uid);
45618 @@ -533,7 +533,7 @@ compat_sys_io_setup(unsigned nr_reqs, u3
45619
45620 set_fs(KERNEL_DS);
45621 /* The __user pointer cast is valid because of the set_fs() */
45622 - ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
45623 + ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64);
45624 set_fs(oldfs);
45625 /* truncating is ok because it's a user address */
45626 if (!ret)
45627 @@ -830,6 +830,7 @@ struct compat_old_linux_dirent {
45628
45629 struct compat_readdir_callback {
45630 struct compat_old_linux_dirent __user *dirent;
45631 + struct file * file;
45632 int result;
45633 };
45634
45635 @@ -847,6 +848,10 @@ static int compat_fillonedir(void *__buf
45636 buf->result = -EOVERFLOW;
45637 return -EOVERFLOW;
45638 }
45639 +
45640 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
45641 + return 0;
45642 +
45643 buf->result++;
45644 dirent = buf->dirent;
45645 if (!access_ok(VERIFY_WRITE, dirent,
45646 @@ -879,6 +884,7 @@ asmlinkage long compat_sys_old_readdir(u
45647
45648 buf.result = 0;
45649 buf.dirent = dirent;
45650 + buf.file = file;
45651
45652 error = vfs_readdir(file, compat_fillonedir, &buf);
45653 if (buf.result)
45654 @@ -899,6 +905,7 @@ struct compat_linux_dirent {
45655 struct compat_getdents_callback {
45656 struct compat_linux_dirent __user *current_dir;
45657 struct compat_linux_dirent __user *previous;
45658 + struct file * file;
45659 int count;
45660 int error;
45661 };
45662 @@ -919,6 +926,10 @@ static int compat_filldir(void *__buf, c
45663 buf->error = -EOVERFLOW;
45664 return -EOVERFLOW;
45665 }
45666 +
45667 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
45668 + return 0;
45669 +
45670 dirent = buf->previous;
45671 if (dirent) {
45672 if (__put_user(offset, &dirent->d_off))
45673 @@ -966,6 +977,7 @@ asmlinkage long compat_sys_getdents(unsi
45674 buf.previous = NULL;
45675 buf.count = count;
45676 buf.error = 0;
45677 + buf.file = file;
45678
45679 error = vfs_readdir(file, compat_filldir, &buf);
45680 if (error >= 0)
45681 @@ -987,6 +999,7 @@ out:
45682 struct compat_getdents_callback64 {
45683 struct linux_dirent64 __user *current_dir;
45684 struct linux_dirent64 __user *previous;
45685 + struct file * file;
45686 int count;
45687 int error;
45688 };
45689 @@ -1003,6 +1016,10 @@ static int compat_filldir64(void * __buf
45690 buf->error = -EINVAL; /* only used if we fail.. */
45691 if (reclen > buf->count)
45692 return -EINVAL;
45693 +
45694 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
45695 + return 0;
45696 +
45697 dirent = buf->previous;
45698
45699 if (dirent) {
45700 @@ -1054,13 +1071,14 @@ asmlinkage long compat_sys_getdents64(un
45701 buf.previous = NULL;
45702 buf.count = count;
45703 buf.error = 0;
45704 + buf.file = file;
45705
45706 error = vfs_readdir(file, compat_filldir64, &buf);
45707 if (error >= 0)
45708 error = buf.error;
45709 lastdirent = buf.previous;
45710 if (lastdirent) {
45711 - typeof(lastdirent->d_off) d_off = file->f_pos;
45712 + typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
45713 if (__put_user_unaligned(d_off, &lastdirent->d_off))
45714 error = -EFAULT;
45715 else
45716 @@ -1098,7 +1116,7 @@ static ssize_t compat_do_readv_writev(in
45717 * verify all the pointers
45718 */
45719 ret = -EINVAL;
45720 - if ((nr_segs > UIO_MAXIOV) || (nr_segs <= 0))
45721 + if (nr_segs > UIO_MAXIOV)
45722 goto out;
45723 if (!file->f_op)
45724 goto out;
45725 @@ -1463,11 +1481,35 @@ int compat_do_execve(char * filename,
45726 compat_uptr_t __user *envp,
45727 struct pt_regs * regs)
45728 {
45729 +#ifdef CONFIG_GRKERNSEC
45730 + struct file *old_exec_file;
45731 + struct acl_subject_label *old_acl;
45732 + struct rlimit old_rlim[RLIM_NLIMITS];
45733 +#endif
45734 struct linux_binprm *bprm;
45735 struct file *file;
45736 struct files_struct *displaced;
45737 bool clear_in_exec;
45738 int retval;
45739 + const struct cred *cred = current_cred();
45740 +
45741 + /*
45742 + * We move the actual failure in case of RLIMIT_NPROC excess from
45743 + * set*uid() to execve() because too many poorly written programs
45744 + * don't check setuid() return code. Here we additionally recheck
45745 + * whether NPROC limit is still exceeded.
45746 + */
45747 + gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
45748 +
45749 + if ((current->flags & PF_NPROC_EXCEEDED) &&
45750 + atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
45751 + retval = -EAGAIN;
45752 + goto out_ret;
45753 + }
45754 +
45755 + /* We're below the limit (still or again), so we don't want to make
45756 + * further execve() calls fail. */
45757 + current->flags &= ~PF_NPROC_EXCEEDED;
45758
45759 retval = unshare_files(&displaced);
45760 if (retval)
45761 @@ -1499,6 +1541,15 @@ int compat_do_execve(char * filename,
45762 bprm->filename = filename;
45763 bprm->interp = filename;
45764
45765 + if (gr_process_user_ban()) {
45766 + retval = -EPERM;
45767 + goto out_file;
45768 + }
45769 +
45770 + retval = -EACCES;
45771 + if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
45772 + goto out_file;
45773 +
45774 retval = bprm_mm_init(bprm);
45775 if (retval)
45776 goto out_file;
45777 @@ -1528,9 +1579,40 @@ int compat_do_execve(char * filename,
45778 if (retval < 0)
45779 goto out;
45780
45781 + if (!gr_tpe_allow(file)) {
45782 + retval = -EACCES;
45783 + goto out;
45784 + }
45785 +
45786 + if (gr_check_crash_exec(file)) {
45787 + retval = -EACCES;
45788 + goto out;
45789 + }
45790 +
45791 + gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
45792 +
45793 + gr_handle_exec_args_compat(bprm, argv);
45794 +
45795 +#ifdef CONFIG_GRKERNSEC
45796 + old_acl = current->acl;
45797 + memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
45798 + old_exec_file = current->exec_file;
45799 + get_file(file);
45800 + current->exec_file = file;
45801 +#endif
45802 +
45803 + retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
45804 + bprm->unsafe & LSM_UNSAFE_SHARE);
45805 + if (retval < 0)
45806 + goto out_fail;
45807 +
45808 retval = search_binary_handler(bprm, regs);
45809 if (retval < 0)
45810 - goto out;
45811 + goto out_fail;
45812 +#ifdef CONFIG_GRKERNSEC
45813 + if (old_exec_file)
45814 + fput(old_exec_file);
45815 +#endif
45816
45817 /* execve succeeded */
45818 current->fs->in_exec = 0;
45819 @@ -1541,6 +1623,14 @@ int compat_do_execve(char * filename,
45820 put_files_struct(displaced);
45821 return retval;
45822
45823 +out_fail:
45824 +#ifdef CONFIG_GRKERNSEC
45825 + current->acl = old_acl;
45826 + memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
45827 + fput(current->exec_file);
45828 + current->exec_file = old_exec_file;
45829 +#endif
45830 +
45831 out:
45832 if (bprm->mm) {
45833 acct_arg_size(bprm, 0);
45834 @@ -1711,6 +1801,8 @@ int compat_core_sys_select(int n, compat
45835 struct fdtable *fdt;
45836 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
45837
45838 + pax_track_stack();
45839 +
45840 if (n < 0)
45841 goto out_nofds;
45842
45843 @@ -2151,7 +2243,7 @@ asmlinkage long compat_sys_nfsservctl(in
45844 oldfs = get_fs();
45845 set_fs(KERNEL_DS);
45846 /* The __user pointer casts are valid because of the set_fs() */
45847 - err = sys_nfsservctl(cmd, (void __user *) karg, (void __user *) kres);
45848 + err = sys_nfsservctl(cmd, (void __force_user *) karg, (void __force_user *) kres);
45849 set_fs(oldfs);
45850
45851 if (err)
45852 diff -urNp linux-2.6.32.49/fs/compat_ioctl.c linux-2.6.32.49/fs/compat_ioctl.c
45853 --- linux-2.6.32.49/fs/compat_ioctl.c 2011-11-08 19:02:43.000000000 -0500
45854 +++ linux-2.6.32.49/fs/compat_ioctl.c 2011-11-15 19:59:43.000000000 -0500
45855 @@ -234,6 +234,8 @@ static int do_video_set_spu_palette(unsi
45856 up = (struct compat_video_spu_palette __user *) arg;
45857 err = get_user(palp, &up->palette);
45858 err |= get_user(length, &up->length);
45859 + if (err)
45860 + return -EFAULT;
45861
45862 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
45863 err = put_user(compat_ptr(palp), &up_native->palette);
45864 @@ -1513,7 +1515,7 @@ static int serial_struct_ioctl(unsigned
45865 return -EFAULT;
45866 if (__get_user(udata, &ss32->iomem_base))
45867 return -EFAULT;
45868 - ss.iomem_base = compat_ptr(udata);
45869 + ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata);
45870 if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
45871 __get_user(ss.port_high, &ss32->port_high))
45872 return -EFAULT;
45873 @@ -1809,7 +1811,7 @@ static int compat_ioctl_preallocate(stru
45874 copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) ||
45875 copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) ||
45876 copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) ||
45877 - copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32)))
45878 + copy_in_user(p->l_pad, &p32->l_pad, 4*sizeof(u32)))
45879 return -EFAULT;
45880
45881 return ioctl_preallocate(file, p);
45882 diff -urNp linux-2.6.32.49/fs/configfs/dir.c linux-2.6.32.49/fs/configfs/dir.c
45883 --- linux-2.6.32.49/fs/configfs/dir.c 2011-11-08 19:02:43.000000000 -0500
45884 +++ linux-2.6.32.49/fs/configfs/dir.c 2011-11-15 19:59:43.000000000 -0500
45885 @@ -1572,7 +1572,8 @@ static int configfs_readdir(struct file
45886 }
45887 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
45888 struct configfs_dirent *next;
45889 - const char * name;
45890 + const unsigned char * name;
45891 + char d_name[sizeof(next->s_dentry->d_iname)];
45892 int len;
45893
45894 next = list_entry(p, struct configfs_dirent,
45895 @@ -1581,7 +1582,12 @@ static int configfs_readdir(struct file
45896 continue;
45897
45898 name = configfs_get_name(next);
45899 - len = strlen(name);
45900 + if (next->s_dentry && name == next->s_dentry->d_iname) {
45901 + len = next->s_dentry->d_name.len;
45902 + memcpy(d_name, name, len);
45903 + name = d_name;
45904 + } else
45905 + len = strlen(name);
45906 if (next->s_dentry)
45907 ino = next->s_dentry->d_inode->i_ino;
45908 else
45909 diff -urNp linux-2.6.32.49/fs/dcache.c linux-2.6.32.49/fs/dcache.c
45910 --- linux-2.6.32.49/fs/dcache.c 2011-11-08 19:02:43.000000000 -0500
45911 +++ linux-2.6.32.49/fs/dcache.c 2011-11-15 19:59:43.000000000 -0500
45912 @@ -45,8 +45,6 @@ EXPORT_SYMBOL(dcache_lock);
45913
45914 static struct kmem_cache *dentry_cache __read_mostly;
45915
45916 -#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
45917 -
45918 /*
45919 * This is the single most critical data structure when it comes
45920 * to the dcache: the hashtable for lookups. Somebody should try
45921 @@ -2319,7 +2317,7 @@ void __init vfs_caches_init(unsigned lon
45922 mempages -= reserve;
45923
45924 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
45925 - SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
45926 + SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
45927
45928 dcache_init();
45929 inode_init();
45930 diff -urNp linux-2.6.32.49/fs/dlm/lockspace.c linux-2.6.32.49/fs/dlm/lockspace.c
45931 --- linux-2.6.32.49/fs/dlm/lockspace.c 2011-11-08 19:02:43.000000000 -0500
45932 +++ linux-2.6.32.49/fs/dlm/lockspace.c 2011-11-15 19:59:43.000000000 -0500
45933 @@ -148,7 +148,7 @@ static void lockspace_kobj_release(struc
45934 kfree(ls);
45935 }
45936
45937 -static struct sysfs_ops dlm_attr_ops = {
45938 +static const struct sysfs_ops dlm_attr_ops = {
45939 .show = dlm_attr_show,
45940 .store = dlm_attr_store,
45941 };
45942 diff -urNp linux-2.6.32.49/fs/ecryptfs/inode.c linux-2.6.32.49/fs/ecryptfs/inode.c
45943 --- linux-2.6.32.49/fs/ecryptfs/inode.c 2011-11-08 19:02:43.000000000 -0500
45944 +++ linux-2.6.32.49/fs/ecryptfs/inode.c 2011-11-15 19:59:43.000000000 -0500
45945 @@ -660,7 +660,7 @@ static int ecryptfs_readlink_lower(struc
45946 old_fs = get_fs();
45947 set_fs(get_ds());
45948 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
45949 - (char __user *)lower_buf,
45950 + (char __force_user *)lower_buf,
45951 lower_bufsiz);
45952 set_fs(old_fs);
45953 if (rc < 0)
45954 @@ -706,7 +706,7 @@ static void *ecryptfs_follow_link(struct
45955 }
45956 old_fs = get_fs();
45957 set_fs(get_ds());
45958 - rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
45959 + rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
45960 set_fs(old_fs);
45961 if (rc < 0)
45962 goto out_free;
45963 diff -urNp linux-2.6.32.49/fs/exec.c linux-2.6.32.49/fs/exec.c
45964 --- linux-2.6.32.49/fs/exec.c 2011-11-08 19:02:43.000000000 -0500
45965 +++ linux-2.6.32.49/fs/exec.c 2011-11-18 19:28:23.000000000 -0500
45966 @@ -56,12 +56,24 @@
45967 #include <linux/fsnotify.h>
45968 #include <linux/fs_struct.h>
45969 #include <linux/pipe_fs_i.h>
45970 +#include <linux/random.h>
45971 +#include <linux/seq_file.h>
45972 +
45973 +#ifdef CONFIG_PAX_REFCOUNT
45974 +#include <linux/kallsyms.h>
45975 +#include <linux/kdebug.h>
45976 +#endif
45977
45978 #include <asm/uaccess.h>
45979 #include <asm/mmu_context.h>
45980 #include <asm/tlb.h>
45981 #include "internal.h"
45982
45983 +#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
45984 +void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
45985 +EXPORT_SYMBOL(pax_set_initial_flags_func);
45986 +#endif
45987 +
45988 int core_uses_pid;
45989 char core_pattern[CORENAME_MAX_SIZE] = "core";
45990 unsigned int core_pipe_limit;
45991 @@ -178,18 +190,10 @@ struct page *get_arg_page(struct linux_b
45992 int write)
45993 {
45994 struct page *page;
45995 - int ret;
45996
45997 -#ifdef CONFIG_STACK_GROWSUP
45998 - if (write) {
45999 - ret = expand_stack_downwards(bprm->vma, pos);
46000 - if (ret < 0)
46001 - return NULL;
46002 - }
46003 -#endif
46004 - ret = get_user_pages(current, bprm->mm, pos,
46005 - 1, write, 1, &page, NULL);
46006 - if (ret <= 0)
46007 + if (0 > expand_stack_downwards(bprm->vma, pos))
46008 + return NULL;
46009 + if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
46010 return NULL;
46011
46012 if (write) {
46013 @@ -263,6 +267,11 @@ static int __bprm_mm_init(struct linux_b
46014 vma->vm_end = STACK_TOP_MAX;
46015 vma->vm_start = vma->vm_end - PAGE_SIZE;
46016 vma->vm_flags = VM_STACK_FLAGS;
46017 +
46018 +#ifdef CONFIG_PAX_SEGMEXEC
46019 + vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
46020 +#endif
46021 +
46022 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
46023
46024 err = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
46025 @@ -276,6 +285,12 @@ static int __bprm_mm_init(struct linux_b
46026 mm->stack_vm = mm->total_vm = 1;
46027 up_write(&mm->mmap_sem);
46028 bprm->p = vma->vm_end - sizeof(void *);
46029 +
46030 +#ifdef CONFIG_PAX_RANDUSTACK
46031 + if (randomize_va_space)
46032 + bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
46033 +#endif
46034 +
46035 return 0;
46036 err:
46037 up_write(&mm->mmap_sem);
46038 @@ -510,7 +525,7 @@ int copy_strings_kernel(int argc,char **
46039 int r;
46040 mm_segment_t oldfs = get_fs();
46041 set_fs(KERNEL_DS);
46042 - r = copy_strings(argc, (char __user * __user *)argv, bprm);
46043 + r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
46044 set_fs(oldfs);
46045 return r;
46046 }
46047 @@ -540,7 +555,8 @@ static int shift_arg_pages(struct vm_are
46048 unsigned long new_end = old_end - shift;
46049 struct mmu_gather *tlb;
46050
46051 - BUG_ON(new_start > new_end);
46052 + if (new_start >= new_end || new_start < mmap_min_addr)
46053 + return -ENOMEM;
46054
46055 /*
46056 * ensure there are no vmas between where we want to go
46057 @@ -549,6 +565,10 @@ static int shift_arg_pages(struct vm_are
46058 if (vma != find_vma(mm, new_start))
46059 return -EFAULT;
46060
46061 +#ifdef CONFIG_PAX_SEGMEXEC
46062 + BUG_ON(pax_find_mirror_vma(vma));
46063 +#endif
46064 +
46065 /*
46066 * cover the whole range: [new_start, old_end)
46067 */
46068 @@ -630,10 +650,6 @@ int setup_arg_pages(struct linux_binprm
46069 stack_top = arch_align_stack(stack_top);
46070 stack_top = PAGE_ALIGN(stack_top);
46071
46072 - if (unlikely(stack_top < mmap_min_addr) ||
46073 - unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
46074 - return -ENOMEM;
46075 -
46076 stack_shift = vma->vm_end - stack_top;
46077
46078 bprm->p -= stack_shift;
46079 @@ -645,6 +661,14 @@ int setup_arg_pages(struct linux_binprm
46080 bprm->exec -= stack_shift;
46081
46082 down_write(&mm->mmap_sem);
46083 +
46084 + /* Move stack pages down in memory. */
46085 + if (stack_shift) {
46086 + ret = shift_arg_pages(vma, stack_shift);
46087 + if (ret)
46088 + goto out_unlock;
46089 + }
46090 +
46091 vm_flags = VM_STACK_FLAGS;
46092
46093 /*
46094 @@ -658,19 +682,24 @@ int setup_arg_pages(struct linux_binprm
46095 vm_flags &= ~VM_EXEC;
46096 vm_flags |= mm->def_flags;
46097
46098 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
46099 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
46100 + vm_flags &= ~VM_EXEC;
46101 +
46102 +#ifdef CONFIG_PAX_MPROTECT
46103 + if (mm->pax_flags & MF_PAX_MPROTECT)
46104 + vm_flags &= ~VM_MAYEXEC;
46105 +#endif
46106 +
46107 + }
46108 +#endif
46109 +
46110 ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
46111 vm_flags);
46112 if (ret)
46113 goto out_unlock;
46114 BUG_ON(prev != vma);
46115
46116 - /* Move stack pages down in memory. */
46117 - if (stack_shift) {
46118 - ret = shift_arg_pages(vma, stack_shift);
46119 - if (ret)
46120 - goto out_unlock;
46121 - }
46122 -
46123 stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
46124 stack_size = vma->vm_end - vma->vm_start;
46125 /*
46126 @@ -744,7 +773,7 @@ int kernel_read(struct file *file, loff_
46127 old_fs = get_fs();
46128 set_fs(get_ds());
46129 /* The cast to a user pointer is valid due to the set_fs() */
46130 - result = vfs_read(file, (void __user *)addr, count, &pos);
46131 + result = vfs_read(file, (void __force_user *)addr, count, &pos);
46132 set_fs(old_fs);
46133 return result;
46134 }
46135 @@ -1152,7 +1181,7 @@ int check_unsafe_exec(struct linux_binpr
46136 }
46137 rcu_read_unlock();
46138
46139 - if (p->fs->users > n_fs) {
46140 + if (atomic_read(&p->fs->users) > n_fs) {
46141 bprm->unsafe |= LSM_UNSAFE_SHARE;
46142 } else {
46143 res = -EAGAIN;
46144 @@ -1347,11 +1376,35 @@ int do_execve(char * filename,
46145 char __user *__user *envp,
46146 struct pt_regs * regs)
46147 {
46148 +#ifdef CONFIG_GRKERNSEC
46149 + struct file *old_exec_file;
46150 + struct acl_subject_label *old_acl;
46151 + struct rlimit old_rlim[RLIM_NLIMITS];
46152 +#endif
46153 struct linux_binprm *bprm;
46154 struct file *file;
46155 struct files_struct *displaced;
46156 bool clear_in_exec;
46157 int retval;
46158 + const struct cred *cred = current_cred();
46159 +
46160 + /*
46161 + * We move the actual failure in case of RLIMIT_NPROC excess from
46162 + * set*uid() to execve() because too many poorly written programs
46163 + * don't check setuid() return code. Here we additionally recheck
46164 + * whether NPROC limit is still exceeded.
46165 + */
46166 + gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
46167 +
46168 + if ((current->flags & PF_NPROC_EXCEEDED) &&
46169 + atomic_read(&cred->user->processes) > current->signal->rlim[RLIMIT_NPROC].rlim_cur) {
46170 + retval = -EAGAIN;
46171 + goto out_ret;
46172 + }
46173 +
46174 + /* We're below the limit (still or again), so we don't want to make
46175 + * further execve() calls fail. */
46176 + current->flags &= ~PF_NPROC_EXCEEDED;
46177
46178 retval = unshare_files(&displaced);
46179 if (retval)
46180 @@ -1383,6 +1436,16 @@ int do_execve(char * filename,
46181 bprm->filename = filename;
46182 bprm->interp = filename;
46183
46184 + if (gr_process_user_ban()) {
46185 + retval = -EPERM;
46186 + goto out_file;
46187 + }
46188 +
46189 + if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
46190 + retval = -EACCES;
46191 + goto out_file;
46192 + }
46193 +
46194 retval = bprm_mm_init(bprm);
46195 if (retval)
46196 goto out_file;
46197 @@ -1412,10 +1475,41 @@ int do_execve(char * filename,
46198 if (retval < 0)
46199 goto out;
46200
46201 + if (!gr_tpe_allow(file)) {
46202 + retval = -EACCES;
46203 + goto out;
46204 + }
46205 +
46206 + if (gr_check_crash_exec(file)) {
46207 + retval = -EACCES;
46208 + goto out;
46209 + }
46210 +
46211 + gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
46212 +
46213 + gr_handle_exec_args(bprm, (const char __user *const __user *)argv);
46214 +
46215 +#ifdef CONFIG_GRKERNSEC
46216 + old_acl = current->acl;
46217 + memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
46218 + old_exec_file = current->exec_file;
46219 + get_file(file);
46220 + current->exec_file = file;
46221 +#endif
46222 +
46223 + retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
46224 + bprm->unsafe & LSM_UNSAFE_SHARE);
46225 + if (retval < 0)
46226 + goto out_fail;
46227 +
46228 current->flags &= ~PF_KTHREAD;
46229 retval = search_binary_handler(bprm,regs);
46230 if (retval < 0)
46231 - goto out;
46232 + goto out_fail;
46233 +#ifdef CONFIG_GRKERNSEC
46234 + if (old_exec_file)
46235 + fput(old_exec_file);
46236 +#endif
46237
46238 /* execve succeeded */
46239 current->fs->in_exec = 0;
46240 @@ -1426,6 +1520,14 @@ int do_execve(char * filename,
46241 put_files_struct(displaced);
46242 return retval;
46243
46244 +out_fail:
46245 +#ifdef CONFIG_GRKERNSEC
46246 + current->acl = old_acl;
46247 + memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
46248 + fput(current->exec_file);
46249 + current->exec_file = old_exec_file;
46250 +#endif
46251 +
46252 out:
46253 if (bprm->mm) {
46254 acct_arg_size(bprm, 0);
46255 @@ -1591,6 +1693,220 @@ out:
46256 return ispipe;
46257 }
46258
46259 +int pax_check_flags(unsigned long *flags)
46260 +{
46261 + int retval = 0;
46262 +
46263 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
46264 + if (*flags & MF_PAX_SEGMEXEC)
46265 + {
46266 + *flags &= ~MF_PAX_SEGMEXEC;
46267 + retval = -EINVAL;
46268 + }
46269 +#endif
46270 +
46271 + if ((*flags & MF_PAX_PAGEEXEC)
46272 +
46273 +#ifdef CONFIG_PAX_PAGEEXEC
46274 + && (*flags & MF_PAX_SEGMEXEC)
46275 +#endif
46276 +
46277 + )
46278 + {
46279 + *flags &= ~MF_PAX_PAGEEXEC;
46280 + retval = -EINVAL;
46281 + }
46282 +
46283 + if ((*flags & MF_PAX_MPROTECT)
46284 +
46285 +#ifdef CONFIG_PAX_MPROTECT
46286 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
46287 +#endif
46288 +
46289 + )
46290 + {
46291 + *flags &= ~MF_PAX_MPROTECT;
46292 + retval = -EINVAL;
46293 + }
46294 +
46295 + if ((*flags & MF_PAX_EMUTRAMP)
46296 +
46297 +#ifdef CONFIG_PAX_EMUTRAMP
46298 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
46299 +#endif
46300 +
46301 + )
46302 + {
46303 + *flags &= ~MF_PAX_EMUTRAMP;
46304 + retval = -EINVAL;
46305 + }
46306 +
46307 + return retval;
46308 +}
46309 +
46310 +EXPORT_SYMBOL(pax_check_flags);
46311 +
46312 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
46313 +void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
46314 +{
46315 + struct task_struct *tsk = current;
46316 + struct mm_struct *mm = current->mm;
46317 + char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
46318 + char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
46319 + char *path_exec = NULL;
46320 + char *path_fault = NULL;
46321 + unsigned long start = 0UL, end = 0UL, offset = 0UL;
46322 +
46323 + if (buffer_exec && buffer_fault) {
46324 + struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
46325 +
46326 + down_read(&mm->mmap_sem);
46327 + vma = mm->mmap;
46328 + while (vma && (!vma_exec || !vma_fault)) {
46329 + if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
46330 + vma_exec = vma;
46331 + if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
46332 + vma_fault = vma;
46333 + vma = vma->vm_next;
46334 + }
46335 + if (vma_exec) {
46336 + path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
46337 + if (IS_ERR(path_exec))
46338 + path_exec = "<path too long>";
46339 + else {
46340 + path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
46341 + if (path_exec) {
46342 + *path_exec = 0;
46343 + path_exec = buffer_exec;
46344 + } else
46345 + path_exec = "<path too long>";
46346 + }
46347 + }
46348 + if (vma_fault) {
46349 + start = vma_fault->vm_start;
46350 + end = vma_fault->vm_end;
46351 + offset = vma_fault->vm_pgoff << PAGE_SHIFT;
46352 + if (vma_fault->vm_file) {
46353 + path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
46354 + if (IS_ERR(path_fault))
46355 + path_fault = "<path too long>";
46356 + else {
46357 + path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
46358 + if (path_fault) {
46359 + *path_fault = 0;
46360 + path_fault = buffer_fault;
46361 + } else
46362 + path_fault = "<path too long>";
46363 + }
46364 + } else
46365 + path_fault = "<anonymous mapping>";
46366 + }
46367 + up_read(&mm->mmap_sem);
46368 + }
46369 + if (tsk->signal->curr_ip)
46370 + printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
46371 + else
46372 + printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
46373 + printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
46374 + "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
46375 + task_uid(tsk), task_euid(tsk), pc, sp);
46376 + free_page((unsigned long)buffer_exec);
46377 + free_page((unsigned long)buffer_fault);
46378 + pax_report_insns(regs, pc, sp);
46379 + do_coredump(SIGKILL, SIGKILL, regs);
46380 +}
46381 +#endif
46382 +
46383 +#ifdef CONFIG_PAX_REFCOUNT
46384 +void pax_report_refcount_overflow(struct pt_regs *regs)
46385 +{
46386 + if (current->signal->curr_ip)
46387 + printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
46388 + &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
46389 + else
46390 + printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
46391 + current->comm, task_pid_nr(current), current_uid(), current_euid());
46392 + print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
46393 + show_regs(regs);
46394 + force_sig_specific(SIGKILL, current);
46395 +}
46396 +#endif
46397 +
46398 +#ifdef CONFIG_PAX_USERCOPY
46399 +/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
46400 +int object_is_on_stack(const void *obj, unsigned long len)
46401 +{
46402 + const void * const stack = task_stack_page(current);
46403 + const void * const stackend = stack + THREAD_SIZE;
46404 +
46405 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
46406 + const void *frame = NULL;
46407 + const void *oldframe;
46408 +#endif
46409 +
46410 + if (obj + len < obj)
46411 + return -1;
46412 +
46413 + if (obj + len <= stack || stackend <= obj)
46414 + return 0;
46415 +
46416 + if (obj < stack || stackend < obj + len)
46417 + return -1;
46418 +
46419 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
46420 + oldframe = __builtin_frame_address(1);
46421 + if (oldframe)
46422 + frame = __builtin_frame_address(2);
46423 + /*
46424 + low ----------------------------------------------> high
46425 + [saved bp][saved ip][args][local vars][saved bp][saved ip]
46426 + ^----------------^
46427 + allow copies only within here
46428 + */
46429 + while (stack <= frame && frame < stackend) {
46430 + /* if obj + len extends past the last frame, this
46431 + check won't pass and the next frame will be 0,
46432 + causing us to bail out and correctly report
46433 + the copy as invalid
46434 + */
46435 + if (obj + len <= frame)
46436 + return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
46437 + oldframe = frame;
46438 + frame = *(const void * const *)frame;
46439 + }
46440 + return -1;
46441 +#else
46442 + return 1;
46443 +#endif
46444 +}
46445 +
46446 +
46447 +NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
46448 +{
46449 + if (current->signal->curr_ip)
46450 + printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
46451 + &current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
46452 + else
46453 + printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
46454 + to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
46455 +
46456 + dump_stack();
46457 + gr_handle_kernel_exploit();
46458 + do_group_exit(SIGKILL);
46459 +}
46460 +#endif
46461 +
46462 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
46463 +void pax_track_stack(void)
46464 +{
46465 + unsigned long sp = (unsigned long)&sp;
46466 + if (sp < current_thread_info()->lowest_stack &&
46467 + sp > (unsigned long)task_stack_page(current))
46468 + current_thread_info()->lowest_stack = sp;
46469 +}
46470 +EXPORT_SYMBOL(pax_track_stack);
46471 +#endif
46472 +
46473 static int zap_process(struct task_struct *start)
46474 {
46475 struct task_struct *t;
46476 @@ -1793,17 +2109,17 @@ static void wait_for_dump_helpers(struct
46477 pipe = file->f_path.dentry->d_inode->i_pipe;
46478
46479 pipe_lock(pipe);
46480 - pipe->readers++;
46481 - pipe->writers--;
46482 + atomic_inc(&pipe->readers);
46483 + atomic_dec(&pipe->writers);
46484
46485 - while ((pipe->readers > 1) && (!signal_pending(current))) {
46486 + while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
46487 wake_up_interruptible_sync(&pipe->wait);
46488 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
46489 pipe_wait(pipe);
46490 }
46491
46492 - pipe->readers--;
46493 - pipe->writers++;
46494 + atomic_dec(&pipe->readers);
46495 + atomic_inc(&pipe->writers);
46496 pipe_unlock(pipe);
46497
46498 }
46499 @@ -1826,10 +2142,13 @@ void do_coredump(long signr, int exit_co
46500 char **helper_argv = NULL;
46501 int helper_argc = 0;
46502 int dump_count = 0;
46503 - static atomic_t core_dump_count = ATOMIC_INIT(0);
46504 + static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
46505
46506 audit_core_dumps(signr);
46507
46508 + if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
46509 + gr_handle_brute_attach(current, mm->flags);
46510 +
46511 binfmt = mm->binfmt;
46512 if (!binfmt || !binfmt->core_dump)
46513 goto fail;
46514 @@ -1874,6 +2193,8 @@ void do_coredump(long signr, int exit_co
46515 */
46516 clear_thread_flag(TIF_SIGPENDING);
46517
46518 + gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
46519 +
46520 /*
46521 * lock_kernel() because format_corename() is controlled by sysctl, which
46522 * uses lock_kernel()
46523 @@ -1908,7 +2229,7 @@ void do_coredump(long signr, int exit_co
46524 goto fail_unlock;
46525 }
46526
46527 - dump_count = atomic_inc_return(&core_dump_count);
46528 + dump_count = atomic_inc_return_unchecked(&core_dump_count);
46529 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
46530 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
46531 task_tgid_vnr(current), current->comm);
46532 @@ -1972,7 +2293,7 @@ close_fail:
46533 filp_close(file, NULL);
46534 fail_dropcount:
46535 if (dump_count)
46536 - atomic_dec(&core_dump_count);
46537 + atomic_dec_unchecked(&core_dump_count);
46538 fail_unlock:
46539 if (helper_argv)
46540 argv_free(helper_argv);
46541 diff -urNp linux-2.6.32.49/fs/ext2/balloc.c linux-2.6.32.49/fs/ext2/balloc.c
46542 --- linux-2.6.32.49/fs/ext2/balloc.c 2011-11-08 19:02:43.000000000 -0500
46543 +++ linux-2.6.32.49/fs/ext2/balloc.c 2011-11-15 19:59:43.000000000 -0500
46544 @@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
46545
46546 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
46547 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
46548 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
46549 + if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
46550 sbi->s_resuid != current_fsuid() &&
46551 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
46552 return 0;
46553 diff -urNp linux-2.6.32.49/fs/ext3/balloc.c linux-2.6.32.49/fs/ext3/balloc.c
46554 --- linux-2.6.32.49/fs/ext3/balloc.c 2011-11-08 19:02:43.000000000 -0500
46555 +++ linux-2.6.32.49/fs/ext3/balloc.c 2011-11-15 19:59:43.000000000 -0500
46556 @@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct e
46557
46558 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
46559 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
46560 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
46561 + if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
46562 sbi->s_resuid != current_fsuid() &&
46563 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
46564 return 0;
46565 diff -urNp linux-2.6.32.49/fs/ext4/balloc.c linux-2.6.32.49/fs/ext4/balloc.c
46566 --- linux-2.6.32.49/fs/ext4/balloc.c 2011-11-08 19:02:43.000000000 -0500
46567 +++ linux-2.6.32.49/fs/ext4/balloc.c 2011-11-15 19:59:43.000000000 -0500
46568 @@ -570,7 +570,7 @@ int ext4_has_free_blocks(struct ext4_sb_
46569 /* Hm, nope. Are (enough) root reserved blocks available? */
46570 if (sbi->s_resuid == current_fsuid() ||
46571 ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
46572 - capable(CAP_SYS_RESOURCE)) {
46573 + capable_nolog(CAP_SYS_RESOURCE)) {
46574 if (free_blocks >= (nblocks + dirty_blocks))
46575 return 1;
46576 }
46577 diff -urNp linux-2.6.32.49/fs/ext4/ext4.h linux-2.6.32.49/fs/ext4/ext4.h
46578 --- linux-2.6.32.49/fs/ext4/ext4.h 2011-11-08 19:02:43.000000000 -0500
46579 +++ linux-2.6.32.49/fs/ext4/ext4.h 2011-11-15 19:59:43.000000000 -0500
46580 @@ -1077,19 +1077,19 @@ struct ext4_sb_info {
46581
46582 /* stats for buddy allocator */
46583 spinlock_t s_mb_pa_lock;
46584 - atomic_t s_bal_reqs; /* number of reqs with len > 1 */
46585 - atomic_t s_bal_success; /* we found long enough chunks */
46586 - atomic_t s_bal_allocated; /* in blocks */
46587 - atomic_t s_bal_ex_scanned; /* total extents scanned */
46588 - atomic_t s_bal_goals; /* goal hits */
46589 - atomic_t s_bal_breaks; /* too long searches */
46590 - atomic_t s_bal_2orders; /* 2^order hits */
46591 + atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
46592 + atomic_unchecked_t s_bal_success; /* we found long enough chunks */
46593 + atomic_unchecked_t s_bal_allocated; /* in blocks */
46594 + atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
46595 + atomic_unchecked_t s_bal_goals; /* goal hits */
46596 + atomic_unchecked_t s_bal_breaks; /* too long searches */
46597 + atomic_unchecked_t s_bal_2orders; /* 2^order hits */
46598 spinlock_t s_bal_lock;
46599 unsigned long s_mb_buddies_generated;
46600 unsigned long long s_mb_generation_time;
46601 - atomic_t s_mb_lost_chunks;
46602 - atomic_t s_mb_preallocated;
46603 - atomic_t s_mb_discarded;
46604 + atomic_unchecked_t s_mb_lost_chunks;
46605 + atomic_unchecked_t s_mb_preallocated;
46606 + atomic_unchecked_t s_mb_discarded;
46607 atomic_t s_lock_busy;
46608
46609 /* locality groups */
46610 diff -urNp linux-2.6.32.49/fs/ext4/file.c linux-2.6.32.49/fs/ext4/file.c
46611 --- linux-2.6.32.49/fs/ext4/file.c 2011-11-08 19:02:43.000000000 -0500
46612 +++ linux-2.6.32.49/fs/ext4/file.c 2011-11-15 19:59:43.000000000 -0500
46613 @@ -122,8 +122,8 @@ static int ext4_file_open(struct inode *
46614 cp = d_path(&path, buf, sizeof(buf));
46615 path_put(&path);
46616 if (!IS_ERR(cp)) {
46617 - memcpy(sbi->s_es->s_last_mounted, cp,
46618 - sizeof(sbi->s_es->s_last_mounted));
46619 + strlcpy(sbi->s_es->s_last_mounted, cp,
46620 + sizeof(sbi->s_es->s_last_mounted));
46621 sb->s_dirt = 1;
46622 }
46623 }
46624 diff -urNp linux-2.6.32.49/fs/ext4/mballoc.c linux-2.6.32.49/fs/ext4/mballoc.c
46625 --- linux-2.6.32.49/fs/ext4/mballoc.c 2011-11-08 19:02:43.000000000 -0500
46626 +++ linux-2.6.32.49/fs/ext4/mballoc.c 2011-11-15 19:59:43.000000000 -0500
46627 @@ -1755,7 +1755,7 @@ void ext4_mb_simple_scan_group(struct ex
46628 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
46629
46630 if (EXT4_SB(sb)->s_mb_stats)
46631 - atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
46632 + atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
46633
46634 break;
46635 }
46636 @@ -2131,7 +2131,7 @@ repeat:
46637 ac->ac_status = AC_STATUS_CONTINUE;
46638 ac->ac_flags |= EXT4_MB_HINT_FIRST;
46639 cr = 3;
46640 - atomic_inc(&sbi->s_mb_lost_chunks);
46641 + atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
46642 goto repeat;
46643 }
46644 }
46645 @@ -2174,6 +2174,8 @@ static int ext4_mb_seq_groups_show(struc
46646 ext4_grpblk_t counters[16];
46647 } sg;
46648
46649 + pax_track_stack();
46650 +
46651 group--;
46652 if (group == 0)
46653 seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
46654 @@ -2534,25 +2536,25 @@ int ext4_mb_release(struct super_block *
46655 if (sbi->s_mb_stats) {
46656 printk(KERN_INFO
46657 "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
46658 - atomic_read(&sbi->s_bal_allocated),
46659 - atomic_read(&sbi->s_bal_reqs),
46660 - atomic_read(&sbi->s_bal_success));
46661 + atomic_read_unchecked(&sbi->s_bal_allocated),
46662 + atomic_read_unchecked(&sbi->s_bal_reqs),
46663 + atomic_read_unchecked(&sbi->s_bal_success));
46664 printk(KERN_INFO
46665 "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
46666 "%u 2^N hits, %u breaks, %u lost\n",
46667 - atomic_read(&sbi->s_bal_ex_scanned),
46668 - atomic_read(&sbi->s_bal_goals),
46669 - atomic_read(&sbi->s_bal_2orders),
46670 - atomic_read(&sbi->s_bal_breaks),
46671 - atomic_read(&sbi->s_mb_lost_chunks));
46672 + atomic_read_unchecked(&sbi->s_bal_ex_scanned),
46673 + atomic_read_unchecked(&sbi->s_bal_goals),
46674 + atomic_read_unchecked(&sbi->s_bal_2orders),
46675 + atomic_read_unchecked(&sbi->s_bal_breaks),
46676 + atomic_read_unchecked(&sbi->s_mb_lost_chunks));
46677 printk(KERN_INFO
46678 "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
46679 sbi->s_mb_buddies_generated++,
46680 sbi->s_mb_generation_time);
46681 printk(KERN_INFO
46682 "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
46683 - atomic_read(&sbi->s_mb_preallocated),
46684 - atomic_read(&sbi->s_mb_discarded));
46685 + atomic_read_unchecked(&sbi->s_mb_preallocated),
46686 + atomic_read_unchecked(&sbi->s_mb_discarded));
46687 }
46688
46689 free_percpu(sbi->s_locality_groups);
46690 @@ -3034,16 +3036,16 @@ static void ext4_mb_collect_stats(struct
46691 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
46692
46693 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
46694 - atomic_inc(&sbi->s_bal_reqs);
46695 - atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
46696 + atomic_inc_unchecked(&sbi->s_bal_reqs);
46697 + atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
46698 if (ac->ac_o_ex.fe_len >= ac->ac_g_ex.fe_len)
46699 - atomic_inc(&sbi->s_bal_success);
46700 - atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
46701 + atomic_inc_unchecked(&sbi->s_bal_success);
46702 + atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
46703 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
46704 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
46705 - atomic_inc(&sbi->s_bal_goals);
46706 + atomic_inc_unchecked(&sbi->s_bal_goals);
46707 if (ac->ac_found > sbi->s_mb_max_to_scan)
46708 - atomic_inc(&sbi->s_bal_breaks);
46709 + atomic_inc_unchecked(&sbi->s_bal_breaks);
46710 }
46711
46712 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
46713 @@ -3443,7 +3445,7 @@ ext4_mb_new_inode_pa(struct ext4_allocat
46714 trace_ext4_mb_new_inode_pa(ac, pa);
46715
46716 ext4_mb_use_inode_pa(ac, pa);
46717 - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
46718 + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
46719
46720 ei = EXT4_I(ac->ac_inode);
46721 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
46722 @@ -3503,7 +3505,7 @@ ext4_mb_new_group_pa(struct ext4_allocat
46723 trace_ext4_mb_new_group_pa(ac, pa);
46724
46725 ext4_mb_use_group_pa(ac, pa);
46726 - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
46727 + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
46728
46729 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
46730 lg = ac->ac_lg;
46731 @@ -3607,7 +3609,7 @@ ext4_mb_release_inode_pa(struct ext4_bud
46732 * from the bitmap and continue.
46733 */
46734 }
46735 - atomic_add(free, &sbi->s_mb_discarded);
46736 + atomic_add_unchecked(free, &sbi->s_mb_discarded);
46737
46738 return err;
46739 }
46740 @@ -3626,7 +3628,7 @@ ext4_mb_release_group_pa(struct ext4_bud
46741 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
46742 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
46743 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
46744 - atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
46745 + atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
46746
46747 if (ac) {
46748 ac->ac_sb = sb;
46749 diff -urNp linux-2.6.32.49/fs/ext4/super.c linux-2.6.32.49/fs/ext4/super.c
46750 --- linux-2.6.32.49/fs/ext4/super.c 2011-11-08 19:02:43.000000000 -0500
46751 +++ linux-2.6.32.49/fs/ext4/super.c 2011-11-15 19:59:43.000000000 -0500
46752 @@ -2287,7 +2287,7 @@ static void ext4_sb_release(struct kobje
46753 }
46754
46755
46756 -static struct sysfs_ops ext4_attr_ops = {
46757 +static const struct sysfs_ops ext4_attr_ops = {
46758 .show = ext4_attr_show,
46759 .store = ext4_attr_store,
46760 };
46761 diff -urNp linux-2.6.32.49/fs/fcntl.c linux-2.6.32.49/fs/fcntl.c
46762 --- linux-2.6.32.49/fs/fcntl.c 2011-11-08 19:02:43.000000000 -0500
46763 +++ linux-2.6.32.49/fs/fcntl.c 2011-11-15 19:59:43.000000000 -0500
46764 @@ -223,6 +223,11 @@ int __f_setown(struct file *filp, struct
46765 if (err)
46766 return err;
46767
46768 + if (gr_handle_chroot_fowner(pid, type))
46769 + return -ENOENT;
46770 + if (gr_check_protected_task_fowner(pid, type))
46771 + return -EACCES;
46772 +
46773 f_modown(filp, pid, type, force);
46774 return 0;
46775 }
46776 @@ -265,7 +270,7 @@ pid_t f_getown(struct file *filp)
46777
46778 static int f_setown_ex(struct file *filp, unsigned long arg)
46779 {
46780 - struct f_owner_ex * __user owner_p = (void * __user)arg;
46781 + struct f_owner_ex __user *owner_p = (void __user *)arg;
46782 struct f_owner_ex owner;
46783 struct pid *pid;
46784 int type;
46785 @@ -305,7 +310,7 @@ static int f_setown_ex(struct file *filp
46786
46787 static int f_getown_ex(struct file *filp, unsigned long arg)
46788 {
46789 - struct f_owner_ex * __user owner_p = (void * __user)arg;
46790 + struct f_owner_ex __user *owner_p = (void __user *)arg;
46791 struct f_owner_ex owner;
46792 int ret = 0;
46793
46794 @@ -344,6 +349,7 @@ static long do_fcntl(int fd, unsigned in
46795 switch (cmd) {
46796 case F_DUPFD:
46797 case F_DUPFD_CLOEXEC:
46798 + gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
46799 if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
46800 break;
46801 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
46802 diff -urNp linux-2.6.32.49/fs/fifo.c linux-2.6.32.49/fs/fifo.c
46803 --- linux-2.6.32.49/fs/fifo.c 2011-11-08 19:02:43.000000000 -0500
46804 +++ linux-2.6.32.49/fs/fifo.c 2011-11-15 19:59:43.000000000 -0500
46805 @@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode
46806 */
46807 filp->f_op = &read_pipefifo_fops;
46808 pipe->r_counter++;
46809 - if (pipe->readers++ == 0)
46810 + if (atomic_inc_return(&pipe->readers) == 1)
46811 wake_up_partner(inode);
46812
46813 - if (!pipe->writers) {
46814 + if (!atomic_read(&pipe->writers)) {
46815 if ((filp->f_flags & O_NONBLOCK)) {
46816 /* suppress POLLHUP until we have
46817 * seen a writer */
46818 @@ -83,15 +83,15 @@ static int fifo_open(struct inode *inode
46819 * errno=ENXIO when there is no process reading the FIFO.
46820 */
46821 ret = -ENXIO;
46822 - if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
46823 + if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
46824 goto err;
46825
46826 filp->f_op = &write_pipefifo_fops;
46827 pipe->w_counter++;
46828 - if (!pipe->writers++)
46829 + if (atomic_inc_return(&pipe->writers) == 1)
46830 wake_up_partner(inode);
46831
46832 - if (!pipe->readers) {
46833 + if (!atomic_read(&pipe->readers)) {
46834 wait_for_partner(inode, &pipe->r_counter);
46835 if (signal_pending(current))
46836 goto err_wr;
46837 @@ -107,11 +107,11 @@ static int fifo_open(struct inode *inode
46838 */
46839 filp->f_op = &rdwr_pipefifo_fops;
46840
46841 - pipe->readers++;
46842 - pipe->writers++;
46843 + atomic_inc(&pipe->readers);
46844 + atomic_inc(&pipe->writers);
46845 pipe->r_counter++;
46846 pipe->w_counter++;
46847 - if (pipe->readers == 1 || pipe->writers == 1)
46848 + if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
46849 wake_up_partner(inode);
46850 break;
46851
46852 @@ -125,19 +125,19 @@ static int fifo_open(struct inode *inode
46853 return 0;
46854
46855 err_rd:
46856 - if (!--pipe->readers)
46857 + if (atomic_dec_and_test(&pipe->readers))
46858 wake_up_interruptible(&pipe->wait);
46859 ret = -ERESTARTSYS;
46860 goto err;
46861
46862 err_wr:
46863 - if (!--pipe->writers)
46864 + if (atomic_dec_and_test(&pipe->writers))
46865 wake_up_interruptible(&pipe->wait);
46866 ret = -ERESTARTSYS;
46867 goto err;
46868
46869 err:
46870 - if (!pipe->readers && !pipe->writers)
46871 + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
46872 free_pipe_info(inode);
46873
46874 err_nocleanup:
46875 diff -urNp linux-2.6.32.49/fs/file.c linux-2.6.32.49/fs/file.c
46876 --- linux-2.6.32.49/fs/file.c 2011-11-08 19:02:43.000000000 -0500
46877 +++ linux-2.6.32.49/fs/file.c 2011-11-15 19:59:43.000000000 -0500
46878 @@ -14,6 +14,7 @@
46879 #include <linux/slab.h>
46880 #include <linux/vmalloc.h>
46881 #include <linux/file.h>
46882 +#include <linux/security.h>
46883 #include <linux/fdtable.h>
46884 #include <linux/bitops.h>
46885 #include <linux/interrupt.h>
46886 @@ -257,6 +258,8 @@ int expand_files(struct files_struct *fi
46887 * N.B. For clone tasks sharing a files structure, this test
46888 * will limit the total number of files that can be opened.
46889 */
46890 +
46891 + gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
46892 if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
46893 return -EMFILE;
46894
46895 diff -urNp linux-2.6.32.49/fs/filesystems.c linux-2.6.32.49/fs/filesystems.c
46896 --- linux-2.6.32.49/fs/filesystems.c 2011-11-08 19:02:43.000000000 -0500
46897 +++ linux-2.6.32.49/fs/filesystems.c 2011-11-15 19:59:43.000000000 -0500
46898 @@ -272,7 +272,12 @@ struct file_system_type *get_fs_type(con
46899 int len = dot ? dot - name : strlen(name);
46900
46901 fs = __get_fs_type(name, len);
46902 +
46903 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
46904 + if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
46905 +#else
46906 if (!fs && (request_module("%.*s", len, name) == 0))
46907 +#endif
46908 fs = __get_fs_type(name, len);
46909
46910 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
46911 diff -urNp linux-2.6.32.49/fs/fscache/cookie.c linux-2.6.32.49/fs/fscache/cookie.c
46912 --- linux-2.6.32.49/fs/fscache/cookie.c 2011-11-08 19:02:43.000000000 -0500
46913 +++ linux-2.6.32.49/fs/fscache/cookie.c 2011-11-15 19:59:43.000000000 -0500
46914 @@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire
46915 parent ? (char *) parent->def->name : "<no-parent>",
46916 def->name, netfs_data);
46917
46918 - fscache_stat(&fscache_n_acquires);
46919 + fscache_stat_unchecked(&fscache_n_acquires);
46920
46921 /* if there's no parent cookie, then we don't create one here either */
46922 if (!parent) {
46923 - fscache_stat(&fscache_n_acquires_null);
46924 + fscache_stat_unchecked(&fscache_n_acquires_null);
46925 _leave(" [no parent]");
46926 return NULL;
46927 }
46928 @@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire
46929 /* allocate and initialise a cookie */
46930 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
46931 if (!cookie) {
46932 - fscache_stat(&fscache_n_acquires_oom);
46933 + fscache_stat_unchecked(&fscache_n_acquires_oom);
46934 _leave(" [ENOMEM]");
46935 return NULL;
46936 }
46937 @@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire
46938
46939 switch (cookie->def->type) {
46940 case FSCACHE_COOKIE_TYPE_INDEX:
46941 - fscache_stat(&fscache_n_cookie_index);
46942 + fscache_stat_unchecked(&fscache_n_cookie_index);
46943 break;
46944 case FSCACHE_COOKIE_TYPE_DATAFILE:
46945 - fscache_stat(&fscache_n_cookie_data);
46946 + fscache_stat_unchecked(&fscache_n_cookie_data);
46947 break;
46948 default:
46949 - fscache_stat(&fscache_n_cookie_special);
46950 + fscache_stat_unchecked(&fscache_n_cookie_special);
46951 break;
46952 }
46953
46954 @@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire
46955 if (fscache_acquire_non_index_cookie(cookie) < 0) {
46956 atomic_dec(&parent->n_children);
46957 __fscache_cookie_put(cookie);
46958 - fscache_stat(&fscache_n_acquires_nobufs);
46959 + fscache_stat_unchecked(&fscache_n_acquires_nobufs);
46960 _leave(" = NULL");
46961 return NULL;
46962 }
46963 }
46964
46965 - fscache_stat(&fscache_n_acquires_ok);
46966 + fscache_stat_unchecked(&fscache_n_acquires_ok);
46967 _leave(" = %p", cookie);
46968 return cookie;
46969 }
46970 @@ -168,7 +168,7 @@ static int fscache_acquire_non_index_coo
46971 cache = fscache_select_cache_for_object(cookie->parent);
46972 if (!cache) {
46973 up_read(&fscache_addremove_sem);
46974 - fscache_stat(&fscache_n_acquires_no_cache);
46975 + fscache_stat_unchecked(&fscache_n_acquires_no_cache);
46976 _leave(" = -ENOMEDIUM [no cache]");
46977 return -ENOMEDIUM;
46978 }
46979 @@ -256,12 +256,12 @@ static int fscache_alloc_object(struct f
46980 object = cache->ops->alloc_object(cache, cookie);
46981 fscache_stat_d(&fscache_n_cop_alloc_object);
46982 if (IS_ERR(object)) {
46983 - fscache_stat(&fscache_n_object_no_alloc);
46984 + fscache_stat_unchecked(&fscache_n_object_no_alloc);
46985 ret = PTR_ERR(object);
46986 goto error;
46987 }
46988
46989 - fscache_stat(&fscache_n_object_alloc);
46990 + fscache_stat_unchecked(&fscache_n_object_alloc);
46991
46992 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
46993
46994 @@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fsca
46995 struct fscache_object *object;
46996 struct hlist_node *_p;
46997
46998 - fscache_stat(&fscache_n_updates);
46999 + fscache_stat_unchecked(&fscache_n_updates);
47000
47001 if (!cookie) {
47002 - fscache_stat(&fscache_n_updates_null);
47003 + fscache_stat_unchecked(&fscache_n_updates_null);
47004 _leave(" [no cookie]");
47005 return;
47006 }
47007 @@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct
47008 struct fscache_object *object;
47009 unsigned long event;
47010
47011 - fscache_stat(&fscache_n_relinquishes);
47012 + fscache_stat_unchecked(&fscache_n_relinquishes);
47013 if (retire)
47014 - fscache_stat(&fscache_n_relinquishes_retire);
47015 + fscache_stat_unchecked(&fscache_n_relinquishes_retire);
47016
47017 if (!cookie) {
47018 - fscache_stat(&fscache_n_relinquishes_null);
47019 + fscache_stat_unchecked(&fscache_n_relinquishes_null);
47020 _leave(" [no cookie]");
47021 return;
47022 }
47023 @@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct
47024
47025 /* wait for the cookie to finish being instantiated (or to fail) */
47026 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
47027 - fscache_stat(&fscache_n_relinquishes_waitcrt);
47028 + fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
47029 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
47030 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
47031 }
47032 diff -urNp linux-2.6.32.49/fs/fscache/internal.h linux-2.6.32.49/fs/fscache/internal.h
47033 --- linux-2.6.32.49/fs/fscache/internal.h 2011-11-08 19:02:43.000000000 -0500
47034 +++ linux-2.6.32.49/fs/fscache/internal.h 2011-11-15 19:59:43.000000000 -0500
47035 @@ -136,94 +136,94 @@ extern void fscache_proc_cleanup(void);
47036 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
47037 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
47038
47039 -extern atomic_t fscache_n_op_pend;
47040 -extern atomic_t fscache_n_op_run;
47041 -extern atomic_t fscache_n_op_enqueue;
47042 -extern atomic_t fscache_n_op_deferred_release;
47043 -extern atomic_t fscache_n_op_release;
47044 -extern atomic_t fscache_n_op_gc;
47045 -extern atomic_t fscache_n_op_cancelled;
47046 -extern atomic_t fscache_n_op_rejected;
47047 -
47048 -extern atomic_t fscache_n_attr_changed;
47049 -extern atomic_t fscache_n_attr_changed_ok;
47050 -extern atomic_t fscache_n_attr_changed_nobufs;
47051 -extern atomic_t fscache_n_attr_changed_nomem;
47052 -extern atomic_t fscache_n_attr_changed_calls;
47053 -
47054 -extern atomic_t fscache_n_allocs;
47055 -extern atomic_t fscache_n_allocs_ok;
47056 -extern atomic_t fscache_n_allocs_wait;
47057 -extern atomic_t fscache_n_allocs_nobufs;
47058 -extern atomic_t fscache_n_allocs_intr;
47059 -extern atomic_t fscache_n_allocs_object_dead;
47060 -extern atomic_t fscache_n_alloc_ops;
47061 -extern atomic_t fscache_n_alloc_op_waits;
47062 -
47063 -extern atomic_t fscache_n_retrievals;
47064 -extern atomic_t fscache_n_retrievals_ok;
47065 -extern atomic_t fscache_n_retrievals_wait;
47066 -extern atomic_t fscache_n_retrievals_nodata;
47067 -extern atomic_t fscache_n_retrievals_nobufs;
47068 -extern atomic_t fscache_n_retrievals_intr;
47069 -extern atomic_t fscache_n_retrievals_nomem;
47070 -extern atomic_t fscache_n_retrievals_object_dead;
47071 -extern atomic_t fscache_n_retrieval_ops;
47072 -extern atomic_t fscache_n_retrieval_op_waits;
47073 -
47074 -extern atomic_t fscache_n_stores;
47075 -extern atomic_t fscache_n_stores_ok;
47076 -extern atomic_t fscache_n_stores_again;
47077 -extern atomic_t fscache_n_stores_nobufs;
47078 -extern atomic_t fscache_n_stores_oom;
47079 -extern atomic_t fscache_n_store_ops;
47080 -extern atomic_t fscache_n_store_calls;
47081 -extern atomic_t fscache_n_store_pages;
47082 -extern atomic_t fscache_n_store_radix_deletes;
47083 -extern atomic_t fscache_n_store_pages_over_limit;
47084 -
47085 -extern atomic_t fscache_n_store_vmscan_not_storing;
47086 -extern atomic_t fscache_n_store_vmscan_gone;
47087 -extern atomic_t fscache_n_store_vmscan_busy;
47088 -extern atomic_t fscache_n_store_vmscan_cancelled;
47089 -
47090 -extern atomic_t fscache_n_marks;
47091 -extern atomic_t fscache_n_uncaches;
47092 -
47093 -extern atomic_t fscache_n_acquires;
47094 -extern atomic_t fscache_n_acquires_null;
47095 -extern atomic_t fscache_n_acquires_no_cache;
47096 -extern atomic_t fscache_n_acquires_ok;
47097 -extern atomic_t fscache_n_acquires_nobufs;
47098 -extern atomic_t fscache_n_acquires_oom;
47099 -
47100 -extern atomic_t fscache_n_updates;
47101 -extern atomic_t fscache_n_updates_null;
47102 -extern atomic_t fscache_n_updates_run;
47103 -
47104 -extern atomic_t fscache_n_relinquishes;
47105 -extern atomic_t fscache_n_relinquishes_null;
47106 -extern atomic_t fscache_n_relinquishes_waitcrt;
47107 -extern atomic_t fscache_n_relinquishes_retire;
47108 -
47109 -extern atomic_t fscache_n_cookie_index;
47110 -extern atomic_t fscache_n_cookie_data;
47111 -extern atomic_t fscache_n_cookie_special;
47112 -
47113 -extern atomic_t fscache_n_object_alloc;
47114 -extern atomic_t fscache_n_object_no_alloc;
47115 -extern atomic_t fscache_n_object_lookups;
47116 -extern atomic_t fscache_n_object_lookups_negative;
47117 -extern atomic_t fscache_n_object_lookups_positive;
47118 -extern atomic_t fscache_n_object_lookups_timed_out;
47119 -extern atomic_t fscache_n_object_created;
47120 -extern atomic_t fscache_n_object_avail;
47121 -extern atomic_t fscache_n_object_dead;
47122 -
47123 -extern atomic_t fscache_n_checkaux_none;
47124 -extern atomic_t fscache_n_checkaux_okay;
47125 -extern atomic_t fscache_n_checkaux_update;
47126 -extern atomic_t fscache_n_checkaux_obsolete;
47127 +extern atomic_unchecked_t fscache_n_op_pend;
47128 +extern atomic_unchecked_t fscache_n_op_run;
47129 +extern atomic_unchecked_t fscache_n_op_enqueue;
47130 +extern atomic_unchecked_t fscache_n_op_deferred_release;
47131 +extern atomic_unchecked_t fscache_n_op_release;
47132 +extern atomic_unchecked_t fscache_n_op_gc;
47133 +extern atomic_unchecked_t fscache_n_op_cancelled;
47134 +extern atomic_unchecked_t fscache_n_op_rejected;
47135 +
47136 +extern atomic_unchecked_t fscache_n_attr_changed;
47137 +extern atomic_unchecked_t fscache_n_attr_changed_ok;
47138 +extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
47139 +extern atomic_unchecked_t fscache_n_attr_changed_nomem;
47140 +extern atomic_unchecked_t fscache_n_attr_changed_calls;
47141 +
47142 +extern atomic_unchecked_t fscache_n_allocs;
47143 +extern atomic_unchecked_t fscache_n_allocs_ok;
47144 +extern atomic_unchecked_t fscache_n_allocs_wait;
47145 +extern atomic_unchecked_t fscache_n_allocs_nobufs;
47146 +extern atomic_unchecked_t fscache_n_allocs_intr;
47147 +extern atomic_unchecked_t fscache_n_allocs_object_dead;
47148 +extern atomic_unchecked_t fscache_n_alloc_ops;
47149 +extern atomic_unchecked_t fscache_n_alloc_op_waits;
47150 +
47151 +extern atomic_unchecked_t fscache_n_retrievals;
47152 +extern atomic_unchecked_t fscache_n_retrievals_ok;
47153 +extern atomic_unchecked_t fscache_n_retrievals_wait;
47154 +extern atomic_unchecked_t fscache_n_retrievals_nodata;
47155 +extern atomic_unchecked_t fscache_n_retrievals_nobufs;
47156 +extern atomic_unchecked_t fscache_n_retrievals_intr;
47157 +extern atomic_unchecked_t fscache_n_retrievals_nomem;
47158 +extern atomic_unchecked_t fscache_n_retrievals_object_dead;
47159 +extern atomic_unchecked_t fscache_n_retrieval_ops;
47160 +extern atomic_unchecked_t fscache_n_retrieval_op_waits;
47161 +
47162 +extern atomic_unchecked_t fscache_n_stores;
47163 +extern atomic_unchecked_t fscache_n_stores_ok;
47164 +extern atomic_unchecked_t fscache_n_stores_again;
47165 +extern atomic_unchecked_t fscache_n_stores_nobufs;
47166 +extern atomic_unchecked_t fscache_n_stores_oom;
47167 +extern atomic_unchecked_t fscache_n_store_ops;
47168 +extern atomic_unchecked_t fscache_n_store_calls;
47169 +extern atomic_unchecked_t fscache_n_store_pages;
47170 +extern atomic_unchecked_t fscache_n_store_radix_deletes;
47171 +extern atomic_unchecked_t fscache_n_store_pages_over_limit;
47172 +
47173 +extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
47174 +extern atomic_unchecked_t fscache_n_store_vmscan_gone;
47175 +extern atomic_unchecked_t fscache_n_store_vmscan_busy;
47176 +extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
47177 +
47178 +extern atomic_unchecked_t fscache_n_marks;
47179 +extern atomic_unchecked_t fscache_n_uncaches;
47180 +
47181 +extern atomic_unchecked_t fscache_n_acquires;
47182 +extern atomic_unchecked_t fscache_n_acquires_null;
47183 +extern atomic_unchecked_t fscache_n_acquires_no_cache;
47184 +extern atomic_unchecked_t fscache_n_acquires_ok;
47185 +extern atomic_unchecked_t fscache_n_acquires_nobufs;
47186 +extern atomic_unchecked_t fscache_n_acquires_oom;
47187 +
47188 +extern atomic_unchecked_t fscache_n_updates;
47189 +extern atomic_unchecked_t fscache_n_updates_null;
47190 +extern atomic_unchecked_t fscache_n_updates_run;
47191 +
47192 +extern atomic_unchecked_t fscache_n_relinquishes;
47193 +extern atomic_unchecked_t fscache_n_relinquishes_null;
47194 +extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
47195 +extern atomic_unchecked_t fscache_n_relinquishes_retire;
47196 +
47197 +extern atomic_unchecked_t fscache_n_cookie_index;
47198 +extern atomic_unchecked_t fscache_n_cookie_data;
47199 +extern atomic_unchecked_t fscache_n_cookie_special;
47200 +
47201 +extern atomic_unchecked_t fscache_n_object_alloc;
47202 +extern atomic_unchecked_t fscache_n_object_no_alloc;
47203 +extern atomic_unchecked_t fscache_n_object_lookups;
47204 +extern atomic_unchecked_t fscache_n_object_lookups_negative;
47205 +extern atomic_unchecked_t fscache_n_object_lookups_positive;
47206 +extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
47207 +extern atomic_unchecked_t fscache_n_object_created;
47208 +extern atomic_unchecked_t fscache_n_object_avail;
47209 +extern atomic_unchecked_t fscache_n_object_dead;
47210 +
47211 +extern atomic_unchecked_t fscache_n_checkaux_none;
47212 +extern atomic_unchecked_t fscache_n_checkaux_okay;
47213 +extern atomic_unchecked_t fscache_n_checkaux_update;
47214 +extern atomic_unchecked_t fscache_n_checkaux_obsolete;
47215
47216 extern atomic_t fscache_n_cop_alloc_object;
47217 extern atomic_t fscache_n_cop_lookup_object;
47218 @@ -247,6 +247,11 @@ static inline void fscache_stat(atomic_t
47219 atomic_inc(stat);
47220 }
47221
47222 +static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
47223 +{
47224 + atomic_inc_unchecked(stat);
47225 +}
47226 +
47227 static inline void fscache_stat_d(atomic_t *stat)
47228 {
47229 atomic_dec(stat);
47230 @@ -259,6 +264,7 @@ extern const struct file_operations fsca
47231
47232 #define __fscache_stat(stat) (NULL)
47233 #define fscache_stat(stat) do {} while (0)
47234 +#define fscache_stat_unchecked(stat) do {} while (0)
47235 #define fscache_stat_d(stat) do {} while (0)
47236 #endif
47237
47238 diff -urNp linux-2.6.32.49/fs/fscache/object.c linux-2.6.32.49/fs/fscache/object.c
47239 --- linux-2.6.32.49/fs/fscache/object.c 2011-11-08 19:02:43.000000000 -0500
47240 +++ linux-2.6.32.49/fs/fscache/object.c 2011-11-15 19:59:43.000000000 -0500
47241 @@ -144,7 +144,7 @@ static void fscache_object_state_machine
47242 /* update the object metadata on disk */
47243 case FSCACHE_OBJECT_UPDATING:
47244 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
47245 - fscache_stat(&fscache_n_updates_run);
47246 + fscache_stat_unchecked(&fscache_n_updates_run);
47247 fscache_stat(&fscache_n_cop_update_object);
47248 object->cache->ops->update_object(object);
47249 fscache_stat_d(&fscache_n_cop_update_object);
47250 @@ -233,7 +233,7 @@ static void fscache_object_state_machine
47251 spin_lock(&object->lock);
47252 object->state = FSCACHE_OBJECT_DEAD;
47253 spin_unlock(&object->lock);
47254 - fscache_stat(&fscache_n_object_dead);
47255 + fscache_stat_unchecked(&fscache_n_object_dead);
47256 goto terminal_transit;
47257
47258 /* handle the parent cache of this object being withdrawn from
47259 @@ -248,7 +248,7 @@ static void fscache_object_state_machine
47260 spin_lock(&object->lock);
47261 object->state = FSCACHE_OBJECT_DEAD;
47262 spin_unlock(&object->lock);
47263 - fscache_stat(&fscache_n_object_dead);
47264 + fscache_stat_unchecked(&fscache_n_object_dead);
47265 goto terminal_transit;
47266
47267 /* complain about the object being woken up once it is
47268 @@ -492,7 +492,7 @@ static void fscache_lookup_object(struct
47269 parent->cookie->def->name, cookie->def->name,
47270 object->cache->tag->name);
47271
47272 - fscache_stat(&fscache_n_object_lookups);
47273 + fscache_stat_unchecked(&fscache_n_object_lookups);
47274 fscache_stat(&fscache_n_cop_lookup_object);
47275 ret = object->cache->ops->lookup_object(object);
47276 fscache_stat_d(&fscache_n_cop_lookup_object);
47277 @@ -503,7 +503,7 @@ static void fscache_lookup_object(struct
47278 if (ret == -ETIMEDOUT) {
47279 /* probably stuck behind another object, so move this one to
47280 * the back of the queue */
47281 - fscache_stat(&fscache_n_object_lookups_timed_out);
47282 + fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
47283 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
47284 }
47285
47286 @@ -526,7 +526,7 @@ void fscache_object_lookup_negative(stru
47287
47288 spin_lock(&object->lock);
47289 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
47290 - fscache_stat(&fscache_n_object_lookups_negative);
47291 + fscache_stat_unchecked(&fscache_n_object_lookups_negative);
47292
47293 /* transit here to allow write requests to begin stacking up
47294 * and read requests to begin returning ENODATA */
47295 @@ -572,7 +572,7 @@ void fscache_obtained_object(struct fsca
47296 * result, in which case there may be data available */
47297 spin_lock(&object->lock);
47298 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
47299 - fscache_stat(&fscache_n_object_lookups_positive);
47300 + fscache_stat_unchecked(&fscache_n_object_lookups_positive);
47301
47302 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
47303
47304 @@ -586,7 +586,7 @@ void fscache_obtained_object(struct fsca
47305 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
47306 } else {
47307 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
47308 - fscache_stat(&fscache_n_object_created);
47309 + fscache_stat_unchecked(&fscache_n_object_created);
47310
47311 object->state = FSCACHE_OBJECT_AVAILABLE;
47312 spin_unlock(&object->lock);
47313 @@ -633,7 +633,7 @@ static void fscache_object_available(str
47314 fscache_enqueue_dependents(object);
47315
47316 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
47317 - fscache_stat(&fscache_n_object_avail);
47318 + fscache_stat_unchecked(&fscache_n_object_avail);
47319
47320 _leave("");
47321 }
47322 @@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(
47323 enum fscache_checkaux result;
47324
47325 if (!object->cookie->def->check_aux) {
47326 - fscache_stat(&fscache_n_checkaux_none);
47327 + fscache_stat_unchecked(&fscache_n_checkaux_none);
47328 return FSCACHE_CHECKAUX_OKAY;
47329 }
47330
47331 @@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(
47332 switch (result) {
47333 /* entry okay as is */
47334 case FSCACHE_CHECKAUX_OKAY:
47335 - fscache_stat(&fscache_n_checkaux_okay);
47336 + fscache_stat_unchecked(&fscache_n_checkaux_okay);
47337 break;
47338
47339 /* entry requires update */
47340 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
47341 - fscache_stat(&fscache_n_checkaux_update);
47342 + fscache_stat_unchecked(&fscache_n_checkaux_update);
47343 break;
47344
47345 /* entry requires deletion */
47346 case FSCACHE_CHECKAUX_OBSOLETE:
47347 - fscache_stat(&fscache_n_checkaux_obsolete);
47348 + fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
47349 break;
47350
47351 default:
47352 diff -urNp linux-2.6.32.49/fs/fscache/operation.c linux-2.6.32.49/fs/fscache/operation.c
47353 --- linux-2.6.32.49/fs/fscache/operation.c 2011-11-08 19:02:43.000000000 -0500
47354 +++ linux-2.6.32.49/fs/fscache/operation.c 2011-11-15 19:59:43.000000000 -0500
47355 @@ -16,7 +16,7 @@
47356 #include <linux/seq_file.h>
47357 #include "internal.h"
47358
47359 -atomic_t fscache_op_debug_id;
47360 +atomic_unchecked_t fscache_op_debug_id;
47361 EXPORT_SYMBOL(fscache_op_debug_id);
47362
47363 /**
47364 @@ -39,7 +39,7 @@ void fscache_enqueue_operation(struct fs
47365 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
47366 ASSERTCMP(atomic_read(&op->usage), >, 0);
47367
47368 - fscache_stat(&fscache_n_op_enqueue);
47369 + fscache_stat_unchecked(&fscache_n_op_enqueue);
47370 switch (op->flags & FSCACHE_OP_TYPE) {
47371 case FSCACHE_OP_FAST:
47372 _debug("queue fast");
47373 @@ -76,7 +76,7 @@ static void fscache_run_op(struct fscach
47374 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
47375 if (op->processor)
47376 fscache_enqueue_operation(op);
47377 - fscache_stat(&fscache_n_op_run);
47378 + fscache_stat_unchecked(&fscache_n_op_run);
47379 }
47380
47381 /*
47382 @@ -107,11 +107,11 @@ int fscache_submit_exclusive_op(struct f
47383 if (object->n_ops > 0) {
47384 atomic_inc(&op->usage);
47385 list_add_tail(&op->pend_link, &object->pending_ops);
47386 - fscache_stat(&fscache_n_op_pend);
47387 + fscache_stat_unchecked(&fscache_n_op_pend);
47388 } else if (!list_empty(&object->pending_ops)) {
47389 atomic_inc(&op->usage);
47390 list_add_tail(&op->pend_link, &object->pending_ops);
47391 - fscache_stat(&fscache_n_op_pend);
47392 + fscache_stat_unchecked(&fscache_n_op_pend);
47393 fscache_start_operations(object);
47394 } else {
47395 ASSERTCMP(object->n_in_progress, ==, 0);
47396 @@ -127,7 +127,7 @@ int fscache_submit_exclusive_op(struct f
47397 object->n_exclusive++; /* reads and writes must wait */
47398 atomic_inc(&op->usage);
47399 list_add_tail(&op->pend_link, &object->pending_ops);
47400 - fscache_stat(&fscache_n_op_pend);
47401 + fscache_stat_unchecked(&fscache_n_op_pend);
47402 ret = 0;
47403 } else {
47404 /* not allowed to submit ops in any other state */
47405 @@ -214,11 +214,11 @@ int fscache_submit_op(struct fscache_obj
47406 if (object->n_exclusive > 0) {
47407 atomic_inc(&op->usage);
47408 list_add_tail(&op->pend_link, &object->pending_ops);
47409 - fscache_stat(&fscache_n_op_pend);
47410 + fscache_stat_unchecked(&fscache_n_op_pend);
47411 } else if (!list_empty(&object->pending_ops)) {
47412 atomic_inc(&op->usage);
47413 list_add_tail(&op->pend_link, &object->pending_ops);
47414 - fscache_stat(&fscache_n_op_pend);
47415 + fscache_stat_unchecked(&fscache_n_op_pend);
47416 fscache_start_operations(object);
47417 } else {
47418 ASSERTCMP(object->n_exclusive, ==, 0);
47419 @@ -230,12 +230,12 @@ int fscache_submit_op(struct fscache_obj
47420 object->n_ops++;
47421 atomic_inc(&op->usage);
47422 list_add_tail(&op->pend_link, &object->pending_ops);
47423 - fscache_stat(&fscache_n_op_pend);
47424 + fscache_stat_unchecked(&fscache_n_op_pend);
47425 ret = 0;
47426 } else if (object->state == FSCACHE_OBJECT_DYING ||
47427 object->state == FSCACHE_OBJECT_LC_DYING ||
47428 object->state == FSCACHE_OBJECT_WITHDRAWING) {
47429 - fscache_stat(&fscache_n_op_rejected);
47430 + fscache_stat_unchecked(&fscache_n_op_rejected);
47431 ret = -ENOBUFS;
47432 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
47433 fscache_report_unexpected_submission(object, op, ostate);
47434 @@ -305,7 +305,7 @@ int fscache_cancel_op(struct fscache_ope
47435
47436 ret = -EBUSY;
47437 if (!list_empty(&op->pend_link)) {
47438 - fscache_stat(&fscache_n_op_cancelled);
47439 + fscache_stat_unchecked(&fscache_n_op_cancelled);
47440 list_del_init(&op->pend_link);
47441 object->n_ops--;
47442 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
47443 @@ -344,7 +344,7 @@ void fscache_put_operation(struct fscach
47444 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
47445 BUG();
47446
47447 - fscache_stat(&fscache_n_op_release);
47448 + fscache_stat_unchecked(&fscache_n_op_release);
47449
47450 if (op->release) {
47451 op->release(op);
47452 @@ -361,7 +361,7 @@ void fscache_put_operation(struct fscach
47453 * lock, and defer it otherwise */
47454 if (!spin_trylock(&object->lock)) {
47455 _debug("defer put");
47456 - fscache_stat(&fscache_n_op_deferred_release);
47457 + fscache_stat_unchecked(&fscache_n_op_deferred_release);
47458
47459 cache = object->cache;
47460 spin_lock(&cache->op_gc_list_lock);
47461 @@ -423,7 +423,7 @@ void fscache_operation_gc(struct work_st
47462
47463 _debug("GC DEFERRED REL OBJ%x OP%x",
47464 object->debug_id, op->debug_id);
47465 - fscache_stat(&fscache_n_op_gc);
47466 + fscache_stat_unchecked(&fscache_n_op_gc);
47467
47468 ASSERTCMP(atomic_read(&op->usage), ==, 0);
47469
47470 diff -urNp linux-2.6.32.49/fs/fscache/page.c linux-2.6.32.49/fs/fscache/page.c
47471 --- linux-2.6.32.49/fs/fscache/page.c 2011-11-08 19:02:43.000000000 -0500
47472 +++ linux-2.6.32.49/fs/fscache/page.c 2011-11-15 19:59:43.000000000 -0500
47473 @@ -59,7 +59,7 @@ bool __fscache_maybe_release_page(struct
47474 val = radix_tree_lookup(&cookie->stores, page->index);
47475 if (!val) {
47476 rcu_read_unlock();
47477 - fscache_stat(&fscache_n_store_vmscan_not_storing);
47478 + fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
47479 __fscache_uncache_page(cookie, page);
47480 return true;
47481 }
47482 @@ -89,11 +89,11 @@ bool __fscache_maybe_release_page(struct
47483 spin_unlock(&cookie->stores_lock);
47484
47485 if (xpage) {
47486 - fscache_stat(&fscache_n_store_vmscan_cancelled);
47487 - fscache_stat(&fscache_n_store_radix_deletes);
47488 + fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
47489 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
47490 ASSERTCMP(xpage, ==, page);
47491 } else {
47492 - fscache_stat(&fscache_n_store_vmscan_gone);
47493 + fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
47494 }
47495
47496 wake_up_bit(&cookie->flags, 0);
47497 @@ -106,7 +106,7 @@ page_busy:
47498 /* we might want to wait here, but that could deadlock the allocator as
47499 * the slow-work threads writing to the cache may all end up sleeping
47500 * on memory allocation */
47501 - fscache_stat(&fscache_n_store_vmscan_busy);
47502 + fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
47503 return false;
47504 }
47505 EXPORT_SYMBOL(__fscache_maybe_release_page);
47506 @@ -130,7 +130,7 @@ static void fscache_end_page_write(struc
47507 FSCACHE_COOKIE_STORING_TAG);
47508 if (!radix_tree_tag_get(&cookie->stores, page->index,
47509 FSCACHE_COOKIE_PENDING_TAG)) {
47510 - fscache_stat(&fscache_n_store_radix_deletes);
47511 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
47512 xpage = radix_tree_delete(&cookie->stores, page->index);
47513 }
47514 spin_unlock(&cookie->stores_lock);
47515 @@ -151,7 +151,7 @@ static void fscache_attr_changed_op(stru
47516
47517 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
47518
47519 - fscache_stat(&fscache_n_attr_changed_calls);
47520 + fscache_stat_unchecked(&fscache_n_attr_changed_calls);
47521
47522 if (fscache_object_is_active(object)) {
47523 fscache_set_op_state(op, "CallFS");
47524 @@ -178,11 +178,11 @@ int __fscache_attr_changed(struct fscach
47525
47526 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
47527
47528 - fscache_stat(&fscache_n_attr_changed);
47529 + fscache_stat_unchecked(&fscache_n_attr_changed);
47530
47531 op = kzalloc(sizeof(*op), GFP_KERNEL);
47532 if (!op) {
47533 - fscache_stat(&fscache_n_attr_changed_nomem);
47534 + fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
47535 _leave(" = -ENOMEM");
47536 return -ENOMEM;
47537 }
47538 @@ -202,7 +202,7 @@ int __fscache_attr_changed(struct fscach
47539 if (fscache_submit_exclusive_op(object, op) < 0)
47540 goto nobufs;
47541 spin_unlock(&cookie->lock);
47542 - fscache_stat(&fscache_n_attr_changed_ok);
47543 + fscache_stat_unchecked(&fscache_n_attr_changed_ok);
47544 fscache_put_operation(op);
47545 _leave(" = 0");
47546 return 0;
47547 @@ -210,7 +210,7 @@ int __fscache_attr_changed(struct fscach
47548 nobufs:
47549 spin_unlock(&cookie->lock);
47550 kfree(op);
47551 - fscache_stat(&fscache_n_attr_changed_nobufs);
47552 + fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
47553 _leave(" = %d", -ENOBUFS);
47554 return -ENOBUFS;
47555 }
47556 @@ -264,7 +264,7 @@ static struct fscache_retrieval *fscache
47557 /* allocate a retrieval operation and attempt to submit it */
47558 op = kzalloc(sizeof(*op), GFP_NOIO);
47559 if (!op) {
47560 - fscache_stat(&fscache_n_retrievals_nomem);
47561 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
47562 return NULL;
47563 }
47564
47565 @@ -294,13 +294,13 @@ static int fscache_wait_for_deferred_loo
47566 return 0;
47567 }
47568
47569 - fscache_stat(&fscache_n_retrievals_wait);
47570 + fscache_stat_unchecked(&fscache_n_retrievals_wait);
47571
47572 jif = jiffies;
47573 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
47574 fscache_wait_bit_interruptible,
47575 TASK_INTERRUPTIBLE) != 0) {
47576 - fscache_stat(&fscache_n_retrievals_intr);
47577 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
47578 _leave(" = -ERESTARTSYS");
47579 return -ERESTARTSYS;
47580 }
47581 @@ -318,8 +318,8 @@ static int fscache_wait_for_deferred_loo
47582 */
47583 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
47584 struct fscache_retrieval *op,
47585 - atomic_t *stat_op_waits,
47586 - atomic_t *stat_object_dead)
47587 + atomic_unchecked_t *stat_op_waits,
47588 + atomic_unchecked_t *stat_object_dead)
47589 {
47590 int ret;
47591
47592 @@ -327,7 +327,7 @@ static int fscache_wait_for_retrieval_ac
47593 goto check_if_dead;
47594
47595 _debug(">>> WT");
47596 - fscache_stat(stat_op_waits);
47597 + fscache_stat_unchecked(stat_op_waits);
47598 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
47599 fscache_wait_bit_interruptible,
47600 TASK_INTERRUPTIBLE) < 0) {
47601 @@ -344,7 +344,7 @@ static int fscache_wait_for_retrieval_ac
47602
47603 check_if_dead:
47604 if (unlikely(fscache_object_is_dead(object))) {
47605 - fscache_stat(stat_object_dead);
47606 + fscache_stat_unchecked(stat_object_dead);
47607 return -ENOBUFS;
47608 }
47609 return 0;
47610 @@ -371,7 +371,7 @@ int __fscache_read_or_alloc_page(struct
47611
47612 _enter("%p,%p,,,", cookie, page);
47613
47614 - fscache_stat(&fscache_n_retrievals);
47615 + fscache_stat_unchecked(&fscache_n_retrievals);
47616
47617 if (hlist_empty(&cookie->backing_objects))
47618 goto nobufs;
47619 @@ -405,7 +405,7 @@ int __fscache_read_or_alloc_page(struct
47620 goto nobufs_unlock;
47621 spin_unlock(&cookie->lock);
47622
47623 - fscache_stat(&fscache_n_retrieval_ops);
47624 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
47625
47626 /* pin the netfs read context in case we need to do the actual netfs
47627 * read because we've encountered a cache read failure */
47628 @@ -435,15 +435,15 @@ int __fscache_read_or_alloc_page(struct
47629
47630 error:
47631 if (ret == -ENOMEM)
47632 - fscache_stat(&fscache_n_retrievals_nomem);
47633 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
47634 else if (ret == -ERESTARTSYS)
47635 - fscache_stat(&fscache_n_retrievals_intr);
47636 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
47637 else if (ret == -ENODATA)
47638 - fscache_stat(&fscache_n_retrievals_nodata);
47639 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
47640 else if (ret < 0)
47641 - fscache_stat(&fscache_n_retrievals_nobufs);
47642 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
47643 else
47644 - fscache_stat(&fscache_n_retrievals_ok);
47645 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
47646
47647 fscache_put_retrieval(op);
47648 _leave(" = %d", ret);
47649 @@ -453,7 +453,7 @@ nobufs_unlock:
47650 spin_unlock(&cookie->lock);
47651 kfree(op);
47652 nobufs:
47653 - fscache_stat(&fscache_n_retrievals_nobufs);
47654 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
47655 _leave(" = -ENOBUFS");
47656 return -ENOBUFS;
47657 }
47658 @@ -491,7 +491,7 @@ int __fscache_read_or_alloc_pages(struct
47659
47660 _enter("%p,,%d,,,", cookie, *nr_pages);
47661
47662 - fscache_stat(&fscache_n_retrievals);
47663 + fscache_stat_unchecked(&fscache_n_retrievals);
47664
47665 if (hlist_empty(&cookie->backing_objects))
47666 goto nobufs;
47667 @@ -522,7 +522,7 @@ int __fscache_read_or_alloc_pages(struct
47668 goto nobufs_unlock;
47669 spin_unlock(&cookie->lock);
47670
47671 - fscache_stat(&fscache_n_retrieval_ops);
47672 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
47673
47674 /* pin the netfs read context in case we need to do the actual netfs
47675 * read because we've encountered a cache read failure */
47676 @@ -552,15 +552,15 @@ int __fscache_read_or_alloc_pages(struct
47677
47678 error:
47679 if (ret == -ENOMEM)
47680 - fscache_stat(&fscache_n_retrievals_nomem);
47681 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
47682 else if (ret == -ERESTARTSYS)
47683 - fscache_stat(&fscache_n_retrievals_intr);
47684 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
47685 else if (ret == -ENODATA)
47686 - fscache_stat(&fscache_n_retrievals_nodata);
47687 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
47688 else if (ret < 0)
47689 - fscache_stat(&fscache_n_retrievals_nobufs);
47690 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
47691 else
47692 - fscache_stat(&fscache_n_retrievals_ok);
47693 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
47694
47695 fscache_put_retrieval(op);
47696 _leave(" = %d", ret);
47697 @@ -570,7 +570,7 @@ nobufs_unlock:
47698 spin_unlock(&cookie->lock);
47699 kfree(op);
47700 nobufs:
47701 - fscache_stat(&fscache_n_retrievals_nobufs);
47702 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
47703 _leave(" = -ENOBUFS");
47704 return -ENOBUFS;
47705 }
47706 @@ -594,7 +594,7 @@ int __fscache_alloc_page(struct fscache_
47707
47708 _enter("%p,%p,,,", cookie, page);
47709
47710 - fscache_stat(&fscache_n_allocs);
47711 + fscache_stat_unchecked(&fscache_n_allocs);
47712
47713 if (hlist_empty(&cookie->backing_objects))
47714 goto nobufs;
47715 @@ -621,7 +621,7 @@ int __fscache_alloc_page(struct fscache_
47716 goto nobufs_unlock;
47717 spin_unlock(&cookie->lock);
47718
47719 - fscache_stat(&fscache_n_alloc_ops);
47720 + fscache_stat_unchecked(&fscache_n_alloc_ops);
47721
47722 ret = fscache_wait_for_retrieval_activation(
47723 object, op,
47724 @@ -637,11 +637,11 @@ int __fscache_alloc_page(struct fscache_
47725
47726 error:
47727 if (ret == -ERESTARTSYS)
47728 - fscache_stat(&fscache_n_allocs_intr);
47729 + fscache_stat_unchecked(&fscache_n_allocs_intr);
47730 else if (ret < 0)
47731 - fscache_stat(&fscache_n_allocs_nobufs);
47732 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
47733 else
47734 - fscache_stat(&fscache_n_allocs_ok);
47735 + fscache_stat_unchecked(&fscache_n_allocs_ok);
47736
47737 fscache_put_retrieval(op);
47738 _leave(" = %d", ret);
47739 @@ -651,7 +651,7 @@ nobufs_unlock:
47740 spin_unlock(&cookie->lock);
47741 kfree(op);
47742 nobufs:
47743 - fscache_stat(&fscache_n_allocs_nobufs);
47744 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
47745 _leave(" = -ENOBUFS");
47746 return -ENOBUFS;
47747 }
47748 @@ -694,7 +694,7 @@ static void fscache_write_op(struct fsca
47749
47750 spin_lock(&cookie->stores_lock);
47751
47752 - fscache_stat(&fscache_n_store_calls);
47753 + fscache_stat_unchecked(&fscache_n_store_calls);
47754
47755 /* find a page to store */
47756 page = NULL;
47757 @@ -705,7 +705,7 @@ static void fscache_write_op(struct fsca
47758 page = results[0];
47759 _debug("gang %d [%lx]", n, page->index);
47760 if (page->index > op->store_limit) {
47761 - fscache_stat(&fscache_n_store_pages_over_limit);
47762 + fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
47763 goto superseded;
47764 }
47765
47766 @@ -721,7 +721,7 @@ static void fscache_write_op(struct fsca
47767
47768 if (page) {
47769 fscache_set_op_state(&op->op, "Store");
47770 - fscache_stat(&fscache_n_store_pages);
47771 + fscache_stat_unchecked(&fscache_n_store_pages);
47772 fscache_stat(&fscache_n_cop_write_page);
47773 ret = object->cache->ops->write_page(op, page);
47774 fscache_stat_d(&fscache_n_cop_write_page);
47775 @@ -792,7 +792,7 @@ int __fscache_write_page(struct fscache_
47776 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
47777 ASSERT(PageFsCache(page));
47778
47779 - fscache_stat(&fscache_n_stores);
47780 + fscache_stat_unchecked(&fscache_n_stores);
47781
47782 op = kzalloc(sizeof(*op), GFP_NOIO);
47783 if (!op)
47784 @@ -844,7 +844,7 @@ int __fscache_write_page(struct fscache_
47785 spin_unlock(&cookie->stores_lock);
47786 spin_unlock(&object->lock);
47787
47788 - op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
47789 + op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
47790 op->store_limit = object->store_limit;
47791
47792 if (fscache_submit_op(object, &op->op) < 0)
47793 @@ -852,8 +852,8 @@ int __fscache_write_page(struct fscache_
47794
47795 spin_unlock(&cookie->lock);
47796 radix_tree_preload_end();
47797 - fscache_stat(&fscache_n_store_ops);
47798 - fscache_stat(&fscache_n_stores_ok);
47799 + fscache_stat_unchecked(&fscache_n_store_ops);
47800 + fscache_stat_unchecked(&fscache_n_stores_ok);
47801
47802 /* the slow work queue now carries its own ref on the object */
47803 fscache_put_operation(&op->op);
47804 @@ -861,14 +861,14 @@ int __fscache_write_page(struct fscache_
47805 return 0;
47806
47807 already_queued:
47808 - fscache_stat(&fscache_n_stores_again);
47809 + fscache_stat_unchecked(&fscache_n_stores_again);
47810 already_pending:
47811 spin_unlock(&cookie->stores_lock);
47812 spin_unlock(&object->lock);
47813 spin_unlock(&cookie->lock);
47814 radix_tree_preload_end();
47815 kfree(op);
47816 - fscache_stat(&fscache_n_stores_ok);
47817 + fscache_stat_unchecked(&fscache_n_stores_ok);
47818 _leave(" = 0");
47819 return 0;
47820
47821 @@ -886,14 +886,14 @@ nobufs:
47822 spin_unlock(&cookie->lock);
47823 radix_tree_preload_end();
47824 kfree(op);
47825 - fscache_stat(&fscache_n_stores_nobufs);
47826 + fscache_stat_unchecked(&fscache_n_stores_nobufs);
47827 _leave(" = -ENOBUFS");
47828 return -ENOBUFS;
47829
47830 nomem_free:
47831 kfree(op);
47832 nomem:
47833 - fscache_stat(&fscache_n_stores_oom);
47834 + fscache_stat_unchecked(&fscache_n_stores_oom);
47835 _leave(" = -ENOMEM");
47836 return -ENOMEM;
47837 }
47838 @@ -911,7 +911,7 @@ void __fscache_uncache_page(struct fscac
47839 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
47840 ASSERTCMP(page, !=, NULL);
47841
47842 - fscache_stat(&fscache_n_uncaches);
47843 + fscache_stat_unchecked(&fscache_n_uncaches);
47844
47845 /* cache withdrawal may beat us to it */
47846 if (!PageFsCache(page))
47847 @@ -964,7 +964,7 @@ void fscache_mark_pages_cached(struct fs
47848 unsigned long loop;
47849
47850 #ifdef CONFIG_FSCACHE_STATS
47851 - atomic_add(pagevec->nr, &fscache_n_marks);
47852 + atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
47853 #endif
47854
47855 for (loop = 0; loop < pagevec->nr; loop++) {
47856 diff -urNp linux-2.6.32.49/fs/fscache/stats.c linux-2.6.32.49/fs/fscache/stats.c
47857 --- linux-2.6.32.49/fs/fscache/stats.c 2011-11-08 19:02:43.000000000 -0500
47858 +++ linux-2.6.32.49/fs/fscache/stats.c 2011-11-15 19:59:43.000000000 -0500
47859 @@ -18,95 +18,95 @@
47860 /*
47861 * operation counters
47862 */
47863 -atomic_t fscache_n_op_pend;
47864 -atomic_t fscache_n_op_run;
47865 -atomic_t fscache_n_op_enqueue;
47866 -atomic_t fscache_n_op_requeue;
47867 -atomic_t fscache_n_op_deferred_release;
47868 -atomic_t fscache_n_op_release;
47869 -atomic_t fscache_n_op_gc;
47870 -atomic_t fscache_n_op_cancelled;
47871 -atomic_t fscache_n_op_rejected;
47872 -
47873 -atomic_t fscache_n_attr_changed;
47874 -atomic_t fscache_n_attr_changed_ok;
47875 -atomic_t fscache_n_attr_changed_nobufs;
47876 -atomic_t fscache_n_attr_changed_nomem;
47877 -atomic_t fscache_n_attr_changed_calls;
47878 -
47879 -atomic_t fscache_n_allocs;
47880 -atomic_t fscache_n_allocs_ok;
47881 -atomic_t fscache_n_allocs_wait;
47882 -atomic_t fscache_n_allocs_nobufs;
47883 -atomic_t fscache_n_allocs_intr;
47884 -atomic_t fscache_n_allocs_object_dead;
47885 -atomic_t fscache_n_alloc_ops;
47886 -atomic_t fscache_n_alloc_op_waits;
47887 -
47888 -atomic_t fscache_n_retrievals;
47889 -atomic_t fscache_n_retrievals_ok;
47890 -atomic_t fscache_n_retrievals_wait;
47891 -atomic_t fscache_n_retrievals_nodata;
47892 -atomic_t fscache_n_retrievals_nobufs;
47893 -atomic_t fscache_n_retrievals_intr;
47894 -atomic_t fscache_n_retrievals_nomem;
47895 -atomic_t fscache_n_retrievals_object_dead;
47896 -atomic_t fscache_n_retrieval_ops;
47897 -atomic_t fscache_n_retrieval_op_waits;
47898 -
47899 -atomic_t fscache_n_stores;
47900 -atomic_t fscache_n_stores_ok;
47901 -atomic_t fscache_n_stores_again;
47902 -atomic_t fscache_n_stores_nobufs;
47903 -atomic_t fscache_n_stores_oom;
47904 -atomic_t fscache_n_store_ops;
47905 -atomic_t fscache_n_store_calls;
47906 -atomic_t fscache_n_store_pages;
47907 -atomic_t fscache_n_store_radix_deletes;
47908 -atomic_t fscache_n_store_pages_over_limit;
47909 -
47910 -atomic_t fscache_n_store_vmscan_not_storing;
47911 -atomic_t fscache_n_store_vmscan_gone;
47912 -atomic_t fscache_n_store_vmscan_busy;
47913 -atomic_t fscache_n_store_vmscan_cancelled;
47914 -
47915 -atomic_t fscache_n_marks;
47916 -atomic_t fscache_n_uncaches;
47917 -
47918 -atomic_t fscache_n_acquires;
47919 -atomic_t fscache_n_acquires_null;
47920 -atomic_t fscache_n_acquires_no_cache;
47921 -atomic_t fscache_n_acquires_ok;
47922 -atomic_t fscache_n_acquires_nobufs;
47923 -atomic_t fscache_n_acquires_oom;
47924 -
47925 -atomic_t fscache_n_updates;
47926 -atomic_t fscache_n_updates_null;
47927 -atomic_t fscache_n_updates_run;
47928 -
47929 -atomic_t fscache_n_relinquishes;
47930 -atomic_t fscache_n_relinquishes_null;
47931 -atomic_t fscache_n_relinquishes_waitcrt;
47932 -atomic_t fscache_n_relinquishes_retire;
47933 -
47934 -atomic_t fscache_n_cookie_index;
47935 -atomic_t fscache_n_cookie_data;
47936 -atomic_t fscache_n_cookie_special;
47937 -
47938 -atomic_t fscache_n_object_alloc;
47939 -atomic_t fscache_n_object_no_alloc;
47940 -atomic_t fscache_n_object_lookups;
47941 -atomic_t fscache_n_object_lookups_negative;
47942 -atomic_t fscache_n_object_lookups_positive;
47943 -atomic_t fscache_n_object_lookups_timed_out;
47944 -atomic_t fscache_n_object_created;
47945 -atomic_t fscache_n_object_avail;
47946 -atomic_t fscache_n_object_dead;
47947 -
47948 -atomic_t fscache_n_checkaux_none;
47949 -atomic_t fscache_n_checkaux_okay;
47950 -atomic_t fscache_n_checkaux_update;
47951 -atomic_t fscache_n_checkaux_obsolete;
47952 +atomic_unchecked_t fscache_n_op_pend;
47953 +atomic_unchecked_t fscache_n_op_run;
47954 +atomic_unchecked_t fscache_n_op_enqueue;
47955 +atomic_unchecked_t fscache_n_op_requeue;
47956 +atomic_unchecked_t fscache_n_op_deferred_release;
47957 +atomic_unchecked_t fscache_n_op_release;
47958 +atomic_unchecked_t fscache_n_op_gc;
47959 +atomic_unchecked_t fscache_n_op_cancelled;
47960 +atomic_unchecked_t fscache_n_op_rejected;
47961 +
47962 +atomic_unchecked_t fscache_n_attr_changed;
47963 +atomic_unchecked_t fscache_n_attr_changed_ok;
47964 +atomic_unchecked_t fscache_n_attr_changed_nobufs;
47965 +atomic_unchecked_t fscache_n_attr_changed_nomem;
47966 +atomic_unchecked_t fscache_n_attr_changed_calls;
47967 +
47968 +atomic_unchecked_t fscache_n_allocs;
47969 +atomic_unchecked_t fscache_n_allocs_ok;
47970 +atomic_unchecked_t fscache_n_allocs_wait;
47971 +atomic_unchecked_t fscache_n_allocs_nobufs;
47972 +atomic_unchecked_t fscache_n_allocs_intr;
47973 +atomic_unchecked_t fscache_n_allocs_object_dead;
47974 +atomic_unchecked_t fscache_n_alloc_ops;
47975 +atomic_unchecked_t fscache_n_alloc_op_waits;
47976 +
47977 +atomic_unchecked_t fscache_n_retrievals;
47978 +atomic_unchecked_t fscache_n_retrievals_ok;
47979 +atomic_unchecked_t fscache_n_retrievals_wait;
47980 +atomic_unchecked_t fscache_n_retrievals_nodata;
47981 +atomic_unchecked_t fscache_n_retrievals_nobufs;
47982 +atomic_unchecked_t fscache_n_retrievals_intr;
47983 +atomic_unchecked_t fscache_n_retrievals_nomem;
47984 +atomic_unchecked_t fscache_n_retrievals_object_dead;
47985 +atomic_unchecked_t fscache_n_retrieval_ops;
47986 +atomic_unchecked_t fscache_n_retrieval_op_waits;
47987 +
47988 +atomic_unchecked_t fscache_n_stores;
47989 +atomic_unchecked_t fscache_n_stores_ok;
47990 +atomic_unchecked_t fscache_n_stores_again;
47991 +atomic_unchecked_t fscache_n_stores_nobufs;
47992 +atomic_unchecked_t fscache_n_stores_oom;
47993 +atomic_unchecked_t fscache_n_store_ops;
47994 +atomic_unchecked_t fscache_n_store_calls;
47995 +atomic_unchecked_t fscache_n_store_pages;
47996 +atomic_unchecked_t fscache_n_store_radix_deletes;
47997 +atomic_unchecked_t fscache_n_store_pages_over_limit;
47998 +
47999 +atomic_unchecked_t fscache_n_store_vmscan_not_storing;
48000 +atomic_unchecked_t fscache_n_store_vmscan_gone;
48001 +atomic_unchecked_t fscache_n_store_vmscan_busy;
48002 +atomic_unchecked_t fscache_n_store_vmscan_cancelled;
48003 +
48004 +atomic_unchecked_t fscache_n_marks;
48005 +atomic_unchecked_t fscache_n_uncaches;
48006 +
48007 +atomic_unchecked_t fscache_n_acquires;
48008 +atomic_unchecked_t fscache_n_acquires_null;
48009 +atomic_unchecked_t fscache_n_acquires_no_cache;
48010 +atomic_unchecked_t fscache_n_acquires_ok;
48011 +atomic_unchecked_t fscache_n_acquires_nobufs;
48012 +atomic_unchecked_t fscache_n_acquires_oom;
48013 +
48014 +atomic_unchecked_t fscache_n_updates;
48015 +atomic_unchecked_t fscache_n_updates_null;
48016 +atomic_unchecked_t fscache_n_updates_run;
48017 +
48018 +atomic_unchecked_t fscache_n_relinquishes;
48019 +atomic_unchecked_t fscache_n_relinquishes_null;
48020 +atomic_unchecked_t fscache_n_relinquishes_waitcrt;
48021 +atomic_unchecked_t fscache_n_relinquishes_retire;
48022 +
48023 +atomic_unchecked_t fscache_n_cookie_index;
48024 +atomic_unchecked_t fscache_n_cookie_data;
48025 +atomic_unchecked_t fscache_n_cookie_special;
48026 +
48027 +atomic_unchecked_t fscache_n_object_alloc;
48028 +atomic_unchecked_t fscache_n_object_no_alloc;
48029 +atomic_unchecked_t fscache_n_object_lookups;
48030 +atomic_unchecked_t fscache_n_object_lookups_negative;
48031 +atomic_unchecked_t fscache_n_object_lookups_positive;
48032 +atomic_unchecked_t fscache_n_object_lookups_timed_out;
48033 +atomic_unchecked_t fscache_n_object_created;
48034 +atomic_unchecked_t fscache_n_object_avail;
48035 +atomic_unchecked_t fscache_n_object_dead;
48036 +
48037 +atomic_unchecked_t fscache_n_checkaux_none;
48038 +atomic_unchecked_t fscache_n_checkaux_okay;
48039 +atomic_unchecked_t fscache_n_checkaux_update;
48040 +atomic_unchecked_t fscache_n_checkaux_obsolete;
48041
48042 atomic_t fscache_n_cop_alloc_object;
48043 atomic_t fscache_n_cop_lookup_object;
48044 @@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq
48045 seq_puts(m, "FS-Cache statistics\n");
48046
48047 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
48048 - atomic_read(&fscache_n_cookie_index),
48049 - atomic_read(&fscache_n_cookie_data),
48050 - atomic_read(&fscache_n_cookie_special));
48051 + atomic_read_unchecked(&fscache_n_cookie_index),
48052 + atomic_read_unchecked(&fscache_n_cookie_data),
48053 + atomic_read_unchecked(&fscache_n_cookie_special));
48054
48055 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
48056 - atomic_read(&fscache_n_object_alloc),
48057 - atomic_read(&fscache_n_object_no_alloc),
48058 - atomic_read(&fscache_n_object_avail),
48059 - atomic_read(&fscache_n_object_dead));
48060 + atomic_read_unchecked(&fscache_n_object_alloc),
48061 + atomic_read_unchecked(&fscache_n_object_no_alloc),
48062 + atomic_read_unchecked(&fscache_n_object_avail),
48063 + atomic_read_unchecked(&fscache_n_object_dead));
48064 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
48065 - atomic_read(&fscache_n_checkaux_none),
48066 - atomic_read(&fscache_n_checkaux_okay),
48067 - atomic_read(&fscache_n_checkaux_update),
48068 - atomic_read(&fscache_n_checkaux_obsolete));
48069 + atomic_read_unchecked(&fscache_n_checkaux_none),
48070 + atomic_read_unchecked(&fscache_n_checkaux_okay),
48071 + atomic_read_unchecked(&fscache_n_checkaux_update),
48072 + atomic_read_unchecked(&fscache_n_checkaux_obsolete));
48073
48074 seq_printf(m, "Pages : mrk=%u unc=%u\n",
48075 - atomic_read(&fscache_n_marks),
48076 - atomic_read(&fscache_n_uncaches));
48077 + atomic_read_unchecked(&fscache_n_marks),
48078 + atomic_read_unchecked(&fscache_n_uncaches));
48079
48080 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
48081 " oom=%u\n",
48082 - atomic_read(&fscache_n_acquires),
48083 - atomic_read(&fscache_n_acquires_null),
48084 - atomic_read(&fscache_n_acquires_no_cache),
48085 - atomic_read(&fscache_n_acquires_ok),
48086 - atomic_read(&fscache_n_acquires_nobufs),
48087 - atomic_read(&fscache_n_acquires_oom));
48088 + atomic_read_unchecked(&fscache_n_acquires),
48089 + atomic_read_unchecked(&fscache_n_acquires_null),
48090 + atomic_read_unchecked(&fscache_n_acquires_no_cache),
48091 + atomic_read_unchecked(&fscache_n_acquires_ok),
48092 + atomic_read_unchecked(&fscache_n_acquires_nobufs),
48093 + atomic_read_unchecked(&fscache_n_acquires_oom));
48094
48095 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
48096 - atomic_read(&fscache_n_object_lookups),
48097 - atomic_read(&fscache_n_object_lookups_negative),
48098 - atomic_read(&fscache_n_object_lookups_positive),
48099 - atomic_read(&fscache_n_object_lookups_timed_out),
48100 - atomic_read(&fscache_n_object_created));
48101 + atomic_read_unchecked(&fscache_n_object_lookups),
48102 + atomic_read_unchecked(&fscache_n_object_lookups_negative),
48103 + atomic_read_unchecked(&fscache_n_object_lookups_positive),
48104 + atomic_read_unchecked(&fscache_n_object_lookups_timed_out),
48105 + atomic_read_unchecked(&fscache_n_object_created));
48106
48107 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
48108 - atomic_read(&fscache_n_updates),
48109 - atomic_read(&fscache_n_updates_null),
48110 - atomic_read(&fscache_n_updates_run));
48111 + atomic_read_unchecked(&fscache_n_updates),
48112 + atomic_read_unchecked(&fscache_n_updates_null),
48113 + atomic_read_unchecked(&fscache_n_updates_run));
48114
48115 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
48116 - atomic_read(&fscache_n_relinquishes),
48117 - atomic_read(&fscache_n_relinquishes_null),
48118 - atomic_read(&fscache_n_relinquishes_waitcrt),
48119 - atomic_read(&fscache_n_relinquishes_retire));
48120 + atomic_read_unchecked(&fscache_n_relinquishes),
48121 + atomic_read_unchecked(&fscache_n_relinquishes_null),
48122 + atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
48123 + atomic_read_unchecked(&fscache_n_relinquishes_retire));
48124
48125 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
48126 - atomic_read(&fscache_n_attr_changed),
48127 - atomic_read(&fscache_n_attr_changed_ok),
48128 - atomic_read(&fscache_n_attr_changed_nobufs),
48129 - atomic_read(&fscache_n_attr_changed_nomem),
48130 - atomic_read(&fscache_n_attr_changed_calls));
48131 + atomic_read_unchecked(&fscache_n_attr_changed),
48132 + atomic_read_unchecked(&fscache_n_attr_changed_ok),
48133 + atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
48134 + atomic_read_unchecked(&fscache_n_attr_changed_nomem),
48135 + atomic_read_unchecked(&fscache_n_attr_changed_calls));
48136
48137 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
48138 - atomic_read(&fscache_n_allocs),
48139 - atomic_read(&fscache_n_allocs_ok),
48140 - atomic_read(&fscache_n_allocs_wait),
48141 - atomic_read(&fscache_n_allocs_nobufs),
48142 - atomic_read(&fscache_n_allocs_intr));
48143 + atomic_read_unchecked(&fscache_n_allocs),
48144 + atomic_read_unchecked(&fscache_n_allocs_ok),
48145 + atomic_read_unchecked(&fscache_n_allocs_wait),
48146 + atomic_read_unchecked(&fscache_n_allocs_nobufs),
48147 + atomic_read_unchecked(&fscache_n_allocs_intr));
48148 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
48149 - atomic_read(&fscache_n_alloc_ops),
48150 - atomic_read(&fscache_n_alloc_op_waits),
48151 - atomic_read(&fscache_n_allocs_object_dead));
48152 + atomic_read_unchecked(&fscache_n_alloc_ops),
48153 + atomic_read_unchecked(&fscache_n_alloc_op_waits),
48154 + atomic_read_unchecked(&fscache_n_allocs_object_dead));
48155
48156 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
48157 " int=%u oom=%u\n",
48158 - atomic_read(&fscache_n_retrievals),
48159 - atomic_read(&fscache_n_retrievals_ok),
48160 - atomic_read(&fscache_n_retrievals_wait),
48161 - atomic_read(&fscache_n_retrievals_nodata),
48162 - atomic_read(&fscache_n_retrievals_nobufs),
48163 - atomic_read(&fscache_n_retrievals_intr),
48164 - atomic_read(&fscache_n_retrievals_nomem));
48165 + atomic_read_unchecked(&fscache_n_retrievals),
48166 + atomic_read_unchecked(&fscache_n_retrievals_ok),
48167 + atomic_read_unchecked(&fscache_n_retrievals_wait),
48168 + atomic_read_unchecked(&fscache_n_retrievals_nodata),
48169 + atomic_read_unchecked(&fscache_n_retrievals_nobufs),
48170 + atomic_read_unchecked(&fscache_n_retrievals_intr),
48171 + atomic_read_unchecked(&fscache_n_retrievals_nomem));
48172 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
48173 - atomic_read(&fscache_n_retrieval_ops),
48174 - atomic_read(&fscache_n_retrieval_op_waits),
48175 - atomic_read(&fscache_n_retrievals_object_dead));
48176 + atomic_read_unchecked(&fscache_n_retrieval_ops),
48177 + atomic_read_unchecked(&fscache_n_retrieval_op_waits),
48178 + atomic_read_unchecked(&fscache_n_retrievals_object_dead));
48179
48180 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
48181 - atomic_read(&fscache_n_stores),
48182 - atomic_read(&fscache_n_stores_ok),
48183 - atomic_read(&fscache_n_stores_again),
48184 - atomic_read(&fscache_n_stores_nobufs),
48185 - atomic_read(&fscache_n_stores_oom));
48186 + atomic_read_unchecked(&fscache_n_stores),
48187 + atomic_read_unchecked(&fscache_n_stores_ok),
48188 + atomic_read_unchecked(&fscache_n_stores_again),
48189 + atomic_read_unchecked(&fscache_n_stores_nobufs),
48190 + atomic_read_unchecked(&fscache_n_stores_oom));
48191 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
48192 - atomic_read(&fscache_n_store_ops),
48193 - atomic_read(&fscache_n_store_calls),
48194 - atomic_read(&fscache_n_store_pages),
48195 - atomic_read(&fscache_n_store_radix_deletes),
48196 - atomic_read(&fscache_n_store_pages_over_limit));
48197 + atomic_read_unchecked(&fscache_n_store_ops),
48198 + atomic_read_unchecked(&fscache_n_store_calls),
48199 + atomic_read_unchecked(&fscache_n_store_pages),
48200 + atomic_read_unchecked(&fscache_n_store_radix_deletes),
48201 + atomic_read_unchecked(&fscache_n_store_pages_over_limit));
48202
48203 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
48204 - atomic_read(&fscache_n_store_vmscan_not_storing),
48205 - atomic_read(&fscache_n_store_vmscan_gone),
48206 - atomic_read(&fscache_n_store_vmscan_busy),
48207 - atomic_read(&fscache_n_store_vmscan_cancelled));
48208 + atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
48209 + atomic_read_unchecked(&fscache_n_store_vmscan_gone),
48210 + atomic_read_unchecked(&fscache_n_store_vmscan_busy),
48211 + atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
48212
48213 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
48214 - atomic_read(&fscache_n_op_pend),
48215 - atomic_read(&fscache_n_op_run),
48216 - atomic_read(&fscache_n_op_enqueue),
48217 - atomic_read(&fscache_n_op_cancelled),
48218 - atomic_read(&fscache_n_op_rejected));
48219 + atomic_read_unchecked(&fscache_n_op_pend),
48220 + atomic_read_unchecked(&fscache_n_op_run),
48221 + atomic_read_unchecked(&fscache_n_op_enqueue),
48222 + atomic_read_unchecked(&fscache_n_op_cancelled),
48223 + atomic_read_unchecked(&fscache_n_op_rejected));
48224 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
48225 - atomic_read(&fscache_n_op_deferred_release),
48226 - atomic_read(&fscache_n_op_release),
48227 - atomic_read(&fscache_n_op_gc));
48228 + atomic_read_unchecked(&fscache_n_op_deferred_release),
48229 + atomic_read_unchecked(&fscache_n_op_release),
48230 + atomic_read_unchecked(&fscache_n_op_gc));
48231
48232 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
48233 atomic_read(&fscache_n_cop_alloc_object),
48234 diff -urNp linux-2.6.32.49/fs/fs_struct.c linux-2.6.32.49/fs/fs_struct.c
48235 --- linux-2.6.32.49/fs/fs_struct.c 2011-11-08 19:02:43.000000000 -0500
48236 +++ linux-2.6.32.49/fs/fs_struct.c 2011-11-15 19:59:43.000000000 -0500
48237 @@ -4,6 +4,7 @@
48238 #include <linux/path.h>
48239 #include <linux/slab.h>
48240 #include <linux/fs_struct.h>
48241 +#include <linux/grsecurity.h>
48242
48243 /*
48244 * Replace the fs->{rootmnt,root} with {mnt,dentry}. Put the old values.
48245 @@ -17,6 +18,7 @@ void set_fs_root(struct fs_struct *fs, s
48246 old_root = fs->root;
48247 fs->root = *path;
48248 path_get(path);
48249 + gr_set_chroot_entries(current, path);
48250 write_unlock(&fs->lock);
48251 if (old_root.dentry)
48252 path_put(&old_root);
48253 @@ -56,6 +58,7 @@ void chroot_fs_refs(struct path *old_roo
48254 && fs->root.mnt == old_root->mnt) {
48255 path_get(new_root);
48256 fs->root = *new_root;
48257 + gr_set_chroot_entries(p, new_root);
48258 count++;
48259 }
48260 if (fs->pwd.dentry == old_root->dentry
48261 @@ -89,7 +92,8 @@ void exit_fs(struct task_struct *tsk)
48262 task_lock(tsk);
48263 write_lock(&fs->lock);
48264 tsk->fs = NULL;
48265 - kill = !--fs->users;
48266 + gr_clear_chroot_entries(tsk);
48267 + kill = !atomic_dec_return(&fs->users);
48268 write_unlock(&fs->lock);
48269 task_unlock(tsk);
48270 if (kill)
48271 @@ -102,7 +106,7 @@ struct fs_struct *copy_fs_struct(struct
48272 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
48273 /* We don't need to lock fs - think why ;-) */
48274 if (fs) {
48275 - fs->users = 1;
48276 + atomic_set(&fs->users, 1);
48277 fs->in_exec = 0;
48278 rwlock_init(&fs->lock);
48279 fs->umask = old->umask;
48280 @@ -127,8 +131,9 @@ int unshare_fs_struct(void)
48281
48282 task_lock(current);
48283 write_lock(&fs->lock);
48284 - kill = !--fs->users;
48285 + kill = !atomic_dec_return(&fs->users);
48286 current->fs = new_fs;
48287 + gr_set_chroot_entries(current, &new_fs->root);
48288 write_unlock(&fs->lock);
48289 task_unlock(current);
48290
48291 @@ -147,7 +152,7 @@ EXPORT_SYMBOL(current_umask);
48292
48293 /* to be mentioned only in INIT_TASK */
48294 struct fs_struct init_fs = {
48295 - .users = 1,
48296 + .users = ATOMIC_INIT(1),
48297 .lock = __RW_LOCK_UNLOCKED(init_fs.lock),
48298 .umask = 0022,
48299 };
48300 @@ -162,12 +167,13 @@ void daemonize_fs_struct(void)
48301 task_lock(current);
48302
48303 write_lock(&init_fs.lock);
48304 - init_fs.users++;
48305 + atomic_inc(&init_fs.users);
48306 write_unlock(&init_fs.lock);
48307
48308 write_lock(&fs->lock);
48309 current->fs = &init_fs;
48310 - kill = !--fs->users;
48311 + gr_set_chroot_entries(current, &current->fs->root);
48312 + kill = !atomic_dec_return(&fs->users);
48313 write_unlock(&fs->lock);
48314
48315 task_unlock(current);
48316 diff -urNp linux-2.6.32.49/fs/fuse/cuse.c linux-2.6.32.49/fs/fuse/cuse.c
48317 --- linux-2.6.32.49/fs/fuse/cuse.c 2011-11-08 19:02:43.000000000 -0500
48318 +++ linux-2.6.32.49/fs/fuse/cuse.c 2011-11-15 19:59:43.000000000 -0500
48319 @@ -576,10 +576,12 @@ static int __init cuse_init(void)
48320 INIT_LIST_HEAD(&cuse_conntbl[i]);
48321
48322 /* inherit and extend fuse_dev_operations */
48323 - cuse_channel_fops = fuse_dev_operations;
48324 - cuse_channel_fops.owner = THIS_MODULE;
48325 - cuse_channel_fops.open = cuse_channel_open;
48326 - cuse_channel_fops.release = cuse_channel_release;
48327 + pax_open_kernel();
48328 + memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
48329 + *(void **)&cuse_channel_fops.owner = THIS_MODULE;
48330 + *(void **)&cuse_channel_fops.open = cuse_channel_open;
48331 + *(void **)&cuse_channel_fops.release = cuse_channel_release;
48332 + pax_close_kernel();
48333
48334 cuse_class = class_create(THIS_MODULE, "cuse");
48335 if (IS_ERR(cuse_class))
48336 diff -urNp linux-2.6.32.49/fs/fuse/dev.c linux-2.6.32.49/fs/fuse/dev.c
48337 --- linux-2.6.32.49/fs/fuse/dev.c 2011-11-08 19:02:43.000000000 -0500
48338 +++ linux-2.6.32.49/fs/fuse/dev.c 2011-11-15 19:59:43.000000000 -0500
48339 @@ -885,7 +885,7 @@ static int fuse_notify_inval_entry(struc
48340 {
48341 struct fuse_notify_inval_entry_out outarg;
48342 int err = -EINVAL;
48343 - char buf[FUSE_NAME_MAX+1];
48344 + char *buf = NULL;
48345 struct qstr name;
48346
48347 if (size < sizeof(outarg))
48348 @@ -899,6 +899,11 @@ static int fuse_notify_inval_entry(struc
48349 if (outarg.namelen > FUSE_NAME_MAX)
48350 goto err;
48351
48352 + err = -ENOMEM;
48353 + buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
48354 + if (!buf)
48355 + goto err;
48356 +
48357 err = -EINVAL;
48358 if (size != sizeof(outarg) + outarg.namelen + 1)
48359 goto err;
48360 @@ -914,17 +919,15 @@ static int fuse_notify_inval_entry(struc
48361
48362 down_read(&fc->killsb);
48363 err = -ENOENT;
48364 - if (!fc->sb)
48365 - goto err_unlock;
48366 -
48367 - err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
48368 -
48369 -err_unlock:
48370 + if (fc->sb)
48371 + err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
48372 up_read(&fc->killsb);
48373 + kfree(buf);
48374 return err;
48375
48376 err:
48377 fuse_copy_finish(cs);
48378 + kfree(buf);
48379 return err;
48380 }
48381
48382 diff -urNp linux-2.6.32.49/fs/fuse/dir.c linux-2.6.32.49/fs/fuse/dir.c
48383 --- linux-2.6.32.49/fs/fuse/dir.c 2011-11-08 19:02:43.000000000 -0500
48384 +++ linux-2.6.32.49/fs/fuse/dir.c 2011-11-15 19:59:43.000000000 -0500
48385 @@ -1127,7 +1127,7 @@ static char *read_link(struct dentry *de
48386 return link;
48387 }
48388
48389 -static void free_link(char *link)
48390 +static void free_link(const char *link)
48391 {
48392 if (!IS_ERR(link))
48393 free_page((unsigned long) link);
48394 diff -urNp linux-2.6.32.49/fs/gfs2/ops_inode.c linux-2.6.32.49/fs/gfs2/ops_inode.c
48395 --- linux-2.6.32.49/fs/gfs2/ops_inode.c 2011-11-08 19:02:43.000000000 -0500
48396 +++ linux-2.6.32.49/fs/gfs2/ops_inode.c 2011-11-15 19:59:43.000000000 -0500
48397 @@ -752,6 +752,8 @@ static int gfs2_rename(struct inode *odi
48398 unsigned int x;
48399 int error;
48400
48401 + pax_track_stack();
48402 +
48403 if (ndentry->d_inode) {
48404 nip = GFS2_I(ndentry->d_inode);
48405 if (ip == nip)
48406 diff -urNp linux-2.6.32.49/fs/gfs2/sys.c linux-2.6.32.49/fs/gfs2/sys.c
48407 --- linux-2.6.32.49/fs/gfs2/sys.c 2011-11-08 19:02:43.000000000 -0500
48408 +++ linux-2.6.32.49/fs/gfs2/sys.c 2011-11-15 19:59:43.000000000 -0500
48409 @@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct ko
48410 return a->store ? a->store(sdp, buf, len) : len;
48411 }
48412
48413 -static struct sysfs_ops gfs2_attr_ops = {
48414 +static const struct sysfs_ops gfs2_attr_ops = {
48415 .show = gfs2_attr_show,
48416 .store = gfs2_attr_store,
48417 };
48418 @@ -584,7 +584,7 @@ static int gfs2_uevent(struct kset *kset
48419 return 0;
48420 }
48421
48422 -static struct kset_uevent_ops gfs2_uevent_ops = {
48423 +static const struct kset_uevent_ops gfs2_uevent_ops = {
48424 .uevent = gfs2_uevent,
48425 };
48426
48427 diff -urNp linux-2.6.32.49/fs/hfs/btree.c linux-2.6.32.49/fs/hfs/btree.c
48428 --- linux-2.6.32.49/fs/hfs/btree.c 2011-11-08 19:02:43.000000000 -0500
48429 +++ linux-2.6.32.49/fs/hfs/btree.c 2011-11-18 18:49:57.000000000 -0500
48430 @@ -45,11 +45,27 @@ struct hfs_btree *hfs_btree_open(struct
48431 case HFS_EXT_CNID:
48432 hfs_inode_read_fork(tree->inode, mdb->drXTExtRec, mdb->drXTFlSize,
48433 mdb->drXTFlSize, be32_to_cpu(mdb->drXTClpSiz));
48434 +
48435 + if (HFS_I(tree->inode)->alloc_blocks >
48436 + HFS_I(tree->inode)->first_blocks) {
48437 + printk(KERN_ERR "hfs: invalid btree extent records\n");
48438 + unlock_new_inode(tree->inode);
48439 + goto free_inode;
48440 + }
48441 +
48442 tree->inode->i_mapping->a_ops = &hfs_btree_aops;
48443 break;
48444 case HFS_CAT_CNID:
48445 hfs_inode_read_fork(tree->inode, mdb->drCTExtRec, mdb->drCTFlSize,
48446 mdb->drCTFlSize, be32_to_cpu(mdb->drCTClpSiz));
48447 +
48448 + if (!HFS_I(tree->inode)->first_blocks) {
48449 + printk(KERN_ERR "hfs: invalid btree extent records "
48450 + "(0 size).\n");
48451 + unlock_new_inode(tree->inode);
48452 + goto free_inode;
48453 + }
48454 +
48455 tree->inode->i_mapping->a_ops = &hfs_btree_aops;
48456 break;
48457 default:
48458 @@ -58,11 +74,6 @@ struct hfs_btree *hfs_btree_open(struct
48459 }
48460 unlock_new_inode(tree->inode);
48461
48462 - if (!HFS_I(tree->inode)->first_blocks) {
48463 - printk(KERN_ERR "hfs: invalid btree extent records (0 size).\n");
48464 - goto free_inode;
48465 - }
48466 -
48467 mapping = tree->inode->i_mapping;
48468 page = read_mapping_page(mapping, 0, NULL);
48469 if (IS_ERR(page))
48470 diff -urNp linux-2.6.32.49/fs/hfsplus/catalog.c linux-2.6.32.49/fs/hfsplus/catalog.c
48471 --- linux-2.6.32.49/fs/hfsplus/catalog.c 2011-11-08 19:02:43.000000000 -0500
48472 +++ linux-2.6.32.49/fs/hfsplus/catalog.c 2011-11-15 19:59:43.000000000 -0500
48473 @@ -157,6 +157,8 @@ int hfsplus_find_cat(struct super_block
48474 int err;
48475 u16 type;
48476
48477 + pax_track_stack();
48478 +
48479 hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
48480 err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
48481 if (err)
48482 @@ -186,6 +188,8 @@ int hfsplus_create_cat(u32 cnid, struct
48483 int entry_size;
48484 int err;
48485
48486 + pax_track_stack();
48487 +
48488 dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n", str->name, cnid, inode->i_nlink);
48489 sb = dir->i_sb;
48490 hfs_find_init(HFSPLUS_SB(sb).cat_tree, &fd);
48491 @@ -318,6 +322,8 @@ int hfsplus_rename_cat(u32 cnid,
48492 int entry_size, type;
48493 int err = 0;
48494
48495 + pax_track_stack();
48496 +
48497 dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n", cnid, src_dir->i_ino, src_name->name,
48498 dst_dir->i_ino, dst_name->name);
48499 sb = src_dir->i_sb;
48500 diff -urNp linux-2.6.32.49/fs/hfsplus/dir.c linux-2.6.32.49/fs/hfsplus/dir.c
48501 --- linux-2.6.32.49/fs/hfsplus/dir.c 2011-11-08 19:02:43.000000000 -0500
48502 +++ linux-2.6.32.49/fs/hfsplus/dir.c 2011-11-15 19:59:43.000000000 -0500
48503 @@ -121,6 +121,8 @@ static int hfsplus_readdir(struct file *
48504 struct hfsplus_readdir_data *rd;
48505 u16 type;
48506
48507 + pax_track_stack();
48508 +
48509 if (filp->f_pos >= inode->i_size)
48510 return 0;
48511
48512 diff -urNp linux-2.6.32.49/fs/hfsplus/inode.c linux-2.6.32.49/fs/hfsplus/inode.c
48513 --- linux-2.6.32.49/fs/hfsplus/inode.c 2011-11-08 19:02:43.000000000 -0500
48514 +++ linux-2.6.32.49/fs/hfsplus/inode.c 2011-11-15 19:59:43.000000000 -0500
48515 @@ -399,6 +399,8 @@ int hfsplus_cat_read_inode(struct inode
48516 int res = 0;
48517 u16 type;
48518
48519 + pax_track_stack();
48520 +
48521 type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
48522
48523 HFSPLUS_I(inode).dev = 0;
48524 @@ -461,6 +463,8 @@ int hfsplus_cat_write_inode(struct inode
48525 struct hfs_find_data fd;
48526 hfsplus_cat_entry entry;
48527
48528 + pax_track_stack();
48529 +
48530 if (HFSPLUS_IS_RSRC(inode))
48531 main_inode = HFSPLUS_I(inode).rsrc_inode;
48532
48533 diff -urNp linux-2.6.32.49/fs/hfsplus/ioctl.c linux-2.6.32.49/fs/hfsplus/ioctl.c
48534 --- linux-2.6.32.49/fs/hfsplus/ioctl.c 2011-11-08 19:02:43.000000000 -0500
48535 +++ linux-2.6.32.49/fs/hfsplus/ioctl.c 2011-11-15 19:59:43.000000000 -0500
48536 @@ -101,6 +101,8 @@ int hfsplus_setxattr(struct dentry *dent
48537 struct hfsplus_cat_file *file;
48538 int res;
48539
48540 + pax_track_stack();
48541 +
48542 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
48543 return -EOPNOTSUPP;
48544
48545 @@ -143,6 +145,8 @@ ssize_t hfsplus_getxattr(struct dentry *
48546 struct hfsplus_cat_file *file;
48547 ssize_t res = 0;
48548
48549 + pax_track_stack();
48550 +
48551 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
48552 return -EOPNOTSUPP;
48553
48554 diff -urNp linux-2.6.32.49/fs/hfsplus/super.c linux-2.6.32.49/fs/hfsplus/super.c
48555 --- linux-2.6.32.49/fs/hfsplus/super.c 2011-11-08 19:02:43.000000000 -0500
48556 +++ linux-2.6.32.49/fs/hfsplus/super.c 2011-11-15 19:59:43.000000000 -0500
48557 @@ -312,6 +312,8 @@ static int hfsplus_fill_super(struct sup
48558 struct nls_table *nls = NULL;
48559 int err = -EINVAL;
48560
48561 + pax_track_stack();
48562 +
48563 sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
48564 if (!sbi)
48565 return -ENOMEM;
48566 diff -urNp linux-2.6.32.49/fs/hugetlbfs/inode.c linux-2.6.32.49/fs/hugetlbfs/inode.c
48567 --- linux-2.6.32.49/fs/hugetlbfs/inode.c 2011-11-08 19:02:43.000000000 -0500
48568 +++ linux-2.6.32.49/fs/hugetlbfs/inode.c 2011-11-15 19:59:43.000000000 -0500
48569 @@ -909,7 +909,7 @@ static struct file_system_type hugetlbfs
48570 .kill_sb = kill_litter_super,
48571 };
48572
48573 -static struct vfsmount *hugetlbfs_vfsmount;
48574 +struct vfsmount *hugetlbfs_vfsmount;
48575
48576 static int can_do_hugetlb_shm(void)
48577 {
48578 diff -urNp linux-2.6.32.49/fs/ioctl.c linux-2.6.32.49/fs/ioctl.c
48579 --- linux-2.6.32.49/fs/ioctl.c 2011-11-08 19:02:43.000000000 -0500
48580 +++ linux-2.6.32.49/fs/ioctl.c 2011-11-15 19:59:43.000000000 -0500
48581 @@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiema
48582 u64 phys, u64 len, u32 flags)
48583 {
48584 struct fiemap_extent extent;
48585 - struct fiemap_extent *dest = fieinfo->fi_extents_start;
48586 + struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
48587
48588 /* only count the extents */
48589 if (fieinfo->fi_extents_max == 0) {
48590 @@ -207,7 +207,7 @@ static int ioctl_fiemap(struct file *fil
48591
48592 fieinfo.fi_flags = fiemap.fm_flags;
48593 fieinfo.fi_extents_max = fiemap.fm_extent_count;
48594 - fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
48595 + fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
48596
48597 if (fiemap.fm_extent_count != 0 &&
48598 !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
48599 @@ -220,7 +220,7 @@ static int ioctl_fiemap(struct file *fil
48600 error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
48601 fiemap.fm_flags = fieinfo.fi_flags;
48602 fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
48603 - if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
48604 + if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
48605 error = -EFAULT;
48606
48607 return error;
48608 diff -urNp linux-2.6.32.49/fs/jbd/checkpoint.c linux-2.6.32.49/fs/jbd/checkpoint.c
48609 --- linux-2.6.32.49/fs/jbd/checkpoint.c 2011-11-08 19:02:43.000000000 -0500
48610 +++ linux-2.6.32.49/fs/jbd/checkpoint.c 2011-11-15 19:59:43.000000000 -0500
48611 @@ -348,6 +348,8 @@ int log_do_checkpoint(journal_t *journal
48612 tid_t this_tid;
48613 int result;
48614
48615 + pax_track_stack();
48616 +
48617 jbd_debug(1, "Start checkpoint\n");
48618
48619 /*
48620 diff -urNp linux-2.6.32.49/fs/jffs2/compr_rtime.c linux-2.6.32.49/fs/jffs2/compr_rtime.c
48621 --- linux-2.6.32.49/fs/jffs2/compr_rtime.c 2011-11-08 19:02:43.000000000 -0500
48622 +++ linux-2.6.32.49/fs/jffs2/compr_rtime.c 2011-11-15 19:59:43.000000000 -0500
48623 @@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned
48624 int outpos = 0;
48625 int pos=0;
48626
48627 + pax_track_stack();
48628 +
48629 memset(positions,0,sizeof(positions));
48630
48631 while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
48632 @@ -79,6 +81,8 @@ static int jffs2_rtime_decompress(unsign
48633 int outpos = 0;
48634 int pos=0;
48635
48636 + pax_track_stack();
48637 +
48638 memset(positions,0,sizeof(positions));
48639
48640 while (outpos<destlen) {
48641 diff -urNp linux-2.6.32.49/fs/jffs2/compr_rubin.c linux-2.6.32.49/fs/jffs2/compr_rubin.c
48642 --- linux-2.6.32.49/fs/jffs2/compr_rubin.c 2011-11-08 19:02:43.000000000 -0500
48643 +++ linux-2.6.32.49/fs/jffs2/compr_rubin.c 2011-11-15 19:59:43.000000000 -0500
48644 @@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsig
48645 int ret;
48646 uint32_t mysrclen, mydstlen;
48647
48648 + pax_track_stack();
48649 +
48650 mysrclen = *sourcelen;
48651 mydstlen = *dstlen - 8;
48652
48653 diff -urNp linux-2.6.32.49/fs/jffs2/erase.c linux-2.6.32.49/fs/jffs2/erase.c
48654 --- linux-2.6.32.49/fs/jffs2/erase.c 2011-11-08 19:02:43.000000000 -0500
48655 +++ linux-2.6.32.49/fs/jffs2/erase.c 2011-11-15 19:59:43.000000000 -0500
48656 @@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(stru
48657 struct jffs2_unknown_node marker = {
48658 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
48659 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
48660 - .totlen = cpu_to_je32(c->cleanmarker_size)
48661 + .totlen = cpu_to_je32(c->cleanmarker_size),
48662 + .hdr_crc = cpu_to_je32(0)
48663 };
48664
48665 jffs2_prealloc_raw_node_refs(c, jeb, 1);
48666 diff -urNp linux-2.6.32.49/fs/jffs2/wbuf.c linux-2.6.32.49/fs/jffs2/wbuf.c
48667 --- linux-2.6.32.49/fs/jffs2/wbuf.c 2011-11-08 19:02:43.000000000 -0500
48668 +++ linux-2.6.32.49/fs/jffs2/wbuf.c 2011-11-15 19:59:43.000000000 -0500
48669 @@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
48670 {
48671 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
48672 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
48673 - .totlen = constant_cpu_to_je32(8)
48674 + .totlen = constant_cpu_to_je32(8),
48675 + .hdr_crc = constant_cpu_to_je32(0)
48676 };
48677
48678 /*
48679 diff -urNp linux-2.6.32.49/fs/jffs2/xattr.c linux-2.6.32.49/fs/jffs2/xattr.c
48680 --- linux-2.6.32.49/fs/jffs2/xattr.c 2011-11-08 19:02:43.000000000 -0500
48681 +++ linux-2.6.32.49/fs/jffs2/xattr.c 2011-11-15 19:59:43.000000000 -0500
48682 @@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct
48683
48684 BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
48685
48686 + pax_track_stack();
48687 +
48688 /* Phase.1 : Merge same xref */
48689 for (i=0; i < XREF_TMPHASH_SIZE; i++)
48690 xref_tmphash[i] = NULL;
48691 diff -urNp linux-2.6.32.49/fs/jfs/super.c linux-2.6.32.49/fs/jfs/super.c
48692 --- linux-2.6.32.49/fs/jfs/super.c 2011-11-08 19:02:43.000000000 -0500
48693 +++ linux-2.6.32.49/fs/jfs/super.c 2011-11-15 19:59:43.000000000 -0500
48694 @@ -793,7 +793,7 @@ static int __init init_jfs_fs(void)
48695
48696 jfs_inode_cachep =
48697 kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
48698 - SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
48699 + SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
48700 init_once);
48701 if (jfs_inode_cachep == NULL)
48702 return -ENOMEM;
48703 diff -urNp linux-2.6.32.49/fs/Kconfig.binfmt linux-2.6.32.49/fs/Kconfig.binfmt
48704 --- linux-2.6.32.49/fs/Kconfig.binfmt 2011-11-08 19:02:43.000000000 -0500
48705 +++ linux-2.6.32.49/fs/Kconfig.binfmt 2011-11-15 19:59:43.000000000 -0500
48706 @@ -86,7 +86,7 @@ config HAVE_AOUT
48707
48708 config BINFMT_AOUT
48709 tristate "Kernel support for a.out and ECOFF binaries"
48710 - depends on HAVE_AOUT
48711 + depends on HAVE_AOUT && BROKEN
48712 ---help---
48713 A.out (Assembler.OUTput) is a set of formats for libraries and
48714 executables used in the earliest versions of UNIX. Linux used
48715 diff -urNp linux-2.6.32.49/fs/libfs.c linux-2.6.32.49/fs/libfs.c
48716 --- linux-2.6.32.49/fs/libfs.c 2011-11-08 19:02:43.000000000 -0500
48717 +++ linux-2.6.32.49/fs/libfs.c 2011-11-15 19:59:43.000000000 -0500
48718 @@ -157,12 +157,20 @@ int dcache_readdir(struct file * filp, v
48719
48720 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
48721 struct dentry *next;
48722 + char d_name[sizeof(next->d_iname)];
48723 + const unsigned char *name;
48724 +
48725 next = list_entry(p, struct dentry, d_u.d_child);
48726 if (d_unhashed(next) || !next->d_inode)
48727 continue;
48728
48729 spin_unlock(&dcache_lock);
48730 - if (filldir(dirent, next->d_name.name,
48731 + name = next->d_name.name;
48732 + if (name == next->d_iname) {
48733 + memcpy(d_name, name, next->d_name.len);
48734 + name = d_name;
48735 + }
48736 + if (filldir(dirent, name,
48737 next->d_name.len, filp->f_pos,
48738 next->d_inode->i_ino,
48739 dt_type(next->d_inode)) < 0)
48740 diff -urNp linux-2.6.32.49/fs/lockd/clntproc.c linux-2.6.32.49/fs/lockd/clntproc.c
48741 --- linux-2.6.32.49/fs/lockd/clntproc.c 2011-11-08 19:02:43.000000000 -0500
48742 +++ linux-2.6.32.49/fs/lockd/clntproc.c 2011-11-15 19:59:43.000000000 -0500
48743 @@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt
48744 /*
48745 * Cookie counter for NLM requests
48746 */
48747 -static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
48748 +static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
48749
48750 void nlmclnt_next_cookie(struct nlm_cookie *c)
48751 {
48752 - u32 cookie = atomic_inc_return(&nlm_cookie);
48753 + u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
48754
48755 memcpy(c->data, &cookie, 4);
48756 c->len=4;
48757 @@ -621,6 +621,8 @@ nlmclnt_reclaim(struct nlm_host *host, s
48758 struct nlm_rqst reqst, *req;
48759 int status;
48760
48761 + pax_track_stack();
48762 +
48763 req = &reqst;
48764 memset(req, 0, sizeof(*req));
48765 locks_init_lock(&req->a_args.lock.fl);
48766 diff -urNp linux-2.6.32.49/fs/lockd/svc.c linux-2.6.32.49/fs/lockd/svc.c
48767 --- linux-2.6.32.49/fs/lockd/svc.c 2011-11-08 19:02:43.000000000 -0500
48768 +++ linux-2.6.32.49/fs/lockd/svc.c 2011-11-15 19:59:43.000000000 -0500
48769 @@ -43,7 +43,7 @@
48770
48771 static struct svc_program nlmsvc_program;
48772
48773 -struct nlmsvc_binding * nlmsvc_ops;
48774 +const struct nlmsvc_binding * nlmsvc_ops;
48775 EXPORT_SYMBOL_GPL(nlmsvc_ops);
48776
48777 static DEFINE_MUTEX(nlmsvc_mutex);
48778 diff -urNp linux-2.6.32.49/fs/locks.c linux-2.6.32.49/fs/locks.c
48779 --- linux-2.6.32.49/fs/locks.c 2011-11-08 19:02:43.000000000 -0500
48780 +++ linux-2.6.32.49/fs/locks.c 2011-11-15 19:59:43.000000000 -0500
48781 @@ -145,10 +145,28 @@ static LIST_HEAD(blocked_list);
48782
48783 static struct kmem_cache *filelock_cache __read_mostly;
48784
48785 +static void locks_init_lock_always(struct file_lock *fl)
48786 +{
48787 + fl->fl_next = NULL;
48788 + fl->fl_fasync = NULL;
48789 + fl->fl_owner = NULL;
48790 + fl->fl_pid = 0;
48791 + fl->fl_nspid = NULL;
48792 + fl->fl_file = NULL;
48793 + fl->fl_flags = 0;
48794 + fl->fl_type = 0;
48795 + fl->fl_start = fl->fl_end = 0;
48796 +}
48797 +
48798 /* Allocate an empty lock structure. */
48799 static struct file_lock *locks_alloc_lock(void)
48800 {
48801 - return kmem_cache_alloc(filelock_cache, GFP_KERNEL);
48802 + struct file_lock *fl = kmem_cache_alloc(filelock_cache, GFP_KERNEL);
48803 +
48804 + if (fl)
48805 + locks_init_lock_always(fl);
48806 +
48807 + return fl;
48808 }
48809
48810 void locks_release_private(struct file_lock *fl)
48811 @@ -183,17 +201,9 @@ void locks_init_lock(struct file_lock *f
48812 INIT_LIST_HEAD(&fl->fl_link);
48813 INIT_LIST_HEAD(&fl->fl_block);
48814 init_waitqueue_head(&fl->fl_wait);
48815 - fl->fl_next = NULL;
48816 - fl->fl_fasync = NULL;
48817 - fl->fl_owner = NULL;
48818 - fl->fl_pid = 0;
48819 - fl->fl_nspid = NULL;
48820 - fl->fl_file = NULL;
48821 - fl->fl_flags = 0;
48822 - fl->fl_type = 0;
48823 - fl->fl_start = fl->fl_end = 0;
48824 fl->fl_ops = NULL;
48825 fl->fl_lmops = NULL;
48826 + locks_init_lock_always(fl);
48827 }
48828
48829 EXPORT_SYMBOL(locks_init_lock);
48830 @@ -2007,16 +2017,16 @@ void locks_remove_flock(struct file *fil
48831 return;
48832
48833 if (filp->f_op && filp->f_op->flock) {
48834 - struct file_lock fl = {
48835 + struct file_lock flock = {
48836 .fl_pid = current->tgid,
48837 .fl_file = filp,
48838 .fl_flags = FL_FLOCK,
48839 .fl_type = F_UNLCK,
48840 .fl_end = OFFSET_MAX,
48841 };
48842 - filp->f_op->flock(filp, F_SETLKW, &fl);
48843 - if (fl.fl_ops && fl.fl_ops->fl_release_private)
48844 - fl.fl_ops->fl_release_private(&fl);
48845 + filp->f_op->flock(filp, F_SETLKW, &flock);
48846 + if (flock.fl_ops && flock.fl_ops->fl_release_private)
48847 + flock.fl_ops->fl_release_private(&flock);
48848 }
48849
48850 lock_kernel();
48851 diff -urNp linux-2.6.32.49/fs/mbcache.c linux-2.6.32.49/fs/mbcache.c
48852 --- linux-2.6.32.49/fs/mbcache.c 2011-11-08 19:02:43.000000000 -0500
48853 +++ linux-2.6.32.49/fs/mbcache.c 2011-11-15 19:59:43.000000000 -0500
48854 @@ -266,9 +266,9 @@ mb_cache_create(const char *name, struct
48855 if (!cache)
48856 goto fail;
48857 cache->c_name = name;
48858 - cache->c_op.free = NULL;
48859 + *(void **)&cache->c_op.free = NULL;
48860 if (cache_op)
48861 - cache->c_op.free = cache_op->free;
48862 + *(void **)&cache->c_op.free = cache_op->free;
48863 atomic_set(&cache->c_entry_count, 0);
48864 cache->c_bucket_bits = bucket_bits;
48865 #ifdef MB_CACHE_INDEXES_COUNT
48866 diff -urNp linux-2.6.32.49/fs/namei.c linux-2.6.32.49/fs/namei.c
48867 --- linux-2.6.32.49/fs/namei.c 2011-11-08 19:02:43.000000000 -0500
48868 +++ linux-2.6.32.49/fs/namei.c 2011-11-18 19:36:31.000000000 -0500
48869 @@ -224,14 +224,6 @@ int generic_permission(struct inode *ino
48870 return ret;
48871
48872 /*
48873 - * Read/write DACs are always overridable.
48874 - * Executable DACs are overridable if at least one exec bit is set.
48875 - */
48876 - if (!(mask & MAY_EXEC) || execute_ok(inode))
48877 - if (capable(CAP_DAC_OVERRIDE))
48878 - return 0;
48879 -
48880 - /*
48881 * Searching includes executable on directories, else just read.
48882 */
48883 mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
48884 @@ -239,6 +231,14 @@ int generic_permission(struct inode *ino
48885 if (capable(CAP_DAC_READ_SEARCH))
48886 return 0;
48887
48888 + /*
48889 + * Read/write DACs are always overridable.
48890 + * Executable DACs are overridable if at least one exec bit is set.
48891 + */
48892 + if (!(mask & MAY_EXEC) || execute_ok(inode))
48893 + if (capable(CAP_DAC_OVERRIDE))
48894 + return 0;
48895 +
48896 return -EACCES;
48897 }
48898
48899 @@ -458,7 +458,8 @@ static int exec_permission_lite(struct i
48900 if (!ret)
48901 goto ok;
48902
48903 - if (capable(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH))
48904 + if (capable_nolog(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH) ||
48905 + capable(CAP_DAC_OVERRIDE))
48906 goto ok;
48907
48908 return ret;
48909 @@ -638,7 +639,7 @@ static __always_inline int __do_follow_l
48910 cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
48911 error = PTR_ERR(cookie);
48912 if (!IS_ERR(cookie)) {
48913 - char *s = nd_get_link(nd);
48914 + const char *s = nd_get_link(nd);
48915 error = 0;
48916 if (s)
48917 error = __vfs_follow_link(nd, s);
48918 @@ -669,6 +670,13 @@ static inline int do_follow_link(struct
48919 err = security_inode_follow_link(path->dentry, nd);
48920 if (err)
48921 goto loop;
48922 +
48923 + if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
48924 + path->dentry->d_inode, path->dentry, nd->path.mnt)) {
48925 + err = -EACCES;
48926 + goto loop;
48927 + }
48928 +
48929 current->link_count++;
48930 current->total_link_count++;
48931 nd->depth++;
48932 @@ -1016,11 +1024,19 @@ return_reval:
48933 break;
48934 }
48935 return_base:
48936 + if (!(nd->flags & (LOOKUP_CONTINUE | LOOKUP_PARENT)) &&
48937 + !gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
48938 + path_put(&nd->path);
48939 + return -ENOENT;
48940 + }
48941 return 0;
48942 out_dput:
48943 path_put_conditional(&next, nd);
48944 break;
48945 }
48946 + if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
48947 + err = -ENOENT;
48948 +
48949 path_put(&nd->path);
48950 return_err:
48951 return err;
48952 @@ -1091,13 +1107,20 @@ static int do_path_lookup(int dfd, const
48953 int retval = path_init(dfd, name, flags, nd);
48954 if (!retval)
48955 retval = path_walk(name, nd);
48956 - if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
48957 - nd->path.dentry->d_inode))
48958 - audit_inode(name, nd->path.dentry);
48959 +
48960 + if (likely(!retval)) {
48961 + if (nd->path.dentry && nd->path.dentry->d_inode) {
48962 + if (*name != '/' && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
48963 + retval = -ENOENT;
48964 + if (!audit_dummy_context())
48965 + audit_inode(name, nd->path.dentry);
48966 + }
48967 + }
48968 if (nd->root.mnt) {
48969 path_put(&nd->root);
48970 nd->root.mnt = NULL;
48971 }
48972 +
48973 return retval;
48974 }
48975
48976 @@ -1576,6 +1599,20 @@ int may_open(struct path *path, int acc_
48977 if (error)
48978 goto err_out;
48979
48980 +
48981 + if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
48982 + error = -EPERM;
48983 + goto err_out;
48984 + }
48985 + if (gr_handle_rawio(inode)) {
48986 + error = -EPERM;
48987 + goto err_out;
48988 + }
48989 + if (!gr_acl_handle_open(dentry, path->mnt, acc_mode)) {
48990 + error = -EACCES;
48991 + goto err_out;
48992 + }
48993 +
48994 if (flag & O_TRUNC) {
48995 error = get_write_access(inode);
48996 if (error)
48997 @@ -1620,6 +1657,17 @@ static int __open_namei_create(struct na
48998 {
48999 int error;
49000 struct dentry *dir = nd->path.dentry;
49001 + int acc_mode = ACC_MODE(flag);
49002 +
49003 + if (flag & O_TRUNC)
49004 + acc_mode |= MAY_WRITE;
49005 + if (flag & O_APPEND)
49006 + acc_mode |= MAY_APPEND;
49007 +
49008 + if (!gr_acl_handle_creat(path->dentry, dir, nd->path.mnt, flag, acc_mode, mode)) {
49009 + error = -EACCES;
49010 + goto out_unlock;
49011 + }
49012
49013 if (!IS_POSIXACL(dir->d_inode))
49014 mode &= ~current_umask();
49015 @@ -1627,6 +1675,8 @@ static int __open_namei_create(struct na
49016 if (error)
49017 goto out_unlock;
49018 error = vfs_create(dir->d_inode, path->dentry, mode, nd);
49019 + if (!error)
49020 + gr_handle_create(path->dentry, nd->path.mnt);
49021 out_unlock:
49022 mutex_unlock(&dir->d_inode->i_mutex);
49023 dput(nd->path.dentry);
49024 @@ -1709,6 +1759,22 @@ struct file *do_filp_open(int dfd, const
49025 &nd, flag);
49026 if (error)
49027 return ERR_PTR(error);
49028 +
49029 + if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
49030 + error = -EPERM;
49031 + goto exit;
49032 + }
49033 +
49034 + if (gr_handle_rawio(nd.path.dentry->d_inode)) {
49035 + error = -EPERM;
49036 + goto exit;
49037 + }
49038 +
49039 + if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, acc_mode)) {
49040 + error = -EACCES;
49041 + goto exit;
49042 + }
49043 +
49044 goto ok;
49045 }
49046
49047 @@ -1795,6 +1861,19 @@ do_last:
49048 /*
49049 * It already exists.
49050 */
49051 +
49052 + if (!gr_acl_handle_hidden_file(path.dentry, path.mnt)) {
49053 + error = -ENOENT;
49054 + goto exit_mutex_unlock;
49055 + }
49056 +
49057 + /* only check if O_CREAT is specified, all other checks need
49058 + to go into may_open */
49059 + if (gr_handle_fifo(path.dentry, path.mnt, dir, flag, acc_mode)) {
49060 + error = -EACCES;
49061 + goto exit_mutex_unlock;
49062 + }
49063 +
49064 mutex_unlock(&dir->d_inode->i_mutex);
49065 audit_inode(pathname, path.dentry);
49066
49067 @@ -1887,6 +1966,13 @@ do_link:
49068 error = security_inode_follow_link(path.dentry, &nd);
49069 if (error)
49070 goto exit_dput;
49071 +
49072 + if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
49073 + path.dentry, nd.path.mnt)) {
49074 + error = -EACCES;
49075 + goto exit_dput;
49076 + }
49077 +
49078 error = __do_follow_link(&path, &nd);
49079 if (error) {
49080 /* Does someone understand code flow here? Or it is only
49081 @@ -1984,6 +2070,10 @@ struct dentry *lookup_create(struct name
49082 }
49083 return dentry;
49084 eexist:
49085 + if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) {
49086 + dput(dentry);
49087 + return ERR_PTR(-ENOENT);
49088 + }
49089 dput(dentry);
49090 dentry = ERR_PTR(-EEXIST);
49091 fail:
49092 @@ -2061,6 +2151,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
49093 error = may_mknod(mode);
49094 if (error)
49095 goto out_dput;
49096 +
49097 + if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
49098 + error = -EPERM;
49099 + goto out_dput;
49100 + }
49101 +
49102 + if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
49103 + error = -EACCES;
49104 + goto out_dput;
49105 + }
49106 +
49107 error = mnt_want_write(nd.path.mnt);
49108 if (error)
49109 goto out_dput;
49110 @@ -2081,6 +2182,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
49111 }
49112 out_drop_write:
49113 mnt_drop_write(nd.path.mnt);
49114 +
49115 + if (!error)
49116 + gr_handle_create(dentry, nd.path.mnt);
49117 out_dput:
49118 dput(dentry);
49119 out_unlock:
49120 @@ -2134,6 +2238,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
49121 if (IS_ERR(dentry))
49122 goto out_unlock;
49123
49124 + if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
49125 + error = -EACCES;
49126 + goto out_dput;
49127 + }
49128 +
49129 if (!IS_POSIXACL(nd.path.dentry->d_inode))
49130 mode &= ~current_umask();
49131 error = mnt_want_write(nd.path.mnt);
49132 @@ -2145,6 +2254,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
49133 error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
49134 out_drop_write:
49135 mnt_drop_write(nd.path.mnt);
49136 +
49137 + if (!error)
49138 + gr_handle_create(dentry, nd.path.mnt);
49139 +
49140 out_dput:
49141 dput(dentry);
49142 out_unlock:
49143 @@ -2226,6 +2339,8 @@ static long do_rmdir(int dfd, const char
49144 char * name;
49145 struct dentry *dentry;
49146 struct nameidata nd;
49147 + ino_t saved_ino = 0;
49148 + dev_t saved_dev = 0;
49149
49150 error = user_path_parent(dfd, pathname, &nd, &name);
49151 if (error)
49152 @@ -2250,6 +2365,17 @@ static long do_rmdir(int dfd, const char
49153 error = PTR_ERR(dentry);
49154 if (IS_ERR(dentry))
49155 goto exit2;
49156 +
49157 + if (dentry->d_inode != NULL) {
49158 + saved_ino = dentry->d_inode->i_ino;
49159 + saved_dev = gr_get_dev_from_dentry(dentry);
49160 +
49161 + if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
49162 + error = -EACCES;
49163 + goto exit3;
49164 + }
49165 + }
49166 +
49167 error = mnt_want_write(nd.path.mnt);
49168 if (error)
49169 goto exit3;
49170 @@ -2257,6 +2383,8 @@ static long do_rmdir(int dfd, const char
49171 if (error)
49172 goto exit4;
49173 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
49174 + if (!error && (saved_dev || saved_ino))
49175 + gr_handle_delete(saved_ino, saved_dev);
49176 exit4:
49177 mnt_drop_write(nd.path.mnt);
49178 exit3:
49179 @@ -2318,6 +2446,8 @@ static long do_unlinkat(int dfd, const c
49180 struct dentry *dentry;
49181 struct nameidata nd;
49182 struct inode *inode = NULL;
49183 + ino_t saved_ino = 0;
49184 + dev_t saved_dev = 0;
49185
49186 error = user_path_parent(dfd, pathname, &nd, &name);
49187 if (error)
49188 @@ -2337,8 +2467,19 @@ static long do_unlinkat(int dfd, const c
49189 if (nd.last.name[nd.last.len])
49190 goto slashes;
49191 inode = dentry->d_inode;
49192 - if (inode)
49193 + if (inode) {
49194 + if (inode->i_nlink <= 1) {
49195 + saved_ino = inode->i_ino;
49196 + saved_dev = gr_get_dev_from_dentry(dentry);
49197 + }
49198 +
49199 atomic_inc(&inode->i_count);
49200 +
49201 + if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
49202 + error = -EACCES;
49203 + goto exit2;
49204 + }
49205 + }
49206 error = mnt_want_write(nd.path.mnt);
49207 if (error)
49208 goto exit2;
49209 @@ -2346,6 +2487,8 @@ static long do_unlinkat(int dfd, const c
49210 if (error)
49211 goto exit3;
49212 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
49213 + if (!error && (saved_ino || saved_dev))
49214 + gr_handle_delete(saved_ino, saved_dev);
49215 exit3:
49216 mnt_drop_write(nd.path.mnt);
49217 exit2:
49218 @@ -2424,6 +2567,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
49219 if (IS_ERR(dentry))
49220 goto out_unlock;
49221
49222 + if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
49223 + error = -EACCES;
49224 + goto out_dput;
49225 + }
49226 +
49227 error = mnt_want_write(nd.path.mnt);
49228 if (error)
49229 goto out_dput;
49230 @@ -2431,6 +2579,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
49231 if (error)
49232 goto out_drop_write;
49233 error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
49234 + if (!error)
49235 + gr_handle_create(dentry, nd.path.mnt);
49236 out_drop_write:
49237 mnt_drop_write(nd.path.mnt);
49238 out_dput:
49239 @@ -2524,6 +2674,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
49240 error = PTR_ERR(new_dentry);
49241 if (IS_ERR(new_dentry))
49242 goto out_unlock;
49243 +
49244 + if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
49245 + old_path.dentry->d_inode,
49246 + old_path.dentry->d_inode->i_mode, to)) {
49247 + error = -EACCES;
49248 + goto out_dput;
49249 + }
49250 +
49251 + if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
49252 + old_path.dentry, old_path.mnt, to)) {
49253 + error = -EACCES;
49254 + goto out_dput;
49255 + }
49256 +
49257 error = mnt_want_write(nd.path.mnt);
49258 if (error)
49259 goto out_dput;
49260 @@ -2531,6 +2695,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
49261 if (error)
49262 goto out_drop_write;
49263 error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
49264 + if (!error)
49265 + gr_handle_create(new_dentry, nd.path.mnt);
49266 out_drop_write:
49267 mnt_drop_write(nd.path.mnt);
49268 out_dput:
49269 @@ -2708,6 +2874,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
49270 char *to;
49271 int error;
49272
49273 + pax_track_stack();
49274 +
49275 error = user_path_parent(olddfd, oldname, &oldnd, &from);
49276 if (error)
49277 goto exit;
49278 @@ -2764,6 +2932,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
49279 if (new_dentry == trap)
49280 goto exit5;
49281
49282 + error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
49283 + old_dentry, old_dir->d_inode, oldnd.path.mnt,
49284 + to);
49285 + if (error)
49286 + goto exit5;
49287 +
49288 error = mnt_want_write(oldnd.path.mnt);
49289 if (error)
49290 goto exit5;
49291 @@ -2773,6 +2947,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
49292 goto exit6;
49293 error = vfs_rename(old_dir->d_inode, old_dentry,
49294 new_dir->d_inode, new_dentry);
49295 + if (!error)
49296 + gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
49297 + new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
49298 exit6:
49299 mnt_drop_write(oldnd.path.mnt);
49300 exit5:
49301 @@ -2798,6 +2975,8 @@ SYSCALL_DEFINE2(rename, const char __use
49302
49303 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
49304 {
49305 + char tmpbuf[64];
49306 + const char *newlink;
49307 int len;
49308
49309 len = PTR_ERR(link);
49310 @@ -2807,7 +2986,14 @@ int vfs_readlink(struct dentry *dentry,
49311 len = strlen(link);
49312 if (len > (unsigned) buflen)
49313 len = buflen;
49314 - if (copy_to_user(buffer, link, len))
49315 +
49316 + if (len < sizeof(tmpbuf)) {
49317 + memcpy(tmpbuf, link, len);
49318 + newlink = tmpbuf;
49319 + } else
49320 + newlink = link;
49321 +
49322 + if (copy_to_user(buffer, newlink, len))
49323 len = -EFAULT;
49324 out:
49325 return len;
49326 diff -urNp linux-2.6.32.49/fs/namespace.c linux-2.6.32.49/fs/namespace.c
49327 --- linux-2.6.32.49/fs/namespace.c 2011-11-08 19:02:43.000000000 -0500
49328 +++ linux-2.6.32.49/fs/namespace.c 2011-11-15 19:59:43.000000000 -0500
49329 @@ -1083,6 +1083,9 @@ static int do_umount(struct vfsmount *mn
49330 if (!(sb->s_flags & MS_RDONLY))
49331 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
49332 up_write(&sb->s_umount);
49333 +
49334 + gr_log_remount(mnt->mnt_devname, retval);
49335 +
49336 return retval;
49337 }
49338
49339 @@ -1104,6 +1107,9 @@ static int do_umount(struct vfsmount *mn
49340 security_sb_umount_busy(mnt);
49341 up_write(&namespace_sem);
49342 release_mounts(&umount_list);
49343 +
49344 + gr_log_unmount(mnt->mnt_devname, retval);
49345 +
49346 return retval;
49347 }
49348
49349 @@ -1962,6 +1968,16 @@ long do_mount(char *dev_name, char *dir_
49350 if (retval)
49351 goto dput_out;
49352
49353 + if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
49354 + retval = -EPERM;
49355 + goto dput_out;
49356 + }
49357 +
49358 + if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
49359 + retval = -EPERM;
49360 + goto dput_out;
49361 + }
49362 +
49363 if (flags & MS_REMOUNT)
49364 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
49365 data_page);
49366 @@ -1976,6 +1992,9 @@ long do_mount(char *dev_name, char *dir_
49367 dev_name, data_page);
49368 dput_out:
49369 path_put(&path);
49370 +
49371 + gr_log_mount(dev_name, dir_name, retval);
49372 +
49373 return retval;
49374 }
49375
49376 @@ -2182,6 +2201,12 @@ SYSCALL_DEFINE2(pivot_root, const char _
49377 goto out1;
49378 }
49379
49380 + if (gr_handle_chroot_pivot()) {
49381 + error = -EPERM;
49382 + path_put(&old);
49383 + goto out1;
49384 + }
49385 +
49386 read_lock(&current->fs->lock);
49387 root = current->fs->root;
49388 path_get(&current->fs->root);
49389 diff -urNp linux-2.6.32.49/fs/ncpfs/dir.c linux-2.6.32.49/fs/ncpfs/dir.c
49390 --- linux-2.6.32.49/fs/ncpfs/dir.c 2011-11-08 19:02:43.000000000 -0500
49391 +++ linux-2.6.32.49/fs/ncpfs/dir.c 2011-11-15 19:59:43.000000000 -0500
49392 @@ -275,6 +275,8 @@ __ncp_lookup_validate(struct dentry *den
49393 int res, val = 0, len;
49394 __u8 __name[NCP_MAXPATHLEN + 1];
49395
49396 + pax_track_stack();
49397 +
49398 parent = dget_parent(dentry);
49399 dir = parent->d_inode;
49400
49401 @@ -799,6 +801,8 @@ static struct dentry *ncp_lookup(struct
49402 int error, res, len;
49403 __u8 __name[NCP_MAXPATHLEN + 1];
49404
49405 + pax_track_stack();
49406 +
49407 lock_kernel();
49408 error = -EIO;
49409 if (!ncp_conn_valid(server))
49410 @@ -883,10 +887,12 @@ int ncp_create_new(struct inode *dir, st
49411 int error, result, len;
49412 int opmode;
49413 __u8 __name[NCP_MAXPATHLEN + 1];
49414 -
49415 +
49416 PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
49417 dentry->d_parent->d_name.name, dentry->d_name.name, mode);
49418
49419 + pax_track_stack();
49420 +
49421 error = -EIO;
49422 lock_kernel();
49423 if (!ncp_conn_valid(server))
49424 @@ -952,6 +958,8 @@ static int ncp_mkdir(struct inode *dir,
49425 int error, len;
49426 __u8 __name[NCP_MAXPATHLEN + 1];
49427
49428 + pax_track_stack();
49429 +
49430 DPRINTK("ncp_mkdir: making %s/%s\n",
49431 dentry->d_parent->d_name.name, dentry->d_name.name);
49432
49433 @@ -960,6 +968,8 @@ static int ncp_mkdir(struct inode *dir,
49434 if (!ncp_conn_valid(server))
49435 goto out;
49436
49437 + pax_track_stack();
49438 +
49439 ncp_age_dentry(server, dentry);
49440 len = sizeof(__name);
49441 error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
49442 @@ -1114,6 +1124,8 @@ static int ncp_rename(struct inode *old_
49443 int old_len, new_len;
49444 __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
49445
49446 + pax_track_stack();
49447 +
49448 DPRINTK("ncp_rename: %s/%s to %s/%s\n",
49449 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
49450 new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
49451 diff -urNp linux-2.6.32.49/fs/ncpfs/inode.c linux-2.6.32.49/fs/ncpfs/inode.c
49452 --- linux-2.6.32.49/fs/ncpfs/inode.c 2011-11-08 19:02:43.000000000 -0500
49453 +++ linux-2.6.32.49/fs/ncpfs/inode.c 2011-11-15 19:59:43.000000000 -0500
49454 @@ -445,6 +445,8 @@ static int ncp_fill_super(struct super_b
49455 #endif
49456 struct ncp_entry_info finfo;
49457
49458 + pax_track_stack();
49459 +
49460 data.wdog_pid = NULL;
49461 server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
49462 if (!server)
49463 diff -urNp linux-2.6.32.49/fs/nfs/inode.c linux-2.6.32.49/fs/nfs/inode.c
49464 --- linux-2.6.32.49/fs/nfs/inode.c 2011-11-08 19:02:43.000000000 -0500
49465 +++ linux-2.6.32.49/fs/nfs/inode.c 2011-11-15 19:59:43.000000000 -0500
49466 @@ -156,7 +156,7 @@ static void nfs_zap_caches_locked(struct
49467 nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
49468 nfsi->attrtimeo_timestamp = jiffies;
49469
49470 - memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
49471 + memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
49472 if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
49473 nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
49474 else
49475 @@ -973,16 +973,16 @@ static int nfs_size_need_update(const st
49476 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
49477 }
49478
49479 -static atomic_long_t nfs_attr_generation_counter;
49480 +static atomic_long_unchecked_t nfs_attr_generation_counter;
49481
49482 static unsigned long nfs_read_attr_generation_counter(void)
49483 {
49484 - return atomic_long_read(&nfs_attr_generation_counter);
49485 + return atomic_long_read_unchecked(&nfs_attr_generation_counter);
49486 }
49487
49488 unsigned long nfs_inc_attr_generation_counter(void)
49489 {
49490 - return atomic_long_inc_return(&nfs_attr_generation_counter);
49491 + return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
49492 }
49493
49494 void nfs_fattr_init(struct nfs_fattr *fattr)
49495 diff -urNp linux-2.6.32.49/fs/nfsd/lockd.c linux-2.6.32.49/fs/nfsd/lockd.c
49496 --- linux-2.6.32.49/fs/nfsd/lockd.c 2011-11-08 19:02:43.000000000 -0500
49497 +++ linux-2.6.32.49/fs/nfsd/lockd.c 2011-11-15 19:59:43.000000000 -0500
49498 @@ -66,7 +66,7 @@ nlm_fclose(struct file *filp)
49499 fput(filp);
49500 }
49501
49502 -static struct nlmsvc_binding nfsd_nlm_ops = {
49503 +static const struct nlmsvc_binding nfsd_nlm_ops = {
49504 .fopen = nlm_fopen, /* open file for locking */
49505 .fclose = nlm_fclose, /* close file */
49506 };
49507 diff -urNp linux-2.6.32.49/fs/nfsd/nfs4state.c linux-2.6.32.49/fs/nfsd/nfs4state.c
49508 --- linux-2.6.32.49/fs/nfsd/nfs4state.c 2011-11-08 19:02:43.000000000 -0500
49509 +++ linux-2.6.32.49/fs/nfsd/nfs4state.c 2011-11-15 19:59:43.000000000 -0500
49510 @@ -3459,6 +3459,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
49511 unsigned int cmd;
49512 int err;
49513
49514 + pax_track_stack();
49515 +
49516 dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
49517 (long long) lock->lk_offset,
49518 (long long) lock->lk_length);
49519 diff -urNp linux-2.6.32.49/fs/nfsd/nfs4xdr.c linux-2.6.32.49/fs/nfsd/nfs4xdr.c
49520 --- linux-2.6.32.49/fs/nfsd/nfs4xdr.c 2011-11-08 19:02:43.000000000 -0500
49521 +++ linux-2.6.32.49/fs/nfsd/nfs4xdr.c 2011-11-15 19:59:43.000000000 -0500
49522 @@ -1751,6 +1751,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
49523 struct nfsd4_compoundres *resp = rqstp->rq_resp;
49524 u32 minorversion = resp->cstate.minorversion;
49525
49526 + pax_track_stack();
49527 +
49528 BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
49529 BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
49530 BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
49531 diff -urNp linux-2.6.32.49/fs/nfsd/vfs.c linux-2.6.32.49/fs/nfsd/vfs.c
49532 --- linux-2.6.32.49/fs/nfsd/vfs.c 2011-11-08 19:02:43.000000000 -0500
49533 +++ linux-2.6.32.49/fs/nfsd/vfs.c 2011-11-15 19:59:43.000000000 -0500
49534 @@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
49535 } else {
49536 oldfs = get_fs();
49537 set_fs(KERNEL_DS);
49538 - host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
49539 + host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset);
49540 set_fs(oldfs);
49541 }
49542
49543 @@ -1060,7 +1060,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
49544
49545 /* Write the data. */
49546 oldfs = get_fs(); set_fs(KERNEL_DS);
49547 - host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
49548 + host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &offset);
49549 set_fs(oldfs);
49550 if (host_err < 0)
49551 goto out_nfserr;
49552 @@ -1542,7 +1542,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
49553 */
49554
49555 oldfs = get_fs(); set_fs(KERNEL_DS);
49556 - host_err = inode->i_op->readlink(dentry, buf, *lenp);
49557 + host_err = inode->i_op->readlink(dentry, (char __force_user *)buf, *lenp);
49558 set_fs(oldfs);
49559
49560 if (host_err < 0)
49561 diff -urNp linux-2.6.32.49/fs/nilfs2/ioctl.c linux-2.6.32.49/fs/nilfs2/ioctl.c
49562 --- linux-2.6.32.49/fs/nilfs2/ioctl.c 2011-11-08 19:02:43.000000000 -0500
49563 +++ linux-2.6.32.49/fs/nilfs2/ioctl.c 2011-11-15 19:59:43.000000000 -0500
49564 @@ -480,7 +480,7 @@ static int nilfs_ioctl_clean_segments(st
49565 unsigned int cmd, void __user *argp)
49566 {
49567 struct nilfs_argv argv[5];
49568 - const static size_t argsz[5] = {
49569 + static const size_t argsz[5] = {
49570 sizeof(struct nilfs_vdesc),
49571 sizeof(struct nilfs_period),
49572 sizeof(__u64),
49573 diff -urNp linux-2.6.32.49/fs/notify/dnotify/dnotify.c linux-2.6.32.49/fs/notify/dnotify/dnotify.c
49574 --- linux-2.6.32.49/fs/notify/dnotify/dnotify.c 2011-11-08 19:02:43.000000000 -0500
49575 +++ linux-2.6.32.49/fs/notify/dnotify/dnotify.c 2011-11-15 19:59:43.000000000 -0500
49576 @@ -173,7 +173,7 @@ static void dnotify_free_mark(struct fsn
49577 kmem_cache_free(dnotify_mark_entry_cache, dnentry);
49578 }
49579
49580 -static struct fsnotify_ops dnotify_fsnotify_ops = {
49581 +static const struct fsnotify_ops dnotify_fsnotify_ops = {
49582 .handle_event = dnotify_handle_event,
49583 .should_send_event = dnotify_should_send_event,
49584 .free_group_priv = NULL,
49585 diff -urNp linux-2.6.32.49/fs/notify/notification.c linux-2.6.32.49/fs/notify/notification.c
49586 --- linux-2.6.32.49/fs/notify/notification.c 2011-11-08 19:02:43.000000000 -0500
49587 +++ linux-2.6.32.49/fs/notify/notification.c 2011-11-15 19:59:43.000000000 -0500
49588 @@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event
49589 * get set to 0 so it will never get 'freed'
49590 */
49591 static struct fsnotify_event q_overflow_event;
49592 -static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
49593 +static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
49594
49595 /**
49596 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
49597 @@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = A
49598 */
49599 u32 fsnotify_get_cookie(void)
49600 {
49601 - return atomic_inc_return(&fsnotify_sync_cookie);
49602 + return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
49603 }
49604 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
49605
49606 diff -urNp linux-2.6.32.49/fs/ntfs/dir.c linux-2.6.32.49/fs/ntfs/dir.c
49607 --- linux-2.6.32.49/fs/ntfs/dir.c 2011-11-08 19:02:43.000000000 -0500
49608 +++ linux-2.6.32.49/fs/ntfs/dir.c 2011-11-15 19:59:43.000000000 -0500
49609 @@ -1328,7 +1328,7 @@ find_next_index_buffer:
49610 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
49611 ~(s64)(ndir->itype.index.block_size - 1)));
49612 /* Bounds checks. */
49613 - if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
49614 + if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
49615 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
49616 "inode 0x%lx or driver bug.", vdir->i_ino);
49617 goto err_out;
49618 diff -urNp linux-2.6.32.49/fs/ntfs/file.c linux-2.6.32.49/fs/ntfs/file.c
49619 --- linux-2.6.32.49/fs/ntfs/file.c 2011-11-08 19:02:43.000000000 -0500
49620 +++ linux-2.6.32.49/fs/ntfs/file.c 2011-11-15 19:59:43.000000000 -0500
49621 @@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_
49622 #endif /* NTFS_RW */
49623 };
49624
49625 -const struct file_operations ntfs_empty_file_ops = {};
49626 +const struct file_operations ntfs_empty_file_ops __read_only;
49627
49628 -const struct inode_operations ntfs_empty_inode_ops = {};
49629 +const struct inode_operations ntfs_empty_inode_ops __read_only;
49630 diff -urNp linux-2.6.32.49/fs/ocfs2/cluster/masklog.c linux-2.6.32.49/fs/ocfs2/cluster/masklog.c
49631 --- linux-2.6.32.49/fs/ocfs2/cluster/masklog.c 2011-11-08 19:02:43.000000000 -0500
49632 +++ linux-2.6.32.49/fs/ocfs2/cluster/masklog.c 2011-11-15 19:59:43.000000000 -0500
49633 @@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject
49634 return mlog_mask_store(mlog_attr->mask, buf, count);
49635 }
49636
49637 -static struct sysfs_ops mlog_attr_ops = {
49638 +static const struct sysfs_ops mlog_attr_ops = {
49639 .show = mlog_show,
49640 .store = mlog_store,
49641 };
49642 diff -urNp linux-2.6.32.49/fs/ocfs2/localalloc.c linux-2.6.32.49/fs/ocfs2/localalloc.c
49643 --- linux-2.6.32.49/fs/ocfs2/localalloc.c 2011-11-08 19:02:43.000000000 -0500
49644 +++ linux-2.6.32.49/fs/ocfs2/localalloc.c 2011-11-15 19:59:43.000000000 -0500
49645 @@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_windo
49646 goto bail;
49647 }
49648
49649 - atomic_inc(&osb->alloc_stats.moves);
49650 + atomic_inc_unchecked(&osb->alloc_stats.moves);
49651
49652 status = 0;
49653 bail:
49654 diff -urNp linux-2.6.32.49/fs/ocfs2/namei.c linux-2.6.32.49/fs/ocfs2/namei.c
49655 --- linux-2.6.32.49/fs/ocfs2/namei.c 2011-11-08 19:02:43.000000000 -0500
49656 +++ linux-2.6.32.49/fs/ocfs2/namei.c 2011-11-15 19:59:43.000000000 -0500
49657 @@ -1043,6 +1043,8 @@ static int ocfs2_rename(struct inode *ol
49658 struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
49659 struct ocfs2_dir_lookup_result target_insert = { NULL, };
49660
49661 + pax_track_stack();
49662 +
49663 /* At some point it might be nice to break this function up a
49664 * bit. */
49665
49666 diff -urNp linux-2.6.32.49/fs/ocfs2/ocfs2.h linux-2.6.32.49/fs/ocfs2/ocfs2.h
49667 --- linux-2.6.32.49/fs/ocfs2/ocfs2.h 2011-11-08 19:02:43.000000000 -0500
49668 +++ linux-2.6.32.49/fs/ocfs2/ocfs2.h 2011-11-15 19:59:43.000000000 -0500
49669 @@ -217,11 +217,11 @@ enum ocfs2_vol_state
49670
49671 struct ocfs2_alloc_stats
49672 {
49673 - atomic_t moves;
49674 - atomic_t local_data;
49675 - atomic_t bitmap_data;
49676 - atomic_t bg_allocs;
49677 - atomic_t bg_extends;
49678 + atomic_unchecked_t moves;
49679 + atomic_unchecked_t local_data;
49680 + atomic_unchecked_t bitmap_data;
49681 + atomic_unchecked_t bg_allocs;
49682 + atomic_unchecked_t bg_extends;
49683 };
49684
49685 enum ocfs2_local_alloc_state
49686 diff -urNp linux-2.6.32.49/fs/ocfs2/suballoc.c linux-2.6.32.49/fs/ocfs2/suballoc.c
49687 --- linux-2.6.32.49/fs/ocfs2/suballoc.c 2011-11-08 19:02:43.000000000 -0500
49688 +++ linux-2.6.32.49/fs/ocfs2/suballoc.c 2011-11-15 19:59:43.000000000 -0500
49689 @@ -623,7 +623,7 @@ static int ocfs2_reserve_suballoc_bits(s
49690 mlog_errno(status);
49691 goto bail;
49692 }
49693 - atomic_inc(&osb->alloc_stats.bg_extends);
49694 + atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
49695
49696 /* You should never ask for this much metadata */
49697 BUG_ON(bits_wanted >
49698 @@ -1654,7 +1654,7 @@ int ocfs2_claim_metadata(struct ocfs2_su
49699 mlog_errno(status);
49700 goto bail;
49701 }
49702 - atomic_inc(&osb->alloc_stats.bg_allocs);
49703 + atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
49704
49705 *blkno_start = bg_blkno + (u64) *suballoc_bit_start;
49706 ac->ac_bits_given += (*num_bits);
49707 @@ -1728,7 +1728,7 @@ int ocfs2_claim_new_inode(struct ocfs2_s
49708 mlog_errno(status);
49709 goto bail;
49710 }
49711 - atomic_inc(&osb->alloc_stats.bg_allocs);
49712 + atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
49713
49714 BUG_ON(num_bits != 1);
49715
49716 @@ -1830,7 +1830,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
49717 cluster_start,
49718 num_clusters);
49719 if (!status)
49720 - atomic_inc(&osb->alloc_stats.local_data);
49721 + atomic_inc_unchecked(&osb->alloc_stats.local_data);
49722 } else {
49723 if (min_clusters > (osb->bitmap_cpg - 1)) {
49724 /* The only paths asking for contiguousness
49725 @@ -1858,7 +1858,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
49726 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
49727 bg_blkno,
49728 bg_bit_off);
49729 - atomic_inc(&osb->alloc_stats.bitmap_data);
49730 + atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
49731 }
49732 }
49733 if (status < 0) {
49734 diff -urNp linux-2.6.32.49/fs/ocfs2/super.c linux-2.6.32.49/fs/ocfs2/super.c
49735 --- linux-2.6.32.49/fs/ocfs2/super.c 2011-11-08 19:02:43.000000000 -0500
49736 +++ linux-2.6.32.49/fs/ocfs2/super.c 2011-11-15 19:59:43.000000000 -0500
49737 @@ -284,11 +284,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
49738 "%10s => GlobalAllocs: %d LocalAllocs: %d "
49739 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
49740 "Stats",
49741 - atomic_read(&osb->alloc_stats.bitmap_data),
49742 - atomic_read(&osb->alloc_stats.local_data),
49743 - atomic_read(&osb->alloc_stats.bg_allocs),
49744 - atomic_read(&osb->alloc_stats.moves),
49745 - atomic_read(&osb->alloc_stats.bg_extends));
49746 + atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
49747 + atomic_read_unchecked(&osb->alloc_stats.local_data),
49748 + atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
49749 + atomic_read_unchecked(&osb->alloc_stats.moves),
49750 + atomic_read_unchecked(&osb->alloc_stats.bg_extends));
49751
49752 out += snprintf(buf + out, len - out,
49753 "%10s => State: %u Descriptor: %llu Size: %u bits "
49754 @@ -2002,11 +2002,11 @@ static int ocfs2_initialize_super(struct
49755 spin_lock_init(&osb->osb_xattr_lock);
49756 ocfs2_init_inode_steal_slot(osb);
49757
49758 - atomic_set(&osb->alloc_stats.moves, 0);
49759 - atomic_set(&osb->alloc_stats.local_data, 0);
49760 - atomic_set(&osb->alloc_stats.bitmap_data, 0);
49761 - atomic_set(&osb->alloc_stats.bg_allocs, 0);
49762 - atomic_set(&osb->alloc_stats.bg_extends, 0);
49763 + atomic_set_unchecked(&osb->alloc_stats.moves, 0);
49764 + atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
49765 + atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
49766 + atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
49767 + atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
49768
49769 /* Copy the blockcheck stats from the superblock probe */
49770 osb->osb_ecc_stats = *stats;
49771 diff -urNp linux-2.6.32.49/fs/open.c linux-2.6.32.49/fs/open.c
49772 --- linux-2.6.32.49/fs/open.c 2011-11-08 19:02:43.000000000 -0500
49773 +++ linux-2.6.32.49/fs/open.c 2011-11-18 19:28:37.000000000 -0500
49774 @@ -275,6 +275,10 @@ static long do_sys_truncate(const char _
49775 error = locks_verify_truncate(inode, NULL, length);
49776 if (!error)
49777 error = security_path_truncate(&path, length, 0);
49778 +
49779 + if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
49780 + error = -EACCES;
49781 +
49782 if (!error) {
49783 vfs_dq_init(inode);
49784 error = do_truncate(path.dentry, length, 0, NULL);
49785 @@ -511,6 +515,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
49786 if (__mnt_is_readonly(path.mnt))
49787 res = -EROFS;
49788
49789 + if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
49790 + res = -EACCES;
49791 +
49792 out_path_release:
49793 path_put(&path);
49794 out:
49795 @@ -537,6 +544,8 @@ SYSCALL_DEFINE1(chdir, const char __user
49796 if (error)
49797 goto dput_and_out;
49798
49799 + gr_log_chdir(path.dentry, path.mnt);
49800 +
49801 set_fs_pwd(current->fs, &path);
49802
49803 dput_and_out:
49804 @@ -563,6 +572,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
49805 goto out_putf;
49806
49807 error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
49808 +
49809 + if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
49810 + error = -EPERM;
49811 +
49812 + if (!error)
49813 + gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
49814 +
49815 if (!error)
49816 set_fs_pwd(current->fs, &file->f_path);
49817 out_putf:
49818 @@ -588,7 +604,13 @@ SYSCALL_DEFINE1(chroot, const char __use
49819 if (!capable(CAP_SYS_CHROOT))
49820 goto dput_and_out;
49821
49822 + if (gr_handle_chroot_chroot(path.dentry, path.mnt))
49823 + goto dput_and_out;
49824 +
49825 set_fs_root(current->fs, &path);
49826 +
49827 + gr_handle_chroot_chdir(&path);
49828 +
49829 error = 0;
49830 dput_and_out:
49831 path_put(&path);
49832 @@ -616,12 +638,27 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
49833 err = mnt_want_write_file(file);
49834 if (err)
49835 goto out_putf;
49836 +
49837 mutex_lock(&inode->i_mutex);
49838 +
49839 + if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
49840 + err = -EACCES;
49841 + goto out_unlock;
49842 + }
49843 +
49844 if (mode == (mode_t) -1)
49845 mode = inode->i_mode;
49846 +
49847 + if (gr_handle_chroot_chmod(dentry, file->f_path.mnt, mode)) {
49848 + err = -EPERM;
49849 + goto out_unlock;
49850 + }
49851 +
49852 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
49853 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
49854 err = notify_change(dentry, &newattrs);
49855 +
49856 +out_unlock:
49857 mutex_unlock(&inode->i_mutex);
49858 mnt_drop_write(file->f_path.mnt);
49859 out_putf:
49860 @@ -645,12 +682,27 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
49861 error = mnt_want_write(path.mnt);
49862 if (error)
49863 goto dput_and_out;
49864 +
49865 mutex_lock(&inode->i_mutex);
49866 +
49867 + if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
49868 + error = -EACCES;
49869 + goto out_unlock;
49870 + }
49871 +
49872 if (mode == (mode_t) -1)
49873 mode = inode->i_mode;
49874 +
49875 + if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
49876 + error = -EACCES;
49877 + goto out_unlock;
49878 + }
49879 +
49880 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
49881 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
49882 error = notify_change(path.dentry, &newattrs);
49883 +
49884 +out_unlock:
49885 mutex_unlock(&inode->i_mutex);
49886 mnt_drop_write(path.mnt);
49887 dput_and_out:
49888 @@ -664,12 +716,15 @@ SYSCALL_DEFINE2(chmod, const char __user
49889 return sys_fchmodat(AT_FDCWD, filename, mode);
49890 }
49891
49892 -static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
49893 +static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
49894 {
49895 struct inode *inode = dentry->d_inode;
49896 int error;
49897 struct iattr newattrs;
49898
49899 + if (!gr_acl_handle_chown(dentry, mnt))
49900 + return -EACCES;
49901 +
49902 newattrs.ia_valid = ATTR_CTIME;
49903 if (user != (uid_t) -1) {
49904 newattrs.ia_valid |= ATTR_UID;
49905 @@ -700,7 +755,7 @@ SYSCALL_DEFINE3(chown, const char __user
49906 error = mnt_want_write(path.mnt);
49907 if (error)
49908 goto out_release;
49909 - error = chown_common(path.dentry, user, group);
49910 + error = chown_common(path.dentry, user, group, path.mnt);
49911 mnt_drop_write(path.mnt);
49912 out_release:
49913 path_put(&path);
49914 @@ -725,7 +780,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
49915 error = mnt_want_write(path.mnt);
49916 if (error)
49917 goto out_release;
49918 - error = chown_common(path.dentry, user, group);
49919 + error = chown_common(path.dentry, user, group, path.mnt);
49920 mnt_drop_write(path.mnt);
49921 out_release:
49922 path_put(&path);
49923 @@ -744,7 +799,7 @@ SYSCALL_DEFINE3(lchown, const char __use
49924 error = mnt_want_write(path.mnt);
49925 if (error)
49926 goto out_release;
49927 - error = chown_common(path.dentry, user, group);
49928 + error = chown_common(path.dentry, user, group, path.mnt);
49929 mnt_drop_write(path.mnt);
49930 out_release:
49931 path_put(&path);
49932 @@ -767,7 +822,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
49933 goto out_fput;
49934 dentry = file->f_path.dentry;
49935 audit_inode(NULL, dentry);
49936 - error = chown_common(dentry, user, group);
49937 + error = chown_common(dentry, user, group, file->f_path.mnt);
49938 mnt_drop_write(file->f_path.mnt);
49939 out_fput:
49940 fput(file);
49941 @@ -1036,7 +1091,7 @@ long do_sys_open(int dfd, const char __u
49942 if (!IS_ERR(tmp)) {
49943 fd = get_unused_fd_flags(flags);
49944 if (fd >= 0) {
49945 - struct file *f = do_filp_open(dfd, tmp, flags, mode, 0);
49946 + struct file *f = do_filp_open(dfd, tmp, flags, mode, 0);
49947 if (IS_ERR(f)) {
49948 put_unused_fd(fd);
49949 fd = PTR_ERR(f);
49950 diff -urNp linux-2.6.32.49/fs/partitions/ldm.c linux-2.6.32.49/fs/partitions/ldm.c
49951 --- linux-2.6.32.49/fs/partitions/ldm.c 2011-11-08 19:02:43.000000000 -0500
49952 +++ linux-2.6.32.49/fs/partitions/ldm.c 2011-11-15 19:59:43.000000000 -0500
49953 @@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data
49954 ldm_error ("A VBLK claims to have %d parts.", num);
49955 return false;
49956 }
49957 +
49958 if (rec >= num) {
49959 ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
49960 return false;
49961 @@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data
49962 goto found;
49963 }
49964
49965 - f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
49966 + f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
49967 if (!f) {
49968 ldm_crit ("Out of memory.");
49969 return false;
49970 diff -urNp linux-2.6.32.49/fs/partitions/mac.c linux-2.6.32.49/fs/partitions/mac.c
49971 --- linux-2.6.32.49/fs/partitions/mac.c 2011-11-08 19:02:43.000000000 -0500
49972 +++ linux-2.6.32.49/fs/partitions/mac.c 2011-11-15 19:59:43.000000000 -0500
49973 @@ -59,11 +59,11 @@ int mac_partition(struct parsed_partitio
49974 return 0; /* not a MacOS disk */
49975 }
49976 blocks_in_map = be32_to_cpu(part->map_count);
49977 + printk(" [mac]");
49978 if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) {
49979 put_dev_sector(sect);
49980 return 0;
49981 }
49982 - printk(" [mac]");
49983 for (slot = 1; slot <= blocks_in_map; ++slot) {
49984 int pos = slot * secsize;
49985 put_dev_sector(sect);
49986 diff -urNp linux-2.6.32.49/fs/pipe.c linux-2.6.32.49/fs/pipe.c
49987 --- linux-2.6.32.49/fs/pipe.c 2011-11-08 19:02:43.000000000 -0500
49988 +++ linux-2.6.32.49/fs/pipe.c 2011-11-15 19:59:43.000000000 -0500
49989 @@ -401,9 +401,9 @@ redo:
49990 }
49991 if (bufs) /* More to do? */
49992 continue;
49993 - if (!pipe->writers)
49994 + if (!atomic_read(&pipe->writers))
49995 break;
49996 - if (!pipe->waiting_writers) {
49997 + if (!atomic_read(&pipe->waiting_writers)) {
49998 /* syscall merging: Usually we must not sleep
49999 * if O_NONBLOCK is set, or if we got some data.
50000 * But if a writer sleeps in kernel space, then
50001 @@ -462,7 +462,7 @@ pipe_write(struct kiocb *iocb, const str
50002 mutex_lock(&inode->i_mutex);
50003 pipe = inode->i_pipe;
50004
50005 - if (!pipe->readers) {
50006 + if (!atomic_read(&pipe->readers)) {
50007 send_sig(SIGPIPE, current, 0);
50008 ret = -EPIPE;
50009 goto out;
50010 @@ -511,7 +511,7 @@ redo1:
50011 for (;;) {
50012 int bufs;
50013
50014 - if (!pipe->readers) {
50015 + if (!atomic_read(&pipe->readers)) {
50016 send_sig(SIGPIPE, current, 0);
50017 if (!ret)
50018 ret = -EPIPE;
50019 @@ -597,9 +597,9 @@ redo2:
50020 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
50021 do_wakeup = 0;
50022 }
50023 - pipe->waiting_writers++;
50024 + atomic_inc(&pipe->waiting_writers);
50025 pipe_wait(pipe);
50026 - pipe->waiting_writers--;
50027 + atomic_dec(&pipe->waiting_writers);
50028 }
50029 out:
50030 mutex_unlock(&inode->i_mutex);
50031 @@ -666,7 +666,7 @@ pipe_poll(struct file *filp, poll_table
50032 mask = 0;
50033 if (filp->f_mode & FMODE_READ) {
50034 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
50035 - if (!pipe->writers && filp->f_version != pipe->w_counter)
50036 + if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
50037 mask |= POLLHUP;
50038 }
50039
50040 @@ -676,7 +676,7 @@ pipe_poll(struct file *filp, poll_table
50041 * Most Unices do not set POLLERR for FIFOs but on Linux they
50042 * behave exactly like pipes for poll().
50043 */
50044 - if (!pipe->readers)
50045 + if (!atomic_read(&pipe->readers))
50046 mask |= POLLERR;
50047 }
50048
50049 @@ -690,10 +690,10 @@ pipe_release(struct inode *inode, int de
50050
50051 mutex_lock(&inode->i_mutex);
50052 pipe = inode->i_pipe;
50053 - pipe->readers -= decr;
50054 - pipe->writers -= decw;
50055 + atomic_sub(decr, &pipe->readers);
50056 + atomic_sub(decw, &pipe->writers);
50057
50058 - if (!pipe->readers && !pipe->writers) {
50059 + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
50060 free_pipe_info(inode);
50061 } else {
50062 wake_up_interruptible_sync(&pipe->wait);
50063 @@ -783,7 +783,7 @@ pipe_read_open(struct inode *inode, stru
50064
50065 if (inode->i_pipe) {
50066 ret = 0;
50067 - inode->i_pipe->readers++;
50068 + atomic_inc(&inode->i_pipe->readers);
50069 }
50070
50071 mutex_unlock(&inode->i_mutex);
50072 @@ -800,7 +800,7 @@ pipe_write_open(struct inode *inode, str
50073
50074 if (inode->i_pipe) {
50075 ret = 0;
50076 - inode->i_pipe->writers++;
50077 + atomic_inc(&inode->i_pipe->writers);
50078 }
50079
50080 mutex_unlock(&inode->i_mutex);
50081 @@ -818,9 +818,9 @@ pipe_rdwr_open(struct inode *inode, stru
50082 if (inode->i_pipe) {
50083 ret = 0;
50084 if (filp->f_mode & FMODE_READ)
50085 - inode->i_pipe->readers++;
50086 + atomic_inc(&inode->i_pipe->readers);
50087 if (filp->f_mode & FMODE_WRITE)
50088 - inode->i_pipe->writers++;
50089 + atomic_inc(&inode->i_pipe->writers);
50090 }
50091
50092 mutex_unlock(&inode->i_mutex);
50093 @@ -905,7 +905,7 @@ void free_pipe_info(struct inode *inode)
50094 inode->i_pipe = NULL;
50095 }
50096
50097 -static struct vfsmount *pipe_mnt __read_mostly;
50098 +struct vfsmount *pipe_mnt __read_mostly;
50099 static int pipefs_delete_dentry(struct dentry *dentry)
50100 {
50101 /*
50102 @@ -945,7 +945,8 @@ static struct inode * get_pipe_inode(voi
50103 goto fail_iput;
50104 inode->i_pipe = pipe;
50105
50106 - pipe->readers = pipe->writers = 1;
50107 + atomic_set(&pipe->readers, 1);
50108 + atomic_set(&pipe->writers, 1);
50109 inode->i_fop = &rdwr_pipefifo_fops;
50110
50111 /*
50112 diff -urNp linux-2.6.32.49/fs/proc/array.c linux-2.6.32.49/fs/proc/array.c
50113 --- linux-2.6.32.49/fs/proc/array.c 2011-11-08 19:02:43.000000000 -0500
50114 +++ linux-2.6.32.49/fs/proc/array.c 2011-11-15 19:59:43.000000000 -0500
50115 @@ -60,6 +60,7 @@
50116 #include <linux/tty.h>
50117 #include <linux/string.h>
50118 #include <linux/mman.h>
50119 +#include <linux/grsecurity.h>
50120 #include <linux/proc_fs.h>
50121 #include <linux/ioport.h>
50122 #include <linux/uaccess.h>
50123 @@ -321,6 +322,21 @@ static inline void task_context_switch_c
50124 p->nivcsw);
50125 }
50126
50127 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
50128 +static inline void task_pax(struct seq_file *m, struct task_struct *p)
50129 +{
50130 + if (p->mm)
50131 + seq_printf(m, "PaX:\t%c%c%c%c%c\n",
50132 + p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
50133 + p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
50134 + p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
50135 + p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
50136 + p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
50137 + else
50138 + seq_printf(m, "PaX:\t-----\n");
50139 +}
50140 +#endif
50141 +
50142 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
50143 struct pid *pid, struct task_struct *task)
50144 {
50145 @@ -337,9 +353,24 @@ int proc_pid_status(struct seq_file *m,
50146 task_cap(m, task);
50147 cpuset_task_status_allowed(m, task);
50148 task_context_switch_counts(m, task);
50149 +
50150 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
50151 + task_pax(m, task);
50152 +#endif
50153 +
50154 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
50155 + task_grsec_rbac(m, task);
50156 +#endif
50157 +
50158 return 0;
50159 }
50160
50161 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50162 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
50163 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
50164 + _mm->pax_flags & MF_PAX_SEGMEXEC))
50165 +#endif
50166 +
50167 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
50168 struct pid *pid, struct task_struct *task, int whole)
50169 {
50170 @@ -358,9 +389,11 @@ static int do_task_stat(struct seq_file
50171 cputime_t cutime, cstime, utime, stime;
50172 cputime_t cgtime, gtime;
50173 unsigned long rsslim = 0;
50174 - char tcomm[sizeof(task->comm)];
50175 + char tcomm[sizeof(task->comm)] = { 0 };
50176 unsigned long flags;
50177
50178 + pax_track_stack();
50179 +
50180 state = *get_task_state(task);
50181 vsize = eip = esp = 0;
50182 permitted = ptrace_may_access(task, PTRACE_MODE_READ);
50183 @@ -433,6 +466,19 @@ static int do_task_stat(struct seq_file
50184 gtime = task_gtime(task);
50185 }
50186
50187 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50188 + if (PAX_RAND_FLAGS(mm)) {
50189 + eip = 0;
50190 + esp = 0;
50191 + wchan = 0;
50192 + }
50193 +#endif
50194 +#ifdef CONFIG_GRKERNSEC_HIDESYM
50195 + wchan = 0;
50196 + eip =0;
50197 + esp =0;
50198 +#endif
50199 +
50200 /* scale priority and nice values from timeslices to -20..20 */
50201 /* to make it look like a "normal" Unix priority/nice value */
50202 priority = task_prio(task);
50203 @@ -473,9 +519,15 @@ static int do_task_stat(struct seq_file
50204 vsize,
50205 mm ? get_mm_rss(mm) : 0,
50206 rsslim,
50207 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50208 + PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
50209 + PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
50210 + PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
50211 +#else
50212 mm ? (permitted ? mm->start_code : 1) : 0,
50213 mm ? (permitted ? mm->end_code : 1) : 0,
50214 (permitted && mm) ? mm->start_stack : 0,
50215 +#endif
50216 esp,
50217 eip,
50218 /* The signal information here is obsolete.
50219 @@ -528,3 +580,18 @@ int proc_pid_statm(struct seq_file *m, s
50220
50221 return 0;
50222 }
50223 +
50224 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
50225 +int proc_pid_ipaddr(struct task_struct *task, char *buffer)
50226 +{
50227 + u32 curr_ip = 0;
50228 + unsigned long flags;
50229 +
50230 + if (lock_task_sighand(task, &flags)) {
50231 + curr_ip = task->signal->curr_ip;
50232 + unlock_task_sighand(task, &flags);
50233 + }
50234 +
50235 + return sprintf(buffer, "%pI4\n", &curr_ip);
50236 +}
50237 +#endif
50238 diff -urNp linux-2.6.32.49/fs/proc/base.c linux-2.6.32.49/fs/proc/base.c
50239 --- linux-2.6.32.49/fs/proc/base.c 2011-11-08 19:02:43.000000000 -0500
50240 +++ linux-2.6.32.49/fs/proc/base.c 2011-11-15 19:59:43.000000000 -0500
50241 @@ -102,6 +102,22 @@ struct pid_entry {
50242 union proc_op op;
50243 };
50244
50245 +struct getdents_callback {
50246 + struct linux_dirent __user * current_dir;
50247 + struct linux_dirent __user * previous;
50248 + struct file * file;
50249 + int count;
50250 + int error;
50251 +};
50252 +
50253 +static int gr_fake_filldir(void * __buf, const char *name, int namlen,
50254 + loff_t offset, u64 ino, unsigned int d_type)
50255 +{
50256 + struct getdents_callback * buf = (struct getdents_callback *) __buf;
50257 + buf->error = -EINVAL;
50258 + return 0;
50259 +}
50260 +
50261 #define NOD(NAME, MODE, IOP, FOP, OP) { \
50262 .name = (NAME), \
50263 .len = sizeof(NAME) - 1, \
50264 @@ -213,6 +229,9 @@ static int check_mem_permission(struct t
50265 if (task == current)
50266 return 0;
50267
50268 + if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
50269 + return -EPERM;
50270 +
50271 /*
50272 * If current is actively ptrace'ing, and would also be
50273 * permitted to freshly attach with ptrace now, permit it.
50274 @@ -260,6 +279,9 @@ static int proc_pid_cmdline(struct task_
50275 if (!mm->arg_end)
50276 goto out_mm; /* Shh! No looking before we're done */
50277
50278 + if (gr_acl_handle_procpidmem(task))
50279 + goto out_mm;
50280 +
50281 len = mm->arg_end - mm->arg_start;
50282
50283 if (len > PAGE_SIZE)
50284 @@ -287,12 +309,28 @@ out:
50285 return res;
50286 }
50287
50288 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50289 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
50290 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
50291 + _mm->pax_flags & MF_PAX_SEGMEXEC))
50292 +#endif
50293 +
50294 static int proc_pid_auxv(struct task_struct *task, char *buffer)
50295 {
50296 int res = 0;
50297 struct mm_struct *mm = get_task_mm(task);
50298 if (mm) {
50299 unsigned int nwords = 0;
50300 +
50301 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50302 + /* allow if we're currently ptracing this task */
50303 + if (PAX_RAND_FLAGS(mm) &&
50304 + (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
50305 + mmput(mm);
50306 + return 0;
50307 + }
50308 +#endif
50309 +
50310 do {
50311 nwords += 2;
50312 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
50313 @@ -306,7 +344,7 @@ static int proc_pid_auxv(struct task_str
50314 }
50315
50316
50317 -#ifdef CONFIG_KALLSYMS
50318 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
50319 /*
50320 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
50321 * Returns the resolved symbol. If that fails, simply return the address.
50322 @@ -345,7 +383,7 @@ static void unlock_trace(struct task_str
50323 mutex_unlock(&task->cred_guard_mutex);
50324 }
50325
50326 -#ifdef CONFIG_STACKTRACE
50327 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
50328
50329 #define MAX_STACK_TRACE_DEPTH 64
50330
50331 @@ -545,7 +583,7 @@ static int proc_pid_limits(struct task_s
50332 return count;
50333 }
50334
50335 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
50336 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
50337 static int proc_pid_syscall(struct task_struct *task, char *buffer)
50338 {
50339 long nr;
50340 @@ -574,7 +612,7 @@ static int proc_pid_syscall(struct task_
50341 /************************************************************************/
50342
50343 /* permission checks */
50344 -static int proc_fd_access_allowed(struct inode *inode)
50345 +static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
50346 {
50347 struct task_struct *task;
50348 int allowed = 0;
50349 @@ -584,7 +622,10 @@ static int proc_fd_access_allowed(struct
50350 */
50351 task = get_proc_task(inode);
50352 if (task) {
50353 - allowed = ptrace_may_access(task, PTRACE_MODE_READ);
50354 + if (log)
50355 + allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
50356 + else
50357 + allowed = ptrace_may_access(task, PTRACE_MODE_READ);
50358 put_task_struct(task);
50359 }
50360 return allowed;
50361 @@ -963,6 +1004,9 @@ static ssize_t environ_read(struct file
50362 if (!task)
50363 goto out_no_task;
50364
50365 + if (gr_acl_handle_procpidmem(task))
50366 + goto out;
50367 +
50368 if (!ptrace_may_access(task, PTRACE_MODE_READ))
50369 goto out;
50370
50371 @@ -1377,7 +1421,7 @@ static void *proc_pid_follow_link(struct
50372 path_put(&nd->path);
50373
50374 /* Are we allowed to snoop on the tasks file descriptors? */
50375 - if (!proc_fd_access_allowed(inode))
50376 + if (!proc_fd_access_allowed(inode,0))
50377 goto out;
50378
50379 error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
50380 @@ -1417,8 +1461,18 @@ static int proc_pid_readlink(struct dent
50381 struct path path;
50382
50383 /* Are we allowed to snoop on the tasks file descriptors? */
50384 - if (!proc_fd_access_allowed(inode))
50385 - goto out;
50386 + /* logging this is needed for learning on chromium to work properly,
50387 + but we don't want to flood the logs from 'ps' which does a readlink
50388 + on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
50389 + CAP_SYS_PTRACE as it's not necessary for its basic functionality
50390 + */
50391 + if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
50392 + if (!proc_fd_access_allowed(inode,0))
50393 + goto out;
50394 + } else {
50395 + if (!proc_fd_access_allowed(inode,1))
50396 + goto out;
50397 + }
50398
50399 error = PROC_I(inode)->op.proc_get_link(inode, &path);
50400 if (error)
50401 @@ -1483,7 +1537,11 @@ static struct inode *proc_pid_make_inode
50402 rcu_read_lock();
50403 cred = __task_cred(task);
50404 inode->i_uid = cred->euid;
50405 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
50406 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
50407 +#else
50408 inode->i_gid = cred->egid;
50409 +#endif
50410 rcu_read_unlock();
50411 }
50412 security_task_to_inode(task, inode);
50413 @@ -1501,6 +1559,9 @@ static int pid_getattr(struct vfsmount *
50414 struct inode *inode = dentry->d_inode;
50415 struct task_struct *task;
50416 const struct cred *cred;
50417 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50418 + const struct cred *tmpcred = current_cred();
50419 +#endif
50420
50421 generic_fillattr(inode, stat);
50422
50423 @@ -1508,13 +1569,41 @@ static int pid_getattr(struct vfsmount *
50424 stat->uid = 0;
50425 stat->gid = 0;
50426 task = pid_task(proc_pid(inode), PIDTYPE_PID);
50427 +
50428 + if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
50429 + rcu_read_unlock();
50430 + return -ENOENT;
50431 + }
50432 +
50433 if (task) {
50434 + cred = __task_cred(task);
50435 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50436 + if (!tmpcred->uid || (tmpcred->uid == cred->uid)
50437 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
50438 + || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
50439 +#endif
50440 + ) {
50441 +#endif
50442 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
50443 +#ifdef CONFIG_GRKERNSEC_PROC_USER
50444 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
50445 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50446 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
50447 +#endif
50448 task_dumpable(task)) {
50449 - cred = __task_cred(task);
50450 stat->uid = cred->euid;
50451 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
50452 + stat->gid = CONFIG_GRKERNSEC_PROC_GID;
50453 +#else
50454 stat->gid = cred->egid;
50455 +#endif
50456 }
50457 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50458 + } else {
50459 + rcu_read_unlock();
50460 + return -ENOENT;
50461 + }
50462 +#endif
50463 }
50464 rcu_read_unlock();
50465 return 0;
50466 @@ -1545,11 +1634,20 @@ static int pid_revalidate(struct dentry
50467
50468 if (task) {
50469 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
50470 +#ifdef CONFIG_GRKERNSEC_PROC_USER
50471 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
50472 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50473 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
50474 +#endif
50475 task_dumpable(task)) {
50476 rcu_read_lock();
50477 cred = __task_cred(task);
50478 inode->i_uid = cred->euid;
50479 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
50480 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
50481 +#else
50482 inode->i_gid = cred->egid;
50483 +#endif
50484 rcu_read_unlock();
50485 } else {
50486 inode->i_uid = 0;
50487 @@ -1670,7 +1768,8 @@ static int proc_fd_info(struct inode *in
50488 int fd = proc_fd(inode);
50489
50490 if (task) {
50491 - files = get_files_struct(task);
50492 + if (!gr_acl_handle_procpidmem(task))
50493 + files = get_files_struct(task);
50494 put_task_struct(task);
50495 }
50496 if (files) {
50497 @@ -1922,12 +2021,22 @@ static const struct file_operations proc
50498 static int proc_fd_permission(struct inode *inode, int mask)
50499 {
50500 int rv;
50501 + struct task_struct *task;
50502
50503 rv = generic_permission(inode, mask, NULL);
50504 - if (rv == 0)
50505 - return 0;
50506 +
50507 if (task_pid(current) == proc_pid(inode))
50508 rv = 0;
50509 +
50510 + task = get_proc_task(inode);
50511 + if (task == NULL)
50512 + return rv;
50513 +
50514 + if (gr_acl_handle_procpidmem(task))
50515 + rv = -EACCES;
50516 +
50517 + put_task_struct(task);
50518 +
50519 return rv;
50520 }
50521
50522 @@ -2036,6 +2145,9 @@ static struct dentry *proc_pident_lookup
50523 if (!task)
50524 goto out_no_task;
50525
50526 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
50527 + goto out;
50528 +
50529 /*
50530 * Yes, it does not scale. And it should not. Don't add
50531 * new entries into /proc/<tgid>/ without very good reasons.
50532 @@ -2080,6 +2192,9 @@ static int proc_pident_readdir(struct fi
50533 if (!task)
50534 goto out_no_task;
50535
50536 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
50537 + goto out;
50538 +
50539 ret = 0;
50540 i = filp->f_pos;
50541 switch (i) {
50542 @@ -2347,7 +2462,7 @@ static void *proc_self_follow_link(struc
50543 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
50544 void *cookie)
50545 {
50546 - char *s = nd_get_link(nd);
50547 + const char *s = nd_get_link(nd);
50548 if (!IS_ERR(s))
50549 __putname(s);
50550 }
50551 @@ -2553,7 +2668,7 @@ static const struct pid_entry tgid_base_
50552 #ifdef CONFIG_SCHED_DEBUG
50553 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
50554 #endif
50555 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
50556 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
50557 INF("syscall", S_IRUGO, proc_pid_syscall),
50558 #endif
50559 INF("cmdline", S_IRUGO, proc_pid_cmdline),
50560 @@ -2578,10 +2693,10 @@ static const struct pid_entry tgid_base_
50561 #ifdef CONFIG_SECURITY
50562 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
50563 #endif
50564 -#ifdef CONFIG_KALLSYMS
50565 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
50566 INF("wchan", S_IRUGO, proc_pid_wchan),
50567 #endif
50568 -#ifdef CONFIG_STACKTRACE
50569 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
50570 ONE("stack", S_IRUGO, proc_pid_stack),
50571 #endif
50572 #ifdef CONFIG_SCHEDSTATS
50573 @@ -2611,6 +2726,9 @@ static const struct pid_entry tgid_base_
50574 #ifdef CONFIG_TASK_IO_ACCOUNTING
50575 INF("io", S_IRUSR, proc_tgid_io_accounting),
50576 #endif
50577 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
50578 + INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
50579 +#endif
50580 };
50581
50582 static int proc_tgid_base_readdir(struct file * filp,
50583 @@ -2735,7 +2853,14 @@ static struct dentry *proc_pid_instantia
50584 if (!inode)
50585 goto out;
50586
50587 +#ifdef CONFIG_GRKERNSEC_PROC_USER
50588 + inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
50589 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50590 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
50591 + inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
50592 +#else
50593 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
50594 +#endif
50595 inode->i_op = &proc_tgid_base_inode_operations;
50596 inode->i_fop = &proc_tgid_base_operations;
50597 inode->i_flags|=S_IMMUTABLE;
50598 @@ -2777,7 +2902,14 @@ struct dentry *proc_pid_lookup(struct in
50599 if (!task)
50600 goto out;
50601
50602 + if (!has_group_leader_pid(task))
50603 + goto out_put_task;
50604 +
50605 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
50606 + goto out_put_task;
50607 +
50608 result = proc_pid_instantiate(dir, dentry, task, NULL);
50609 +out_put_task:
50610 put_task_struct(task);
50611 out:
50612 return result;
50613 @@ -2842,6 +2974,11 @@ int proc_pid_readdir(struct file * filp,
50614 {
50615 unsigned int nr;
50616 struct task_struct *reaper;
50617 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50618 + const struct cred *tmpcred = current_cred();
50619 + const struct cred *itercred;
50620 +#endif
50621 + filldir_t __filldir = filldir;
50622 struct tgid_iter iter;
50623 struct pid_namespace *ns;
50624
50625 @@ -2865,8 +3002,27 @@ int proc_pid_readdir(struct file * filp,
50626 for (iter = next_tgid(ns, iter);
50627 iter.task;
50628 iter.tgid += 1, iter = next_tgid(ns, iter)) {
50629 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50630 + rcu_read_lock();
50631 + itercred = __task_cred(iter.task);
50632 +#endif
50633 + if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
50634 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50635 + || (tmpcred->uid && (itercred->uid != tmpcred->uid)
50636 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
50637 + && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
50638 +#endif
50639 + )
50640 +#endif
50641 + )
50642 + __filldir = &gr_fake_filldir;
50643 + else
50644 + __filldir = filldir;
50645 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50646 + rcu_read_unlock();
50647 +#endif
50648 filp->f_pos = iter.tgid + TGID_OFFSET;
50649 - if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
50650 + if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
50651 put_task_struct(iter.task);
50652 goto out;
50653 }
50654 @@ -2892,7 +3048,7 @@ static const struct pid_entry tid_base_s
50655 #ifdef CONFIG_SCHED_DEBUG
50656 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
50657 #endif
50658 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
50659 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
50660 INF("syscall", S_IRUGO, proc_pid_syscall),
50661 #endif
50662 INF("cmdline", S_IRUGO, proc_pid_cmdline),
50663 @@ -2916,10 +3072,10 @@ static const struct pid_entry tid_base_s
50664 #ifdef CONFIG_SECURITY
50665 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
50666 #endif
50667 -#ifdef CONFIG_KALLSYMS
50668 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
50669 INF("wchan", S_IRUGO, proc_pid_wchan),
50670 #endif
50671 -#ifdef CONFIG_STACKTRACE
50672 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
50673 ONE("stack", S_IRUGO, proc_pid_stack),
50674 #endif
50675 #ifdef CONFIG_SCHEDSTATS
50676 diff -urNp linux-2.6.32.49/fs/proc/cmdline.c linux-2.6.32.49/fs/proc/cmdline.c
50677 --- linux-2.6.32.49/fs/proc/cmdline.c 2011-11-08 19:02:43.000000000 -0500
50678 +++ linux-2.6.32.49/fs/proc/cmdline.c 2011-11-15 19:59:43.000000000 -0500
50679 @@ -23,7 +23,11 @@ static const struct file_operations cmdl
50680
50681 static int __init proc_cmdline_init(void)
50682 {
50683 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
50684 + proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
50685 +#else
50686 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
50687 +#endif
50688 return 0;
50689 }
50690 module_init(proc_cmdline_init);
50691 diff -urNp linux-2.6.32.49/fs/proc/devices.c linux-2.6.32.49/fs/proc/devices.c
50692 --- linux-2.6.32.49/fs/proc/devices.c 2011-11-08 19:02:43.000000000 -0500
50693 +++ linux-2.6.32.49/fs/proc/devices.c 2011-11-15 19:59:43.000000000 -0500
50694 @@ -64,7 +64,11 @@ static const struct file_operations proc
50695
50696 static int __init proc_devices_init(void)
50697 {
50698 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
50699 + proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
50700 +#else
50701 proc_create("devices", 0, NULL, &proc_devinfo_operations);
50702 +#endif
50703 return 0;
50704 }
50705 module_init(proc_devices_init);
50706 diff -urNp linux-2.6.32.49/fs/proc/inode.c linux-2.6.32.49/fs/proc/inode.c
50707 --- linux-2.6.32.49/fs/proc/inode.c 2011-11-08 19:02:43.000000000 -0500
50708 +++ linux-2.6.32.49/fs/proc/inode.c 2011-11-15 19:59:43.000000000 -0500
50709 @@ -18,12 +18,19 @@
50710 #include <linux/module.h>
50711 #include <linux/smp_lock.h>
50712 #include <linux/sysctl.h>
50713 +#include <linux/grsecurity.h>
50714
50715 #include <asm/system.h>
50716 #include <asm/uaccess.h>
50717
50718 #include "internal.h"
50719
50720 +#ifdef CONFIG_PROC_SYSCTL
50721 +extern const struct inode_operations proc_sys_inode_operations;
50722 +extern const struct inode_operations proc_sys_dir_operations;
50723 +#endif
50724 +
50725 +
50726 struct proc_dir_entry *de_get(struct proc_dir_entry *de)
50727 {
50728 atomic_inc(&de->count);
50729 @@ -62,6 +69,13 @@ static void proc_delete_inode(struct ino
50730 de_put(de);
50731 if (PROC_I(inode)->sysctl)
50732 sysctl_head_put(PROC_I(inode)->sysctl);
50733 +
50734 +#ifdef CONFIG_PROC_SYSCTL
50735 + if (inode->i_op == &proc_sys_inode_operations ||
50736 + inode->i_op == &proc_sys_dir_operations)
50737 + gr_handle_delete(inode->i_ino, inode->i_sb->s_dev);
50738 +#endif
50739 +
50740 clear_inode(inode);
50741 }
50742
50743 @@ -457,7 +471,11 @@ struct inode *proc_get_inode(struct supe
50744 if (de->mode) {
50745 inode->i_mode = de->mode;
50746 inode->i_uid = de->uid;
50747 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
50748 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
50749 +#else
50750 inode->i_gid = de->gid;
50751 +#endif
50752 }
50753 if (de->size)
50754 inode->i_size = de->size;
50755 diff -urNp linux-2.6.32.49/fs/proc/internal.h linux-2.6.32.49/fs/proc/internal.h
50756 --- linux-2.6.32.49/fs/proc/internal.h 2011-11-08 19:02:43.000000000 -0500
50757 +++ linux-2.6.32.49/fs/proc/internal.h 2011-11-15 19:59:43.000000000 -0500
50758 @@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
50759 struct pid *pid, struct task_struct *task);
50760 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
50761 struct pid *pid, struct task_struct *task);
50762 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
50763 +extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
50764 +#endif
50765 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
50766
50767 extern const struct file_operations proc_maps_operations;
50768 diff -urNp linux-2.6.32.49/fs/proc/Kconfig linux-2.6.32.49/fs/proc/Kconfig
50769 --- linux-2.6.32.49/fs/proc/Kconfig 2011-11-08 19:02:43.000000000 -0500
50770 +++ linux-2.6.32.49/fs/proc/Kconfig 2011-11-15 19:59:43.000000000 -0500
50771 @@ -30,12 +30,12 @@ config PROC_FS
50772
50773 config PROC_KCORE
50774 bool "/proc/kcore support" if !ARM
50775 - depends on PROC_FS && MMU
50776 + depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
50777
50778 config PROC_VMCORE
50779 bool "/proc/vmcore support (EXPERIMENTAL)"
50780 - depends on PROC_FS && CRASH_DUMP
50781 - default y
50782 + depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
50783 + default n
50784 help
50785 Exports the dump image of crashed kernel in ELF format.
50786
50787 @@ -59,8 +59,8 @@ config PROC_SYSCTL
50788 limited in memory.
50789
50790 config PROC_PAGE_MONITOR
50791 - default y
50792 - depends on PROC_FS && MMU
50793 + default n
50794 + depends on PROC_FS && MMU && !GRKERNSEC
50795 bool "Enable /proc page monitoring" if EMBEDDED
50796 help
50797 Various /proc files exist to monitor process memory utilization:
50798 diff -urNp linux-2.6.32.49/fs/proc/kcore.c linux-2.6.32.49/fs/proc/kcore.c
50799 --- linux-2.6.32.49/fs/proc/kcore.c 2011-11-08 19:02:43.000000000 -0500
50800 +++ linux-2.6.32.49/fs/proc/kcore.c 2011-11-15 19:59:43.000000000 -0500
50801 @@ -320,6 +320,8 @@ static void elf_kcore_store_hdr(char *bu
50802 off_t offset = 0;
50803 struct kcore_list *m;
50804
50805 + pax_track_stack();
50806 +
50807 /* setup ELF header */
50808 elf = (struct elfhdr *) bufp;
50809 bufp += sizeof(struct elfhdr);
50810 @@ -477,9 +479,10 @@ read_kcore(struct file *file, char __use
50811 * the addresses in the elf_phdr on our list.
50812 */
50813 start = kc_offset_to_vaddr(*fpos - elf_buflen);
50814 - if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
50815 + tsz = PAGE_SIZE - (start & ~PAGE_MASK);
50816 + if (tsz > buflen)
50817 tsz = buflen;
50818 -
50819 +
50820 while (buflen) {
50821 struct kcore_list *m;
50822
50823 @@ -508,20 +511,23 @@ read_kcore(struct file *file, char __use
50824 kfree(elf_buf);
50825 } else {
50826 if (kern_addr_valid(start)) {
50827 - unsigned long n;
50828 + char *elf_buf;
50829 + mm_segment_t oldfs;
50830
50831 - n = copy_to_user(buffer, (char *)start, tsz);
50832 - /*
50833 - * We cannot distingush between fault on source
50834 - * and fault on destination. When this happens
50835 - * we clear too and hope it will trigger the
50836 - * EFAULT again.
50837 - */
50838 - if (n) {
50839 - if (clear_user(buffer + tsz - n,
50840 - n))
50841 + elf_buf = kmalloc(tsz, GFP_KERNEL);
50842 + if (!elf_buf)
50843 + return -ENOMEM;
50844 + oldfs = get_fs();
50845 + set_fs(KERNEL_DS);
50846 + if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
50847 + set_fs(oldfs);
50848 + if (copy_to_user(buffer, elf_buf, tsz)) {
50849 + kfree(elf_buf);
50850 return -EFAULT;
50851 + }
50852 }
50853 + set_fs(oldfs);
50854 + kfree(elf_buf);
50855 } else {
50856 if (clear_user(buffer, tsz))
50857 return -EFAULT;
50858 @@ -541,6 +547,9 @@ read_kcore(struct file *file, char __use
50859
50860 static int open_kcore(struct inode *inode, struct file *filp)
50861 {
50862 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
50863 + return -EPERM;
50864 +#endif
50865 if (!capable(CAP_SYS_RAWIO))
50866 return -EPERM;
50867 if (kcore_need_update)
50868 diff -urNp linux-2.6.32.49/fs/proc/meminfo.c linux-2.6.32.49/fs/proc/meminfo.c
50869 --- linux-2.6.32.49/fs/proc/meminfo.c 2011-11-08 19:02:43.000000000 -0500
50870 +++ linux-2.6.32.49/fs/proc/meminfo.c 2011-11-15 19:59:43.000000000 -0500
50871 @@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_
50872 unsigned long pages[NR_LRU_LISTS];
50873 int lru;
50874
50875 + pax_track_stack();
50876 +
50877 /*
50878 * display in kilobytes.
50879 */
50880 @@ -149,7 +151,7 @@ static int meminfo_proc_show(struct seq_
50881 vmi.used >> 10,
50882 vmi.largest_chunk >> 10
50883 #ifdef CONFIG_MEMORY_FAILURE
50884 - ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
50885 + ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
50886 #endif
50887 );
50888
50889 diff -urNp linux-2.6.32.49/fs/proc/nommu.c linux-2.6.32.49/fs/proc/nommu.c
50890 --- linux-2.6.32.49/fs/proc/nommu.c 2011-11-08 19:02:43.000000000 -0500
50891 +++ linux-2.6.32.49/fs/proc/nommu.c 2011-11-15 19:59:43.000000000 -0500
50892 @@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_
50893 if (len < 1)
50894 len = 1;
50895 seq_printf(m, "%*c", len, ' ');
50896 - seq_path(m, &file->f_path, "");
50897 + seq_path(m, &file->f_path, "\n\\");
50898 }
50899
50900 seq_putc(m, '\n');
50901 diff -urNp linux-2.6.32.49/fs/proc/proc_net.c linux-2.6.32.49/fs/proc/proc_net.c
50902 --- linux-2.6.32.49/fs/proc/proc_net.c 2011-11-08 19:02:43.000000000 -0500
50903 +++ linux-2.6.32.49/fs/proc/proc_net.c 2011-11-15 19:59:43.000000000 -0500
50904 @@ -104,6 +104,17 @@ static struct net *get_proc_task_net(str
50905 struct task_struct *task;
50906 struct nsproxy *ns;
50907 struct net *net = NULL;
50908 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50909 + const struct cred *cred = current_cred();
50910 +#endif
50911 +
50912 +#ifdef CONFIG_GRKERNSEC_PROC_USER
50913 + if (cred->fsuid)
50914 + return net;
50915 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50916 + if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
50917 + return net;
50918 +#endif
50919
50920 rcu_read_lock();
50921 task = pid_task(proc_pid(dir), PIDTYPE_PID);
50922 diff -urNp linux-2.6.32.49/fs/proc/proc_sysctl.c linux-2.6.32.49/fs/proc/proc_sysctl.c
50923 --- linux-2.6.32.49/fs/proc/proc_sysctl.c 2011-11-08 19:02:43.000000000 -0500
50924 +++ linux-2.6.32.49/fs/proc/proc_sysctl.c 2011-11-18 18:45:06.000000000 -0500
50925 @@ -7,11 +7,13 @@
50926 #include <linux/security.h>
50927 #include "internal.h"
50928
50929 +extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
50930 +
50931 static const struct dentry_operations proc_sys_dentry_operations;
50932 static const struct file_operations proc_sys_file_operations;
50933 -static const struct inode_operations proc_sys_inode_operations;
50934 +const struct inode_operations proc_sys_inode_operations;
50935 static const struct file_operations proc_sys_dir_file_operations;
50936 -static const struct inode_operations proc_sys_dir_operations;
50937 +const struct inode_operations proc_sys_dir_operations;
50938
50939 static struct inode *proc_sys_make_inode(struct super_block *sb,
50940 struct ctl_table_header *head, struct ctl_table *table)
50941 @@ -109,6 +111,9 @@ static struct dentry *proc_sys_lookup(st
50942 if (!p)
50943 goto out;
50944
50945 + if (gr_handle_sysctl(p, MAY_EXEC))
50946 + goto out;
50947 +
50948 err = ERR_PTR(-ENOMEM);
50949 inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
50950 if (h)
50951 @@ -119,6 +124,9 @@ static struct dentry *proc_sys_lookup(st
50952
50953 err = NULL;
50954 dentry->d_op = &proc_sys_dentry_operations;
50955 +
50956 + gr_handle_proc_create(dentry, inode);
50957 +
50958 d_add(dentry, inode);
50959
50960 out:
50961 @@ -200,6 +208,9 @@ static int proc_sys_fill_cache(struct fi
50962 return -ENOMEM;
50963 } else {
50964 child->d_op = &proc_sys_dentry_operations;
50965 +
50966 + gr_handle_proc_create(child, inode);
50967 +
50968 d_add(child, inode);
50969 }
50970 } else {
50971 @@ -228,6 +239,9 @@ static int scan(struct ctl_table_header
50972 if (*pos < file->f_pos)
50973 continue;
50974
50975 + if (gr_handle_sysctl(table, 0))
50976 + continue;
50977 +
50978 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
50979 if (res)
50980 return res;
50981 @@ -344,6 +358,9 @@ static int proc_sys_getattr(struct vfsmo
50982 if (IS_ERR(head))
50983 return PTR_ERR(head);
50984
50985 + if (table && gr_handle_sysctl(table, MAY_EXEC))
50986 + return -ENOENT;
50987 +
50988 generic_fillattr(inode, stat);
50989 if (table)
50990 stat->mode = (stat->mode & S_IFMT) | table->mode;
50991 @@ -358,17 +375,18 @@ static const struct file_operations proc
50992 };
50993
50994 static const struct file_operations proc_sys_dir_file_operations = {
50995 + .read = generic_read_dir,
50996 .readdir = proc_sys_readdir,
50997 .llseek = generic_file_llseek,
50998 };
50999
51000 -static const struct inode_operations proc_sys_inode_operations = {
51001 +const struct inode_operations proc_sys_inode_operations = {
51002 .permission = proc_sys_permission,
51003 .setattr = proc_sys_setattr,
51004 .getattr = proc_sys_getattr,
51005 };
51006
51007 -static const struct inode_operations proc_sys_dir_operations = {
51008 +const struct inode_operations proc_sys_dir_operations = {
51009 .lookup = proc_sys_lookup,
51010 .permission = proc_sys_permission,
51011 .setattr = proc_sys_setattr,
51012 diff -urNp linux-2.6.32.49/fs/proc/root.c linux-2.6.32.49/fs/proc/root.c
51013 --- linux-2.6.32.49/fs/proc/root.c 2011-11-08 19:02:43.000000000 -0500
51014 +++ linux-2.6.32.49/fs/proc/root.c 2011-11-15 19:59:43.000000000 -0500
51015 @@ -134,7 +134,15 @@ void __init proc_root_init(void)
51016 #ifdef CONFIG_PROC_DEVICETREE
51017 proc_device_tree_init();
51018 #endif
51019 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
51020 +#ifdef CONFIG_GRKERNSEC_PROC_USER
51021 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
51022 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
51023 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
51024 +#endif
51025 +#else
51026 proc_mkdir("bus", NULL);
51027 +#endif
51028 proc_sys_init();
51029 }
51030
51031 diff -urNp linux-2.6.32.49/fs/proc/task_mmu.c linux-2.6.32.49/fs/proc/task_mmu.c
51032 --- linux-2.6.32.49/fs/proc/task_mmu.c 2011-11-08 19:02:43.000000000 -0500
51033 +++ linux-2.6.32.49/fs/proc/task_mmu.c 2011-11-15 19:59:43.000000000 -0500
51034 @@ -46,15 +46,26 @@ void task_mem(struct seq_file *m, struct
51035 "VmStk:\t%8lu kB\n"
51036 "VmExe:\t%8lu kB\n"
51037 "VmLib:\t%8lu kB\n"
51038 - "VmPTE:\t%8lu kB\n",
51039 - hiwater_vm << (PAGE_SHIFT-10),
51040 + "VmPTE:\t%8lu kB\n"
51041 +
51042 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
51043 + "CsBase:\t%8lx\nCsLim:\t%8lx\n"
51044 +#endif
51045 +
51046 + ,hiwater_vm << (PAGE_SHIFT-10),
51047 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
51048 mm->locked_vm << (PAGE_SHIFT-10),
51049 hiwater_rss << (PAGE_SHIFT-10),
51050 total_rss << (PAGE_SHIFT-10),
51051 data << (PAGE_SHIFT-10),
51052 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
51053 - (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
51054 + (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
51055 +
51056 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
51057 + , mm->context.user_cs_base, mm->context.user_cs_limit
51058 +#endif
51059 +
51060 + );
51061 }
51062
51063 unsigned long task_vsize(struct mm_struct *mm)
51064 @@ -175,7 +186,8 @@ static void m_stop(struct seq_file *m, v
51065 struct proc_maps_private *priv = m->private;
51066 struct vm_area_struct *vma = v;
51067
51068 - vma_stop(priv, vma);
51069 + if (!IS_ERR(vma))
51070 + vma_stop(priv, vma);
51071 if (priv->task)
51072 put_task_struct(priv->task);
51073 }
51074 @@ -199,6 +211,12 @@ static int do_maps_open(struct inode *in
51075 return ret;
51076 }
51077
51078 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
51079 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
51080 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
51081 + _mm->pax_flags & MF_PAX_SEGMEXEC))
51082 +#endif
51083 +
51084 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
51085 {
51086 struct mm_struct *mm = vma->vm_mm;
51087 @@ -206,7 +224,6 @@ static void show_map_vma(struct seq_file
51088 int flags = vma->vm_flags;
51089 unsigned long ino = 0;
51090 unsigned long long pgoff = 0;
51091 - unsigned long start;
51092 dev_t dev = 0;
51093 int len;
51094
51095 @@ -217,20 +234,23 @@ static void show_map_vma(struct seq_file
51096 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
51097 }
51098
51099 - /* We don't show the stack guard page in /proc/maps */
51100 - start = vma->vm_start;
51101 - if (vma->vm_flags & VM_GROWSDOWN)
51102 - if (!vma_stack_continue(vma->vm_prev, vma->vm_start))
51103 - start += PAGE_SIZE;
51104 -
51105 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
51106 - start,
51107 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
51108 + PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
51109 + PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
51110 +#else
51111 + vma->vm_start,
51112 vma->vm_end,
51113 +#endif
51114 flags & VM_READ ? 'r' : '-',
51115 flags & VM_WRITE ? 'w' : '-',
51116 flags & VM_EXEC ? 'x' : '-',
51117 flags & VM_MAYSHARE ? 's' : 'p',
51118 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
51119 + PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
51120 +#else
51121 pgoff,
51122 +#endif
51123 MAJOR(dev), MINOR(dev), ino, &len);
51124
51125 /*
51126 @@ -239,7 +259,7 @@ static void show_map_vma(struct seq_file
51127 */
51128 if (file) {
51129 pad_len_spaces(m, len);
51130 - seq_path(m, &file->f_path, "\n");
51131 + seq_path(m, &file->f_path, "\n\\");
51132 } else {
51133 const char *name = arch_vma_name(vma);
51134 if (!name) {
51135 @@ -247,8 +267,9 @@ static void show_map_vma(struct seq_file
51136 if (vma->vm_start <= mm->brk &&
51137 vma->vm_end >= mm->start_brk) {
51138 name = "[heap]";
51139 - } else if (vma->vm_start <= mm->start_stack &&
51140 - vma->vm_end >= mm->start_stack) {
51141 + } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
51142 + (vma->vm_start <= mm->start_stack &&
51143 + vma->vm_end >= mm->start_stack)) {
51144 name = "[stack]";
51145 }
51146 } else {
51147 @@ -391,9 +412,16 @@ static int show_smap(struct seq_file *m,
51148 };
51149
51150 memset(&mss, 0, sizeof mss);
51151 - mss.vma = vma;
51152 - if (vma->vm_mm && !is_vm_hugetlb_page(vma))
51153 - walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
51154 +
51155 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
51156 + if (!PAX_RAND_FLAGS(vma->vm_mm)) {
51157 +#endif
51158 + mss.vma = vma;
51159 + if (vma->vm_mm && !is_vm_hugetlb_page(vma))
51160 + walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
51161 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
51162 + }
51163 +#endif
51164
51165 show_map_vma(m, vma);
51166
51167 @@ -409,7 +437,11 @@ static int show_smap(struct seq_file *m,
51168 "Swap: %8lu kB\n"
51169 "KernelPageSize: %8lu kB\n"
51170 "MMUPageSize: %8lu kB\n",
51171 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
51172 + PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
51173 +#else
51174 (vma->vm_end - vma->vm_start) >> 10,
51175 +#endif
51176 mss.resident >> 10,
51177 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
51178 mss.shared_clean >> 10,
51179 diff -urNp linux-2.6.32.49/fs/proc/task_nommu.c linux-2.6.32.49/fs/proc/task_nommu.c
51180 --- linux-2.6.32.49/fs/proc/task_nommu.c 2011-11-08 19:02:43.000000000 -0500
51181 +++ linux-2.6.32.49/fs/proc/task_nommu.c 2011-11-15 19:59:43.000000000 -0500
51182 @@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct
51183 else
51184 bytes += kobjsize(mm);
51185
51186 - if (current->fs && current->fs->users > 1)
51187 + if (current->fs && atomic_read(&current->fs->users) > 1)
51188 sbytes += kobjsize(current->fs);
51189 else
51190 bytes += kobjsize(current->fs);
51191 @@ -154,7 +154,7 @@ static int nommu_vma_show(struct seq_fil
51192 if (len < 1)
51193 len = 1;
51194 seq_printf(m, "%*c", len, ' ');
51195 - seq_path(m, &file->f_path, "");
51196 + seq_path(m, &file->f_path, "\n\\");
51197 }
51198
51199 seq_putc(m, '\n');
51200 diff -urNp linux-2.6.32.49/fs/readdir.c linux-2.6.32.49/fs/readdir.c
51201 --- linux-2.6.32.49/fs/readdir.c 2011-11-08 19:02:43.000000000 -0500
51202 +++ linux-2.6.32.49/fs/readdir.c 2011-11-15 19:59:43.000000000 -0500
51203 @@ -16,6 +16,7 @@
51204 #include <linux/security.h>
51205 #include <linux/syscalls.h>
51206 #include <linux/unistd.h>
51207 +#include <linux/namei.h>
51208
51209 #include <asm/uaccess.h>
51210
51211 @@ -67,6 +68,7 @@ struct old_linux_dirent {
51212
51213 struct readdir_callback {
51214 struct old_linux_dirent __user * dirent;
51215 + struct file * file;
51216 int result;
51217 };
51218
51219 @@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
51220 buf->result = -EOVERFLOW;
51221 return -EOVERFLOW;
51222 }
51223 +
51224 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
51225 + return 0;
51226 +
51227 buf->result++;
51228 dirent = buf->dirent;
51229 if (!access_ok(VERIFY_WRITE, dirent,
51230 @@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
51231
51232 buf.result = 0;
51233 buf.dirent = dirent;
51234 + buf.file = file;
51235
51236 error = vfs_readdir(file, fillonedir, &buf);
51237 if (buf.result)
51238 @@ -142,6 +149,7 @@ struct linux_dirent {
51239 struct getdents_callback {
51240 struct linux_dirent __user * current_dir;
51241 struct linux_dirent __user * previous;
51242 + struct file * file;
51243 int count;
51244 int error;
51245 };
51246 @@ -162,6 +170,10 @@ static int filldir(void * __buf, const c
51247 buf->error = -EOVERFLOW;
51248 return -EOVERFLOW;
51249 }
51250 +
51251 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
51252 + return 0;
51253 +
51254 dirent = buf->previous;
51255 if (dirent) {
51256 if (__put_user(offset, &dirent->d_off))
51257 @@ -209,6 +221,7 @@ SYSCALL_DEFINE3(getdents, unsigned int,
51258 buf.previous = NULL;
51259 buf.count = count;
51260 buf.error = 0;
51261 + buf.file = file;
51262
51263 error = vfs_readdir(file, filldir, &buf);
51264 if (error >= 0)
51265 @@ -228,6 +241,7 @@ out:
51266 struct getdents_callback64 {
51267 struct linux_dirent64 __user * current_dir;
51268 struct linux_dirent64 __user * previous;
51269 + struct file *file;
51270 int count;
51271 int error;
51272 };
51273 @@ -242,6 +256,10 @@ static int filldir64(void * __buf, const
51274 buf->error = -EINVAL; /* only used if we fail.. */
51275 if (reclen > buf->count)
51276 return -EINVAL;
51277 +
51278 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
51279 + return 0;
51280 +
51281 dirent = buf->previous;
51282 if (dirent) {
51283 if (__put_user(offset, &dirent->d_off))
51284 @@ -289,6 +307,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
51285
51286 buf.current_dir = dirent;
51287 buf.previous = NULL;
51288 + buf.file = file;
51289 buf.count = count;
51290 buf.error = 0;
51291
51292 @@ -297,7 +316,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
51293 error = buf.error;
51294 lastdirent = buf.previous;
51295 if (lastdirent) {
51296 - typeof(lastdirent->d_off) d_off = file->f_pos;
51297 + typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
51298 if (__put_user(d_off, &lastdirent->d_off))
51299 error = -EFAULT;
51300 else
51301 diff -urNp linux-2.6.32.49/fs/reiserfs/dir.c linux-2.6.32.49/fs/reiserfs/dir.c
51302 --- linux-2.6.32.49/fs/reiserfs/dir.c 2011-11-08 19:02:43.000000000 -0500
51303 +++ linux-2.6.32.49/fs/reiserfs/dir.c 2011-11-15 19:59:43.000000000 -0500
51304 @@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentr
51305 struct reiserfs_dir_entry de;
51306 int ret = 0;
51307
51308 + pax_track_stack();
51309 +
51310 reiserfs_write_lock(inode->i_sb);
51311
51312 reiserfs_check_lock_depth(inode->i_sb, "readdir");
51313 diff -urNp linux-2.6.32.49/fs/reiserfs/do_balan.c linux-2.6.32.49/fs/reiserfs/do_balan.c
51314 --- linux-2.6.32.49/fs/reiserfs/do_balan.c 2011-11-08 19:02:43.000000000 -0500
51315 +++ linux-2.6.32.49/fs/reiserfs/do_balan.c 2011-11-15 19:59:43.000000000 -0500
51316 @@ -2058,7 +2058,7 @@ void do_balance(struct tree_balance *tb,
51317 return;
51318 }
51319
51320 - atomic_inc(&(fs_generation(tb->tb_sb)));
51321 + atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
51322 do_balance_starts(tb);
51323
51324 /* balance leaf returns 0 except if combining L R and S into
51325 diff -urNp linux-2.6.32.49/fs/reiserfs/item_ops.c linux-2.6.32.49/fs/reiserfs/item_ops.c
51326 --- linux-2.6.32.49/fs/reiserfs/item_ops.c 2011-11-08 19:02:43.000000000 -0500
51327 +++ linux-2.6.32.49/fs/reiserfs/item_ops.c 2011-11-15 19:59:43.000000000 -0500
51328 @@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
51329 vi->vi_index, vi->vi_type, vi->vi_ih);
51330 }
51331
51332 -static struct item_operations stat_data_ops = {
51333 +static const struct item_operations stat_data_ops = {
51334 .bytes_number = sd_bytes_number,
51335 .decrement_key = sd_decrement_key,
51336 .is_left_mergeable = sd_is_left_mergeable,
51337 @@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
51338 vi->vi_index, vi->vi_type, vi->vi_ih);
51339 }
51340
51341 -static struct item_operations direct_ops = {
51342 +static const struct item_operations direct_ops = {
51343 .bytes_number = direct_bytes_number,
51344 .decrement_key = direct_decrement_key,
51345 .is_left_mergeable = direct_is_left_mergeable,
51346 @@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
51347 vi->vi_index, vi->vi_type, vi->vi_ih);
51348 }
51349
51350 -static struct item_operations indirect_ops = {
51351 +static const struct item_operations indirect_ops = {
51352 .bytes_number = indirect_bytes_number,
51353 .decrement_key = indirect_decrement_key,
51354 .is_left_mergeable = indirect_is_left_mergeable,
51355 @@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
51356 printk("\n");
51357 }
51358
51359 -static struct item_operations direntry_ops = {
51360 +static const struct item_operations direntry_ops = {
51361 .bytes_number = direntry_bytes_number,
51362 .decrement_key = direntry_decrement_key,
51363 .is_left_mergeable = direntry_is_left_mergeable,
51364 @@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
51365 "Invalid item type observed, run fsck ASAP");
51366 }
51367
51368 -static struct item_operations errcatch_ops = {
51369 +static const struct item_operations errcatch_ops = {
51370 errcatch_bytes_number,
51371 errcatch_decrement_key,
51372 errcatch_is_left_mergeable,
51373 @@ -746,7 +746,7 @@ static struct item_operations errcatch_o
51374 #error Item types must use disk-format assigned values.
51375 #endif
51376
51377 -struct item_operations *item_ops[TYPE_ANY + 1] = {
51378 +const struct item_operations * const item_ops[TYPE_ANY + 1] = {
51379 &stat_data_ops,
51380 &indirect_ops,
51381 &direct_ops,
51382 diff -urNp linux-2.6.32.49/fs/reiserfs/journal.c linux-2.6.32.49/fs/reiserfs/journal.c
51383 --- linux-2.6.32.49/fs/reiserfs/journal.c 2011-11-08 19:02:43.000000000 -0500
51384 +++ linux-2.6.32.49/fs/reiserfs/journal.c 2011-11-15 19:59:43.000000000 -0500
51385 @@ -2329,6 +2329,8 @@ static struct buffer_head *reiserfs_brea
51386 struct buffer_head *bh;
51387 int i, j;
51388
51389 + pax_track_stack();
51390 +
51391 bh = __getblk(dev, block, bufsize);
51392 if (buffer_uptodate(bh))
51393 return (bh);
51394 diff -urNp linux-2.6.32.49/fs/reiserfs/namei.c linux-2.6.32.49/fs/reiserfs/namei.c
51395 --- linux-2.6.32.49/fs/reiserfs/namei.c 2011-11-08 19:02:43.000000000 -0500
51396 +++ linux-2.6.32.49/fs/reiserfs/namei.c 2011-11-15 19:59:43.000000000 -0500
51397 @@ -1214,6 +1214,8 @@ static int reiserfs_rename(struct inode
51398 unsigned long savelink = 1;
51399 struct timespec ctime;
51400
51401 + pax_track_stack();
51402 +
51403 /* three balancings: (1) old name removal, (2) new name insertion
51404 and (3) maybe "save" link insertion
51405 stat data updates: (1) old directory,
51406 diff -urNp linux-2.6.32.49/fs/reiserfs/procfs.c linux-2.6.32.49/fs/reiserfs/procfs.c
51407 --- linux-2.6.32.49/fs/reiserfs/procfs.c 2011-11-08 19:02:43.000000000 -0500
51408 +++ linux-2.6.32.49/fs/reiserfs/procfs.c 2011-11-15 19:59:43.000000000 -0500
51409 @@ -123,7 +123,7 @@ static int show_super(struct seq_file *m
51410 "SMALL_TAILS " : "NO_TAILS ",
51411 replay_only(sb) ? "REPLAY_ONLY " : "",
51412 convert_reiserfs(sb) ? "CONV " : "",
51413 - atomic_read(&r->s_generation_counter),
51414 + atomic_read_unchecked(&r->s_generation_counter),
51415 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
51416 SF(s_do_balance), SF(s_unneeded_left_neighbor),
51417 SF(s_good_search_by_key_reada), SF(s_bmaps),
51418 @@ -309,6 +309,8 @@ static int show_journal(struct seq_file
51419 struct journal_params *jp = &rs->s_v1.s_journal;
51420 char b[BDEVNAME_SIZE];
51421
51422 + pax_track_stack();
51423 +
51424 seq_printf(m, /* on-disk fields */
51425 "jp_journal_1st_block: \t%i\n"
51426 "jp_journal_dev: \t%s[%x]\n"
51427 diff -urNp linux-2.6.32.49/fs/reiserfs/stree.c linux-2.6.32.49/fs/reiserfs/stree.c
51428 --- linux-2.6.32.49/fs/reiserfs/stree.c 2011-11-08 19:02:43.000000000 -0500
51429 +++ linux-2.6.32.49/fs/reiserfs/stree.c 2011-11-15 19:59:43.000000000 -0500
51430 @@ -1159,6 +1159,8 @@ int reiserfs_delete_item(struct reiserfs
51431 int iter = 0;
51432 #endif
51433
51434 + pax_track_stack();
51435 +
51436 BUG_ON(!th->t_trans_id);
51437
51438 init_tb_struct(th, &s_del_balance, sb, path,
51439 @@ -1296,6 +1298,8 @@ void reiserfs_delete_solid_item(struct r
51440 int retval;
51441 int quota_cut_bytes = 0;
51442
51443 + pax_track_stack();
51444 +
51445 BUG_ON(!th->t_trans_id);
51446
51447 le_key2cpu_key(&cpu_key, key);
51448 @@ -1525,6 +1529,8 @@ int reiserfs_cut_from_item(struct reiser
51449 int quota_cut_bytes;
51450 loff_t tail_pos = 0;
51451
51452 + pax_track_stack();
51453 +
51454 BUG_ON(!th->t_trans_id);
51455
51456 init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
51457 @@ -1920,6 +1926,8 @@ int reiserfs_paste_into_item(struct reis
51458 int retval;
51459 int fs_gen;
51460
51461 + pax_track_stack();
51462 +
51463 BUG_ON(!th->t_trans_id);
51464
51465 fs_gen = get_generation(inode->i_sb);
51466 @@ -2007,6 +2015,8 @@ int reiserfs_insert_item(struct reiserfs
51467 int fs_gen = 0;
51468 int quota_bytes = 0;
51469
51470 + pax_track_stack();
51471 +
51472 BUG_ON(!th->t_trans_id);
51473
51474 if (inode) { /* Do we count quotas for item? */
51475 diff -urNp linux-2.6.32.49/fs/reiserfs/super.c linux-2.6.32.49/fs/reiserfs/super.c
51476 --- linux-2.6.32.49/fs/reiserfs/super.c 2011-11-08 19:02:43.000000000 -0500
51477 +++ linux-2.6.32.49/fs/reiserfs/super.c 2011-11-15 19:59:43.000000000 -0500
51478 @@ -912,6 +912,8 @@ static int reiserfs_parse_options(struct
51479 {.option_name = NULL}
51480 };
51481
51482 + pax_track_stack();
51483 +
51484 *blocks = 0;
51485 if (!options || !*options)
51486 /* use default configuration: create tails, journaling on, no
51487 diff -urNp linux-2.6.32.49/fs/select.c linux-2.6.32.49/fs/select.c
51488 --- linux-2.6.32.49/fs/select.c 2011-11-08 19:02:43.000000000 -0500
51489 +++ linux-2.6.32.49/fs/select.c 2011-11-15 19:59:43.000000000 -0500
51490 @@ -20,6 +20,7 @@
51491 #include <linux/module.h>
51492 #include <linux/slab.h>
51493 #include <linux/poll.h>
51494 +#include <linux/security.h>
51495 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
51496 #include <linux/file.h>
51497 #include <linux/fdtable.h>
51498 @@ -401,6 +402,8 @@ int do_select(int n, fd_set_bits *fds, s
51499 int retval, i, timed_out = 0;
51500 unsigned long slack = 0;
51501
51502 + pax_track_stack();
51503 +
51504 rcu_read_lock();
51505 retval = max_select_fd(n, fds);
51506 rcu_read_unlock();
51507 @@ -529,6 +532,8 @@ int core_sys_select(int n, fd_set __user
51508 /* Allocate small arguments on the stack to save memory and be faster */
51509 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
51510
51511 + pax_track_stack();
51512 +
51513 ret = -EINVAL;
51514 if (n < 0)
51515 goto out_nofds;
51516 @@ -821,6 +826,9 @@ int do_sys_poll(struct pollfd __user *uf
51517 struct poll_list *walk = head;
51518 unsigned long todo = nfds;
51519
51520 + pax_track_stack();
51521 +
51522 + gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
51523 if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
51524 return -EINVAL;
51525
51526 diff -urNp linux-2.6.32.49/fs/seq_file.c linux-2.6.32.49/fs/seq_file.c
51527 --- linux-2.6.32.49/fs/seq_file.c 2011-11-08 19:02:43.000000000 -0500
51528 +++ linux-2.6.32.49/fs/seq_file.c 2011-11-15 19:59:43.000000000 -0500
51529 @@ -76,7 +76,8 @@ static int traverse(struct seq_file *m,
51530 return 0;
51531 }
51532 if (!m->buf) {
51533 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
51534 + m->size = PAGE_SIZE;
51535 + m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
51536 if (!m->buf)
51537 return -ENOMEM;
51538 }
51539 @@ -116,7 +117,8 @@ static int traverse(struct seq_file *m,
51540 Eoverflow:
51541 m->op->stop(m, p);
51542 kfree(m->buf);
51543 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
51544 + m->size <<= 1;
51545 + m->buf = kmalloc(m->size, GFP_KERNEL);
51546 return !m->buf ? -ENOMEM : -EAGAIN;
51547 }
51548
51549 @@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
51550 m->version = file->f_version;
51551 /* grab buffer if we didn't have one */
51552 if (!m->buf) {
51553 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
51554 + m->size = PAGE_SIZE;
51555 + m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
51556 if (!m->buf)
51557 goto Enomem;
51558 }
51559 @@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
51560 goto Fill;
51561 m->op->stop(m, p);
51562 kfree(m->buf);
51563 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
51564 + m->size <<= 1;
51565 + m->buf = kmalloc(m->size, GFP_KERNEL);
51566 if (!m->buf)
51567 goto Enomem;
51568 m->count = 0;
51569 @@ -551,7 +555,7 @@ static void single_stop(struct seq_file
51570 int single_open(struct file *file, int (*show)(struct seq_file *, void *),
51571 void *data)
51572 {
51573 - struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
51574 + seq_operations_no_const *op = kmalloc(sizeof(*op), GFP_KERNEL);
51575 int res = -ENOMEM;
51576
51577 if (op) {
51578 diff -urNp linux-2.6.32.49/fs/smbfs/proc.c linux-2.6.32.49/fs/smbfs/proc.c
51579 --- linux-2.6.32.49/fs/smbfs/proc.c 2011-11-08 19:02:43.000000000 -0500
51580 +++ linux-2.6.32.49/fs/smbfs/proc.c 2011-11-15 19:59:43.000000000 -0500
51581 @@ -266,9 +266,9 @@ int smb_setcodepage(struct smb_sb_info *
51582
51583 out:
51584 if (server->local_nls != NULL && server->remote_nls != NULL)
51585 - server->ops->convert = convert_cp;
51586 + *(void **)&server->ops->convert = convert_cp;
51587 else
51588 - server->ops->convert = convert_memcpy;
51589 + *(void **)&server->ops->convert = convert_memcpy;
51590
51591 smb_unlock_server(server);
51592 return n;
51593 @@ -933,9 +933,9 @@ smb_newconn(struct smb_sb_info *server,
51594
51595 /* FIXME: the win9x code wants to modify these ... (seek/trunc bug) */
51596 if (server->mnt->flags & SMB_MOUNT_OLDATTR) {
51597 - server->ops->getattr = smb_proc_getattr_core;
51598 + *(void **)&server->ops->getattr = smb_proc_getattr_core;
51599 } else if (server->mnt->flags & SMB_MOUNT_DIRATTR) {
51600 - server->ops->getattr = smb_proc_getattr_ff;
51601 + *(void **)&server->ops->getattr = smb_proc_getattr_ff;
51602 }
51603
51604 /* Decode server capabilities */
51605 @@ -3439,7 +3439,7 @@ out:
51606 static void
51607 install_ops(struct smb_ops *dst, struct smb_ops *src)
51608 {
51609 - memcpy(dst, src, sizeof(void *) * SMB_OPS_NUM_STATIC);
51610 + memcpy((void *)dst, src, sizeof(void *) * SMB_OPS_NUM_STATIC);
51611 }
51612
51613 /* < LANMAN2 */
51614 diff -urNp linux-2.6.32.49/fs/smbfs/symlink.c linux-2.6.32.49/fs/smbfs/symlink.c
51615 --- linux-2.6.32.49/fs/smbfs/symlink.c 2011-11-08 19:02:43.000000000 -0500
51616 +++ linux-2.6.32.49/fs/smbfs/symlink.c 2011-11-15 19:59:43.000000000 -0500
51617 @@ -55,7 +55,7 @@ static void *smb_follow_link(struct dent
51618
51619 static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
51620 {
51621 - char *s = nd_get_link(nd);
51622 + const char *s = nd_get_link(nd);
51623 if (!IS_ERR(s))
51624 __putname(s);
51625 }
51626 diff -urNp linux-2.6.32.49/fs/splice.c linux-2.6.32.49/fs/splice.c
51627 --- linux-2.6.32.49/fs/splice.c 2011-11-08 19:02:43.000000000 -0500
51628 +++ linux-2.6.32.49/fs/splice.c 2011-11-15 19:59:43.000000000 -0500
51629 @@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode
51630 pipe_lock(pipe);
51631
51632 for (;;) {
51633 - if (!pipe->readers) {
51634 + if (!atomic_read(&pipe->readers)) {
51635 send_sig(SIGPIPE, current, 0);
51636 if (!ret)
51637 ret = -EPIPE;
51638 @@ -239,9 +239,9 @@ ssize_t splice_to_pipe(struct pipe_inode
51639 do_wakeup = 0;
51640 }
51641
51642 - pipe->waiting_writers++;
51643 + atomic_inc(&pipe->waiting_writers);
51644 pipe_wait(pipe);
51645 - pipe->waiting_writers--;
51646 + atomic_dec(&pipe->waiting_writers);
51647 }
51648
51649 pipe_unlock(pipe);
51650 @@ -285,6 +285,8 @@ __generic_file_splice_read(struct file *
51651 .spd_release = spd_release_page,
51652 };
51653
51654 + pax_track_stack();
51655 +
51656 index = *ppos >> PAGE_CACHE_SHIFT;
51657 loff = *ppos & ~PAGE_CACHE_MASK;
51658 req_pages = (len + loff + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
51659 @@ -521,7 +523,7 @@ static ssize_t kernel_readv(struct file
51660 old_fs = get_fs();
51661 set_fs(get_ds());
51662 /* The cast to a user pointer is valid due to the set_fs() */
51663 - res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
51664 + res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos);
51665 set_fs(old_fs);
51666
51667 return res;
51668 @@ -536,7 +538,7 @@ static ssize_t kernel_write(struct file
51669 old_fs = get_fs();
51670 set_fs(get_ds());
51671 /* The cast to a user pointer is valid due to the set_fs() */
51672 - res = vfs_write(file, (const char __user *)buf, count, &pos);
51673 + res = vfs_write(file, (const char __force_user *)buf, count, &pos);
51674 set_fs(old_fs);
51675
51676 return res;
51677 @@ -565,6 +567,8 @@ ssize_t default_file_splice_read(struct
51678 .spd_release = spd_release_page,
51679 };
51680
51681 + pax_track_stack();
51682 +
51683 index = *ppos >> PAGE_CACHE_SHIFT;
51684 offset = *ppos & ~PAGE_CACHE_MASK;
51685 nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
51686 @@ -578,7 +582,7 @@ ssize_t default_file_splice_read(struct
51687 goto err;
51688
51689 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
51690 - vec[i].iov_base = (void __user *) page_address(page);
51691 + vec[i].iov_base = (__force void __user *) page_address(page);
51692 vec[i].iov_len = this_len;
51693 pages[i] = page;
51694 spd.nr_pages++;
51695 @@ -800,10 +804,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
51696 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
51697 {
51698 while (!pipe->nrbufs) {
51699 - if (!pipe->writers)
51700 + if (!atomic_read(&pipe->writers))
51701 return 0;
51702
51703 - if (!pipe->waiting_writers && sd->num_spliced)
51704 + if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
51705 return 0;
51706
51707 if (sd->flags & SPLICE_F_NONBLOCK)
51708 @@ -1140,7 +1144,7 @@ ssize_t splice_direct_to_actor(struct fi
51709 * out of the pipe right after the splice_to_pipe(). So set
51710 * PIPE_READERS appropriately.
51711 */
51712 - pipe->readers = 1;
51713 + atomic_set(&pipe->readers, 1);
51714
51715 current->splice_pipe = pipe;
51716 }
51717 @@ -1593,6 +1597,8 @@ static long vmsplice_to_pipe(struct file
51718 .spd_release = spd_release_page,
51719 };
51720
51721 + pax_track_stack();
51722 +
51723 pipe = pipe_info(file->f_path.dentry->d_inode);
51724 if (!pipe)
51725 return -EBADF;
51726 @@ -1701,9 +1707,9 @@ static int ipipe_prep(struct pipe_inode_
51727 ret = -ERESTARTSYS;
51728 break;
51729 }
51730 - if (!pipe->writers)
51731 + if (!atomic_read(&pipe->writers))
51732 break;
51733 - if (!pipe->waiting_writers) {
51734 + if (!atomic_read(&pipe->waiting_writers)) {
51735 if (flags & SPLICE_F_NONBLOCK) {
51736 ret = -EAGAIN;
51737 break;
51738 @@ -1735,7 +1741,7 @@ static int opipe_prep(struct pipe_inode_
51739 pipe_lock(pipe);
51740
51741 while (pipe->nrbufs >= PIPE_BUFFERS) {
51742 - if (!pipe->readers) {
51743 + if (!atomic_read(&pipe->readers)) {
51744 send_sig(SIGPIPE, current, 0);
51745 ret = -EPIPE;
51746 break;
51747 @@ -1748,9 +1754,9 @@ static int opipe_prep(struct pipe_inode_
51748 ret = -ERESTARTSYS;
51749 break;
51750 }
51751 - pipe->waiting_writers++;
51752 + atomic_inc(&pipe->waiting_writers);
51753 pipe_wait(pipe);
51754 - pipe->waiting_writers--;
51755 + atomic_dec(&pipe->waiting_writers);
51756 }
51757
51758 pipe_unlock(pipe);
51759 @@ -1786,14 +1792,14 @@ retry:
51760 pipe_double_lock(ipipe, opipe);
51761
51762 do {
51763 - if (!opipe->readers) {
51764 + if (!atomic_read(&opipe->readers)) {
51765 send_sig(SIGPIPE, current, 0);
51766 if (!ret)
51767 ret = -EPIPE;
51768 break;
51769 }
51770
51771 - if (!ipipe->nrbufs && !ipipe->writers)
51772 + if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
51773 break;
51774
51775 /*
51776 @@ -1893,7 +1899,7 @@ static int link_pipe(struct pipe_inode_i
51777 pipe_double_lock(ipipe, opipe);
51778
51779 do {
51780 - if (!opipe->readers) {
51781 + if (!atomic_read(&opipe->readers)) {
51782 send_sig(SIGPIPE, current, 0);
51783 if (!ret)
51784 ret = -EPIPE;
51785 @@ -1938,7 +1944,7 @@ static int link_pipe(struct pipe_inode_i
51786 * return EAGAIN if we have the potential of some data in the
51787 * future, otherwise just return 0
51788 */
51789 - if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
51790 + if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
51791 ret = -EAGAIN;
51792
51793 pipe_unlock(ipipe);
51794 diff -urNp linux-2.6.32.49/fs/sysfs/file.c linux-2.6.32.49/fs/sysfs/file.c
51795 --- linux-2.6.32.49/fs/sysfs/file.c 2011-11-08 19:02:43.000000000 -0500
51796 +++ linux-2.6.32.49/fs/sysfs/file.c 2011-11-15 19:59:43.000000000 -0500
51797 @@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent
51798
51799 struct sysfs_open_dirent {
51800 atomic_t refcnt;
51801 - atomic_t event;
51802 + atomic_unchecked_t event;
51803 wait_queue_head_t poll;
51804 struct list_head buffers; /* goes through sysfs_buffer.list */
51805 };
51806 @@ -53,7 +53,7 @@ struct sysfs_buffer {
51807 size_t count;
51808 loff_t pos;
51809 char * page;
51810 - struct sysfs_ops * ops;
51811 + const struct sysfs_ops * ops;
51812 struct mutex mutex;
51813 int needs_read_fill;
51814 int event;
51815 @@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentr
51816 {
51817 struct sysfs_dirent *attr_sd = dentry->d_fsdata;
51818 struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
51819 - struct sysfs_ops * ops = buffer->ops;
51820 + const struct sysfs_ops * ops = buffer->ops;
51821 int ret = 0;
51822 ssize_t count;
51823
51824 @@ -88,7 +88,7 @@ static int fill_read_buffer(struct dentr
51825 if (!sysfs_get_active_two(attr_sd))
51826 return -ENODEV;
51827
51828 - buffer->event = atomic_read(&attr_sd->s_attr.open->event);
51829 + buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
51830 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
51831
51832 sysfs_put_active_two(attr_sd);
51833 @@ -199,7 +199,7 @@ flush_write_buffer(struct dentry * dentr
51834 {
51835 struct sysfs_dirent *attr_sd = dentry->d_fsdata;
51836 struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
51837 - struct sysfs_ops * ops = buffer->ops;
51838 + const struct sysfs_ops * ops = buffer->ops;
51839 int rc;
51840
51841 /* need attr_sd for attr and ops, its parent for kobj */
51842 @@ -294,7 +294,7 @@ static int sysfs_get_open_dirent(struct
51843 return -ENOMEM;
51844
51845 atomic_set(&new_od->refcnt, 0);
51846 - atomic_set(&new_od->event, 1);
51847 + atomic_set_unchecked(&new_od->event, 1);
51848 init_waitqueue_head(&new_od->poll);
51849 INIT_LIST_HEAD(&new_od->buffers);
51850 goto retry;
51851 @@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode
51852 struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
51853 struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
51854 struct sysfs_buffer *buffer;
51855 - struct sysfs_ops *ops;
51856 + const struct sysfs_ops *ops;
51857 int error = -EACCES;
51858 char *p;
51859
51860 @@ -444,7 +444,7 @@ static unsigned int sysfs_poll(struct fi
51861
51862 sysfs_put_active_two(attr_sd);
51863
51864 - if (buffer->event != atomic_read(&od->event))
51865 + if (buffer->event != atomic_read_unchecked(&od->event))
51866 goto trigger;
51867
51868 return DEFAULT_POLLMASK;
51869 @@ -463,7 +463,7 @@ void sysfs_notify_dirent(struct sysfs_di
51870
51871 od = sd->s_attr.open;
51872 if (od) {
51873 - atomic_inc(&od->event);
51874 + atomic_inc_unchecked(&od->event);
51875 wake_up_interruptible(&od->poll);
51876 }
51877
51878 diff -urNp linux-2.6.32.49/fs/sysfs/mount.c linux-2.6.32.49/fs/sysfs/mount.c
51879 --- linux-2.6.32.49/fs/sysfs/mount.c 2011-11-08 19:02:43.000000000 -0500
51880 +++ linux-2.6.32.49/fs/sysfs/mount.c 2011-11-15 19:59:43.000000000 -0500
51881 @@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
51882 .s_name = "",
51883 .s_count = ATOMIC_INIT(1),
51884 .s_flags = SYSFS_DIR,
51885 +#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
51886 + .s_mode = S_IFDIR | S_IRWXU,
51887 +#else
51888 .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
51889 +#endif
51890 .s_ino = 1,
51891 };
51892
51893 diff -urNp linux-2.6.32.49/fs/sysfs/symlink.c linux-2.6.32.49/fs/sysfs/symlink.c
51894 --- linux-2.6.32.49/fs/sysfs/symlink.c 2011-11-08 19:02:43.000000000 -0500
51895 +++ linux-2.6.32.49/fs/sysfs/symlink.c 2011-11-15 19:59:43.000000000 -0500
51896 @@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct de
51897
51898 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
51899 {
51900 - char *page = nd_get_link(nd);
51901 + const char *page = nd_get_link(nd);
51902 if (!IS_ERR(page))
51903 free_page((unsigned long)page);
51904 }
51905 diff -urNp linux-2.6.32.49/fs/udf/balloc.c linux-2.6.32.49/fs/udf/balloc.c
51906 --- linux-2.6.32.49/fs/udf/balloc.c 2011-11-08 19:02:43.000000000 -0500
51907 +++ linux-2.6.32.49/fs/udf/balloc.c 2011-11-15 19:59:43.000000000 -0500
51908 @@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struc
51909
51910 mutex_lock(&sbi->s_alloc_mutex);
51911 partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
51912 - if (bloc->logicalBlockNum < 0 ||
51913 - (bloc->logicalBlockNum + count) >
51914 - partmap->s_partition_len) {
51915 + if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
51916 udf_debug("%d < %d || %d + %d > %d\n",
51917 bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
51918 count, partmap->s_partition_len);
51919 @@ -436,9 +434,7 @@ static void udf_table_free_blocks(struct
51920
51921 mutex_lock(&sbi->s_alloc_mutex);
51922 partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
51923 - if (bloc->logicalBlockNum < 0 ||
51924 - (bloc->logicalBlockNum + count) >
51925 - partmap->s_partition_len) {
51926 + if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
51927 udf_debug("%d < %d || %d + %d > %d\n",
51928 bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
51929 partmap->s_partition_len);
51930 diff -urNp linux-2.6.32.49/fs/udf/inode.c linux-2.6.32.49/fs/udf/inode.c
51931 --- linux-2.6.32.49/fs/udf/inode.c 2011-11-08 19:02:43.000000000 -0500
51932 +++ linux-2.6.32.49/fs/udf/inode.c 2011-11-15 19:59:43.000000000 -0500
51933 @@ -484,6 +484,8 @@ static struct buffer_head *inode_getblk(
51934 int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
51935 int lastblock = 0;
51936
51937 + pax_track_stack();
51938 +
51939 prev_epos.offset = udf_file_entry_alloc_offset(inode);
51940 prev_epos.block = iinfo->i_location;
51941 prev_epos.bh = NULL;
51942 diff -urNp linux-2.6.32.49/fs/udf/misc.c linux-2.6.32.49/fs/udf/misc.c
51943 --- linux-2.6.32.49/fs/udf/misc.c 2011-11-08 19:02:43.000000000 -0500
51944 +++ linux-2.6.32.49/fs/udf/misc.c 2011-11-15 19:59:43.000000000 -0500
51945 @@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t id
51946
51947 u8 udf_tag_checksum(const struct tag *t)
51948 {
51949 - u8 *data = (u8 *)t;
51950 + const u8 *data = (const u8 *)t;
51951 u8 checksum = 0;
51952 int i;
51953 for (i = 0; i < sizeof(struct tag); ++i)
51954 diff -urNp linux-2.6.32.49/fs/utimes.c linux-2.6.32.49/fs/utimes.c
51955 --- linux-2.6.32.49/fs/utimes.c 2011-11-08 19:02:43.000000000 -0500
51956 +++ linux-2.6.32.49/fs/utimes.c 2011-11-15 19:59:43.000000000 -0500
51957 @@ -1,6 +1,7 @@
51958 #include <linux/compiler.h>
51959 #include <linux/file.h>
51960 #include <linux/fs.h>
51961 +#include <linux/security.h>
51962 #include <linux/linkage.h>
51963 #include <linux/mount.h>
51964 #include <linux/namei.h>
51965 @@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
51966 goto mnt_drop_write_and_out;
51967 }
51968 }
51969 +
51970 + if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
51971 + error = -EACCES;
51972 + goto mnt_drop_write_and_out;
51973 + }
51974 +
51975 mutex_lock(&inode->i_mutex);
51976 error = notify_change(path->dentry, &newattrs);
51977 mutex_unlock(&inode->i_mutex);
51978 diff -urNp linux-2.6.32.49/fs/xattr_acl.c linux-2.6.32.49/fs/xattr_acl.c
51979 --- linux-2.6.32.49/fs/xattr_acl.c 2011-11-08 19:02:43.000000000 -0500
51980 +++ linux-2.6.32.49/fs/xattr_acl.c 2011-11-15 19:59:43.000000000 -0500
51981 @@ -17,8 +17,8 @@
51982 struct posix_acl *
51983 posix_acl_from_xattr(const void *value, size_t size)
51984 {
51985 - posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
51986 - posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
51987 + const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
51988 + const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
51989 int count;
51990 struct posix_acl *acl;
51991 struct posix_acl_entry *acl_e;
51992 diff -urNp linux-2.6.32.49/fs/xattr.c linux-2.6.32.49/fs/xattr.c
51993 --- linux-2.6.32.49/fs/xattr.c 2011-11-08 19:02:43.000000000 -0500
51994 +++ linux-2.6.32.49/fs/xattr.c 2011-11-15 19:59:43.000000000 -0500
51995 @@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
51996 * Extended attribute SET operations
51997 */
51998 static long
51999 -setxattr(struct dentry *d, const char __user *name, const void __user *value,
52000 +setxattr(struct path *path, const char __user *name, const void __user *value,
52001 size_t size, int flags)
52002 {
52003 int error;
52004 @@ -271,7 +271,13 @@ setxattr(struct dentry *d, const char __
52005 return PTR_ERR(kvalue);
52006 }
52007
52008 - error = vfs_setxattr(d, kname, kvalue, size, flags);
52009 + if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
52010 + error = -EACCES;
52011 + goto out;
52012 + }
52013 +
52014 + error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
52015 +out:
52016 kfree(kvalue);
52017 return error;
52018 }
52019 @@ -288,7 +294,7 @@ SYSCALL_DEFINE5(setxattr, const char __u
52020 return error;
52021 error = mnt_want_write(path.mnt);
52022 if (!error) {
52023 - error = setxattr(path.dentry, name, value, size, flags);
52024 + error = setxattr(&path, name, value, size, flags);
52025 mnt_drop_write(path.mnt);
52026 }
52027 path_put(&path);
52028 @@ -307,7 +313,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __
52029 return error;
52030 error = mnt_want_write(path.mnt);
52031 if (!error) {
52032 - error = setxattr(path.dentry, name, value, size, flags);
52033 + error = setxattr(&path, name, value, size, flags);
52034 mnt_drop_write(path.mnt);
52035 }
52036 path_put(&path);
52037 @@ -318,17 +324,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons
52038 const void __user *,value, size_t, size, int, flags)
52039 {
52040 struct file *f;
52041 - struct dentry *dentry;
52042 int error = -EBADF;
52043
52044 f = fget(fd);
52045 if (!f)
52046 return error;
52047 - dentry = f->f_path.dentry;
52048 - audit_inode(NULL, dentry);
52049 + audit_inode(NULL, f->f_path.dentry);
52050 error = mnt_want_write_file(f);
52051 if (!error) {
52052 - error = setxattr(dentry, name, value, size, flags);
52053 + error = setxattr(&f->f_path, name, value, size, flags);
52054 mnt_drop_write(f->f_path.mnt);
52055 }
52056 fput(f);
52057 diff -urNp linux-2.6.32.49/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.32.49/fs/xfs/linux-2.6/xfs_ioctl32.c
52058 --- linux-2.6.32.49/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-11-08 19:02:43.000000000 -0500
52059 +++ linux-2.6.32.49/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-11-15 19:59:43.000000000 -0500
52060 @@ -75,6 +75,7 @@ xfs_compat_ioc_fsgeometry_v1(
52061 xfs_fsop_geom_t fsgeo;
52062 int error;
52063
52064 + memset(&fsgeo, 0, sizeof(fsgeo));
52065 error = xfs_fs_geometry(mp, &fsgeo, 3);
52066 if (error)
52067 return -error;
52068 diff -urNp linux-2.6.32.49/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.32.49/fs/xfs/linux-2.6/xfs_ioctl.c
52069 --- linux-2.6.32.49/fs/xfs/linux-2.6/xfs_ioctl.c 2011-11-08 19:02:43.000000000 -0500
52070 +++ linux-2.6.32.49/fs/xfs/linux-2.6/xfs_ioctl.c 2011-11-15 19:59:43.000000000 -0500
52071 @@ -134,7 +134,7 @@ xfs_find_handle(
52072 }
52073
52074 error = -EFAULT;
52075 - if (copy_to_user(hreq->ohandle, &handle, hsize) ||
52076 + if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
52077 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
52078 goto out_put;
52079
52080 @@ -423,7 +423,7 @@ xfs_attrlist_by_handle(
52081 if (IS_ERR(dentry))
52082 return PTR_ERR(dentry);
52083
52084 - kbuf = kmalloc(al_hreq.buflen, GFP_KERNEL);
52085 + kbuf = kzalloc(al_hreq.buflen, GFP_KERNEL);
52086 if (!kbuf)
52087 goto out_dput;
52088
52089 @@ -697,7 +697,7 @@ xfs_ioc_fsgeometry_v1(
52090 xfs_mount_t *mp,
52091 void __user *arg)
52092 {
52093 - xfs_fsop_geom_t fsgeo;
52094 + xfs_fsop_geom_t fsgeo;
52095 int error;
52096
52097 error = xfs_fs_geometry(mp, &fsgeo, 3);
52098 diff -urNp linux-2.6.32.49/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.32.49/fs/xfs/linux-2.6/xfs_iops.c
52099 --- linux-2.6.32.49/fs/xfs/linux-2.6/xfs_iops.c 2011-11-08 19:02:43.000000000 -0500
52100 +++ linux-2.6.32.49/fs/xfs/linux-2.6/xfs_iops.c 2011-11-15 19:59:43.000000000 -0500
52101 @@ -468,7 +468,7 @@ xfs_vn_put_link(
52102 struct nameidata *nd,
52103 void *p)
52104 {
52105 - char *s = nd_get_link(nd);
52106 + const char *s = nd_get_link(nd);
52107
52108 if (!IS_ERR(s))
52109 kfree(s);
52110 diff -urNp linux-2.6.32.49/fs/xfs/xfs_bmap.c linux-2.6.32.49/fs/xfs/xfs_bmap.c
52111 --- linux-2.6.32.49/fs/xfs/xfs_bmap.c 2011-11-08 19:02:43.000000000 -0500
52112 +++ linux-2.6.32.49/fs/xfs/xfs_bmap.c 2011-11-15 19:59:43.000000000 -0500
52113 @@ -360,7 +360,7 @@ xfs_bmap_validate_ret(
52114 int nmap,
52115 int ret_nmap);
52116 #else
52117 -#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
52118 +#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
52119 #endif /* DEBUG */
52120
52121 #if defined(XFS_RW_TRACE)
52122 diff -urNp linux-2.6.32.49/fs/xfs/xfs_dir2_sf.c linux-2.6.32.49/fs/xfs/xfs_dir2_sf.c
52123 --- linux-2.6.32.49/fs/xfs/xfs_dir2_sf.c 2011-11-08 19:02:43.000000000 -0500
52124 +++ linux-2.6.32.49/fs/xfs/xfs_dir2_sf.c 2011-11-15 19:59:43.000000000 -0500
52125 @@ -779,7 +779,15 @@ xfs_dir2_sf_getdents(
52126 }
52127
52128 ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
52129 - if (filldir(dirent, sfep->name, sfep->namelen,
52130 + if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
52131 + char name[sfep->namelen];
52132 + memcpy(name, sfep->name, sfep->namelen);
52133 + if (filldir(dirent, name, sfep->namelen,
52134 + off & 0x7fffffff, ino, DT_UNKNOWN)) {
52135 + *offset = off & 0x7fffffff;
52136 + return 0;
52137 + }
52138 + } else if (filldir(dirent, sfep->name, sfep->namelen,
52139 off & 0x7fffffff, ino, DT_UNKNOWN)) {
52140 *offset = off & 0x7fffffff;
52141 return 0;
52142 diff -urNp linux-2.6.32.49/fs/xfs/xfs_vnodeops.c linux-2.6.32.49/fs/xfs/xfs_vnodeops.c
52143 --- linux-2.6.32.49/fs/xfs/xfs_vnodeops.c 2011-11-08 19:02:43.000000000 -0500
52144 +++ linux-2.6.32.49/fs/xfs/xfs_vnodeops.c 2011-11-18 18:59:38.000000000 -0500
52145 @@ -564,13 +564,17 @@ xfs_readlink(
52146
52147 xfs_ilock(ip, XFS_ILOCK_SHARED);
52148
52149 - ASSERT((ip->i_d.di_mode & S_IFMT) == S_IFLNK);
52150 - ASSERT(ip->i_d.di_size <= MAXPATHLEN);
52151 -
52152 pathlen = ip->i_d.di_size;
52153 if (!pathlen)
52154 goto out;
52155
52156 + if (pathlen > MAXPATHLEN) {
52157 + xfs_fs_cmn_err(CE_ALERT, mp, "%s: inode (%llu) symlink length (%d) too long",
52158 + __func__, (unsigned long long)ip->i_ino, pathlen);
52159 + ASSERT(0);
52160 + return XFS_ERROR(EFSCORRUPTED);
52161 + }
52162 +
52163 if (ip->i_df.if_flags & XFS_IFINLINE) {
52164 memcpy(link, ip->i_df.if_u1.if_data, pathlen);
52165 link[pathlen] = '\0';
52166 diff -urNp linux-2.6.32.49/grsecurity/gracl_alloc.c linux-2.6.32.49/grsecurity/gracl_alloc.c
52167 --- linux-2.6.32.49/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500
52168 +++ linux-2.6.32.49/grsecurity/gracl_alloc.c 2011-11-15 19:59:43.000000000 -0500
52169 @@ -0,0 +1,105 @@
52170 +#include <linux/kernel.h>
52171 +#include <linux/mm.h>
52172 +#include <linux/slab.h>
52173 +#include <linux/vmalloc.h>
52174 +#include <linux/gracl.h>
52175 +#include <linux/grsecurity.h>
52176 +
52177 +static unsigned long alloc_stack_next = 1;
52178 +static unsigned long alloc_stack_size = 1;
52179 +static void **alloc_stack;
52180 +
52181 +static __inline__ int
52182 +alloc_pop(void)
52183 +{
52184 + if (alloc_stack_next == 1)
52185 + return 0;
52186 +
52187 + kfree(alloc_stack[alloc_stack_next - 2]);
52188 +
52189 + alloc_stack_next--;
52190 +
52191 + return 1;
52192 +}
52193 +
52194 +static __inline__ int
52195 +alloc_push(void *buf)
52196 +{
52197 + if (alloc_stack_next >= alloc_stack_size)
52198 + return 1;
52199 +
52200 + alloc_stack[alloc_stack_next - 1] = buf;
52201 +
52202 + alloc_stack_next++;
52203 +
52204 + return 0;
52205 +}
52206 +
52207 +void *
52208 +acl_alloc(unsigned long len)
52209 +{
52210 + void *ret = NULL;
52211 +
52212 + if (!len || len > PAGE_SIZE)
52213 + goto out;
52214 +
52215 + ret = kmalloc(len, GFP_KERNEL);
52216 +
52217 + if (ret) {
52218 + if (alloc_push(ret)) {
52219 + kfree(ret);
52220 + ret = NULL;
52221 + }
52222 + }
52223 +
52224 +out:
52225 + return ret;
52226 +}
52227 +
52228 +void *
52229 +acl_alloc_num(unsigned long num, unsigned long len)
52230 +{
52231 + if (!len || (num > (PAGE_SIZE / len)))
52232 + return NULL;
52233 +
52234 + return acl_alloc(num * len);
52235 +}
52236 +
52237 +void
52238 +acl_free_all(void)
52239 +{
52240 + if (gr_acl_is_enabled() || !alloc_stack)
52241 + return;
52242 +
52243 + while (alloc_pop()) ;
52244 +
52245 + if (alloc_stack) {
52246 + if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
52247 + kfree(alloc_stack);
52248 + else
52249 + vfree(alloc_stack);
52250 + }
52251 +
52252 + alloc_stack = NULL;
52253 + alloc_stack_size = 1;
52254 + alloc_stack_next = 1;
52255 +
52256 + return;
52257 +}
52258 +
52259 +int
52260 +acl_alloc_stack_init(unsigned long size)
52261 +{
52262 + if ((size * sizeof (void *)) <= PAGE_SIZE)
52263 + alloc_stack =
52264 + (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
52265 + else
52266 + alloc_stack = (void **) vmalloc(size * sizeof (void *));
52267 +
52268 + alloc_stack_size = size;
52269 +
52270 + if (!alloc_stack)
52271 + return 0;
52272 + else
52273 + return 1;
52274 +}
52275 diff -urNp linux-2.6.32.49/grsecurity/gracl.c linux-2.6.32.49/grsecurity/gracl.c
52276 --- linux-2.6.32.49/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500
52277 +++ linux-2.6.32.49/grsecurity/gracl.c 2011-11-16 17:55:28.000000000 -0500
52278 @@ -0,0 +1,4141 @@
52279 +#include <linux/kernel.h>
52280 +#include <linux/module.h>
52281 +#include <linux/sched.h>
52282 +#include <linux/mm.h>
52283 +#include <linux/file.h>
52284 +#include <linux/fs.h>
52285 +#include <linux/namei.h>
52286 +#include <linux/mount.h>
52287 +#include <linux/tty.h>
52288 +#include <linux/proc_fs.h>
52289 +#include <linux/smp_lock.h>
52290 +#include <linux/slab.h>
52291 +#include <linux/vmalloc.h>
52292 +#include <linux/types.h>
52293 +#include <linux/sysctl.h>
52294 +#include <linux/netdevice.h>
52295 +#include <linux/ptrace.h>
52296 +#include <linux/gracl.h>
52297 +#include <linux/gralloc.h>
52298 +#include <linux/grsecurity.h>
52299 +#include <linux/grinternal.h>
52300 +#include <linux/pid_namespace.h>
52301 +#include <linux/fdtable.h>
52302 +#include <linux/percpu.h>
52303 +
52304 +#include <asm/uaccess.h>
52305 +#include <asm/errno.h>
52306 +#include <asm/mman.h>
52307 +
52308 +static struct acl_role_db acl_role_set;
52309 +static struct name_db name_set;
52310 +static struct inodev_db inodev_set;
52311 +
52312 +/* for keeping track of userspace pointers used for subjects, so we
52313 + can share references in the kernel as well
52314 +*/
52315 +
52316 +static struct dentry *real_root;
52317 +static struct vfsmount *real_root_mnt;
52318 +
52319 +static struct acl_subj_map_db subj_map_set;
52320 +
52321 +static struct acl_role_label *default_role;
52322 +
52323 +static struct acl_role_label *role_list;
52324 +
52325 +static u16 acl_sp_role_value;
52326 +
52327 +extern char *gr_shared_page[4];
52328 +static DEFINE_MUTEX(gr_dev_mutex);
52329 +DEFINE_RWLOCK(gr_inode_lock);
52330 +
52331 +struct gr_arg *gr_usermode;
52332 +
52333 +static unsigned int gr_status __read_only = GR_STATUS_INIT;
52334 +
52335 +extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
52336 +extern void gr_clear_learn_entries(void);
52337 +
52338 +#ifdef CONFIG_GRKERNSEC_RESLOG
52339 +extern void gr_log_resource(const struct task_struct *task,
52340 + const int res, const unsigned long wanted, const int gt);
52341 +#endif
52342 +
52343 +unsigned char *gr_system_salt;
52344 +unsigned char *gr_system_sum;
52345 +
52346 +static struct sprole_pw **acl_special_roles = NULL;
52347 +static __u16 num_sprole_pws = 0;
52348 +
52349 +static struct acl_role_label *kernel_role = NULL;
52350 +
52351 +static unsigned int gr_auth_attempts = 0;
52352 +static unsigned long gr_auth_expires = 0UL;
52353 +
52354 +#ifdef CONFIG_NET
52355 +extern struct vfsmount *sock_mnt;
52356 +#endif
52357 +extern struct vfsmount *pipe_mnt;
52358 +extern struct vfsmount *shm_mnt;
52359 +#ifdef CONFIG_HUGETLBFS
52360 +extern struct vfsmount *hugetlbfs_vfsmount;
52361 +#endif
52362 +
52363 +static struct acl_object_label *fakefs_obj_rw;
52364 +static struct acl_object_label *fakefs_obj_rwx;
52365 +
52366 +extern int gr_init_uidset(void);
52367 +extern void gr_free_uidset(void);
52368 +extern void gr_remove_uid(uid_t uid);
52369 +extern int gr_find_uid(uid_t uid);
52370 +
52371 +__inline__ int
52372 +gr_acl_is_enabled(void)
52373 +{
52374 + return (gr_status & GR_READY);
52375 +}
52376 +
52377 +#ifdef CONFIG_BTRFS_FS
52378 +extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
52379 +extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
52380 +#endif
52381 +
52382 +static inline dev_t __get_dev(const struct dentry *dentry)
52383 +{
52384 +#ifdef CONFIG_BTRFS_FS
52385 + if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
52386 + return get_btrfs_dev_from_inode(dentry->d_inode);
52387 + else
52388 +#endif
52389 + return dentry->d_inode->i_sb->s_dev;
52390 +}
52391 +
52392 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
52393 +{
52394 + return __get_dev(dentry);
52395 +}
52396 +
52397 +static char gr_task_roletype_to_char(struct task_struct *task)
52398 +{
52399 + switch (task->role->roletype &
52400 + (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
52401 + GR_ROLE_SPECIAL)) {
52402 + case GR_ROLE_DEFAULT:
52403 + return 'D';
52404 + case GR_ROLE_USER:
52405 + return 'U';
52406 + case GR_ROLE_GROUP:
52407 + return 'G';
52408 + case GR_ROLE_SPECIAL:
52409 + return 'S';
52410 + }
52411 +
52412 + return 'X';
52413 +}
52414 +
52415 +char gr_roletype_to_char(void)
52416 +{
52417 + return gr_task_roletype_to_char(current);
52418 +}
52419 +
52420 +__inline__ int
52421 +gr_acl_tpe_check(void)
52422 +{
52423 + if (unlikely(!(gr_status & GR_READY)))
52424 + return 0;
52425 + if (current->role->roletype & GR_ROLE_TPE)
52426 + return 1;
52427 + else
52428 + return 0;
52429 +}
52430 +
52431 +int
52432 +gr_handle_rawio(const struct inode *inode)
52433 +{
52434 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
52435 + if (inode && S_ISBLK(inode->i_mode) &&
52436 + grsec_enable_chroot_caps && proc_is_chrooted(current) &&
52437 + !capable(CAP_SYS_RAWIO))
52438 + return 1;
52439 +#endif
52440 + return 0;
52441 +}
52442 +
52443 +static int
52444 +gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
52445 +{
52446 + if (likely(lena != lenb))
52447 + return 0;
52448 +
52449 + return !memcmp(a, b, lena);
52450 +}
52451 +
52452 +static int prepend(char **buffer, int *buflen, const char *str, int namelen)
52453 +{
52454 + *buflen -= namelen;
52455 + if (*buflen < 0)
52456 + return -ENAMETOOLONG;
52457 + *buffer -= namelen;
52458 + memcpy(*buffer, str, namelen);
52459 + return 0;
52460 +}
52461 +
52462 +/* this must be called with vfsmount_lock and dcache_lock held */
52463 +
52464 +static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
52465 + struct dentry *root, struct vfsmount *rootmnt,
52466 + char *buffer, int buflen)
52467 +{
52468 + char * end = buffer+buflen;
52469 + char * retval;
52470 + int namelen;
52471 +
52472 + *--end = '\0';
52473 + buflen--;
52474 +
52475 + if (buflen < 1)
52476 + goto Elong;
52477 + /* Get '/' right */
52478 + retval = end-1;
52479 + *retval = '/';
52480 +
52481 + for (;;) {
52482 + struct dentry * parent;
52483 +
52484 + if (dentry == root && vfsmnt == rootmnt)
52485 + break;
52486 + if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
52487 + /* Global root? */
52488 + if (vfsmnt->mnt_parent == vfsmnt)
52489 + goto global_root;
52490 + dentry = vfsmnt->mnt_mountpoint;
52491 + vfsmnt = vfsmnt->mnt_parent;
52492 + continue;
52493 + }
52494 + parent = dentry->d_parent;
52495 + prefetch(parent);
52496 + namelen = dentry->d_name.len;
52497 + buflen -= namelen + 1;
52498 + if (buflen < 0)
52499 + goto Elong;
52500 + end -= namelen;
52501 + memcpy(end, dentry->d_name.name, namelen);
52502 + *--end = '/';
52503 + retval = end;
52504 + dentry = parent;
52505 + }
52506 +
52507 +out:
52508 + return retval;
52509 +
52510 +global_root:
52511 + namelen = dentry->d_name.len;
52512 + buflen -= namelen;
52513 + if (buflen < 0)
52514 + goto Elong;
52515 + retval -= namelen-1; /* hit the slash */
52516 + memcpy(retval, dentry->d_name.name, namelen);
52517 + goto out;
52518 +Elong:
52519 + retval = ERR_PTR(-ENAMETOOLONG);
52520 + goto out;
52521 +}
52522 +
52523 +static char *
52524 +gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
52525 + struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
52526 +{
52527 + char *retval;
52528 +
52529 + retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
52530 + if (unlikely(IS_ERR(retval)))
52531 + retval = strcpy(buf, "<path too long>");
52532 + else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
52533 + retval[1] = '\0';
52534 +
52535 + return retval;
52536 +}
52537 +
52538 +static char *
52539 +__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
52540 + char *buf, int buflen)
52541 +{
52542 + char *res;
52543 +
52544 + /* we can use real_root, real_root_mnt, because this is only called
52545 + by the RBAC system */
52546 + res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
52547 +
52548 + return res;
52549 +}
52550 +
52551 +static char *
52552 +d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
52553 + char *buf, int buflen)
52554 +{
52555 + char *res;
52556 + struct dentry *root;
52557 + struct vfsmount *rootmnt;
52558 + struct task_struct *reaper = &init_task;
52559 +
52560 + /* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
52561 + read_lock(&reaper->fs->lock);
52562 + root = dget(reaper->fs->root.dentry);
52563 + rootmnt = mntget(reaper->fs->root.mnt);
52564 + read_unlock(&reaper->fs->lock);
52565 +
52566 + spin_lock(&dcache_lock);
52567 + spin_lock(&vfsmount_lock);
52568 + res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
52569 + spin_unlock(&vfsmount_lock);
52570 + spin_unlock(&dcache_lock);
52571 +
52572 + dput(root);
52573 + mntput(rootmnt);
52574 + return res;
52575 +}
52576 +
52577 +static char *
52578 +gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
52579 +{
52580 + char *ret;
52581 + spin_lock(&dcache_lock);
52582 + spin_lock(&vfsmount_lock);
52583 + ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
52584 + PAGE_SIZE);
52585 + spin_unlock(&vfsmount_lock);
52586 + spin_unlock(&dcache_lock);
52587 + return ret;
52588 +}
52589 +
52590 +static char *
52591 +gr_to_proc_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
52592 +{
52593 + char *ret;
52594 + char *buf;
52595 + int buflen;
52596 +
52597 + spin_lock(&dcache_lock);
52598 + spin_lock(&vfsmount_lock);
52599 + buf = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
52600 + ret = __d_real_path(dentry, mnt, buf, PAGE_SIZE - 6);
52601 + buflen = (int)(ret - buf);
52602 + if (buflen >= 5)
52603 + prepend(&ret, &buflen, "/proc", 5);
52604 + else
52605 + ret = strcpy(buf, "<path too long>");
52606 + spin_unlock(&vfsmount_lock);
52607 + spin_unlock(&dcache_lock);
52608 + return ret;
52609 +}
52610 +
52611 +char *
52612 +gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
52613 +{
52614 + return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
52615 + PAGE_SIZE);
52616 +}
52617 +
52618 +char *
52619 +gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
52620 +{
52621 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
52622 + PAGE_SIZE);
52623 +}
52624 +
52625 +char *
52626 +gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
52627 +{
52628 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
52629 + PAGE_SIZE);
52630 +}
52631 +
52632 +char *
52633 +gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
52634 +{
52635 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
52636 + PAGE_SIZE);
52637 +}
52638 +
52639 +char *
52640 +gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
52641 +{
52642 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
52643 + PAGE_SIZE);
52644 +}
52645 +
52646 +__inline__ __u32
52647 +to_gr_audit(const __u32 reqmode)
52648 +{
52649 + /* masks off auditable permission flags, then shifts them to create
52650 + auditing flags, and adds the special case of append auditing if
52651 + we're requesting write */
52652 + return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
52653 +}
52654 +
52655 +struct acl_subject_label *
52656 +lookup_subject_map(const struct acl_subject_label *userp)
52657 +{
52658 + unsigned int index = shash(userp, subj_map_set.s_size);
52659 + struct subject_map *match;
52660 +
52661 + match = subj_map_set.s_hash[index];
52662 +
52663 + while (match && match->user != userp)
52664 + match = match->next;
52665 +
52666 + if (match != NULL)
52667 + return match->kernel;
52668 + else
52669 + return NULL;
52670 +}
52671 +
52672 +static void
52673 +insert_subj_map_entry(struct subject_map *subjmap)
52674 +{
52675 + unsigned int index = shash(subjmap->user, subj_map_set.s_size);
52676 + struct subject_map **curr;
52677 +
52678 + subjmap->prev = NULL;
52679 +
52680 + curr = &subj_map_set.s_hash[index];
52681 + if (*curr != NULL)
52682 + (*curr)->prev = subjmap;
52683 +
52684 + subjmap->next = *curr;
52685 + *curr = subjmap;
52686 +
52687 + return;
52688 +}
52689 +
52690 +static struct acl_role_label *
52691 +lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
52692 + const gid_t gid)
52693 +{
52694 + unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
52695 + struct acl_role_label *match;
52696 + struct role_allowed_ip *ipp;
52697 + unsigned int x;
52698 + u32 curr_ip = task->signal->curr_ip;
52699 +
52700 + task->signal->saved_ip = curr_ip;
52701 +
52702 + match = acl_role_set.r_hash[index];
52703 +
52704 + while (match) {
52705 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
52706 + for (x = 0; x < match->domain_child_num; x++) {
52707 + if (match->domain_children[x] == uid)
52708 + goto found;
52709 + }
52710 + } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
52711 + break;
52712 + match = match->next;
52713 + }
52714 +found:
52715 + if (match == NULL) {
52716 + try_group:
52717 + index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
52718 + match = acl_role_set.r_hash[index];
52719 +
52720 + while (match) {
52721 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
52722 + for (x = 0; x < match->domain_child_num; x++) {
52723 + if (match->domain_children[x] == gid)
52724 + goto found2;
52725 + }
52726 + } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
52727 + break;
52728 + match = match->next;
52729 + }
52730 +found2:
52731 + if (match == NULL)
52732 + match = default_role;
52733 + if (match->allowed_ips == NULL)
52734 + return match;
52735 + else {
52736 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
52737 + if (likely
52738 + ((ntohl(curr_ip) & ipp->netmask) ==
52739 + (ntohl(ipp->addr) & ipp->netmask)))
52740 + return match;
52741 + }
52742 + match = default_role;
52743 + }
52744 + } else if (match->allowed_ips == NULL) {
52745 + return match;
52746 + } else {
52747 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
52748 + if (likely
52749 + ((ntohl(curr_ip) & ipp->netmask) ==
52750 + (ntohl(ipp->addr) & ipp->netmask)))
52751 + return match;
52752 + }
52753 + goto try_group;
52754 + }
52755 +
52756 + return match;
52757 +}
52758 +
52759 +struct acl_subject_label *
52760 +lookup_acl_subj_label(const ino_t ino, const dev_t dev,
52761 + const struct acl_role_label *role)
52762 +{
52763 + unsigned int index = fhash(ino, dev, role->subj_hash_size);
52764 + struct acl_subject_label *match;
52765 +
52766 + match = role->subj_hash[index];
52767 +
52768 + while (match && (match->inode != ino || match->device != dev ||
52769 + (match->mode & GR_DELETED))) {
52770 + match = match->next;
52771 + }
52772 +
52773 + if (match && !(match->mode & GR_DELETED))
52774 + return match;
52775 + else
52776 + return NULL;
52777 +}
52778 +
52779 +struct acl_subject_label *
52780 +lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
52781 + const struct acl_role_label *role)
52782 +{
52783 + unsigned int index = fhash(ino, dev, role->subj_hash_size);
52784 + struct acl_subject_label *match;
52785 +
52786 + match = role->subj_hash[index];
52787 +
52788 + while (match && (match->inode != ino || match->device != dev ||
52789 + !(match->mode & GR_DELETED))) {
52790 + match = match->next;
52791 + }
52792 +
52793 + if (match && (match->mode & GR_DELETED))
52794 + return match;
52795 + else
52796 + return NULL;
52797 +}
52798 +
52799 +static struct acl_object_label *
52800 +lookup_acl_obj_label(const ino_t ino, const dev_t dev,
52801 + const struct acl_subject_label *subj)
52802 +{
52803 + unsigned int index = fhash(ino, dev, subj->obj_hash_size);
52804 + struct acl_object_label *match;
52805 +
52806 + match = subj->obj_hash[index];
52807 +
52808 + while (match && (match->inode != ino || match->device != dev ||
52809 + (match->mode & GR_DELETED))) {
52810 + match = match->next;
52811 + }
52812 +
52813 + if (match && !(match->mode & GR_DELETED))
52814 + return match;
52815 + else
52816 + return NULL;
52817 +}
52818 +
52819 +static struct acl_object_label *
52820 +lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
52821 + const struct acl_subject_label *subj)
52822 +{
52823 + unsigned int index = fhash(ino, dev, subj->obj_hash_size);
52824 + struct acl_object_label *match;
52825 +
52826 + match = subj->obj_hash[index];
52827 +
52828 + while (match && (match->inode != ino || match->device != dev ||
52829 + !(match->mode & GR_DELETED))) {
52830 + match = match->next;
52831 + }
52832 +
52833 + if (match && (match->mode & GR_DELETED))
52834 + return match;
52835 +
52836 + match = subj->obj_hash[index];
52837 +
52838 + while (match && (match->inode != ino || match->device != dev ||
52839 + (match->mode & GR_DELETED))) {
52840 + match = match->next;
52841 + }
52842 +
52843 + if (match && !(match->mode & GR_DELETED))
52844 + return match;
52845 + else
52846 + return NULL;
52847 +}
52848 +
52849 +static struct name_entry *
52850 +lookup_name_entry(const char *name)
52851 +{
52852 + unsigned int len = strlen(name);
52853 + unsigned int key = full_name_hash(name, len);
52854 + unsigned int index = key % name_set.n_size;
52855 + struct name_entry *match;
52856 +
52857 + match = name_set.n_hash[index];
52858 +
52859 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
52860 + match = match->next;
52861 +
52862 + return match;
52863 +}
52864 +
52865 +static struct name_entry *
52866 +lookup_name_entry_create(const char *name)
52867 +{
52868 + unsigned int len = strlen(name);
52869 + unsigned int key = full_name_hash(name, len);
52870 + unsigned int index = key % name_set.n_size;
52871 + struct name_entry *match;
52872 +
52873 + match = name_set.n_hash[index];
52874 +
52875 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
52876 + !match->deleted))
52877 + match = match->next;
52878 +
52879 + if (match && match->deleted)
52880 + return match;
52881 +
52882 + match = name_set.n_hash[index];
52883 +
52884 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
52885 + match->deleted))
52886 + match = match->next;
52887 +
52888 + if (match && !match->deleted)
52889 + return match;
52890 + else
52891 + return NULL;
52892 +}
52893 +
52894 +static struct inodev_entry *
52895 +lookup_inodev_entry(const ino_t ino, const dev_t dev)
52896 +{
52897 + unsigned int index = fhash(ino, dev, inodev_set.i_size);
52898 + struct inodev_entry *match;
52899 +
52900 + match = inodev_set.i_hash[index];
52901 +
52902 + while (match && (match->nentry->inode != ino || match->nentry->device != dev))
52903 + match = match->next;
52904 +
52905 + return match;
52906 +}
52907 +
52908 +static void
52909 +insert_inodev_entry(struct inodev_entry *entry)
52910 +{
52911 + unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
52912 + inodev_set.i_size);
52913 + struct inodev_entry **curr;
52914 +
52915 + entry->prev = NULL;
52916 +
52917 + curr = &inodev_set.i_hash[index];
52918 + if (*curr != NULL)
52919 + (*curr)->prev = entry;
52920 +
52921 + entry->next = *curr;
52922 + *curr = entry;
52923 +
52924 + return;
52925 +}
52926 +
52927 +static void
52928 +__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
52929 +{
52930 + unsigned int index =
52931 + rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
52932 + struct acl_role_label **curr;
52933 + struct acl_role_label *tmp;
52934 +
52935 + curr = &acl_role_set.r_hash[index];
52936 +
52937 + /* if role was already inserted due to domains and already has
52938 + a role in the same bucket as it attached, then we need to
52939 + combine these two buckets
52940 + */
52941 + if (role->next) {
52942 + tmp = role->next;
52943 + while (tmp->next)
52944 + tmp = tmp->next;
52945 + tmp->next = *curr;
52946 + } else
52947 + role->next = *curr;
52948 + *curr = role;
52949 +
52950 + return;
52951 +}
52952 +
52953 +static void
52954 +insert_acl_role_label(struct acl_role_label *role)
52955 +{
52956 + int i;
52957 +
52958 + if (role_list == NULL) {
52959 + role_list = role;
52960 + role->prev = NULL;
52961 + } else {
52962 + role->prev = role_list;
52963 + role_list = role;
52964 + }
52965 +
52966 + /* used for hash chains */
52967 + role->next = NULL;
52968 +
52969 + if (role->roletype & GR_ROLE_DOMAIN) {
52970 + for (i = 0; i < role->domain_child_num; i++)
52971 + __insert_acl_role_label(role, role->domain_children[i]);
52972 + } else
52973 + __insert_acl_role_label(role, role->uidgid);
52974 +}
52975 +
52976 +static int
52977 +insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
52978 +{
52979 + struct name_entry **curr, *nentry;
52980 + struct inodev_entry *ientry;
52981 + unsigned int len = strlen(name);
52982 + unsigned int key = full_name_hash(name, len);
52983 + unsigned int index = key % name_set.n_size;
52984 +
52985 + curr = &name_set.n_hash[index];
52986 +
52987 + while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
52988 + curr = &((*curr)->next);
52989 +
52990 + if (*curr != NULL)
52991 + return 1;
52992 +
52993 + nentry = acl_alloc(sizeof (struct name_entry));
52994 + if (nentry == NULL)
52995 + return 0;
52996 + ientry = acl_alloc(sizeof (struct inodev_entry));
52997 + if (ientry == NULL)
52998 + return 0;
52999 + ientry->nentry = nentry;
53000 +
53001 + nentry->key = key;
53002 + nentry->name = name;
53003 + nentry->inode = inode;
53004 + nentry->device = device;
53005 + nentry->len = len;
53006 + nentry->deleted = deleted;
53007 +
53008 + nentry->prev = NULL;
53009 + curr = &name_set.n_hash[index];
53010 + if (*curr != NULL)
53011 + (*curr)->prev = nentry;
53012 + nentry->next = *curr;
53013 + *curr = nentry;
53014 +
53015 + /* insert us into the table searchable by inode/dev */
53016 + insert_inodev_entry(ientry);
53017 +
53018 + return 1;
53019 +}
53020 +
53021 +static void
53022 +insert_acl_obj_label(struct acl_object_label *obj,
53023 + struct acl_subject_label *subj)
53024 +{
53025 + unsigned int index =
53026 + fhash(obj->inode, obj->device, subj->obj_hash_size);
53027 + struct acl_object_label **curr;
53028 +
53029 +
53030 + obj->prev = NULL;
53031 +
53032 + curr = &subj->obj_hash[index];
53033 + if (*curr != NULL)
53034 + (*curr)->prev = obj;
53035 +
53036 + obj->next = *curr;
53037 + *curr = obj;
53038 +
53039 + return;
53040 +}
53041 +
53042 +static void
53043 +insert_acl_subj_label(struct acl_subject_label *obj,
53044 + struct acl_role_label *role)
53045 +{
53046 + unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
53047 + struct acl_subject_label **curr;
53048 +
53049 + obj->prev = NULL;
53050 +
53051 + curr = &role->subj_hash[index];
53052 + if (*curr != NULL)
53053 + (*curr)->prev = obj;
53054 +
53055 + obj->next = *curr;
53056 + *curr = obj;
53057 +
53058 + return;
53059 +}
53060 +
53061 +/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
53062 +
53063 +static void *
53064 +create_table(__u32 * len, int elementsize)
53065 +{
53066 + unsigned int table_sizes[] = {
53067 + 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
53068 + 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
53069 + 4194301, 8388593, 16777213, 33554393, 67108859
53070 + };
53071 + void *newtable = NULL;
53072 + unsigned int pwr = 0;
53073 +
53074 + while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
53075 + table_sizes[pwr] <= *len)
53076 + pwr++;
53077 +
53078 + if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
53079 + return newtable;
53080 +
53081 + if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
53082 + newtable =
53083 + kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
53084 + else
53085 + newtable = vmalloc(table_sizes[pwr] * elementsize);
53086 +
53087 + *len = table_sizes[pwr];
53088 +
53089 + return newtable;
53090 +}
53091 +
53092 +static int
53093 +init_variables(const struct gr_arg *arg)
53094 +{
53095 + struct task_struct *reaper = &init_task;
53096 + unsigned int stacksize;
53097 +
53098 + subj_map_set.s_size = arg->role_db.num_subjects;
53099 + acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
53100 + name_set.n_size = arg->role_db.num_objects;
53101 + inodev_set.i_size = arg->role_db.num_objects;
53102 +
53103 + if (!subj_map_set.s_size || !acl_role_set.r_size ||
53104 + !name_set.n_size || !inodev_set.i_size)
53105 + return 1;
53106 +
53107 + if (!gr_init_uidset())
53108 + return 1;
53109 +
53110 + /* set up the stack that holds allocation info */
53111 +
53112 + stacksize = arg->role_db.num_pointers + 5;
53113 +
53114 + if (!acl_alloc_stack_init(stacksize))
53115 + return 1;
53116 +
53117 + /* grab reference for the real root dentry and vfsmount */
53118 + read_lock(&reaper->fs->lock);
53119 + real_root = dget(reaper->fs->root.dentry);
53120 + real_root_mnt = mntget(reaper->fs->root.mnt);
53121 + read_unlock(&reaper->fs->lock);
53122 +
53123 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53124 + printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root), real_root->d_inode->i_ino);
53125 +#endif
53126 +
53127 + fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
53128 + if (fakefs_obj_rw == NULL)
53129 + return 1;
53130 + fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
53131 +
53132 + fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
53133 + if (fakefs_obj_rwx == NULL)
53134 + return 1;
53135 + fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
53136 +
53137 + subj_map_set.s_hash =
53138 + (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
53139 + acl_role_set.r_hash =
53140 + (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
53141 + name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
53142 + inodev_set.i_hash =
53143 + (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
53144 +
53145 + if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
53146 + !name_set.n_hash || !inodev_set.i_hash)
53147 + return 1;
53148 +
53149 + memset(subj_map_set.s_hash, 0,
53150 + sizeof(struct subject_map *) * subj_map_set.s_size);
53151 + memset(acl_role_set.r_hash, 0,
53152 + sizeof (struct acl_role_label *) * acl_role_set.r_size);
53153 + memset(name_set.n_hash, 0,
53154 + sizeof (struct name_entry *) * name_set.n_size);
53155 + memset(inodev_set.i_hash, 0,
53156 + sizeof (struct inodev_entry *) * inodev_set.i_size);
53157 +
53158 + return 0;
53159 +}
53160 +
53161 +/* free information not needed after startup
53162 + currently contains user->kernel pointer mappings for subjects
53163 +*/
53164 +
53165 +static void
53166 +free_init_variables(void)
53167 +{
53168 + __u32 i;
53169 +
53170 + if (subj_map_set.s_hash) {
53171 + for (i = 0; i < subj_map_set.s_size; i++) {
53172 + if (subj_map_set.s_hash[i]) {
53173 + kfree(subj_map_set.s_hash[i]);
53174 + subj_map_set.s_hash[i] = NULL;
53175 + }
53176 + }
53177 +
53178 + if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
53179 + PAGE_SIZE)
53180 + kfree(subj_map_set.s_hash);
53181 + else
53182 + vfree(subj_map_set.s_hash);
53183 + }
53184 +
53185 + return;
53186 +}
53187 +
53188 +static void
53189 +free_variables(void)
53190 +{
53191 + struct acl_subject_label *s;
53192 + struct acl_role_label *r;
53193 + struct task_struct *task, *task2;
53194 + unsigned int x;
53195 +
53196 + gr_clear_learn_entries();
53197 +
53198 + read_lock(&tasklist_lock);
53199 + do_each_thread(task2, task) {
53200 + task->acl_sp_role = 0;
53201 + task->acl_role_id = 0;
53202 + task->acl = NULL;
53203 + task->role = NULL;
53204 + } while_each_thread(task2, task);
53205 + read_unlock(&tasklist_lock);
53206 +
53207 + /* release the reference to the real root dentry and vfsmount */
53208 + if (real_root)
53209 + dput(real_root);
53210 + real_root = NULL;
53211 + if (real_root_mnt)
53212 + mntput(real_root_mnt);
53213 + real_root_mnt = NULL;
53214 +
53215 + /* free all object hash tables */
53216 +
53217 + FOR_EACH_ROLE_START(r)
53218 + if (r->subj_hash == NULL)
53219 + goto next_role;
53220 + FOR_EACH_SUBJECT_START(r, s, x)
53221 + if (s->obj_hash == NULL)
53222 + break;
53223 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
53224 + kfree(s->obj_hash);
53225 + else
53226 + vfree(s->obj_hash);
53227 + FOR_EACH_SUBJECT_END(s, x)
53228 + FOR_EACH_NESTED_SUBJECT_START(r, s)
53229 + if (s->obj_hash == NULL)
53230 + break;
53231 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
53232 + kfree(s->obj_hash);
53233 + else
53234 + vfree(s->obj_hash);
53235 + FOR_EACH_NESTED_SUBJECT_END(s)
53236 + if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
53237 + kfree(r->subj_hash);
53238 + else
53239 + vfree(r->subj_hash);
53240 + r->subj_hash = NULL;
53241 +next_role:
53242 + FOR_EACH_ROLE_END(r)
53243 +
53244 + acl_free_all();
53245 +
53246 + if (acl_role_set.r_hash) {
53247 + if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
53248 + PAGE_SIZE)
53249 + kfree(acl_role_set.r_hash);
53250 + else
53251 + vfree(acl_role_set.r_hash);
53252 + }
53253 + if (name_set.n_hash) {
53254 + if ((name_set.n_size * sizeof (struct name_entry *)) <=
53255 + PAGE_SIZE)
53256 + kfree(name_set.n_hash);
53257 + else
53258 + vfree(name_set.n_hash);
53259 + }
53260 +
53261 + if (inodev_set.i_hash) {
53262 + if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
53263 + PAGE_SIZE)
53264 + kfree(inodev_set.i_hash);
53265 + else
53266 + vfree(inodev_set.i_hash);
53267 + }
53268 +
53269 + gr_free_uidset();
53270 +
53271 + memset(&name_set, 0, sizeof (struct name_db));
53272 + memset(&inodev_set, 0, sizeof (struct inodev_db));
53273 + memset(&acl_role_set, 0, sizeof (struct acl_role_db));
53274 + memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
53275 +
53276 + default_role = NULL;
53277 + role_list = NULL;
53278 +
53279 + return;
53280 +}
53281 +
53282 +static __u32
53283 +count_user_objs(struct acl_object_label *userp)
53284 +{
53285 + struct acl_object_label o_tmp;
53286 + __u32 num = 0;
53287 +
53288 + while (userp) {
53289 + if (copy_from_user(&o_tmp, userp,
53290 + sizeof (struct acl_object_label)))
53291 + break;
53292 +
53293 + userp = o_tmp.prev;
53294 + num++;
53295 + }
53296 +
53297 + return num;
53298 +}
53299 +
53300 +static struct acl_subject_label *
53301 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
53302 +
53303 +static int
53304 +copy_user_glob(struct acl_object_label *obj)
53305 +{
53306 + struct acl_object_label *g_tmp, **guser;
53307 + unsigned int len;
53308 + char *tmp;
53309 +
53310 + if (obj->globbed == NULL)
53311 + return 0;
53312 +
53313 + guser = &obj->globbed;
53314 + while (*guser) {
53315 + g_tmp = (struct acl_object_label *)
53316 + acl_alloc(sizeof (struct acl_object_label));
53317 + if (g_tmp == NULL)
53318 + return -ENOMEM;
53319 +
53320 + if (copy_from_user(g_tmp, *guser,
53321 + sizeof (struct acl_object_label)))
53322 + return -EFAULT;
53323 +
53324 + len = strnlen_user(g_tmp->filename, PATH_MAX);
53325 +
53326 + if (!len || len >= PATH_MAX)
53327 + return -EINVAL;
53328 +
53329 + if ((tmp = (char *) acl_alloc(len)) == NULL)
53330 + return -ENOMEM;
53331 +
53332 + if (copy_from_user(tmp, g_tmp->filename, len))
53333 + return -EFAULT;
53334 + tmp[len-1] = '\0';
53335 + g_tmp->filename = tmp;
53336 +
53337 + *guser = g_tmp;
53338 + guser = &(g_tmp->next);
53339 + }
53340 +
53341 + return 0;
53342 +}
53343 +
53344 +static int
53345 +copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
53346 + struct acl_role_label *role)
53347 +{
53348 + struct acl_object_label *o_tmp;
53349 + unsigned int len;
53350 + int ret;
53351 + char *tmp;
53352 +
53353 + while (userp) {
53354 + if ((o_tmp = (struct acl_object_label *)
53355 + acl_alloc(sizeof (struct acl_object_label))) == NULL)
53356 + return -ENOMEM;
53357 +
53358 + if (copy_from_user(o_tmp, userp,
53359 + sizeof (struct acl_object_label)))
53360 + return -EFAULT;
53361 +
53362 + userp = o_tmp->prev;
53363 +
53364 + len = strnlen_user(o_tmp->filename, PATH_MAX);
53365 +
53366 + if (!len || len >= PATH_MAX)
53367 + return -EINVAL;
53368 +
53369 + if ((tmp = (char *) acl_alloc(len)) == NULL)
53370 + return -ENOMEM;
53371 +
53372 + if (copy_from_user(tmp, o_tmp->filename, len))
53373 + return -EFAULT;
53374 + tmp[len-1] = '\0';
53375 + o_tmp->filename = tmp;
53376 +
53377 + insert_acl_obj_label(o_tmp, subj);
53378 + if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
53379 + o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
53380 + return -ENOMEM;
53381 +
53382 + ret = copy_user_glob(o_tmp);
53383 + if (ret)
53384 + return ret;
53385 +
53386 + if (o_tmp->nested) {
53387 + o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
53388 + if (IS_ERR(o_tmp->nested))
53389 + return PTR_ERR(o_tmp->nested);
53390 +
53391 + /* insert into nested subject list */
53392 + o_tmp->nested->next = role->hash->first;
53393 + role->hash->first = o_tmp->nested;
53394 + }
53395 + }
53396 +
53397 + return 0;
53398 +}
53399 +
53400 +static __u32
53401 +count_user_subjs(struct acl_subject_label *userp)
53402 +{
53403 + struct acl_subject_label s_tmp;
53404 + __u32 num = 0;
53405 +
53406 + while (userp) {
53407 + if (copy_from_user(&s_tmp, userp,
53408 + sizeof (struct acl_subject_label)))
53409 + break;
53410 +
53411 + userp = s_tmp.prev;
53412 + /* do not count nested subjects against this count, since
53413 + they are not included in the hash table, but are
53414 + attached to objects. We have already counted
53415 + the subjects in userspace for the allocation
53416 + stack
53417 + */
53418 + if (!(s_tmp.mode & GR_NESTED))
53419 + num++;
53420 + }
53421 +
53422 + return num;
53423 +}
53424 +
53425 +static int
53426 +copy_user_allowedips(struct acl_role_label *rolep)
53427 +{
53428 + struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
53429 +
53430 + ruserip = rolep->allowed_ips;
53431 +
53432 + while (ruserip) {
53433 + rlast = rtmp;
53434 +
53435 + if ((rtmp = (struct role_allowed_ip *)
53436 + acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
53437 + return -ENOMEM;
53438 +
53439 + if (copy_from_user(rtmp, ruserip,
53440 + sizeof (struct role_allowed_ip)))
53441 + return -EFAULT;
53442 +
53443 + ruserip = rtmp->prev;
53444 +
53445 + if (!rlast) {
53446 + rtmp->prev = NULL;
53447 + rolep->allowed_ips = rtmp;
53448 + } else {
53449 + rlast->next = rtmp;
53450 + rtmp->prev = rlast;
53451 + }
53452 +
53453 + if (!ruserip)
53454 + rtmp->next = NULL;
53455 + }
53456 +
53457 + return 0;
53458 +}
53459 +
53460 +static int
53461 +copy_user_transitions(struct acl_role_label *rolep)
53462 +{
53463 + struct role_transition *rusertp, *rtmp = NULL, *rlast;
53464 +
53465 + unsigned int len;
53466 + char *tmp;
53467 +
53468 + rusertp = rolep->transitions;
53469 +
53470 + while (rusertp) {
53471 + rlast = rtmp;
53472 +
53473 + if ((rtmp = (struct role_transition *)
53474 + acl_alloc(sizeof (struct role_transition))) == NULL)
53475 + return -ENOMEM;
53476 +
53477 + if (copy_from_user(rtmp, rusertp,
53478 + sizeof (struct role_transition)))
53479 + return -EFAULT;
53480 +
53481 + rusertp = rtmp->prev;
53482 +
53483 + len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
53484 +
53485 + if (!len || len >= GR_SPROLE_LEN)
53486 + return -EINVAL;
53487 +
53488 + if ((tmp = (char *) acl_alloc(len)) == NULL)
53489 + return -ENOMEM;
53490 +
53491 + if (copy_from_user(tmp, rtmp->rolename, len))
53492 + return -EFAULT;
53493 + tmp[len-1] = '\0';
53494 + rtmp->rolename = tmp;
53495 +
53496 + if (!rlast) {
53497 + rtmp->prev = NULL;
53498 + rolep->transitions = rtmp;
53499 + } else {
53500 + rlast->next = rtmp;
53501 + rtmp->prev = rlast;
53502 + }
53503 +
53504 + if (!rusertp)
53505 + rtmp->next = NULL;
53506 + }
53507 +
53508 + return 0;
53509 +}
53510 +
53511 +static struct acl_subject_label *
53512 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
53513 +{
53514 + struct acl_subject_label *s_tmp = NULL, *s_tmp2;
53515 + unsigned int len;
53516 + char *tmp;
53517 + __u32 num_objs;
53518 + struct acl_ip_label **i_tmp, *i_utmp2;
53519 + struct gr_hash_struct ghash;
53520 + struct subject_map *subjmap;
53521 + unsigned int i_num;
53522 + int err;
53523 +
53524 + s_tmp = lookup_subject_map(userp);
53525 +
53526 + /* we've already copied this subject into the kernel, just return
53527 + the reference to it, and don't copy it over again
53528 + */
53529 + if (s_tmp)
53530 + return(s_tmp);
53531 +
53532 + if ((s_tmp = (struct acl_subject_label *)
53533 + acl_alloc(sizeof (struct acl_subject_label))) == NULL)
53534 + return ERR_PTR(-ENOMEM);
53535 +
53536 + subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
53537 + if (subjmap == NULL)
53538 + return ERR_PTR(-ENOMEM);
53539 +
53540 + subjmap->user = userp;
53541 + subjmap->kernel = s_tmp;
53542 + insert_subj_map_entry(subjmap);
53543 +
53544 + if (copy_from_user(s_tmp, userp,
53545 + sizeof (struct acl_subject_label)))
53546 + return ERR_PTR(-EFAULT);
53547 +
53548 + len = strnlen_user(s_tmp->filename, PATH_MAX);
53549 +
53550 + if (!len || len >= PATH_MAX)
53551 + return ERR_PTR(-EINVAL);
53552 +
53553 + if ((tmp = (char *) acl_alloc(len)) == NULL)
53554 + return ERR_PTR(-ENOMEM);
53555 +
53556 + if (copy_from_user(tmp, s_tmp->filename, len))
53557 + return ERR_PTR(-EFAULT);
53558 + tmp[len-1] = '\0';
53559 + s_tmp->filename = tmp;
53560 +
53561 + if (!strcmp(s_tmp->filename, "/"))
53562 + role->root_label = s_tmp;
53563 +
53564 + if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
53565 + return ERR_PTR(-EFAULT);
53566 +
53567 + /* copy user and group transition tables */
53568 +
53569 + if (s_tmp->user_trans_num) {
53570 + uid_t *uidlist;
53571 +
53572 + uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
53573 + if (uidlist == NULL)
53574 + return ERR_PTR(-ENOMEM);
53575 + if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
53576 + return ERR_PTR(-EFAULT);
53577 +
53578 + s_tmp->user_transitions = uidlist;
53579 + }
53580 +
53581 + if (s_tmp->group_trans_num) {
53582 + gid_t *gidlist;
53583 +
53584 + gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
53585 + if (gidlist == NULL)
53586 + return ERR_PTR(-ENOMEM);
53587 + if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
53588 + return ERR_PTR(-EFAULT);
53589 +
53590 + s_tmp->group_transitions = gidlist;
53591 + }
53592 +
53593 + /* set up object hash table */
53594 + num_objs = count_user_objs(ghash.first);
53595 +
53596 + s_tmp->obj_hash_size = num_objs;
53597 + s_tmp->obj_hash =
53598 + (struct acl_object_label **)
53599 + create_table(&(s_tmp->obj_hash_size), sizeof(void *));
53600 +
53601 + if (!s_tmp->obj_hash)
53602 + return ERR_PTR(-ENOMEM);
53603 +
53604 + memset(s_tmp->obj_hash, 0,
53605 + s_tmp->obj_hash_size *
53606 + sizeof (struct acl_object_label *));
53607 +
53608 + /* add in objects */
53609 + err = copy_user_objs(ghash.first, s_tmp, role);
53610 +
53611 + if (err)
53612 + return ERR_PTR(err);
53613 +
53614 + /* set pointer for parent subject */
53615 + if (s_tmp->parent_subject) {
53616 + s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
53617 +
53618 + if (IS_ERR(s_tmp2))
53619 + return s_tmp2;
53620 +
53621 + s_tmp->parent_subject = s_tmp2;
53622 + }
53623 +
53624 + /* add in ip acls */
53625 +
53626 + if (!s_tmp->ip_num) {
53627 + s_tmp->ips = NULL;
53628 + goto insert;
53629 + }
53630 +
53631 + i_tmp =
53632 + (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
53633 + sizeof (struct acl_ip_label *));
53634 +
53635 + if (!i_tmp)
53636 + return ERR_PTR(-ENOMEM);
53637 +
53638 + for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
53639 + *(i_tmp + i_num) =
53640 + (struct acl_ip_label *)
53641 + acl_alloc(sizeof (struct acl_ip_label));
53642 + if (!*(i_tmp + i_num))
53643 + return ERR_PTR(-ENOMEM);
53644 +
53645 + if (copy_from_user
53646 + (&i_utmp2, s_tmp->ips + i_num,
53647 + sizeof (struct acl_ip_label *)))
53648 + return ERR_PTR(-EFAULT);
53649 +
53650 + if (copy_from_user
53651 + (*(i_tmp + i_num), i_utmp2,
53652 + sizeof (struct acl_ip_label)))
53653 + return ERR_PTR(-EFAULT);
53654 +
53655 + if ((*(i_tmp + i_num))->iface == NULL)
53656 + continue;
53657 +
53658 + len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
53659 + if (!len || len >= IFNAMSIZ)
53660 + return ERR_PTR(-EINVAL);
53661 + tmp = acl_alloc(len);
53662 + if (tmp == NULL)
53663 + return ERR_PTR(-ENOMEM);
53664 + if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
53665 + return ERR_PTR(-EFAULT);
53666 + (*(i_tmp + i_num))->iface = tmp;
53667 + }
53668 +
53669 + s_tmp->ips = i_tmp;
53670 +
53671 +insert:
53672 + if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
53673 + s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
53674 + return ERR_PTR(-ENOMEM);
53675 +
53676 + return s_tmp;
53677 +}
53678 +
53679 +static int
53680 +copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
53681 +{
53682 + struct acl_subject_label s_pre;
53683 + struct acl_subject_label * ret;
53684 + int err;
53685 +
53686 + while (userp) {
53687 + if (copy_from_user(&s_pre, userp,
53688 + sizeof (struct acl_subject_label)))
53689 + return -EFAULT;
53690 +
53691 + /* do not add nested subjects here, add
53692 + while parsing objects
53693 + */
53694 +
53695 + if (s_pre.mode & GR_NESTED) {
53696 + userp = s_pre.prev;
53697 + continue;
53698 + }
53699 +
53700 + ret = do_copy_user_subj(userp, role);
53701 +
53702 + err = PTR_ERR(ret);
53703 + if (IS_ERR(ret))
53704 + return err;
53705 +
53706 + insert_acl_subj_label(ret, role);
53707 +
53708 + userp = s_pre.prev;
53709 + }
53710 +
53711 + return 0;
53712 +}
53713 +
53714 +static int
53715 +copy_user_acl(struct gr_arg *arg)
53716 +{
53717 + struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
53718 + struct sprole_pw *sptmp;
53719 + struct gr_hash_struct *ghash;
53720 + uid_t *domainlist;
53721 + unsigned int r_num;
53722 + unsigned int len;
53723 + char *tmp;
53724 + int err = 0;
53725 + __u16 i;
53726 + __u32 num_subjs;
53727 +
53728 + /* we need a default and kernel role */
53729 + if (arg->role_db.num_roles < 2)
53730 + return -EINVAL;
53731 +
53732 + /* copy special role authentication info from userspace */
53733 +
53734 + num_sprole_pws = arg->num_sprole_pws;
53735 + acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
53736 +
53737 + if (!acl_special_roles) {
53738 + err = -ENOMEM;
53739 + goto cleanup;
53740 + }
53741 +
53742 + for (i = 0; i < num_sprole_pws; i++) {
53743 + sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
53744 + if (!sptmp) {
53745 + err = -ENOMEM;
53746 + goto cleanup;
53747 + }
53748 + if (copy_from_user(sptmp, arg->sprole_pws + i,
53749 + sizeof (struct sprole_pw))) {
53750 + err = -EFAULT;
53751 + goto cleanup;
53752 + }
53753 +
53754 + len =
53755 + strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
53756 +
53757 + if (!len || len >= GR_SPROLE_LEN) {
53758 + err = -EINVAL;
53759 + goto cleanup;
53760 + }
53761 +
53762 + if ((tmp = (char *) acl_alloc(len)) == NULL) {
53763 + err = -ENOMEM;
53764 + goto cleanup;
53765 + }
53766 +
53767 + if (copy_from_user(tmp, sptmp->rolename, len)) {
53768 + err = -EFAULT;
53769 + goto cleanup;
53770 + }
53771 + tmp[len-1] = '\0';
53772 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53773 + printk(KERN_ALERT "Copying special role %s\n", tmp);
53774 +#endif
53775 + sptmp->rolename = tmp;
53776 + acl_special_roles[i] = sptmp;
53777 + }
53778 +
53779 + r_utmp = (struct acl_role_label **) arg->role_db.r_table;
53780 +
53781 + for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
53782 + r_tmp = acl_alloc(sizeof (struct acl_role_label));
53783 +
53784 + if (!r_tmp) {
53785 + err = -ENOMEM;
53786 + goto cleanup;
53787 + }
53788 +
53789 + if (copy_from_user(&r_utmp2, r_utmp + r_num,
53790 + sizeof (struct acl_role_label *))) {
53791 + err = -EFAULT;
53792 + goto cleanup;
53793 + }
53794 +
53795 + if (copy_from_user(r_tmp, r_utmp2,
53796 + sizeof (struct acl_role_label))) {
53797 + err = -EFAULT;
53798 + goto cleanup;
53799 + }
53800 +
53801 + len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
53802 +
53803 + if (!len || len >= PATH_MAX) {
53804 + err = -EINVAL;
53805 + goto cleanup;
53806 + }
53807 +
53808 + if ((tmp = (char *) acl_alloc(len)) == NULL) {
53809 + err = -ENOMEM;
53810 + goto cleanup;
53811 + }
53812 + if (copy_from_user(tmp, r_tmp->rolename, len)) {
53813 + err = -EFAULT;
53814 + goto cleanup;
53815 + }
53816 + tmp[len-1] = '\0';
53817 + r_tmp->rolename = tmp;
53818 +
53819 + if (!strcmp(r_tmp->rolename, "default")
53820 + && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
53821 + default_role = r_tmp;
53822 + } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
53823 + kernel_role = r_tmp;
53824 + }
53825 +
53826 + if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
53827 + err = -ENOMEM;
53828 + goto cleanup;
53829 + }
53830 + if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
53831 + err = -EFAULT;
53832 + goto cleanup;
53833 + }
53834 +
53835 + r_tmp->hash = ghash;
53836 +
53837 + num_subjs = count_user_subjs(r_tmp->hash->first);
53838 +
53839 + r_tmp->subj_hash_size = num_subjs;
53840 + r_tmp->subj_hash =
53841 + (struct acl_subject_label **)
53842 + create_table(&(r_tmp->subj_hash_size), sizeof(void *));
53843 +
53844 + if (!r_tmp->subj_hash) {
53845 + err = -ENOMEM;
53846 + goto cleanup;
53847 + }
53848 +
53849 + err = copy_user_allowedips(r_tmp);
53850 + if (err)
53851 + goto cleanup;
53852 +
53853 + /* copy domain info */
53854 + if (r_tmp->domain_children != NULL) {
53855 + domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
53856 + if (domainlist == NULL) {
53857 + err = -ENOMEM;
53858 + goto cleanup;
53859 + }
53860 + if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
53861 + err = -EFAULT;
53862 + goto cleanup;
53863 + }
53864 + r_tmp->domain_children = domainlist;
53865 + }
53866 +
53867 + err = copy_user_transitions(r_tmp);
53868 + if (err)
53869 + goto cleanup;
53870 +
53871 + memset(r_tmp->subj_hash, 0,
53872 + r_tmp->subj_hash_size *
53873 + sizeof (struct acl_subject_label *));
53874 +
53875 + err = copy_user_subjs(r_tmp->hash->first, r_tmp);
53876 +
53877 + if (err)
53878 + goto cleanup;
53879 +
53880 + /* set nested subject list to null */
53881 + r_tmp->hash->first = NULL;
53882 +
53883 + insert_acl_role_label(r_tmp);
53884 + }
53885 +
53886 + goto return_err;
53887 + cleanup:
53888 + free_variables();
53889 + return_err:
53890 + return err;
53891 +
53892 +}
53893 +
53894 +static int
53895 +gracl_init(struct gr_arg *args)
53896 +{
53897 + int error = 0;
53898 +
53899 + memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
53900 + memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
53901 +
53902 + if (init_variables(args)) {
53903 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
53904 + error = -ENOMEM;
53905 + free_variables();
53906 + goto out;
53907 + }
53908 +
53909 + error = copy_user_acl(args);
53910 + free_init_variables();
53911 + if (error) {
53912 + free_variables();
53913 + goto out;
53914 + }
53915 +
53916 + if ((error = gr_set_acls(0))) {
53917 + free_variables();
53918 + goto out;
53919 + }
53920 +
53921 + pax_open_kernel();
53922 + gr_status |= GR_READY;
53923 + pax_close_kernel();
53924 +
53925 + out:
53926 + return error;
53927 +}
53928 +
53929 +/* derived from glibc fnmatch() 0: match, 1: no match*/
53930 +
53931 +static int
53932 +glob_match(const char *p, const char *n)
53933 +{
53934 + char c;
53935 +
53936 + while ((c = *p++) != '\0') {
53937 + switch (c) {
53938 + case '?':
53939 + if (*n == '\0')
53940 + return 1;
53941 + else if (*n == '/')
53942 + return 1;
53943 + break;
53944 + case '\\':
53945 + if (*n != c)
53946 + return 1;
53947 + break;
53948 + case '*':
53949 + for (c = *p++; c == '?' || c == '*'; c = *p++) {
53950 + if (*n == '/')
53951 + return 1;
53952 + else if (c == '?') {
53953 + if (*n == '\0')
53954 + return 1;
53955 + else
53956 + ++n;
53957 + }
53958 + }
53959 + if (c == '\0') {
53960 + return 0;
53961 + } else {
53962 + const char *endp;
53963 +
53964 + if ((endp = strchr(n, '/')) == NULL)
53965 + endp = n + strlen(n);
53966 +
53967 + if (c == '[') {
53968 + for (--p; n < endp; ++n)
53969 + if (!glob_match(p, n))
53970 + return 0;
53971 + } else if (c == '/') {
53972 + while (*n != '\0' && *n != '/')
53973 + ++n;
53974 + if (*n == '/' && !glob_match(p, n + 1))
53975 + return 0;
53976 + } else {
53977 + for (--p; n < endp; ++n)
53978 + if (*n == c && !glob_match(p, n))
53979 + return 0;
53980 + }
53981 +
53982 + return 1;
53983 + }
53984 + case '[':
53985 + {
53986 + int not;
53987 + char cold;
53988 +
53989 + if (*n == '\0' || *n == '/')
53990 + return 1;
53991 +
53992 + not = (*p == '!' || *p == '^');
53993 + if (not)
53994 + ++p;
53995 +
53996 + c = *p++;
53997 + for (;;) {
53998 + unsigned char fn = (unsigned char)*n;
53999 +
54000 + if (c == '\0')
54001 + return 1;
54002 + else {
54003 + if (c == fn)
54004 + goto matched;
54005 + cold = c;
54006 + c = *p++;
54007 +
54008 + if (c == '-' && *p != ']') {
54009 + unsigned char cend = *p++;
54010 +
54011 + if (cend == '\0')
54012 + return 1;
54013 +
54014 + if (cold <= fn && fn <= cend)
54015 + goto matched;
54016 +
54017 + c = *p++;
54018 + }
54019 + }
54020 +
54021 + if (c == ']')
54022 + break;
54023 + }
54024 + if (!not)
54025 + return 1;
54026 + break;
54027 + matched:
54028 + while (c != ']') {
54029 + if (c == '\0')
54030 + return 1;
54031 +
54032 + c = *p++;
54033 + }
54034 + if (not)
54035 + return 1;
54036 + }
54037 + break;
54038 + default:
54039 + if (c != *n)
54040 + return 1;
54041 + }
54042 +
54043 + ++n;
54044 + }
54045 +
54046 + if (*n == '\0')
54047 + return 0;
54048 +
54049 + if (*n == '/')
54050 + return 0;
54051 +
54052 + return 1;
54053 +}
54054 +
54055 +static struct acl_object_label *
54056 +chk_glob_label(struct acl_object_label *globbed,
54057 + struct dentry *dentry, struct vfsmount *mnt, char **path)
54058 +{
54059 + struct acl_object_label *tmp;
54060 +
54061 + if (*path == NULL)
54062 + *path = gr_to_filename_nolock(dentry, mnt);
54063 +
54064 + tmp = globbed;
54065 +
54066 + while (tmp) {
54067 + if (!glob_match(tmp->filename, *path))
54068 + return tmp;
54069 + tmp = tmp->next;
54070 + }
54071 +
54072 + return NULL;
54073 +}
54074 +
54075 +static struct acl_object_label *
54076 +__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
54077 + const ino_t curr_ino, const dev_t curr_dev,
54078 + const struct acl_subject_label *subj, char **path, const int checkglob)
54079 +{
54080 + struct acl_subject_label *tmpsubj;
54081 + struct acl_object_label *retval;
54082 + struct acl_object_label *retval2;
54083 +
54084 + tmpsubj = (struct acl_subject_label *) subj;
54085 + read_lock(&gr_inode_lock);
54086 + do {
54087 + retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
54088 + if (retval) {
54089 + if (checkglob && retval->globbed) {
54090 + retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
54091 + (struct vfsmount *)orig_mnt, path);
54092 + if (retval2)
54093 + retval = retval2;
54094 + }
54095 + break;
54096 + }
54097 + } while ((tmpsubj = tmpsubj->parent_subject));
54098 + read_unlock(&gr_inode_lock);
54099 +
54100 + return retval;
54101 +}
54102 +
54103 +static __inline__ struct acl_object_label *
54104 +full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
54105 + const struct dentry *curr_dentry,
54106 + const struct acl_subject_label *subj, char **path, const int checkglob)
54107 +{
54108 + int newglob = checkglob;
54109 +
54110 + /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
54111 + as we don't want a / * rule to match instead of the / object
54112 + don't do this for create lookups that call this function though, since they're looking up
54113 + on the parent and thus need globbing checks on all paths
54114 + */
54115 + if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
54116 + newglob = GR_NO_GLOB;
54117 +
54118 + return __full_lookup(orig_dentry, orig_mnt,
54119 + curr_dentry->d_inode->i_ino,
54120 + __get_dev(curr_dentry), subj, path, newglob);
54121 +}
54122 +
54123 +static struct acl_object_label *
54124 +__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
54125 + const struct acl_subject_label *subj, char *path, const int checkglob)
54126 +{
54127 + struct dentry *dentry = (struct dentry *) l_dentry;
54128 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
54129 + struct acl_object_label *retval;
54130 +
54131 + spin_lock(&dcache_lock);
54132 + spin_lock(&vfsmount_lock);
54133 +
54134 + if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
54135 +#ifdef CONFIG_NET
54136 + mnt == sock_mnt ||
54137 +#endif
54138 +#ifdef CONFIG_HUGETLBFS
54139 + (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
54140 +#endif
54141 + /* ignore Eric Biederman */
54142 + IS_PRIVATE(l_dentry->d_inode))) {
54143 + retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
54144 + goto out;
54145 + }
54146 +
54147 + for (;;) {
54148 + if (dentry == real_root && mnt == real_root_mnt)
54149 + break;
54150 +
54151 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
54152 + if (mnt->mnt_parent == mnt)
54153 + break;
54154 +
54155 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
54156 + if (retval != NULL)
54157 + goto out;
54158 +
54159 + dentry = mnt->mnt_mountpoint;
54160 + mnt = mnt->mnt_parent;
54161 + continue;
54162 + }
54163 +
54164 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
54165 + if (retval != NULL)
54166 + goto out;
54167 +
54168 + dentry = dentry->d_parent;
54169 + }
54170 +
54171 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
54172 +
54173 + if (retval == NULL)
54174 + retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
54175 +out:
54176 + spin_unlock(&vfsmount_lock);
54177 + spin_unlock(&dcache_lock);
54178 +
54179 + BUG_ON(retval == NULL);
54180 +
54181 + return retval;
54182 +}
54183 +
54184 +static __inline__ struct acl_object_label *
54185 +chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
54186 + const struct acl_subject_label *subj)
54187 +{
54188 + char *path = NULL;
54189 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
54190 +}
54191 +
54192 +static __inline__ struct acl_object_label *
54193 +chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
54194 + const struct acl_subject_label *subj)
54195 +{
54196 + char *path = NULL;
54197 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
54198 +}
54199 +
54200 +static __inline__ struct acl_object_label *
54201 +chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
54202 + const struct acl_subject_label *subj, char *path)
54203 +{
54204 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
54205 +}
54206 +
54207 +static struct acl_subject_label *
54208 +chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
54209 + const struct acl_role_label *role)
54210 +{
54211 + struct dentry *dentry = (struct dentry *) l_dentry;
54212 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
54213 + struct acl_subject_label *retval;
54214 +
54215 + spin_lock(&dcache_lock);
54216 + spin_lock(&vfsmount_lock);
54217 +
54218 + for (;;) {
54219 + if (dentry == real_root && mnt == real_root_mnt)
54220 + break;
54221 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
54222 + if (mnt->mnt_parent == mnt)
54223 + break;
54224 +
54225 + read_lock(&gr_inode_lock);
54226 + retval =
54227 + lookup_acl_subj_label(dentry->d_inode->i_ino,
54228 + __get_dev(dentry), role);
54229 + read_unlock(&gr_inode_lock);
54230 + if (retval != NULL)
54231 + goto out;
54232 +
54233 + dentry = mnt->mnt_mountpoint;
54234 + mnt = mnt->mnt_parent;
54235 + continue;
54236 + }
54237 +
54238 + read_lock(&gr_inode_lock);
54239 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
54240 + __get_dev(dentry), role);
54241 + read_unlock(&gr_inode_lock);
54242 + if (retval != NULL)
54243 + goto out;
54244 +
54245 + dentry = dentry->d_parent;
54246 + }
54247 +
54248 + read_lock(&gr_inode_lock);
54249 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
54250 + __get_dev(dentry), role);
54251 + read_unlock(&gr_inode_lock);
54252 +
54253 + if (unlikely(retval == NULL)) {
54254 + read_lock(&gr_inode_lock);
54255 + retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
54256 + __get_dev(real_root), role);
54257 + read_unlock(&gr_inode_lock);
54258 + }
54259 +out:
54260 + spin_unlock(&vfsmount_lock);
54261 + spin_unlock(&dcache_lock);
54262 +
54263 + BUG_ON(retval == NULL);
54264 +
54265 + return retval;
54266 +}
54267 +
54268 +static void
54269 +gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
54270 +{
54271 + struct task_struct *task = current;
54272 + const struct cred *cred = current_cred();
54273 +
54274 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
54275 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
54276 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
54277 + 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
54278 +
54279 + return;
54280 +}
54281 +
54282 +static void
54283 +gr_log_learn_sysctl(const char *path, const __u32 mode)
54284 +{
54285 + struct task_struct *task = current;
54286 + const struct cred *cred = current_cred();
54287 +
54288 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
54289 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
54290 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
54291 + 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
54292 +
54293 + return;
54294 +}
54295 +
54296 +static void
54297 +gr_log_learn_id_change(const char type, const unsigned int real,
54298 + const unsigned int effective, const unsigned int fs)
54299 +{
54300 + struct task_struct *task = current;
54301 + const struct cred *cred = current_cred();
54302 +
54303 + security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
54304 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
54305 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
54306 + type, real, effective, fs, &task->signal->saved_ip);
54307 +
54308 + return;
54309 +}
54310 +
54311 +__u32
54312 +gr_search_file(const struct dentry * dentry, const __u32 mode,
54313 + const struct vfsmount * mnt)
54314 +{
54315 + __u32 retval = mode;
54316 + struct acl_subject_label *curracl;
54317 + struct acl_object_label *currobj;
54318 +
54319 + if (unlikely(!(gr_status & GR_READY)))
54320 + return (mode & ~GR_AUDITS);
54321 +
54322 + curracl = current->acl;
54323 +
54324 + currobj = chk_obj_label(dentry, mnt, curracl);
54325 + retval = currobj->mode & mode;
54326 +
54327 + /* if we're opening a specified transfer file for writing
54328 + (e.g. /dev/initctl), then transfer our role to init
54329 + */
54330 + if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
54331 + current->role->roletype & GR_ROLE_PERSIST)) {
54332 + struct task_struct *task = init_pid_ns.child_reaper;
54333 +
54334 + if (task->role != current->role) {
54335 + task->acl_sp_role = 0;
54336 + task->acl_role_id = current->acl_role_id;
54337 + task->role = current->role;
54338 + rcu_read_lock();
54339 + read_lock(&grsec_exec_file_lock);
54340 + gr_apply_subject_to_task(task);
54341 + read_unlock(&grsec_exec_file_lock);
54342 + rcu_read_unlock();
54343 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
54344 + }
54345 + }
54346 +
54347 + if (unlikely
54348 + ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
54349 + && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
54350 + __u32 new_mode = mode;
54351 +
54352 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
54353 +
54354 + retval = new_mode;
54355 +
54356 + if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
54357 + new_mode |= GR_INHERIT;
54358 +
54359 + if (!(mode & GR_NOLEARN))
54360 + gr_log_learn(dentry, mnt, new_mode);
54361 + }
54362 +
54363 + return retval;
54364 +}
54365 +
54366 +struct acl_object_label *gr_get_create_object(const struct dentry *new_dentry,
54367 + const struct dentry *parent,
54368 + const struct vfsmount *mnt)
54369 +{
54370 + struct name_entry *match;
54371 + struct acl_object_label *matchpo;
54372 + struct acl_subject_label *curracl;
54373 + char *path;
54374 +
54375 + if (unlikely(!(gr_status & GR_READY)))
54376 + return NULL;
54377 +
54378 + preempt_disable();
54379 + path = gr_to_filename_rbac(new_dentry, mnt);
54380 + match = lookup_name_entry_create(path);
54381 +
54382 + curracl = current->acl;
54383 +
54384 + if (match) {
54385 + read_lock(&gr_inode_lock);
54386 + matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
54387 + read_unlock(&gr_inode_lock);
54388 +
54389 + if (matchpo) {
54390 + preempt_enable();
54391 + return matchpo;
54392 + }
54393 + }
54394 +
54395 + // lookup parent
54396 +
54397 + matchpo = chk_obj_create_label(parent, mnt, curracl, path);
54398 +
54399 + preempt_enable();
54400 + return matchpo;
54401 +}
54402 +
54403 +__u32
54404 +gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
54405 + const struct vfsmount * mnt, const __u32 mode)
54406 +{
54407 + struct acl_object_label *matchpo;
54408 + __u32 retval;
54409 +
54410 + if (unlikely(!(gr_status & GR_READY)))
54411 + return (mode & ~GR_AUDITS);
54412 +
54413 + matchpo = gr_get_create_object(new_dentry, parent, mnt);
54414 +
54415 + retval = matchpo->mode & mode;
54416 +
54417 + if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
54418 + && (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
54419 + __u32 new_mode = mode;
54420 +
54421 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
54422 +
54423 + gr_log_learn(new_dentry, mnt, new_mode);
54424 + return new_mode;
54425 + }
54426 +
54427 + return retval;
54428 +}
54429 +
54430 +__u32
54431 +gr_check_link(const struct dentry * new_dentry,
54432 + const struct dentry * parent_dentry,
54433 + const struct vfsmount * parent_mnt,
54434 + const struct dentry * old_dentry, const struct vfsmount * old_mnt)
54435 +{
54436 + struct acl_object_label *obj;
54437 + __u32 oldmode, newmode;
54438 + __u32 needmode;
54439 + __u32 checkmodes = GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC | GR_SETID | GR_READ |
54440 + GR_DELETE | GR_INHERIT;
54441 +
54442 + if (unlikely(!(gr_status & GR_READY)))
54443 + return (GR_CREATE | GR_LINK);
54444 +
54445 + obj = chk_obj_label(old_dentry, old_mnt, current->acl);
54446 + oldmode = obj->mode;
54447 +
54448 + obj = gr_get_create_object(new_dentry, parent_dentry, parent_mnt);
54449 + newmode = obj->mode;
54450 +
54451 + needmode = newmode & checkmodes;
54452 +
54453 + // old name for hardlink must have at least the permissions of the new name
54454 + if ((oldmode & needmode) != needmode)
54455 + goto bad;
54456 +
54457 + // if old name had restrictions/auditing, make sure the new name does as well
54458 + needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
54459 +
54460 + // don't allow hardlinking of suid/sgid files without permission
54461 + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
54462 + needmode |= GR_SETID;
54463 +
54464 + if ((newmode & needmode) != needmode)
54465 + goto bad;
54466 +
54467 + // enforce minimum permissions
54468 + if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
54469 + return newmode;
54470 +bad:
54471 + needmode = oldmode;
54472 + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
54473 + needmode |= GR_SETID;
54474 +
54475 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
54476 + gr_log_learn(old_dentry, old_mnt, needmode | GR_CREATE | GR_LINK);
54477 + return (GR_CREATE | GR_LINK);
54478 + } else if (newmode & GR_SUPPRESS)
54479 + return GR_SUPPRESS;
54480 + else
54481 + return 0;
54482 +}
54483 +
54484 +int
54485 +gr_check_hidden_task(const struct task_struct *task)
54486 +{
54487 + if (unlikely(!(gr_status & GR_READY)))
54488 + return 0;
54489 +
54490 + if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
54491 + return 1;
54492 +
54493 + return 0;
54494 +}
54495 +
54496 +int
54497 +gr_check_protected_task(const struct task_struct *task)
54498 +{
54499 + if (unlikely(!(gr_status & GR_READY) || !task))
54500 + return 0;
54501 +
54502 + if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
54503 + task->acl != current->acl)
54504 + return 1;
54505 +
54506 + return 0;
54507 +}
54508 +
54509 +int
54510 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
54511 +{
54512 + struct task_struct *p;
54513 + int ret = 0;
54514 +
54515 + if (unlikely(!(gr_status & GR_READY) || !pid))
54516 + return ret;
54517 +
54518 + read_lock(&tasklist_lock);
54519 + do_each_pid_task(pid, type, p) {
54520 + if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
54521 + p->acl != current->acl) {
54522 + ret = 1;
54523 + goto out;
54524 + }
54525 + } while_each_pid_task(pid, type, p);
54526 +out:
54527 + read_unlock(&tasklist_lock);
54528 +
54529 + return ret;
54530 +}
54531 +
54532 +void
54533 +gr_copy_label(struct task_struct *tsk)
54534 +{
54535 + tsk->signal->used_accept = 0;
54536 + tsk->acl_sp_role = 0;
54537 + tsk->acl_role_id = current->acl_role_id;
54538 + tsk->acl = current->acl;
54539 + tsk->role = current->role;
54540 + tsk->signal->curr_ip = current->signal->curr_ip;
54541 + tsk->signal->saved_ip = current->signal->saved_ip;
54542 + if (current->exec_file)
54543 + get_file(current->exec_file);
54544 + tsk->exec_file = current->exec_file;
54545 + tsk->is_writable = current->is_writable;
54546 + if (unlikely(current->signal->used_accept)) {
54547 + current->signal->curr_ip = 0;
54548 + current->signal->saved_ip = 0;
54549 + }
54550 +
54551 + return;
54552 +}
54553 +
54554 +static void
54555 +gr_set_proc_res(struct task_struct *task)
54556 +{
54557 + struct acl_subject_label *proc;
54558 + unsigned short i;
54559 +
54560 + proc = task->acl;
54561 +
54562 + if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
54563 + return;
54564 +
54565 + for (i = 0; i < RLIM_NLIMITS; i++) {
54566 + if (!(proc->resmask & (1 << i)))
54567 + continue;
54568 +
54569 + task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
54570 + task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
54571 + }
54572 +
54573 + return;
54574 +}
54575 +
54576 +extern int __gr_process_user_ban(struct user_struct *user);
54577 +
54578 +int
54579 +gr_check_user_change(int real, int effective, int fs)
54580 +{
54581 + unsigned int i;
54582 + __u16 num;
54583 + uid_t *uidlist;
54584 + int curuid;
54585 + int realok = 0;
54586 + int effectiveok = 0;
54587 + int fsok = 0;
54588 +
54589 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
54590 + struct user_struct *user;
54591 +
54592 + if (real == -1)
54593 + goto skipit;
54594 +
54595 + user = find_user(real);
54596 + if (user == NULL)
54597 + goto skipit;
54598 +
54599 + if (__gr_process_user_ban(user)) {
54600 + /* for find_user */
54601 + free_uid(user);
54602 + return 1;
54603 + }
54604 +
54605 + /* for find_user */
54606 + free_uid(user);
54607 +
54608 +skipit:
54609 +#endif
54610 +
54611 + if (unlikely(!(gr_status & GR_READY)))
54612 + return 0;
54613 +
54614 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
54615 + gr_log_learn_id_change('u', real, effective, fs);
54616 +
54617 + num = current->acl->user_trans_num;
54618 + uidlist = current->acl->user_transitions;
54619 +
54620 + if (uidlist == NULL)
54621 + return 0;
54622 +
54623 + if (real == -1)
54624 + realok = 1;
54625 + if (effective == -1)
54626 + effectiveok = 1;
54627 + if (fs == -1)
54628 + fsok = 1;
54629 +
54630 + if (current->acl->user_trans_type & GR_ID_ALLOW) {
54631 + for (i = 0; i < num; i++) {
54632 + curuid = (int)uidlist[i];
54633 + if (real == curuid)
54634 + realok = 1;
54635 + if (effective == curuid)
54636 + effectiveok = 1;
54637 + if (fs == curuid)
54638 + fsok = 1;
54639 + }
54640 + } else if (current->acl->user_trans_type & GR_ID_DENY) {
54641 + for (i = 0; i < num; i++) {
54642 + curuid = (int)uidlist[i];
54643 + if (real == curuid)
54644 + break;
54645 + if (effective == curuid)
54646 + break;
54647 + if (fs == curuid)
54648 + break;
54649 + }
54650 + /* not in deny list */
54651 + if (i == num) {
54652 + realok = 1;
54653 + effectiveok = 1;
54654 + fsok = 1;
54655 + }
54656 + }
54657 +
54658 + if (realok && effectiveok && fsok)
54659 + return 0;
54660 + else {
54661 + gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
54662 + return 1;
54663 + }
54664 +}
54665 +
54666 +int
54667 +gr_check_group_change(int real, int effective, int fs)
54668 +{
54669 + unsigned int i;
54670 + __u16 num;
54671 + gid_t *gidlist;
54672 + int curgid;
54673 + int realok = 0;
54674 + int effectiveok = 0;
54675 + int fsok = 0;
54676 +
54677 + if (unlikely(!(gr_status & GR_READY)))
54678 + return 0;
54679 +
54680 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
54681 + gr_log_learn_id_change('g', real, effective, fs);
54682 +
54683 + num = current->acl->group_trans_num;
54684 + gidlist = current->acl->group_transitions;
54685 +
54686 + if (gidlist == NULL)
54687 + return 0;
54688 +
54689 + if (real == -1)
54690 + realok = 1;
54691 + if (effective == -1)
54692 + effectiveok = 1;
54693 + if (fs == -1)
54694 + fsok = 1;
54695 +
54696 + if (current->acl->group_trans_type & GR_ID_ALLOW) {
54697 + for (i = 0; i < num; i++) {
54698 + curgid = (int)gidlist[i];
54699 + if (real == curgid)
54700 + realok = 1;
54701 + if (effective == curgid)
54702 + effectiveok = 1;
54703 + if (fs == curgid)
54704 + fsok = 1;
54705 + }
54706 + } else if (current->acl->group_trans_type & GR_ID_DENY) {
54707 + for (i = 0; i < num; i++) {
54708 + curgid = (int)gidlist[i];
54709 + if (real == curgid)
54710 + break;
54711 + if (effective == curgid)
54712 + break;
54713 + if (fs == curgid)
54714 + break;
54715 + }
54716 + /* not in deny list */
54717 + if (i == num) {
54718 + realok = 1;
54719 + effectiveok = 1;
54720 + fsok = 1;
54721 + }
54722 + }
54723 +
54724 + if (realok && effectiveok && fsok)
54725 + return 0;
54726 + else {
54727 + gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
54728 + return 1;
54729 + }
54730 +}
54731 +
54732 +void
54733 +gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
54734 +{
54735 + struct acl_role_label *role = task->role;
54736 + struct acl_subject_label *subj = NULL;
54737 + struct acl_object_label *obj;
54738 + struct file *filp;
54739 +
54740 + if (unlikely(!(gr_status & GR_READY)))
54741 + return;
54742 +
54743 + filp = task->exec_file;
54744 +
54745 + /* kernel process, we'll give them the kernel role */
54746 + if (unlikely(!filp)) {
54747 + task->role = kernel_role;
54748 + task->acl = kernel_role->root_label;
54749 + return;
54750 + } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
54751 + role = lookup_acl_role_label(task, uid, gid);
54752 +
54753 + /* perform subject lookup in possibly new role
54754 + we can use this result below in the case where role == task->role
54755 + */
54756 + subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
54757 +
54758 + /* if we changed uid/gid, but result in the same role
54759 + and are using inheritance, don't lose the inherited subject
54760 + if current subject is other than what normal lookup
54761 + would result in, we arrived via inheritance, don't
54762 + lose subject
54763 + */
54764 + if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
54765 + (subj == task->acl)))
54766 + task->acl = subj;
54767 +
54768 + task->role = role;
54769 +
54770 + task->is_writable = 0;
54771 +
54772 + /* ignore additional mmap checks for processes that are writable
54773 + by the default ACL */
54774 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54775 + if (unlikely(obj->mode & GR_WRITE))
54776 + task->is_writable = 1;
54777 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
54778 + if (unlikely(obj->mode & GR_WRITE))
54779 + task->is_writable = 1;
54780 +
54781 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54782 + printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54783 +#endif
54784 +
54785 + gr_set_proc_res(task);
54786 +
54787 + return;
54788 +}
54789 +
54790 +int
54791 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
54792 + const int unsafe_share)
54793 +{
54794 + struct task_struct *task = current;
54795 + struct acl_subject_label *newacl;
54796 + struct acl_object_label *obj;
54797 + __u32 retmode;
54798 +
54799 + if (unlikely(!(gr_status & GR_READY)))
54800 + return 0;
54801 +
54802 + newacl = chk_subj_label(dentry, mnt, task->role);
54803 +
54804 + task_lock(task);
54805 + if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
54806 + !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
54807 + !(task->role->roletype & GR_ROLE_GOD) &&
54808 + !gr_search_file(dentry, GR_PTRACERD, mnt) &&
54809 + !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
54810 + task_unlock(task);
54811 + if (unsafe_share)
54812 + gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
54813 + else
54814 + gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
54815 + return -EACCES;
54816 + }
54817 + task_unlock(task);
54818 +
54819 + obj = chk_obj_label(dentry, mnt, task->acl);
54820 + retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
54821 +
54822 + if (!(task->acl->mode & GR_INHERITLEARN) &&
54823 + ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
54824 + if (obj->nested)
54825 + task->acl = obj->nested;
54826 + else
54827 + task->acl = newacl;
54828 + } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
54829 + gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
54830 +
54831 + task->is_writable = 0;
54832 +
54833 + /* ignore additional mmap checks for processes that are writable
54834 + by the default ACL */
54835 + obj = chk_obj_label(dentry, mnt, default_role->root_label);
54836 + if (unlikely(obj->mode & GR_WRITE))
54837 + task->is_writable = 1;
54838 + obj = chk_obj_label(dentry, mnt, task->role->root_label);
54839 + if (unlikely(obj->mode & GR_WRITE))
54840 + task->is_writable = 1;
54841 +
54842 + gr_set_proc_res(task);
54843 +
54844 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54845 + printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54846 +#endif
54847 + return 0;
54848 +}
54849 +
54850 +/* always called with valid inodev ptr */
54851 +static void
54852 +do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
54853 +{
54854 + struct acl_object_label *matchpo;
54855 + struct acl_subject_label *matchps;
54856 + struct acl_subject_label *subj;
54857 + struct acl_role_label *role;
54858 + unsigned int x;
54859 +
54860 + FOR_EACH_ROLE_START(role)
54861 + FOR_EACH_SUBJECT_START(role, subj, x)
54862 + if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
54863 + matchpo->mode |= GR_DELETED;
54864 + FOR_EACH_SUBJECT_END(subj,x)
54865 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
54866 + if (subj->inode == ino && subj->device == dev)
54867 + subj->mode |= GR_DELETED;
54868 + FOR_EACH_NESTED_SUBJECT_END(subj)
54869 + if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
54870 + matchps->mode |= GR_DELETED;
54871 + FOR_EACH_ROLE_END(role)
54872 +
54873 + inodev->nentry->deleted = 1;
54874 +
54875 + return;
54876 +}
54877 +
54878 +void
54879 +gr_handle_delete(const ino_t ino, const dev_t dev)
54880 +{
54881 + struct inodev_entry *inodev;
54882 +
54883 + if (unlikely(!(gr_status & GR_READY)))
54884 + return;
54885 +
54886 + write_lock(&gr_inode_lock);
54887 + inodev = lookup_inodev_entry(ino, dev);
54888 + if (inodev != NULL)
54889 + do_handle_delete(inodev, ino, dev);
54890 + write_unlock(&gr_inode_lock);
54891 +
54892 + return;
54893 +}
54894 +
54895 +static void
54896 +update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
54897 + const ino_t newinode, const dev_t newdevice,
54898 + struct acl_subject_label *subj)
54899 +{
54900 + unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
54901 + struct acl_object_label *match;
54902 +
54903 + match = subj->obj_hash[index];
54904 +
54905 + while (match && (match->inode != oldinode ||
54906 + match->device != olddevice ||
54907 + !(match->mode & GR_DELETED)))
54908 + match = match->next;
54909 +
54910 + if (match && (match->inode == oldinode)
54911 + && (match->device == olddevice)
54912 + && (match->mode & GR_DELETED)) {
54913 + if (match->prev == NULL) {
54914 + subj->obj_hash[index] = match->next;
54915 + if (match->next != NULL)
54916 + match->next->prev = NULL;
54917 + } else {
54918 + match->prev->next = match->next;
54919 + if (match->next != NULL)
54920 + match->next->prev = match->prev;
54921 + }
54922 + match->prev = NULL;
54923 + match->next = NULL;
54924 + match->inode = newinode;
54925 + match->device = newdevice;
54926 + match->mode &= ~GR_DELETED;
54927 +
54928 + insert_acl_obj_label(match, subj);
54929 + }
54930 +
54931 + return;
54932 +}
54933 +
54934 +static void
54935 +update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
54936 + const ino_t newinode, const dev_t newdevice,
54937 + struct acl_role_label *role)
54938 +{
54939 + unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
54940 + struct acl_subject_label *match;
54941 +
54942 + match = role->subj_hash[index];
54943 +
54944 + while (match && (match->inode != oldinode ||
54945 + match->device != olddevice ||
54946 + !(match->mode & GR_DELETED)))
54947 + match = match->next;
54948 +
54949 + if (match && (match->inode == oldinode)
54950 + && (match->device == olddevice)
54951 + && (match->mode & GR_DELETED)) {
54952 + if (match->prev == NULL) {
54953 + role->subj_hash[index] = match->next;
54954 + if (match->next != NULL)
54955 + match->next->prev = NULL;
54956 + } else {
54957 + match->prev->next = match->next;
54958 + if (match->next != NULL)
54959 + match->next->prev = match->prev;
54960 + }
54961 + match->prev = NULL;
54962 + match->next = NULL;
54963 + match->inode = newinode;
54964 + match->device = newdevice;
54965 + match->mode &= ~GR_DELETED;
54966 +
54967 + insert_acl_subj_label(match, role);
54968 + }
54969 +
54970 + return;
54971 +}
54972 +
54973 +static void
54974 +update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
54975 + const ino_t newinode, const dev_t newdevice)
54976 +{
54977 + unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
54978 + struct inodev_entry *match;
54979 +
54980 + match = inodev_set.i_hash[index];
54981 +
54982 + while (match && (match->nentry->inode != oldinode ||
54983 + match->nentry->device != olddevice || !match->nentry->deleted))
54984 + match = match->next;
54985 +
54986 + if (match && (match->nentry->inode == oldinode)
54987 + && (match->nentry->device == olddevice) &&
54988 + match->nentry->deleted) {
54989 + if (match->prev == NULL) {
54990 + inodev_set.i_hash[index] = match->next;
54991 + if (match->next != NULL)
54992 + match->next->prev = NULL;
54993 + } else {
54994 + match->prev->next = match->next;
54995 + if (match->next != NULL)
54996 + match->next->prev = match->prev;
54997 + }
54998 + match->prev = NULL;
54999 + match->next = NULL;
55000 + match->nentry->inode = newinode;
55001 + match->nentry->device = newdevice;
55002 + match->nentry->deleted = 0;
55003 +
55004 + insert_inodev_entry(match);
55005 + }
55006 +
55007 + return;
55008 +}
55009 +
55010 +static void
55011 +__do_handle_create(const struct name_entry *matchn, ino_t inode, dev_t dev)
55012 +{
55013 + struct acl_subject_label *subj;
55014 + struct acl_role_label *role;
55015 + unsigned int x;
55016 +
55017 + FOR_EACH_ROLE_START(role)
55018 + update_acl_subj_label(matchn->inode, matchn->device,
55019 + inode, dev, role);
55020 +
55021 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
55022 + if ((subj->inode == inode) && (subj->device == dev)) {
55023 + subj->inode = inode;
55024 + subj->device = dev;
55025 + }
55026 + FOR_EACH_NESTED_SUBJECT_END(subj)
55027 + FOR_EACH_SUBJECT_START(role, subj, x)
55028 + update_acl_obj_label(matchn->inode, matchn->device,
55029 + inode, dev, subj);
55030 + FOR_EACH_SUBJECT_END(subj,x)
55031 + FOR_EACH_ROLE_END(role)
55032 +
55033 + update_inodev_entry(matchn->inode, matchn->device, inode, dev);
55034 +
55035 + return;
55036 +}
55037 +
55038 +static void
55039 +do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
55040 + const struct vfsmount *mnt)
55041 +{
55042 + ino_t ino = dentry->d_inode->i_ino;
55043 + dev_t dev = __get_dev(dentry);
55044 +
55045 + __do_handle_create(matchn, ino, dev);
55046 +
55047 + return;
55048 +}
55049 +
55050 +void
55051 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
55052 +{
55053 + struct name_entry *matchn;
55054 +
55055 + if (unlikely(!(gr_status & GR_READY)))
55056 + return;
55057 +
55058 + preempt_disable();
55059 + matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
55060 +
55061 + if (unlikely((unsigned long)matchn)) {
55062 + write_lock(&gr_inode_lock);
55063 + do_handle_create(matchn, dentry, mnt);
55064 + write_unlock(&gr_inode_lock);
55065 + }
55066 + preempt_enable();
55067 +
55068 + return;
55069 +}
55070 +
55071 +void
55072 +gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
55073 +{
55074 + struct name_entry *matchn;
55075 +
55076 + if (unlikely(!(gr_status & GR_READY)))
55077 + return;
55078 +
55079 + preempt_disable();
55080 + matchn = lookup_name_entry(gr_to_proc_filename_rbac(dentry, init_pid_ns.proc_mnt));
55081 +
55082 + if (unlikely((unsigned long)matchn)) {
55083 + write_lock(&gr_inode_lock);
55084 + __do_handle_create(matchn, inode->i_ino, inode->i_sb->s_dev);
55085 + write_unlock(&gr_inode_lock);
55086 + }
55087 + preempt_enable();
55088 +
55089 + return;
55090 +}
55091 +
55092 +void
55093 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
55094 + struct dentry *old_dentry,
55095 + struct dentry *new_dentry,
55096 + struct vfsmount *mnt, const __u8 replace)
55097 +{
55098 + struct name_entry *matchn;
55099 + struct inodev_entry *inodev;
55100 + struct inode *inode = new_dentry->d_inode;
55101 + ino_t oldinode = old_dentry->d_inode->i_ino;
55102 + dev_t olddev = __get_dev(old_dentry);
55103 +
55104 + /* vfs_rename swaps the name and parent link for old_dentry and
55105 + new_dentry
55106 + at this point, old_dentry has the new name, parent link, and inode
55107 + for the renamed file
55108 + if a file is being replaced by a rename, new_dentry has the inode
55109 + and name for the replaced file
55110 + */
55111 +
55112 + if (unlikely(!(gr_status & GR_READY)))
55113 + return;
55114 +
55115 + preempt_disable();
55116 + matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
55117 +
55118 + /* we wouldn't have to check d_inode if it weren't for
55119 + NFS silly-renaming
55120 + */
55121 +
55122 + write_lock(&gr_inode_lock);
55123 + if (unlikely(replace && inode)) {
55124 + ino_t newinode = inode->i_ino;
55125 + dev_t newdev = __get_dev(new_dentry);
55126 + inodev = lookup_inodev_entry(newinode, newdev);
55127 + if (inodev != NULL && ((inode->i_nlink <= 1) || S_ISDIR(inode->i_mode)))
55128 + do_handle_delete(inodev, newinode, newdev);
55129 + }
55130 +
55131 + inodev = lookup_inodev_entry(oldinode, olddev);
55132 + if (inodev != NULL && ((old_dentry->d_inode->i_nlink <= 1) || S_ISDIR(old_dentry->d_inode->i_mode)))
55133 + do_handle_delete(inodev, oldinode, olddev);
55134 +
55135 + if (unlikely((unsigned long)matchn))
55136 + do_handle_create(matchn, old_dentry, mnt);
55137 +
55138 + write_unlock(&gr_inode_lock);
55139 + preempt_enable();
55140 +
55141 + return;
55142 +}
55143 +
55144 +static int
55145 +lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
55146 + unsigned char **sum)
55147 +{
55148 + struct acl_role_label *r;
55149 + struct role_allowed_ip *ipp;
55150 + struct role_transition *trans;
55151 + unsigned int i;
55152 + int found = 0;
55153 + u32 curr_ip = current->signal->curr_ip;
55154 +
55155 + current->signal->saved_ip = curr_ip;
55156 +
55157 + /* check transition table */
55158 +
55159 + for (trans = current->role->transitions; trans; trans = trans->next) {
55160 + if (!strcmp(rolename, trans->rolename)) {
55161 + found = 1;
55162 + break;
55163 + }
55164 + }
55165 +
55166 + if (!found)
55167 + return 0;
55168 +
55169 + /* handle special roles that do not require authentication
55170 + and check ip */
55171 +
55172 + FOR_EACH_ROLE_START(r)
55173 + if (!strcmp(rolename, r->rolename) &&
55174 + (r->roletype & GR_ROLE_SPECIAL)) {
55175 + found = 0;
55176 + if (r->allowed_ips != NULL) {
55177 + for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
55178 + if ((ntohl(curr_ip) & ipp->netmask) ==
55179 + (ntohl(ipp->addr) & ipp->netmask))
55180 + found = 1;
55181 + }
55182 + } else
55183 + found = 2;
55184 + if (!found)
55185 + return 0;
55186 +
55187 + if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
55188 + ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
55189 + *salt = NULL;
55190 + *sum = NULL;
55191 + return 1;
55192 + }
55193 + }
55194 + FOR_EACH_ROLE_END(r)
55195 +
55196 + for (i = 0; i < num_sprole_pws; i++) {
55197 + if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
55198 + *salt = acl_special_roles[i]->salt;
55199 + *sum = acl_special_roles[i]->sum;
55200 + return 1;
55201 + }
55202 + }
55203 +
55204 + return 0;
55205 +}
55206 +
55207 +static void
55208 +assign_special_role(char *rolename)
55209 +{
55210 + struct acl_object_label *obj;
55211 + struct acl_role_label *r;
55212 + struct acl_role_label *assigned = NULL;
55213 + struct task_struct *tsk;
55214 + struct file *filp;
55215 +
55216 + FOR_EACH_ROLE_START(r)
55217 + if (!strcmp(rolename, r->rolename) &&
55218 + (r->roletype & GR_ROLE_SPECIAL)) {
55219 + assigned = r;
55220 + break;
55221 + }
55222 + FOR_EACH_ROLE_END(r)
55223 +
55224 + if (!assigned)
55225 + return;
55226 +
55227 + read_lock(&tasklist_lock);
55228 + read_lock(&grsec_exec_file_lock);
55229 +
55230 + tsk = current->real_parent;
55231 + if (tsk == NULL)
55232 + goto out_unlock;
55233 +
55234 + filp = tsk->exec_file;
55235 + if (filp == NULL)
55236 + goto out_unlock;
55237 +
55238 + tsk->is_writable = 0;
55239 +
55240 + tsk->acl_sp_role = 1;
55241 + tsk->acl_role_id = ++acl_sp_role_value;
55242 + tsk->role = assigned;
55243 + tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
55244 +
55245 + /* ignore additional mmap checks for processes that are writable
55246 + by the default ACL */
55247 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
55248 + if (unlikely(obj->mode & GR_WRITE))
55249 + tsk->is_writable = 1;
55250 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
55251 + if (unlikely(obj->mode & GR_WRITE))
55252 + tsk->is_writable = 1;
55253 +
55254 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
55255 + printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
55256 +#endif
55257 +
55258 +out_unlock:
55259 + read_unlock(&grsec_exec_file_lock);
55260 + read_unlock(&tasklist_lock);
55261 + return;
55262 +}
55263 +
55264 +int gr_check_secure_terminal(struct task_struct *task)
55265 +{
55266 + struct task_struct *p, *p2, *p3;
55267 + struct files_struct *files;
55268 + struct fdtable *fdt;
55269 + struct file *our_file = NULL, *file;
55270 + int i;
55271 +
55272 + if (task->signal->tty == NULL)
55273 + return 1;
55274 +
55275 + files = get_files_struct(task);
55276 + if (files != NULL) {
55277 + rcu_read_lock();
55278 + fdt = files_fdtable(files);
55279 + for (i=0; i < fdt->max_fds; i++) {
55280 + file = fcheck_files(files, i);
55281 + if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
55282 + get_file(file);
55283 + our_file = file;
55284 + }
55285 + }
55286 + rcu_read_unlock();
55287 + put_files_struct(files);
55288 + }
55289 +
55290 + if (our_file == NULL)
55291 + return 1;
55292 +
55293 + read_lock(&tasklist_lock);
55294 + do_each_thread(p2, p) {
55295 + files = get_files_struct(p);
55296 + if (files == NULL ||
55297 + (p->signal && p->signal->tty == task->signal->tty)) {
55298 + if (files != NULL)
55299 + put_files_struct(files);
55300 + continue;
55301 + }
55302 + rcu_read_lock();
55303 + fdt = files_fdtable(files);
55304 + for (i=0; i < fdt->max_fds; i++) {
55305 + file = fcheck_files(files, i);
55306 + if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
55307 + file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
55308 + p3 = task;
55309 + while (p3->pid > 0) {
55310 + if (p3 == p)
55311 + break;
55312 + p3 = p3->real_parent;
55313 + }
55314 + if (p3 == p)
55315 + break;
55316 + gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
55317 + gr_handle_alertkill(p);
55318 + rcu_read_unlock();
55319 + put_files_struct(files);
55320 + read_unlock(&tasklist_lock);
55321 + fput(our_file);
55322 + return 0;
55323 + }
55324 + }
55325 + rcu_read_unlock();
55326 + put_files_struct(files);
55327 + } while_each_thread(p2, p);
55328 + read_unlock(&tasklist_lock);
55329 +
55330 + fput(our_file);
55331 + return 1;
55332 +}
55333 +
55334 +ssize_t
55335 +write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
55336 +{
55337 + struct gr_arg_wrapper uwrap;
55338 + unsigned char *sprole_salt = NULL;
55339 + unsigned char *sprole_sum = NULL;
55340 + int error = sizeof (struct gr_arg_wrapper);
55341 + int error2 = 0;
55342 +
55343 + mutex_lock(&gr_dev_mutex);
55344 +
55345 + if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
55346 + error = -EPERM;
55347 + goto out;
55348 + }
55349 +
55350 + if (count != sizeof (struct gr_arg_wrapper)) {
55351 + gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
55352 + error = -EINVAL;
55353 + goto out;
55354 + }
55355 +
55356 +
55357 + if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
55358 + gr_auth_expires = 0;
55359 + gr_auth_attempts = 0;
55360 + }
55361 +
55362 + if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
55363 + error = -EFAULT;
55364 + goto out;
55365 + }
55366 +
55367 + if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
55368 + error = -EINVAL;
55369 + goto out;
55370 + }
55371 +
55372 + if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
55373 + error = -EFAULT;
55374 + goto out;
55375 + }
55376 +
55377 + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
55378 + gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
55379 + time_after(gr_auth_expires, get_seconds())) {
55380 + error = -EBUSY;
55381 + goto out;
55382 + }
55383 +
55384 + /* if non-root trying to do anything other than use a special role,
55385 + do not attempt authentication, do not count towards authentication
55386 + locking
55387 + */
55388 +
55389 + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
55390 + gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
55391 + current_uid()) {
55392 + error = -EPERM;
55393 + goto out;
55394 + }
55395 +
55396 + /* ensure pw and special role name are null terminated */
55397 +
55398 + gr_usermode->pw[GR_PW_LEN - 1] = '\0';
55399 + gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
55400 +
55401 + /* Okay.
55402 + * We have our enough of the argument structure..(we have yet
55403 + * to copy_from_user the tables themselves) . Copy the tables
55404 + * only if we need them, i.e. for loading operations. */
55405 +
55406 + switch (gr_usermode->mode) {
55407 + case GR_STATUS:
55408 + if (gr_status & GR_READY) {
55409 + error = 1;
55410 + if (!gr_check_secure_terminal(current))
55411 + error = 3;
55412 + } else
55413 + error = 2;
55414 + goto out;
55415 + case GR_SHUTDOWN:
55416 + if ((gr_status & GR_READY)
55417 + && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
55418 + pax_open_kernel();
55419 + gr_status &= ~GR_READY;
55420 + pax_close_kernel();
55421 +
55422 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
55423 + free_variables();
55424 + memset(gr_usermode, 0, sizeof (struct gr_arg));
55425 + memset(gr_system_salt, 0, GR_SALT_LEN);
55426 + memset(gr_system_sum, 0, GR_SHA_LEN);
55427 + } else if (gr_status & GR_READY) {
55428 + gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
55429 + error = -EPERM;
55430 + } else {
55431 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
55432 + error = -EAGAIN;
55433 + }
55434 + break;
55435 + case GR_ENABLE:
55436 + if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
55437 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
55438 + else {
55439 + if (gr_status & GR_READY)
55440 + error = -EAGAIN;
55441 + else
55442 + error = error2;
55443 + gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
55444 + }
55445 + break;
55446 + case GR_RELOAD:
55447 + if (!(gr_status & GR_READY)) {
55448 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
55449 + error = -EAGAIN;
55450 + } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
55451 + lock_kernel();
55452 +
55453 + pax_open_kernel();
55454 + gr_status &= ~GR_READY;
55455 + pax_close_kernel();
55456 +
55457 + free_variables();
55458 + if (!(error2 = gracl_init(gr_usermode))) {
55459 + unlock_kernel();
55460 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
55461 + } else {
55462 + unlock_kernel();
55463 + error = error2;
55464 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
55465 + }
55466 + } else {
55467 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
55468 + error = -EPERM;
55469 + }
55470 + break;
55471 + case GR_SEGVMOD:
55472 + if (unlikely(!(gr_status & GR_READY))) {
55473 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
55474 + error = -EAGAIN;
55475 + break;
55476 + }
55477 +
55478 + if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
55479 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
55480 + if (gr_usermode->segv_device && gr_usermode->segv_inode) {
55481 + struct acl_subject_label *segvacl;
55482 + segvacl =
55483 + lookup_acl_subj_label(gr_usermode->segv_inode,
55484 + gr_usermode->segv_device,
55485 + current->role);
55486 + if (segvacl) {
55487 + segvacl->crashes = 0;
55488 + segvacl->expires = 0;
55489 + }
55490 + } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
55491 + gr_remove_uid(gr_usermode->segv_uid);
55492 + }
55493 + } else {
55494 + gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
55495 + error = -EPERM;
55496 + }
55497 + break;
55498 + case GR_SPROLE:
55499 + case GR_SPROLEPAM:
55500 + if (unlikely(!(gr_status & GR_READY))) {
55501 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
55502 + error = -EAGAIN;
55503 + break;
55504 + }
55505 +
55506 + if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
55507 + current->role->expires = 0;
55508 + current->role->auth_attempts = 0;
55509 + }
55510 +
55511 + if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
55512 + time_after(current->role->expires, get_seconds())) {
55513 + error = -EBUSY;
55514 + goto out;
55515 + }
55516 +
55517 + if (lookup_special_role_auth
55518 + (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
55519 + && ((!sprole_salt && !sprole_sum)
55520 + || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
55521 + char *p = "";
55522 + assign_special_role(gr_usermode->sp_role);
55523 + read_lock(&tasklist_lock);
55524 + if (current->real_parent)
55525 + p = current->real_parent->role->rolename;
55526 + read_unlock(&tasklist_lock);
55527 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
55528 + p, acl_sp_role_value);
55529 + } else {
55530 + gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
55531 + error = -EPERM;
55532 + if(!(current->role->auth_attempts++))
55533 + current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
55534 +
55535 + goto out;
55536 + }
55537 + break;
55538 + case GR_UNSPROLE:
55539 + if (unlikely(!(gr_status & GR_READY))) {
55540 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
55541 + error = -EAGAIN;
55542 + break;
55543 + }
55544 +
55545 + if (current->role->roletype & GR_ROLE_SPECIAL) {
55546 + char *p = "";
55547 + int i = 0;
55548 +
55549 + read_lock(&tasklist_lock);
55550 + if (current->real_parent) {
55551 + p = current->real_parent->role->rolename;
55552 + i = current->real_parent->acl_role_id;
55553 + }
55554 + read_unlock(&tasklist_lock);
55555 +
55556 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
55557 + gr_set_acls(1);
55558 + } else {
55559 + error = -EPERM;
55560 + goto out;
55561 + }
55562 + break;
55563 + default:
55564 + gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
55565 + error = -EINVAL;
55566 + break;
55567 + }
55568 +
55569 + if (error != -EPERM)
55570 + goto out;
55571 +
55572 + if(!(gr_auth_attempts++))
55573 + gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
55574 +
55575 + out:
55576 + mutex_unlock(&gr_dev_mutex);
55577 + return error;
55578 +}
55579 +
55580 +/* must be called with
55581 + rcu_read_lock();
55582 + read_lock(&tasklist_lock);
55583 + read_lock(&grsec_exec_file_lock);
55584 +*/
55585 +int gr_apply_subject_to_task(struct task_struct *task)
55586 +{
55587 + struct acl_object_label *obj;
55588 + char *tmpname;
55589 + struct acl_subject_label *tmpsubj;
55590 + struct file *filp;
55591 + struct name_entry *nmatch;
55592 +
55593 + filp = task->exec_file;
55594 + if (filp == NULL)
55595 + return 0;
55596 +
55597 + /* the following is to apply the correct subject
55598 + on binaries running when the RBAC system
55599 + is enabled, when the binaries have been
55600 + replaced or deleted since their execution
55601 + -----
55602 + when the RBAC system starts, the inode/dev
55603 + from exec_file will be one the RBAC system
55604 + is unaware of. It only knows the inode/dev
55605 + of the present file on disk, or the absence
55606 + of it.
55607 + */
55608 + preempt_disable();
55609 + tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
55610 +
55611 + nmatch = lookup_name_entry(tmpname);
55612 + preempt_enable();
55613 + tmpsubj = NULL;
55614 + if (nmatch) {
55615 + if (nmatch->deleted)
55616 + tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
55617 + else
55618 + tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
55619 + if (tmpsubj != NULL)
55620 + task->acl = tmpsubj;
55621 + }
55622 + if (tmpsubj == NULL)
55623 + task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
55624 + task->role);
55625 + if (task->acl) {
55626 + task->is_writable = 0;
55627 + /* ignore additional mmap checks for processes that are writable
55628 + by the default ACL */
55629 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
55630 + if (unlikely(obj->mode & GR_WRITE))
55631 + task->is_writable = 1;
55632 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
55633 + if (unlikely(obj->mode & GR_WRITE))
55634 + task->is_writable = 1;
55635 +
55636 + gr_set_proc_res(task);
55637 +
55638 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
55639 + printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
55640 +#endif
55641 + } else {
55642 + return 1;
55643 + }
55644 +
55645 + return 0;
55646 +}
55647 +
55648 +int
55649 +gr_set_acls(const int type)
55650 +{
55651 + struct task_struct *task, *task2;
55652 + struct acl_role_label *role = current->role;
55653 + __u16 acl_role_id = current->acl_role_id;
55654 + const struct cred *cred;
55655 + int ret;
55656 +
55657 + rcu_read_lock();
55658 + read_lock(&tasklist_lock);
55659 + read_lock(&grsec_exec_file_lock);
55660 + do_each_thread(task2, task) {
55661 + /* check to see if we're called from the exit handler,
55662 + if so, only replace ACLs that have inherited the admin
55663 + ACL */
55664 +
55665 + if (type && (task->role != role ||
55666 + task->acl_role_id != acl_role_id))
55667 + continue;
55668 +
55669 + task->acl_role_id = 0;
55670 + task->acl_sp_role = 0;
55671 +
55672 + if (task->exec_file) {
55673 + cred = __task_cred(task);
55674 + task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
55675 +
55676 + ret = gr_apply_subject_to_task(task);
55677 + if (ret) {
55678 + read_unlock(&grsec_exec_file_lock);
55679 + read_unlock(&tasklist_lock);
55680 + rcu_read_unlock();
55681 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
55682 + return ret;
55683 + }
55684 + } else {
55685 + // it's a kernel process
55686 + task->role = kernel_role;
55687 + task->acl = kernel_role->root_label;
55688 +#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
55689 + task->acl->mode &= ~GR_PROCFIND;
55690 +#endif
55691 + }
55692 + } while_each_thread(task2, task);
55693 + read_unlock(&grsec_exec_file_lock);
55694 + read_unlock(&tasklist_lock);
55695 + rcu_read_unlock();
55696 +
55697 + return 0;
55698 +}
55699 +
55700 +void
55701 +gr_learn_resource(const struct task_struct *task,
55702 + const int res, const unsigned long wanted, const int gt)
55703 +{
55704 + struct acl_subject_label *acl;
55705 + const struct cred *cred;
55706 +
55707 + if (unlikely((gr_status & GR_READY) &&
55708 + task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
55709 + goto skip_reslog;
55710 +
55711 +#ifdef CONFIG_GRKERNSEC_RESLOG
55712 + gr_log_resource(task, res, wanted, gt);
55713 +#endif
55714 + skip_reslog:
55715 +
55716 + if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
55717 + return;
55718 +
55719 + acl = task->acl;
55720 +
55721 + if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
55722 + !(acl->resmask & (1 << (unsigned short) res))))
55723 + return;
55724 +
55725 + if (wanted >= acl->res[res].rlim_cur) {
55726 + unsigned long res_add;
55727 +
55728 + res_add = wanted;
55729 + switch (res) {
55730 + case RLIMIT_CPU:
55731 + res_add += GR_RLIM_CPU_BUMP;
55732 + break;
55733 + case RLIMIT_FSIZE:
55734 + res_add += GR_RLIM_FSIZE_BUMP;
55735 + break;
55736 + case RLIMIT_DATA:
55737 + res_add += GR_RLIM_DATA_BUMP;
55738 + break;
55739 + case RLIMIT_STACK:
55740 + res_add += GR_RLIM_STACK_BUMP;
55741 + break;
55742 + case RLIMIT_CORE:
55743 + res_add += GR_RLIM_CORE_BUMP;
55744 + break;
55745 + case RLIMIT_RSS:
55746 + res_add += GR_RLIM_RSS_BUMP;
55747 + break;
55748 + case RLIMIT_NPROC:
55749 + res_add += GR_RLIM_NPROC_BUMP;
55750 + break;
55751 + case RLIMIT_NOFILE:
55752 + res_add += GR_RLIM_NOFILE_BUMP;
55753 + break;
55754 + case RLIMIT_MEMLOCK:
55755 + res_add += GR_RLIM_MEMLOCK_BUMP;
55756 + break;
55757 + case RLIMIT_AS:
55758 + res_add += GR_RLIM_AS_BUMP;
55759 + break;
55760 + case RLIMIT_LOCKS:
55761 + res_add += GR_RLIM_LOCKS_BUMP;
55762 + break;
55763 + case RLIMIT_SIGPENDING:
55764 + res_add += GR_RLIM_SIGPENDING_BUMP;
55765 + break;
55766 + case RLIMIT_MSGQUEUE:
55767 + res_add += GR_RLIM_MSGQUEUE_BUMP;
55768 + break;
55769 + case RLIMIT_NICE:
55770 + res_add += GR_RLIM_NICE_BUMP;
55771 + break;
55772 + case RLIMIT_RTPRIO:
55773 + res_add += GR_RLIM_RTPRIO_BUMP;
55774 + break;
55775 + case RLIMIT_RTTIME:
55776 + res_add += GR_RLIM_RTTIME_BUMP;
55777 + break;
55778 + }
55779 +
55780 + acl->res[res].rlim_cur = res_add;
55781 +
55782 + if (wanted > acl->res[res].rlim_max)
55783 + acl->res[res].rlim_max = res_add;
55784 +
55785 + /* only log the subject filename, since resource logging is supported for
55786 + single-subject learning only */
55787 + rcu_read_lock();
55788 + cred = __task_cred(task);
55789 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
55790 + task->role->roletype, cred->uid, cred->gid, acl->filename,
55791 + acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
55792 + "", (unsigned long) res, &task->signal->saved_ip);
55793 + rcu_read_unlock();
55794 + }
55795 +
55796 + return;
55797 +}
55798 +
55799 +#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
55800 +void
55801 +pax_set_initial_flags(struct linux_binprm *bprm)
55802 +{
55803 + struct task_struct *task = current;
55804 + struct acl_subject_label *proc;
55805 + unsigned long flags;
55806 +
55807 + if (unlikely(!(gr_status & GR_READY)))
55808 + return;
55809 +
55810 + flags = pax_get_flags(task);
55811 +
55812 + proc = task->acl;
55813 +
55814 + if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
55815 + flags &= ~MF_PAX_PAGEEXEC;
55816 + if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
55817 + flags &= ~MF_PAX_SEGMEXEC;
55818 + if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
55819 + flags &= ~MF_PAX_RANDMMAP;
55820 + if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
55821 + flags &= ~MF_PAX_EMUTRAMP;
55822 + if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
55823 + flags &= ~MF_PAX_MPROTECT;
55824 +
55825 + if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
55826 + flags |= MF_PAX_PAGEEXEC;
55827 + if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
55828 + flags |= MF_PAX_SEGMEXEC;
55829 + if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
55830 + flags |= MF_PAX_RANDMMAP;
55831 + if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
55832 + flags |= MF_PAX_EMUTRAMP;
55833 + if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
55834 + flags |= MF_PAX_MPROTECT;
55835 +
55836 + pax_set_flags(task, flags);
55837 +
55838 + return;
55839 +}
55840 +#endif
55841 +
55842 +#ifdef CONFIG_SYSCTL
55843 +/* Eric Biederman likes breaking userland ABI and every inode-based security
55844 + system to save 35kb of memory */
55845 +
55846 +/* we modify the passed in filename, but adjust it back before returning */
55847 +static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
55848 +{
55849 + struct name_entry *nmatch;
55850 + char *p, *lastp = NULL;
55851 + struct acl_object_label *obj = NULL, *tmp;
55852 + struct acl_subject_label *tmpsubj;
55853 + char c = '\0';
55854 +
55855 + read_lock(&gr_inode_lock);
55856 +
55857 + p = name + len - 1;
55858 + do {
55859 + nmatch = lookup_name_entry(name);
55860 + if (lastp != NULL)
55861 + *lastp = c;
55862 +
55863 + if (nmatch == NULL)
55864 + goto next_component;
55865 + tmpsubj = current->acl;
55866 + do {
55867 + obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
55868 + if (obj != NULL) {
55869 + tmp = obj->globbed;
55870 + while (tmp) {
55871 + if (!glob_match(tmp->filename, name)) {
55872 + obj = tmp;
55873 + goto found_obj;
55874 + }
55875 + tmp = tmp->next;
55876 + }
55877 + goto found_obj;
55878 + }
55879 + } while ((tmpsubj = tmpsubj->parent_subject));
55880 +next_component:
55881 + /* end case */
55882 + if (p == name)
55883 + break;
55884 +
55885 + while (*p != '/')
55886 + p--;
55887 + if (p == name)
55888 + lastp = p + 1;
55889 + else {
55890 + lastp = p;
55891 + p--;
55892 + }
55893 + c = *lastp;
55894 + *lastp = '\0';
55895 + } while (1);
55896 +found_obj:
55897 + read_unlock(&gr_inode_lock);
55898 + /* obj returned will always be non-null */
55899 + return obj;
55900 +}
55901 +
55902 +/* returns 0 when allowing, non-zero on error
55903 + op of 0 is used for readdir, so we don't log the names of hidden files
55904 +*/
55905 +__u32
55906 +gr_handle_sysctl(const struct ctl_table *table, const int op)
55907 +{
55908 + ctl_table *tmp;
55909 + const char *proc_sys = "/proc/sys";
55910 + char *path;
55911 + struct acl_object_label *obj;
55912 + unsigned short len = 0, pos = 0, depth = 0, i;
55913 + __u32 err = 0;
55914 + __u32 mode = 0;
55915 +
55916 + if (unlikely(!(gr_status & GR_READY)))
55917 + return 0;
55918 +
55919 + /* for now, ignore operations on non-sysctl entries if it's not a
55920 + readdir*/
55921 + if (table->child != NULL && op != 0)
55922 + return 0;
55923 +
55924 + mode |= GR_FIND;
55925 + /* it's only a read if it's an entry, read on dirs is for readdir */
55926 + if (op & MAY_READ)
55927 + mode |= GR_READ;
55928 + if (op & MAY_WRITE)
55929 + mode |= GR_WRITE;
55930 +
55931 + preempt_disable();
55932 +
55933 + path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
55934 +
55935 + /* it's only a read/write if it's an actual entry, not a dir
55936 + (which are opened for readdir)
55937 + */
55938 +
55939 + /* convert the requested sysctl entry into a pathname */
55940 +
55941 + for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
55942 + len += strlen(tmp->procname);
55943 + len++;
55944 + depth++;
55945 + }
55946 +
55947 + if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
55948 + /* deny */
55949 + goto out;
55950 + }
55951 +
55952 + memset(path, 0, PAGE_SIZE);
55953 +
55954 + memcpy(path, proc_sys, strlen(proc_sys));
55955 +
55956 + pos += strlen(proc_sys);
55957 +
55958 + for (; depth > 0; depth--) {
55959 + path[pos] = '/';
55960 + pos++;
55961 + for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
55962 + if (depth == i) {
55963 + memcpy(path + pos, tmp->procname,
55964 + strlen(tmp->procname));
55965 + pos += strlen(tmp->procname);
55966 + }
55967 + i++;
55968 + }
55969 + }
55970 +
55971 + obj = gr_lookup_by_name(path, pos);
55972 + err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
55973 +
55974 + if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
55975 + ((err & mode) != mode))) {
55976 + __u32 new_mode = mode;
55977 +
55978 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
55979 +
55980 + err = 0;
55981 + gr_log_learn_sysctl(path, new_mode);
55982 + } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
55983 + gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
55984 + err = -ENOENT;
55985 + } else if (!(err & GR_FIND)) {
55986 + err = -ENOENT;
55987 + } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
55988 + gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
55989 + path, (mode & GR_READ) ? " reading" : "",
55990 + (mode & GR_WRITE) ? " writing" : "");
55991 + err = -EACCES;
55992 + } else if ((err & mode) != mode) {
55993 + err = -EACCES;
55994 + } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
55995 + gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
55996 + path, (mode & GR_READ) ? " reading" : "",
55997 + (mode & GR_WRITE) ? " writing" : "");
55998 + err = 0;
55999 + } else
56000 + err = 0;
56001 +
56002 + out:
56003 + preempt_enable();
56004 +
56005 + return err;
56006 +}
56007 +#endif
56008 +
56009 +int
56010 +gr_handle_proc_ptrace(struct task_struct *task)
56011 +{
56012 + struct file *filp;
56013 + struct task_struct *tmp = task;
56014 + struct task_struct *curtemp = current;
56015 + __u32 retmode;
56016 +
56017 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
56018 + if (unlikely(!(gr_status & GR_READY)))
56019 + return 0;
56020 +#endif
56021 +
56022 + read_lock(&tasklist_lock);
56023 + read_lock(&grsec_exec_file_lock);
56024 + filp = task->exec_file;
56025 +
56026 + while (tmp->pid > 0) {
56027 + if (tmp == curtemp)
56028 + break;
56029 + tmp = tmp->real_parent;
56030 + }
56031 +
56032 + if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
56033 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
56034 + read_unlock(&grsec_exec_file_lock);
56035 + read_unlock(&tasklist_lock);
56036 + return 1;
56037 + }
56038 +
56039 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
56040 + if (!(gr_status & GR_READY)) {
56041 + read_unlock(&grsec_exec_file_lock);
56042 + read_unlock(&tasklist_lock);
56043 + return 0;
56044 + }
56045 +#endif
56046 +
56047 + retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
56048 + read_unlock(&grsec_exec_file_lock);
56049 + read_unlock(&tasklist_lock);
56050 +
56051 + if (retmode & GR_NOPTRACE)
56052 + return 1;
56053 +
56054 + if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
56055 + && (current->acl != task->acl || (current->acl != current->role->root_label
56056 + && current->pid != task->pid)))
56057 + return 1;
56058 +
56059 + return 0;
56060 +}
56061 +
56062 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
56063 +{
56064 + if (unlikely(!(gr_status & GR_READY)))
56065 + return;
56066 +
56067 + if (!(current->role->roletype & GR_ROLE_GOD))
56068 + return;
56069 +
56070 + seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
56071 + p->role->rolename, gr_task_roletype_to_char(p),
56072 + p->acl->filename);
56073 +}
56074 +
56075 +int
56076 +gr_handle_ptrace(struct task_struct *task, const long request)
56077 +{
56078 + struct task_struct *tmp = task;
56079 + struct task_struct *curtemp = current;
56080 + __u32 retmode;
56081 +
56082 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
56083 + if (unlikely(!(gr_status & GR_READY)))
56084 + return 0;
56085 +#endif
56086 +
56087 + read_lock(&tasklist_lock);
56088 + while (tmp->pid > 0) {
56089 + if (tmp == curtemp)
56090 + break;
56091 + tmp = tmp->real_parent;
56092 + }
56093 +
56094 + if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
56095 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
56096 + read_unlock(&tasklist_lock);
56097 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
56098 + return 1;
56099 + }
56100 + read_unlock(&tasklist_lock);
56101 +
56102 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
56103 + if (!(gr_status & GR_READY))
56104 + return 0;
56105 +#endif
56106 +
56107 + read_lock(&grsec_exec_file_lock);
56108 + if (unlikely(!task->exec_file)) {
56109 + read_unlock(&grsec_exec_file_lock);
56110 + return 0;
56111 + }
56112 +
56113 + retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
56114 + read_unlock(&grsec_exec_file_lock);
56115 +
56116 + if (retmode & GR_NOPTRACE) {
56117 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
56118 + return 1;
56119 + }
56120 +
56121 + if (retmode & GR_PTRACERD) {
56122 + switch (request) {
56123 + case PTRACE_POKETEXT:
56124 + case PTRACE_POKEDATA:
56125 + case PTRACE_POKEUSR:
56126 +#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
56127 + case PTRACE_SETREGS:
56128 + case PTRACE_SETFPREGS:
56129 +#endif
56130 +#ifdef CONFIG_X86
56131 + case PTRACE_SETFPXREGS:
56132 +#endif
56133 +#ifdef CONFIG_ALTIVEC
56134 + case PTRACE_SETVRREGS:
56135 +#endif
56136 + return 1;
56137 + default:
56138 + return 0;
56139 + }
56140 + } else if (!(current->acl->mode & GR_POVERRIDE) &&
56141 + !(current->role->roletype & GR_ROLE_GOD) &&
56142 + (current->acl != task->acl)) {
56143 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
56144 + return 1;
56145 + }
56146 +
56147 + return 0;
56148 +}
56149 +
56150 +static int is_writable_mmap(const struct file *filp)
56151 +{
56152 + struct task_struct *task = current;
56153 + struct acl_object_label *obj, *obj2;
56154 +
56155 + if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
56156 + !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
56157 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
56158 + obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
56159 + task->role->root_label);
56160 + if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
56161 + gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
56162 + return 1;
56163 + }
56164 + }
56165 + return 0;
56166 +}
56167 +
56168 +int
56169 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
56170 +{
56171 + __u32 mode;
56172 +
56173 + if (unlikely(!file || !(prot & PROT_EXEC)))
56174 + return 1;
56175 +
56176 + if (is_writable_mmap(file))
56177 + return 0;
56178 +
56179 + mode =
56180 + gr_search_file(file->f_path.dentry,
56181 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
56182 + file->f_path.mnt);
56183 +
56184 + if (!gr_tpe_allow(file))
56185 + return 0;
56186 +
56187 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
56188 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
56189 + return 0;
56190 + } else if (unlikely(!(mode & GR_EXEC))) {
56191 + return 0;
56192 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
56193 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
56194 + return 1;
56195 + }
56196 +
56197 + return 1;
56198 +}
56199 +
56200 +int
56201 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
56202 +{
56203 + __u32 mode;
56204 +
56205 + if (unlikely(!file || !(prot & PROT_EXEC)))
56206 + return 1;
56207 +
56208 + if (is_writable_mmap(file))
56209 + return 0;
56210 +
56211 + mode =
56212 + gr_search_file(file->f_path.dentry,
56213 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
56214 + file->f_path.mnt);
56215 +
56216 + if (!gr_tpe_allow(file))
56217 + return 0;
56218 +
56219 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
56220 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
56221 + return 0;
56222 + } else if (unlikely(!(mode & GR_EXEC))) {
56223 + return 0;
56224 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
56225 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
56226 + return 1;
56227 + }
56228 +
56229 + return 1;
56230 +}
56231 +
56232 +void
56233 +gr_acl_handle_psacct(struct task_struct *task, const long code)
56234 +{
56235 + unsigned long runtime;
56236 + unsigned long cputime;
56237 + unsigned int wday, cday;
56238 + __u8 whr, chr;
56239 + __u8 wmin, cmin;
56240 + __u8 wsec, csec;
56241 + struct timespec timeval;
56242 +
56243 + if (unlikely(!(gr_status & GR_READY) || !task->acl ||
56244 + !(task->acl->mode & GR_PROCACCT)))
56245 + return;
56246 +
56247 + do_posix_clock_monotonic_gettime(&timeval);
56248 + runtime = timeval.tv_sec - task->start_time.tv_sec;
56249 + wday = runtime / (3600 * 24);
56250 + runtime -= wday * (3600 * 24);
56251 + whr = runtime / 3600;
56252 + runtime -= whr * 3600;
56253 + wmin = runtime / 60;
56254 + runtime -= wmin * 60;
56255 + wsec = runtime;
56256 +
56257 + cputime = (task->utime + task->stime) / HZ;
56258 + cday = cputime / (3600 * 24);
56259 + cputime -= cday * (3600 * 24);
56260 + chr = cputime / 3600;
56261 + cputime -= chr * 3600;
56262 + cmin = cputime / 60;
56263 + cputime -= cmin * 60;
56264 + csec = cputime;
56265 +
56266 + gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
56267 +
56268 + return;
56269 +}
56270 +
56271 +void gr_set_kernel_label(struct task_struct *task)
56272 +{
56273 + if (gr_status & GR_READY) {
56274 + task->role = kernel_role;
56275 + task->acl = kernel_role->root_label;
56276 + }
56277 + return;
56278 +}
56279 +
56280 +#ifdef CONFIG_TASKSTATS
56281 +int gr_is_taskstats_denied(int pid)
56282 +{
56283 + struct task_struct *task;
56284 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
56285 + const struct cred *cred;
56286 +#endif
56287 + int ret = 0;
56288 +
56289 + /* restrict taskstats viewing to un-chrooted root users
56290 + who have the 'view' subject flag if the RBAC system is enabled
56291 + */
56292 +
56293 + rcu_read_lock();
56294 + read_lock(&tasklist_lock);
56295 + task = find_task_by_vpid(pid);
56296 + if (task) {
56297 +#ifdef CONFIG_GRKERNSEC_CHROOT
56298 + if (proc_is_chrooted(task))
56299 + ret = -EACCES;
56300 +#endif
56301 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
56302 + cred = __task_cred(task);
56303 +#ifdef CONFIG_GRKERNSEC_PROC_USER
56304 + if (cred->uid != 0)
56305 + ret = -EACCES;
56306 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
56307 + if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
56308 + ret = -EACCES;
56309 +#endif
56310 +#endif
56311 + if (gr_status & GR_READY) {
56312 + if (!(task->acl->mode & GR_VIEW))
56313 + ret = -EACCES;
56314 + }
56315 + } else
56316 + ret = -ENOENT;
56317 +
56318 + read_unlock(&tasklist_lock);
56319 + rcu_read_unlock();
56320 +
56321 + return ret;
56322 +}
56323 +#endif
56324 +
56325 +/* AUXV entries are filled via a descendant of search_binary_handler
56326 + after we've already applied the subject for the target
56327 +*/
56328 +int gr_acl_enable_at_secure(void)
56329 +{
56330 + if (unlikely(!(gr_status & GR_READY)))
56331 + return 0;
56332 +
56333 + if (current->acl->mode & GR_ATSECURE)
56334 + return 1;
56335 +
56336 + return 0;
56337 +}
56338 +
56339 +int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
56340 +{
56341 + struct task_struct *task = current;
56342 + struct dentry *dentry = file->f_path.dentry;
56343 + struct vfsmount *mnt = file->f_path.mnt;
56344 + struct acl_object_label *obj, *tmp;
56345 + struct acl_subject_label *subj;
56346 + unsigned int bufsize;
56347 + int is_not_root;
56348 + char *path;
56349 + dev_t dev = __get_dev(dentry);
56350 +
56351 + if (unlikely(!(gr_status & GR_READY)))
56352 + return 1;
56353 +
56354 + if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
56355 + return 1;
56356 +
56357 + /* ignore Eric Biederman */
56358 + if (IS_PRIVATE(dentry->d_inode))
56359 + return 1;
56360 +
56361 + subj = task->acl;
56362 + do {
56363 + obj = lookup_acl_obj_label(ino, dev, subj);
56364 + if (obj != NULL)
56365 + return (obj->mode & GR_FIND) ? 1 : 0;
56366 + } while ((subj = subj->parent_subject));
56367 +
56368 + /* this is purely an optimization since we're looking for an object
56369 + for the directory we're doing a readdir on
56370 + if it's possible for any globbed object to match the entry we're
56371 + filling into the directory, then the object we find here will be
56372 + an anchor point with attached globbed objects
56373 + */
56374 + obj = chk_obj_label_noglob(dentry, mnt, task->acl);
56375 + if (obj->globbed == NULL)
56376 + return (obj->mode & GR_FIND) ? 1 : 0;
56377 +
56378 + is_not_root = ((obj->filename[0] == '/') &&
56379 + (obj->filename[1] == '\0')) ? 0 : 1;
56380 + bufsize = PAGE_SIZE - namelen - is_not_root;
56381 +
56382 + /* check bufsize > PAGE_SIZE || bufsize == 0 */
56383 + if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
56384 + return 1;
56385 +
56386 + preempt_disable();
56387 + path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
56388 + bufsize);
56389 +
56390 + bufsize = strlen(path);
56391 +
56392 + /* if base is "/", don't append an additional slash */
56393 + if (is_not_root)
56394 + *(path + bufsize) = '/';
56395 + memcpy(path + bufsize + is_not_root, name, namelen);
56396 + *(path + bufsize + namelen + is_not_root) = '\0';
56397 +
56398 + tmp = obj->globbed;
56399 + while (tmp) {
56400 + if (!glob_match(tmp->filename, path)) {
56401 + preempt_enable();
56402 + return (tmp->mode & GR_FIND) ? 1 : 0;
56403 + }
56404 + tmp = tmp->next;
56405 + }
56406 + preempt_enable();
56407 + return (obj->mode & GR_FIND) ? 1 : 0;
56408 +}
56409 +
56410 +#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
56411 +EXPORT_SYMBOL(gr_acl_is_enabled);
56412 +#endif
56413 +EXPORT_SYMBOL(gr_learn_resource);
56414 +EXPORT_SYMBOL(gr_set_kernel_label);
56415 +#ifdef CONFIG_SECURITY
56416 +EXPORT_SYMBOL(gr_check_user_change);
56417 +EXPORT_SYMBOL(gr_check_group_change);
56418 +#endif
56419 +
56420 diff -urNp linux-2.6.32.49/grsecurity/gracl_cap.c linux-2.6.32.49/grsecurity/gracl_cap.c
56421 --- linux-2.6.32.49/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
56422 +++ linux-2.6.32.49/grsecurity/gracl_cap.c 2011-11-15 19:59:43.000000000 -0500
56423 @@ -0,0 +1,101 @@
56424 +#include <linux/kernel.h>
56425 +#include <linux/module.h>
56426 +#include <linux/sched.h>
56427 +#include <linux/gracl.h>
56428 +#include <linux/grsecurity.h>
56429 +#include <linux/grinternal.h>
56430 +
56431 +extern const char *captab_log[];
56432 +extern int captab_log_entries;
56433 +
56434 +int
56435 +gr_acl_is_capable(const int cap)
56436 +{
56437 + struct task_struct *task = current;
56438 + const struct cred *cred = current_cred();
56439 + struct acl_subject_label *curracl;
56440 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
56441 + kernel_cap_t cap_audit = __cap_empty_set;
56442 +
56443 + if (!gr_acl_is_enabled())
56444 + return 1;
56445 +
56446 + curracl = task->acl;
56447 +
56448 + cap_drop = curracl->cap_lower;
56449 + cap_mask = curracl->cap_mask;
56450 + cap_audit = curracl->cap_invert_audit;
56451 +
56452 + while ((curracl = curracl->parent_subject)) {
56453 + /* if the cap isn't specified in the current computed mask but is specified in the
56454 + current level subject, and is lowered in the current level subject, then add
56455 + it to the set of dropped capabilities
56456 + otherwise, add the current level subject's mask to the current computed mask
56457 + */
56458 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
56459 + cap_raise(cap_mask, cap);
56460 + if (cap_raised(curracl->cap_lower, cap))
56461 + cap_raise(cap_drop, cap);
56462 + if (cap_raised(curracl->cap_invert_audit, cap))
56463 + cap_raise(cap_audit, cap);
56464 + }
56465 + }
56466 +
56467 + if (!cap_raised(cap_drop, cap)) {
56468 + if (cap_raised(cap_audit, cap))
56469 + gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
56470 + return 1;
56471 + }
56472 +
56473 + curracl = task->acl;
56474 +
56475 + if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
56476 + && cap_raised(cred->cap_effective, cap)) {
56477 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
56478 + task->role->roletype, cred->uid,
56479 + cred->gid, task->exec_file ?
56480 + gr_to_filename(task->exec_file->f_path.dentry,
56481 + task->exec_file->f_path.mnt) : curracl->filename,
56482 + curracl->filename, 0UL,
56483 + 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
56484 + return 1;
56485 + }
56486 +
56487 + if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
56488 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
56489 + return 0;
56490 +}
56491 +
56492 +int
56493 +gr_acl_is_capable_nolog(const int cap)
56494 +{
56495 + struct acl_subject_label *curracl;
56496 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
56497 +
56498 + if (!gr_acl_is_enabled())
56499 + return 1;
56500 +
56501 + curracl = current->acl;
56502 +
56503 + cap_drop = curracl->cap_lower;
56504 + cap_mask = curracl->cap_mask;
56505 +
56506 + while ((curracl = curracl->parent_subject)) {
56507 + /* if the cap isn't specified in the current computed mask but is specified in the
56508 + current level subject, and is lowered in the current level subject, then add
56509 + it to the set of dropped capabilities
56510 + otherwise, add the current level subject's mask to the current computed mask
56511 + */
56512 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
56513 + cap_raise(cap_mask, cap);
56514 + if (cap_raised(curracl->cap_lower, cap))
56515 + cap_raise(cap_drop, cap);
56516 + }
56517 + }
56518 +
56519 + if (!cap_raised(cap_drop, cap))
56520 + return 1;
56521 +
56522 + return 0;
56523 +}
56524 +
56525 diff -urNp linux-2.6.32.49/grsecurity/gracl_fs.c linux-2.6.32.49/grsecurity/gracl_fs.c
56526 --- linux-2.6.32.49/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500
56527 +++ linux-2.6.32.49/grsecurity/gracl_fs.c 2011-11-18 19:29:57.000000000 -0500
56528 @@ -0,0 +1,433 @@
56529 +#include <linux/kernel.h>
56530 +#include <linux/sched.h>
56531 +#include <linux/types.h>
56532 +#include <linux/fs.h>
56533 +#include <linux/file.h>
56534 +#include <linux/stat.h>
56535 +#include <linux/grsecurity.h>
56536 +#include <linux/grinternal.h>
56537 +#include <linux/gracl.h>
56538 +
56539 +__u32
56540 +gr_acl_handle_hidden_file(const struct dentry * dentry,
56541 + const struct vfsmount * mnt)
56542 +{
56543 + __u32 mode;
56544 +
56545 + if (unlikely(!dentry->d_inode))
56546 + return GR_FIND;
56547 +
56548 + mode =
56549 + gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
56550 +
56551 + if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
56552 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
56553 + return mode;
56554 + } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
56555 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
56556 + return 0;
56557 + } else if (unlikely(!(mode & GR_FIND)))
56558 + return 0;
56559 +
56560 + return GR_FIND;
56561 +}
56562 +
56563 +__u32
56564 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
56565 + int acc_mode)
56566 +{
56567 + __u32 reqmode = GR_FIND;
56568 + __u32 mode;
56569 +
56570 + if (unlikely(!dentry->d_inode))
56571 + return reqmode;
56572 +
56573 + if (acc_mode & MAY_APPEND)
56574 + reqmode |= GR_APPEND;
56575 + else if (acc_mode & MAY_WRITE)
56576 + reqmode |= GR_WRITE;
56577 + if ((acc_mode & MAY_READ) && !S_ISDIR(dentry->d_inode->i_mode))
56578 + reqmode |= GR_READ;
56579 +
56580 + mode =
56581 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
56582 + mnt);
56583 +
56584 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
56585 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
56586 + reqmode & GR_READ ? " reading" : "",
56587 + reqmode & GR_WRITE ? " writing" : reqmode &
56588 + GR_APPEND ? " appending" : "");
56589 + return reqmode;
56590 + } else
56591 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
56592 + {
56593 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
56594 + reqmode & GR_READ ? " reading" : "",
56595 + reqmode & GR_WRITE ? " writing" : reqmode &
56596 + GR_APPEND ? " appending" : "");
56597 + return 0;
56598 + } else if (unlikely((mode & reqmode) != reqmode))
56599 + return 0;
56600 +
56601 + return reqmode;
56602 +}
56603 +
56604 +__u32
56605 +gr_acl_handle_creat(const struct dentry * dentry,
56606 + const struct dentry * p_dentry,
56607 + const struct vfsmount * p_mnt, int open_flags, int acc_mode,
56608 + const int imode)
56609 +{
56610 + __u32 reqmode = GR_WRITE | GR_CREATE;
56611 + __u32 mode;
56612 +
56613 + if (acc_mode & MAY_APPEND)
56614 + reqmode |= GR_APPEND;
56615 + // if a directory was required or the directory already exists, then
56616 + // don't count this open as a read
56617 + if ((acc_mode & MAY_READ) &&
56618 + !((open_flags & O_DIRECTORY) || (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode))))
56619 + reqmode |= GR_READ;
56620 + if ((open_flags & O_CREAT) && (imode & (S_ISUID | S_ISGID)))
56621 + reqmode |= GR_SETID;
56622 +
56623 + mode =
56624 + gr_check_create(dentry, p_dentry, p_mnt,
56625 + reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
56626 +
56627 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
56628 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
56629 + reqmode & GR_READ ? " reading" : "",
56630 + reqmode & GR_WRITE ? " writing" : reqmode &
56631 + GR_APPEND ? " appending" : "");
56632 + return reqmode;
56633 + } else
56634 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
56635 + {
56636 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
56637 + reqmode & GR_READ ? " reading" : "",
56638 + reqmode & GR_WRITE ? " writing" : reqmode &
56639 + GR_APPEND ? " appending" : "");
56640 + return 0;
56641 + } else if (unlikely((mode & reqmode) != reqmode))
56642 + return 0;
56643 +
56644 + return reqmode;
56645 +}
56646 +
56647 +__u32
56648 +gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
56649 + const int fmode)
56650 +{
56651 + __u32 mode, reqmode = GR_FIND;
56652 +
56653 + if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
56654 + reqmode |= GR_EXEC;
56655 + if (fmode & S_IWOTH)
56656 + reqmode |= GR_WRITE;
56657 + if (fmode & S_IROTH)
56658 + reqmode |= GR_READ;
56659 +
56660 + mode =
56661 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
56662 + mnt);
56663 +
56664 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
56665 + gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
56666 + reqmode & GR_READ ? " reading" : "",
56667 + reqmode & GR_WRITE ? " writing" : "",
56668 + reqmode & GR_EXEC ? " executing" : "");
56669 + return reqmode;
56670 + } else
56671 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
56672 + {
56673 + gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
56674 + reqmode & GR_READ ? " reading" : "",
56675 + reqmode & GR_WRITE ? " writing" : "",
56676 + reqmode & GR_EXEC ? " executing" : "");
56677 + return 0;
56678 + } else if (unlikely((mode & reqmode) != reqmode))
56679 + return 0;
56680 +
56681 + return reqmode;
56682 +}
56683 +
56684 +static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
56685 +{
56686 + __u32 mode;
56687 +
56688 + mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
56689 +
56690 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
56691 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
56692 + return mode;
56693 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
56694 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
56695 + return 0;
56696 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
56697 + return 0;
56698 +
56699 + return (reqmode);
56700 +}
56701 +
56702 +__u32
56703 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
56704 +{
56705 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
56706 +}
56707 +
56708 +__u32
56709 +gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
56710 +{
56711 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
56712 +}
56713 +
56714 +__u32
56715 +gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
56716 +{
56717 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
56718 +}
56719 +
56720 +__u32
56721 +gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
56722 +{
56723 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
56724 +}
56725 +
56726 +__u32
56727 +gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
56728 + mode_t mode)
56729 +{
56730 + if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
56731 + return 1;
56732 +
56733 + if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
56734 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
56735 + GR_FCHMOD_ACL_MSG);
56736 + } else {
56737 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
56738 + }
56739 +}
56740 +
56741 +__u32
56742 +gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
56743 + mode_t mode)
56744 +{
56745 + if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
56746 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
56747 + GR_CHMOD_ACL_MSG);
56748 + } else {
56749 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
56750 + }
56751 +}
56752 +
56753 +__u32
56754 +gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
56755 +{
56756 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
56757 +}
56758 +
56759 +__u32
56760 +gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
56761 +{
56762 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
56763 +}
56764 +
56765 +__u32
56766 +gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
56767 +{
56768 + return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
56769 +}
56770 +
56771 +__u32
56772 +gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
56773 +{
56774 + return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
56775 + GR_UNIXCONNECT_ACL_MSG);
56776 +}
56777 +
56778 +/* hardlinks require at minimum create and link permission,
56779 + any additional privilege required is based on the
56780 + privilege of the file being linked to
56781 +*/
56782 +__u32
56783 +gr_acl_handle_link(const struct dentry * new_dentry,
56784 + const struct dentry * parent_dentry,
56785 + const struct vfsmount * parent_mnt,
56786 + const struct dentry * old_dentry,
56787 + const struct vfsmount * old_mnt, const char *to)
56788 +{
56789 + __u32 mode;
56790 + __u32 needmode = GR_CREATE | GR_LINK;
56791 + __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
56792 +
56793 + mode =
56794 + gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
56795 + old_mnt);
56796 +
56797 + if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
56798 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
56799 + return mode;
56800 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
56801 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
56802 + return 0;
56803 + } else if (unlikely((mode & needmode) != needmode))
56804 + return 0;
56805 +
56806 + return 1;
56807 +}
56808 +
56809 +__u32
56810 +gr_acl_handle_symlink(const struct dentry * new_dentry,
56811 + const struct dentry * parent_dentry,
56812 + const struct vfsmount * parent_mnt, const char *from)
56813 +{
56814 + __u32 needmode = GR_WRITE | GR_CREATE;
56815 + __u32 mode;
56816 +
56817 + mode =
56818 + gr_check_create(new_dentry, parent_dentry, parent_mnt,
56819 + GR_CREATE | GR_AUDIT_CREATE |
56820 + GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
56821 +
56822 + if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
56823 + gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
56824 + return mode;
56825 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
56826 + gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
56827 + return 0;
56828 + } else if (unlikely((mode & needmode) != needmode))
56829 + return 0;
56830 +
56831 + return (GR_WRITE | GR_CREATE);
56832 +}
56833 +
56834 +static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
56835 +{
56836 + __u32 mode;
56837 +
56838 + mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
56839 +
56840 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
56841 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
56842 + return mode;
56843 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
56844 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
56845 + return 0;
56846 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
56847 + return 0;
56848 +
56849 + return (reqmode);
56850 +}
56851 +
56852 +__u32
56853 +gr_acl_handle_mknod(const struct dentry * new_dentry,
56854 + const struct dentry * parent_dentry,
56855 + const struct vfsmount * parent_mnt,
56856 + const int mode)
56857 +{
56858 + __u32 reqmode = GR_WRITE | GR_CREATE;
56859 + if (unlikely(mode & (S_ISUID | S_ISGID)))
56860 + reqmode |= GR_SETID;
56861 +
56862 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
56863 + reqmode, GR_MKNOD_ACL_MSG);
56864 +}
56865 +
56866 +__u32
56867 +gr_acl_handle_mkdir(const struct dentry *new_dentry,
56868 + const struct dentry *parent_dentry,
56869 + const struct vfsmount *parent_mnt)
56870 +{
56871 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
56872 + GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
56873 +}
56874 +
56875 +#define RENAME_CHECK_SUCCESS(old, new) \
56876 + (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
56877 + ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
56878 +
56879 +int
56880 +gr_acl_handle_rename(struct dentry *new_dentry,
56881 + struct dentry *parent_dentry,
56882 + const struct vfsmount *parent_mnt,
56883 + struct dentry *old_dentry,
56884 + struct inode *old_parent_inode,
56885 + struct vfsmount *old_mnt, const char *newname)
56886 +{
56887 + __u32 comp1, comp2;
56888 + int error = 0;
56889 +
56890 + if (unlikely(!gr_acl_is_enabled()))
56891 + return 0;
56892 +
56893 + if (!new_dentry->d_inode) {
56894 + comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
56895 + GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
56896 + GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
56897 + comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
56898 + GR_DELETE | GR_AUDIT_DELETE |
56899 + GR_AUDIT_READ | GR_AUDIT_WRITE |
56900 + GR_SUPPRESS, old_mnt);
56901 + } else {
56902 + comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
56903 + GR_CREATE | GR_DELETE |
56904 + GR_AUDIT_CREATE | GR_AUDIT_DELETE |
56905 + GR_AUDIT_READ | GR_AUDIT_WRITE |
56906 + GR_SUPPRESS, parent_mnt);
56907 + comp2 =
56908 + gr_search_file(old_dentry,
56909 + GR_READ | GR_WRITE | GR_AUDIT_READ |
56910 + GR_DELETE | GR_AUDIT_DELETE |
56911 + GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
56912 + }
56913 +
56914 + if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
56915 + ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
56916 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
56917 + else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
56918 + && !(comp2 & GR_SUPPRESS)) {
56919 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
56920 + error = -EACCES;
56921 + } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
56922 + error = -EACCES;
56923 +
56924 + return error;
56925 +}
56926 +
56927 +void
56928 +gr_acl_handle_exit(void)
56929 +{
56930 + u16 id;
56931 + char *rolename;
56932 + struct file *exec_file;
56933 +
56934 + if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
56935 + !(current->role->roletype & GR_ROLE_PERSIST))) {
56936 + id = current->acl_role_id;
56937 + rolename = current->role->rolename;
56938 + gr_set_acls(1);
56939 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
56940 + }
56941 +
56942 + write_lock(&grsec_exec_file_lock);
56943 + exec_file = current->exec_file;
56944 + current->exec_file = NULL;
56945 + write_unlock(&grsec_exec_file_lock);
56946 +
56947 + if (exec_file)
56948 + fput(exec_file);
56949 +}
56950 +
56951 +int
56952 +gr_acl_handle_procpidmem(const struct task_struct *task)
56953 +{
56954 + if (unlikely(!gr_acl_is_enabled()))
56955 + return 0;
56956 +
56957 + if (task != current && task->acl->mode & GR_PROTPROCFD)
56958 + return -EACCES;
56959 +
56960 + return 0;
56961 +}
56962 diff -urNp linux-2.6.32.49/grsecurity/gracl_ip.c linux-2.6.32.49/grsecurity/gracl_ip.c
56963 --- linux-2.6.32.49/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500
56964 +++ linux-2.6.32.49/grsecurity/gracl_ip.c 2011-11-15 19:59:43.000000000 -0500
56965 @@ -0,0 +1,382 @@
56966 +#include <linux/kernel.h>
56967 +#include <asm/uaccess.h>
56968 +#include <asm/errno.h>
56969 +#include <net/sock.h>
56970 +#include <linux/file.h>
56971 +#include <linux/fs.h>
56972 +#include <linux/net.h>
56973 +#include <linux/in.h>
56974 +#include <linux/skbuff.h>
56975 +#include <linux/ip.h>
56976 +#include <linux/udp.h>
56977 +#include <linux/smp_lock.h>
56978 +#include <linux/types.h>
56979 +#include <linux/sched.h>
56980 +#include <linux/netdevice.h>
56981 +#include <linux/inetdevice.h>
56982 +#include <linux/gracl.h>
56983 +#include <linux/grsecurity.h>
56984 +#include <linux/grinternal.h>
56985 +
56986 +#define GR_BIND 0x01
56987 +#define GR_CONNECT 0x02
56988 +#define GR_INVERT 0x04
56989 +#define GR_BINDOVERRIDE 0x08
56990 +#define GR_CONNECTOVERRIDE 0x10
56991 +#define GR_SOCK_FAMILY 0x20
56992 +
56993 +static const char * gr_protocols[IPPROTO_MAX] = {
56994 + "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
56995 + "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
56996 + "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
56997 + "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
56998 + "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
56999 + "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
57000 + "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
57001 + "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
57002 + "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
57003 + "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
57004 + "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
57005 + "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
57006 + "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
57007 + "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
57008 + "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
57009 + "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
57010 + "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
57011 + "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
57012 + "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
57013 + "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
57014 + "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
57015 + "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
57016 + "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
57017 + "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
57018 + "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
57019 + "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
57020 + "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
57021 + "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
57022 + "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
57023 + "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
57024 + "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
57025 + "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
57026 + };
57027 +
57028 +static const char * gr_socktypes[SOCK_MAX] = {
57029 + "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
57030 + "unknown:7", "unknown:8", "unknown:9", "packet"
57031 + };
57032 +
57033 +static const char * gr_sockfamilies[AF_MAX+1] = {
57034 + "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
57035 + "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
57036 + "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
57037 + "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154"
57038 + };
57039 +
57040 +const char *
57041 +gr_proto_to_name(unsigned char proto)
57042 +{
57043 + return gr_protocols[proto];
57044 +}
57045 +
57046 +const char *
57047 +gr_socktype_to_name(unsigned char type)
57048 +{
57049 + return gr_socktypes[type];
57050 +}
57051 +
57052 +const char *
57053 +gr_sockfamily_to_name(unsigned char family)
57054 +{
57055 + return gr_sockfamilies[family];
57056 +}
57057 +
57058 +int
57059 +gr_search_socket(const int domain, const int type, const int protocol)
57060 +{
57061 + struct acl_subject_label *curr;
57062 + const struct cred *cred = current_cred();
57063 +
57064 + if (unlikely(!gr_acl_is_enabled()))
57065 + goto exit;
57066 +
57067 + if ((domain < 0) || (type < 0) || (protocol < 0) ||
57068 + (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
57069 + goto exit; // let the kernel handle it
57070 +
57071 + curr = current->acl;
57072 +
57073 + if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
57074 + /* the family is allowed, if this is PF_INET allow it only if
57075 + the extra sock type/protocol checks pass */
57076 + if (domain == PF_INET)
57077 + goto inet_check;
57078 + goto exit;
57079 + } else {
57080 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
57081 + __u32 fakeip = 0;
57082 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
57083 + current->role->roletype, cred->uid,
57084 + cred->gid, current->exec_file ?
57085 + gr_to_filename(current->exec_file->f_path.dentry,
57086 + current->exec_file->f_path.mnt) :
57087 + curr->filename, curr->filename,
57088 + &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
57089 + &current->signal->saved_ip);
57090 + goto exit;
57091 + }
57092 + goto exit_fail;
57093 + }
57094 +
57095 +inet_check:
57096 + /* the rest of this checking is for IPv4 only */
57097 + if (!curr->ips)
57098 + goto exit;
57099 +
57100 + if ((curr->ip_type & (1 << type)) &&
57101 + (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
57102 + goto exit;
57103 +
57104 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
57105 + /* we don't place acls on raw sockets , and sometimes
57106 + dgram/ip sockets are opened for ioctl and not
57107 + bind/connect, so we'll fake a bind learn log */
57108 + if (type == SOCK_RAW || type == SOCK_PACKET) {
57109 + __u32 fakeip = 0;
57110 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
57111 + current->role->roletype, cred->uid,
57112 + cred->gid, current->exec_file ?
57113 + gr_to_filename(current->exec_file->f_path.dentry,
57114 + current->exec_file->f_path.mnt) :
57115 + curr->filename, curr->filename,
57116 + &fakeip, 0, type,
57117 + protocol, GR_CONNECT, &current->signal->saved_ip);
57118 + } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
57119 + __u32 fakeip = 0;
57120 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
57121 + current->role->roletype, cred->uid,
57122 + cred->gid, current->exec_file ?
57123 + gr_to_filename(current->exec_file->f_path.dentry,
57124 + current->exec_file->f_path.mnt) :
57125 + curr->filename, curr->filename,
57126 + &fakeip, 0, type,
57127 + protocol, GR_BIND, &current->signal->saved_ip);
57128 + }
57129 + /* we'll log when they use connect or bind */
57130 + goto exit;
57131 + }
57132 +
57133 +exit_fail:
57134 + if (domain == PF_INET)
57135 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
57136 + gr_socktype_to_name(type), gr_proto_to_name(protocol));
57137 + else
57138 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
57139 + gr_socktype_to_name(type), protocol);
57140 +
57141 + return 0;
57142 +exit:
57143 + return 1;
57144 +}
57145 +
57146 +int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
57147 +{
57148 + if ((ip->mode & mode) &&
57149 + (ip_port >= ip->low) &&
57150 + (ip_port <= ip->high) &&
57151 + ((ntohl(ip_addr) & our_netmask) ==
57152 + (ntohl(our_addr) & our_netmask))
57153 + && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
57154 + && (ip->type & (1 << type))) {
57155 + if (ip->mode & GR_INVERT)
57156 + return 2; // specifically denied
57157 + else
57158 + return 1; // allowed
57159 + }
57160 +
57161 + return 0; // not specifically allowed, may continue parsing
57162 +}
57163 +
57164 +static int
57165 +gr_search_connectbind(const int full_mode, struct sock *sk,
57166 + struct sockaddr_in *addr, const int type)
57167 +{
57168 + char iface[IFNAMSIZ] = {0};
57169 + struct acl_subject_label *curr;
57170 + struct acl_ip_label *ip;
57171 + struct inet_sock *isk;
57172 + struct net_device *dev;
57173 + struct in_device *idev;
57174 + unsigned long i;
57175 + int ret;
57176 + int mode = full_mode & (GR_BIND | GR_CONNECT);
57177 + __u32 ip_addr = 0;
57178 + __u32 our_addr;
57179 + __u32 our_netmask;
57180 + char *p;
57181 + __u16 ip_port = 0;
57182 + const struct cred *cred = current_cred();
57183 +
57184 + if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
57185 + return 0;
57186 +
57187 + curr = current->acl;
57188 + isk = inet_sk(sk);
57189 +
57190 + /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
57191 + if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
57192 + addr->sin_addr.s_addr = curr->inaddr_any_override;
57193 + if ((full_mode & GR_CONNECT) && isk->saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
57194 + struct sockaddr_in saddr;
57195 + int err;
57196 +
57197 + saddr.sin_family = AF_INET;
57198 + saddr.sin_addr.s_addr = curr->inaddr_any_override;
57199 + saddr.sin_port = isk->sport;
57200 +
57201 + err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
57202 + if (err)
57203 + return err;
57204 +
57205 + err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
57206 + if (err)
57207 + return err;
57208 + }
57209 +
57210 + if (!curr->ips)
57211 + return 0;
57212 +
57213 + ip_addr = addr->sin_addr.s_addr;
57214 + ip_port = ntohs(addr->sin_port);
57215 +
57216 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
57217 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
57218 + current->role->roletype, cred->uid,
57219 + cred->gid, current->exec_file ?
57220 + gr_to_filename(current->exec_file->f_path.dentry,
57221 + current->exec_file->f_path.mnt) :
57222 + curr->filename, curr->filename,
57223 + &ip_addr, ip_port, type,
57224 + sk->sk_protocol, mode, &current->signal->saved_ip);
57225 + return 0;
57226 + }
57227 +
57228 + for (i = 0; i < curr->ip_num; i++) {
57229 + ip = *(curr->ips + i);
57230 + if (ip->iface != NULL) {
57231 + strncpy(iface, ip->iface, IFNAMSIZ - 1);
57232 + p = strchr(iface, ':');
57233 + if (p != NULL)
57234 + *p = '\0';
57235 + dev = dev_get_by_name(sock_net(sk), iface);
57236 + if (dev == NULL)
57237 + continue;
57238 + idev = in_dev_get(dev);
57239 + if (idev == NULL) {
57240 + dev_put(dev);
57241 + continue;
57242 + }
57243 + rcu_read_lock();
57244 + for_ifa(idev) {
57245 + if (!strcmp(ip->iface, ifa->ifa_label)) {
57246 + our_addr = ifa->ifa_address;
57247 + our_netmask = 0xffffffff;
57248 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
57249 + if (ret == 1) {
57250 + rcu_read_unlock();
57251 + in_dev_put(idev);
57252 + dev_put(dev);
57253 + return 0;
57254 + } else if (ret == 2) {
57255 + rcu_read_unlock();
57256 + in_dev_put(idev);
57257 + dev_put(dev);
57258 + goto denied;
57259 + }
57260 + }
57261 + } endfor_ifa(idev);
57262 + rcu_read_unlock();
57263 + in_dev_put(idev);
57264 + dev_put(dev);
57265 + } else {
57266 + our_addr = ip->addr;
57267 + our_netmask = ip->netmask;
57268 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
57269 + if (ret == 1)
57270 + return 0;
57271 + else if (ret == 2)
57272 + goto denied;
57273 + }
57274 + }
57275 +
57276 +denied:
57277 + if (mode == GR_BIND)
57278 + gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
57279 + else if (mode == GR_CONNECT)
57280 + gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
57281 +
57282 + return -EACCES;
57283 +}
57284 +
57285 +int
57286 +gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
57287 +{
57288 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
57289 +}
57290 +
57291 +int
57292 +gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
57293 +{
57294 + return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
57295 +}
57296 +
57297 +int gr_search_listen(struct socket *sock)
57298 +{
57299 + struct sock *sk = sock->sk;
57300 + struct sockaddr_in addr;
57301 +
57302 + addr.sin_addr.s_addr = inet_sk(sk)->saddr;
57303 + addr.sin_port = inet_sk(sk)->sport;
57304 +
57305 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
57306 +}
57307 +
57308 +int gr_search_accept(struct socket *sock)
57309 +{
57310 + struct sock *sk = sock->sk;
57311 + struct sockaddr_in addr;
57312 +
57313 + addr.sin_addr.s_addr = inet_sk(sk)->saddr;
57314 + addr.sin_port = inet_sk(sk)->sport;
57315 +
57316 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
57317 +}
57318 +
57319 +int
57320 +gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
57321 +{
57322 + if (addr)
57323 + return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
57324 + else {
57325 + struct sockaddr_in sin;
57326 + const struct inet_sock *inet = inet_sk(sk);
57327 +
57328 + sin.sin_addr.s_addr = inet->daddr;
57329 + sin.sin_port = inet->dport;
57330 +
57331 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
57332 + }
57333 +}
57334 +
57335 +int
57336 +gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
57337 +{
57338 + struct sockaddr_in sin;
57339 +
57340 + if (unlikely(skb->len < sizeof (struct udphdr)))
57341 + return 0; // skip this packet
57342 +
57343 + sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
57344 + sin.sin_port = udp_hdr(skb)->source;
57345 +
57346 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
57347 +}
57348 diff -urNp linux-2.6.32.49/grsecurity/gracl_learn.c linux-2.6.32.49/grsecurity/gracl_learn.c
57349 --- linux-2.6.32.49/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500
57350 +++ linux-2.6.32.49/grsecurity/gracl_learn.c 2011-11-15 19:59:43.000000000 -0500
57351 @@ -0,0 +1,208 @@
57352 +#include <linux/kernel.h>
57353 +#include <linux/mm.h>
57354 +#include <linux/sched.h>
57355 +#include <linux/poll.h>
57356 +#include <linux/smp_lock.h>
57357 +#include <linux/string.h>
57358 +#include <linux/file.h>
57359 +#include <linux/types.h>
57360 +#include <linux/vmalloc.h>
57361 +#include <linux/grinternal.h>
57362 +
57363 +extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
57364 + size_t count, loff_t *ppos);
57365 +extern int gr_acl_is_enabled(void);
57366 +
57367 +static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
57368 +static int gr_learn_attached;
57369 +
57370 +/* use a 512k buffer */
57371 +#define LEARN_BUFFER_SIZE (512 * 1024)
57372 +
57373 +static DEFINE_SPINLOCK(gr_learn_lock);
57374 +static DEFINE_MUTEX(gr_learn_user_mutex);
57375 +
57376 +/* we need to maintain two buffers, so that the kernel context of grlearn
57377 + uses a semaphore around the userspace copying, and the other kernel contexts
57378 + use a spinlock when copying into the buffer, since they cannot sleep
57379 +*/
57380 +static char *learn_buffer;
57381 +static char *learn_buffer_user;
57382 +static int learn_buffer_len;
57383 +static int learn_buffer_user_len;
57384 +
57385 +static ssize_t
57386 +read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
57387 +{
57388 + DECLARE_WAITQUEUE(wait, current);
57389 + ssize_t retval = 0;
57390 +
57391 + add_wait_queue(&learn_wait, &wait);
57392 + set_current_state(TASK_INTERRUPTIBLE);
57393 + do {
57394 + mutex_lock(&gr_learn_user_mutex);
57395 + spin_lock(&gr_learn_lock);
57396 + if (learn_buffer_len)
57397 + break;
57398 + spin_unlock(&gr_learn_lock);
57399 + mutex_unlock(&gr_learn_user_mutex);
57400 + if (file->f_flags & O_NONBLOCK) {
57401 + retval = -EAGAIN;
57402 + goto out;
57403 + }
57404 + if (signal_pending(current)) {
57405 + retval = -ERESTARTSYS;
57406 + goto out;
57407 + }
57408 +
57409 + schedule();
57410 + } while (1);
57411 +
57412 + memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
57413 + learn_buffer_user_len = learn_buffer_len;
57414 + retval = learn_buffer_len;
57415 + learn_buffer_len = 0;
57416 +
57417 + spin_unlock(&gr_learn_lock);
57418 +
57419 + if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
57420 + retval = -EFAULT;
57421 +
57422 + mutex_unlock(&gr_learn_user_mutex);
57423 +out:
57424 + set_current_state(TASK_RUNNING);
57425 + remove_wait_queue(&learn_wait, &wait);
57426 + return retval;
57427 +}
57428 +
57429 +static unsigned int
57430 +poll_learn(struct file * file, poll_table * wait)
57431 +{
57432 + poll_wait(file, &learn_wait, wait);
57433 +
57434 + if (learn_buffer_len)
57435 + return (POLLIN | POLLRDNORM);
57436 +
57437 + return 0;
57438 +}
57439 +
57440 +void
57441 +gr_clear_learn_entries(void)
57442 +{
57443 + char *tmp;
57444 +
57445 + mutex_lock(&gr_learn_user_mutex);
57446 + spin_lock(&gr_learn_lock);
57447 + tmp = learn_buffer;
57448 + learn_buffer = NULL;
57449 + spin_unlock(&gr_learn_lock);
57450 + if (tmp)
57451 + vfree(tmp);
57452 + if (learn_buffer_user != NULL) {
57453 + vfree(learn_buffer_user);
57454 + learn_buffer_user = NULL;
57455 + }
57456 + learn_buffer_len = 0;
57457 + mutex_unlock(&gr_learn_user_mutex);
57458 +
57459 + return;
57460 +}
57461 +
57462 +void
57463 +gr_add_learn_entry(const char *fmt, ...)
57464 +{
57465 + va_list args;
57466 + unsigned int len;
57467 +
57468 + if (!gr_learn_attached)
57469 + return;
57470 +
57471 + spin_lock(&gr_learn_lock);
57472 +
57473 + /* leave a gap at the end so we know when it's "full" but don't have to
57474 + compute the exact length of the string we're trying to append
57475 + */
57476 + if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
57477 + spin_unlock(&gr_learn_lock);
57478 + wake_up_interruptible(&learn_wait);
57479 + return;
57480 + }
57481 + if (learn_buffer == NULL) {
57482 + spin_unlock(&gr_learn_lock);
57483 + return;
57484 + }
57485 +
57486 + va_start(args, fmt);
57487 + len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
57488 + va_end(args);
57489 +
57490 + learn_buffer_len += len + 1;
57491 +
57492 + spin_unlock(&gr_learn_lock);
57493 + wake_up_interruptible(&learn_wait);
57494 +
57495 + return;
57496 +}
57497 +
57498 +static int
57499 +open_learn(struct inode *inode, struct file *file)
57500 +{
57501 + if (file->f_mode & FMODE_READ && gr_learn_attached)
57502 + return -EBUSY;
57503 + if (file->f_mode & FMODE_READ) {
57504 + int retval = 0;
57505 + mutex_lock(&gr_learn_user_mutex);
57506 + if (learn_buffer == NULL)
57507 + learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
57508 + if (learn_buffer_user == NULL)
57509 + learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
57510 + if (learn_buffer == NULL) {
57511 + retval = -ENOMEM;
57512 + goto out_error;
57513 + }
57514 + if (learn_buffer_user == NULL) {
57515 + retval = -ENOMEM;
57516 + goto out_error;
57517 + }
57518 + learn_buffer_len = 0;
57519 + learn_buffer_user_len = 0;
57520 + gr_learn_attached = 1;
57521 +out_error:
57522 + mutex_unlock(&gr_learn_user_mutex);
57523 + return retval;
57524 + }
57525 + return 0;
57526 +}
57527 +
57528 +static int
57529 +close_learn(struct inode *inode, struct file *file)
57530 +{
57531 + if (file->f_mode & FMODE_READ) {
57532 + char *tmp = NULL;
57533 + mutex_lock(&gr_learn_user_mutex);
57534 + spin_lock(&gr_learn_lock);
57535 + tmp = learn_buffer;
57536 + learn_buffer = NULL;
57537 + spin_unlock(&gr_learn_lock);
57538 + if (tmp)
57539 + vfree(tmp);
57540 + if (learn_buffer_user != NULL) {
57541 + vfree(learn_buffer_user);
57542 + learn_buffer_user = NULL;
57543 + }
57544 + learn_buffer_len = 0;
57545 + learn_buffer_user_len = 0;
57546 + gr_learn_attached = 0;
57547 + mutex_unlock(&gr_learn_user_mutex);
57548 + }
57549 +
57550 + return 0;
57551 +}
57552 +
57553 +const struct file_operations grsec_fops = {
57554 + .read = read_learn,
57555 + .write = write_grsec_handler,
57556 + .open = open_learn,
57557 + .release = close_learn,
57558 + .poll = poll_learn,
57559 +};
57560 diff -urNp linux-2.6.32.49/grsecurity/gracl_res.c linux-2.6.32.49/grsecurity/gracl_res.c
57561 --- linux-2.6.32.49/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
57562 +++ linux-2.6.32.49/grsecurity/gracl_res.c 2011-11-15 19:59:43.000000000 -0500
57563 @@ -0,0 +1,67 @@
57564 +#include <linux/kernel.h>
57565 +#include <linux/sched.h>
57566 +#include <linux/gracl.h>
57567 +#include <linux/grinternal.h>
57568 +
57569 +static const char *restab_log[] = {
57570 + [RLIMIT_CPU] = "RLIMIT_CPU",
57571 + [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
57572 + [RLIMIT_DATA] = "RLIMIT_DATA",
57573 + [RLIMIT_STACK] = "RLIMIT_STACK",
57574 + [RLIMIT_CORE] = "RLIMIT_CORE",
57575 + [RLIMIT_RSS] = "RLIMIT_RSS",
57576 + [RLIMIT_NPROC] = "RLIMIT_NPROC",
57577 + [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
57578 + [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
57579 + [RLIMIT_AS] = "RLIMIT_AS",
57580 + [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
57581 + [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
57582 + [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
57583 + [RLIMIT_NICE] = "RLIMIT_NICE",
57584 + [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
57585 + [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
57586 + [GR_CRASH_RES] = "RLIMIT_CRASH"
57587 +};
57588 +
57589 +void
57590 +gr_log_resource(const struct task_struct *task,
57591 + const int res, const unsigned long wanted, const int gt)
57592 +{
57593 + const struct cred *cred;
57594 + unsigned long rlim;
57595 +
57596 + if (!gr_acl_is_enabled() && !grsec_resource_logging)
57597 + return;
57598 +
57599 + // not yet supported resource
57600 + if (unlikely(!restab_log[res]))
57601 + return;
57602 +
57603 + if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
57604 + rlim = task->signal->rlim[res].rlim_max;
57605 + else
57606 + rlim = task->signal->rlim[res].rlim_cur;
57607 + if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
57608 + return;
57609 +
57610 + rcu_read_lock();
57611 + cred = __task_cred(task);
57612 +
57613 + if (res == RLIMIT_NPROC &&
57614 + (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
57615 + cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
57616 + goto out_rcu_unlock;
57617 + else if (res == RLIMIT_MEMLOCK &&
57618 + cap_raised(cred->cap_effective, CAP_IPC_LOCK))
57619 + goto out_rcu_unlock;
57620 + else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
57621 + goto out_rcu_unlock;
57622 + rcu_read_unlock();
57623 +
57624 + gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
57625 +
57626 + return;
57627 +out_rcu_unlock:
57628 + rcu_read_unlock();
57629 + return;
57630 +}
57631 diff -urNp linux-2.6.32.49/grsecurity/gracl_segv.c linux-2.6.32.49/grsecurity/gracl_segv.c
57632 --- linux-2.6.32.49/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500
57633 +++ linux-2.6.32.49/grsecurity/gracl_segv.c 2011-11-17 20:48:17.000000000 -0500
57634 @@ -0,0 +1,284 @@
57635 +#include <linux/kernel.h>
57636 +#include <linux/mm.h>
57637 +#include <asm/uaccess.h>
57638 +#include <asm/errno.h>
57639 +#include <asm/mman.h>
57640 +#include <net/sock.h>
57641 +#include <linux/file.h>
57642 +#include <linux/fs.h>
57643 +#include <linux/net.h>
57644 +#include <linux/in.h>
57645 +#include <linux/smp_lock.h>
57646 +#include <linux/slab.h>
57647 +#include <linux/types.h>
57648 +#include <linux/sched.h>
57649 +#include <linux/timer.h>
57650 +#include <linux/gracl.h>
57651 +#include <linux/grsecurity.h>
57652 +#include <linux/grinternal.h>
57653 +
57654 +static struct crash_uid *uid_set;
57655 +static unsigned short uid_used;
57656 +static DEFINE_SPINLOCK(gr_uid_lock);
57657 +extern rwlock_t gr_inode_lock;
57658 +extern struct acl_subject_label *
57659 + lookup_acl_subj_label(const ino_t inode, const dev_t dev,
57660 + struct acl_role_label *role);
57661 +extern int gr_fake_force_sig(int sig, struct task_struct *t);
57662 +
57663 +int
57664 +gr_init_uidset(void)
57665 +{
57666 + uid_set =
57667 + kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
57668 + uid_used = 0;
57669 +
57670 + return uid_set ? 1 : 0;
57671 +}
57672 +
57673 +void
57674 +gr_free_uidset(void)
57675 +{
57676 + if (uid_set)
57677 + kfree(uid_set);
57678 +
57679 + return;
57680 +}
57681 +
57682 +int
57683 +gr_find_uid(const uid_t uid)
57684 +{
57685 + struct crash_uid *tmp = uid_set;
57686 + uid_t buid;
57687 + int low = 0, high = uid_used - 1, mid;
57688 +
57689 + while (high >= low) {
57690 + mid = (low + high) >> 1;
57691 + buid = tmp[mid].uid;
57692 + if (buid == uid)
57693 + return mid;
57694 + if (buid > uid)
57695 + high = mid - 1;
57696 + if (buid < uid)
57697 + low = mid + 1;
57698 + }
57699 +
57700 + return -1;
57701 +}
57702 +
57703 +static __inline__ void
57704 +gr_insertsort(void)
57705 +{
57706 + unsigned short i, j;
57707 + struct crash_uid index;
57708 +
57709 + for (i = 1; i < uid_used; i++) {
57710 + index = uid_set[i];
57711 + j = i;
57712 + while ((j > 0) && uid_set[j - 1].uid > index.uid) {
57713 + uid_set[j] = uid_set[j - 1];
57714 + j--;
57715 + }
57716 + uid_set[j] = index;
57717 + }
57718 +
57719 + return;
57720 +}
57721 +
57722 +static __inline__ void
57723 +gr_insert_uid(const uid_t uid, const unsigned long expires)
57724 +{
57725 + int loc;
57726 +
57727 + if (uid_used == GR_UIDTABLE_MAX)
57728 + return;
57729 +
57730 + loc = gr_find_uid(uid);
57731 +
57732 + if (loc >= 0) {
57733 + uid_set[loc].expires = expires;
57734 + return;
57735 + }
57736 +
57737 + uid_set[uid_used].uid = uid;
57738 + uid_set[uid_used].expires = expires;
57739 + uid_used++;
57740 +
57741 + gr_insertsort();
57742 +
57743 + return;
57744 +}
57745 +
57746 +void
57747 +gr_remove_uid(const unsigned short loc)
57748 +{
57749 + unsigned short i;
57750 +
57751 + for (i = loc + 1; i < uid_used; i++)
57752 + uid_set[i - 1] = uid_set[i];
57753 +
57754 + uid_used--;
57755 +
57756 + return;
57757 +}
57758 +
57759 +int
57760 +gr_check_crash_uid(const uid_t uid)
57761 +{
57762 + int loc;
57763 + int ret = 0;
57764 +
57765 + if (unlikely(!gr_acl_is_enabled()))
57766 + return 0;
57767 +
57768 + spin_lock(&gr_uid_lock);
57769 + loc = gr_find_uid(uid);
57770 +
57771 + if (loc < 0)
57772 + goto out_unlock;
57773 +
57774 + if (time_before_eq(uid_set[loc].expires, get_seconds()))
57775 + gr_remove_uid(loc);
57776 + else
57777 + ret = 1;
57778 +
57779 +out_unlock:
57780 + spin_unlock(&gr_uid_lock);
57781 + return ret;
57782 +}
57783 +
57784 +static __inline__ int
57785 +proc_is_setxid(const struct cred *cred)
57786 +{
57787 + if (cred->uid != cred->euid || cred->uid != cred->suid ||
57788 + cred->uid != cred->fsuid)
57789 + return 1;
57790 + if (cred->gid != cred->egid || cred->gid != cred->sgid ||
57791 + cred->gid != cred->fsgid)
57792 + return 1;
57793 +
57794 + return 0;
57795 +}
57796 +
57797 +void
57798 +gr_handle_crash(struct task_struct *task, const int sig)
57799 +{
57800 + struct acl_subject_label *curr;
57801 + struct task_struct *tsk, *tsk2;
57802 + const struct cred *cred;
57803 + const struct cred *cred2;
57804 +
57805 + if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
57806 + return;
57807 +
57808 + if (unlikely(!gr_acl_is_enabled()))
57809 + return;
57810 +
57811 + curr = task->acl;
57812 +
57813 + if (!(curr->resmask & (1 << GR_CRASH_RES)))
57814 + return;
57815 +
57816 + if (time_before_eq(curr->expires, get_seconds())) {
57817 + curr->expires = 0;
57818 + curr->crashes = 0;
57819 + }
57820 +
57821 + curr->crashes++;
57822 +
57823 + if (!curr->expires)
57824 + curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
57825 +
57826 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
57827 + time_after(curr->expires, get_seconds())) {
57828 + rcu_read_lock();
57829 + cred = __task_cred(task);
57830 + if (cred->uid && proc_is_setxid(cred)) {
57831 + gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
57832 + spin_lock(&gr_uid_lock);
57833 + gr_insert_uid(cred->uid, curr->expires);
57834 + spin_unlock(&gr_uid_lock);
57835 + curr->expires = 0;
57836 + curr->crashes = 0;
57837 + read_lock(&tasklist_lock);
57838 + do_each_thread(tsk2, tsk) {
57839 + cred2 = __task_cred(tsk);
57840 + if (tsk != task && cred2->uid == cred->uid)
57841 + gr_fake_force_sig(SIGKILL, tsk);
57842 + } while_each_thread(tsk2, tsk);
57843 + read_unlock(&tasklist_lock);
57844 + } else {
57845 + gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
57846 + read_lock(&tasklist_lock);
57847 + read_lock(&grsec_exec_file_lock);
57848 + do_each_thread(tsk2, tsk) {
57849 + if (likely(tsk != task)) {
57850 + // if this thread has the same subject as the one that triggered
57851 + // RES_CRASH and it's the same binary, kill it
57852 + if (tsk->acl == task->acl && tsk->exec_file == task->exec_file)
57853 + gr_fake_force_sig(SIGKILL, tsk);
57854 + }
57855 + } while_each_thread(tsk2, tsk);
57856 + read_unlock(&grsec_exec_file_lock);
57857 + read_unlock(&tasklist_lock);
57858 + }
57859 + rcu_read_unlock();
57860 + }
57861 +
57862 + return;
57863 +}
57864 +
57865 +int
57866 +gr_check_crash_exec(const struct file *filp)
57867 +{
57868 + struct acl_subject_label *curr;
57869 +
57870 + if (unlikely(!gr_acl_is_enabled()))
57871 + return 0;
57872 +
57873 + read_lock(&gr_inode_lock);
57874 + curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
57875 + filp->f_path.dentry->d_inode->i_sb->s_dev,
57876 + current->role);
57877 + read_unlock(&gr_inode_lock);
57878 +
57879 + if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
57880 + (!curr->crashes && !curr->expires))
57881 + return 0;
57882 +
57883 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
57884 + time_after(curr->expires, get_seconds()))
57885 + return 1;
57886 + else if (time_before_eq(curr->expires, get_seconds())) {
57887 + curr->crashes = 0;
57888 + curr->expires = 0;
57889 + }
57890 +
57891 + return 0;
57892 +}
57893 +
57894 +void
57895 +gr_handle_alertkill(struct task_struct *task)
57896 +{
57897 + struct acl_subject_label *curracl;
57898 + __u32 curr_ip;
57899 + struct task_struct *p, *p2;
57900 +
57901 + if (unlikely(!gr_acl_is_enabled()))
57902 + return;
57903 +
57904 + curracl = task->acl;
57905 + curr_ip = task->signal->curr_ip;
57906 +
57907 + if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
57908 + read_lock(&tasklist_lock);
57909 + do_each_thread(p2, p) {
57910 + if (p->signal->curr_ip == curr_ip)
57911 + gr_fake_force_sig(SIGKILL, p);
57912 + } while_each_thread(p2, p);
57913 + read_unlock(&tasklist_lock);
57914 + } else if (curracl->mode & GR_KILLPROC)
57915 + gr_fake_force_sig(SIGKILL, task);
57916 +
57917 + return;
57918 +}
57919 diff -urNp linux-2.6.32.49/grsecurity/gracl_shm.c linux-2.6.32.49/grsecurity/gracl_shm.c
57920 --- linux-2.6.32.49/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
57921 +++ linux-2.6.32.49/grsecurity/gracl_shm.c 2011-11-15 19:59:43.000000000 -0500
57922 @@ -0,0 +1,40 @@
57923 +#include <linux/kernel.h>
57924 +#include <linux/mm.h>
57925 +#include <linux/sched.h>
57926 +#include <linux/file.h>
57927 +#include <linux/ipc.h>
57928 +#include <linux/gracl.h>
57929 +#include <linux/grsecurity.h>
57930 +#include <linux/grinternal.h>
57931 +
57932 +int
57933 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57934 + const time_t shm_createtime, const uid_t cuid, const int shmid)
57935 +{
57936 + struct task_struct *task;
57937 +
57938 + if (!gr_acl_is_enabled())
57939 + return 1;
57940 +
57941 + rcu_read_lock();
57942 + read_lock(&tasklist_lock);
57943 +
57944 + task = find_task_by_vpid(shm_cprid);
57945 +
57946 + if (unlikely(!task))
57947 + task = find_task_by_vpid(shm_lapid);
57948 +
57949 + if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
57950 + (task->pid == shm_lapid)) &&
57951 + (task->acl->mode & GR_PROTSHM) &&
57952 + (task->acl != current->acl))) {
57953 + read_unlock(&tasklist_lock);
57954 + rcu_read_unlock();
57955 + gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
57956 + return 0;
57957 + }
57958 + read_unlock(&tasklist_lock);
57959 + rcu_read_unlock();
57960 +
57961 + return 1;
57962 +}
57963 diff -urNp linux-2.6.32.49/grsecurity/grsec_chdir.c linux-2.6.32.49/grsecurity/grsec_chdir.c
57964 --- linux-2.6.32.49/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500
57965 +++ linux-2.6.32.49/grsecurity/grsec_chdir.c 2011-11-15 19:59:43.000000000 -0500
57966 @@ -0,0 +1,19 @@
57967 +#include <linux/kernel.h>
57968 +#include <linux/sched.h>
57969 +#include <linux/fs.h>
57970 +#include <linux/file.h>
57971 +#include <linux/grsecurity.h>
57972 +#include <linux/grinternal.h>
57973 +
57974 +void
57975 +gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
57976 +{
57977 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
57978 + if ((grsec_enable_chdir && grsec_enable_group &&
57979 + in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
57980 + !grsec_enable_group)) {
57981 + gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
57982 + }
57983 +#endif
57984 + return;
57985 +}
57986 diff -urNp linux-2.6.32.49/grsecurity/grsec_chroot.c linux-2.6.32.49/grsecurity/grsec_chroot.c
57987 --- linux-2.6.32.49/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500
57988 +++ linux-2.6.32.49/grsecurity/grsec_chroot.c 2011-11-15 19:59:43.000000000 -0500
57989 @@ -0,0 +1,386 @@
57990 +#include <linux/kernel.h>
57991 +#include <linux/module.h>
57992 +#include <linux/sched.h>
57993 +#include <linux/file.h>
57994 +#include <linux/fs.h>
57995 +#include <linux/mount.h>
57996 +#include <linux/types.h>
57997 +#include <linux/pid_namespace.h>
57998 +#include <linux/grsecurity.h>
57999 +#include <linux/grinternal.h>
58000 +
58001 +void gr_set_chroot_entries(struct task_struct *task, struct path *path)
58002 +{
58003 +#ifdef CONFIG_GRKERNSEC
58004 + if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
58005 + path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
58006 + task->gr_is_chrooted = 1;
58007 + else
58008 + task->gr_is_chrooted = 0;
58009 +
58010 + task->gr_chroot_dentry = path->dentry;
58011 +#endif
58012 + return;
58013 +}
58014 +
58015 +void gr_clear_chroot_entries(struct task_struct *task)
58016 +{
58017 +#ifdef CONFIG_GRKERNSEC
58018 + task->gr_is_chrooted = 0;
58019 + task->gr_chroot_dentry = NULL;
58020 +#endif
58021 + return;
58022 +}
58023 +
58024 +int
58025 +gr_handle_chroot_unix(const pid_t pid)
58026 +{
58027 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
58028 + struct task_struct *p;
58029 +
58030 + if (unlikely(!grsec_enable_chroot_unix))
58031 + return 1;
58032 +
58033 + if (likely(!proc_is_chrooted(current)))
58034 + return 1;
58035 +
58036 + rcu_read_lock();
58037 + read_lock(&tasklist_lock);
58038 +
58039 + p = find_task_by_vpid_unrestricted(pid);
58040 + if (unlikely(p && !have_same_root(current, p))) {
58041 + read_unlock(&tasklist_lock);
58042 + rcu_read_unlock();
58043 + gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
58044 + return 0;
58045 + }
58046 + read_unlock(&tasklist_lock);
58047 + rcu_read_unlock();
58048 +#endif
58049 + return 1;
58050 +}
58051 +
58052 +int
58053 +gr_handle_chroot_nice(void)
58054 +{
58055 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
58056 + if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
58057 + gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
58058 + return -EPERM;
58059 + }
58060 +#endif
58061 + return 0;
58062 +}
58063 +
58064 +int
58065 +gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
58066 +{
58067 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
58068 + if (grsec_enable_chroot_nice && (niceval < task_nice(p))
58069 + && proc_is_chrooted(current)) {
58070 + gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
58071 + return -EACCES;
58072 + }
58073 +#endif
58074 + return 0;
58075 +}
58076 +
58077 +int
58078 +gr_handle_chroot_rawio(const struct inode *inode)
58079 +{
58080 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
58081 + if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
58082 + inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
58083 + return 1;
58084 +#endif
58085 + return 0;
58086 +}
58087 +
58088 +int
58089 +gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
58090 +{
58091 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
58092 + struct task_struct *p;
58093 + int ret = 0;
58094 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
58095 + return ret;
58096 +
58097 + read_lock(&tasklist_lock);
58098 + do_each_pid_task(pid, type, p) {
58099 + if (!have_same_root(current, p)) {
58100 + ret = 1;
58101 + goto out;
58102 + }
58103 + } while_each_pid_task(pid, type, p);
58104 +out:
58105 + read_unlock(&tasklist_lock);
58106 + return ret;
58107 +#endif
58108 + return 0;
58109 +}
58110 +
58111 +int
58112 +gr_pid_is_chrooted(struct task_struct *p)
58113 +{
58114 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
58115 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
58116 + return 0;
58117 +
58118 + if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
58119 + !have_same_root(current, p)) {
58120 + return 1;
58121 + }
58122 +#endif
58123 + return 0;
58124 +}
58125 +
58126 +EXPORT_SYMBOL(gr_pid_is_chrooted);
58127 +
58128 +#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
58129 +int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
58130 +{
58131 + struct dentry *dentry = (struct dentry *)u_dentry;
58132 + struct vfsmount *mnt = (struct vfsmount *)u_mnt;
58133 + struct dentry *realroot;
58134 + struct vfsmount *realrootmnt;
58135 + struct dentry *currentroot;
58136 + struct vfsmount *currentmnt;
58137 + struct task_struct *reaper = &init_task;
58138 + int ret = 1;
58139 +
58140 + read_lock(&reaper->fs->lock);
58141 + realrootmnt = mntget(reaper->fs->root.mnt);
58142 + realroot = dget(reaper->fs->root.dentry);
58143 + read_unlock(&reaper->fs->lock);
58144 +
58145 + read_lock(&current->fs->lock);
58146 + currentmnt = mntget(current->fs->root.mnt);
58147 + currentroot = dget(current->fs->root.dentry);
58148 + read_unlock(&current->fs->lock);
58149 +
58150 + spin_lock(&dcache_lock);
58151 + for (;;) {
58152 + if (unlikely((dentry == realroot && mnt == realrootmnt)
58153 + || (dentry == currentroot && mnt == currentmnt)))
58154 + break;
58155 + if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
58156 + if (mnt->mnt_parent == mnt)
58157 + break;
58158 + dentry = mnt->mnt_mountpoint;
58159 + mnt = mnt->mnt_parent;
58160 + continue;
58161 + }
58162 + dentry = dentry->d_parent;
58163 + }
58164 + spin_unlock(&dcache_lock);
58165 +
58166 + dput(currentroot);
58167 + mntput(currentmnt);
58168 +
58169 + /* access is outside of chroot */
58170 + if (dentry == realroot && mnt == realrootmnt)
58171 + ret = 0;
58172 +
58173 + dput(realroot);
58174 + mntput(realrootmnt);
58175 + return ret;
58176 +}
58177 +#endif
58178 +
58179 +int
58180 +gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
58181 +{
58182 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
58183 + if (!grsec_enable_chroot_fchdir)
58184 + return 1;
58185 +
58186 + if (!proc_is_chrooted(current))
58187 + return 1;
58188 + else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
58189 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
58190 + return 0;
58191 + }
58192 +#endif
58193 + return 1;
58194 +}
58195 +
58196 +int
58197 +gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
58198 + const time_t shm_createtime)
58199 +{
58200 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
58201 + struct task_struct *p;
58202 + time_t starttime;
58203 +
58204 + if (unlikely(!grsec_enable_chroot_shmat))
58205 + return 1;
58206 +
58207 + if (likely(!proc_is_chrooted(current)))
58208 + return 1;
58209 +
58210 + rcu_read_lock();
58211 + read_lock(&tasklist_lock);
58212 +
58213 + if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
58214 + starttime = p->start_time.tv_sec;
58215 + if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
58216 + if (have_same_root(current, p)) {
58217 + goto allow;
58218 + } else {
58219 + read_unlock(&tasklist_lock);
58220 + rcu_read_unlock();
58221 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
58222 + return 0;
58223 + }
58224 + }
58225 + /* creator exited, pid reuse, fall through to next check */
58226 + }
58227 + if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
58228 + if (unlikely(!have_same_root(current, p))) {
58229 + read_unlock(&tasklist_lock);
58230 + rcu_read_unlock();
58231 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
58232 + return 0;
58233 + }
58234 + }
58235 +
58236 +allow:
58237 + read_unlock(&tasklist_lock);
58238 + rcu_read_unlock();
58239 +#endif
58240 + return 1;
58241 +}
58242 +
58243 +void
58244 +gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
58245 +{
58246 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
58247 + if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
58248 + gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
58249 +#endif
58250 + return;
58251 +}
58252 +
58253 +int
58254 +gr_handle_chroot_mknod(const struct dentry *dentry,
58255 + const struct vfsmount *mnt, const int mode)
58256 +{
58257 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
58258 + if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
58259 + proc_is_chrooted(current)) {
58260 + gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
58261 + return -EPERM;
58262 + }
58263 +#endif
58264 + return 0;
58265 +}
58266 +
58267 +int
58268 +gr_handle_chroot_mount(const struct dentry *dentry,
58269 + const struct vfsmount *mnt, const char *dev_name)
58270 +{
58271 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
58272 + if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
58273 + gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none" , dentry, mnt);
58274 + return -EPERM;
58275 + }
58276 +#endif
58277 + return 0;
58278 +}
58279 +
58280 +int
58281 +gr_handle_chroot_pivot(void)
58282 +{
58283 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
58284 + if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
58285 + gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
58286 + return -EPERM;
58287 + }
58288 +#endif
58289 + return 0;
58290 +}
58291 +
58292 +int
58293 +gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
58294 +{
58295 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
58296 + if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
58297 + !gr_is_outside_chroot(dentry, mnt)) {
58298 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
58299 + return -EPERM;
58300 + }
58301 +#endif
58302 + return 0;
58303 +}
58304 +
58305 +extern const char *captab_log[];
58306 +extern int captab_log_entries;
58307 +
58308 +int
58309 +gr_chroot_is_capable(const int cap)
58310 +{
58311 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
58312 + if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
58313 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
58314 + if (cap_raised(chroot_caps, cap)) {
58315 + const struct cred *creds = current_cred();
58316 + if (cap_raised(creds->cap_effective, cap) && cap < captab_log_entries) {
58317 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, current, captab_log[cap]);
58318 + }
58319 + return 0;
58320 + }
58321 + }
58322 +#endif
58323 + return 1;
58324 +}
58325 +
58326 +int
58327 +gr_chroot_is_capable_nolog(const int cap)
58328 +{
58329 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
58330 + if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
58331 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
58332 + if (cap_raised(chroot_caps, cap)) {
58333 + return 0;
58334 + }
58335 + }
58336 +#endif
58337 + return 1;
58338 +}
58339 +
58340 +int
58341 +gr_handle_chroot_sysctl(const int op)
58342 +{
58343 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
58344 + if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
58345 + && (op & MAY_WRITE))
58346 + return -EACCES;
58347 +#endif
58348 + return 0;
58349 +}
58350 +
58351 +void
58352 +gr_handle_chroot_chdir(struct path *path)
58353 +{
58354 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
58355 + if (grsec_enable_chroot_chdir)
58356 + set_fs_pwd(current->fs, path);
58357 +#endif
58358 + return;
58359 +}
58360 +
58361 +int
58362 +gr_handle_chroot_chmod(const struct dentry *dentry,
58363 + const struct vfsmount *mnt, const int mode)
58364 +{
58365 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
58366 + /* allow chmod +s on directories, but not on files */
58367 + if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
58368 + ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
58369 + proc_is_chrooted(current)) {
58370 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
58371 + return -EPERM;
58372 + }
58373 +#endif
58374 + return 0;
58375 +}
58376 diff -urNp linux-2.6.32.49/grsecurity/grsec_disabled.c linux-2.6.32.49/grsecurity/grsec_disabled.c
58377 --- linux-2.6.32.49/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500
58378 +++ linux-2.6.32.49/grsecurity/grsec_disabled.c 2011-11-18 19:30:15.000000000 -0500
58379 @@ -0,0 +1,439 @@
58380 +#include <linux/kernel.h>
58381 +#include <linux/module.h>
58382 +#include <linux/sched.h>
58383 +#include <linux/file.h>
58384 +#include <linux/fs.h>
58385 +#include <linux/kdev_t.h>
58386 +#include <linux/net.h>
58387 +#include <linux/in.h>
58388 +#include <linux/ip.h>
58389 +#include <linux/skbuff.h>
58390 +#include <linux/sysctl.h>
58391 +
58392 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
58393 +void
58394 +pax_set_initial_flags(struct linux_binprm *bprm)
58395 +{
58396 + return;
58397 +}
58398 +#endif
58399 +
58400 +#ifdef CONFIG_SYSCTL
58401 +__u32
58402 +gr_handle_sysctl(const struct ctl_table * table, const int op)
58403 +{
58404 + return 0;
58405 +}
58406 +#endif
58407 +
58408 +#ifdef CONFIG_TASKSTATS
58409 +int gr_is_taskstats_denied(int pid)
58410 +{
58411 + return 0;
58412 +}
58413 +#endif
58414 +
58415 +int
58416 +gr_acl_is_enabled(void)
58417 +{
58418 + return 0;
58419 +}
58420 +
58421 +void
58422 +gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
58423 +{
58424 + return;
58425 +}
58426 +
58427 +int
58428 +gr_handle_rawio(const struct inode *inode)
58429 +{
58430 + return 0;
58431 +}
58432 +
58433 +void
58434 +gr_acl_handle_psacct(struct task_struct *task, const long code)
58435 +{
58436 + return;
58437 +}
58438 +
58439 +int
58440 +gr_handle_ptrace(struct task_struct *task, const long request)
58441 +{
58442 + return 0;
58443 +}
58444 +
58445 +int
58446 +gr_handle_proc_ptrace(struct task_struct *task)
58447 +{
58448 + return 0;
58449 +}
58450 +
58451 +void
58452 +gr_learn_resource(const struct task_struct *task,
58453 + const int res, const unsigned long wanted, const int gt)
58454 +{
58455 + return;
58456 +}
58457 +
58458 +int
58459 +gr_set_acls(const int type)
58460 +{
58461 + return 0;
58462 +}
58463 +
58464 +int
58465 +gr_check_hidden_task(const struct task_struct *tsk)
58466 +{
58467 + return 0;
58468 +}
58469 +
58470 +int
58471 +gr_check_protected_task(const struct task_struct *task)
58472 +{
58473 + return 0;
58474 +}
58475 +
58476 +int
58477 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
58478 +{
58479 + return 0;
58480 +}
58481 +
58482 +void
58483 +gr_copy_label(struct task_struct *tsk)
58484 +{
58485 + return;
58486 +}
58487 +
58488 +void
58489 +gr_set_pax_flags(struct task_struct *task)
58490 +{
58491 + return;
58492 +}
58493 +
58494 +int
58495 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
58496 + const int unsafe_share)
58497 +{
58498 + return 0;
58499 +}
58500 +
58501 +void
58502 +gr_handle_delete(const ino_t ino, const dev_t dev)
58503 +{
58504 + return;
58505 +}
58506 +
58507 +void
58508 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
58509 +{
58510 + return;
58511 +}
58512 +
58513 +void
58514 +gr_handle_crash(struct task_struct *task, const int sig)
58515 +{
58516 + return;
58517 +}
58518 +
58519 +int
58520 +gr_check_crash_exec(const struct file *filp)
58521 +{
58522 + return 0;
58523 +}
58524 +
58525 +int
58526 +gr_check_crash_uid(const uid_t uid)
58527 +{
58528 + return 0;
58529 +}
58530 +
58531 +void
58532 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
58533 + struct dentry *old_dentry,
58534 + struct dentry *new_dentry,
58535 + struct vfsmount *mnt, const __u8 replace)
58536 +{
58537 + return;
58538 +}
58539 +
58540 +int
58541 +gr_search_socket(const int family, const int type, const int protocol)
58542 +{
58543 + return 1;
58544 +}
58545 +
58546 +int
58547 +gr_search_connectbind(const int mode, const struct socket *sock,
58548 + const struct sockaddr_in *addr)
58549 +{
58550 + return 0;
58551 +}
58552 +
58553 +void
58554 +gr_handle_alertkill(struct task_struct *task)
58555 +{
58556 + return;
58557 +}
58558 +
58559 +__u32
58560 +gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
58561 +{
58562 + return 1;
58563 +}
58564 +
58565 +__u32
58566 +gr_acl_handle_hidden_file(const struct dentry * dentry,
58567 + const struct vfsmount * mnt)
58568 +{
58569 + return 1;
58570 +}
58571 +
58572 +__u32
58573 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
58574 + int acc_mode)
58575 +{
58576 + return 1;
58577 +}
58578 +
58579 +__u32
58580 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
58581 +{
58582 + return 1;
58583 +}
58584 +
58585 +__u32
58586 +gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
58587 +{
58588 + return 1;
58589 +}
58590 +
58591 +int
58592 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
58593 + unsigned int *vm_flags)
58594 +{
58595 + return 1;
58596 +}
58597 +
58598 +__u32
58599 +gr_acl_handle_truncate(const struct dentry * dentry,
58600 + const struct vfsmount * mnt)
58601 +{
58602 + return 1;
58603 +}
58604 +
58605 +__u32
58606 +gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
58607 +{
58608 + return 1;
58609 +}
58610 +
58611 +__u32
58612 +gr_acl_handle_access(const struct dentry * dentry,
58613 + const struct vfsmount * mnt, const int fmode)
58614 +{
58615 + return 1;
58616 +}
58617 +
58618 +__u32
58619 +gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
58620 + mode_t mode)
58621 +{
58622 + return 1;
58623 +}
58624 +
58625 +__u32
58626 +gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
58627 + mode_t mode)
58628 +{
58629 + return 1;
58630 +}
58631 +
58632 +__u32
58633 +gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
58634 +{
58635 + return 1;
58636 +}
58637 +
58638 +__u32
58639 +gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
58640 +{
58641 + return 1;
58642 +}
58643 +
58644 +void
58645 +grsecurity_init(void)
58646 +{
58647 + return;
58648 +}
58649 +
58650 +__u32
58651 +gr_acl_handle_mknod(const struct dentry * new_dentry,
58652 + const struct dentry * parent_dentry,
58653 + const struct vfsmount * parent_mnt,
58654 + const int mode)
58655 +{
58656 + return 1;
58657 +}
58658 +
58659 +__u32
58660 +gr_acl_handle_mkdir(const struct dentry * new_dentry,
58661 + const struct dentry * parent_dentry,
58662 + const struct vfsmount * parent_mnt)
58663 +{
58664 + return 1;
58665 +}
58666 +
58667 +__u32
58668 +gr_acl_handle_symlink(const struct dentry * new_dentry,
58669 + const struct dentry * parent_dentry,
58670 + const struct vfsmount * parent_mnt, const char *from)
58671 +{
58672 + return 1;
58673 +}
58674 +
58675 +__u32
58676 +gr_acl_handle_link(const struct dentry * new_dentry,
58677 + const struct dentry * parent_dentry,
58678 + const struct vfsmount * parent_mnt,
58679 + const struct dentry * old_dentry,
58680 + const struct vfsmount * old_mnt, const char *to)
58681 +{
58682 + return 1;
58683 +}
58684 +
58685 +int
58686 +gr_acl_handle_rename(const struct dentry *new_dentry,
58687 + const struct dentry *parent_dentry,
58688 + const struct vfsmount *parent_mnt,
58689 + const struct dentry *old_dentry,
58690 + const struct inode *old_parent_inode,
58691 + const struct vfsmount *old_mnt, const char *newname)
58692 +{
58693 + return 0;
58694 +}
58695 +
58696 +int
58697 +gr_acl_handle_filldir(const struct file *file, const char *name,
58698 + const int namelen, const ino_t ino)
58699 +{
58700 + return 1;
58701 +}
58702 +
58703 +int
58704 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
58705 + const time_t shm_createtime, const uid_t cuid, const int shmid)
58706 +{
58707 + return 1;
58708 +}
58709 +
58710 +int
58711 +gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
58712 +{
58713 + return 0;
58714 +}
58715 +
58716 +int
58717 +gr_search_accept(const struct socket *sock)
58718 +{
58719 + return 0;
58720 +}
58721 +
58722 +int
58723 +gr_search_listen(const struct socket *sock)
58724 +{
58725 + return 0;
58726 +}
58727 +
58728 +int
58729 +gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
58730 +{
58731 + return 0;
58732 +}
58733 +
58734 +__u32
58735 +gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
58736 +{
58737 + return 1;
58738 +}
58739 +
58740 +__u32
58741 +gr_acl_handle_creat(const struct dentry * dentry,
58742 + const struct dentry * p_dentry,
58743 + const struct vfsmount * p_mnt, int open_flags, int acc_mode,
58744 + const int imode)
58745 +{
58746 + return 1;
58747 +}
58748 +
58749 +void
58750 +gr_acl_handle_exit(void)
58751 +{
58752 + return;
58753 +}
58754 +
58755 +int
58756 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
58757 +{
58758 + return 1;
58759 +}
58760 +
58761 +void
58762 +gr_set_role_label(const uid_t uid, const gid_t gid)
58763 +{
58764 + return;
58765 +}
58766 +
58767 +int
58768 +gr_acl_handle_procpidmem(const struct task_struct *task)
58769 +{
58770 + return 0;
58771 +}
58772 +
58773 +int
58774 +gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
58775 +{
58776 + return 0;
58777 +}
58778 +
58779 +int
58780 +gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
58781 +{
58782 + return 0;
58783 +}
58784 +
58785 +void
58786 +gr_set_kernel_label(struct task_struct *task)
58787 +{
58788 + return;
58789 +}
58790 +
58791 +int
58792 +gr_check_user_change(int real, int effective, int fs)
58793 +{
58794 + return 0;
58795 +}
58796 +
58797 +int
58798 +gr_check_group_change(int real, int effective, int fs)
58799 +{
58800 + return 0;
58801 +}
58802 +
58803 +int gr_acl_enable_at_secure(void)
58804 +{
58805 + return 0;
58806 +}
58807 +
58808 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
58809 +{
58810 + return dentry->d_inode->i_sb->s_dev;
58811 +}
58812 +
58813 +EXPORT_SYMBOL(gr_learn_resource);
58814 +EXPORT_SYMBOL(gr_set_kernel_label);
58815 +#ifdef CONFIG_SECURITY
58816 +EXPORT_SYMBOL(gr_check_user_change);
58817 +EXPORT_SYMBOL(gr_check_group_change);
58818 +#endif
58819 diff -urNp linux-2.6.32.49/grsecurity/grsec_exec.c linux-2.6.32.49/grsecurity/grsec_exec.c
58820 --- linux-2.6.32.49/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500
58821 +++ linux-2.6.32.49/grsecurity/grsec_exec.c 2011-11-15 19:59:43.000000000 -0500
58822 @@ -0,0 +1,204 @@
58823 +#include <linux/kernel.h>
58824 +#include <linux/sched.h>
58825 +#include <linux/file.h>
58826 +#include <linux/binfmts.h>
58827 +#include <linux/smp_lock.h>
58828 +#include <linux/fs.h>
58829 +#include <linux/types.h>
58830 +#include <linux/grdefs.h>
58831 +#include <linux/grinternal.h>
58832 +#include <linux/capability.h>
58833 +#include <linux/compat.h>
58834 +#include <linux/module.h>
58835 +
58836 +#include <asm/uaccess.h>
58837 +
58838 +#ifdef CONFIG_GRKERNSEC_EXECLOG
58839 +static char gr_exec_arg_buf[132];
58840 +static DEFINE_MUTEX(gr_exec_arg_mutex);
58841 +#endif
58842 +
58843 +void
58844 +gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv)
58845 +{
58846 +#ifdef CONFIG_GRKERNSEC_EXECLOG
58847 + char *grarg = gr_exec_arg_buf;
58848 + unsigned int i, x, execlen = 0;
58849 + char c;
58850 +
58851 + if (!((grsec_enable_execlog && grsec_enable_group &&
58852 + in_group_p(grsec_audit_gid))
58853 + || (grsec_enable_execlog && !grsec_enable_group)))
58854 + return;
58855 +
58856 + mutex_lock(&gr_exec_arg_mutex);
58857 + memset(grarg, 0, sizeof(gr_exec_arg_buf));
58858 +
58859 + if (unlikely(argv == NULL))
58860 + goto log;
58861 +
58862 + for (i = 0; i < bprm->argc && execlen < 128; i++) {
58863 + const char __user *p;
58864 + unsigned int len;
58865 +
58866 + if (copy_from_user(&p, argv + i, sizeof(p)))
58867 + goto log;
58868 + if (!p)
58869 + goto log;
58870 + len = strnlen_user(p, 128 - execlen);
58871 + if (len > 128 - execlen)
58872 + len = 128 - execlen;
58873 + else if (len > 0)
58874 + len--;
58875 + if (copy_from_user(grarg + execlen, p, len))
58876 + goto log;
58877 +
58878 + /* rewrite unprintable characters */
58879 + for (x = 0; x < len; x++) {
58880 + c = *(grarg + execlen + x);
58881 + if (c < 32 || c > 126)
58882 + *(grarg + execlen + x) = ' ';
58883 + }
58884 +
58885 + execlen += len;
58886 + *(grarg + execlen) = ' ';
58887 + *(grarg + execlen + 1) = '\0';
58888 + execlen++;
58889 + }
58890 +
58891 + log:
58892 + gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
58893 + bprm->file->f_path.mnt, grarg);
58894 + mutex_unlock(&gr_exec_arg_mutex);
58895 +#endif
58896 + return;
58897 +}
58898 +
58899 +#ifdef CONFIG_COMPAT
58900 +void
58901 +gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv)
58902 +{
58903 +#ifdef CONFIG_GRKERNSEC_EXECLOG
58904 + char *grarg = gr_exec_arg_buf;
58905 + unsigned int i, x, execlen = 0;
58906 + char c;
58907 +
58908 + if (!((grsec_enable_execlog && grsec_enable_group &&
58909 + in_group_p(grsec_audit_gid))
58910 + || (grsec_enable_execlog && !grsec_enable_group)))
58911 + return;
58912 +
58913 + mutex_lock(&gr_exec_arg_mutex);
58914 + memset(grarg, 0, sizeof(gr_exec_arg_buf));
58915 +
58916 + if (unlikely(argv == NULL))
58917 + goto log;
58918 +
58919 + for (i = 0; i < bprm->argc && execlen < 128; i++) {
58920 + compat_uptr_t p;
58921 + unsigned int len;
58922 +
58923 + if (get_user(p, argv + i))
58924 + goto log;
58925 + len = strnlen_user(compat_ptr(p), 128 - execlen);
58926 + if (len > 128 - execlen)
58927 + len = 128 - execlen;
58928 + else if (len > 0)
58929 + len--;
58930 + else
58931 + goto log;
58932 + if (copy_from_user(grarg + execlen, compat_ptr(p), len))
58933 + goto log;
58934 +
58935 + /* rewrite unprintable characters */
58936 + for (x = 0; x < len; x++) {
58937 + c = *(grarg + execlen + x);
58938 + if (c < 32 || c > 126)
58939 + *(grarg + execlen + x) = ' ';
58940 + }
58941 +
58942 + execlen += len;
58943 + *(grarg + execlen) = ' ';
58944 + *(grarg + execlen + 1) = '\0';
58945 + execlen++;
58946 + }
58947 +
58948 + log:
58949 + gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
58950 + bprm->file->f_path.mnt, grarg);
58951 + mutex_unlock(&gr_exec_arg_mutex);
58952 +#endif
58953 + return;
58954 +}
58955 +#endif
58956 +
58957 +#ifdef CONFIG_GRKERNSEC
58958 +extern int gr_acl_is_capable(const int cap);
58959 +extern int gr_acl_is_capable_nolog(const int cap);
58960 +extern int gr_chroot_is_capable(const int cap);
58961 +extern int gr_chroot_is_capable_nolog(const int cap);
58962 +#endif
58963 +
58964 +const char *captab_log[] = {
58965 + "CAP_CHOWN",
58966 + "CAP_DAC_OVERRIDE",
58967 + "CAP_DAC_READ_SEARCH",
58968 + "CAP_FOWNER",
58969 + "CAP_FSETID",
58970 + "CAP_KILL",
58971 + "CAP_SETGID",
58972 + "CAP_SETUID",
58973 + "CAP_SETPCAP",
58974 + "CAP_LINUX_IMMUTABLE",
58975 + "CAP_NET_BIND_SERVICE",
58976 + "CAP_NET_BROADCAST",
58977 + "CAP_NET_ADMIN",
58978 + "CAP_NET_RAW",
58979 + "CAP_IPC_LOCK",
58980 + "CAP_IPC_OWNER",
58981 + "CAP_SYS_MODULE",
58982 + "CAP_SYS_RAWIO",
58983 + "CAP_SYS_CHROOT",
58984 + "CAP_SYS_PTRACE",
58985 + "CAP_SYS_PACCT",
58986 + "CAP_SYS_ADMIN",
58987 + "CAP_SYS_BOOT",
58988 + "CAP_SYS_NICE",
58989 + "CAP_SYS_RESOURCE",
58990 + "CAP_SYS_TIME",
58991 + "CAP_SYS_TTY_CONFIG",
58992 + "CAP_MKNOD",
58993 + "CAP_LEASE",
58994 + "CAP_AUDIT_WRITE",
58995 + "CAP_AUDIT_CONTROL",
58996 + "CAP_SETFCAP",
58997 + "CAP_MAC_OVERRIDE",
58998 + "CAP_MAC_ADMIN"
58999 +};
59000 +
59001 +int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
59002 +
59003 +int gr_is_capable(const int cap)
59004 +{
59005 +#ifdef CONFIG_GRKERNSEC
59006 + if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap))
59007 + return 1;
59008 + return 0;
59009 +#else
59010 + return 1;
59011 +#endif
59012 +}
59013 +
59014 +int gr_is_capable_nolog(const int cap)
59015 +{
59016 +#ifdef CONFIG_GRKERNSEC
59017 + if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap))
59018 + return 1;
59019 + return 0;
59020 +#else
59021 + return 1;
59022 +#endif
59023 +}
59024 +
59025 +EXPORT_SYMBOL(gr_is_capable);
59026 +EXPORT_SYMBOL(gr_is_capable_nolog);
59027 diff -urNp linux-2.6.32.49/grsecurity/grsec_fifo.c linux-2.6.32.49/grsecurity/grsec_fifo.c
59028 --- linux-2.6.32.49/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500
59029 +++ linux-2.6.32.49/grsecurity/grsec_fifo.c 2011-11-15 19:59:43.000000000 -0500
59030 @@ -0,0 +1,24 @@
59031 +#include <linux/kernel.h>
59032 +#include <linux/sched.h>
59033 +#include <linux/fs.h>
59034 +#include <linux/file.h>
59035 +#include <linux/grinternal.h>
59036 +
59037 +int
59038 +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
59039 + const struct dentry *dir, const int flag, const int acc_mode)
59040 +{
59041 +#ifdef CONFIG_GRKERNSEC_FIFO
59042 + const struct cred *cred = current_cred();
59043 +
59044 + if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
59045 + !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
59046 + (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
59047 + (cred->fsuid != dentry->d_inode->i_uid)) {
59048 + if (!inode_permission(dentry->d_inode, acc_mode))
59049 + gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
59050 + return -EACCES;
59051 + }
59052 +#endif
59053 + return 0;
59054 +}
59055 diff -urNp linux-2.6.32.49/grsecurity/grsec_fork.c linux-2.6.32.49/grsecurity/grsec_fork.c
59056 --- linux-2.6.32.49/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500
59057 +++ linux-2.6.32.49/grsecurity/grsec_fork.c 2011-11-15 19:59:43.000000000 -0500
59058 @@ -0,0 +1,23 @@
59059 +#include <linux/kernel.h>
59060 +#include <linux/sched.h>
59061 +#include <linux/grsecurity.h>
59062 +#include <linux/grinternal.h>
59063 +#include <linux/errno.h>
59064 +
59065 +void
59066 +gr_log_forkfail(const int retval)
59067 +{
59068 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
59069 + if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
59070 + switch (retval) {
59071 + case -EAGAIN:
59072 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
59073 + break;
59074 + case -ENOMEM:
59075 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
59076 + break;
59077 + }
59078 + }
59079 +#endif
59080 + return;
59081 +}
59082 diff -urNp linux-2.6.32.49/grsecurity/grsec_init.c linux-2.6.32.49/grsecurity/grsec_init.c
59083 --- linux-2.6.32.49/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500
59084 +++ linux-2.6.32.49/grsecurity/grsec_init.c 2011-11-15 19:59:43.000000000 -0500
59085 @@ -0,0 +1,270 @@
59086 +#include <linux/kernel.h>
59087 +#include <linux/sched.h>
59088 +#include <linux/mm.h>
59089 +#include <linux/smp_lock.h>
59090 +#include <linux/gracl.h>
59091 +#include <linux/slab.h>
59092 +#include <linux/vmalloc.h>
59093 +#include <linux/percpu.h>
59094 +#include <linux/module.h>
59095 +
59096 +int grsec_enable_brute;
59097 +int grsec_enable_link;
59098 +int grsec_enable_dmesg;
59099 +int grsec_enable_harden_ptrace;
59100 +int grsec_enable_fifo;
59101 +int grsec_enable_execlog;
59102 +int grsec_enable_signal;
59103 +int grsec_enable_forkfail;
59104 +int grsec_enable_audit_ptrace;
59105 +int grsec_enable_time;
59106 +int grsec_enable_audit_textrel;
59107 +int grsec_enable_group;
59108 +int grsec_audit_gid;
59109 +int grsec_enable_chdir;
59110 +int grsec_enable_mount;
59111 +int grsec_enable_rofs;
59112 +int grsec_enable_chroot_findtask;
59113 +int grsec_enable_chroot_mount;
59114 +int grsec_enable_chroot_shmat;
59115 +int grsec_enable_chroot_fchdir;
59116 +int grsec_enable_chroot_double;
59117 +int grsec_enable_chroot_pivot;
59118 +int grsec_enable_chroot_chdir;
59119 +int grsec_enable_chroot_chmod;
59120 +int grsec_enable_chroot_mknod;
59121 +int grsec_enable_chroot_nice;
59122 +int grsec_enable_chroot_execlog;
59123 +int grsec_enable_chroot_caps;
59124 +int grsec_enable_chroot_sysctl;
59125 +int grsec_enable_chroot_unix;
59126 +int grsec_enable_tpe;
59127 +int grsec_tpe_gid;
59128 +int grsec_enable_blackhole;
59129 +#ifdef CONFIG_IPV6_MODULE
59130 +EXPORT_SYMBOL(grsec_enable_blackhole);
59131 +#endif
59132 +int grsec_lastack_retries;
59133 +int grsec_enable_tpe_all;
59134 +int grsec_enable_tpe_invert;
59135 +int grsec_enable_socket_all;
59136 +int grsec_socket_all_gid;
59137 +int grsec_enable_socket_client;
59138 +int grsec_socket_client_gid;
59139 +int grsec_enable_socket_server;
59140 +int grsec_socket_server_gid;
59141 +int grsec_resource_logging;
59142 +int grsec_disable_privio;
59143 +int grsec_enable_log_rwxmaps;
59144 +int grsec_lock;
59145 +
59146 +DEFINE_SPINLOCK(grsec_alert_lock);
59147 +unsigned long grsec_alert_wtime = 0;
59148 +unsigned long grsec_alert_fyet = 0;
59149 +
59150 +DEFINE_SPINLOCK(grsec_audit_lock);
59151 +
59152 +DEFINE_RWLOCK(grsec_exec_file_lock);
59153 +
59154 +char *gr_shared_page[4];
59155 +
59156 +char *gr_alert_log_fmt;
59157 +char *gr_audit_log_fmt;
59158 +char *gr_alert_log_buf;
59159 +char *gr_audit_log_buf;
59160 +
59161 +extern struct gr_arg *gr_usermode;
59162 +extern unsigned char *gr_system_salt;
59163 +extern unsigned char *gr_system_sum;
59164 +
59165 +void __init
59166 +grsecurity_init(void)
59167 +{
59168 + int j;
59169 + /* create the per-cpu shared pages */
59170 +
59171 +#ifdef CONFIG_X86
59172 + memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
59173 +#endif
59174 +
59175 + for (j = 0; j < 4; j++) {
59176 + gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
59177 + if (gr_shared_page[j] == NULL) {
59178 + panic("Unable to allocate grsecurity shared page");
59179 + return;
59180 + }
59181 + }
59182 +
59183 + /* allocate log buffers */
59184 + gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
59185 + if (!gr_alert_log_fmt) {
59186 + panic("Unable to allocate grsecurity alert log format buffer");
59187 + return;
59188 + }
59189 + gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
59190 + if (!gr_audit_log_fmt) {
59191 + panic("Unable to allocate grsecurity audit log format buffer");
59192 + return;
59193 + }
59194 + gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
59195 + if (!gr_alert_log_buf) {
59196 + panic("Unable to allocate grsecurity alert log buffer");
59197 + return;
59198 + }
59199 + gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
59200 + if (!gr_audit_log_buf) {
59201 + panic("Unable to allocate grsecurity audit log buffer");
59202 + return;
59203 + }
59204 +
59205 + /* allocate memory for authentication structure */
59206 + gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
59207 + gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
59208 + gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
59209 +
59210 + if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
59211 + panic("Unable to allocate grsecurity authentication structure");
59212 + return;
59213 + }
59214 +
59215 +
59216 +#ifdef CONFIG_GRKERNSEC_IO
59217 +#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
59218 + grsec_disable_privio = 1;
59219 +#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
59220 + grsec_disable_privio = 1;
59221 +#else
59222 + grsec_disable_privio = 0;
59223 +#endif
59224 +#endif
59225 +
59226 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59227 + /* for backward compatibility, tpe_invert always defaults to on if
59228 + enabled in the kernel
59229 + */
59230 + grsec_enable_tpe_invert = 1;
59231 +#endif
59232 +
59233 +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
59234 +#ifndef CONFIG_GRKERNSEC_SYSCTL
59235 + grsec_lock = 1;
59236 +#endif
59237 +
59238 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59239 + grsec_enable_audit_textrel = 1;
59240 +#endif
59241 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
59242 + grsec_enable_log_rwxmaps = 1;
59243 +#endif
59244 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
59245 + grsec_enable_group = 1;
59246 + grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
59247 +#endif
59248 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
59249 + grsec_enable_chdir = 1;
59250 +#endif
59251 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
59252 + grsec_enable_harden_ptrace = 1;
59253 +#endif
59254 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59255 + grsec_enable_mount = 1;
59256 +#endif
59257 +#ifdef CONFIG_GRKERNSEC_LINK
59258 + grsec_enable_link = 1;
59259 +#endif
59260 +#ifdef CONFIG_GRKERNSEC_BRUTE
59261 + grsec_enable_brute = 1;
59262 +#endif
59263 +#ifdef CONFIG_GRKERNSEC_DMESG
59264 + grsec_enable_dmesg = 1;
59265 +#endif
59266 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
59267 + grsec_enable_blackhole = 1;
59268 + grsec_lastack_retries = 4;
59269 +#endif
59270 +#ifdef CONFIG_GRKERNSEC_FIFO
59271 + grsec_enable_fifo = 1;
59272 +#endif
59273 +#ifdef CONFIG_GRKERNSEC_EXECLOG
59274 + grsec_enable_execlog = 1;
59275 +#endif
59276 +#ifdef CONFIG_GRKERNSEC_SIGNAL
59277 + grsec_enable_signal = 1;
59278 +#endif
59279 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
59280 + grsec_enable_forkfail = 1;
59281 +#endif
59282 +#ifdef CONFIG_GRKERNSEC_TIME
59283 + grsec_enable_time = 1;
59284 +#endif
59285 +#ifdef CONFIG_GRKERNSEC_RESLOG
59286 + grsec_resource_logging = 1;
59287 +#endif
59288 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
59289 + grsec_enable_chroot_findtask = 1;
59290 +#endif
59291 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
59292 + grsec_enable_chroot_unix = 1;
59293 +#endif
59294 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
59295 + grsec_enable_chroot_mount = 1;
59296 +#endif
59297 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
59298 + grsec_enable_chroot_fchdir = 1;
59299 +#endif
59300 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
59301 + grsec_enable_chroot_shmat = 1;
59302 +#endif
59303 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
59304 + grsec_enable_audit_ptrace = 1;
59305 +#endif
59306 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
59307 + grsec_enable_chroot_double = 1;
59308 +#endif
59309 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
59310 + grsec_enable_chroot_pivot = 1;
59311 +#endif
59312 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
59313 + grsec_enable_chroot_chdir = 1;
59314 +#endif
59315 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
59316 + grsec_enable_chroot_chmod = 1;
59317 +#endif
59318 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
59319 + grsec_enable_chroot_mknod = 1;
59320 +#endif
59321 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
59322 + grsec_enable_chroot_nice = 1;
59323 +#endif
59324 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
59325 + grsec_enable_chroot_execlog = 1;
59326 +#endif
59327 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
59328 + grsec_enable_chroot_caps = 1;
59329 +#endif
59330 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
59331 + grsec_enable_chroot_sysctl = 1;
59332 +#endif
59333 +#ifdef CONFIG_GRKERNSEC_TPE
59334 + grsec_enable_tpe = 1;
59335 + grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
59336 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
59337 + grsec_enable_tpe_all = 1;
59338 +#endif
59339 +#endif
59340 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59341 + grsec_enable_socket_all = 1;
59342 + grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
59343 +#endif
59344 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59345 + grsec_enable_socket_client = 1;
59346 + grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
59347 +#endif
59348 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59349 + grsec_enable_socket_server = 1;
59350 + grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
59351 +#endif
59352 +#endif
59353 +
59354 + return;
59355 +}
59356 diff -urNp linux-2.6.32.49/grsecurity/grsec_link.c linux-2.6.32.49/grsecurity/grsec_link.c
59357 --- linux-2.6.32.49/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500
59358 +++ linux-2.6.32.49/grsecurity/grsec_link.c 2011-11-15 19:59:43.000000000 -0500
59359 @@ -0,0 +1,43 @@
59360 +#include <linux/kernel.h>
59361 +#include <linux/sched.h>
59362 +#include <linux/fs.h>
59363 +#include <linux/file.h>
59364 +#include <linux/grinternal.h>
59365 +
59366 +int
59367 +gr_handle_follow_link(const struct inode *parent,
59368 + const struct inode *inode,
59369 + const struct dentry *dentry, const struct vfsmount *mnt)
59370 +{
59371 +#ifdef CONFIG_GRKERNSEC_LINK
59372 + const struct cred *cred = current_cred();
59373 +
59374 + if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
59375 + (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
59376 + (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
59377 + gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
59378 + return -EACCES;
59379 + }
59380 +#endif
59381 + return 0;
59382 +}
59383 +
59384 +int
59385 +gr_handle_hardlink(const struct dentry *dentry,
59386 + const struct vfsmount *mnt,
59387 + struct inode *inode, const int mode, const char *to)
59388 +{
59389 +#ifdef CONFIG_GRKERNSEC_LINK
59390 + const struct cred *cred = current_cred();
59391 +
59392 + if (grsec_enable_link && cred->fsuid != inode->i_uid &&
59393 + (!S_ISREG(mode) || (mode & S_ISUID) ||
59394 + ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
59395 + (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
59396 + !capable(CAP_FOWNER) && cred->uid) {
59397 + gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
59398 + return -EPERM;
59399 + }
59400 +#endif
59401 + return 0;
59402 +}
59403 diff -urNp linux-2.6.32.49/grsecurity/grsec_log.c linux-2.6.32.49/grsecurity/grsec_log.c
59404 --- linux-2.6.32.49/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
59405 +++ linux-2.6.32.49/grsecurity/grsec_log.c 2011-11-15 19:59:43.000000000 -0500
59406 @@ -0,0 +1,322 @@
59407 +#include <linux/kernel.h>
59408 +#include <linux/sched.h>
59409 +#include <linux/file.h>
59410 +#include <linux/tty.h>
59411 +#include <linux/fs.h>
59412 +#include <linux/grinternal.h>
59413 +
59414 +#ifdef CONFIG_TREE_PREEMPT_RCU
59415 +#define DISABLE_PREEMPT() preempt_disable()
59416 +#define ENABLE_PREEMPT() preempt_enable()
59417 +#else
59418 +#define DISABLE_PREEMPT()
59419 +#define ENABLE_PREEMPT()
59420 +#endif
59421 +
59422 +#define BEGIN_LOCKS(x) \
59423 + DISABLE_PREEMPT(); \
59424 + rcu_read_lock(); \
59425 + read_lock(&tasklist_lock); \
59426 + read_lock(&grsec_exec_file_lock); \
59427 + if (x != GR_DO_AUDIT) \
59428 + spin_lock(&grsec_alert_lock); \
59429 + else \
59430 + spin_lock(&grsec_audit_lock)
59431 +
59432 +#define END_LOCKS(x) \
59433 + if (x != GR_DO_AUDIT) \
59434 + spin_unlock(&grsec_alert_lock); \
59435 + else \
59436 + spin_unlock(&grsec_audit_lock); \
59437 + read_unlock(&grsec_exec_file_lock); \
59438 + read_unlock(&tasklist_lock); \
59439 + rcu_read_unlock(); \
59440 + ENABLE_PREEMPT(); \
59441 + if (x == GR_DONT_AUDIT) \
59442 + gr_handle_alertkill(current)
59443 +
59444 +enum {
59445 + FLOODING,
59446 + NO_FLOODING
59447 +};
59448 +
59449 +extern char *gr_alert_log_fmt;
59450 +extern char *gr_audit_log_fmt;
59451 +extern char *gr_alert_log_buf;
59452 +extern char *gr_audit_log_buf;
59453 +
59454 +static int gr_log_start(int audit)
59455 +{
59456 + char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
59457 + char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
59458 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
59459 +#if (CONFIG_GRKERNSEC_FLOODTIME > 0 && CONFIG_GRKERNSEC_FLOODBURST > 0)
59460 + unsigned long curr_secs = get_seconds();
59461 +
59462 + if (audit == GR_DO_AUDIT)
59463 + goto set_fmt;
59464 +
59465 + if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
59466 + grsec_alert_wtime = curr_secs;
59467 + grsec_alert_fyet = 0;
59468 + } else if (time_before_eq(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)
59469 + && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
59470 + grsec_alert_fyet++;
59471 + } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
59472 + grsec_alert_wtime = curr_secs;
59473 + grsec_alert_fyet++;
59474 + printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
59475 + return FLOODING;
59476 + }
59477 + else return FLOODING;
59478 +
59479 +set_fmt:
59480 +#endif
59481 + memset(buf, 0, PAGE_SIZE);
59482 + if (current->signal->curr_ip && gr_acl_is_enabled()) {
59483 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
59484 + snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
59485 + } else if (current->signal->curr_ip) {
59486 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
59487 + snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
59488 + } else if (gr_acl_is_enabled()) {
59489 + sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
59490 + snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
59491 + } else {
59492 + sprintf(fmt, "%s%s", loglevel, "grsec: ");
59493 + strcpy(buf, fmt);
59494 + }
59495 +
59496 + return NO_FLOODING;
59497 +}
59498 +
59499 +static void gr_log_middle(int audit, const char *msg, va_list ap)
59500 + __attribute__ ((format (printf, 2, 0)));
59501 +
59502 +static void gr_log_middle(int audit, const char *msg, va_list ap)
59503 +{
59504 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
59505 + unsigned int len = strlen(buf);
59506 +
59507 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
59508 +
59509 + return;
59510 +}
59511 +
59512 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
59513 + __attribute__ ((format (printf, 2, 3)));
59514 +
59515 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
59516 +{
59517 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
59518 + unsigned int len = strlen(buf);
59519 + va_list ap;
59520 +
59521 + va_start(ap, msg);
59522 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
59523 + va_end(ap);
59524 +
59525 + return;
59526 +}
59527 +
59528 +static void gr_log_end(int audit, int append_default)
59529 +{
59530 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
59531 +
59532 + if (append_default) {
59533 + unsigned int len = strlen(buf);
59534 + snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
59535 + }
59536 +
59537 + printk("%s\n", buf);
59538 +
59539 + return;
59540 +}
59541 +
59542 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
59543 +{
59544 + int logtype;
59545 + char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
59546 + char *str1 = NULL, *str2 = NULL, *str3 = NULL;
59547 + void *voidptr = NULL;
59548 + int num1 = 0, num2 = 0;
59549 + unsigned long ulong1 = 0, ulong2 = 0;
59550 + struct dentry *dentry = NULL;
59551 + struct vfsmount *mnt = NULL;
59552 + struct file *file = NULL;
59553 + struct task_struct *task = NULL;
59554 + const struct cred *cred, *pcred;
59555 + va_list ap;
59556 +
59557 + BEGIN_LOCKS(audit);
59558 + logtype = gr_log_start(audit);
59559 + if (logtype == FLOODING) {
59560 + END_LOCKS(audit);
59561 + return;
59562 + }
59563 + va_start(ap, argtypes);
59564 + switch (argtypes) {
59565 + case GR_TTYSNIFF:
59566 + task = va_arg(ap, struct task_struct *);
59567 + gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
59568 + break;
59569 + case GR_SYSCTL_HIDDEN:
59570 + str1 = va_arg(ap, char *);
59571 + gr_log_middle_varargs(audit, msg, result, str1);
59572 + break;
59573 + case GR_RBAC:
59574 + dentry = va_arg(ap, struct dentry *);
59575 + mnt = va_arg(ap, struct vfsmount *);
59576 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
59577 + break;
59578 + case GR_RBAC_STR:
59579 + dentry = va_arg(ap, struct dentry *);
59580 + mnt = va_arg(ap, struct vfsmount *);
59581 + str1 = va_arg(ap, char *);
59582 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
59583 + break;
59584 + case GR_STR_RBAC:
59585 + str1 = va_arg(ap, char *);
59586 + dentry = va_arg(ap, struct dentry *);
59587 + mnt = va_arg(ap, struct vfsmount *);
59588 + gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
59589 + break;
59590 + case GR_RBAC_MODE2:
59591 + dentry = va_arg(ap, struct dentry *);
59592 + mnt = va_arg(ap, struct vfsmount *);
59593 + str1 = va_arg(ap, char *);
59594 + str2 = va_arg(ap, char *);
59595 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
59596 + break;
59597 + case GR_RBAC_MODE3:
59598 + dentry = va_arg(ap, struct dentry *);
59599 + mnt = va_arg(ap, struct vfsmount *);
59600 + str1 = va_arg(ap, char *);
59601 + str2 = va_arg(ap, char *);
59602 + str3 = va_arg(ap, char *);
59603 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
59604 + break;
59605 + case GR_FILENAME:
59606 + dentry = va_arg(ap, struct dentry *);
59607 + mnt = va_arg(ap, struct vfsmount *);
59608 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
59609 + break;
59610 + case GR_STR_FILENAME:
59611 + str1 = va_arg(ap, char *);
59612 + dentry = va_arg(ap, struct dentry *);
59613 + mnt = va_arg(ap, struct vfsmount *);
59614 + gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
59615 + break;
59616 + case GR_FILENAME_STR:
59617 + dentry = va_arg(ap, struct dentry *);
59618 + mnt = va_arg(ap, struct vfsmount *);
59619 + str1 = va_arg(ap, char *);
59620 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
59621 + break;
59622 + case GR_FILENAME_TWO_INT:
59623 + dentry = va_arg(ap, struct dentry *);
59624 + mnt = va_arg(ap, struct vfsmount *);
59625 + num1 = va_arg(ap, int);
59626 + num2 = va_arg(ap, int);
59627 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
59628 + break;
59629 + case GR_FILENAME_TWO_INT_STR:
59630 + dentry = va_arg(ap, struct dentry *);
59631 + mnt = va_arg(ap, struct vfsmount *);
59632 + num1 = va_arg(ap, int);
59633 + num2 = va_arg(ap, int);
59634 + str1 = va_arg(ap, char *);
59635 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
59636 + break;
59637 + case GR_TEXTREL:
59638 + file = va_arg(ap, struct file *);
59639 + ulong1 = va_arg(ap, unsigned long);
59640 + ulong2 = va_arg(ap, unsigned long);
59641 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
59642 + break;
59643 + case GR_PTRACE:
59644 + task = va_arg(ap, struct task_struct *);
59645 + gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
59646 + break;
59647 + case GR_RESOURCE:
59648 + task = va_arg(ap, struct task_struct *);
59649 + cred = __task_cred(task);
59650 + pcred = __task_cred(task->real_parent);
59651 + ulong1 = va_arg(ap, unsigned long);
59652 + str1 = va_arg(ap, char *);
59653 + ulong2 = va_arg(ap, unsigned long);
59654 + gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
59655 + break;
59656 + case GR_CAP:
59657 + task = va_arg(ap, struct task_struct *);
59658 + cred = __task_cred(task);
59659 + pcred = __task_cred(task->real_parent);
59660 + str1 = va_arg(ap, char *);
59661 + gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
59662 + break;
59663 + case GR_SIG:
59664 + str1 = va_arg(ap, char *);
59665 + voidptr = va_arg(ap, void *);
59666 + gr_log_middle_varargs(audit, msg, str1, voidptr);
59667 + break;
59668 + case GR_SIG2:
59669 + task = va_arg(ap, struct task_struct *);
59670 + cred = __task_cred(task);
59671 + pcred = __task_cred(task->real_parent);
59672 + num1 = va_arg(ap, int);
59673 + gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
59674 + break;
59675 + case GR_CRASH1:
59676 + task = va_arg(ap, struct task_struct *);
59677 + cred = __task_cred(task);
59678 + pcred = __task_cred(task->real_parent);
59679 + ulong1 = va_arg(ap, unsigned long);
59680 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
59681 + break;
59682 + case GR_CRASH2:
59683 + task = va_arg(ap, struct task_struct *);
59684 + cred = __task_cred(task);
59685 + pcred = __task_cred(task->real_parent);
59686 + ulong1 = va_arg(ap, unsigned long);
59687 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
59688 + break;
59689 + case GR_RWXMAP:
59690 + file = va_arg(ap, struct file *);
59691 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
59692 + break;
59693 + case GR_PSACCT:
59694 + {
59695 + unsigned int wday, cday;
59696 + __u8 whr, chr;
59697 + __u8 wmin, cmin;
59698 + __u8 wsec, csec;
59699 + char cur_tty[64] = { 0 };
59700 + char parent_tty[64] = { 0 };
59701 +
59702 + task = va_arg(ap, struct task_struct *);
59703 + wday = va_arg(ap, unsigned int);
59704 + cday = va_arg(ap, unsigned int);
59705 + whr = va_arg(ap, int);
59706 + chr = va_arg(ap, int);
59707 + wmin = va_arg(ap, int);
59708 + cmin = va_arg(ap, int);
59709 + wsec = va_arg(ap, int);
59710 + csec = va_arg(ap, int);
59711 + ulong1 = va_arg(ap, unsigned long);
59712 + cred = __task_cred(task);
59713 + pcred = __task_cred(task->real_parent);
59714 +
59715 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
59716 + }
59717 + break;
59718 + default:
59719 + gr_log_middle(audit, msg, ap);
59720 + }
59721 + va_end(ap);
59722 + // these don't need DEFAULTSECARGS printed on the end
59723 + if (argtypes == GR_CRASH1 || argtypes == GR_CRASH2)
59724 + gr_log_end(audit, 0);
59725 + else
59726 + gr_log_end(audit, 1);
59727 + END_LOCKS(audit);
59728 +}
59729 diff -urNp linux-2.6.32.49/grsecurity/grsec_mem.c linux-2.6.32.49/grsecurity/grsec_mem.c
59730 --- linux-2.6.32.49/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
59731 +++ linux-2.6.32.49/grsecurity/grsec_mem.c 2011-11-15 19:59:43.000000000 -0500
59732 @@ -0,0 +1,33 @@
59733 +#include <linux/kernel.h>
59734 +#include <linux/sched.h>
59735 +#include <linux/mm.h>
59736 +#include <linux/mman.h>
59737 +#include <linux/grinternal.h>
59738 +
59739 +void
59740 +gr_handle_ioperm(void)
59741 +{
59742 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
59743 + return;
59744 +}
59745 +
59746 +void
59747 +gr_handle_iopl(void)
59748 +{
59749 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
59750 + return;
59751 +}
59752 +
59753 +void
59754 +gr_handle_mem_readwrite(u64 from, u64 to)
59755 +{
59756 + gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
59757 + return;
59758 +}
59759 +
59760 +void
59761 +gr_handle_vm86(void)
59762 +{
59763 + gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
59764 + return;
59765 +}
59766 diff -urNp linux-2.6.32.49/grsecurity/grsec_mount.c linux-2.6.32.49/grsecurity/grsec_mount.c
59767 --- linux-2.6.32.49/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500
59768 +++ linux-2.6.32.49/grsecurity/grsec_mount.c 2011-11-15 19:59:43.000000000 -0500
59769 @@ -0,0 +1,62 @@
59770 +#include <linux/kernel.h>
59771 +#include <linux/sched.h>
59772 +#include <linux/mount.h>
59773 +#include <linux/grsecurity.h>
59774 +#include <linux/grinternal.h>
59775 +
59776 +void
59777 +gr_log_remount(const char *devname, const int retval)
59778 +{
59779 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59780 + if (grsec_enable_mount && (retval >= 0))
59781 + gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
59782 +#endif
59783 + return;
59784 +}
59785 +
59786 +void
59787 +gr_log_unmount(const char *devname, const int retval)
59788 +{
59789 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59790 + if (grsec_enable_mount && (retval >= 0))
59791 + gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
59792 +#endif
59793 + return;
59794 +}
59795 +
59796 +void
59797 +gr_log_mount(const char *from, const char *to, const int retval)
59798 +{
59799 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59800 + if (grsec_enable_mount && (retval >= 0))
59801 + gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
59802 +#endif
59803 + return;
59804 +}
59805 +
59806 +int
59807 +gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
59808 +{
59809 +#ifdef CONFIG_GRKERNSEC_ROFS
59810 + if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
59811 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
59812 + return -EPERM;
59813 + } else
59814 + return 0;
59815 +#endif
59816 + return 0;
59817 +}
59818 +
59819 +int
59820 +gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
59821 +{
59822 +#ifdef CONFIG_GRKERNSEC_ROFS
59823 + if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
59824 + dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
59825 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
59826 + return -EPERM;
59827 + } else
59828 + return 0;
59829 +#endif
59830 + return 0;
59831 +}
59832 diff -urNp linux-2.6.32.49/grsecurity/grsec_pax.c linux-2.6.32.49/grsecurity/grsec_pax.c
59833 --- linux-2.6.32.49/grsecurity/grsec_pax.c 1969-12-31 19:00:00.000000000 -0500
59834 +++ linux-2.6.32.49/grsecurity/grsec_pax.c 2011-11-15 19:59:43.000000000 -0500
59835 @@ -0,0 +1,36 @@
59836 +#include <linux/kernel.h>
59837 +#include <linux/sched.h>
59838 +#include <linux/mm.h>
59839 +#include <linux/file.h>
59840 +#include <linux/grinternal.h>
59841 +#include <linux/grsecurity.h>
59842 +
59843 +void
59844 +gr_log_textrel(struct vm_area_struct * vma)
59845 +{
59846 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59847 + if (grsec_enable_audit_textrel)
59848 + gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
59849 +#endif
59850 + return;
59851 +}
59852 +
59853 +void
59854 +gr_log_rwxmmap(struct file *file)
59855 +{
59856 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
59857 + if (grsec_enable_log_rwxmaps)
59858 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
59859 +#endif
59860 + return;
59861 +}
59862 +
59863 +void
59864 +gr_log_rwxmprotect(struct file *file)
59865 +{
59866 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
59867 + if (grsec_enable_log_rwxmaps)
59868 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
59869 +#endif
59870 + return;
59871 +}
59872 diff -urNp linux-2.6.32.49/grsecurity/grsec_ptrace.c linux-2.6.32.49/grsecurity/grsec_ptrace.c
59873 --- linux-2.6.32.49/grsecurity/grsec_ptrace.c 1969-12-31 19:00:00.000000000 -0500
59874 +++ linux-2.6.32.49/grsecurity/grsec_ptrace.c 2011-11-15 19:59:43.000000000 -0500
59875 @@ -0,0 +1,14 @@
59876 +#include <linux/kernel.h>
59877 +#include <linux/sched.h>
59878 +#include <linux/grinternal.h>
59879 +#include <linux/grsecurity.h>
59880 +
59881 +void
59882 +gr_audit_ptrace(struct task_struct *task)
59883 +{
59884 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
59885 + if (grsec_enable_audit_ptrace)
59886 + gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
59887 +#endif
59888 + return;
59889 +}
59890 diff -urNp linux-2.6.32.49/grsecurity/grsec_sig.c linux-2.6.32.49/grsecurity/grsec_sig.c
59891 --- linux-2.6.32.49/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
59892 +++ linux-2.6.32.49/grsecurity/grsec_sig.c 2011-11-15 19:59:43.000000000 -0500
59893 @@ -0,0 +1,205 @@
59894 +#include <linux/kernel.h>
59895 +#include <linux/sched.h>
59896 +#include <linux/delay.h>
59897 +#include <linux/grsecurity.h>
59898 +#include <linux/grinternal.h>
59899 +#include <linux/hardirq.h>
59900 +
59901 +char *signames[] = {
59902 + [SIGSEGV] = "Segmentation fault",
59903 + [SIGILL] = "Illegal instruction",
59904 + [SIGABRT] = "Abort",
59905 + [SIGBUS] = "Invalid alignment/Bus error"
59906 +};
59907 +
59908 +void
59909 +gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
59910 +{
59911 +#ifdef CONFIG_GRKERNSEC_SIGNAL
59912 + if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
59913 + (sig == SIGABRT) || (sig == SIGBUS))) {
59914 + if (t->pid == current->pid) {
59915 + gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
59916 + } else {
59917 + gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
59918 + }
59919 + }
59920 +#endif
59921 + return;
59922 +}
59923 +
59924 +int
59925 +gr_handle_signal(const struct task_struct *p, const int sig)
59926 +{
59927 +#ifdef CONFIG_GRKERNSEC
59928 + if (current->pid > 1 && gr_check_protected_task(p)) {
59929 + gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
59930 + return -EPERM;
59931 + } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
59932 + return -EPERM;
59933 + }
59934 +#endif
59935 + return 0;
59936 +}
59937 +
59938 +#ifdef CONFIG_GRKERNSEC
59939 +extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
59940 +
59941 +int gr_fake_force_sig(int sig, struct task_struct *t)
59942 +{
59943 + unsigned long int flags;
59944 + int ret, blocked, ignored;
59945 + struct k_sigaction *action;
59946 +
59947 + spin_lock_irqsave(&t->sighand->siglock, flags);
59948 + action = &t->sighand->action[sig-1];
59949 + ignored = action->sa.sa_handler == SIG_IGN;
59950 + blocked = sigismember(&t->blocked, sig);
59951 + if (blocked || ignored) {
59952 + action->sa.sa_handler = SIG_DFL;
59953 + if (blocked) {
59954 + sigdelset(&t->blocked, sig);
59955 + recalc_sigpending_and_wake(t);
59956 + }
59957 + }
59958 + if (action->sa.sa_handler == SIG_DFL)
59959 + t->signal->flags &= ~SIGNAL_UNKILLABLE;
59960 + ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
59961 +
59962 + spin_unlock_irqrestore(&t->sighand->siglock, flags);
59963 +
59964 + return ret;
59965 +}
59966 +#endif
59967 +
59968 +#ifdef CONFIG_GRKERNSEC_BRUTE
59969 +#define GR_USER_BAN_TIME (15 * 60)
59970 +
59971 +static int __get_dumpable(unsigned long mm_flags)
59972 +{
59973 + int ret;
59974 +
59975 + ret = mm_flags & MMF_DUMPABLE_MASK;
59976 + return (ret >= 2) ? 2 : ret;
59977 +}
59978 +#endif
59979 +
59980 +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
59981 +{
59982 +#ifdef CONFIG_GRKERNSEC_BRUTE
59983 + uid_t uid = 0;
59984 +
59985 + if (!grsec_enable_brute)
59986 + return;
59987 +
59988 + rcu_read_lock();
59989 + read_lock(&tasklist_lock);
59990 + read_lock(&grsec_exec_file_lock);
59991 + if (p->real_parent && p->real_parent->exec_file == p->exec_file)
59992 + p->real_parent->brute = 1;
59993 + else {
59994 + const struct cred *cred = __task_cred(p), *cred2;
59995 + struct task_struct *tsk, *tsk2;
59996 +
59997 + if (!__get_dumpable(mm_flags) && cred->uid) {
59998 + struct user_struct *user;
59999 +
60000 + uid = cred->uid;
60001 +
60002 + /* this is put upon execution past expiration */
60003 + user = find_user(uid);
60004 + if (user == NULL)
60005 + goto unlock;
60006 + user->banned = 1;
60007 + user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
60008 + if (user->ban_expires == ~0UL)
60009 + user->ban_expires--;
60010 +
60011 + do_each_thread(tsk2, tsk) {
60012 + cred2 = __task_cred(tsk);
60013 + if (tsk != p && cred2->uid == uid)
60014 + gr_fake_force_sig(SIGKILL, tsk);
60015 + } while_each_thread(tsk2, tsk);
60016 + }
60017 + }
60018 +unlock:
60019 + read_unlock(&grsec_exec_file_lock);
60020 + read_unlock(&tasklist_lock);
60021 + rcu_read_unlock();
60022 +
60023 + if (uid)
60024 + printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
60025 +#endif
60026 + return;
60027 +}
60028 +
60029 +void gr_handle_brute_check(void)
60030 +{
60031 +#ifdef CONFIG_GRKERNSEC_BRUTE
60032 + if (current->brute)
60033 + msleep(30 * 1000);
60034 +#endif
60035 + return;
60036 +}
60037 +
60038 +void gr_handle_kernel_exploit(void)
60039 +{
60040 +#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
60041 + const struct cred *cred;
60042 + struct task_struct *tsk, *tsk2;
60043 + struct user_struct *user;
60044 + uid_t uid;
60045 +
60046 + if (in_irq() || in_serving_softirq() || in_nmi())
60047 + panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
60048 +
60049 + uid = current_uid();
60050 +
60051 + if (uid == 0)
60052 + panic("grsec: halting the system due to suspicious kernel crash caused by root");
60053 + else {
60054 + /* kill all the processes of this user, hold a reference
60055 + to their creds struct, and prevent them from creating
60056 + another process until system reset
60057 + */
60058 + printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
60059 + /* we intentionally leak this ref */
60060 + user = get_uid(current->cred->user);
60061 + if (user) {
60062 + user->banned = 1;
60063 + user->ban_expires = ~0UL;
60064 + }
60065 +
60066 + read_lock(&tasklist_lock);
60067 + do_each_thread(tsk2, tsk) {
60068 + cred = __task_cred(tsk);
60069 + if (cred->uid == uid)
60070 + gr_fake_force_sig(SIGKILL, tsk);
60071 + } while_each_thread(tsk2, tsk);
60072 + read_unlock(&tasklist_lock);
60073 + }
60074 +#endif
60075 +}
60076 +
60077 +int __gr_process_user_ban(struct user_struct *user)
60078 +{
60079 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
60080 + if (unlikely(user->banned)) {
60081 + if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
60082 + user->banned = 0;
60083 + user->ban_expires = 0;
60084 + free_uid(user);
60085 + } else
60086 + return -EPERM;
60087 + }
60088 +#endif
60089 + return 0;
60090 +}
60091 +
60092 +int gr_process_user_ban(void)
60093 +{
60094 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
60095 + return __gr_process_user_ban(current->cred->user);
60096 +#endif
60097 + return 0;
60098 +}
60099 diff -urNp linux-2.6.32.49/grsecurity/grsec_sock.c linux-2.6.32.49/grsecurity/grsec_sock.c
60100 --- linux-2.6.32.49/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500
60101 +++ linux-2.6.32.49/grsecurity/grsec_sock.c 2011-11-15 19:59:43.000000000 -0500
60102 @@ -0,0 +1,275 @@
60103 +#include <linux/kernel.h>
60104 +#include <linux/module.h>
60105 +#include <linux/sched.h>
60106 +#include <linux/file.h>
60107 +#include <linux/net.h>
60108 +#include <linux/in.h>
60109 +#include <linux/ip.h>
60110 +#include <net/sock.h>
60111 +#include <net/inet_sock.h>
60112 +#include <linux/grsecurity.h>
60113 +#include <linux/grinternal.h>
60114 +#include <linux/gracl.h>
60115 +
60116 +kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
60117 +EXPORT_SYMBOL(gr_cap_rtnetlink);
60118 +
60119 +extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
60120 +extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
60121 +
60122 +EXPORT_SYMBOL(gr_search_udp_recvmsg);
60123 +EXPORT_SYMBOL(gr_search_udp_sendmsg);
60124 +
60125 +#ifdef CONFIG_UNIX_MODULE
60126 +EXPORT_SYMBOL(gr_acl_handle_unix);
60127 +EXPORT_SYMBOL(gr_acl_handle_mknod);
60128 +EXPORT_SYMBOL(gr_handle_chroot_unix);
60129 +EXPORT_SYMBOL(gr_handle_create);
60130 +#endif
60131 +
60132 +#ifdef CONFIG_GRKERNSEC
60133 +#define gr_conn_table_size 32749
60134 +struct conn_table_entry {
60135 + struct conn_table_entry *next;
60136 + struct signal_struct *sig;
60137 +};
60138 +
60139 +struct conn_table_entry *gr_conn_table[gr_conn_table_size];
60140 +DEFINE_SPINLOCK(gr_conn_table_lock);
60141 +
60142 +extern const char * gr_socktype_to_name(unsigned char type);
60143 +extern const char * gr_proto_to_name(unsigned char proto);
60144 +extern const char * gr_sockfamily_to_name(unsigned char family);
60145 +
60146 +static __inline__ int
60147 +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
60148 +{
60149 + return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
60150 +}
60151 +
60152 +static __inline__ int
60153 +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
60154 + __u16 sport, __u16 dport)
60155 +{
60156 + if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
60157 + sig->gr_sport == sport && sig->gr_dport == dport))
60158 + return 1;
60159 + else
60160 + return 0;
60161 +}
60162 +
60163 +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
60164 +{
60165 + struct conn_table_entry **match;
60166 + unsigned int index;
60167 +
60168 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
60169 + sig->gr_sport, sig->gr_dport,
60170 + gr_conn_table_size);
60171 +
60172 + newent->sig = sig;
60173 +
60174 + match = &gr_conn_table[index];
60175 + newent->next = *match;
60176 + *match = newent;
60177 +
60178 + return;
60179 +}
60180 +
60181 +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
60182 +{
60183 + struct conn_table_entry *match, *last = NULL;
60184 + unsigned int index;
60185 +
60186 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
60187 + sig->gr_sport, sig->gr_dport,
60188 + gr_conn_table_size);
60189 +
60190 + match = gr_conn_table[index];
60191 + while (match && !conn_match(match->sig,
60192 + sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
60193 + sig->gr_dport)) {
60194 + last = match;
60195 + match = match->next;
60196 + }
60197 +
60198 + if (match) {
60199 + if (last)
60200 + last->next = match->next;
60201 + else
60202 + gr_conn_table[index] = NULL;
60203 + kfree(match);
60204 + }
60205 +
60206 + return;
60207 +}
60208 +
60209 +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
60210 + __u16 sport, __u16 dport)
60211 +{
60212 + struct conn_table_entry *match;
60213 + unsigned int index;
60214 +
60215 + index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
60216 +
60217 + match = gr_conn_table[index];
60218 + while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
60219 + match = match->next;
60220 +
60221 + if (match)
60222 + return match->sig;
60223 + else
60224 + return NULL;
60225 +}
60226 +
60227 +#endif
60228 +
60229 +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
60230 +{
60231 +#ifdef CONFIG_GRKERNSEC
60232 + struct signal_struct *sig = task->signal;
60233 + struct conn_table_entry *newent;
60234 +
60235 + newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
60236 + if (newent == NULL)
60237 + return;
60238 + /* no bh lock needed since we are called with bh disabled */
60239 + spin_lock(&gr_conn_table_lock);
60240 + gr_del_task_from_ip_table_nolock(sig);
60241 + sig->gr_saddr = inet->rcv_saddr;
60242 + sig->gr_daddr = inet->daddr;
60243 + sig->gr_sport = inet->sport;
60244 + sig->gr_dport = inet->dport;
60245 + gr_add_to_task_ip_table_nolock(sig, newent);
60246 + spin_unlock(&gr_conn_table_lock);
60247 +#endif
60248 + return;
60249 +}
60250 +
60251 +void gr_del_task_from_ip_table(struct task_struct *task)
60252 +{
60253 +#ifdef CONFIG_GRKERNSEC
60254 + spin_lock_bh(&gr_conn_table_lock);
60255 + gr_del_task_from_ip_table_nolock(task->signal);
60256 + spin_unlock_bh(&gr_conn_table_lock);
60257 +#endif
60258 + return;
60259 +}
60260 +
60261 +void
60262 +gr_attach_curr_ip(const struct sock *sk)
60263 +{
60264 +#ifdef CONFIG_GRKERNSEC
60265 + struct signal_struct *p, *set;
60266 + const struct inet_sock *inet = inet_sk(sk);
60267 +
60268 + if (unlikely(sk->sk_protocol != IPPROTO_TCP))
60269 + return;
60270 +
60271 + set = current->signal;
60272 +
60273 + spin_lock_bh(&gr_conn_table_lock);
60274 + p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
60275 + inet->dport, inet->sport);
60276 + if (unlikely(p != NULL)) {
60277 + set->curr_ip = p->curr_ip;
60278 + set->used_accept = 1;
60279 + gr_del_task_from_ip_table_nolock(p);
60280 + spin_unlock_bh(&gr_conn_table_lock);
60281 + return;
60282 + }
60283 + spin_unlock_bh(&gr_conn_table_lock);
60284 +
60285 + set->curr_ip = inet->daddr;
60286 + set->used_accept = 1;
60287 +#endif
60288 + return;
60289 +}
60290 +
60291 +int
60292 +gr_handle_sock_all(const int family, const int type, const int protocol)
60293 +{
60294 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
60295 + if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
60296 + (family != AF_UNIX)) {
60297 + if (family == AF_INET)
60298 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
60299 + else
60300 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
60301 + return -EACCES;
60302 + }
60303 +#endif
60304 + return 0;
60305 +}
60306 +
60307 +int
60308 +gr_handle_sock_server(const struct sockaddr *sck)
60309 +{
60310 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
60311 + if (grsec_enable_socket_server &&
60312 + in_group_p(grsec_socket_server_gid) &&
60313 + sck && (sck->sa_family != AF_UNIX) &&
60314 + (sck->sa_family != AF_LOCAL)) {
60315 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
60316 + return -EACCES;
60317 + }
60318 +#endif
60319 + return 0;
60320 +}
60321 +
60322 +int
60323 +gr_handle_sock_server_other(const struct sock *sck)
60324 +{
60325 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
60326 + if (grsec_enable_socket_server &&
60327 + in_group_p(grsec_socket_server_gid) &&
60328 + sck && (sck->sk_family != AF_UNIX) &&
60329 + (sck->sk_family != AF_LOCAL)) {
60330 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
60331 + return -EACCES;
60332 + }
60333 +#endif
60334 + return 0;
60335 +}
60336 +
60337 +int
60338 +gr_handle_sock_client(const struct sockaddr *sck)
60339 +{
60340 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
60341 + if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
60342 + sck && (sck->sa_family != AF_UNIX) &&
60343 + (sck->sa_family != AF_LOCAL)) {
60344 + gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
60345 + return -EACCES;
60346 + }
60347 +#endif
60348 + return 0;
60349 +}
60350 +
60351 +kernel_cap_t
60352 +gr_cap_rtnetlink(struct sock *sock)
60353 +{
60354 +#ifdef CONFIG_GRKERNSEC
60355 + if (!gr_acl_is_enabled())
60356 + return current_cap();
60357 + else if (sock->sk_protocol == NETLINK_ISCSI &&
60358 + cap_raised(current_cap(), CAP_SYS_ADMIN) &&
60359 + gr_is_capable(CAP_SYS_ADMIN))
60360 + return current_cap();
60361 + else if (sock->sk_protocol == NETLINK_AUDIT &&
60362 + cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
60363 + gr_is_capable(CAP_AUDIT_WRITE) &&
60364 + cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
60365 + gr_is_capable(CAP_AUDIT_CONTROL))
60366 + return current_cap();
60367 + else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
60368 + ((sock->sk_protocol == NETLINK_ROUTE) ?
60369 + gr_is_capable_nolog(CAP_NET_ADMIN) :
60370 + gr_is_capable(CAP_NET_ADMIN)))
60371 + return current_cap();
60372 + else
60373 + return __cap_empty_set;
60374 +#else
60375 + return current_cap();
60376 +#endif
60377 +}
60378 diff -urNp linux-2.6.32.49/grsecurity/grsec_sysctl.c linux-2.6.32.49/grsecurity/grsec_sysctl.c
60379 --- linux-2.6.32.49/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500
60380 +++ linux-2.6.32.49/grsecurity/grsec_sysctl.c 2011-11-15 19:59:43.000000000 -0500
60381 @@ -0,0 +1,479 @@
60382 +#include <linux/kernel.h>
60383 +#include <linux/sched.h>
60384 +#include <linux/sysctl.h>
60385 +#include <linux/grsecurity.h>
60386 +#include <linux/grinternal.h>
60387 +
60388 +int
60389 +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
60390 +{
60391 +#ifdef CONFIG_GRKERNSEC_SYSCTL
60392 + if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
60393 + gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
60394 + return -EACCES;
60395 + }
60396 +#endif
60397 + return 0;
60398 +}
60399 +
60400 +#ifdef CONFIG_GRKERNSEC_ROFS
60401 +static int __maybe_unused one = 1;
60402 +#endif
60403 +
60404 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
60405 +ctl_table grsecurity_table[] = {
60406 +#ifdef CONFIG_GRKERNSEC_SYSCTL
60407 +#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
60408 +#ifdef CONFIG_GRKERNSEC_IO
60409 + {
60410 + .ctl_name = CTL_UNNUMBERED,
60411 + .procname = "disable_priv_io",
60412 + .data = &grsec_disable_privio,
60413 + .maxlen = sizeof(int),
60414 + .mode = 0600,
60415 + .proc_handler = &proc_dointvec,
60416 + },
60417 +#endif
60418 +#endif
60419 +#ifdef CONFIG_GRKERNSEC_LINK
60420 + {
60421 + .ctl_name = CTL_UNNUMBERED,
60422 + .procname = "linking_restrictions",
60423 + .data = &grsec_enable_link,
60424 + .maxlen = sizeof(int),
60425 + .mode = 0600,
60426 + .proc_handler = &proc_dointvec,
60427 + },
60428 +#endif
60429 +#ifdef CONFIG_GRKERNSEC_BRUTE
60430 + {
60431 + .ctl_name = CTL_UNNUMBERED,
60432 + .procname = "deter_bruteforce",
60433 + .data = &grsec_enable_brute,
60434 + .maxlen = sizeof(int),
60435 + .mode = 0600,
60436 + .proc_handler = &proc_dointvec,
60437 + },
60438 +#endif
60439 +#ifdef CONFIG_GRKERNSEC_FIFO
60440 + {
60441 + .ctl_name = CTL_UNNUMBERED,
60442 + .procname = "fifo_restrictions",
60443 + .data = &grsec_enable_fifo,
60444 + .maxlen = sizeof(int),
60445 + .mode = 0600,
60446 + .proc_handler = &proc_dointvec,
60447 + },
60448 +#endif
60449 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
60450 + {
60451 + .ctl_name = CTL_UNNUMBERED,
60452 + .procname = "ip_blackhole",
60453 + .data = &grsec_enable_blackhole,
60454 + .maxlen = sizeof(int),
60455 + .mode = 0600,
60456 + .proc_handler = &proc_dointvec,
60457 + },
60458 + {
60459 + .ctl_name = CTL_UNNUMBERED,
60460 + .procname = "lastack_retries",
60461 + .data = &grsec_lastack_retries,
60462 + .maxlen = sizeof(int),
60463 + .mode = 0600,
60464 + .proc_handler = &proc_dointvec,
60465 + },
60466 +#endif
60467 +#ifdef CONFIG_GRKERNSEC_EXECLOG
60468 + {
60469 + .ctl_name = CTL_UNNUMBERED,
60470 + .procname = "exec_logging",
60471 + .data = &grsec_enable_execlog,
60472 + .maxlen = sizeof(int),
60473 + .mode = 0600,
60474 + .proc_handler = &proc_dointvec,
60475 + },
60476 +#endif
60477 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
60478 + {
60479 + .ctl_name = CTL_UNNUMBERED,
60480 + .procname = "rwxmap_logging",
60481 + .data = &grsec_enable_log_rwxmaps,
60482 + .maxlen = sizeof(int),
60483 + .mode = 0600,
60484 + .proc_handler = &proc_dointvec,
60485 + },
60486 +#endif
60487 +#ifdef CONFIG_GRKERNSEC_SIGNAL
60488 + {
60489 + .ctl_name = CTL_UNNUMBERED,
60490 + .procname = "signal_logging",
60491 + .data = &grsec_enable_signal,
60492 + .maxlen = sizeof(int),
60493 + .mode = 0600,
60494 + .proc_handler = &proc_dointvec,
60495 + },
60496 +#endif
60497 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
60498 + {
60499 + .ctl_name = CTL_UNNUMBERED,
60500 + .procname = "forkfail_logging",
60501 + .data = &grsec_enable_forkfail,
60502 + .maxlen = sizeof(int),
60503 + .mode = 0600,
60504 + .proc_handler = &proc_dointvec,
60505 + },
60506 +#endif
60507 +#ifdef CONFIG_GRKERNSEC_TIME
60508 + {
60509 + .ctl_name = CTL_UNNUMBERED,
60510 + .procname = "timechange_logging",
60511 + .data = &grsec_enable_time,
60512 + .maxlen = sizeof(int),
60513 + .mode = 0600,
60514 + .proc_handler = &proc_dointvec,
60515 + },
60516 +#endif
60517 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
60518 + {
60519 + .ctl_name = CTL_UNNUMBERED,
60520 + .procname = "chroot_deny_shmat",
60521 + .data = &grsec_enable_chroot_shmat,
60522 + .maxlen = sizeof(int),
60523 + .mode = 0600,
60524 + .proc_handler = &proc_dointvec,
60525 + },
60526 +#endif
60527 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
60528 + {
60529 + .ctl_name = CTL_UNNUMBERED,
60530 + .procname = "chroot_deny_unix",
60531 + .data = &grsec_enable_chroot_unix,
60532 + .maxlen = sizeof(int),
60533 + .mode = 0600,
60534 + .proc_handler = &proc_dointvec,
60535 + },
60536 +#endif
60537 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
60538 + {
60539 + .ctl_name = CTL_UNNUMBERED,
60540 + .procname = "chroot_deny_mount",
60541 + .data = &grsec_enable_chroot_mount,
60542 + .maxlen = sizeof(int),
60543 + .mode = 0600,
60544 + .proc_handler = &proc_dointvec,
60545 + },
60546 +#endif
60547 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
60548 + {
60549 + .ctl_name = CTL_UNNUMBERED,
60550 + .procname = "chroot_deny_fchdir",
60551 + .data = &grsec_enable_chroot_fchdir,
60552 + .maxlen = sizeof(int),
60553 + .mode = 0600,
60554 + .proc_handler = &proc_dointvec,
60555 + },
60556 +#endif
60557 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
60558 + {
60559 + .ctl_name = CTL_UNNUMBERED,
60560 + .procname = "chroot_deny_chroot",
60561 + .data = &grsec_enable_chroot_double,
60562 + .maxlen = sizeof(int),
60563 + .mode = 0600,
60564 + .proc_handler = &proc_dointvec,
60565 + },
60566 +#endif
60567 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
60568 + {
60569 + .ctl_name = CTL_UNNUMBERED,
60570 + .procname = "chroot_deny_pivot",
60571 + .data = &grsec_enable_chroot_pivot,
60572 + .maxlen = sizeof(int),
60573 + .mode = 0600,
60574 + .proc_handler = &proc_dointvec,
60575 + },
60576 +#endif
60577 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
60578 + {
60579 + .ctl_name = CTL_UNNUMBERED,
60580 + .procname = "chroot_enforce_chdir",
60581 + .data = &grsec_enable_chroot_chdir,
60582 + .maxlen = sizeof(int),
60583 + .mode = 0600,
60584 + .proc_handler = &proc_dointvec,
60585 + },
60586 +#endif
60587 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
60588 + {
60589 + .ctl_name = CTL_UNNUMBERED,
60590 + .procname = "chroot_deny_chmod",
60591 + .data = &grsec_enable_chroot_chmod,
60592 + .maxlen = sizeof(int),
60593 + .mode = 0600,
60594 + .proc_handler = &proc_dointvec,
60595 + },
60596 +#endif
60597 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
60598 + {
60599 + .ctl_name = CTL_UNNUMBERED,
60600 + .procname = "chroot_deny_mknod",
60601 + .data = &grsec_enable_chroot_mknod,
60602 + .maxlen = sizeof(int),
60603 + .mode = 0600,
60604 + .proc_handler = &proc_dointvec,
60605 + },
60606 +#endif
60607 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
60608 + {
60609 + .ctl_name = CTL_UNNUMBERED,
60610 + .procname = "chroot_restrict_nice",
60611 + .data = &grsec_enable_chroot_nice,
60612 + .maxlen = sizeof(int),
60613 + .mode = 0600,
60614 + .proc_handler = &proc_dointvec,
60615 + },
60616 +#endif
60617 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
60618 + {
60619 + .ctl_name = CTL_UNNUMBERED,
60620 + .procname = "chroot_execlog",
60621 + .data = &grsec_enable_chroot_execlog,
60622 + .maxlen = sizeof(int),
60623 + .mode = 0600,
60624 + .proc_handler = &proc_dointvec,
60625 + },
60626 +#endif
60627 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
60628 + {
60629 + .ctl_name = CTL_UNNUMBERED,
60630 + .procname = "chroot_caps",
60631 + .data = &grsec_enable_chroot_caps,
60632 + .maxlen = sizeof(int),
60633 + .mode = 0600,
60634 + .proc_handler = &proc_dointvec,
60635 + },
60636 +#endif
60637 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
60638 + {
60639 + .ctl_name = CTL_UNNUMBERED,
60640 + .procname = "chroot_deny_sysctl",
60641 + .data = &grsec_enable_chroot_sysctl,
60642 + .maxlen = sizeof(int),
60643 + .mode = 0600,
60644 + .proc_handler = &proc_dointvec,
60645 + },
60646 +#endif
60647 +#ifdef CONFIG_GRKERNSEC_TPE
60648 + {
60649 + .ctl_name = CTL_UNNUMBERED,
60650 + .procname = "tpe",
60651 + .data = &grsec_enable_tpe,
60652 + .maxlen = sizeof(int),
60653 + .mode = 0600,
60654 + .proc_handler = &proc_dointvec,
60655 + },
60656 + {
60657 + .ctl_name = CTL_UNNUMBERED,
60658 + .procname = "tpe_gid",
60659 + .data = &grsec_tpe_gid,
60660 + .maxlen = sizeof(int),
60661 + .mode = 0600,
60662 + .proc_handler = &proc_dointvec,
60663 + },
60664 +#endif
60665 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
60666 + {
60667 + .ctl_name = CTL_UNNUMBERED,
60668 + .procname = "tpe_invert",
60669 + .data = &grsec_enable_tpe_invert,
60670 + .maxlen = sizeof(int),
60671 + .mode = 0600,
60672 + .proc_handler = &proc_dointvec,
60673 + },
60674 +#endif
60675 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
60676 + {
60677 + .ctl_name = CTL_UNNUMBERED,
60678 + .procname = "tpe_restrict_all",
60679 + .data = &grsec_enable_tpe_all,
60680 + .maxlen = sizeof(int),
60681 + .mode = 0600,
60682 + .proc_handler = &proc_dointvec,
60683 + },
60684 +#endif
60685 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
60686 + {
60687 + .ctl_name = CTL_UNNUMBERED,
60688 + .procname = "socket_all",
60689 + .data = &grsec_enable_socket_all,
60690 + .maxlen = sizeof(int),
60691 + .mode = 0600,
60692 + .proc_handler = &proc_dointvec,
60693 + },
60694 + {
60695 + .ctl_name = CTL_UNNUMBERED,
60696 + .procname = "socket_all_gid",
60697 + .data = &grsec_socket_all_gid,
60698 + .maxlen = sizeof(int),
60699 + .mode = 0600,
60700 + .proc_handler = &proc_dointvec,
60701 + },
60702 +#endif
60703 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
60704 + {
60705 + .ctl_name = CTL_UNNUMBERED,
60706 + .procname = "socket_client",
60707 + .data = &grsec_enable_socket_client,
60708 + .maxlen = sizeof(int),
60709 + .mode = 0600,
60710 + .proc_handler = &proc_dointvec,
60711 + },
60712 + {
60713 + .ctl_name = CTL_UNNUMBERED,
60714 + .procname = "socket_client_gid",
60715 + .data = &grsec_socket_client_gid,
60716 + .maxlen = sizeof(int),
60717 + .mode = 0600,
60718 + .proc_handler = &proc_dointvec,
60719 + },
60720 +#endif
60721 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
60722 + {
60723 + .ctl_name = CTL_UNNUMBERED,
60724 + .procname = "socket_server",
60725 + .data = &grsec_enable_socket_server,
60726 + .maxlen = sizeof(int),
60727 + .mode = 0600,
60728 + .proc_handler = &proc_dointvec,
60729 + },
60730 + {
60731 + .ctl_name = CTL_UNNUMBERED,
60732 + .procname = "socket_server_gid",
60733 + .data = &grsec_socket_server_gid,
60734 + .maxlen = sizeof(int),
60735 + .mode = 0600,
60736 + .proc_handler = &proc_dointvec,
60737 + },
60738 +#endif
60739 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
60740 + {
60741 + .ctl_name = CTL_UNNUMBERED,
60742 + .procname = "audit_group",
60743 + .data = &grsec_enable_group,
60744 + .maxlen = sizeof(int),
60745 + .mode = 0600,
60746 + .proc_handler = &proc_dointvec,
60747 + },
60748 + {
60749 + .ctl_name = CTL_UNNUMBERED,
60750 + .procname = "audit_gid",
60751 + .data = &grsec_audit_gid,
60752 + .maxlen = sizeof(int),
60753 + .mode = 0600,
60754 + .proc_handler = &proc_dointvec,
60755 + },
60756 +#endif
60757 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
60758 + {
60759 + .ctl_name = CTL_UNNUMBERED,
60760 + .procname = "audit_chdir",
60761 + .data = &grsec_enable_chdir,
60762 + .maxlen = sizeof(int),
60763 + .mode = 0600,
60764 + .proc_handler = &proc_dointvec,
60765 + },
60766 +#endif
60767 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
60768 + {
60769 + .ctl_name = CTL_UNNUMBERED,
60770 + .procname = "audit_mount",
60771 + .data = &grsec_enable_mount,
60772 + .maxlen = sizeof(int),
60773 + .mode = 0600,
60774 + .proc_handler = &proc_dointvec,
60775 + },
60776 +#endif
60777 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
60778 + {
60779 + .ctl_name = CTL_UNNUMBERED,
60780 + .procname = "audit_textrel",
60781 + .data = &grsec_enable_audit_textrel,
60782 + .maxlen = sizeof(int),
60783 + .mode = 0600,
60784 + .proc_handler = &proc_dointvec,
60785 + },
60786 +#endif
60787 +#ifdef CONFIG_GRKERNSEC_DMESG
60788 + {
60789 + .ctl_name = CTL_UNNUMBERED,
60790 + .procname = "dmesg",
60791 + .data = &grsec_enable_dmesg,
60792 + .maxlen = sizeof(int),
60793 + .mode = 0600,
60794 + .proc_handler = &proc_dointvec,
60795 + },
60796 +#endif
60797 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
60798 + {
60799 + .ctl_name = CTL_UNNUMBERED,
60800 + .procname = "chroot_findtask",
60801 + .data = &grsec_enable_chroot_findtask,
60802 + .maxlen = sizeof(int),
60803 + .mode = 0600,
60804 + .proc_handler = &proc_dointvec,
60805 + },
60806 +#endif
60807 +#ifdef CONFIG_GRKERNSEC_RESLOG
60808 + {
60809 + .ctl_name = CTL_UNNUMBERED,
60810 + .procname = "resource_logging",
60811 + .data = &grsec_resource_logging,
60812 + .maxlen = sizeof(int),
60813 + .mode = 0600,
60814 + .proc_handler = &proc_dointvec,
60815 + },
60816 +#endif
60817 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
60818 + {
60819 + .ctl_name = CTL_UNNUMBERED,
60820 + .procname = "audit_ptrace",
60821 + .data = &grsec_enable_audit_ptrace,
60822 + .maxlen = sizeof(int),
60823 + .mode = 0600,
60824 + .proc_handler = &proc_dointvec,
60825 + },
60826 +#endif
60827 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
60828 + {
60829 + .ctl_name = CTL_UNNUMBERED,
60830 + .procname = "harden_ptrace",
60831 + .data = &grsec_enable_harden_ptrace,
60832 + .maxlen = sizeof(int),
60833 + .mode = 0600,
60834 + .proc_handler = &proc_dointvec,
60835 + },
60836 +#endif
60837 + {
60838 + .ctl_name = CTL_UNNUMBERED,
60839 + .procname = "grsec_lock",
60840 + .data = &grsec_lock,
60841 + .maxlen = sizeof(int),
60842 + .mode = 0600,
60843 + .proc_handler = &proc_dointvec,
60844 + },
60845 +#endif
60846 +#ifdef CONFIG_GRKERNSEC_ROFS
60847 + {
60848 + .ctl_name = CTL_UNNUMBERED,
60849 + .procname = "romount_protect",
60850 + .data = &grsec_enable_rofs,
60851 + .maxlen = sizeof(int),
60852 + .mode = 0600,
60853 + .proc_handler = &proc_dointvec_minmax,
60854 + .extra1 = &one,
60855 + .extra2 = &one,
60856 + },
60857 +#endif
60858 + { .ctl_name = 0 }
60859 +};
60860 +#endif
60861 diff -urNp linux-2.6.32.49/grsecurity/grsec_time.c linux-2.6.32.49/grsecurity/grsec_time.c
60862 --- linux-2.6.32.49/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500
60863 +++ linux-2.6.32.49/grsecurity/grsec_time.c 2011-11-15 19:59:43.000000000 -0500
60864 @@ -0,0 +1,16 @@
60865 +#include <linux/kernel.h>
60866 +#include <linux/sched.h>
60867 +#include <linux/grinternal.h>
60868 +#include <linux/module.h>
60869 +
60870 +void
60871 +gr_log_timechange(void)
60872 +{
60873 +#ifdef CONFIG_GRKERNSEC_TIME
60874 + if (grsec_enable_time)
60875 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
60876 +#endif
60877 + return;
60878 +}
60879 +
60880 +EXPORT_SYMBOL(gr_log_timechange);
60881 diff -urNp linux-2.6.32.49/grsecurity/grsec_tpe.c linux-2.6.32.49/grsecurity/grsec_tpe.c
60882 --- linux-2.6.32.49/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
60883 +++ linux-2.6.32.49/grsecurity/grsec_tpe.c 2011-11-15 19:59:43.000000000 -0500
60884 @@ -0,0 +1,39 @@
60885 +#include <linux/kernel.h>
60886 +#include <linux/sched.h>
60887 +#include <linux/file.h>
60888 +#include <linux/fs.h>
60889 +#include <linux/grinternal.h>
60890 +
60891 +extern int gr_acl_tpe_check(void);
60892 +
60893 +int
60894 +gr_tpe_allow(const struct file *file)
60895 +{
60896 +#ifdef CONFIG_GRKERNSEC
60897 + struct inode *inode = file->f_path.dentry->d_parent->d_inode;
60898 + const struct cred *cred = current_cred();
60899 +
60900 + if (cred->uid && ((grsec_enable_tpe &&
60901 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
60902 + ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
60903 + (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
60904 +#else
60905 + in_group_p(grsec_tpe_gid)
60906 +#endif
60907 + ) || gr_acl_tpe_check()) &&
60908 + (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
60909 + (inode->i_mode & S_IWOTH))))) {
60910 + gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
60911 + return 0;
60912 + }
60913 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
60914 + if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
60915 + ((inode->i_uid && (inode->i_uid != cred->uid)) ||
60916 + (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
60917 + gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
60918 + return 0;
60919 + }
60920 +#endif
60921 +#endif
60922 + return 1;
60923 +}
60924 diff -urNp linux-2.6.32.49/grsecurity/grsum.c linux-2.6.32.49/grsecurity/grsum.c
60925 --- linux-2.6.32.49/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500
60926 +++ linux-2.6.32.49/grsecurity/grsum.c 2011-11-15 19:59:43.000000000 -0500
60927 @@ -0,0 +1,61 @@
60928 +#include <linux/err.h>
60929 +#include <linux/kernel.h>
60930 +#include <linux/sched.h>
60931 +#include <linux/mm.h>
60932 +#include <linux/scatterlist.h>
60933 +#include <linux/crypto.h>
60934 +#include <linux/gracl.h>
60935 +
60936 +
60937 +#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
60938 +#error "crypto and sha256 must be built into the kernel"
60939 +#endif
60940 +
60941 +int
60942 +chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
60943 +{
60944 + char *p;
60945 + struct crypto_hash *tfm;
60946 + struct hash_desc desc;
60947 + struct scatterlist sg;
60948 + unsigned char temp_sum[GR_SHA_LEN];
60949 + volatile int retval = 0;
60950 + volatile int dummy = 0;
60951 + unsigned int i;
60952 +
60953 + sg_init_table(&sg, 1);
60954 +
60955 + tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
60956 + if (IS_ERR(tfm)) {
60957 + /* should never happen, since sha256 should be built in */
60958 + return 1;
60959 + }
60960 +
60961 + desc.tfm = tfm;
60962 + desc.flags = 0;
60963 +
60964 + crypto_hash_init(&desc);
60965 +
60966 + p = salt;
60967 + sg_set_buf(&sg, p, GR_SALT_LEN);
60968 + crypto_hash_update(&desc, &sg, sg.length);
60969 +
60970 + p = entry->pw;
60971 + sg_set_buf(&sg, p, strlen(p));
60972 +
60973 + crypto_hash_update(&desc, &sg, sg.length);
60974 +
60975 + crypto_hash_final(&desc, temp_sum);
60976 +
60977 + memset(entry->pw, 0, GR_PW_LEN);
60978 +
60979 + for (i = 0; i < GR_SHA_LEN; i++)
60980 + if (sum[i] != temp_sum[i])
60981 + retval = 1;
60982 + else
60983 + dummy = 1; // waste a cycle
60984 +
60985 + crypto_free_hash(tfm);
60986 +
60987 + return retval;
60988 +}
60989 diff -urNp linux-2.6.32.49/grsecurity/Kconfig linux-2.6.32.49/grsecurity/Kconfig
60990 --- linux-2.6.32.49/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500
60991 +++ linux-2.6.32.49/grsecurity/Kconfig 2011-11-15 19:59:43.000000000 -0500
60992 @@ -0,0 +1,1036 @@
60993 +#
60994 +# grecurity configuration
60995 +#
60996 +
60997 +menu "Grsecurity"
60998 +
60999 +config GRKERNSEC
61000 + bool "Grsecurity"
61001 + select CRYPTO
61002 + select CRYPTO_SHA256
61003 + help
61004 + If you say Y here, you will be able to configure many features
61005 + that will enhance the security of your system. It is highly
61006 + recommended that you say Y here and read through the help
61007 + for each option so that you fully understand the features and
61008 + can evaluate their usefulness for your machine.
61009 +
61010 +choice
61011 + prompt "Security Level"
61012 + depends on GRKERNSEC
61013 + default GRKERNSEC_CUSTOM
61014 +
61015 +config GRKERNSEC_LOW
61016 + bool "Low"
61017 + select GRKERNSEC_LINK
61018 + select GRKERNSEC_FIFO
61019 + select GRKERNSEC_RANDNET
61020 + select GRKERNSEC_DMESG
61021 + select GRKERNSEC_CHROOT
61022 + select GRKERNSEC_CHROOT_CHDIR
61023 +
61024 + help
61025 + If you choose this option, several of the grsecurity options will
61026 + be enabled that will give you greater protection against a number
61027 + of attacks, while assuring that none of your software will have any
61028 + conflicts with the additional security measures. If you run a lot
61029 + of unusual software, or you are having problems with the higher
61030 + security levels, you should say Y here. With this option, the
61031 + following features are enabled:
61032 +
61033 + - Linking restrictions
61034 + - FIFO restrictions
61035 + - Restricted dmesg
61036 + - Enforced chdir("/") on chroot
61037 + - Runtime module disabling
61038 +
61039 +config GRKERNSEC_MEDIUM
61040 + bool "Medium"
61041 + select PAX
61042 + select PAX_EI_PAX
61043 + select PAX_PT_PAX_FLAGS
61044 + select PAX_HAVE_ACL_FLAGS
61045 + select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
61046 + select GRKERNSEC_CHROOT
61047 + select GRKERNSEC_CHROOT_SYSCTL
61048 + select GRKERNSEC_LINK
61049 + select GRKERNSEC_FIFO
61050 + select GRKERNSEC_DMESG
61051 + select GRKERNSEC_RANDNET
61052 + select GRKERNSEC_FORKFAIL
61053 + select GRKERNSEC_TIME
61054 + select GRKERNSEC_SIGNAL
61055 + select GRKERNSEC_CHROOT
61056 + select GRKERNSEC_CHROOT_UNIX
61057 + select GRKERNSEC_CHROOT_MOUNT
61058 + select GRKERNSEC_CHROOT_PIVOT
61059 + select GRKERNSEC_CHROOT_DOUBLE
61060 + select GRKERNSEC_CHROOT_CHDIR
61061 + select GRKERNSEC_CHROOT_MKNOD
61062 + select GRKERNSEC_PROC
61063 + select GRKERNSEC_PROC_USERGROUP
61064 + select PAX_RANDUSTACK
61065 + select PAX_ASLR
61066 + select PAX_RANDMMAP
61067 + select PAX_REFCOUNT if (X86 || SPARC64)
61068 + select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
61069 +
61070 + help
61071 + If you say Y here, several features in addition to those included
61072 + in the low additional security level will be enabled. These
61073 + features provide even more security to your system, though in rare
61074 + cases they may be incompatible with very old or poorly written
61075 + software. If you enable this option, make sure that your auth
61076 + service (identd) is running as gid 1001. With this option,
61077 + the following features (in addition to those provided in the
61078 + low additional security level) will be enabled:
61079 +
61080 + - Failed fork logging
61081 + - Time change logging
61082 + - Signal logging
61083 + - Deny mounts in chroot
61084 + - Deny double chrooting
61085 + - Deny sysctl writes in chroot
61086 + - Deny mknod in chroot
61087 + - Deny access to abstract AF_UNIX sockets out of chroot
61088 + - Deny pivot_root in chroot
61089 + - Denied reads/writes of /dev/kmem, /dev/mem, and /dev/port
61090 + - /proc restrictions with special GID set to 10 (usually wheel)
61091 + - Address Space Layout Randomization (ASLR)
61092 + - Prevent exploitation of most refcount overflows
61093 + - Bounds checking of copying between the kernel and userland
61094 +
61095 +config GRKERNSEC_HIGH
61096 + bool "High"
61097 + select GRKERNSEC_LINK
61098 + select GRKERNSEC_FIFO
61099 + select GRKERNSEC_DMESG
61100 + select GRKERNSEC_FORKFAIL
61101 + select GRKERNSEC_TIME
61102 + select GRKERNSEC_SIGNAL
61103 + select GRKERNSEC_CHROOT
61104 + select GRKERNSEC_CHROOT_SHMAT
61105 + select GRKERNSEC_CHROOT_UNIX
61106 + select GRKERNSEC_CHROOT_MOUNT
61107 + select GRKERNSEC_CHROOT_FCHDIR
61108 + select GRKERNSEC_CHROOT_PIVOT
61109 + select GRKERNSEC_CHROOT_DOUBLE
61110 + select GRKERNSEC_CHROOT_CHDIR
61111 + select GRKERNSEC_CHROOT_MKNOD
61112 + select GRKERNSEC_CHROOT_CAPS
61113 + select GRKERNSEC_CHROOT_SYSCTL
61114 + select GRKERNSEC_CHROOT_FINDTASK
61115 + select GRKERNSEC_SYSFS_RESTRICT
61116 + select GRKERNSEC_PROC
61117 + select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
61118 + select GRKERNSEC_HIDESYM
61119 + select GRKERNSEC_BRUTE
61120 + select GRKERNSEC_PROC_USERGROUP
61121 + select GRKERNSEC_KMEM
61122 + select GRKERNSEC_RESLOG
61123 + select GRKERNSEC_RANDNET
61124 + select GRKERNSEC_PROC_ADD
61125 + select GRKERNSEC_CHROOT_CHMOD
61126 + select GRKERNSEC_CHROOT_NICE
61127 + select GRKERNSEC_AUDIT_MOUNT
61128 + select GRKERNSEC_MODHARDEN if (MODULES)
61129 + select GRKERNSEC_HARDEN_PTRACE
61130 + select GRKERNSEC_VM86 if (X86_32)
61131 + select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC)
61132 + select PAX
61133 + select PAX_RANDUSTACK
61134 + select PAX_ASLR
61135 + select PAX_RANDMMAP
61136 + select PAX_NOEXEC
61137 + select PAX_MPROTECT
61138 + select PAX_EI_PAX
61139 + select PAX_PT_PAX_FLAGS
61140 + select PAX_HAVE_ACL_FLAGS
61141 + select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
61142 + select PAX_MEMORY_UDEREF if (X86 && !XEN)
61143 + select PAX_RANDKSTACK if (X86_TSC && X86)
61144 + select PAX_SEGMEXEC if (X86_32)
61145 + select PAX_PAGEEXEC
61146 + select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
61147 + select PAX_EMUTRAMP if (PARISC)
61148 + select PAX_EMUSIGRT if (PARISC)
61149 + select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
61150 + select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
61151 + select PAX_REFCOUNT if (X86 || SPARC64)
61152 + select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
61153 + help
61154 + If you say Y here, many of the features of grsecurity will be
61155 + enabled, which will protect you against many kinds of attacks
61156 + against your system. The heightened security comes at a cost
61157 + of an increased chance of incompatibilities with rare software
61158 + on your machine. Since this security level enables PaX, you should
61159 + view <http://pax.grsecurity.net> and read about the PaX
61160 + project. While you are there, download chpax and run it on
61161 + binaries that cause problems with PaX. Also remember that
61162 + since the /proc restrictions are enabled, you must run your
61163 + identd as gid 1001. This security level enables the following
61164 + features in addition to those listed in the low and medium
61165 + security levels:
61166 +
61167 + - Additional /proc restrictions
61168 + - Chmod restrictions in chroot
61169 + - No signals, ptrace, or viewing of processes outside of chroot
61170 + - Capability restrictions in chroot
61171 + - Deny fchdir out of chroot
61172 + - Priority restrictions in chroot
61173 + - Segmentation-based implementation of PaX
61174 + - Mprotect restrictions
61175 + - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
61176 + - Kernel stack randomization
61177 + - Mount/unmount/remount logging
61178 + - Kernel symbol hiding
61179 + - Hardening of module auto-loading
61180 + - Ptrace restrictions
61181 + - Restricted vm86 mode
61182 + - Restricted sysfs/debugfs
61183 + - Active kernel exploit response
61184 +
61185 +config GRKERNSEC_CUSTOM
61186 + bool "Custom"
61187 + help
61188 + If you say Y here, you will be able to configure every grsecurity
61189 + option, which allows you to enable many more features that aren't
61190 + covered in the basic security levels. These additional features
61191 + include TPE, socket restrictions, and the sysctl system for
61192 + grsecurity. It is advised that you read through the help for
61193 + each option to determine its usefulness in your situation.
61194 +
61195 +endchoice
61196 +
61197 +menu "Address Space Protection"
61198 +depends on GRKERNSEC
61199 +
61200 +config GRKERNSEC_KMEM
61201 + bool "Deny reading/writing to /dev/kmem, /dev/mem, and /dev/port"
61202 + select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
61203 + help
61204 + If you say Y here, /dev/kmem and /dev/mem won't be allowed to
61205 + be written to or read from to modify or leak the contents of the running
61206 + kernel. /dev/port will also not be allowed to be opened. If you have module
61207 + support disabled, enabling this will close up four ways that are
61208 + currently used to insert malicious code into the running kernel.
61209 + Even with all these features enabled, we still highly recommend that
61210 + you use the RBAC system, as it is still possible for an attacker to
61211 + modify the running kernel through privileged I/O granted by ioperm/iopl.
61212 + If you are not using XFree86, you may be able to stop this additional
61213 + case by enabling the 'Disable privileged I/O' option. Though nothing
61214 + legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
61215 + but only to video memory, which is the only writing we allow in this
61216 + case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
61217 + not be allowed to mprotect it with PROT_WRITE later.
61218 + It is highly recommended that you say Y here if you meet all the
61219 + conditions above.
61220 +
61221 +config GRKERNSEC_VM86
61222 + bool "Restrict VM86 mode"
61223 + depends on X86_32
61224 +
61225 + help
61226 + If you say Y here, only processes with CAP_SYS_RAWIO will be able to
61227 + make use of a special execution mode on 32bit x86 processors called
61228 + Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
61229 + video cards and will still work with this option enabled. The purpose
61230 + of the option is to prevent exploitation of emulation errors in
61231 + virtualization of vm86 mode like the one discovered in VMWare in 2009.
61232 + Nearly all users should be able to enable this option.
61233 +
61234 +config GRKERNSEC_IO
61235 + bool "Disable privileged I/O"
61236 + depends on X86
61237 + select RTC_CLASS
61238 + select RTC_INTF_DEV
61239 + select RTC_DRV_CMOS
61240 +
61241 + help
61242 + If you say Y here, all ioperm and iopl calls will return an error.
61243 + Ioperm and iopl can be used to modify the running kernel.
61244 + Unfortunately, some programs need this access to operate properly,
61245 + the most notable of which are XFree86 and hwclock. hwclock can be
61246 + remedied by having RTC support in the kernel, so real-time
61247 + clock support is enabled if this option is enabled, to ensure
61248 + that hwclock operates correctly. XFree86 still will not
61249 + operate correctly with this option enabled, so DO NOT CHOOSE Y
61250 + IF YOU USE XFree86. If you use XFree86 and you still want to
61251 + protect your kernel against modification, use the RBAC system.
61252 +
61253 +config GRKERNSEC_PROC_MEMMAP
61254 + bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
61255 + default y if (PAX_NOEXEC || PAX_ASLR)
61256 + depends on PAX_NOEXEC || PAX_ASLR
61257 + help
61258 + If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
61259 + give no information about the addresses of its mappings if
61260 + PaX features that rely on random addresses are enabled on the task.
61261 + If you use PaX it is greatly recommended that you say Y here as it
61262 + closes up a hole that makes the full ASLR useless for suid
61263 + binaries.
61264 +
61265 +config GRKERNSEC_BRUTE
61266 + bool "Deter exploit bruteforcing"
61267 + help
61268 + If you say Y here, attempts to bruteforce exploits against forking
61269 + daemons such as apache or sshd, as well as against suid/sgid binaries
61270 + will be deterred. When a child of a forking daemon is killed by PaX
61271 + or crashes due to an illegal instruction or other suspicious signal,
61272 + the parent process will be delayed 30 seconds upon every subsequent
61273 + fork until the administrator is able to assess the situation and
61274 + restart the daemon.
61275 + In the suid/sgid case, the attempt is logged, the user has all their
61276 + processes terminated, and they are prevented from executing any further
61277 + processes for 15 minutes.
61278 + It is recommended that you also enable signal logging in the auditing
61279 + section so that logs are generated when a process triggers a suspicious
61280 + signal.
61281 + If the sysctl option is enabled, a sysctl option with name
61282 + "deter_bruteforce" is created.
61283 +
61284 +config GRKERNSEC_MODHARDEN
61285 + bool "Harden module auto-loading"
61286 + depends on MODULES
61287 + help
61288 + If you say Y here, module auto-loading in response to use of some
61289 + feature implemented by an unloaded module will be restricted to
61290 + root users. Enabling this option helps defend against attacks
61291 + by unprivileged users who abuse the auto-loading behavior to
61292 + cause a vulnerable module to load that is then exploited.
61293 +
61294 + If this option prevents a legitimate use of auto-loading for a
61295 + non-root user, the administrator can execute modprobe manually
61296 + with the exact name of the module mentioned in the alert log.
61297 + Alternatively, the administrator can add the module to the list
61298 + of modules loaded at boot by modifying init scripts.
61299 +
61300 + Modification of init scripts will most likely be needed on
61301 + Ubuntu servers with encrypted home directory support enabled,
61302 + as the first non-root user logging in will cause the ecb(aes),
61303 + ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
61304 +
61305 +config GRKERNSEC_HIDESYM
61306 + bool "Hide kernel symbols"
61307 + help
61308 + If you say Y here, getting information on loaded modules, and
61309 + displaying all kernel symbols through a syscall will be restricted
61310 + to users with CAP_SYS_MODULE. For software compatibility reasons,
61311 + /proc/kallsyms will be restricted to the root user. The RBAC
61312 + system can hide that entry even from root.
61313 +
61314 + This option also prevents leaking of kernel addresses through
61315 + several /proc entries.
61316 +
61317 + Note that this option is only effective provided the following
61318 + conditions are met:
61319 + 1) The kernel using grsecurity is not precompiled by some distribution
61320 + 2) You have also enabled GRKERNSEC_DMESG
61321 + 3) You are using the RBAC system and hiding other files such as your
61322 + kernel image and System.map. Alternatively, enabling this option
61323 + causes the permissions on /boot, /lib/modules, and the kernel
61324 + source directory to change at compile time to prevent
61325 + reading by non-root users.
61326 + If the above conditions are met, this option will aid in providing a
61327 + useful protection against local kernel exploitation of overflows
61328 + and arbitrary read/write vulnerabilities.
61329 +
61330 +config GRKERNSEC_KERN_LOCKOUT
61331 + bool "Active kernel exploit response"
61332 + depends on X86 || ARM || PPC || SPARC
61333 + help
61334 + If you say Y here, when a PaX alert is triggered due to suspicious
61335 + activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
61336 + or an OOPs occurs due to bad memory accesses, instead of just
61337 + terminating the offending process (and potentially allowing
61338 + a subsequent exploit from the same user), we will take one of two
61339 + actions:
61340 + If the user was root, we will panic the system
61341 + If the user was non-root, we will log the attempt, terminate
61342 + all processes owned by the user, then prevent them from creating
61343 + any new processes until the system is restarted
61344 + This deters repeated kernel exploitation/bruteforcing attempts
61345 + and is useful for later forensics.
61346 +
61347 +endmenu
61348 +menu "Role Based Access Control Options"
61349 +depends on GRKERNSEC
61350 +
61351 +config GRKERNSEC_RBAC_DEBUG
61352 + bool
61353 +
61354 +config GRKERNSEC_NO_RBAC
61355 + bool "Disable RBAC system"
61356 + help
61357 + If you say Y here, the /dev/grsec device will be removed from the kernel,
61358 + preventing the RBAC system from being enabled. You should only say Y
61359 + here if you have no intention of using the RBAC system, so as to prevent
61360 + an attacker with root access from misusing the RBAC system to hide files
61361 + and processes when loadable module support and /dev/[k]mem have been
61362 + locked down.
61363 +
61364 +config GRKERNSEC_ACL_HIDEKERN
61365 + bool "Hide kernel processes"
61366 + help
61367 + If you say Y here, all kernel threads will be hidden to all
61368 + processes but those whose subject has the "view hidden processes"
61369 + flag.
61370 +
61371 +config GRKERNSEC_ACL_MAXTRIES
61372 + int "Maximum tries before password lockout"
61373 + default 3
61374 + help
61375 + This option enforces the maximum number of times a user can attempt
61376 + to authorize themselves with the grsecurity RBAC system before being
61377 + denied the ability to attempt authorization again for a specified time.
61378 + The lower the number, the harder it will be to brute-force a password.
61379 +
61380 +config GRKERNSEC_ACL_TIMEOUT
61381 + int "Time to wait after max password tries, in seconds"
61382 + default 30
61383 + help
61384 + This option specifies the time the user must wait after attempting to
61385 + authorize to the RBAC system with the maximum number of invalid
61386 + passwords. The higher the number, the harder it will be to brute-force
61387 + a password.
61388 +
61389 +endmenu
61390 +menu "Filesystem Protections"
61391 +depends on GRKERNSEC
61392 +
61393 +config GRKERNSEC_PROC
61394 + bool "Proc restrictions"
61395 + help
61396 + If you say Y here, the permissions of the /proc filesystem
61397 + will be altered to enhance system security and privacy. You MUST
61398 + choose either a user only restriction or a user and group restriction.
61399 + Depending upon the option you choose, you can either restrict users to
61400 + see only the processes they themselves run, or choose a group that can
61401 + view all processes and files normally restricted to root if you choose
61402 + the "restrict to user only" option. NOTE: If you're running identd as
61403 + a non-root user, you will have to run it as the group you specify here.
61404 +
61405 +config GRKERNSEC_PROC_USER
61406 + bool "Restrict /proc to user only"
61407 + depends on GRKERNSEC_PROC
61408 + help
61409 + If you say Y here, non-root users will only be able to view their own
61410 + processes, and restricts them from viewing network-related information,
61411 + and viewing kernel symbol and module information.
61412 +
61413 +config GRKERNSEC_PROC_USERGROUP
61414 + bool "Allow special group"
61415 + depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
61416 + help
61417 + If you say Y here, you will be able to select a group that will be
61418 + able to view all processes and network-related information. If you've
61419 + enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
61420 + remain hidden. This option is useful if you want to run identd as
61421 + a non-root user.
61422 +
61423 +config GRKERNSEC_PROC_GID
61424 + int "GID for special group"
61425 + depends on GRKERNSEC_PROC_USERGROUP
61426 + default 1001
61427 +
61428 +config GRKERNSEC_PROC_ADD
61429 + bool "Additional restrictions"
61430 + depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
61431 + help
61432 + If you say Y here, additional restrictions will be placed on
61433 + /proc that keep normal users from viewing device information and
61434 + slabinfo information that could be useful for exploits.
61435 +
61436 +config GRKERNSEC_LINK
61437 + bool "Linking restrictions"
61438 + help
61439 + If you say Y here, /tmp race exploits will be prevented, since users
61440 + will no longer be able to follow symlinks owned by other users in
61441 + world-writable +t directories (e.g. /tmp), unless the owner of the
61442 + symlink is the owner of the directory. users will also not be
61443 + able to hardlink to files they do not own. If the sysctl option is
61444 + enabled, a sysctl option with name "linking_restrictions" is created.
61445 +
61446 +config GRKERNSEC_FIFO
61447 + bool "FIFO restrictions"
61448 + help
61449 + If you say Y here, users will not be able to write to FIFOs they don't
61450 + own in world-writable +t directories (e.g. /tmp), unless the owner of
61451 + the FIFO is the same owner of the directory it's held in. If the sysctl
61452 + option is enabled, a sysctl option with name "fifo_restrictions" is
61453 + created.
61454 +
61455 +config GRKERNSEC_SYSFS_RESTRICT
61456 + bool "Sysfs/debugfs restriction"
61457 + depends on SYSFS
61458 + help
61459 + If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
61460 + any filesystem normally mounted under it (e.g. debugfs) will only
61461 + be accessible by root. These filesystems generally provide access
61462 + to hardware and debug information that isn't appropriate for unprivileged
61463 + users of the system. Sysfs and debugfs have also become a large source
61464 + of new vulnerabilities, ranging from infoleaks to local compromise.
61465 + There has been very little oversight with an eye toward security involved
61466 + in adding new exporters of information to these filesystems, so their
61467 + use is discouraged.
61468 + This option is equivalent to a chmod 0700 of the mount paths.
61469 +
61470 +config GRKERNSEC_ROFS
61471 + bool "Runtime read-only mount protection"
61472 + help
61473 + If you say Y here, a sysctl option with name "romount_protect" will
61474 + be created. By setting this option to 1 at runtime, filesystems
61475 + will be protected in the following ways:
61476 + * No new writable mounts will be allowed
61477 + * Existing read-only mounts won't be able to be remounted read/write
61478 + * Write operations will be denied on all block devices
61479 + This option acts independently of grsec_lock: once it is set to 1,
61480 + it cannot be turned off. Therefore, please be mindful of the resulting
61481 + behavior if this option is enabled in an init script on a read-only
61482 + filesystem. This feature is mainly intended for secure embedded systems.
61483 +
61484 +config GRKERNSEC_CHROOT
61485 + bool "Chroot jail restrictions"
61486 + help
61487 + If you say Y here, you will be able to choose several options that will
61488 + make breaking out of a chrooted jail much more difficult. If you
61489 + encounter no software incompatibilities with the following options, it
61490 + is recommended that you enable each one.
61491 +
61492 +config GRKERNSEC_CHROOT_MOUNT
61493 + bool "Deny mounts"
61494 + depends on GRKERNSEC_CHROOT
61495 + help
61496 + If you say Y here, processes inside a chroot will not be able to
61497 + mount or remount filesystems. If the sysctl option is enabled, a
61498 + sysctl option with name "chroot_deny_mount" is created.
61499 +
61500 +config GRKERNSEC_CHROOT_DOUBLE
61501 + bool "Deny double-chroots"
61502 + depends on GRKERNSEC_CHROOT
61503 + help
61504 + If you say Y here, processes inside a chroot will not be able to chroot
61505 + again outside the chroot. This is a widely used method of breaking
61506 + out of a chroot jail and should not be allowed. If the sysctl
61507 + option is enabled, a sysctl option with name
61508 + "chroot_deny_chroot" is created.
61509 +
61510 +config GRKERNSEC_CHROOT_PIVOT
61511 + bool "Deny pivot_root in chroot"
61512 + depends on GRKERNSEC_CHROOT
61513 + help
61514 + If you say Y here, processes inside a chroot will not be able to use
61515 + a function called pivot_root() that was introduced in Linux 2.3.41. It
61516 + works similar to chroot in that it changes the root filesystem. This
61517 + function could be misused in a chrooted process to attempt to break out
61518 + of the chroot, and therefore should not be allowed. If the sysctl
61519 + option is enabled, a sysctl option with name "chroot_deny_pivot" is
61520 + created.
61521 +
61522 +config GRKERNSEC_CHROOT_CHDIR
61523 + bool "Enforce chdir(\"/\") on all chroots"
61524 + depends on GRKERNSEC_CHROOT
61525 + help
61526 + If you say Y here, the current working directory of all newly-chrooted
61527 + applications will be set to the the root directory of the chroot.
61528 + The man page on chroot(2) states:
61529 + Note that this call does not change the current working
61530 + directory, so that `.' can be outside the tree rooted at
61531 + `/'. In particular, the super-user can escape from a
61532 + `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
61533 +
61534 + It is recommended that you say Y here, since it's not known to break
61535 + any software. If the sysctl option is enabled, a sysctl option with
61536 + name "chroot_enforce_chdir" is created.
61537 +
61538 +config GRKERNSEC_CHROOT_CHMOD
61539 + bool "Deny (f)chmod +s"
61540 + depends on GRKERNSEC_CHROOT
61541 + help
61542 + If you say Y here, processes inside a chroot will not be able to chmod
61543 + or fchmod files to make them have suid or sgid bits. This protects
61544 + against another published method of breaking a chroot. If the sysctl
61545 + option is enabled, a sysctl option with name "chroot_deny_chmod" is
61546 + created.
61547 +
61548 +config GRKERNSEC_CHROOT_FCHDIR
61549 + bool "Deny fchdir out of chroot"
61550 + depends on GRKERNSEC_CHROOT
61551 + help
61552 + If you say Y here, a well-known method of breaking chroots by fchdir'ing
61553 + to a file descriptor of the chrooting process that points to a directory
61554 + outside the filesystem will be stopped. If the sysctl option
61555 + is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
61556 +
61557 +config GRKERNSEC_CHROOT_MKNOD
61558 + bool "Deny mknod"
61559 + depends on GRKERNSEC_CHROOT
61560 + help
61561 + If you say Y here, processes inside a chroot will not be allowed to
61562 + mknod. The problem with using mknod inside a chroot is that it
61563 + would allow an attacker to create a device entry that is the same
61564 + as one on the physical root of your system, which could range from
61565 + anything from the console device to a device for your harddrive (which
61566 + they could then use to wipe the drive or steal data). It is recommended
61567 + that you say Y here, unless you run into software incompatibilities.
61568 + If the sysctl option is enabled, a sysctl option with name
61569 + "chroot_deny_mknod" is created.
61570 +
61571 +config GRKERNSEC_CHROOT_SHMAT
61572 + bool "Deny shmat() out of chroot"
61573 + depends on GRKERNSEC_CHROOT
61574 + help
61575 + If you say Y here, processes inside a chroot will not be able to attach
61576 + to shared memory segments that were created outside of the chroot jail.
61577 + It is recommended that you say Y here. If the sysctl option is enabled,
61578 + a sysctl option with name "chroot_deny_shmat" is created.
61579 +
61580 +config GRKERNSEC_CHROOT_UNIX
61581 + bool "Deny access to abstract AF_UNIX sockets out of chroot"
61582 + depends on GRKERNSEC_CHROOT
61583 + help
61584 + If you say Y here, processes inside a chroot will not be able to
61585 + connect to abstract (meaning not belonging to a filesystem) Unix
61586 + domain sockets that were bound outside of a chroot. It is recommended
61587 + that you say Y here. If the sysctl option is enabled, a sysctl option
61588 + with name "chroot_deny_unix" is created.
61589 +
61590 +config GRKERNSEC_CHROOT_FINDTASK
61591 + bool "Protect outside processes"
61592 + depends on GRKERNSEC_CHROOT
61593 + help
61594 + If you say Y here, processes inside a chroot will not be able to
61595 + kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
61596 + getsid, or view any process outside of the chroot. If the sysctl
61597 + option is enabled, a sysctl option with name "chroot_findtask" is
61598 + created.
61599 +
61600 +config GRKERNSEC_CHROOT_NICE
61601 + bool "Restrict priority changes"
61602 + depends on GRKERNSEC_CHROOT
61603 + help
61604 + If you say Y here, processes inside a chroot will not be able to raise
61605 + the priority of processes in the chroot, or alter the priority of
61606 + processes outside the chroot. This provides more security than simply
61607 + removing CAP_SYS_NICE from the process' capability set. If the
61608 + sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
61609 + is created.
61610 +
61611 +config GRKERNSEC_CHROOT_SYSCTL
61612 + bool "Deny sysctl writes"
61613 + depends on GRKERNSEC_CHROOT
61614 + help
61615 + If you say Y here, an attacker in a chroot will not be able to
61616 + write to sysctl entries, either by sysctl(2) or through a /proc
61617 + interface. It is strongly recommended that you say Y here. If the
61618 + sysctl option is enabled, a sysctl option with name
61619 + "chroot_deny_sysctl" is created.
61620 +
61621 +config GRKERNSEC_CHROOT_CAPS
61622 + bool "Capability restrictions"
61623 + depends on GRKERNSEC_CHROOT
61624 + help
61625 + If you say Y here, the capabilities on all processes within a
61626 + chroot jail will be lowered to stop module insertion, raw i/o,
61627 + system and net admin tasks, rebooting the system, modifying immutable
61628 + files, modifying IPC owned by another, and changing the system time.
61629 + This is left an option because it can break some apps. Disable this
61630 + if your chrooted apps are having problems performing those kinds of
61631 + tasks. If the sysctl option is enabled, a sysctl option with
61632 + name "chroot_caps" is created.
61633 +
61634 +endmenu
61635 +menu "Kernel Auditing"
61636 +depends on GRKERNSEC
61637 +
61638 +config GRKERNSEC_AUDIT_GROUP
61639 + bool "Single group for auditing"
61640 + help
61641 + If you say Y here, the exec, chdir, and (un)mount logging features
61642 + will only operate on a group you specify. This option is recommended
61643 + if you only want to watch certain users instead of having a large
61644 + amount of logs from the entire system. If the sysctl option is enabled,
61645 + a sysctl option with name "audit_group" is created.
61646 +
61647 +config GRKERNSEC_AUDIT_GID
61648 + int "GID for auditing"
61649 + depends on GRKERNSEC_AUDIT_GROUP
61650 + default 1007
61651 +
61652 +config GRKERNSEC_EXECLOG
61653 + bool "Exec logging"
61654 + help
61655 + If you say Y here, all execve() calls will be logged (since the
61656 + other exec*() calls are frontends to execve(), all execution
61657 + will be logged). Useful for shell-servers that like to keep track
61658 + of their users. If the sysctl option is enabled, a sysctl option with
61659 + name "exec_logging" is created.
61660 + WARNING: This option when enabled will produce a LOT of logs, especially
61661 + on an active system.
61662 +
61663 +config GRKERNSEC_RESLOG
61664 + bool "Resource logging"
61665 + help
61666 + If you say Y here, all attempts to overstep resource limits will
61667 + be logged with the resource name, the requested size, and the current
61668 + limit. It is highly recommended that you say Y here. If the sysctl
61669 + option is enabled, a sysctl option with name "resource_logging" is
61670 + created. If the RBAC system is enabled, the sysctl value is ignored.
61671 +
61672 +config GRKERNSEC_CHROOT_EXECLOG
61673 + bool "Log execs within chroot"
61674 + help
61675 + If you say Y here, all executions inside a chroot jail will be logged
61676 + to syslog. This can cause a large amount of logs if certain
61677 + applications (eg. djb's daemontools) are installed on the system, and
61678 + is therefore left as an option. If the sysctl option is enabled, a
61679 + sysctl option with name "chroot_execlog" is created.
61680 +
61681 +config GRKERNSEC_AUDIT_PTRACE
61682 + bool "Ptrace logging"
61683 + help
61684 + If you say Y here, all attempts to attach to a process via ptrace
61685 + will be logged. If the sysctl option is enabled, a sysctl option
61686 + with name "audit_ptrace" is created.
61687 +
61688 +config GRKERNSEC_AUDIT_CHDIR
61689 + bool "Chdir logging"
61690 + help
61691 + If you say Y here, all chdir() calls will be logged. If the sysctl
61692 + option is enabled, a sysctl option with name "audit_chdir" is created.
61693 +
61694 +config GRKERNSEC_AUDIT_MOUNT
61695 + bool "(Un)Mount logging"
61696 + help
61697 + If you say Y here, all mounts and unmounts will be logged. If the
61698 + sysctl option is enabled, a sysctl option with name "audit_mount" is
61699 + created.
61700 +
61701 +config GRKERNSEC_SIGNAL
61702 + bool "Signal logging"
61703 + help
61704 + If you say Y here, certain important signals will be logged, such as
61705 + SIGSEGV, which will as a result inform you of when a error in a program
61706 + occurred, which in some cases could mean a possible exploit attempt.
61707 + If the sysctl option is enabled, a sysctl option with name
61708 + "signal_logging" is created.
61709 +
61710 +config GRKERNSEC_FORKFAIL
61711 + bool "Fork failure logging"
61712 + help
61713 + If you say Y here, all failed fork() attempts will be logged.
61714 + This could suggest a fork bomb, or someone attempting to overstep
61715 + their process limit. If the sysctl option is enabled, a sysctl option
61716 + with name "forkfail_logging" is created.
61717 +
61718 +config GRKERNSEC_TIME
61719 + bool "Time change logging"
61720 + help
61721 + If you say Y here, any changes of the system clock will be logged.
61722 + If the sysctl option is enabled, a sysctl option with name
61723 + "timechange_logging" is created.
61724 +
61725 +config GRKERNSEC_PROC_IPADDR
61726 + bool "/proc/<pid>/ipaddr support"
61727 + help
61728 + If you say Y here, a new entry will be added to each /proc/<pid>
61729 + directory that contains the IP address of the person using the task.
61730 + The IP is carried across local TCP and AF_UNIX stream sockets.
61731 + This information can be useful for IDS/IPSes to perform remote response
61732 + to a local attack. The entry is readable by only the owner of the
61733 + process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
61734 + the RBAC system), and thus does not create privacy concerns.
61735 +
61736 +config GRKERNSEC_RWXMAP_LOG
61737 + bool 'Denied RWX mmap/mprotect logging'
61738 + depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
61739 + help
61740 + If you say Y here, calls to mmap() and mprotect() with explicit
61741 + usage of PROT_WRITE and PROT_EXEC together will be logged when
61742 + denied by the PAX_MPROTECT feature. If the sysctl option is
61743 + enabled, a sysctl option with name "rwxmap_logging" is created.
61744 +
61745 +config GRKERNSEC_AUDIT_TEXTREL
61746 + bool 'ELF text relocations logging (READ HELP)'
61747 + depends on PAX_MPROTECT
61748 + help
61749 + If you say Y here, text relocations will be logged with the filename
61750 + of the offending library or binary. The purpose of the feature is
61751 + to help Linux distribution developers get rid of libraries and
61752 + binaries that need text relocations which hinder the future progress
61753 + of PaX. Only Linux distribution developers should say Y here, and
61754 + never on a production machine, as this option creates an information
61755 + leak that could aid an attacker in defeating the randomization of
61756 + a single memory region. If the sysctl option is enabled, a sysctl
61757 + option with name "audit_textrel" is created.
61758 +
61759 +endmenu
61760 +
61761 +menu "Executable Protections"
61762 +depends on GRKERNSEC
61763 +
61764 +config GRKERNSEC_DMESG
61765 + bool "Dmesg(8) restriction"
61766 + help
61767 + If you say Y here, non-root users will not be able to use dmesg(8)
61768 + to view up to the last 4kb of messages in the kernel's log buffer.
61769 + The kernel's log buffer often contains kernel addresses and other
61770 + identifying information useful to an attacker in fingerprinting a
61771 + system for a targeted exploit.
61772 + If the sysctl option is enabled, a sysctl option with name "dmesg" is
61773 + created.
61774 +
61775 +config GRKERNSEC_HARDEN_PTRACE
61776 + bool "Deter ptrace-based process snooping"
61777 + help
61778 + If you say Y here, TTY sniffers and other malicious monitoring
61779 + programs implemented through ptrace will be defeated. If you
61780 + have been using the RBAC system, this option has already been
61781 + enabled for several years for all users, with the ability to make
61782 + fine-grained exceptions.
61783 +
61784 + This option only affects the ability of non-root users to ptrace
61785 + processes that are not a descendent of the ptracing process.
61786 + This means that strace ./binary and gdb ./binary will still work,
61787 + but attaching to arbitrary processes will not. If the sysctl
61788 + option is enabled, a sysctl option with name "harden_ptrace" is
61789 + created.
61790 +
61791 +config GRKERNSEC_TPE
61792 + bool "Trusted Path Execution (TPE)"
61793 + help
61794 + If you say Y here, you will be able to choose a gid to add to the
61795 + supplementary groups of users you want to mark as "untrusted."
61796 + These users will not be able to execute any files that are not in
61797 + root-owned directories writable only by root. If the sysctl option
61798 + is enabled, a sysctl option with name "tpe" is created.
61799 +
61800 +config GRKERNSEC_TPE_ALL
61801 + bool "Partially restrict all non-root users"
61802 + depends on GRKERNSEC_TPE
61803 + help
61804 + If you say Y here, all non-root users will be covered under
61805 + a weaker TPE restriction. This is separate from, and in addition to,
61806 + the main TPE options that you have selected elsewhere. Thus, if a
61807 + "trusted" GID is chosen, this restriction applies to even that GID.
61808 + Under this restriction, all non-root users will only be allowed to
61809 + execute files in directories they own that are not group or
61810 + world-writable, or in directories owned by root and writable only by
61811 + root. If the sysctl option is enabled, a sysctl option with name
61812 + "tpe_restrict_all" is created.
61813 +
61814 +config GRKERNSEC_TPE_INVERT
61815 + bool "Invert GID option"
61816 + depends on GRKERNSEC_TPE
61817 + help
61818 + If you say Y here, the group you specify in the TPE configuration will
61819 + decide what group TPE restrictions will be *disabled* for. This
61820 + option is useful if you want TPE restrictions to be applied to most
61821 + users on the system. If the sysctl option is enabled, a sysctl option
61822 + with name "tpe_invert" is created. Unlike other sysctl options, this
61823 + entry will default to on for backward-compatibility.
61824 +
61825 +config GRKERNSEC_TPE_GID
61826 + int "GID for untrusted users"
61827 + depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
61828 + default 1005
61829 + help
61830 + Setting this GID determines what group TPE restrictions will be
61831 + *enabled* for. If the sysctl option is enabled, a sysctl option
61832 + with name "tpe_gid" is created.
61833 +
61834 +config GRKERNSEC_TPE_GID
61835 + int "GID for trusted users"
61836 + depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
61837 + default 1005
61838 + help
61839 + Setting this GID determines what group TPE restrictions will be
61840 + *disabled* for. If the sysctl option is enabled, a sysctl option
61841 + with name "tpe_gid" is created.
61842 +
61843 +endmenu
61844 +menu "Network Protections"
61845 +depends on GRKERNSEC
61846 +
61847 +config GRKERNSEC_RANDNET
61848 + bool "Larger entropy pools"
61849 + help
61850 + If you say Y here, the entropy pools used for many features of Linux
61851 + and grsecurity will be doubled in size. Since several grsecurity
61852 + features use additional randomness, it is recommended that you say Y
61853 + here. Saying Y here has a similar effect as modifying
61854 + /proc/sys/kernel/random/poolsize.
61855 +
61856 +config GRKERNSEC_BLACKHOLE
61857 + bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
61858 + depends on NET
61859 + help
61860 + If you say Y here, neither TCP resets nor ICMP
61861 + destination-unreachable packets will be sent in response to packets
61862 + sent to ports for which no associated listening process exists.
61863 + This feature supports both IPV4 and IPV6 and exempts the
61864 + loopback interface from blackholing. Enabling this feature
61865 + makes a host more resilient to DoS attacks and reduces network
61866 + visibility against scanners.
61867 +
61868 + The blackhole feature as-implemented is equivalent to the FreeBSD
61869 + blackhole feature, as it prevents RST responses to all packets, not
61870 + just SYNs. Under most application behavior this causes no
61871 + problems, but applications (like haproxy) may not close certain
61872 + connections in a way that cleanly terminates them on the remote
61873 + end, leaving the remote host in LAST_ACK state. Because of this
61874 + side-effect and to prevent intentional LAST_ACK DoSes, this
61875 + feature also adds automatic mitigation against such attacks.
61876 + The mitigation drastically reduces the amount of time a socket
61877 + can spend in LAST_ACK state. If you're using haproxy and not
61878 + all servers it connects to have this option enabled, consider
61879 + disabling this feature on the haproxy host.
61880 +
61881 + If the sysctl option is enabled, two sysctl options with names
61882 + "ip_blackhole" and "lastack_retries" will be created.
61883 + While "ip_blackhole" takes the standard zero/non-zero on/off
61884 + toggle, "lastack_retries" uses the same kinds of values as
61885 + "tcp_retries1" and "tcp_retries2". The default value of 4
61886 + prevents a socket from lasting more than 45 seconds in LAST_ACK
61887 + state.
61888 +
61889 +config GRKERNSEC_SOCKET
61890 + bool "Socket restrictions"
61891 + depends on NET
61892 + help
61893 + If you say Y here, you will be able to choose from several options.
61894 + If you assign a GID on your system and add it to the supplementary
61895 + groups of users you want to restrict socket access to, this patch
61896 + will perform up to three things, based on the option(s) you choose.
61897 +
61898 +config GRKERNSEC_SOCKET_ALL
61899 + bool "Deny any sockets to group"
61900 + depends on GRKERNSEC_SOCKET
61901 + help
61902 + If you say Y here, you will be able to choose a GID of whose users will
61903 + be unable to connect to other hosts from your machine or run server
61904 + applications from your machine. If the sysctl option is enabled, a
61905 + sysctl option with name "socket_all" is created.
61906 +
61907 +config GRKERNSEC_SOCKET_ALL_GID
61908 + int "GID to deny all sockets for"
61909 + depends on GRKERNSEC_SOCKET_ALL
61910 + default 1004
61911 + help
61912 + Here you can choose the GID to disable socket access for. Remember to
61913 + add the users you want socket access disabled for to the GID
61914 + specified here. If the sysctl option is enabled, a sysctl option
61915 + with name "socket_all_gid" is created.
61916 +
61917 +config GRKERNSEC_SOCKET_CLIENT
61918 + bool "Deny client sockets to group"
61919 + depends on GRKERNSEC_SOCKET
61920 + help
61921 + If you say Y here, you will be able to choose a GID of whose users will
61922 + be unable to connect to other hosts from your machine, but will be
61923 + able to run servers. If this option is enabled, all users in the group
61924 + you specify will have to use passive mode when initiating ftp transfers
61925 + from the shell on your machine. If the sysctl option is enabled, a
61926 + sysctl option with name "socket_client" is created.
61927 +
61928 +config GRKERNSEC_SOCKET_CLIENT_GID
61929 + int "GID to deny client sockets for"
61930 + depends on GRKERNSEC_SOCKET_CLIENT
61931 + default 1003
61932 + help
61933 + Here you can choose the GID to disable client socket access for.
61934 + Remember to add the users you want client socket access disabled for to
61935 + the GID specified here. If the sysctl option is enabled, a sysctl
61936 + option with name "socket_client_gid" is created.
61937 +
61938 +config GRKERNSEC_SOCKET_SERVER
61939 + bool "Deny server sockets to group"
61940 + depends on GRKERNSEC_SOCKET
61941 + help
61942 + If you say Y here, you will be able to choose a GID of whose users will
61943 + be unable to run server applications from your machine. If the sysctl
61944 + option is enabled, a sysctl option with name "socket_server" is created.
61945 +
61946 +config GRKERNSEC_SOCKET_SERVER_GID
61947 + int "GID to deny server sockets for"
61948 + depends on GRKERNSEC_SOCKET_SERVER
61949 + default 1002
61950 + help
61951 + Here you can choose the GID to disable server socket access for.
61952 + Remember to add the users you want server socket access disabled for to
61953 + the GID specified here. If the sysctl option is enabled, a sysctl
61954 + option with name "socket_server_gid" is created.
61955 +
61956 +endmenu
61957 +menu "Sysctl support"
61958 +depends on GRKERNSEC && SYSCTL
61959 +
61960 +config GRKERNSEC_SYSCTL
61961 + bool "Sysctl support"
61962 + help
61963 + If you say Y here, you will be able to change the options that
61964 + grsecurity runs with at bootup, without having to recompile your
61965 + kernel. You can echo values to files in /proc/sys/kernel/grsecurity
61966 + to enable (1) or disable (0) various features. All the sysctl entries
61967 + are mutable until the "grsec_lock" entry is set to a non-zero value.
61968 + All features enabled in the kernel configuration are disabled at boot
61969 + if you do not say Y to the "Turn on features by default" option.
61970 + All options should be set at startup, and the grsec_lock entry should
61971 + be set to a non-zero value after all the options are set.
61972 + *THIS IS EXTREMELY IMPORTANT*
61973 +
61974 +config GRKERNSEC_SYSCTL_DISTRO
61975 + bool "Extra sysctl support for distro makers (READ HELP)"
61976 + depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
61977 + help
61978 + If you say Y here, additional sysctl options will be created
61979 + for features that affect processes running as root. Therefore,
61980 + it is critical when using this option that the grsec_lock entry be
61981 + enabled after boot. Only distros with prebuilt kernel packages
61982 + with this option enabled that can ensure grsec_lock is enabled
61983 + after boot should use this option.
61984 + *Failure to set grsec_lock after boot makes all grsec features
61985 + this option covers useless*
61986 +
61987 + Currently this option creates the following sysctl entries:
61988 + "Disable Privileged I/O": "disable_priv_io"
61989 +
61990 +config GRKERNSEC_SYSCTL_ON
61991 + bool "Turn on features by default"
61992 + depends on GRKERNSEC_SYSCTL
61993 + help
61994 + If you say Y here, instead of having all features enabled in the
61995 + kernel configuration disabled at boot time, the features will be
61996 + enabled at boot time. It is recommended you say Y here unless
61997 + there is some reason you would want all sysctl-tunable features to
61998 + be disabled by default. As mentioned elsewhere, it is important
61999 + to enable the grsec_lock entry once you have finished modifying
62000 + the sysctl entries.
62001 +
62002 +endmenu
62003 +menu "Logging Options"
62004 +depends on GRKERNSEC
62005 +
62006 +config GRKERNSEC_FLOODTIME
62007 + int "Seconds in between log messages (minimum)"
62008 + default 10
62009 + help
62010 + This option allows you to enforce the number of seconds between
62011 + grsecurity log messages. The default should be suitable for most
62012 + people, however, if you choose to change it, choose a value small enough
62013 + to allow informative logs to be produced, but large enough to
62014 + prevent flooding.
62015 +
62016 +config GRKERNSEC_FLOODBURST
62017 + int "Number of messages in a burst (maximum)"
62018 + default 6
62019 + help
62020 + This option allows you to choose the maximum number of messages allowed
62021 + within the flood time interval you chose in a separate option. The
62022 + default should be suitable for most people, however if you find that
62023 + many of your logs are being interpreted as flooding, you may want to
62024 + raise this value.
62025 +
62026 +endmenu
62027 +
62028 +endmenu
62029 diff -urNp linux-2.6.32.49/grsecurity/Makefile linux-2.6.32.49/grsecurity/Makefile
62030 --- linux-2.6.32.49/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500
62031 +++ linux-2.6.32.49/grsecurity/Makefile 2011-11-15 19:59:43.000000000 -0500
62032 @@ -0,0 +1,36 @@
62033 +# grsecurity's ACL system was originally written in 2001 by Michael Dalton
62034 +# during 2001-2009 it has been completely redesigned by Brad Spengler
62035 +# into an RBAC system
62036 +#
62037 +# All code in this directory and various hooks inserted throughout the kernel
62038 +# are copyright Brad Spengler - Open Source Security, Inc., and released
62039 +# under the GPL v2 or higher
62040 +
62041 +obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
62042 + grsec_mount.o grsec_sig.o grsec_sysctl.o \
62043 + grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
62044 +
62045 +obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
62046 + gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
62047 + gracl_learn.o grsec_log.o
62048 +obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
62049 +
62050 +ifdef CONFIG_NET
62051 +obj-y += grsec_sock.o
62052 +obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
62053 +endif
62054 +
62055 +ifndef CONFIG_GRKERNSEC
62056 +obj-y += grsec_disabled.o
62057 +endif
62058 +
62059 +ifdef CONFIG_GRKERNSEC_HIDESYM
62060 +extra-y := grsec_hidesym.o
62061 +$(obj)/grsec_hidesym.o:
62062 + @-chmod -f 500 /boot
62063 + @-chmod -f 500 /lib/modules
62064 + @-chmod -f 500 /lib64/modules
62065 + @-chmod -f 500 /lib32/modules
62066 + @-chmod -f 700 .
62067 + @echo ' grsec: protected kernel image paths'
62068 +endif
62069 diff -urNp linux-2.6.32.49/include/acpi/acpi_bus.h linux-2.6.32.49/include/acpi/acpi_bus.h
62070 --- linux-2.6.32.49/include/acpi/acpi_bus.h 2011-11-08 19:02:43.000000000 -0500
62071 +++ linux-2.6.32.49/include/acpi/acpi_bus.h 2011-11-15 19:59:43.000000000 -0500
62072 @@ -107,7 +107,7 @@ struct acpi_device_ops {
62073 acpi_op_bind bind;
62074 acpi_op_unbind unbind;
62075 acpi_op_notify notify;
62076 -};
62077 +} __no_const;
62078
62079 #define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */
62080
62081 diff -urNp linux-2.6.32.49/include/acpi/acpi_drivers.h linux-2.6.32.49/include/acpi/acpi_drivers.h
62082 --- linux-2.6.32.49/include/acpi/acpi_drivers.h 2011-11-08 19:02:43.000000000 -0500
62083 +++ linux-2.6.32.49/include/acpi/acpi_drivers.h 2011-11-15 19:59:43.000000000 -0500
62084 @@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acp
62085 Dock Station
62086 -------------------------------------------------------------------------- */
62087 struct acpi_dock_ops {
62088 - acpi_notify_handler handler;
62089 - acpi_notify_handler uevent;
62090 + const acpi_notify_handler handler;
62091 + const acpi_notify_handler uevent;
62092 };
62093
62094 #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
62095 @@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
62096 extern int register_dock_notifier(struct notifier_block *nb);
62097 extern void unregister_dock_notifier(struct notifier_block *nb);
62098 extern int register_hotplug_dock_device(acpi_handle handle,
62099 - struct acpi_dock_ops *ops,
62100 + const struct acpi_dock_ops *ops,
62101 void *context);
62102 extern void unregister_hotplug_dock_device(acpi_handle handle);
62103 #else
62104 @@ -144,7 +144,7 @@ static inline void unregister_dock_notif
62105 {
62106 }
62107 static inline int register_hotplug_dock_device(acpi_handle handle,
62108 - struct acpi_dock_ops *ops,
62109 + const struct acpi_dock_ops *ops,
62110 void *context)
62111 {
62112 return -ENODEV;
62113 diff -urNp linux-2.6.32.49/include/asm-generic/atomic-long.h linux-2.6.32.49/include/asm-generic/atomic-long.h
62114 --- linux-2.6.32.49/include/asm-generic/atomic-long.h 2011-11-08 19:02:43.000000000 -0500
62115 +++ linux-2.6.32.49/include/asm-generic/atomic-long.h 2011-11-15 19:59:43.000000000 -0500
62116 @@ -22,6 +22,12 @@
62117
62118 typedef atomic64_t atomic_long_t;
62119
62120 +#ifdef CONFIG_PAX_REFCOUNT
62121 +typedef atomic64_unchecked_t atomic_long_unchecked_t;
62122 +#else
62123 +typedef atomic64_t atomic_long_unchecked_t;
62124 +#endif
62125 +
62126 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
62127
62128 static inline long atomic_long_read(atomic_long_t *l)
62129 @@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
62130 return (long)atomic64_read(v);
62131 }
62132
62133 +#ifdef CONFIG_PAX_REFCOUNT
62134 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
62135 +{
62136 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
62137 +
62138 + return (long)atomic64_read_unchecked(v);
62139 +}
62140 +#endif
62141 +
62142 static inline void atomic_long_set(atomic_long_t *l, long i)
62143 {
62144 atomic64_t *v = (atomic64_t *)l;
62145 @@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
62146 atomic64_set(v, i);
62147 }
62148
62149 +#ifdef CONFIG_PAX_REFCOUNT
62150 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
62151 +{
62152 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
62153 +
62154 + atomic64_set_unchecked(v, i);
62155 +}
62156 +#endif
62157 +
62158 static inline void atomic_long_inc(atomic_long_t *l)
62159 {
62160 atomic64_t *v = (atomic64_t *)l;
62161 @@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
62162 atomic64_inc(v);
62163 }
62164
62165 +#ifdef CONFIG_PAX_REFCOUNT
62166 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
62167 +{
62168 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
62169 +
62170 + atomic64_inc_unchecked(v);
62171 +}
62172 +#endif
62173 +
62174 static inline void atomic_long_dec(atomic_long_t *l)
62175 {
62176 atomic64_t *v = (atomic64_t *)l;
62177 @@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomi
62178 atomic64_dec(v);
62179 }
62180
62181 +#ifdef CONFIG_PAX_REFCOUNT
62182 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
62183 +{
62184 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
62185 +
62186 + atomic64_dec_unchecked(v);
62187 +}
62188 +#endif
62189 +
62190 static inline void atomic_long_add(long i, atomic_long_t *l)
62191 {
62192 atomic64_t *v = (atomic64_t *)l;
62193 @@ -59,6 +101,15 @@ static inline void atomic_long_add(long
62194 atomic64_add(i, v);
62195 }
62196
62197 +#ifdef CONFIG_PAX_REFCOUNT
62198 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
62199 +{
62200 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
62201 +
62202 + atomic64_add_unchecked(i, v);
62203 +}
62204 +#endif
62205 +
62206 static inline void atomic_long_sub(long i, atomic_long_t *l)
62207 {
62208 atomic64_t *v = (atomic64_t *)l;
62209 @@ -115,6 +166,15 @@ static inline long atomic_long_inc_retur
62210 return (long)atomic64_inc_return(v);
62211 }
62212
62213 +#ifdef CONFIG_PAX_REFCOUNT
62214 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
62215 +{
62216 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
62217 +
62218 + return (long)atomic64_inc_return_unchecked(v);
62219 +}
62220 +#endif
62221 +
62222 static inline long atomic_long_dec_return(atomic_long_t *l)
62223 {
62224 atomic64_t *v = (atomic64_t *)l;
62225 @@ -140,6 +200,12 @@ static inline long atomic_long_add_unles
62226
62227 typedef atomic_t atomic_long_t;
62228
62229 +#ifdef CONFIG_PAX_REFCOUNT
62230 +typedef atomic_unchecked_t atomic_long_unchecked_t;
62231 +#else
62232 +typedef atomic_t atomic_long_unchecked_t;
62233 +#endif
62234 +
62235 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
62236 static inline long atomic_long_read(atomic_long_t *l)
62237 {
62238 @@ -148,6 +214,15 @@ static inline long atomic_long_read(atom
62239 return (long)atomic_read(v);
62240 }
62241
62242 +#ifdef CONFIG_PAX_REFCOUNT
62243 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
62244 +{
62245 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
62246 +
62247 + return (long)atomic_read_unchecked(v);
62248 +}
62249 +#endif
62250 +
62251 static inline void atomic_long_set(atomic_long_t *l, long i)
62252 {
62253 atomic_t *v = (atomic_t *)l;
62254 @@ -155,6 +230,15 @@ static inline void atomic_long_set(atomi
62255 atomic_set(v, i);
62256 }
62257
62258 +#ifdef CONFIG_PAX_REFCOUNT
62259 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
62260 +{
62261 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
62262 +
62263 + atomic_set_unchecked(v, i);
62264 +}
62265 +#endif
62266 +
62267 static inline void atomic_long_inc(atomic_long_t *l)
62268 {
62269 atomic_t *v = (atomic_t *)l;
62270 @@ -162,6 +246,15 @@ static inline void atomic_long_inc(atomi
62271 atomic_inc(v);
62272 }
62273
62274 +#ifdef CONFIG_PAX_REFCOUNT
62275 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
62276 +{
62277 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
62278 +
62279 + atomic_inc_unchecked(v);
62280 +}
62281 +#endif
62282 +
62283 static inline void atomic_long_dec(atomic_long_t *l)
62284 {
62285 atomic_t *v = (atomic_t *)l;
62286 @@ -169,6 +262,15 @@ static inline void atomic_long_dec(atomi
62287 atomic_dec(v);
62288 }
62289
62290 +#ifdef CONFIG_PAX_REFCOUNT
62291 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
62292 +{
62293 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
62294 +
62295 + atomic_dec_unchecked(v);
62296 +}
62297 +#endif
62298 +
62299 static inline void atomic_long_add(long i, atomic_long_t *l)
62300 {
62301 atomic_t *v = (atomic_t *)l;
62302 @@ -176,6 +278,15 @@ static inline void atomic_long_add(long
62303 atomic_add(i, v);
62304 }
62305
62306 +#ifdef CONFIG_PAX_REFCOUNT
62307 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
62308 +{
62309 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
62310 +
62311 + atomic_add_unchecked(i, v);
62312 +}
62313 +#endif
62314 +
62315 static inline void atomic_long_sub(long i, atomic_long_t *l)
62316 {
62317 atomic_t *v = (atomic_t *)l;
62318 @@ -232,6 +343,15 @@ static inline long atomic_long_inc_retur
62319 return (long)atomic_inc_return(v);
62320 }
62321
62322 +#ifdef CONFIG_PAX_REFCOUNT
62323 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
62324 +{
62325 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
62326 +
62327 + return (long)atomic_inc_return_unchecked(v);
62328 +}
62329 +#endif
62330 +
62331 static inline long atomic_long_dec_return(atomic_long_t *l)
62332 {
62333 atomic_t *v = (atomic_t *)l;
62334 @@ -255,4 +375,47 @@ static inline long atomic_long_add_unles
62335
62336 #endif /* BITS_PER_LONG == 64 */
62337
62338 +#ifdef CONFIG_PAX_REFCOUNT
62339 +static inline void pax_refcount_needs_these_functions(void)
62340 +{
62341 + atomic_read_unchecked((atomic_unchecked_t *)NULL);
62342 + atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
62343 + atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
62344 + atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
62345 + atomic_inc_unchecked((atomic_unchecked_t *)NULL);
62346 + (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
62347 + atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
62348 + atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
62349 + atomic_dec_unchecked((atomic_unchecked_t *)NULL);
62350 + atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
62351 + (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
62352 +
62353 + atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
62354 + atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
62355 + atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
62356 + atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
62357 + atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
62358 + atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
62359 +}
62360 +#else
62361 +#define atomic_read_unchecked(v) atomic_read(v)
62362 +#define atomic_set_unchecked(v, i) atomic_set((v), (i))
62363 +#define atomic_add_unchecked(i, v) atomic_add((i), (v))
62364 +#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
62365 +#define atomic_inc_unchecked(v) atomic_inc(v)
62366 +#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
62367 +#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
62368 +#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
62369 +#define atomic_dec_unchecked(v) atomic_dec(v)
62370 +#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
62371 +#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
62372 +
62373 +#define atomic_long_read_unchecked(v) atomic_long_read(v)
62374 +#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
62375 +#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
62376 +#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
62377 +#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
62378 +#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
62379 +#endif
62380 +
62381 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
62382 diff -urNp linux-2.6.32.49/include/asm-generic/bug.h linux-2.6.32.49/include/asm-generic/bug.h
62383 --- linux-2.6.32.49/include/asm-generic/bug.h 2011-11-08 19:02:43.000000000 -0500
62384 +++ linux-2.6.32.49/include/asm-generic/bug.h 2011-11-15 19:59:43.000000000 -0500
62385 @@ -105,11 +105,11 @@ extern void warn_slowpath_null(const cha
62386
62387 #else /* !CONFIG_BUG */
62388 #ifndef HAVE_ARCH_BUG
62389 -#define BUG() do {} while(0)
62390 +#define BUG() do { for (;;) ; } while(0)
62391 #endif
62392
62393 #ifndef HAVE_ARCH_BUG_ON
62394 -#define BUG_ON(condition) do { if (condition) ; } while(0)
62395 +#define BUG_ON(condition) do { if (condition) for (;;) ; } while(0)
62396 #endif
62397
62398 #ifndef HAVE_ARCH_WARN_ON
62399 diff -urNp linux-2.6.32.49/include/asm-generic/cache.h linux-2.6.32.49/include/asm-generic/cache.h
62400 --- linux-2.6.32.49/include/asm-generic/cache.h 2011-11-08 19:02:43.000000000 -0500
62401 +++ linux-2.6.32.49/include/asm-generic/cache.h 2011-11-15 19:59:43.000000000 -0500
62402 @@ -6,7 +6,7 @@
62403 * cache lines need to provide their own cache.h.
62404 */
62405
62406 -#define L1_CACHE_SHIFT 5
62407 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
62408 +#define L1_CACHE_SHIFT 5UL
62409 +#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
62410
62411 #endif /* __ASM_GENERIC_CACHE_H */
62412 diff -urNp linux-2.6.32.49/include/asm-generic/dma-mapping-common.h linux-2.6.32.49/include/asm-generic/dma-mapping-common.h
62413 --- linux-2.6.32.49/include/asm-generic/dma-mapping-common.h 2011-11-08 19:02:43.000000000 -0500
62414 +++ linux-2.6.32.49/include/asm-generic/dma-mapping-common.h 2011-11-15 19:59:43.000000000 -0500
62415 @@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
62416 enum dma_data_direction dir,
62417 struct dma_attrs *attrs)
62418 {
62419 - struct dma_map_ops *ops = get_dma_ops(dev);
62420 + const struct dma_map_ops *ops = get_dma_ops(dev);
62421 dma_addr_t addr;
62422
62423 kmemcheck_mark_initialized(ptr, size);
62424 @@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
62425 enum dma_data_direction dir,
62426 struct dma_attrs *attrs)
62427 {
62428 - struct dma_map_ops *ops = get_dma_ops(dev);
62429 + const struct dma_map_ops *ops = get_dma_ops(dev);
62430
62431 BUG_ON(!valid_dma_direction(dir));
62432 if (ops->unmap_page)
62433 @@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
62434 int nents, enum dma_data_direction dir,
62435 struct dma_attrs *attrs)
62436 {
62437 - struct dma_map_ops *ops = get_dma_ops(dev);
62438 + const struct dma_map_ops *ops = get_dma_ops(dev);
62439 int i, ents;
62440 struct scatterlist *s;
62441
62442 @@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
62443 int nents, enum dma_data_direction dir,
62444 struct dma_attrs *attrs)
62445 {
62446 - struct dma_map_ops *ops = get_dma_ops(dev);
62447 + const struct dma_map_ops *ops = get_dma_ops(dev);
62448
62449 BUG_ON(!valid_dma_direction(dir));
62450 debug_dma_unmap_sg(dev, sg, nents, dir);
62451 @@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
62452 size_t offset, size_t size,
62453 enum dma_data_direction dir)
62454 {
62455 - struct dma_map_ops *ops = get_dma_ops(dev);
62456 + const struct dma_map_ops *ops = get_dma_ops(dev);
62457 dma_addr_t addr;
62458
62459 kmemcheck_mark_initialized(page_address(page) + offset, size);
62460 @@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
62461 static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
62462 size_t size, enum dma_data_direction dir)
62463 {
62464 - struct dma_map_ops *ops = get_dma_ops(dev);
62465 + const struct dma_map_ops *ops = get_dma_ops(dev);
62466
62467 BUG_ON(!valid_dma_direction(dir));
62468 if (ops->unmap_page)
62469 @@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
62470 size_t size,
62471 enum dma_data_direction dir)
62472 {
62473 - struct dma_map_ops *ops = get_dma_ops(dev);
62474 + const struct dma_map_ops *ops = get_dma_ops(dev);
62475
62476 BUG_ON(!valid_dma_direction(dir));
62477 if (ops->sync_single_for_cpu)
62478 @@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
62479 dma_addr_t addr, size_t size,
62480 enum dma_data_direction dir)
62481 {
62482 - struct dma_map_ops *ops = get_dma_ops(dev);
62483 + const struct dma_map_ops *ops = get_dma_ops(dev);
62484
62485 BUG_ON(!valid_dma_direction(dir));
62486 if (ops->sync_single_for_device)
62487 @@ -123,7 +123,7 @@ static inline void dma_sync_single_range
62488 size_t size,
62489 enum dma_data_direction dir)
62490 {
62491 - struct dma_map_ops *ops = get_dma_ops(dev);
62492 + const struct dma_map_ops *ops = get_dma_ops(dev);
62493
62494 BUG_ON(!valid_dma_direction(dir));
62495 if (ops->sync_single_range_for_cpu) {
62496 @@ -140,7 +140,7 @@ static inline void dma_sync_single_range
62497 size_t size,
62498 enum dma_data_direction dir)
62499 {
62500 - struct dma_map_ops *ops = get_dma_ops(dev);
62501 + const struct dma_map_ops *ops = get_dma_ops(dev);
62502
62503 BUG_ON(!valid_dma_direction(dir));
62504 if (ops->sync_single_range_for_device) {
62505 @@ -155,7 +155,7 @@ static inline void
62506 dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
62507 int nelems, enum dma_data_direction dir)
62508 {
62509 - struct dma_map_ops *ops = get_dma_ops(dev);
62510 + const struct dma_map_ops *ops = get_dma_ops(dev);
62511
62512 BUG_ON(!valid_dma_direction(dir));
62513 if (ops->sync_sg_for_cpu)
62514 @@ -167,7 +167,7 @@ static inline void
62515 dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
62516 int nelems, enum dma_data_direction dir)
62517 {
62518 - struct dma_map_ops *ops = get_dma_ops(dev);
62519 + const struct dma_map_ops *ops = get_dma_ops(dev);
62520
62521 BUG_ON(!valid_dma_direction(dir));
62522 if (ops->sync_sg_for_device)
62523 diff -urNp linux-2.6.32.49/include/asm-generic/emergency-restart.h linux-2.6.32.49/include/asm-generic/emergency-restart.h
62524 --- linux-2.6.32.49/include/asm-generic/emergency-restart.h 2011-11-08 19:02:43.000000000 -0500
62525 +++ linux-2.6.32.49/include/asm-generic/emergency-restart.h 2011-11-15 19:59:43.000000000 -0500
62526 @@ -1,7 +1,7 @@
62527 #ifndef _ASM_GENERIC_EMERGENCY_RESTART_H
62528 #define _ASM_GENERIC_EMERGENCY_RESTART_H
62529
62530 -static inline void machine_emergency_restart(void)
62531 +static inline __noreturn void machine_emergency_restart(void)
62532 {
62533 machine_restart(NULL);
62534 }
62535 diff -urNp linux-2.6.32.49/include/asm-generic/futex.h linux-2.6.32.49/include/asm-generic/futex.h
62536 --- linux-2.6.32.49/include/asm-generic/futex.h 2011-11-08 19:02:43.000000000 -0500
62537 +++ linux-2.6.32.49/include/asm-generic/futex.h 2011-11-15 19:59:43.000000000 -0500
62538 @@ -6,7 +6,7 @@
62539 #include <asm/errno.h>
62540
62541 static inline int
62542 -futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
62543 +futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
62544 {
62545 int op = (encoded_op >> 28) & 7;
62546 int cmp = (encoded_op >> 24) & 15;
62547 @@ -48,7 +48,7 @@ futex_atomic_op_inuser (int encoded_op,
62548 }
62549
62550 static inline int
62551 -futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
62552 +futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
62553 {
62554 return -ENOSYS;
62555 }
62556 diff -urNp linux-2.6.32.49/include/asm-generic/int-l64.h linux-2.6.32.49/include/asm-generic/int-l64.h
62557 --- linux-2.6.32.49/include/asm-generic/int-l64.h 2011-11-08 19:02:43.000000000 -0500
62558 +++ linux-2.6.32.49/include/asm-generic/int-l64.h 2011-11-15 19:59:43.000000000 -0500
62559 @@ -46,6 +46,8 @@ typedef unsigned int u32;
62560 typedef signed long s64;
62561 typedef unsigned long u64;
62562
62563 +typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
62564 +
62565 #define S8_C(x) x
62566 #define U8_C(x) x ## U
62567 #define S16_C(x) x
62568 diff -urNp linux-2.6.32.49/include/asm-generic/int-ll64.h linux-2.6.32.49/include/asm-generic/int-ll64.h
62569 --- linux-2.6.32.49/include/asm-generic/int-ll64.h 2011-11-08 19:02:43.000000000 -0500
62570 +++ linux-2.6.32.49/include/asm-generic/int-ll64.h 2011-11-15 19:59:43.000000000 -0500
62571 @@ -51,6 +51,8 @@ typedef unsigned int u32;
62572 typedef signed long long s64;
62573 typedef unsigned long long u64;
62574
62575 +typedef unsigned long long intoverflow_t;
62576 +
62577 #define S8_C(x) x
62578 #define U8_C(x) x ## U
62579 #define S16_C(x) x
62580 diff -urNp linux-2.6.32.49/include/asm-generic/kmap_types.h linux-2.6.32.49/include/asm-generic/kmap_types.h
62581 --- linux-2.6.32.49/include/asm-generic/kmap_types.h 2011-11-08 19:02:43.000000000 -0500
62582 +++ linux-2.6.32.49/include/asm-generic/kmap_types.h 2011-11-15 19:59:43.000000000 -0500
62583 @@ -28,7 +28,8 @@ KMAP_D(15) KM_UML_USERCOPY,
62584 KMAP_D(16) KM_IRQ_PTE,
62585 KMAP_D(17) KM_NMI,
62586 KMAP_D(18) KM_NMI_PTE,
62587 -KMAP_D(19) KM_TYPE_NR
62588 +KMAP_D(19) KM_CLEARPAGE,
62589 +KMAP_D(20) KM_TYPE_NR
62590 };
62591
62592 #undef KMAP_D
62593 diff -urNp linux-2.6.32.49/include/asm-generic/pgtable.h linux-2.6.32.49/include/asm-generic/pgtable.h
62594 --- linux-2.6.32.49/include/asm-generic/pgtable.h 2011-11-08 19:02:43.000000000 -0500
62595 +++ linux-2.6.32.49/include/asm-generic/pgtable.h 2011-11-15 19:59:43.000000000 -0500
62596 @@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_ar
62597 unsigned long size);
62598 #endif
62599
62600 +#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
62601 +static inline unsigned long pax_open_kernel(void) { return 0; }
62602 +#endif
62603 +
62604 +#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
62605 +static inline unsigned long pax_close_kernel(void) { return 0; }
62606 +#endif
62607 +
62608 #endif /* !__ASSEMBLY__ */
62609
62610 #endif /* _ASM_GENERIC_PGTABLE_H */
62611 diff -urNp linux-2.6.32.49/include/asm-generic/pgtable-nopmd.h linux-2.6.32.49/include/asm-generic/pgtable-nopmd.h
62612 --- linux-2.6.32.49/include/asm-generic/pgtable-nopmd.h 2011-11-08 19:02:43.000000000 -0500
62613 +++ linux-2.6.32.49/include/asm-generic/pgtable-nopmd.h 2011-11-15 19:59:43.000000000 -0500
62614 @@ -1,14 +1,19 @@
62615 #ifndef _PGTABLE_NOPMD_H
62616 #define _PGTABLE_NOPMD_H
62617
62618 -#ifndef __ASSEMBLY__
62619 -
62620 #include <asm-generic/pgtable-nopud.h>
62621
62622 -struct mm_struct;
62623 -
62624 #define __PAGETABLE_PMD_FOLDED
62625
62626 +#define PMD_SHIFT PUD_SHIFT
62627 +#define PTRS_PER_PMD 1
62628 +#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
62629 +#define PMD_MASK (~(PMD_SIZE-1))
62630 +
62631 +#ifndef __ASSEMBLY__
62632 +
62633 +struct mm_struct;
62634 +
62635 /*
62636 * Having the pmd type consist of a pud gets the size right, and allows
62637 * us to conceptually access the pud entry that this pmd is folded into
62638 @@ -16,11 +21,6 @@ struct mm_struct;
62639 */
62640 typedef struct { pud_t pud; } pmd_t;
62641
62642 -#define PMD_SHIFT PUD_SHIFT
62643 -#define PTRS_PER_PMD 1
62644 -#define PMD_SIZE (1UL << PMD_SHIFT)
62645 -#define PMD_MASK (~(PMD_SIZE-1))
62646 -
62647 /*
62648 * The "pud_xxx()" functions here are trivial for a folded two-level
62649 * setup: the pmd is never bad, and a pmd always exists (as it's folded
62650 diff -urNp linux-2.6.32.49/include/asm-generic/pgtable-nopud.h linux-2.6.32.49/include/asm-generic/pgtable-nopud.h
62651 --- linux-2.6.32.49/include/asm-generic/pgtable-nopud.h 2011-11-08 19:02:43.000000000 -0500
62652 +++ linux-2.6.32.49/include/asm-generic/pgtable-nopud.h 2011-11-15 19:59:43.000000000 -0500
62653 @@ -1,10 +1,15 @@
62654 #ifndef _PGTABLE_NOPUD_H
62655 #define _PGTABLE_NOPUD_H
62656
62657 -#ifndef __ASSEMBLY__
62658 -
62659 #define __PAGETABLE_PUD_FOLDED
62660
62661 +#define PUD_SHIFT PGDIR_SHIFT
62662 +#define PTRS_PER_PUD 1
62663 +#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
62664 +#define PUD_MASK (~(PUD_SIZE-1))
62665 +
62666 +#ifndef __ASSEMBLY__
62667 +
62668 /*
62669 * Having the pud type consist of a pgd gets the size right, and allows
62670 * us to conceptually access the pgd entry that this pud is folded into
62671 @@ -12,11 +17,6 @@
62672 */
62673 typedef struct { pgd_t pgd; } pud_t;
62674
62675 -#define PUD_SHIFT PGDIR_SHIFT
62676 -#define PTRS_PER_PUD 1
62677 -#define PUD_SIZE (1UL << PUD_SHIFT)
62678 -#define PUD_MASK (~(PUD_SIZE-1))
62679 -
62680 /*
62681 * The "pgd_xxx()" functions here are trivial for a folded two-level
62682 * setup: the pud is never bad, and a pud always exists (as it's folded
62683 diff -urNp linux-2.6.32.49/include/asm-generic/vmlinux.lds.h linux-2.6.32.49/include/asm-generic/vmlinux.lds.h
62684 --- linux-2.6.32.49/include/asm-generic/vmlinux.lds.h 2011-11-08 19:02:43.000000000 -0500
62685 +++ linux-2.6.32.49/include/asm-generic/vmlinux.lds.h 2011-11-15 19:59:43.000000000 -0500
62686 @@ -199,6 +199,7 @@
62687 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
62688 VMLINUX_SYMBOL(__start_rodata) = .; \
62689 *(.rodata) *(.rodata.*) \
62690 + *(.data.read_only) \
62691 *(__vermagic) /* Kernel version magic */ \
62692 *(__markers_strings) /* Markers: strings */ \
62693 *(__tracepoints_strings)/* Tracepoints: strings */ \
62694 @@ -656,22 +657,24 @@
62695 * section in the linker script will go there too. @phdr should have
62696 * a leading colon.
62697 *
62698 - * Note that this macros defines __per_cpu_load as an absolute symbol.
62699 + * Note that this macros defines per_cpu_load as an absolute symbol.
62700 * If there is no need to put the percpu section at a predetermined
62701 * address, use PERCPU().
62702 */
62703 #define PERCPU_VADDR(vaddr, phdr) \
62704 - VMLINUX_SYMBOL(__per_cpu_load) = .; \
62705 - .data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
62706 + per_cpu_load = .; \
62707 + .data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
62708 - LOAD_OFFSET) { \
62709 + VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
62710 VMLINUX_SYMBOL(__per_cpu_start) = .; \
62711 *(.data.percpu.first) \
62712 - *(.data.percpu.page_aligned) \
62713 *(.data.percpu) \
62714 + . = ALIGN(PAGE_SIZE); \
62715 + *(.data.percpu.page_aligned) \
62716 *(.data.percpu.shared_aligned) \
62717 VMLINUX_SYMBOL(__per_cpu_end) = .; \
62718 } phdr \
62719 - . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
62720 + . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
62721
62722 /**
62723 * PERCPU - define output section for percpu area, simple version
62724 diff -urNp linux-2.6.32.49/include/drm/drm_crtc_helper.h linux-2.6.32.49/include/drm/drm_crtc_helper.h
62725 --- linux-2.6.32.49/include/drm/drm_crtc_helper.h 2011-11-08 19:02:43.000000000 -0500
62726 +++ linux-2.6.32.49/include/drm/drm_crtc_helper.h 2011-11-15 19:59:43.000000000 -0500
62727 @@ -64,7 +64,7 @@ struct drm_crtc_helper_funcs {
62728
62729 /* reload the current crtc LUT */
62730 void (*load_lut)(struct drm_crtc *crtc);
62731 -};
62732 +} __no_const;
62733
62734 struct drm_encoder_helper_funcs {
62735 void (*dpms)(struct drm_encoder *encoder, int mode);
62736 @@ -85,7 +85,7 @@ struct drm_encoder_helper_funcs {
62737 struct drm_connector *connector);
62738 /* disable encoder when not in use - more explicit than dpms off */
62739 void (*disable)(struct drm_encoder *encoder);
62740 -};
62741 +} __no_const;
62742
62743 struct drm_connector_helper_funcs {
62744 int (*get_modes)(struct drm_connector *connector);
62745 diff -urNp linux-2.6.32.49/include/drm/drmP.h linux-2.6.32.49/include/drm/drmP.h
62746 --- linux-2.6.32.49/include/drm/drmP.h 2011-11-08 19:02:43.000000000 -0500
62747 +++ linux-2.6.32.49/include/drm/drmP.h 2011-11-15 19:59:43.000000000 -0500
62748 @@ -71,6 +71,7 @@
62749 #include <linux/workqueue.h>
62750 #include <linux/poll.h>
62751 #include <asm/pgalloc.h>
62752 +#include <asm/local.h>
62753 #include "drm.h"
62754
62755 #include <linux/idr.h>
62756 @@ -814,7 +815,7 @@ struct drm_driver {
62757 void (*vgaarb_irq)(struct drm_device *dev, bool state);
62758
62759 /* Driver private ops for this object */
62760 - struct vm_operations_struct *gem_vm_ops;
62761 + const struct vm_operations_struct *gem_vm_ops;
62762
62763 int major;
62764 int minor;
62765 @@ -917,7 +918,7 @@ struct drm_device {
62766
62767 /** \name Usage Counters */
62768 /*@{ */
62769 - int open_count; /**< Outstanding files open */
62770 + local_t open_count; /**< Outstanding files open */
62771 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
62772 atomic_t vma_count; /**< Outstanding vma areas open */
62773 int buf_use; /**< Buffers in use -- cannot alloc */
62774 @@ -928,7 +929,7 @@ struct drm_device {
62775 /*@{ */
62776 unsigned long counters;
62777 enum drm_stat_type types[15];
62778 - atomic_t counts[15];
62779 + atomic_unchecked_t counts[15];
62780 /*@} */
62781
62782 struct list_head filelist;
62783 @@ -1016,7 +1017,7 @@ struct drm_device {
62784 struct pci_controller *hose;
62785 #endif
62786 struct drm_sg_mem *sg; /**< Scatter gather memory */
62787 - unsigned int num_crtcs; /**< Number of CRTCs on this device */
62788 + unsigned int num_crtcs; /**< Number of CRTCs on this device */
62789 void *dev_private; /**< device private data */
62790 void *mm_private;
62791 struct address_space *dev_mapping;
62792 @@ -1042,11 +1043,11 @@ struct drm_device {
62793 spinlock_t object_name_lock;
62794 struct idr object_name_idr;
62795 atomic_t object_count;
62796 - atomic_t object_memory;
62797 + atomic_unchecked_t object_memory;
62798 atomic_t pin_count;
62799 - atomic_t pin_memory;
62800 + atomic_unchecked_t pin_memory;
62801 atomic_t gtt_count;
62802 - atomic_t gtt_memory;
62803 + atomic_unchecked_t gtt_memory;
62804 uint32_t gtt_total;
62805 uint32_t invalidate_domains; /* domains pending invalidation */
62806 uint32_t flush_domains; /* domains pending flush */
62807 diff -urNp linux-2.6.32.49/include/drm/ttm/ttm_memory.h linux-2.6.32.49/include/drm/ttm/ttm_memory.h
62808 --- linux-2.6.32.49/include/drm/ttm/ttm_memory.h 2011-11-08 19:02:43.000000000 -0500
62809 +++ linux-2.6.32.49/include/drm/ttm/ttm_memory.h 2011-11-15 19:59:43.000000000 -0500
62810 @@ -47,7 +47,7 @@
62811
62812 struct ttm_mem_shrink {
62813 int (*do_shrink) (struct ttm_mem_shrink *);
62814 -};
62815 +} __no_const;
62816
62817 /**
62818 * struct ttm_mem_global - Global memory accounting structure.
62819 diff -urNp linux-2.6.32.49/include/linux/a.out.h linux-2.6.32.49/include/linux/a.out.h
62820 --- linux-2.6.32.49/include/linux/a.out.h 2011-11-08 19:02:43.000000000 -0500
62821 +++ linux-2.6.32.49/include/linux/a.out.h 2011-11-15 19:59:43.000000000 -0500
62822 @@ -39,6 +39,14 @@ enum machine_type {
62823 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
62824 };
62825
62826 +/* Constants for the N_FLAGS field */
62827 +#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
62828 +#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
62829 +#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
62830 +#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
62831 +/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
62832 +#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
62833 +
62834 #if !defined (N_MAGIC)
62835 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
62836 #endif
62837 diff -urNp linux-2.6.32.49/include/linux/atmdev.h linux-2.6.32.49/include/linux/atmdev.h
62838 --- linux-2.6.32.49/include/linux/atmdev.h 2011-11-08 19:02:43.000000000 -0500
62839 +++ linux-2.6.32.49/include/linux/atmdev.h 2011-11-15 19:59:43.000000000 -0500
62840 @@ -237,7 +237,7 @@ struct compat_atm_iobuf {
62841 #endif
62842
62843 struct k_atm_aal_stats {
62844 -#define __HANDLE_ITEM(i) atomic_t i
62845 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
62846 __AAL_STAT_ITEMS
62847 #undef __HANDLE_ITEM
62848 };
62849 diff -urNp linux-2.6.32.49/include/linux/backlight.h linux-2.6.32.49/include/linux/backlight.h
62850 --- linux-2.6.32.49/include/linux/backlight.h 2011-11-08 19:02:43.000000000 -0500
62851 +++ linux-2.6.32.49/include/linux/backlight.h 2011-11-15 19:59:43.000000000 -0500
62852 @@ -36,18 +36,18 @@ struct backlight_device;
62853 struct fb_info;
62854
62855 struct backlight_ops {
62856 - unsigned int options;
62857 + const unsigned int options;
62858
62859 #define BL_CORE_SUSPENDRESUME (1 << 0)
62860
62861 /* Notify the backlight driver some property has changed */
62862 - int (*update_status)(struct backlight_device *);
62863 + int (* const update_status)(struct backlight_device *);
62864 /* Return the current backlight brightness (accounting for power,
62865 fb_blank etc.) */
62866 - int (*get_brightness)(struct backlight_device *);
62867 + int (* const get_brightness)(struct backlight_device *);
62868 /* Check if given framebuffer device is the one bound to this backlight;
62869 return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
62870 - int (*check_fb)(struct fb_info *);
62871 + int (* const check_fb)(struct fb_info *);
62872 };
62873
62874 /* This structure defines all the properties of a backlight */
62875 @@ -86,7 +86,7 @@ struct backlight_device {
62876 registered this device has been unloaded, and if class_get_devdata()
62877 points to something in the body of that driver, it is also invalid. */
62878 struct mutex ops_lock;
62879 - struct backlight_ops *ops;
62880 + const struct backlight_ops *ops;
62881
62882 /* The framebuffer notifier block */
62883 struct notifier_block fb_notif;
62884 @@ -103,7 +103,7 @@ static inline void backlight_update_stat
62885 }
62886
62887 extern struct backlight_device *backlight_device_register(const char *name,
62888 - struct device *dev, void *devdata, struct backlight_ops *ops);
62889 + struct device *dev, void *devdata, const struct backlight_ops *ops);
62890 extern void backlight_device_unregister(struct backlight_device *bd);
62891 extern void backlight_force_update(struct backlight_device *bd,
62892 enum backlight_update_reason reason);
62893 diff -urNp linux-2.6.32.49/include/linux/binfmts.h linux-2.6.32.49/include/linux/binfmts.h
62894 --- linux-2.6.32.49/include/linux/binfmts.h 2011-11-08 19:02:43.000000000 -0500
62895 +++ linux-2.6.32.49/include/linux/binfmts.h 2011-11-15 19:59:43.000000000 -0500
62896 @@ -83,6 +83,7 @@ struct linux_binfmt {
62897 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
62898 int (*load_shlib)(struct file *);
62899 int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
62900 + void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
62901 unsigned long min_coredump; /* minimal dump size */
62902 int hasvdso;
62903 };
62904 diff -urNp linux-2.6.32.49/include/linux/blkdev.h linux-2.6.32.49/include/linux/blkdev.h
62905 --- linux-2.6.32.49/include/linux/blkdev.h 2011-11-08 19:02:43.000000000 -0500
62906 +++ linux-2.6.32.49/include/linux/blkdev.h 2011-11-15 19:59:43.000000000 -0500
62907 @@ -1278,7 +1278,7 @@ struct block_device_operations {
62908 int (*revalidate_disk) (struct gendisk *);
62909 int (*getgeo)(struct block_device *, struct hd_geometry *);
62910 struct module *owner;
62911 -};
62912 +} __do_const;
62913
62914 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
62915 unsigned long);
62916 diff -urNp linux-2.6.32.49/include/linux/blktrace_api.h linux-2.6.32.49/include/linux/blktrace_api.h
62917 --- linux-2.6.32.49/include/linux/blktrace_api.h 2011-11-08 19:02:43.000000000 -0500
62918 +++ linux-2.6.32.49/include/linux/blktrace_api.h 2011-11-15 19:59:43.000000000 -0500
62919 @@ -160,7 +160,7 @@ struct blk_trace {
62920 struct dentry *dir;
62921 struct dentry *dropped_file;
62922 struct dentry *msg_file;
62923 - atomic_t dropped;
62924 + atomic_unchecked_t dropped;
62925 };
62926
62927 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
62928 diff -urNp linux-2.6.32.49/include/linux/byteorder/little_endian.h linux-2.6.32.49/include/linux/byteorder/little_endian.h
62929 --- linux-2.6.32.49/include/linux/byteorder/little_endian.h 2011-11-08 19:02:43.000000000 -0500
62930 +++ linux-2.6.32.49/include/linux/byteorder/little_endian.h 2011-11-15 19:59:43.000000000 -0500
62931 @@ -42,51 +42,51 @@
62932
62933 static inline __le64 __cpu_to_le64p(const __u64 *p)
62934 {
62935 - return (__force __le64)*p;
62936 + return (__force const __le64)*p;
62937 }
62938 static inline __u64 __le64_to_cpup(const __le64 *p)
62939 {
62940 - return (__force __u64)*p;
62941 + return (__force const __u64)*p;
62942 }
62943 static inline __le32 __cpu_to_le32p(const __u32 *p)
62944 {
62945 - return (__force __le32)*p;
62946 + return (__force const __le32)*p;
62947 }
62948 static inline __u32 __le32_to_cpup(const __le32 *p)
62949 {
62950 - return (__force __u32)*p;
62951 + return (__force const __u32)*p;
62952 }
62953 static inline __le16 __cpu_to_le16p(const __u16 *p)
62954 {
62955 - return (__force __le16)*p;
62956 + return (__force const __le16)*p;
62957 }
62958 static inline __u16 __le16_to_cpup(const __le16 *p)
62959 {
62960 - return (__force __u16)*p;
62961 + return (__force const __u16)*p;
62962 }
62963 static inline __be64 __cpu_to_be64p(const __u64 *p)
62964 {
62965 - return (__force __be64)__swab64p(p);
62966 + return (__force const __be64)__swab64p(p);
62967 }
62968 static inline __u64 __be64_to_cpup(const __be64 *p)
62969 {
62970 - return __swab64p((__u64 *)p);
62971 + return __swab64p((const __u64 *)p);
62972 }
62973 static inline __be32 __cpu_to_be32p(const __u32 *p)
62974 {
62975 - return (__force __be32)__swab32p(p);
62976 + return (__force const __be32)__swab32p(p);
62977 }
62978 static inline __u32 __be32_to_cpup(const __be32 *p)
62979 {
62980 - return __swab32p((__u32 *)p);
62981 + return __swab32p((const __u32 *)p);
62982 }
62983 static inline __be16 __cpu_to_be16p(const __u16 *p)
62984 {
62985 - return (__force __be16)__swab16p(p);
62986 + return (__force const __be16)__swab16p(p);
62987 }
62988 static inline __u16 __be16_to_cpup(const __be16 *p)
62989 {
62990 - return __swab16p((__u16 *)p);
62991 + return __swab16p((const __u16 *)p);
62992 }
62993 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
62994 #define __le64_to_cpus(x) do { (void)(x); } while (0)
62995 diff -urNp linux-2.6.32.49/include/linux/cache.h linux-2.6.32.49/include/linux/cache.h
62996 --- linux-2.6.32.49/include/linux/cache.h 2011-11-08 19:02:43.000000000 -0500
62997 +++ linux-2.6.32.49/include/linux/cache.h 2011-11-15 19:59:43.000000000 -0500
62998 @@ -16,6 +16,10 @@
62999 #define __read_mostly
63000 #endif
63001
63002 +#ifndef __read_only
63003 +#define __read_only __read_mostly
63004 +#endif
63005 +
63006 #ifndef ____cacheline_aligned
63007 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
63008 #endif
63009 diff -urNp linux-2.6.32.49/include/linux/capability.h linux-2.6.32.49/include/linux/capability.h
63010 --- linux-2.6.32.49/include/linux/capability.h 2011-11-08 19:02:43.000000000 -0500
63011 +++ linux-2.6.32.49/include/linux/capability.h 2011-11-15 19:59:43.000000000 -0500
63012 @@ -563,6 +563,7 @@ extern const kernel_cap_t __cap_init_eff
63013 (security_real_capable_noaudit((t), (cap)) == 0)
63014
63015 extern int capable(int cap);
63016 +int capable_nolog(int cap);
63017
63018 /* audit system wants to get cap info from files as well */
63019 struct dentry;
63020 diff -urNp linux-2.6.32.49/include/linux/compiler-gcc4.h linux-2.6.32.49/include/linux/compiler-gcc4.h
63021 --- linux-2.6.32.49/include/linux/compiler-gcc4.h 2011-11-08 19:02:43.000000000 -0500
63022 +++ linux-2.6.32.49/include/linux/compiler-gcc4.h 2011-11-15 19:59:43.000000000 -0500
63023 @@ -36,4 +36,16 @@
63024 the kernel context */
63025 #define __cold __attribute__((__cold__))
63026
63027 +#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
63028 +#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
63029 +#define __bos0(ptr) __bos((ptr), 0)
63030 +#define __bos1(ptr) __bos((ptr), 1)
63031 +
63032 +#if __GNUC_MINOR__ >= 5
63033 +#ifdef CONSTIFY_PLUGIN
63034 +#define __no_const __attribute__((no_const))
63035 +#define __do_const __attribute__((do_const))
63036 +#endif
63037 +#endif
63038 +
63039 #endif
63040 diff -urNp linux-2.6.32.49/include/linux/compiler.h linux-2.6.32.49/include/linux/compiler.h
63041 --- linux-2.6.32.49/include/linux/compiler.h 2011-11-08 19:02:43.000000000 -0500
63042 +++ linux-2.6.32.49/include/linux/compiler.h 2011-11-15 19:59:43.000000000 -0500
63043 @@ -5,11 +5,14 @@
63044
63045 #ifdef __CHECKER__
63046 # define __user __attribute__((noderef, address_space(1)))
63047 +# define __force_user __force __user
63048 # define __kernel /* default address space */
63049 +# define __force_kernel __force __kernel
63050 # define __safe __attribute__((safe))
63051 # define __force __attribute__((force))
63052 # define __nocast __attribute__((nocast))
63053 # define __iomem __attribute__((noderef, address_space(2)))
63054 +# define __force_iomem __force __iomem
63055 # define __acquires(x) __attribute__((context(x,0,1)))
63056 # define __releases(x) __attribute__((context(x,1,0)))
63057 # define __acquire(x) __context__(x,1)
63058 @@ -17,13 +20,34 @@
63059 # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0)
63060 extern void __chk_user_ptr(const volatile void __user *);
63061 extern void __chk_io_ptr(const volatile void __iomem *);
63062 +#elif defined(CHECKER_PLUGIN)
63063 +//# define __user
63064 +//# define __force_user
63065 +//# define __kernel
63066 +//# define __force_kernel
63067 +# define __safe
63068 +# define __force
63069 +# define __nocast
63070 +# define __iomem
63071 +# define __force_iomem
63072 +# define __chk_user_ptr(x) (void)0
63073 +# define __chk_io_ptr(x) (void)0
63074 +# define __builtin_warning(x, y...) (1)
63075 +# define __acquires(x)
63076 +# define __releases(x)
63077 +# define __acquire(x) (void)0
63078 +# define __release(x) (void)0
63079 +# define __cond_lock(x,c) (c)
63080 #else
63081 # define __user
63082 +# define __force_user
63083 # define __kernel
63084 +# define __force_kernel
63085 # define __safe
63086 # define __force
63087 # define __nocast
63088 # define __iomem
63089 +# define __force_iomem
63090 # define __chk_user_ptr(x) (void)0
63091 # define __chk_io_ptr(x) (void)0
63092 # define __builtin_warning(x, y...) (1)
63093 @@ -247,6 +271,14 @@ void ftrace_likely_update(struct ftrace_
63094 # define __attribute_const__ /* unimplemented */
63095 #endif
63096
63097 +#ifndef __no_const
63098 +# define __no_const
63099 +#endif
63100 +
63101 +#ifndef __do_const
63102 +# define __do_const
63103 +#endif
63104 +
63105 /*
63106 * Tell gcc if a function is cold. The compiler will assume any path
63107 * directly leading to the call is unlikely.
63108 @@ -256,6 +288,22 @@ void ftrace_likely_update(struct ftrace_
63109 #define __cold
63110 #endif
63111
63112 +#ifndef __alloc_size
63113 +#define __alloc_size(...)
63114 +#endif
63115 +
63116 +#ifndef __bos
63117 +#define __bos(ptr, arg)
63118 +#endif
63119 +
63120 +#ifndef __bos0
63121 +#define __bos0(ptr)
63122 +#endif
63123 +
63124 +#ifndef __bos1
63125 +#define __bos1(ptr)
63126 +#endif
63127 +
63128 /* Simple shorthand for a section definition */
63129 #ifndef __section
63130 # define __section(S) __attribute__ ((__section__(#S)))
63131 @@ -278,6 +326,7 @@ void ftrace_likely_update(struct ftrace_
63132 * use is to mediate communication between process-level code and irq/NMI
63133 * handlers, all running on the same CPU.
63134 */
63135 -#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
63136 +#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
63137 +#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
63138
63139 #endif /* __LINUX_COMPILER_H */
63140 diff -urNp linux-2.6.32.49/include/linux/crypto.h linux-2.6.32.49/include/linux/crypto.h
63141 --- linux-2.6.32.49/include/linux/crypto.h 2011-11-08 19:02:43.000000000 -0500
63142 +++ linux-2.6.32.49/include/linux/crypto.h 2011-11-15 19:59:43.000000000 -0500
63143 @@ -394,7 +394,7 @@ struct cipher_tfm {
63144 const u8 *key, unsigned int keylen);
63145 void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
63146 void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
63147 -};
63148 +} __no_const;
63149
63150 struct hash_tfm {
63151 int (*init)(struct hash_desc *desc);
63152 @@ -415,13 +415,13 @@ struct compress_tfm {
63153 int (*cot_decompress)(struct crypto_tfm *tfm,
63154 const u8 *src, unsigned int slen,
63155 u8 *dst, unsigned int *dlen);
63156 -};
63157 +} __no_const;
63158
63159 struct rng_tfm {
63160 int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
63161 unsigned int dlen);
63162 int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
63163 -};
63164 +} __no_const;
63165
63166 #define crt_ablkcipher crt_u.ablkcipher
63167 #define crt_aead crt_u.aead
63168 diff -urNp linux-2.6.32.49/include/linux/dcache.h linux-2.6.32.49/include/linux/dcache.h
63169 --- linux-2.6.32.49/include/linux/dcache.h 2011-11-08 19:02:43.000000000 -0500
63170 +++ linux-2.6.32.49/include/linux/dcache.h 2011-11-15 19:59:43.000000000 -0500
63171 @@ -119,6 +119,8 @@ struct dentry {
63172 unsigned char d_iname[DNAME_INLINE_LEN_MIN]; /* small names */
63173 };
63174
63175 +#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
63176 +
63177 /*
63178 * dentry->d_lock spinlock nesting subclasses:
63179 *
63180 diff -urNp linux-2.6.32.49/include/linux/decompress/mm.h linux-2.6.32.49/include/linux/decompress/mm.h
63181 --- linux-2.6.32.49/include/linux/decompress/mm.h 2011-11-08 19:02:43.000000000 -0500
63182 +++ linux-2.6.32.49/include/linux/decompress/mm.h 2011-11-15 19:59:43.000000000 -0500
63183 @@ -78,7 +78,7 @@ static void free(void *where)
63184 * warnings when not needed (indeed large_malloc / large_free are not
63185 * needed by inflate */
63186
63187 -#define malloc(a) kmalloc(a, GFP_KERNEL)
63188 +#define malloc(a) kmalloc((a), GFP_KERNEL)
63189 #define free(a) kfree(a)
63190
63191 #define large_malloc(a) vmalloc(a)
63192 diff -urNp linux-2.6.32.49/include/linux/dma-mapping.h linux-2.6.32.49/include/linux/dma-mapping.h
63193 --- linux-2.6.32.49/include/linux/dma-mapping.h 2011-11-08 19:02:43.000000000 -0500
63194 +++ linux-2.6.32.49/include/linux/dma-mapping.h 2011-11-15 19:59:43.000000000 -0500
63195 @@ -16,51 +16,51 @@ enum dma_data_direction {
63196 };
63197
63198 struct dma_map_ops {
63199 - void* (*alloc_coherent)(struct device *dev, size_t size,
63200 + void* (* const alloc_coherent)(struct device *dev, size_t size,
63201 dma_addr_t *dma_handle, gfp_t gfp);
63202 - void (*free_coherent)(struct device *dev, size_t size,
63203 + void (* const free_coherent)(struct device *dev, size_t size,
63204 void *vaddr, dma_addr_t dma_handle);
63205 - dma_addr_t (*map_page)(struct device *dev, struct page *page,
63206 + dma_addr_t (* const map_page)(struct device *dev, struct page *page,
63207 unsigned long offset, size_t size,
63208 enum dma_data_direction dir,
63209 struct dma_attrs *attrs);
63210 - void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
63211 + void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
63212 size_t size, enum dma_data_direction dir,
63213 struct dma_attrs *attrs);
63214 - int (*map_sg)(struct device *dev, struct scatterlist *sg,
63215 + int (* const map_sg)(struct device *dev, struct scatterlist *sg,
63216 int nents, enum dma_data_direction dir,
63217 struct dma_attrs *attrs);
63218 - void (*unmap_sg)(struct device *dev,
63219 + void (* const unmap_sg)(struct device *dev,
63220 struct scatterlist *sg, int nents,
63221 enum dma_data_direction dir,
63222 struct dma_attrs *attrs);
63223 - void (*sync_single_for_cpu)(struct device *dev,
63224 + void (* const sync_single_for_cpu)(struct device *dev,
63225 dma_addr_t dma_handle, size_t size,
63226 enum dma_data_direction dir);
63227 - void (*sync_single_for_device)(struct device *dev,
63228 + void (* const sync_single_for_device)(struct device *dev,
63229 dma_addr_t dma_handle, size_t size,
63230 enum dma_data_direction dir);
63231 - void (*sync_single_range_for_cpu)(struct device *dev,
63232 + void (* const sync_single_range_for_cpu)(struct device *dev,
63233 dma_addr_t dma_handle,
63234 unsigned long offset,
63235 size_t size,
63236 enum dma_data_direction dir);
63237 - void (*sync_single_range_for_device)(struct device *dev,
63238 + void (* const sync_single_range_for_device)(struct device *dev,
63239 dma_addr_t dma_handle,
63240 unsigned long offset,
63241 size_t size,
63242 enum dma_data_direction dir);
63243 - void (*sync_sg_for_cpu)(struct device *dev,
63244 + void (* const sync_sg_for_cpu)(struct device *dev,
63245 struct scatterlist *sg, int nents,
63246 enum dma_data_direction dir);
63247 - void (*sync_sg_for_device)(struct device *dev,
63248 + void (* const sync_sg_for_device)(struct device *dev,
63249 struct scatterlist *sg, int nents,
63250 enum dma_data_direction dir);
63251 - int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
63252 - int (*dma_supported)(struct device *dev, u64 mask);
63253 + int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
63254 + int (* const dma_supported)(struct device *dev, u64 mask);
63255 int (*set_dma_mask)(struct device *dev, u64 mask);
63256 int is_phys;
63257 -};
63258 +} __do_const;
63259
63260 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
63261
63262 diff -urNp linux-2.6.32.49/include/linux/dst.h linux-2.6.32.49/include/linux/dst.h
63263 --- linux-2.6.32.49/include/linux/dst.h 2011-11-08 19:02:43.000000000 -0500
63264 +++ linux-2.6.32.49/include/linux/dst.h 2011-11-15 19:59:43.000000000 -0500
63265 @@ -380,7 +380,7 @@ struct dst_node
63266 struct thread_pool *pool;
63267
63268 /* Transaction IDs live here */
63269 - atomic_long_t gen;
63270 + atomic_long_unchecked_t gen;
63271
63272 /*
63273 * How frequently and how many times transaction
63274 diff -urNp linux-2.6.32.49/include/linux/elf.h linux-2.6.32.49/include/linux/elf.h
63275 --- linux-2.6.32.49/include/linux/elf.h 2011-11-08 19:02:43.000000000 -0500
63276 +++ linux-2.6.32.49/include/linux/elf.h 2011-11-15 19:59:43.000000000 -0500
63277 @@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
63278 #define PT_GNU_EH_FRAME 0x6474e550
63279
63280 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
63281 +#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
63282 +
63283 +#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
63284 +
63285 +/* Constants for the e_flags field */
63286 +#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
63287 +#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
63288 +#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
63289 +#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
63290 +/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
63291 +#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
63292
63293 /* These constants define the different elf file types */
63294 #define ET_NONE 0
63295 @@ -84,6 +95,8 @@ typedef __s64 Elf64_Sxword;
63296 #define DT_DEBUG 21
63297 #define DT_TEXTREL 22
63298 #define DT_JMPREL 23
63299 +#define DT_FLAGS 30
63300 + #define DF_TEXTREL 0x00000004
63301 #define DT_ENCODING 32
63302 #define OLD_DT_LOOS 0x60000000
63303 #define DT_LOOS 0x6000000d
63304 @@ -230,6 +243,19 @@ typedef struct elf64_hdr {
63305 #define PF_W 0x2
63306 #define PF_X 0x1
63307
63308 +#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
63309 +#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
63310 +#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
63311 +#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
63312 +#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
63313 +#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
63314 +/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
63315 +/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
63316 +#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
63317 +#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
63318 +#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
63319 +#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
63320 +
63321 typedef struct elf32_phdr{
63322 Elf32_Word p_type;
63323 Elf32_Off p_offset;
63324 @@ -322,6 +348,8 @@ typedef struct elf64_shdr {
63325 #define EI_OSABI 7
63326 #define EI_PAD 8
63327
63328 +#define EI_PAX 14
63329 +
63330 #define ELFMAG0 0x7f /* EI_MAG */
63331 #define ELFMAG1 'E'
63332 #define ELFMAG2 'L'
63333 @@ -386,6 +414,7 @@ extern Elf32_Dyn _DYNAMIC [];
63334 #define elf_phdr elf32_phdr
63335 #define elf_note elf32_note
63336 #define elf_addr_t Elf32_Off
63337 +#define elf_dyn Elf32_Dyn
63338
63339 #else
63340
63341 @@ -394,6 +423,7 @@ extern Elf64_Dyn _DYNAMIC [];
63342 #define elf_phdr elf64_phdr
63343 #define elf_note elf64_note
63344 #define elf_addr_t Elf64_Off
63345 +#define elf_dyn Elf64_Dyn
63346
63347 #endif
63348
63349 diff -urNp linux-2.6.32.49/include/linux/fscache-cache.h linux-2.6.32.49/include/linux/fscache-cache.h
63350 --- linux-2.6.32.49/include/linux/fscache-cache.h 2011-11-08 19:02:43.000000000 -0500
63351 +++ linux-2.6.32.49/include/linux/fscache-cache.h 2011-11-15 19:59:43.000000000 -0500
63352 @@ -116,7 +116,7 @@ struct fscache_operation {
63353 #endif
63354 };
63355
63356 -extern atomic_t fscache_op_debug_id;
63357 +extern atomic_unchecked_t fscache_op_debug_id;
63358 extern const struct slow_work_ops fscache_op_slow_work_ops;
63359
63360 extern void fscache_enqueue_operation(struct fscache_operation *);
63361 @@ -134,7 +134,7 @@ static inline void fscache_operation_ini
63362 fscache_operation_release_t release)
63363 {
63364 atomic_set(&op->usage, 1);
63365 - op->debug_id = atomic_inc_return(&fscache_op_debug_id);
63366 + op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
63367 op->release = release;
63368 INIT_LIST_HEAD(&op->pend_link);
63369 fscache_set_op_state(op, "Init");
63370 diff -urNp linux-2.6.32.49/include/linux/fs.h linux-2.6.32.49/include/linux/fs.h
63371 --- linux-2.6.32.49/include/linux/fs.h 2011-11-08 19:02:43.000000000 -0500
63372 +++ linux-2.6.32.49/include/linux/fs.h 2011-11-18 19:28:58.000000000 -0500
63373 @@ -568,41 +568,41 @@ typedef int (*read_actor_t)(read_descrip
63374 unsigned long, unsigned long);
63375
63376 struct address_space_operations {
63377 - int (*writepage)(struct page *page, struct writeback_control *wbc);
63378 - int (*readpage)(struct file *, struct page *);
63379 - void (*sync_page)(struct page *);
63380 + int (* const writepage)(struct page *page, struct writeback_control *wbc);
63381 + int (* const readpage)(struct file *, struct page *);
63382 + void (* const sync_page)(struct page *);
63383
63384 /* Write back some dirty pages from this mapping. */
63385 - int (*writepages)(struct address_space *, struct writeback_control *);
63386 + int (* const writepages)(struct address_space *, struct writeback_control *);
63387
63388 /* Set a page dirty. Return true if this dirtied it */
63389 - int (*set_page_dirty)(struct page *page);
63390 + int (* const set_page_dirty)(struct page *page);
63391
63392 - int (*readpages)(struct file *filp, struct address_space *mapping,
63393 + int (* const readpages)(struct file *filp, struct address_space *mapping,
63394 struct list_head *pages, unsigned nr_pages);
63395
63396 - int (*write_begin)(struct file *, struct address_space *mapping,
63397 + int (* const write_begin)(struct file *, struct address_space *mapping,
63398 loff_t pos, unsigned len, unsigned flags,
63399 struct page **pagep, void **fsdata);
63400 - int (*write_end)(struct file *, struct address_space *mapping,
63401 + int (* const write_end)(struct file *, struct address_space *mapping,
63402 loff_t pos, unsigned len, unsigned copied,
63403 struct page *page, void *fsdata);
63404
63405 /* Unfortunately this kludge is needed for FIBMAP. Don't use it */
63406 - sector_t (*bmap)(struct address_space *, sector_t);
63407 - void (*invalidatepage) (struct page *, unsigned long);
63408 - int (*releasepage) (struct page *, gfp_t);
63409 - ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
63410 + sector_t (* const bmap)(struct address_space *, sector_t);
63411 + void (* const invalidatepage) (struct page *, unsigned long);
63412 + int (* const releasepage) (struct page *, gfp_t);
63413 + ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
63414 loff_t offset, unsigned long nr_segs);
63415 - int (*get_xip_mem)(struct address_space *, pgoff_t, int,
63416 + int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
63417 void **, unsigned long *);
63418 /* migrate the contents of a page to the specified target */
63419 - int (*migratepage) (struct address_space *,
63420 + int (* const migratepage) (struct address_space *,
63421 struct page *, struct page *);
63422 - int (*launder_page) (struct page *);
63423 - int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
63424 + int (* const launder_page) (struct page *);
63425 + int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
63426 unsigned long);
63427 - int (*error_remove_page)(struct address_space *, struct page *);
63428 + int (* const error_remove_page)(struct address_space *, struct page *);
63429 };
63430
63431 /*
63432 @@ -1031,19 +1031,19 @@ static inline int file_check_writeable(s
63433 typedef struct files_struct *fl_owner_t;
63434
63435 struct file_lock_operations {
63436 - void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
63437 - void (*fl_release_private)(struct file_lock *);
63438 + void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
63439 + void (* const fl_release_private)(struct file_lock *);
63440 };
63441
63442 struct lock_manager_operations {
63443 - int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
63444 - void (*fl_notify)(struct file_lock *); /* unblock callback */
63445 - int (*fl_grant)(struct file_lock *, struct file_lock *, int);
63446 - void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
63447 - void (*fl_release_private)(struct file_lock *);
63448 - void (*fl_break)(struct file_lock *);
63449 - int (*fl_mylease)(struct file_lock *, struct file_lock *);
63450 - int (*fl_change)(struct file_lock **, int);
63451 + int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
63452 + void (* const fl_notify)(struct file_lock *); /* unblock callback */
63453 + int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
63454 + void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
63455 + void (* const fl_release_private)(struct file_lock *);
63456 + void (* const fl_break)(struct file_lock *);
63457 + int (* const fl_mylease)(struct file_lock *, struct file_lock *);
63458 + int (* const fl_change)(struct file_lock **, int);
63459 };
63460
63461 struct lock_manager {
63462 @@ -1442,7 +1442,7 @@ struct fiemap_extent_info {
63463 unsigned int fi_flags; /* Flags as passed from user */
63464 unsigned int fi_extents_mapped; /* Number of mapped extents */
63465 unsigned int fi_extents_max; /* Size of fiemap_extent array */
63466 - struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
63467 + struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
63468 * array */
63469 };
63470 int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
63471 @@ -1512,7 +1512,8 @@ struct file_operations {
63472 ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int);
63473 ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int);
63474 int (*setlease)(struct file *, long, struct file_lock **);
63475 -};
63476 +} __do_const;
63477 +typedef struct file_operations __no_const file_operations_no_const;
63478
63479 struct inode_operations {
63480 int (*create) (struct inode *,struct dentry *,int, struct nameidata *);
63481 @@ -1559,30 +1560,30 @@ extern ssize_t vfs_writev(struct file *,
63482 unsigned long, loff_t *);
63483
63484 struct super_operations {
63485 - struct inode *(*alloc_inode)(struct super_block *sb);
63486 - void (*destroy_inode)(struct inode *);
63487 + struct inode *(* const alloc_inode)(struct super_block *sb);
63488 + void (* const destroy_inode)(struct inode *);
63489
63490 - void (*dirty_inode) (struct inode *);
63491 - int (*write_inode) (struct inode *, int);
63492 - void (*drop_inode) (struct inode *);
63493 - void (*delete_inode) (struct inode *);
63494 - void (*put_super) (struct super_block *);
63495 - void (*write_super) (struct super_block *);
63496 - int (*sync_fs)(struct super_block *sb, int wait);
63497 - int (*freeze_fs) (struct super_block *);
63498 - int (*unfreeze_fs) (struct super_block *);
63499 - int (*statfs) (struct dentry *, struct kstatfs *);
63500 - int (*remount_fs) (struct super_block *, int *, char *);
63501 - void (*clear_inode) (struct inode *);
63502 - void (*umount_begin) (struct super_block *);
63503 + void (* const dirty_inode) (struct inode *);
63504 + int (* const write_inode) (struct inode *, int);
63505 + void (* const drop_inode) (struct inode *);
63506 + void (* const delete_inode) (struct inode *);
63507 + void (* const put_super) (struct super_block *);
63508 + void (* const write_super) (struct super_block *);
63509 + int (* const sync_fs)(struct super_block *sb, int wait);
63510 + int (* const freeze_fs) (struct super_block *);
63511 + int (* const unfreeze_fs) (struct super_block *);
63512 + int (* const statfs) (struct dentry *, struct kstatfs *);
63513 + int (* const remount_fs) (struct super_block *, int *, char *);
63514 + void (* const clear_inode) (struct inode *);
63515 + void (* const umount_begin) (struct super_block *);
63516
63517 - int (*show_options)(struct seq_file *, struct vfsmount *);
63518 - int (*show_stats)(struct seq_file *, struct vfsmount *);
63519 + int (* const show_options)(struct seq_file *, struct vfsmount *);
63520 + int (* const show_stats)(struct seq_file *, struct vfsmount *);
63521 #ifdef CONFIG_QUOTA
63522 - ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
63523 - ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
63524 + ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
63525 + ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
63526 #endif
63527 - int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
63528 + int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
63529 };
63530
63531 /*
63532 diff -urNp linux-2.6.32.49/include/linux/fs_struct.h linux-2.6.32.49/include/linux/fs_struct.h
63533 --- linux-2.6.32.49/include/linux/fs_struct.h 2011-11-08 19:02:43.000000000 -0500
63534 +++ linux-2.6.32.49/include/linux/fs_struct.h 2011-11-15 19:59:43.000000000 -0500
63535 @@ -4,7 +4,7 @@
63536 #include <linux/path.h>
63537
63538 struct fs_struct {
63539 - int users;
63540 + atomic_t users;
63541 rwlock_t lock;
63542 int umask;
63543 int in_exec;
63544 diff -urNp linux-2.6.32.49/include/linux/ftrace_event.h linux-2.6.32.49/include/linux/ftrace_event.h
63545 --- linux-2.6.32.49/include/linux/ftrace_event.h 2011-11-08 19:02:43.000000000 -0500
63546 +++ linux-2.6.32.49/include/linux/ftrace_event.h 2011-11-15 19:59:43.000000000 -0500
63547 @@ -163,7 +163,7 @@ extern int trace_define_field(struct ftr
63548 int filter_type);
63549 extern int trace_define_common_fields(struct ftrace_event_call *call);
63550
63551 -#define is_signed_type(type) (((type)(-1)) < 0)
63552 +#define is_signed_type(type) (((type)(-1)) < (type)1)
63553
63554 int trace_set_clr_event(const char *system, const char *event, int set);
63555
63556 diff -urNp linux-2.6.32.49/include/linux/genhd.h linux-2.6.32.49/include/linux/genhd.h
63557 --- linux-2.6.32.49/include/linux/genhd.h 2011-11-08 19:02:43.000000000 -0500
63558 +++ linux-2.6.32.49/include/linux/genhd.h 2011-11-15 19:59:43.000000000 -0500
63559 @@ -161,7 +161,7 @@ struct gendisk {
63560
63561 struct timer_rand_state *random;
63562
63563 - atomic_t sync_io; /* RAID */
63564 + atomic_unchecked_t sync_io; /* RAID */
63565 struct work_struct async_notify;
63566 #ifdef CONFIG_BLK_DEV_INTEGRITY
63567 struct blk_integrity *integrity;
63568 diff -urNp linux-2.6.32.49/include/linux/gracl.h linux-2.6.32.49/include/linux/gracl.h
63569 --- linux-2.6.32.49/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500
63570 +++ linux-2.6.32.49/include/linux/gracl.h 2011-11-15 19:59:43.000000000 -0500
63571 @@ -0,0 +1,317 @@
63572 +#ifndef GR_ACL_H
63573 +#define GR_ACL_H
63574 +
63575 +#include <linux/grdefs.h>
63576 +#include <linux/resource.h>
63577 +#include <linux/capability.h>
63578 +#include <linux/dcache.h>
63579 +#include <asm/resource.h>
63580 +
63581 +/* Major status information */
63582 +
63583 +#define GR_VERSION "grsecurity 2.2.2"
63584 +#define GRSECURITY_VERSION 0x2202
63585 +
63586 +enum {
63587 + GR_SHUTDOWN = 0,
63588 + GR_ENABLE = 1,
63589 + GR_SPROLE = 2,
63590 + GR_RELOAD = 3,
63591 + GR_SEGVMOD = 4,
63592 + GR_STATUS = 5,
63593 + GR_UNSPROLE = 6,
63594 + GR_PASSSET = 7,
63595 + GR_SPROLEPAM = 8,
63596 +};
63597 +
63598 +/* Password setup definitions
63599 + * kernel/grhash.c */
63600 +enum {
63601 + GR_PW_LEN = 128,
63602 + GR_SALT_LEN = 16,
63603 + GR_SHA_LEN = 32,
63604 +};
63605 +
63606 +enum {
63607 + GR_SPROLE_LEN = 64,
63608 +};
63609 +
63610 +enum {
63611 + GR_NO_GLOB = 0,
63612 + GR_REG_GLOB,
63613 + GR_CREATE_GLOB
63614 +};
63615 +
63616 +#define GR_NLIMITS 32
63617 +
63618 +/* Begin Data Structures */
63619 +
63620 +struct sprole_pw {
63621 + unsigned char *rolename;
63622 + unsigned char salt[GR_SALT_LEN];
63623 + unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
63624 +};
63625 +
63626 +struct name_entry {
63627 + __u32 key;
63628 + ino_t inode;
63629 + dev_t device;
63630 + char *name;
63631 + __u16 len;
63632 + __u8 deleted;
63633 + struct name_entry *prev;
63634 + struct name_entry *next;
63635 +};
63636 +
63637 +struct inodev_entry {
63638 + struct name_entry *nentry;
63639 + struct inodev_entry *prev;
63640 + struct inodev_entry *next;
63641 +};
63642 +
63643 +struct acl_role_db {
63644 + struct acl_role_label **r_hash;
63645 + __u32 r_size;
63646 +};
63647 +
63648 +struct inodev_db {
63649 + struct inodev_entry **i_hash;
63650 + __u32 i_size;
63651 +};
63652 +
63653 +struct name_db {
63654 + struct name_entry **n_hash;
63655 + __u32 n_size;
63656 +};
63657 +
63658 +struct crash_uid {
63659 + uid_t uid;
63660 + unsigned long expires;
63661 +};
63662 +
63663 +struct gr_hash_struct {
63664 + void **table;
63665 + void **nametable;
63666 + void *first;
63667 + __u32 table_size;
63668 + __u32 used_size;
63669 + int type;
63670 +};
63671 +
63672 +/* Userspace Grsecurity ACL data structures */
63673 +
63674 +struct acl_subject_label {
63675 + char *filename;
63676 + ino_t inode;
63677 + dev_t device;
63678 + __u32 mode;
63679 + kernel_cap_t cap_mask;
63680 + kernel_cap_t cap_lower;
63681 + kernel_cap_t cap_invert_audit;
63682 +
63683 + struct rlimit res[GR_NLIMITS];
63684 + __u32 resmask;
63685 +
63686 + __u8 user_trans_type;
63687 + __u8 group_trans_type;
63688 + uid_t *user_transitions;
63689 + gid_t *group_transitions;
63690 + __u16 user_trans_num;
63691 + __u16 group_trans_num;
63692 +
63693 + __u32 sock_families[2];
63694 + __u32 ip_proto[8];
63695 + __u32 ip_type;
63696 + struct acl_ip_label **ips;
63697 + __u32 ip_num;
63698 + __u32 inaddr_any_override;
63699 +
63700 + __u32 crashes;
63701 + unsigned long expires;
63702 +
63703 + struct acl_subject_label *parent_subject;
63704 + struct gr_hash_struct *hash;
63705 + struct acl_subject_label *prev;
63706 + struct acl_subject_label *next;
63707 +
63708 + struct acl_object_label **obj_hash;
63709 + __u32 obj_hash_size;
63710 + __u16 pax_flags;
63711 +};
63712 +
63713 +struct role_allowed_ip {
63714 + __u32 addr;
63715 + __u32 netmask;
63716 +
63717 + struct role_allowed_ip *prev;
63718 + struct role_allowed_ip *next;
63719 +};
63720 +
63721 +struct role_transition {
63722 + char *rolename;
63723 +
63724 + struct role_transition *prev;
63725 + struct role_transition *next;
63726 +};
63727 +
63728 +struct acl_role_label {
63729 + char *rolename;
63730 + uid_t uidgid;
63731 + __u16 roletype;
63732 +
63733 + __u16 auth_attempts;
63734 + unsigned long expires;
63735 +
63736 + struct acl_subject_label *root_label;
63737 + struct gr_hash_struct *hash;
63738 +
63739 + struct acl_role_label *prev;
63740 + struct acl_role_label *next;
63741 +
63742 + struct role_transition *transitions;
63743 + struct role_allowed_ip *allowed_ips;
63744 + uid_t *domain_children;
63745 + __u16 domain_child_num;
63746 +
63747 + struct acl_subject_label **subj_hash;
63748 + __u32 subj_hash_size;
63749 +};
63750 +
63751 +struct user_acl_role_db {
63752 + struct acl_role_label **r_table;
63753 + __u32 num_pointers; /* Number of allocations to track */
63754 + __u32 num_roles; /* Number of roles */
63755 + __u32 num_domain_children; /* Number of domain children */
63756 + __u32 num_subjects; /* Number of subjects */
63757 + __u32 num_objects; /* Number of objects */
63758 +};
63759 +
63760 +struct acl_object_label {
63761 + char *filename;
63762 + ino_t inode;
63763 + dev_t device;
63764 + __u32 mode;
63765 +
63766 + struct acl_subject_label *nested;
63767 + struct acl_object_label *globbed;
63768 +
63769 + /* next two structures not used */
63770 +
63771 + struct acl_object_label *prev;
63772 + struct acl_object_label *next;
63773 +};
63774 +
63775 +struct acl_ip_label {
63776 + char *iface;
63777 + __u32 addr;
63778 + __u32 netmask;
63779 + __u16 low, high;
63780 + __u8 mode;
63781 + __u32 type;
63782 + __u32 proto[8];
63783 +
63784 + /* next two structures not used */
63785 +
63786 + struct acl_ip_label *prev;
63787 + struct acl_ip_label *next;
63788 +};
63789 +
63790 +struct gr_arg {
63791 + struct user_acl_role_db role_db;
63792 + unsigned char pw[GR_PW_LEN];
63793 + unsigned char salt[GR_SALT_LEN];
63794 + unsigned char sum[GR_SHA_LEN];
63795 + unsigned char sp_role[GR_SPROLE_LEN];
63796 + struct sprole_pw *sprole_pws;
63797 + dev_t segv_device;
63798 + ino_t segv_inode;
63799 + uid_t segv_uid;
63800 + __u16 num_sprole_pws;
63801 + __u16 mode;
63802 +};
63803 +
63804 +struct gr_arg_wrapper {
63805 + struct gr_arg *arg;
63806 + __u32 version;
63807 + __u32 size;
63808 +};
63809 +
63810 +struct subject_map {
63811 + struct acl_subject_label *user;
63812 + struct acl_subject_label *kernel;
63813 + struct subject_map *prev;
63814 + struct subject_map *next;
63815 +};
63816 +
63817 +struct acl_subj_map_db {
63818 + struct subject_map **s_hash;
63819 + __u32 s_size;
63820 +};
63821 +
63822 +/* End Data Structures Section */
63823 +
63824 +/* Hash functions generated by empirical testing by Brad Spengler
63825 + Makes good use of the low bits of the inode. Generally 0-1 times
63826 + in loop for successful match. 0-3 for unsuccessful match.
63827 + Shift/add algorithm with modulus of table size and an XOR*/
63828 +
63829 +static __inline__ unsigned int
63830 +rhash(const uid_t uid, const __u16 type, const unsigned int sz)
63831 +{
63832 + return ((((uid + type) << (16 + type)) ^ uid) % sz);
63833 +}
63834 +
63835 + static __inline__ unsigned int
63836 +shash(const struct acl_subject_label *userp, const unsigned int sz)
63837 +{
63838 + return ((const unsigned long)userp % sz);
63839 +}
63840 +
63841 +static __inline__ unsigned int
63842 +fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
63843 +{
63844 + return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
63845 +}
63846 +
63847 +static __inline__ unsigned int
63848 +nhash(const char *name, const __u16 len, const unsigned int sz)
63849 +{
63850 + return full_name_hash((const unsigned char *)name, len) % sz;
63851 +}
63852 +
63853 +#define FOR_EACH_ROLE_START(role) \
63854 + role = role_list; \
63855 + while (role) {
63856 +
63857 +#define FOR_EACH_ROLE_END(role) \
63858 + role = role->prev; \
63859 + }
63860 +
63861 +#define FOR_EACH_SUBJECT_START(role,subj,iter) \
63862 + subj = NULL; \
63863 + iter = 0; \
63864 + while (iter < role->subj_hash_size) { \
63865 + if (subj == NULL) \
63866 + subj = role->subj_hash[iter]; \
63867 + if (subj == NULL) { \
63868 + iter++; \
63869 + continue; \
63870 + }
63871 +
63872 +#define FOR_EACH_SUBJECT_END(subj,iter) \
63873 + subj = subj->next; \
63874 + if (subj == NULL) \
63875 + iter++; \
63876 + }
63877 +
63878 +
63879 +#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
63880 + subj = role->hash->first; \
63881 + while (subj != NULL) {
63882 +
63883 +#define FOR_EACH_NESTED_SUBJECT_END(subj) \
63884 + subj = subj->next; \
63885 + }
63886 +
63887 +#endif
63888 +
63889 diff -urNp linux-2.6.32.49/include/linux/gralloc.h linux-2.6.32.49/include/linux/gralloc.h
63890 --- linux-2.6.32.49/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500
63891 +++ linux-2.6.32.49/include/linux/gralloc.h 2011-11-15 19:59:43.000000000 -0500
63892 @@ -0,0 +1,9 @@
63893 +#ifndef __GRALLOC_H
63894 +#define __GRALLOC_H
63895 +
63896 +void acl_free_all(void);
63897 +int acl_alloc_stack_init(unsigned long size);
63898 +void *acl_alloc(unsigned long len);
63899 +void *acl_alloc_num(unsigned long num, unsigned long len);
63900 +
63901 +#endif
63902 diff -urNp linux-2.6.32.49/include/linux/grdefs.h linux-2.6.32.49/include/linux/grdefs.h
63903 --- linux-2.6.32.49/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
63904 +++ linux-2.6.32.49/include/linux/grdefs.h 2011-11-15 19:59:43.000000000 -0500
63905 @@ -0,0 +1,140 @@
63906 +#ifndef GRDEFS_H
63907 +#define GRDEFS_H
63908 +
63909 +/* Begin grsecurity status declarations */
63910 +
63911 +enum {
63912 + GR_READY = 0x01,
63913 + GR_STATUS_INIT = 0x00 // disabled state
63914 +};
63915 +
63916 +/* Begin ACL declarations */
63917 +
63918 +/* Role flags */
63919 +
63920 +enum {
63921 + GR_ROLE_USER = 0x0001,
63922 + GR_ROLE_GROUP = 0x0002,
63923 + GR_ROLE_DEFAULT = 0x0004,
63924 + GR_ROLE_SPECIAL = 0x0008,
63925 + GR_ROLE_AUTH = 0x0010,
63926 + GR_ROLE_NOPW = 0x0020,
63927 + GR_ROLE_GOD = 0x0040,
63928 + GR_ROLE_LEARN = 0x0080,
63929 + GR_ROLE_TPE = 0x0100,
63930 + GR_ROLE_DOMAIN = 0x0200,
63931 + GR_ROLE_PAM = 0x0400,
63932 + GR_ROLE_PERSIST = 0x800
63933 +};
63934 +
63935 +/* ACL Subject and Object mode flags */
63936 +enum {
63937 + GR_DELETED = 0x80000000
63938 +};
63939 +
63940 +/* ACL Object-only mode flags */
63941 +enum {
63942 + GR_READ = 0x00000001,
63943 + GR_APPEND = 0x00000002,
63944 + GR_WRITE = 0x00000004,
63945 + GR_EXEC = 0x00000008,
63946 + GR_FIND = 0x00000010,
63947 + GR_INHERIT = 0x00000020,
63948 + GR_SETID = 0x00000040,
63949 + GR_CREATE = 0x00000080,
63950 + GR_DELETE = 0x00000100,
63951 + GR_LINK = 0x00000200,
63952 + GR_AUDIT_READ = 0x00000400,
63953 + GR_AUDIT_APPEND = 0x00000800,
63954 + GR_AUDIT_WRITE = 0x00001000,
63955 + GR_AUDIT_EXEC = 0x00002000,
63956 + GR_AUDIT_FIND = 0x00004000,
63957 + GR_AUDIT_INHERIT= 0x00008000,
63958 + GR_AUDIT_SETID = 0x00010000,
63959 + GR_AUDIT_CREATE = 0x00020000,
63960 + GR_AUDIT_DELETE = 0x00040000,
63961 + GR_AUDIT_LINK = 0x00080000,
63962 + GR_PTRACERD = 0x00100000,
63963 + GR_NOPTRACE = 0x00200000,
63964 + GR_SUPPRESS = 0x00400000,
63965 + GR_NOLEARN = 0x00800000,
63966 + GR_INIT_TRANSFER= 0x01000000
63967 +};
63968 +
63969 +#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
63970 + GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
63971 + GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
63972 +
63973 +/* ACL subject-only mode flags */
63974 +enum {
63975 + GR_KILL = 0x00000001,
63976 + GR_VIEW = 0x00000002,
63977 + GR_PROTECTED = 0x00000004,
63978 + GR_LEARN = 0x00000008,
63979 + GR_OVERRIDE = 0x00000010,
63980 + /* just a placeholder, this mode is only used in userspace */
63981 + GR_DUMMY = 0x00000020,
63982 + GR_PROTSHM = 0x00000040,
63983 + GR_KILLPROC = 0x00000080,
63984 + GR_KILLIPPROC = 0x00000100,
63985 + /* just a placeholder, this mode is only used in userspace */
63986 + GR_NOTROJAN = 0x00000200,
63987 + GR_PROTPROCFD = 0x00000400,
63988 + GR_PROCACCT = 0x00000800,
63989 + GR_RELAXPTRACE = 0x00001000,
63990 + GR_NESTED = 0x00002000,
63991 + GR_INHERITLEARN = 0x00004000,
63992 + GR_PROCFIND = 0x00008000,
63993 + GR_POVERRIDE = 0x00010000,
63994 + GR_KERNELAUTH = 0x00020000,
63995 + GR_ATSECURE = 0x00040000,
63996 + GR_SHMEXEC = 0x00080000
63997 +};
63998 +
63999 +enum {
64000 + GR_PAX_ENABLE_SEGMEXEC = 0x0001,
64001 + GR_PAX_ENABLE_PAGEEXEC = 0x0002,
64002 + GR_PAX_ENABLE_MPROTECT = 0x0004,
64003 + GR_PAX_ENABLE_RANDMMAP = 0x0008,
64004 + GR_PAX_ENABLE_EMUTRAMP = 0x0010,
64005 + GR_PAX_DISABLE_SEGMEXEC = 0x0100,
64006 + GR_PAX_DISABLE_PAGEEXEC = 0x0200,
64007 + GR_PAX_DISABLE_MPROTECT = 0x0400,
64008 + GR_PAX_DISABLE_RANDMMAP = 0x0800,
64009 + GR_PAX_DISABLE_EMUTRAMP = 0x1000,
64010 +};
64011 +
64012 +enum {
64013 + GR_ID_USER = 0x01,
64014 + GR_ID_GROUP = 0x02,
64015 +};
64016 +
64017 +enum {
64018 + GR_ID_ALLOW = 0x01,
64019 + GR_ID_DENY = 0x02,
64020 +};
64021 +
64022 +#define GR_CRASH_RES 31
64023 +#define GR_UIDTABLE_MAX 500
64024 +
64025 +/* begin resource learning section */
64026 +enum {
64027 + GR_RLIM_CPU_BUMP = 60,
64028 + GR_RLIM_FSIZE_BUMP = 50000,
64029 + GR_RLIM_DATA_BUMP = 10000,
64030 + GR_RLIM_STACK_BUMP = 1000,
64031 + GR_RLIM_CORE_BUMP = 10000,
64032 + GR_RLIM_RSS_BUMP = 500000,
64033 + GR_RLIM_NPROC_BUMP = 1,
64034 + GR_RLIM_NOFILE_BUMP = 5,
64035 + GR_RLIM_MEMLOCK_BUMP = 50000,
64036 + GR_RLIM_AS_BUMP = 500000,
64037 + GR_RLIM_LOCKS_BUMP = 2,
64038 + GR_RLIM_SIGPENDING_BUMP = 5,
64039 + GR_RLIM_MSGQUEUE_BUMP = 10000,
64040 + GR_RLIM_NICE_BUMP = 1,
64041 + GR_RLIM_RTPRIO_BUMP = 1,
64042 + GR_RLIM_RTTIME_BUMP = 1000000
64043 +};
64044 +
64045 +#endif
64046 diff -urNp linux-2.6.32.49/include/linux/grinternal.h linux-2.6.32.49/include/linux/grinternal.h
64047 --- linux-2.6.32.49/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500
64048 +++ linux-2.6.32.49/include/linux/grinternal.h 2011-11-15 19:59:43.000000000 -0500
64049 @@ -0,0 +1,218 @@
64050 +#ifndef __GRINTERNAL_H
64051 +#define __GRINTERNAL_H
64052 +
64053 +#ifdef CONFIG_GRKERNSEC
64054 +
64055 +#include <linux/fs.h>
64056 +#include <linux/mnt_namespace.h>
64057 +#include <linux/nsproxy.h>
64058 +#include <linux/gracl.h>
64059 +#include <linux/grdefs.h>
64060 +#include <linux/grmsg.h>
64061 +
64062 +void gr_add_learn_entry(const char *fmt, ...)
64063 + __attribute__ ((format (printf, 1, 2)));
64064 +__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
64065 + const struct vfsmount *mnt);
64066 +__u32 gr_check_create(const struct dentry *new_dentry,
64067 + const struct dentry *parent,
64068 + const struct vfsmount *mnt, const __u32 mode);
64069 +int gr_check_protected_task(const struct task_struct *task);
64070 +__u32 to_gr_audit(const __u32 reqmode);
64071 +int gr_set_acls(const int type);
64072 +int gr_apply_subject_to_task(struct task_struct *task);
64073 +int gr_acl_is_enabled(void);
64074 +char gr_roletype_to_char(void);
64075 +
64076 +void gr_handle_alertkill(struct task_struct *task);
64077 +char *gr_to_filename(const struct dentry *dentry,
64078 + const struct vfsmount *mnt);
64079 +char *gr_to_filename1(const struct dentry *dentry,
64080 + const struct vfsmount *mnt);
64081 +char *gr_to_filename2(const struct dentry *dentry,
64082 + const struct vfsmount *mnt);
64083 +char *gr_to_filename3(const struct dentry *dentry,
64084 + const struct vfsmount *mnt);
64085 +
64086 +extern int grsec_enable_harden_ptrace;
64087 +extern int grsec_enable_link;
64088 +extern int grsec_enable_fifo;
64089 +extern int grsec_enable_shm;
64090 +extern int grsec_enable_execlog;
64091 +extern int grsec_enable_signal;
64092 +extern int grsec_enable_audit_ptrace;
64093 +extern int grsec_enable_forkfail;
64094 +extern int grsec_enable_time;
64095 +extern int grsec_enable_rofs;
64096 +extern int grsec_enable_chroot_shmat;
64097 +extern int grsec_enable_chroot_mount;
64098 +extern int grsec_enable_chroot_double;
64099 +extern int grsec_enable_chroot_pivot;
64100 +extern int grsec_enable_chroot_chdir;
64101 +extern int grsec_enable_chroot_chmod;
64102 +extern int grsec_enable_chroot_mknod;
64103 +extern int grsec_enable_chroot_fchdir;
64104 +extern int grsec_enable_chroot_nice;
64105 +extern int grsec_enable_chroot_execlog;
64106 +extern int grsec_enable_chroot_caps;
64107 +extern int grsec_enable_chroot_sysctl;
64108 +extern int grsec_enable_chroot_unix;
64109 +extern int grsec_enable_tpe;
64110 +extern int grsec_tpe_gid;
64111 +extern int grsec_enable_tpe_all;
64112 +extern int grsec_enable_tpe_invert;
64113 +extern int grsec_enable_socket_all;
64114 +extern int grsec_socket_all_gid;
64115 +extern int grsec_enable_socket_client;
64116 +extern int grsec_socket_client_gid;
64117 +extern int grsec_enable_socket_server;
64118 +extern int grsec_socket_server_gid;
64119 +extern int grsec_audit_gid;
64120 +extern int grsec_enable_group;
64121 +extern int grsec_enable_audit_textrel;
64122 +extern int grsec_enable_log_rwxmaps;
64123 +extern int grsec_enable_mount;
64124 +extern int grsec_enable_chdir;
64125 +extern int grsec_resource_logging;
64126 +extern int grsec_enable_blackhole;
64127 +extern int grsec_lastack_retries;
64128 +extern int grsec_enable_brute;
64129 +extern int grsec_lock;
64130 +
64131 +extern spinlock_t grsec_alert_lock;
64132 +extern unsigned long grsec_alert_wtime;
64133 +extern unsigned long grsec_alert_fyet;
64134 +
64135 +extern spinlock_t grsec_audit_lock;
64136 +
64137 +extern rwlock_t grsec_exec_file_lock;
64138 +
64139 +#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
64140 + gr_to_filename2((tsk)->exec_file->f_path.dentry, \
64141 + (tsk)->exec_file->f_vfsmnt) : "/")
64142 +
64143 +#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
64144 + gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
64145 + (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
64146 +
64147 +#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
64148 + gr_to_filename((tsk)->exec_file->f_path.dentry, \
64149 + (tsk)->exec_file->f_vfsmnt) : "/")
64150 +
64151 +#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
64152 + gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
64153 + (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
64154 +
64155 +#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
64156 +
64157 +#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
64158 +
64159 +#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
64160 + (task)->pid, (cred)->uid, \
64161 + (cred)->euid, (cred)->gid, (cred)->egid, \
64162 + gr_parent_task_fullpath(task), \
64163 + (task)->real_parent->comm, (task)->real_parent->pid, \
64164 + (pcred)->uid, (pcred)->euid, \
64165 + (pcred)->gid, (pcred)->egid
64166 +
64167 +#define GR_CHROOT_CAPS {{ \
64168 + CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
64169 + CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
64170 + CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
64171 + CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
64172 + CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
64173 + CAP_TO_MASK(CAP_IPC_OWNER) | CAP_TO_MASK(CAP_SETFCAP), \
64174 + CAP_TO_MASK(CAP_MAC_ADMIN) }}
64175 +
64176 +#define security_learn(normal_msg,args...) \
64177 +({ \
64178 + read_lock(&grsec_exec_file_lock); \
64179 + gr_add_learn_entry(normal_msg "\n", ## args); \
64180 + read_unlock(&grsec_exec_file_lock); \
64181 +})
64182 +
64183 +enum {
64184 + GR_DO_AUDIT,
64185 + GR_DONT_AUDIT,
64186 + GR_DONT_AUDIT_GOOD
64187 +};
64188 +
64189 +enum {
64190 + GR_TTYSNIFF,
64191 + GR_RBAC,
64192 + GR_RBAC_STR,
64193 + GR_STR_RBAC,
64194 + GR_RBAC_MODE2,
64195 + GR_RBAC_MODE3,
64196 + GR_FILENAME,
64197 + GR_SYSCTL_HIDDEN,
64198 + GR_NOARGS,
64199 + GR_ONE_INT,
64200 + GR_ONE_INT_TWO_STR,
64201 + GR_ONE_STR,
64202 + GR_STR_INT,
64203 + GR_TWO_STR_INT,
64204 + GR_TWO_INT,
64205 + GR_TWO_U64,
64206 + GR_THREE_INT,
64207 + GR_FIVE_INT_TWO_STR,
64208 + GR_TWO_STR,
64209 + GR_THREE_STR,
64210 + GR_FOUR_STR,
64211 + GR_STR_FILENAME,
64212 + GR_FILENAME_STR,
64213 + GR_FILENAME_TWO_INT,
64214 + GR_FILENAME_TWO_INT_STR,
64215 + GR_TEXTREL,
64216 + GR_PTRACE,
64217 + GR_RESOURCE,
64218 + GR_CAP,
64219 + GR_SIG,
64220 + GR_SIG2,
64221 + GR_CRASH1,
64222 + GR_CRASH2,
64223 + GR_PSACCT,
64224 + GR_RWXMAP
64225 +};
64226 +
64227 +#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
64228 +#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
64229 +#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
64230 +#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
64231 +#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
64232 +#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
64233 +#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
64234 +#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
64235 +#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
64236 +#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
64237 +#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
64238 +#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
64239 +#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
64240 +#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
64241 +#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
64242 +#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
64243 +#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
64244 +#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
64245 +#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
64246 +#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
64247 +#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
64248 +#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
64249 +#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
64250 +#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
64251 +#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
64252 +#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
64253 +#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
64254 +#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
64255 +#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
64256 +#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
64257 +#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
64258 +#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
64259 +#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
64260 +#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
64261 +#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
64262 +
64263 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
64264 +
64265 +#endif
64266 +
64267 +#endif
64268 diff -urNp linux-2.6.32.49/include/linux/grmsg.h linux-2.6.32.49/include/linux/grmsg.h
64269 --- linux-2.6.32.49/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500
64270 +++ linux-2.6.32.49/include/linux/grmsg.h 2011-11-15 19:59:43.000000000 -0500
64271 @@ -0,0 +1,108 @@
64272 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
64273 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
64274 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
64275 +#define GR_STOPMOD_MSG "denied modification of module state by "
64276 +#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
64277 +#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
64278 +#define GR_IOPERM_MSG "denied use of ioperm() by "
64279 +#define GR_IOPL_MSG "denied use of iopl() by "
64280 +#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
64281 +#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
64282 +#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
64283 +#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
64284 +#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
64285 +#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
64286 +#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
64287 +#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
64288 +#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
64289 +#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
64290 +#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
64291 +#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
64292 +#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
64293 +#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
64294 +#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
64295 +#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
64296 +#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
64297 +#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
64298 +#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
64299 +#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
64300 +#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
64301 +#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
64302 +#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
64303 +#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
64304 +#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
64305 +#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
64306 +#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
64307 +#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
64308 +#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
64309 +#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
64310 +#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
64311 +#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
64312 +#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
64313 +#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
64314 +#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
64315 +#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
64316 +#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
64317 +#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
64318 +#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
64319 +#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
64320 +#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
64321 +#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
64322 +#define GR_INITF_ACL_MSG "init_variables() failed %s by "
64323 +#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
64324 +#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
64325 +#define GR_SHUTS_ACL_MSG "shutdown auth success for "
64326 +#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
64327 +#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
64328 +#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
64329 +#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
64330 +#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
64331 +#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
64332 +#define GR_ENABLEF_ACL_MSG "unable to load %s for "
64333 +#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
64334 +#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
64335 +#define GR_RELOADF_ACL_MSG "failed reload of %s for "
64336 +#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
64337 +#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
64338 +#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
64339 +#define GR_SPROLEF_ACL_MSG "special role %s failure for "
64340 +#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
64341 +#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
64342 +#define GR_INVMODE_ACL_MSG "invalid mode %d by "
64343 +#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
64344 +#define GR_FAILFORK_MSG "failed fork with errno %s by "
64345 +#define GR_NICE_CHROOT_MSG "denied priority change by "
64346 +#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
64347 +#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
64348 +#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
64349 +#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
64350 +#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
64351 +#define GR_TIME_MSG "time set by "
64352 +#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
64353 +#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
64354 +#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
64355 +#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
64356 +#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
64357 +#define GR_BIND_MSG "denied bind() by "
64358 +#define GR_CONNECT_MSG "denied connect() by "
64359 +#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
64360 +#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
64361 +#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
64362 +#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
64363 +#define GR_CAP_ACL_MSG "use of %s denied for "
64364 +#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for "
64365 +#define GR_CAP_ACL_MSG2 "use of %s permitted for "
64366 +#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
64367 +#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
64368 +#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
64369 +#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
64370 +#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
64371 +#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
64372 +#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
64373 +#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
64374 +#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
64375 +#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
64376 +#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
64377 +#define GR_VM86_MSG "denied use of vm86 by "
64378 +#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
64379 +#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
64380 diff -urNp linux-2.6.32.49/include/linux/grsecurity.h linux-2.6.32.49/include/linux/grsecurity.h
64381 --- linux-2.6.32.49/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500
64382 +++ linux-2.6.32.49/include/linux/grsecurity.h 2011-11-18 19:31:08.000000000 -0500
64383 @@ -0,0 +1,218 @@
64384 +#ifndef GR_SECURITY_H
64385 +#define GR_SECURITY_H
64386 +#include <linux/fs.h>
64387 +#include <linux/fs_struct.h>
64388 +#include <linux/binfmts.h>
64389 +#include <linux/gracl.h>
64390 +#include <linux/compat.h>
64391 +
64392 +/* notify of brain-dead configs */
64393 +#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
64394 +#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
64395 +#endif
64396 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
64397 +#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
64398 +#endif
64399 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
64400 +#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
64401 +#endif
64402 +#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
64403 +#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
64404 +#endif
64405 +#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
64406 +#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
64407 +#endif
64408 +#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
64409 +#error "CONFIG_PAX enabled, but no PaX options are enabled."
64410 +#endif
64411 +
64412 +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
64413 +void gr_handle_brute_check(void);
64414 +void gr_handle_kernel_exploit(void);
64415 +int gr_process_user_ban(void);
64416 +
64417 +char gr_roletype_to_char(void);
64418 +
64419 +int gr_acl_enable_at_secure(void);
64420 +
64421 +int gr_check_user_change(int real, int effective, int fs);
64422 +int gr_check_group_change(int real, int effective, int fs);
64423 +
64424 +void gr_del_task_from_ip_table(struct task_struct *p);
64425 +
64426 +int gr_pid_is_chrooted(struct task_struct *p);
64427 +int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
64428 +int gr_handle_chroot_nice(void);
64429 +int gr_handle_chroot_sysctl(const int op);
64430 +int gr_handle_chroot_setpriority(struct task_struct *p,
64431 + const int niceval);
64432 +int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
64433 +int gr_handle_chroot_chroot(const struct dentry *dentry,
64434 + const struct vfsmount *mnt);
64435 +void gr_handle_chroot_chdir(struct path *path);
64436 +int gr_handle_chroot_chmod(const struct dentry *dentry,
64437 + const struct vfsmount *mnt, const int mode);
64438 +int gr_handle_chroot_mknod(const struct dentry *dentry,
64439 + const struct vfsmount *mnt, const int mode);
64440 +int gr_handle_chroot_mount(const struct dentry *dentry,
64441 + const struct vfsmount *mnt,
64442 + const char *dev_name);
64443 +int gr_handle_chroot_pivot(void);
64444 +int gr_handle_chroot_unix(const pid_t pid);
64445 +
64446 +int gr_handle_rawio(const struct inode *inode);
64447 +
64448 +void gr_handle_ioperm(void);
64449 +void gr_handle_iopl(void);
64450 +
64451 +int gr_tpe_allow(const struct file *file);
64452 +
64453 +void gr_set_chroot_entries(struct task_struct *task, struct path *path);
64454 +void gr_clear_chroot_entries(struct task_struct *task);
64455 +
64456 +void gr_log_forkfail(const int retval);
64457 +void gr_log_timechange(void);
64458 +void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
64459 +void gr_log_chdir(const struct dentry *dentry,
64460 + const struct vfsmount *mnt);
64461 +void gr_log_chroot_exec(const struct dentry *dentry,
64462 + const struct vfsmount *mnt);
64463 +void gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv);
64464 +#ifdef CONFIG_COMPAT
64465 +void gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv);
64466 +#endif
64467 +void gr_log_remount(const char *devname, const int retval);
64468 +void gr_log_unmount(const char *devname, const int retval);
64469 +void gr_log_mount(const char *from, const char *to, const int retval);
64470 +void gr_log_textrel(struct vm_area_struct *vma);
64471 +void gr_log_rwxmmap(struct file *file);
64472 +void gr_log_rwxmprotect(struct file *file);
64473 +
64474 +int gr_handle_follow_link(const struct inode *parent,
64475 + const struct inode *inode,
64476 + const struct dentry *dentry,
64477 + const struct vfsmount *mnt);
64478 +int gr_handle_fifo(const struct dentry *dentry,
64479 + const struct vfsmount *mnt,
64480 + const struct dentry *dir, const int flag,
64481 + const int acc_mode);
64482 +int gr_handle_hardlink(const struct dentry *dentry,
64483 + const struct vfsmount *mnt,
64484 + struct inode *inode,
64485 + const int mode, const char *to);
64486 +
64487 +int gr_is_capable(const int cap);
64488 +int gr_is_capable_nolog(const int cap);
64489 +void gr_learn_resource(const struct task_struct *task, const int limit,
64490 + const unsigned long wanted, const int gt);
64491 +void gr_copy_label(struct task_struct *tsk);
64492 +void gr_handle_crash(struct task_struct *task, const int sig);
64493 +int gr_handle_signal(const struct task_struct *p, const int sig);
64494 +int gr_check_crash_uid(const uid_t uid);
64495 +int gr_check_protected_task(const struct task_struct *task);
64496 +int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
64497 +int gr_acl_handle_mmap(const struct file *file,
64498 + const unsigned long prot);
64499 +int gr_acl_handle_mprotect(const struct file *file,
64500 + const unsigned long prot);
64501 +int gr_check_hidden_task(const struct task_struct *tsk);
64502 +__u32 gr_acl_handle_truncate(const struct dentry *dentry,
64503 + const struct vfsmount *mnt);
64504 +__u32 gr_acl_handle_utime(const struct dentry *dentry,
64505 + const struct vfsmount *mnt);
64506 +__u32 gr_acl_handle_access(const struct dentry *dentry,
64507 + const struct vfsmount *mnt, const int fmode);
64508 +__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
64509 + const struct vfsmount *mnt, mode_t mode);
64510 +__u32 gr_acl_handle_chmod(const struct dentry *dentry,
64511 + const struct vfsmount *mnt, mode_t mode);
64512 +__u32 gr_acl_handle_chown(const struct dentry *dentry,
64513 + const struct vfsmount *mnt);
64514 +__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
64515 + const struct vfsmount *mnt);
64516 +int gr_handle_ptrace(struct task_struct *task, const long request);
64517 +int gr_handle_proc_ptrace(struct task_struct *task);
64518 +__u32 gr_acl_handle_execve(const struct dentry *dentry,
64519 + const struct vfsmount *mnt);
64520 +int gr_check_crash_exec(const struct file *filp);
64521 +int gr_acl_is_enabled(void);
64522 +void gr_set_kernel_label(struct task_struct *task);
64523 +void gr_set_role_label(struct task_struct *task, const uid_t uid,
64524 + const gid_t gid);
64525 +int gr_set_proc_label(const struct dentry *dentry,
64526 + const struct vfsmount *mnt,
64527 + const int unsafe_share);
64528 +__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
64529 + const struct vfsmount *mnt);
64530 +__u32 gr_acl_handle_open(const struct dentry *dentry,
64531 + const struct vfsmount *mnt, int acc_mode);
64532 +__u32 gr_acl_handle_creat(const struct dentry *dentry,
64533 + const struct dentry *p_dentry,
64534 + const struct vfsmount *p_mnt,
64535 + int open_flags, int acc_mode, const int imode);
64536 +void gr_handle_create(const struct dentry *dentry,
64537 + const struct vfsmount *mnt);
64538 +void gr_handle_proc_create(const struct dentry *dentry,
64539 + const struct inode *inode);
64540 +__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
64541 + const struct dentry *parent_dentry,
64542 + const struct vfsmount *parent_mnt,
64543 + const int mode);
64544 +__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
64545 + const struct dentry *parent_dentry,
64546 + const struct vfsmount *parent_mnt);
64547 +__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
64548 + const struct vfsmount *mnt);
64549 +void gr_handle_delete(const ino_t ino, const dev_t dev);
64550 +__u32 gr_acl_handle_unlink(const struct dentry *dentry,
64551 + const struct vfsmount *mnt);
64552 +__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
64553 + const struct dentry *parent_dentry,
64554 + const struct vfsmount *parent_mnt,
64555 + const char *from);
64556 +__u32 gr_acl_handle_link(const struct dentry *new_dentry,
64557 + const struct dentry *parent_dentry,
64558 + const struct vfsmount *parent_mnt,
64559 + const struct dentry *old_dentry,
64560 + const struct vfsmount *old_mnt, const char *to);
64561 +int gr_acl_handle_rename(struct dentry *new_dentry,
64562 + struct dentry *parent_dentry,
64563 + const struct vfsmount *parent_mnt,
64564 + struct dentry *old_dentry,
64565 + struct inode *old_parent_inode,
64566 + struct vfsmount *old_mnt, const char *newname);
64567 +void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
64568 + struct dentry *old_dentry,
64569 + struct dentry *new_dentry,
64570 + struct vfsmount *mnt, const __u8 replace);
64571 +__u32 gr_check_link(const struct dentry *new_dentry,
64572 + const struct dentry *parent_dentry,
64573 + const struct vfsmount *parent_mnt,
64574 + const struct dentry *old_dentry,
64575 + const struct vfsmount *old_mnt);
64576 +int gr_acl_handle_filldir(const struct file *file, const char *name,
64577 + const unsigned int namelen, const ino_t ino);
64578 +
64579 +__u32 gr_acl_handle_unix(const struct dentry *dentry,
64580 + const struct vfsmount *mnt);
64581 +void gr_acl_handle_exit(void);
64582 +void gr_acl_handle_psacct(struct task_struct *task, const long code);
64583 +int gr_acl_handle_procpidmem(const struct task_struct *task);
64584 +int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
64585 +int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
64586 +void gr_audit_ptrace(struct task_struct *task);
64587 +dev_t gr_get_dev_from_dentry(struct dentry *dentry);
64588 +
64589 +#ifdef CONFIG_GRKERNSEC
64590 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
64591 +void gr_handle_vm86(void);
64592 +void gr_handle_mem_readwrite(u64 from, u64 to);
64593 +
64594 +extern int grsec_enable_dmesg;
64595 +extern int grsec_disable_privio;
64596 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
64597 +extern int grsec_enable_chroot_findtask;
64598 +#endif
64599 +#endif
64600 +
64601 +#endif
64602 diff -urNp linux-2.6.32.49/include/linux/hdpu_features.h linux-2.6.32.49/include/linux/hdpu_features.h
64603 --- linux-2.6.32.49/include/linux/hdpu_features.h 2011-11-08 19:02:43.000000000 -0500
64604 +++ linux-2.6.32.49/include/linux/hdpu_features.h 2011-11-15 19:59:43.000000000 -0500
64605 @@ -3,7 +3,7 @@
64606 struct cpustate_t {
64607 spinlock_t lock;
64608 int excl;
64609 - int open_count;
64610 + atomic_t open_count;
64611 unsigned char cached_val;
64612 int inited;
64613 unsigned long *set_addr;
64614 diff -urNp linux-2.6.32.49/include/linux/highmem.h linux-2.6.32.49/include/linux/highmem.h
64615 --- linux-2.6.32.49/include/linux/highmem.h 2011-11-08 19:02:43.000000000 -0500
64616 +++ linux-2.6.32.49/include/linux/highmem.h 2011-11-15 19:59:43.000000000 -0500
64617 @@ -137,6 +137,18 @@ static inline void clear_highpage(struct
64618 kunmap_atomic(kaddr, KM_USER0);
64619 }
64620
64621 +static inline void sanitize_highpage(struct page *page)
64622 +{
64623 + void *kaddr;
64624 + unsigned long flags;
64625 +
64626 + local_irq_save(flags);
64627 + kaddr = kmap_atomic(page, KM_CLEARPAGE);
64628 + clear_page(kaddr);
64629 + kunmap_atomic(kaddr, KM_CLEARPAGE);
64630 + local_irq_restore(flags);
64631 +}
64632 +
64633 static inline void zero_user_segments(struct page *page,
64634 unsigned start1, unsigned end1,
64635 unsigned start2, unsigned end2)
64636 diff -urNp linux-2.6.32.49/include/linux/i2c.h linux-2.6.32.49/include/linux/i2c.h
64637 --- linux-2.6.32.49/include/linux/i2c.h 2011-11-08 19:02:43.000000000 -0500
64638 +++ linux-2.6.32.49/include/linux/i2c.h 2011-11-15 19:59:43.000000000 -0500
64639 @@ -325,6 +325,7 @@ struct i2c_algorithm {
64640 /* To determine what the adapter supports */
64641 u32 (*functionality) (struct i2c_adapter *);
64642 };
64643 +typedef struct i2c_algorithm __no_const i2c_algorithm_no_const;
64644
64645 /*
64646 * i2c_adapter is the structure used to identify a physical i2c bus along
64647 diff -urNp linux-2.6.32.49/include/linux/i2o.h linux-2.6.32.49/include/linux/i2o.h
64648 --- linux-2.6.32.49/include/linux/i2o.h 2011-11-08 19:02:43.000000000 -0500
64649 +++ linux-2.6.32.49/include/linux/i2o.h 2011-11-15 19:59:43.000000000 -0500
64650 @@ -564,7 +564,7 @@ struct i2o_controller {
64651 struct i2o_device *exec; /* Executive */
64652 #if BITS_PER_LONG == 64
64653 spinlock_t context_list_lock; /* lock for context_list */
64654 - atomic_t context_list_counter; /* needed for unique contexts */
64655 + atomic_unchecked_t context_list_counter; /* needed for unique contexts */
64656 struct list_head context_list; /* list of context id's
64657 and pointers */
64658 #endif
64659 diff -urNp linux-2.6.32.49/include/linux/init_task.h linux-2.6.32.49/include/linux/init_task.h
64660 --- linux-2.6.32.49/include/linux/init_task.h 2011-11-08 19:02:43.000000000 -0500
64661 +++ linux-2.6.32.49/include/linux/init_task.h 2011-11-15 19:59:43.000000000 -0500
64662 @@ -83,6 +83,12 @@ extern struct group_info init_groups;
64663 #define INIT_IDS
64664 #endif
64665
64666 +#ifdef CONFIG_X86
64667 +#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
64668 +#else
64669 +#define INIT_TASK_THREAD_INFO
64670 +#endif
64671 +
64672 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
64673 /*
64674 * Because of the reduced scope of CAP_SETPCAP when filesystem
64675 @@ -156,6 +162,7 @@ extern struct cred init_cred;
64676 __MUTEX_INITIALIZER(tsk.cred_guard_mutex), \
64677 .comm = "swapper", \
64678 .thread = INIT_THREAD, \
64679 + INIT_TASK_THREAD_INFO \
64680 .fs = &init_fs, \
64681 .files = &init_files, \
64682 .signal = &init_signals, \
64683 diff -urNp linux-2.6.32.49/include/linux/intel-iommu.h linux-2.6.32.49/include/linux/intel-iommu.h
64684 --- linux-2.6.32.49/include/linux/intel-iommu.h 2011-11-08 19:02:43.000000000 -0500
64685 +++ linux-2.6.32.49/include/linux/intel-iommu.h 2011-11-15 19:59:43.000000000 -0500
64686 @@ -296,7 +296,7 @@ struct iommu_flush {
64687 u8 fm, u64 type);
64688 void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
64689 unsigned int size_order, u64 type);
64690 -};
64691 +} __no_const;
64692
64693 enum {
64694 SR_DMAR_FECTL_REG,
64695 diff -urNp linux-2.6.32.49/include/linux/interrupt.h linux-2.6.32.49/include/linux/interrupt.h
64696 --- linux-2.6.32.49/include/linux/interrupt.h 2011-11-26 19:44:53.000000000 -0500
64697 +++ linux-2.6.32.49/include/linux/interrupt.h 2011-11-26 19:45:13.000000000 -0500
64698 @@ -369,7 +369,7 @@ enum
64699 /* map softirq index to softirq name. update 'softirq_to_name' in
64700 * kernel/softirq.c when adding a new softirq.
64701 */
64702 -extern char *softirq_to_name[NR_SOFTIRQS];
64703 +extern const char * const softirq_to_name[NR_SOFTIRQS];
64704
64705 /* softirq mask and active fields moved to irq_cpustat_t in
64706 * asm/hardirq.h to get better cache usage. KAO
64707 @@ -377,12 +377,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
64708
64709 struct softirq_action
64710 {
64711 - void (*action)(struct softirq_action *);
64712 + void (*action)(void);
64713 };
64714
64715 asmlinkage void do_softirq(void);
64716 asmlinkage void __do_softirq(void);
64717 -extern void open_softirq(int nr, void (*action)(struct softirq_action *));
64718 +extern void open_softirq(int nr, void (*action)(void));
64719 extern void softirq_init(void);
64720 #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
64721 extern void raise_softirq_irqoff(unsigned int nr);
64722 diff -urNp linux-2.6.32.49/include/linux/irq.h linux-2.6.32.49/include/linux/irq.h
64723 --- linux-2.6.32.49/include/linux/irq.h 2011-11-08 19:02:43.000000000 -0500
64724 +++ linux-2.6.32.49/include/linux/irq.h 2011-11-15 19:59:43.000000000 -0500
64725 @@ -438,12 +438,12 @@ extern int set_irq_msi(unsigned int irq,
64726 static inline bool alloc_desc_masks(struct irq_desc *desc, int node,
64727 bool boot)
64728 {
64729 +#ifdef CONFIG_CPUMASK_OFFSTACK
64730 gfp_t gfp = GFP_ATOMIC;
64731
64732 if (boot)
64733 gfp = GFP_NOWAIT;
64734
64735 -#ifdef CONFIG_CPUMASK_OFFSTACK
64736 if (!alloc_cpumask_var_node(&desc->affinity, gfp, node))
64737 return false;
64738
64739 diff -urNp linux-2.6.32.49/include/linux/kallsyms.h linux-2.6.32.49/include/linux/kallsyms.h
64740 --- linux-2.6.32.49/include/linux/kallsyms.h 2011-11-08 19:02:43.000000000 -0500
64741 +++ linux-2.6.32.49/include/linux/kallsyms.h 2011-11-15 19:59:43.000000000 -0500
64742 @@ -15,7 +15,8 @@
64743
64744 struct module;
64745
64746 -#ifdef CONFIG_KALLSYMS
64747 +#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
64748 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
64749 /* Lookup the address for a symbol. Returns 0 if not found. */
64750 unsigned long kallsyms_lookup_name(const char *name);
64751
64752 @@ -92,6 +93,15 @@ static inline int lookup_symbol_attrs(un
64753 /* Stupid that this does nothing, but I didn't create this mess. */
64754 #define __print_symbol(fmt, addr)
64755 #endif /*CONFIG_KALLSYMS*/
64756 +#else /* when included by kallsyms.c, vsnprintf.c, or
64757 + arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
64758 +extern void __print_symbol(const char *fmt, unsigned long address);
64759 +extern int sprint_symbol(char *buffer, unsigned long address);
64760 +const char *kallsyms_lookup(unsigned long addr,
64761 + unsigned long *symbolsize,
64762 + unsigned long *offset,
64763 + char **modname, char *namebuf);
64764 +#endif
64765
64766 /* This macro allows us to keep printk typechecking */
64767 static void __check_printsym_format(const char *fmt, ...)
64768 diff -urNp linux-2.6.32.49/include/linux/kgdb.h linux-2.6.32.49/include/linux/kgdb.h
64769 --- linux-2.6.32.49/include/linux/kgdb.h 2011-11-08 19:02:43.000000000 -0500
64770 +++ linux-2.6.32.49/include/linux/kgdb.h 2011-11-15 19:59:43.000000000 -0500
64771 @@ -74,8 +74,8 @@ void kgdb_breakpoint(void);
64772
64773 extern int kgdb_connected;
64774
64775 -extern atomic_t kgdb_setting_breakpoint;
64776 -extern atomic_t kgdb_cpu_doing_single_step;
64777 +extern atomic_unchecked_t kgdb_setting_breakpoint;
64778 +extern atomic_unchecked_t kgdb_cpu_doing_single_step;
64779
64780 extern struct task_struct *kgdb_usethread;
64781 extern struct task_struct *kgdb_contthread;
64782 @@ -235,7 +235,7 @@ struct kgdb_arch {
64783 int (*remove_hw_breakpoint)(unsigned long, int, enum kgdb_bptype);
64784 void (*remove_all_hw_break)(void);
64785 void (*correct_hw_break)(void);
64786 -};
64787 +} __do_const;
64788
64789 /**
64790 * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB.
64791 @@ -257,14 +257,14 @@ struct kgdb_io {
64792 int (*init) (void);
64793 void (*pre_exception) (void);
64794 void (*post_exception) (void);
64795 -};
64796 +} __do_const;
64797
64798 -extern struct kgdb_arch arch_kgdb_ops;
64799 +extern const struct kgdb_arch arch_kgdb_ops;
64800
64801 extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
64802
64803 -extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
64804 -extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
64805 +extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
64806 +extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
64807
64808 extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
64809 extern int kgdb_mem2hex(char *mem, char *buf, int count);
64810 diff -urNp linux-2.6.32.49/include/linux/kmod.h linux-2.6.32.49/include/linux/kmod.h
64811 --- linux-2.6.32.49/include/linux/kmod.h 2011-11-08 19:02:43.000000000 -0500
64812 +++ linux-2.6.32.49/include/linux/kmod.h 2011-11-15 19:59:43.000000000 -0500
64813 @@ -31,6 +31,8 @@
64814 * usually useless though. */
64815 extern int __request_module(bool wait, const char *name, ...) \
64816 __attribute__((format(printf, 2, 3)));
64817 +extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
64818 + __attribute__((format(printf, 3, 4)));
64819 #define request_module(mod...) __request_module(true, mod)
64820 #define request_module_nowait(mod...) __request_module(false, mod)
64821 #define try_then_request_module(x, mod...) \
64822 diff -urNp linux-2.6.32.49/include/linux/kobject.h linux-2.6.32.49/include/linux/kobject.h
64823 --- linux-2.6.32.49/include/linux/kobject.h 2011-11-08 19:02:43.000000000 -0500
64824 +++ linux-2.6.32.49/include/linux/kobject.h 2011-11-15 19:59:43.000000000 -0500
64825 @@ -106,7 +106,7 @@ extern char *kobject_get_path(struct kob
64826
64827 struct kobj_type {
64828 void (*release)(struct kobject *kobj);
64829 - struct sysfs_ops *sysfs_ops;
64830 + const struct sysfs_ops *sysfs_ops;
64831 struct attribute **default_attrs;
64832 };
64833
64834 @@ -118,9 +118,9 @@ struct kobj_uevent_env {
64835 };
64836
64837 struct kset_uevent_ops {
64838 - int (*filter)(struct kset *kset, struct kobject *kobj);
64839 - const char *(*name)(struct kset *kset, struct kobject *kobj);
64840 - int (*uevent)(struct kset *kset, struct kobject *kobj,
64841 + int (* const filter)(struct kset *kset, struct kobject *kobj);
64842 + const char *(* const name)(struct kset *kset, struct kobject *kobj);
64843 + int (* const uevent)(struct kset *kset, struct kobject *kobj,
64844 struct kobj_uevent_env *env);
64845 };
64846
64847 @@ -132,7 +132,7 @@ struct kobj_attribute {
64848 const char *buf, size_t count);
64849 };
64850
64851 -extern struct sysfs_ops kobj_sysfs_ops;
64852 +extern const struct sysfs_ops kobj_sysfs_ops;
64853
64854 /**
64855 * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
64856 @@ -155,14 +155,14 @@ struct kset {
64857 struct list_head list;
64858 spinlock_t list_lock;
64859 struct kobject kobj;
64860 - struct kset_uevent_ops *uevent_ops;
64861 + const struct kset_uevent_ops *uevent_ops;
64862 };
64863
64864 extern void kset_init(struct kset *kset);
64865 extern int __must_check kset_register(struct kset *kset);
64866 extern void kset_unregister(struct kset *kset);
64867 extern struct kset * __must_check kset_create_and_add(const char *name,
64868 - struct kset_uevent_ops *u,
64869 + const struct kset_uevent_ops *u,
64870 struct kobject *parent_kobj);
64871
64872 static inline struct kset *to_kset(struct kobject *kobj)
64873 diff -urNp linux-2.6.32.49/include/linux/kvm_host.h linux-2.6.32.49/include/linux/kvm_host.h
64874 --- linux-2.6.32.49/include/linux/kvm_host.h 2011-11-08 19:02:43.000000000 -0500
64875 +++ linux-2.6.32.49/include/linux/kvm_host.h 2011-11-15 19:59:43.000000000 -0500
64876 @@ -210,7 +210,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
64877 void vcpu_load(struct kvm_vcpu *vcpu);
64878 void vcpu_put(struct kvm_vcpu *vcpu);
64879
64880 -int kvm_init(void *opaque, unsigned int vcpu_size,
64881 +int kvm_init(const void *opaque, unsigned int vcpu_size,
64882 struct module *module);
64883 void kvm_exit(void);
64884
64885 @@ -316,7 +316,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
64886 struct kvm_guest_debug *dbg);
64887 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
64888
64889 -int kvm_arch_init(void *opaque);
64890 +int kvm_arch_init(const void *opaque);
64891 void kvm_arch_exit(void);
64892
64893 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
64894 diff -urNp linux-2.6.32.49/include/linux/libata.h linux-2.6.32.49/include/linux/libata.h
64895 --- linux-2.6.32.49/include/linux/libata.h 2011-11-08 19:02:43.000000000 -0500
64896 +++ linux-2.6.32.49/include/linux/libata.h 2011-11-15 19:59:43.000000000 -0500
64897 @@ -525,11 +525,11 @@ struct ata_ioports {
64898
64899 struct ata_host {
64900 spinlock_t lock;
64901 - struct device *dev;
64902 + struct device *dev;
64903 void __iomem * const *iomap;
64904 unsigned int n_ports;
64905 void *private_data;
64906 - struct ata_port_operations *ops;
64907 + const struct ata_port_operations *ops;
64908 unsigned long flags;
64909 #ifdef CONFIG_ATA_ACPI
64910 acpi_handle acpi_handle;
64911 @@ -710,7 +710,7 @@ struct ata_link {
64912
64913 struct ata_port {
64914 struct Scsi_Host *scsi_host; /* our co-allocated scsi host */
64915 - struct ata_port_operations *ops;
64916 + const struct ata_port_operations *ops;
64917 spinlock_t *lock;
64918 /* Flags owned by the EH context. Only EH should touch these once the
64919 port is active */
64920 @@ -884,7 +884,7 @@ struct ata_port_operations {
64921 * fields must be pointers.
64922 */
64923 const struct ata_port_operations *inherits;
64924 -};
64925 +} __do_const;
64926
64927 struct ata_port_info {
64928 unsigned long flags;
64929 @@ -892,7 +892,7 @@ struct ata_port_info {
64930 unsigned long pio_mask;
64931 unsigned long mwdma_mask;
64932 unsigned long udma_mask;
64933 - struct ata_port_operations *port_ops;
64934 + const struct ata_port_operations *port_ops;
64935 void *private_data;
64936 };
64937
64938 @@ -916,7 +916,7 @@ extern const unsigned long sata_deb_timi
64939 extern const unsigned long sata_deb_timing_hotplug[];
64940 extern const unsigned long sata_deb_timing_long[];
64941
64942 -extern struct ata_port_operations ata_dummy_port_ops;
64943 +extern const struct ata_port_operations ata_dummy_port_ops;
64944 extern const struct ata_port_info ata_dummy_port_info;
64945
64946 static inline const unsigned long *
64947 @@ -962,7 +962,7 @@ extern int ata_host_activate(struct ata_
64948 struct scsi_host_template *sht);
64949 extern void ata_host_detach(struct ata_host *host);
64950 extern void ata_host_init(struct ata_host *, struct device *,
64951 - unsigned long, struct ata_port_operations *);
64952 + unsigned long, const struct ata_port_operations *);
64953 extern int ata_scsi_detect(struct scsi_host_template *sht);
64954 extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
64955 extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
64956 diff -urNp linux-2.6.32.49/include/linux/lockd/bind.h linux-2.6.32.49/include/linux/lockd/bind.h
64957 --- linux-2.6.32.49/include/linux/lockd/bind.h 2011-11-08 19:02:43.000000000 -0500
64958 +++ linux-2.6.32.49/include/linux/lockd/bind.h 2011-11-15 19:59:43.000000000 -0500
64959 @@ -23,13 +23,13 @@ struct svc_rqst;
64960 * This is the set of functions for lockd->nfsd communication
64961 */
64962 struct nlmsvc_binding {
64963 - __be32 (*fopen)(struct svc_rqst *,
64964 + __be32 (* const fopen)(struct svc_rqst *,
64965 struct nfs_fh *,
64966 struct file **);
64967 - void (*fclose)(struct file *);
64968 + void (* const fclose)(struct file *);
64969 };
64970
64971 -extern struct nlmsvc_binding * nlmsvc_ops;
64972 +extern const struct nlmsvc_binding * nlmsvc_ops;
64973
64974 /*
64975 * Similar to nfs_client_initdata, but without the NFS-specific
64976 diff -urNp linux-2.6.32.49/include/linux/mca.h linux-2.6.32.49/include/linux/mca.h
64977 --- linux-2.6.32.49/include/linux/mca.h 2011-11-08 19:02:43.000000000 -0500
64978 +++ linux-2.6.32.49/include/linux/mca.h 2011-11-15 19:59:43.000000000 -0500
64979 @@ -80,7 +80,7 @@ struct mca_bus_accessor_functions {
64980 int region);
64981 void * (*mca_transform_memory)(struct mca_device *,
64982 void *memory);
64983 -};
64984 +} __no_const;
64985
64986 struct mca_bus {
64987 u64 default_dma_mask;
64988 diff -urNp linux-2.6.32.49/include/linux/memory.h linux-2.6.32.49/include/linux/memory.h
64989 --- linux-2.6.32.49/include/linux/memory.h 2011-11-08 19:02:43.000000000 -0500
64990 +++ linux-2.6.32.49/include/linux/memory.h 2011-11-15 19:59:43.000000000 -0500
64991 @@ -108,7 +108,7 @@ struct memory_accessor {
64992 size_t count);
64993 ssize_t (*write)(struct memory_accessor *, const char *buf,
64994 off_t offset, size_t count);
64995 -};
64996 +} __no_const;
64997
64998 /*
64999 * Kernel text modification mutex, used for code patching. Users of this lock
65000 diff -urNp linux-2.6.32.49/include/linux/mm.h linux-2.6.32.49/include/linux/mm.h
65001 --- linux-2.6.32.49/include/linux/mm.h 2011-11-08 19:02:43.000000000 -0500
65002 +++ linux-2.6.32.49/include/linux/mm.h 2011-11-15 19:59:43.000000000 -0500
65003 @@ -106,7 +106,14 @@ extern unsigned int kobjsize(const void
65004
65005 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
65006 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
65007 +
65008 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
65009 +#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
65010 +#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
65011 +#else
65012 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
65013 +#endif
65014 +
65015 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
65016 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
65017
65018 @@ -841,12 +848,6 @@ int set_page_dirty(struct page *page);
65019 int set_page_dirty_lock(struct page *page);
65020 int clear_page_dirty_for_io(struct page *page);
65021
65022 -/* Is the vma a continuation of the stack vma above it? */
65023 -static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr)
65024 -{
65025 - return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
65026 -}
65027 -
65028 extern unsigned long move_page_tables(struct vm_area_struct *vma,
65029 unsigned long old_addr, struct vm_area_struct *new_vma,
65030 unsigned long new_addr, unsigned long len);
65031 @@ -890,6 +891,8 @@ struct shrinker {
65032 extern void register_shrinker(struct shrinker *);
65033 extern void unregister_shrinker(struct shrinker *);
65034
65035 +pgprot_t vm_get_page_prot(unsigned long vm_flags);
65036 +
65037 int vma_wants_writenotify(struct vm_area_struct *vma);
65038
65039 extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
65040 @@ -1162,6 +1165,7 @@ out:
65041 }
65042
65043 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
65044 +extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
65045
65046 extern unsigned long do_brk(unsigned long, unsigned long);
65047
65048 @@ -1218,6 +1222,10 @@ extern struct vm_area_struct * find_vma(
65049 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
65050 struct vm_area_struct **pprev);
65051
65052 +extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
65053 +extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
65054 +extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
65055 +
65056 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
65057 NULL if none. Assume start_addr < end_addr. */
65058 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
65059 @@ -1234,7 +1242,6 @@ static inline unsigned long vma_pages(st
65060 return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
65061 }
65062
65063 -pgprot_t vm_get_page_prot(unsigned long vm_flags);
65064 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
65065 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
65066 unsigned long pfn, unsigned long size, pgprot_t);
65067 @@ -1332,7 +1339,13 @@ extern void memory_failure(unsigned long
65068 extern int __memory_failure(unsigned long pfn, int trapno, int ref);
65069 extern int sysctl_memory_failure_early_kill;
65070 extern int sysctl_memory_failure_recovery;
65071 -extern atomic_long_t mce_bad_pages;
65072 +extern atomic_long_unchecked_t mce_bad_pages;
65073 +
65074 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
65075 +extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
65076 +#else
65077 +static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
65078 +#endif
65079
65080 #endif /* __KERNEL__ */
65081 #endif /* _LINUX_MM_H */
65082 diff -urNp linux-2.6.32.49/include/linux/mm_types.h linux-2.6.32.49/include/linux/mm_types.h
65083 --- linux-2.6.32.49/include/linux/mm_types.h 2011-11-08 19:02:43.000000000 -0500
65084 +++ linux-2.6.32.49/include/linux/mm_types.h 2011-11-15 19:59:43.000000000 -0500
65085 @@ -186,6 +186,8 @@ struct vm_area_struct {
65086 #ifdef CONFIG_NUMA
65087 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
65088 #endif
65089 +
65090 + struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
65091 };
65092
65093 struct core_thread {
65094 @@ -287,6 +289,24 @@ struct mm_struct {
65095 #ifdef CONFIG_MMU_NOTIFIER
65096 struct mmu_notifier_mm *mmu_notifier_mm;
65097 #endif
65098 +
65099 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
65100 + unsigned long pax_flags;
65101 +#endif
65102 +
65103 +#ifdef CONFIG_PAX_DLRESOLVE
65104 + unsigned long call_dl_resolve;
65105 +#endif
65106 +
65107 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
65108 + unsigned long call_syscall;
65109 +#endif
65110 +
65111 +#ifdef CONFIG_PAX_ASLR
65112 + unsigned long delta_mmap; /* randomized offset */
65113 + unsigned long delta_stack; /* randomized offset */
65114 +#endif
65115 +
65116 };
65117
65118 /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
65119 diff -urNp linux-2.6.32.49/include/linux/mmu_notifier.h linux-2.6.32.49/include/linux/mmu_notifier.h
65120 --- linux-2.6.32.49/include/linux/mmu_notifier.h 2011-11-08 19:02:43.000000000 -0500
65121 +++ linux-2.6.32.49/include/linux/mmu_notifier.h 2011-11-15 19:59:43.000000000 -0500
65122 @@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destr
65123 */
65124 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
65125 ({ \
65126 - pte_t __pte; \
65127 + pte_t ___pte; \
65128 struct vm_area_struct *___vma = __vma; \
65129 unsigned long ___address = __address; \
65130 - __pte = ptep_clear_flush(___vma, ___address, __ptep); \
65131 + ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
65132 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
65133 - __pte; \
65134 + ___pte; \
65135 })
65136
65137 #define ptep_clear_flush_young_notify(__vma, __address, __ptep) \
65138 diff -urNp linux-2.6.32.49/include/linux/mmzone.h linux-2.6.32.49/include/linux/mmzone.h
65139 --- linux-2.6.32.49/include/linux/mmzone.h 2011-11-08 19:02:43.000000000 -0500
65140 +++ linux-2.6.32.49/include/linux/mmzone.h 2011-11-15 19:59:43.000000000 -0500
65141 @@ -350,7 +350,7 @@ struct zone {
65142 unsigned long flags; /* zone flags, see below */
65143
65144 /* Zone statistics */
65145 - atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
65146 + atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
65147
65148 /*
65149 * prev_priority holds the scanning priority for this zone. It is
65150 diff -urNp linux-2.6.32.49/include/linux/mod_devicetable.h linux-2.6.32.49/include/linux/mod_devicetable.h
65151 --- linux-2.6.32.49/include/linux/mod_devicetable.h 2011-11-08 19:02:43.000000000 -0500
65152 +++ linux-2.6.32.49/include/linux/mod_devicetable.h 2011-11-15 19:59:43.000000000 -0500
65153 @@ -12,7 +12,7 @@
65154 typedef unsigned long kernel_ulong_t;
65155 #endif
65156
65157 -#define PCI_ANY_ID (~0)
65158 +#define PCI_ANY_ID ((__u16)~0)
65159
65160 struct pci_device_id {
65161 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
65162 @@ -131,7 +131,7 @@ struct usb_device_id {
65163 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
65164 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
65165
65166 -#define HID_ANY_ID (~0)
65167 +#define HID_ANY_ID (~0U)
65168
65169 struct hid_device_id {
65170 __u16 bus;
65171 diff -urNp linux-2.6.32.49/include/linux/module.h linux-2.6.32.49/include/linux/module.h
65172 --- linux-2.6.32.49/include/linux/module.h 2011-11-08 19:02:43.000000000 -0500
65173 +++ linux-2.6.32.49/include/linux/module.h 2011-11-15 19:59:43.000000000 -0500
65174 @@ -16,6 +16,7 @@
65175 #include <linux/kobject.h>
65176 #include <linux/moduleparam.h>
65177 #include <linux/tracepoint.h>
65178 +#include <linux/fs.h>
65179
65180 #include <asm/local.h>
65181 #include <asm/module.h>
65182 @@ -287,16 +288,16 @@ struct module
65183 int (*init)(void);
65184
65185 /* If this is non-NULL, vfree after init() returns */
65186 - void *module_init;
65187 + void *module_init_rx, *module_init_rw;
65188
65189 /* Here is the actual code + data, vfree'd on unload. */
65190 - void *module_core;
65191 + void *module_core_rx, *module_core_rw;
65192
65193 /* Here are the sizes of the init and core sections */
65194 - unsigned int init_size, core_size;
65195 + unsigned int init_size_rw, core_size_rw;
65196
65197 /* The size of the executable code in each section. */
65198 - unsigned int init_text_size, core_text_size;
65199 + unsigned int init_size_rx, core_size_rx;
65200
65201 /* Arch-specific module values */
65202 struct mod_arch_specific arch;
65203 @@ -345,6 +346,10 @@ struct module
65204 #ifdef CONFIG_EVENT_TRACING
65205 struct ftrace_event_call *trace_events;
65206 unsigned int num_trace_events;
65207 + struct file_operations trace_id;
65208 + struct file_operations trace_enable;
65209 + struct file_operations trace_format;
65210 + struct file_operations trace_filter;
65211 #endif
65212 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
65213 unsigned long *ftrace_callsites;
65214 @@ -393,16 +398,46 @@ struct module *__module_address(unsigned
65215 bool is_module_address(unsigned long addr);
65216 bool is_module_text_address(unsigned long addr);
65217
65218 +static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
65219 +{
65220 +
65221 +#ifdef CONFIG_PAX_KERNEXEC
65222 + if (ktla_ktva(addr) >= (unsigned long)start &&
65223 + ktla_ktva(addr) < (unsigned long)start + size)
65224 + return 1;
65225 +#endif
65226 +
65227 + return ((void *)addr >= start && (void *)addr < start + size);
65228 +}
65229 +
65230 +static inline int within_module_core_rx(unsigned long addr, struct module *mod)
65231 +{
65232 + return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
65233 +}
65234 +
65235 +static inline int within_module_core_rw(unsigned long addr, struct module *mod)
65236 +{
65237 + return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
65238 +}
65239 +
65240 +static inline int within_module_init_rx(unsigned long addr, struct module *mod)
65241 +{
65242 + return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
65243 +}
65244 +
65245 +static inline int within_module_init_rw(unsigned long addr, struct module *mod)
65246 +{
65247 + return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
65248 +}
65249 +
65250 static inline int within_module_core(unsigned long addr, struct module *mod)
65251 {
65252 - return (unsigned long)mod->module_core <= addr &&
65253 - addr < (unsigned long)mod->module_core + mod->core_size;
65254 + return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
65255 }
65256
65257 static inline int within_module_init(unsigned long addr, struct module *mod)
65258 {
65259 - return (unsigned long)mod->module_init <= addr &&
65260 - addr < (unsigned long)mod->module_init + mod->init_size;
65261 + return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
65262 }
65263
65264 /* Search for module by name: must hold module_mutex. */
65265 diff -urNp linux-2.6.32.49/include/linux/moduleloader.h linux-2.6.32.49/include/linux/moduleloader.h
65266 --- linux-2.6.32.49/include/linux/moduleloader.h 2011-11-08 19:02:43.000000000 -0500
65267 +++ linux-2.6.32.49/include/linux/moduleloader.h 2011-11-15 19:59:43.000000000 -0500
65268 @@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
65269 sections. Returns NULL on failure. */
65270 void *module_alloc(unsigned long size);
65271
65272 +#ifdef CONFIG_PAX_KERNEXEC
65273 +void *module_alloc_exec(unsigned long size);
65274 +#else
65275 +#define module_alloc_exec(x) module_alloc(x)
65276 +#endif
65277 +
65278 /* Free memory returned from module_alloc. */
65279 void module_free(struct module *mod, void *module_region);
65280
65281 +#ifdef CONFIG_PAX_KERNEXEC
65282 +void module_free_exec(struct module *mod, void *module_region);
65283 +#else
65284 +#define module_free_exec(x, y) module_free((x), (y))
65285 +#endif
65286 +
65287 /* Apply the given relocation to the (simplified) ELF. Return -error
65288 or 0. */
65289 int apply_relocate(Elf_Shdr *sechdrs,
65290 diff -urNp linux-2.6.32.49/include/linux/moduleparam.h linux-2.6.32.49/include/linux/moduleparam.h
65291 --- linux-2.6.32.49/include/linux/moduleparam.h 2011-11-08 19:02:43.000000000 -0500
65292 +++ linux-2.6.32.49/include/linux/moduleparam.h 2011-11-15 19:59:43.000000000 -0500
65293 @@ -132,7 +132,7 @@ struct kparam_array
65294
65295 /* Actually copy string: maxlen param is usually sizeof(string). */
65296 #define module_param_string(name, string, len, perm) \
65297 - static const struct kparam_string __param_string_##name \
65298 + static const struct kparam_string __param_string_##name __used \
65299 = { len, string }; \
65300 __module_param_call(MODULE_PARAM_PREFIX, name, \
65301 param_set_copystring, param_get_string, \
65302 @@ -211,7 +211,7 @@ extern int param_get_invbool(char *buffe
65303
65304 /* Comma-separated array: *nump is set to number they actually specified. */
65305 #define module_param_array_named(name, array, type, nump, perm) \
65306 - static const struct kparam_array __param_arr_##name \
65307 + static const struct kparam_array __param_arr_##name __used \
65308 = { ARRAY_SIZE(array), nump, param_set_##type, param_get_##type,\
65309 sizeof(array[0]), array }; \
65310 __module_param_call(MODULE_PARAM_PREFIX, name, \
65311 diff -urNp linux-2.6.32.49/include/linux/mutex.h linux-2.6.32.49/include/linux/mutex.h
65312 --- linux-2.6.32.49/include/linux/mutex.h 2011-11-08 19:02:43.000000000 -0500
65313 +++ linux-2.6.32.49/include/linux/mutex.h 2011-11-15 19:59:43.000000000 -0500
65314 @@ -51,7 +51,7 @@ struct mutex {
65315 spinlock_t wait_lock;
65316 struct list_head wait_list;
65317 #if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP)
65318 - struct thread_info *owner;
65319 + struct task_struct *owner;
65320 #endif
65321 #ifdef CONFIG_DEBUG_MUTEXES
65322 const char *name;
65323 diff -urNp linux-2.6.32.49/include/linux/namei.h linux-2.6.32.49/include/linux/namei.h
65324 --- linux-2.6.32.49/include/linux/namei.h 2011-11-08 19:02:43.000000000 -0500
65325 +++ linux-2.6.32.49/include/linux/namei.h 2011-11-15 19:59:43.000000000 -0500
65326 @@ -22,7 +22,7 @@ struct nameidata {
65327 unsigned int flags;
65328 int last_type;
65329 unsigned depth;
65330 - char *saved_names[MAX_NESTED_LINKS + 1];
65331 + const char *saved_names[MAX_NESTED_LINKS + 1];
65332
65333 /* Intent data */
65334 union {
65335 @@ -84,12 +84,12 @@ extern int follow_up(struct path *);
65336 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
65337 extern void unlock_rename(struct dentry *, struct dentry *);
65338
65339 -static inline void nd_set_link(struct nameidata *nd, char *path)
65340 +static inline void nd_set_link(struct nameidata *nd, const char *path)
65341 {
65342 nd->saved_names[nd->depth] = path;
65343 }
65344
65345 -static inline char *nd_get_link(struct nameidata *nd)
65346 +static inline const char *nd_get_link(const struct nameidata *nd)
65347 {
65348 return nd->saved_names[nd->depth];
65349 }
65350 diff -urNp linux-2.6.32.49/include/linux/netdevice.h linux-2.6.32.49/include/linux/netdevice.h
65351 --- linux-2.6.32.49/include/linux/netdevice.h 2011-11-08 19:02:43.000000000 -0500
65352 +++ linux-2.6.32.49/include/linux/netdevice.h 2011-11-15 19:59:43.000000000 -0500
65353 @@ -637,6 +637,7 @@ struct net_device_ops {
65354 u16 xid);
65355 #endif
65356 };
65357 +typedef struct net_device_ops __no_const net_device_ops_no_const;
65358
65359 /*
65360 * The DEVICE structure.
65361 diff -urNp linux-2.6.32.49/include/linux/netfilter/xt_gradm.h linux-2.6.32.49/include/linux/netfilter/xt_gradm.h
65362 --- linux-2.6.32.49/include/linux/netfilter/xt_gradm.h 1969-12-31 19:00:00.000000000 -0500
65363 +++ linux-2.6.32.49/include/linux/netfilter/xt_gradm.h 2011-11-15 19:59:43.000000000 -0500
65364 @@ -0,0 +1,9 @@
65365 +#ifndef _LINUX_NETFILTER_XT_GRADM_H
65366 +#define _LINUX_NETFILTER_XT_GRADM_H 1
65367 +
65368 +struct xt_gradm_mtinfo {
65369 + __u16 flags;
65370 + __u16 invflags;
65371 +};
65372 +
65373 +#endif
65374 diff -urNp linux-2.6.32.49/include/linux/nodemask.h linux-2.6.32.49/include/linux/nodemask.h
65375 --- linux-2.6.32.49/include/linux/nodemask.h 2011-11-08 19:02:43.000000000 -0500
65376 +++ linux-2.6.32.49/include/linux/nodemask.h 2011-11-15 19:59:43.000000000 -0500
65377 @@ -464,11 +464,11 @@ static inline int num_node_state(enum no
65378
65379 #define any_online_node(mask) \
65380 ({ \
65381 - int node; \
65382 - for_each_node_mask(node, (mask)) \
65383 - if (node_online(node)) \
65384 + int __node; \
65385 + for_each_node_mask(__node, (mask)) \
65386 + if (node_online(__node)) \
65387 break; \
65388 - node; \
65389 + __node; \
65390 })
65391
65392 #define num_online_nodes() num_node_state(N_ONLINE)
65393 diff -urNp linux-2.6.32.49/include/linux/oprofile.h linux-2.6.32.49/include/linux/oprofile.h
65394 --- linux-2.6.32.49/include/linux/oprofile.h 2011-11-08 19:02:43.000000000 -0500
65395 +++ linux-2.6.32.49/include/linux/oprofile.h 2011-11-15 19:59:43.000000000 -0500
65396 @@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super
65397 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
65398 char const * name, ulong * val);
65399
65400 -/** Create a file for read-only access to an atomic_t. */
65401 +/** Create a file for read-only access to an atomic_unchecked_t. */
65402 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
65403 - char const * name, atomic_t * val);
65404 + char const * name, atomic_unchecked_t * val);
65405
65406 /** create a directory */
65407 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
65408 diff -urNp linux-2.6.32.49/include/linux/pagemap.h linux-2.6.32.49/include/linux/pagemap.h
65409 --- linux-2.6.32.49/include/linux/pagemap.h 2011-11-08 19:02:43.000000000 -0500
65410 +++ linux-2.6.32.49/include/linux/pagemap.h 2011-11-18 18:01:55.000000000 -0500
65411 @@ -425,7 +425,9 @@ static inline int fault_in_pages_readabl
65412 if (((unsigned long)uaddr & PAGE_MASK) !=
65413 ((unsigned long)end & PAGE_MASK))
65414 ret = __get_user(c, end);
65415 + (void)c;
65416 }
65417 + (void)c;
65418 return ret;
65419 }
65420
65421 diff -urNp linux-2.6.32.49/include/linux/perf_event.h linux-2.6.32.49/include/linux/perf_event.h
65422 --- linux-2.6.32.49/include/linux/perf_event.h 2011-11-08 19:02:43.000000000 -0500
65423 +++ linux-2.6.32.49/include/linux/perf_event.h 2011-11-15 19:59:43.000000000 -0500
65424 @@ -476,7 +476,7 @@ struct hw_perf_event {
65425 struct hrtimer hrtimer;
65426 };
65427 };
65428 - atomic64_t prev_count;
65429 + atomic64_unchecked_t prev_count;
65430 u64 sample_period;
65431 u64 last_period;
65432 atomic64_t period_left;
65433 @@ -557,7 +557,7 @@ struct perf_event {
65434 const struct pmu *pmu;
65435
65436 enum perf_event_active_state state;
65437 - atomic64_t count;
65438 + atomic64_unchecked_t count;
65439
65440 /*
65441 * These are the total time in nanoseconds that the event
65442 @@ -595,8 +595,8 @@ struct perf_event {
65443 * These accumulate total time (in nanoseconds) that children
65444 * events have been enabled and running, respectively.
65445 */
65446 - atomic64_t child_total_time_enabled;
65447 - atomic64_t child_total_time_running;
65448 + atomic64_unchecked_t child_total_time_enabled;
65449 + atomic64_unchecked_t child_total_time_running;
65450
65451 /*
65452 * Protect attach/detach and child_list:
65453 diff -urNp linux-2.6.32.49/include/linux/pipe_fs_i.h linux-2.6.32.49/include/linux/pipe_fs_i.h
65454 --- linux-2.6.32.49/include/linux/pipe_fs_i.h 2011-11-08 19:02:43.000000000 -0500
65455 +++ linux-2.6.32.49/include/linux/pipe_fs_i.h 2011-11-15 19:59:43.000000000 -0500
65456 @@ -46,9 +46,9 @@ struct pipe_inode_info {
65457 wait_queue_head_t wait;
65458 unsigned int nrbufs, curbuf;
65459 struct page *tmp_page;
65460 - unsigned int readers;
65461 - unsigned int writers;
65462 - unsigned int waiting_writers;
65463 + atomic_t readers;
65464 + atomic_t writers;
65465 + atomic_t waiting_writers;
65466 unsigned int r_counter;
65467 unsigned int w_counter;
65468 struct fasync_struct *fasync_readers;
65469 diff -urNp linux-2.6.32.49/include/linux/poison.h linux-2.6.32.49/include/linux/poison.h
65470 --- linux-2.6.32.49/include/linux/poison.h 2011-11-08 19:02:43.000000000 -0500
65471 +++ linux-2.6.32.49/include/linux/poison.h 2011-11-15 19:59:43.000000000 -0500
65472 @@ -19,8 +19,8 @@
65473 * under normal circumstances, used to verify that nobody uses
65474 * non-initialized list entries.
65475 */
65476 -#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
65477 -#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
65478 +#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
65479 +#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
65480
65481 /********** include/linux/timer.h **********/
65482 /*
65483 diff -urNp linux-2.6.32.49/include/linux/posix-timers.h linux-2.6.32.49/include/linux/posix-timers.h
65484 --- linux-2.6.32.49/include/linux/posix-timers.h 2011-11-08 19:02:43.000000000 -0500
65485 +++ linux-2.6.32.49/include/linux/posix-timers.h 2011-11-15 19:59:43.000000000 -0500
65486 @@ -67,7 +67,7 @@ struct k_itimer {
65487 };
65488
65489 struct k_clock {
65490 - int res; /* in nanoseconds */
65491 + const int res; /* in nanoseconds */
65492 int (*clock_getres) (const clockid_t which_clock, struct timespec *tp);
65493 int (*clock_set) (const clockid_t which_clock, struct timespec * tp);
65494 int (*clock_get) (const clockid_t which_clock, struct timespec * tp);
65495 diff -urNp linux-2.6.32.49/include/linux/preempt.h linux-2.6.32.49/include/linux/preempt.h
65496 --- linux-2.6.32.49/include/linux/preempt.h 2011-11-08 19:02:43.000000000 -0500
65497 +++ linux-2.6.32.49/include/linux/preempt.h 2011-11-15 19:59:43.000000000 -0500
65498 @@ -110,7 +110,7 @@ struct preempt_ops {
65499 void (*sched_in)(struct preempt_notifier *notifier, int cpu);
65500 void (*sched_out)(struct preempt_notifier *notifier,
65501 struct task_struct *next);
65502 -};
65503 +} __no_const;
65504
65505 /**
65506 * preempt_notifier - key for installing preemption notifiers
65507 diff -urNp linux-2.6.32.49/include/linux/proc_fs.h linux-2.6.32.49/include/linux/proc_fs.h
65508 --- linux-2.6.32.49/include/linux/proc_fs.h 2011-11-08 19:02:43.000000000 -0500
65509 +++ linux-2.6.32.49/include/linux/proc_fs.h 2011-11-15 19:59:43.000000000 -0500
65510 @@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
65511 return proc_create_data(name, mode, parent, proc_fops, NULL);
65512 }
65513
65514 +static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
65515 + struct proc_dir_entry *parent, const struct file_operations *proc_fops)
65516 +{
65517 +#ifdef CONFIG_GRKERNSEC_PROC_USER
65518 + return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
65519 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
65520 + return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
65521 +#else
65522 + return proc_create_data(name, mode, parent, proc_fops, NULL);
65523 +#endif
65524 +}
65525 +
65526 +
65527 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
65528 mode_t mode, struct proc_dir_entry *base,
65529 read_proc_t *read_proc, void * data)
65530 @@ -256,7 +269,7 @@ union proc_op {
65531 int (*proc_show)(struct seq_file *m,
65532 struct pid_namespace *ns, struct pid *pid,
65533 struct task_struct *task);
65534 -};
65535 +} __no_const;
65536
65537 struct ctl_table_header;
65538 struct ctl_table;
65539 diff -urNp linux-2.6.32.49/include/linux/ptrace.h linux-2.6.32.49/include/linux/ptrace.h
65540 --- linux-2.6.32.49/include/linux/ptrace.h 2011-11-08 19:02:43.000000000 -0500
65541 +++ linux-2.6.32.49/include/linux/ptrace.h 2011-11-15 19:59:43.000000000 -0500
65542 @@ -96,10 +96,10 @@ extern void __ptrace_unlink(struct task_
65543 extern void exit_ptrace(struct task_struct *tracer);
65544 #define PTRACE_MODE_READ 1
65545 #define PTRACE_MODE_ATTACH 2
65546 -/* Returns 0 on success, -errno on denial. */
65547 -extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
65548 /* Returns true on success, false on denial. */
65549 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
65550 +/* Returns true on success, false on denial. */
65551 +extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
65552
65553 static inline int ptrace_reparented(struct task_struct *child)
65554 {
65555 diff -urNp linux-2.6.32.49/include/linux/random.h linux-2.6.32.49/include/linux/random.h
65556 --- linux-2.6.32.49/include/linux/random.h 2011-11-08 19:02:43.000000000 -0500
65557 +++ linux-2.6.32.49/include/linux/random.h 2011-11-15 19:59:43.000000000 -0500
65558 @@ -63,6 +63,11 @@ unsigned long randomize_range(unsigned l
65559 u32 random32(void);
65560 void srandom32(u32 seed);
65561
65562 +static inline unsigned long pax_get_random_long(void)
65563 +{
65564 + return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
65565 +}
65566 +
65567 #endif /* __KERNEL___ */
65568
65569 #endif /* _LINUX_RANDOM_H */
65570 diff -urNp linux-2.6.32.49/include/linux/reboot.h linux-2.6.32.49/include/linux/reboot.h
65571 --- linux-2.6.32.49/include/linux/reboot.h 2011-11-08 19:02:43.000000000 -0500
65572 +++ linux-2.6.32.49/include/linux/reboot.h 2011-11-15 19:59:43.000000000 -0500
65573 @@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(st
65574 * Architecture-specific implementations of sys_reboot commands.
65575 */
65576
65577 -extern void machine_restart(char *cmd);
65578 -extern void machine_halt(void);
65579 -extern void machine_power_off(void);
65580 +extern void machine_restart(char *cmd) __noreturn;
65581 +extern void machine_halt(void) __noreturn;
65582 +extern void machine_power_off(void) __noreturn;
65583
65584 extern void machine_shutdown(void);
65585 struct pt_regs;
65586 @@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struc
65587 */
65588
65589 extern void kernel_restart_prepare(char *cmd);
65590 -extern void kernel_restart(char *cmd);
65591 -extern void kernel_halt(void);
65592 -extern void kernel_power_off(void);
65593 +extern void kernel_restart(char *cmd) __noreturn;
65594 +extern void kernel_halt(void) __noreturn;
65595 +extern void kernel_power_off(void) __noreturn;
65596
65597 void ctrl_alt_del(void);
65598
65599 @@ -75,7 +75,7 @@ extern int orderly_poweroff(bool force);
65600 * Emergency restart, callable from an interrupt handler.
65601 */
65602
65603 -extern void emergency_restart(void);
65604 +extern void emergency_restart(void) __noreturn;
65605 #include <asm/emergency-restart.h>
65606
65607 #endif
65608 diff -urNp linux-2.6.32.49/include/linux/reiserfs_fs.h linux-2.6.32.49/include/linux/reiserfs_fs.h
65609 --- linux-2.6.32.49/include/linux/reiserfs_fs.h 2011-11-08 19:02:43.000000000 -0500
65610 +++ linux-2.6.32.49/include/linux/reiserfs_fs.h 2011-11-15 19:59:43.000000000 -0500
65611 @@ -1326,7 +1326,7 @@ static inline loff_t max_reiserfs_offset
65612 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
65613
65614 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
65615 -#define get_generation(s) atomic_read (&fs_generation(s))
65616 +#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
65617 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
65618 #define __fs_changed(gen,s) (gen != get_generation (s))
65619 #define fs_changed(gen,s) ({cond_resched(); __fs_changed(gen, s);})
65620 @@ -1534,24 +1534,24 @@ static inline struct super_block *sb_fro
65621 */
65622
65623 struct item_operations {
65624 - int (*bytes_number) (struct item_head * ih, int block_size);
65625 - void (*decrement_key) (struct cpu_key *);
65626 - int (*is_left_mergeable) (struct reiserfs_key * ih,
65627 + int (* const bytes_number) (struct item_head * ih, int block_size);
65628 + void (* const decrement_key) (struct cpu_key *);
65629 + int (* const is_left_mergeable) (struct reiserfs_key * ih,
65630 unsigned long bsize);
65631 - void (*print_item) (struct item_head *, char *item);
65632 - void (*check_item) (struct item_head *, char *item);
65633 + void (* const print_item) (struct item_head *, char *item);
65634 + void (* const check_item) (struct item_head *, char *item);
65635
65636 - int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
65637 + int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
65638 int is_affected, int insert_size);
65639 - int (*check_left) (struct virtual_item * vi, int free,
65640 + int (* const check_left) (struct virtual_item * vi, int free,
65641 int start_skip, int end_skip);
65642 - int (*check_right) (struct virtual_item * vi, int free);
65643 - int (*part_size) (struct virtual_item * vi, int from, int to);
65644 - int (*unit_num) (struct virtual_item * vi);
65645 - void (*print_vi) (struct virtual_item * vi);
65646 + int (* const check_right) (struct virtual_item * vi, int free);
65647 + int (* const part_size) (struct virtual_item * vi, int from, int to);
65648 + int (* const unit_num) (struct virtual_item * vi);
65649 + void (* const print_vi) (struct virtual_item * vi);
65650 };
65651
65652 -extern struct item_operations *item_ops[TYPE_ANY + 1];
65653 +extern const struct item_operations * const item_ops[TYPE_ANY + 1];
65654
65655 #define op_bytes_number(ih,bsize) item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
65656 #define op_is_left_mergeable(key,bsize) item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
65657 diff -urNp linux-2.6.32.49/include/linux/reiserfs_fs_sb.h linux-2.6.32.49/include/linux/reiserfs_fs_sb.h
65658 --- linux-2.6.32.49/include/linux/reiserfs_fs_sb.h 2011-11-08 19:02:43.000000000 -0500
65659 +++ linux-2.6.32.49/include/linux/reiserfs_fs_sb.h 2011-11-15 19:59:43.000000000 -0500
65660 @@ -377,7 +377,7 @@ struct reiserfs_sb_info {
65661 /* Comment? -Hans */
65662 wait_queue_head_t s_wait;
65663 /* To be obsoleted soon by per buffer seals.. -Hans */
65664 - atomic_t s_generation_counter; // increased by one every time the
65665 + atomic_unchecked_t s_generation_counter; // increased by one every time the
65666 // tree gets re-balanced
65667 unsigned long s_properties; /* File system properties. Currently holds
65668 on-disk FS format */
65669 diff -urNp linux-2.6.32.49/include/linux/relay.h linux-2.6.32.49/include/linux/relay.h
65670 --- linux-2.6.32.49/include/linux/relay.h 2011-11-08 19:02:43.000000000 -0500
65671 +++ linux-2.6.32.49/include/linux/relay.h 2011-11-15 19:59:43.000000000 -0500
65672 @@ -159,7 +159,7 @@ struct rchan_callbacks
65673 * The callback should return 0 if successful, negative if not.
65674 */
65675 int (*remove_buf_file)(struct dentry *dentry);
65676 -};
65677 +} __no_const;
65678
65679 /*
65680 * CONFIG_RELAY kernel API, kernel/relay.c
65681 diff -urNp linux-2.6.32.49/include/linux/rfkill.h linux-2.6.32.49/include/linux/rfkill.h
65682 --- linux-2.6.32.49/include/linux/rfkill.h 2011-11-08 19:02:43.000000000 -0500
65683 +++ linux-2.6.32.49/include/linux/rfkill.h 2011-11-15 19:59:43.000000000 -0500
65684 @@ -144,6 +144,7 @@ struct rfkill_ops {
65685 void (*query)(struct rfkill *rfkill, void *data);
65686 int (*set_block)(void *data, bool blocked);
65687 };
65688 +typedef struct rfkill_ops __no_const rfkill_ops_no_const;
65689
65690 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
65691 /**
65692 diff -urNp linux-2.6.32.49/include/linux/sched.h linux-2.6.32.49/include/linux/sched.h
65693 --- linux-2.6.32.49/include/linux/sched.h 2011-11-08 19:02:43.000000000 -0500
65694 +++ linux-2.6.32.49/include/linux/sched.h 2011-11-18 18:01:52.000000000 -0500
65695 @@ -101,6 +101,7 @@ struct bio;
65696 struct fs_struct;
65697 struct bts_context;
65698 struct perf_event_context;
65699 +struct linux_binprm;
65700
65701 /*
65702 * List of flags we want to share for kernel threads,
65703 @@ -350,7 +351,7 @@ extern signed long schedule_timeout_kill
65704 extern signed long schedule_timeout_uninterruptible(signed long timeout);
65705 asmlinkage void __schedule(void);
65706 asmlinkage void schedule(void);
65707 -extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
65708 +extern int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner);
65709
65710 struct nsproxy;
65711 struct user_namespace;
65712 @@ -371,9 +372,12 @@ struct user_namespace;
65713 #define DEFAULT_MAX_MAP_COUNT (USHORT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
65714
65715 extern int sysctl_max_map_count;
65716 +extern unsigned long sysctl_heap_stack_gap;
65717
65718 #include <linux/aio.h>
65719
65720 +extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
65721 +extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
65722 extern unsigned long
65723 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
65724 unsigned long, unsigned long);
65725 @@ -666,6 +670,16 @@ struct signal_struct {
65726 struct tty_audit_buf *tty_audit_buf;
65727 #endif
65728
65729 +#ifdef CONFIG_GRKERNSEC
65730 + u32 curr_ip;
65731 + u32 saved_ip;
65732 + u32 gr_saddr;
65733 + u32 gr_daddr;
65734 + u16 gr_sport;
65735 + u16 gr_dport;
65736 + u8 used_accept:1;
65737 +#endif
65738 +
65739 int oom_adj; /* OOM kill score adjustment (bit shift) */
65740 };
65741
65742 @@ -723,6 +737,11 @@ struct user_struct {
65743 struct key *session_keyring; /* UID's default session keyring */
65744 #endif
65745
65746 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
65747 + unsigned int banned;
65748 + unsigned long ban_expires;
65749 +#endif
65750 +
65751 /* Hash table maintenance information */
65752 struct hlist_node uidhash_node;
65753 uid_t uid;
65754 @@ -1328,8 +1347,8 @@ struct task_struct {
65755 struct list_head thread_group;
65756
65757 struct completion *vfork_done; /* for vfork() */
65758 - int __user *set_child_tid; /* CLONE_CHILD_SETTID */
65759 - int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
65760 + pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
65761 + pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
65762
65763 cputime_t utime, stime, utimescaled, stimescaled;
65764 cputime_t gtime;
65765 @@ -1343,16 +1362,6 @@ struct task_struct {
65766 struct task_cputime cputime_expires;
65767 struct list_head cpu_timers[3];
65768
65769 -/* process credentials */
65770 - const struct cred *real_cred; /* objective and real subjective task
65771 - * credentials (COW) */
65772 - const struct cred *cred; /* effective (overridable) subjective task
65773 - * credentials (COW) */
65774 - struct mutex cred_guard_mutex; /* guard against foreign influences on
65775 - * credential calculations
65776 - * (notably. ptrace) */
65777 - struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
65778 -
65779 char comm[TASK_COMM_LEN]; /* executable name excluding path
65780 - access with [gs]et_task_comm (which lock
65781 it with task_lock())
65782 @@ -1369,6 +1378,10 @@ struct task_struct {
65783 #endif
65784 /* CPU-specific state of this task */
65785 struct thread_struct thread;
65786 +/* thread_info moved to task_struct */
65787 +#ifdef CONFIG_X86
65788 + struct thread_info tinfo;
65789 +#endif
65790 /* filesystem information */
65791 struct fs_struct *fs;
65792 /* open file information */
65793 @@ -1436,6 +1449,15 @@ struct task_struct {
65794 int hardirq_context;
65795 int softirq_context;
65796 #endif
65797 +
65798 +/* process credentials */
65799 + const struct cred *real_cred; /* objective and real subjective task
65800 + * credentials (COW) */
65801 + struct mutex cred_guard_mutex; /* guard against foreign influences on
65802 + * credential calculations
65803 + * (notably. ptrace) */
65804 + struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
65805 +
65806 #ifdef CONFIG_LOCKDEP
65807 # define MAX_LOCK_DEPTH 48UL
65808 u64 curr_chain_key;
65809 @@ -1456,6 +1478,9 @@ struct task_struct {
65810
65811 struct backing_dev_info *backing_dev_info;
65812
65813 + const struct cred *cred; /* effective (overridable) subjective task
65814 + * credentials (COW) */
65815 +
65816 struct io_context *io_context;
65817
65818 unsigned long ptrace_message;
65819 @@ -1519,6 +1544,21 @@ struct task_struct {
65820 unsigned long default_timer_slack_ns;
65821
65822 struct list_head *scm_work_list;
65823 +
65824 +#ifdef CONFIG_GRKERNSEC
65825 + /* grsecurity */
65826 + struct dentry *gr_chroot_dentry;
65827 + struct acl_subject_label *acl;
65828 + struct acl_role_label *role;
65829 + struct file *exec_file;
65830 + u16 acl_role_id;
65831 + /* is this the task that authenticated to the special role */
65832 + u8 acl_sp_role;
65833 + u8 is_writable;
65834 + u8 brute;
65835 + u8 gr_is_chrooted;
65836 +#endif
65837 +
65838 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
65839 /* Index of current stored adress in ret_stack */
65840 int curr_ret_stack;
65841 @@ -1542,6 +1582,57 @@ struct task_struct {
65842 #endif /* CONFIG_TRACING */
65843 };
65844
65845 +#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
65846 +#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
65847 +#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
65848 +#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
65849 +/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
65850 +#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
65851 +
65852 +#ifdef CONFIG_PAX_SOFTMODE
65853 +extern int pax_softmode;
65854 +#endif
65855 +
65856 +extern int pax_check_flags(unsigned long *);
65857 +
65858 +/* if tsk != current then task_lock must be held on it */
65859 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
65860 +static inline unsigned long pax_get_flags(struct task_struct *tsk)
65861 +{
65862 + if (likely(tsk->mm))
65863 + return tsk->mm->pax_flags;
65864 + else
65865 + return 0UL;
65866 +}
65867 +
65868 +/* if tsk != current then task_lock must be held on it */
65869 +static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
65870 +{
65871 + if (likely(tsk->mm)) {
65872 + tsk->mm->pax_flags = flags;
65873 + return 0;
65874 + }
65875 + return -EINVAL;
65876 +}
65877 +#endif
65878 +
65879 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
65880 +extern void pax_set_initial_flags(struct linux_binprm *bprm);
65881 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
65882 +extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
65883 +#endif
65884 +
65885 +extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
65886 +extern void pax_report_insns(struct pt_regs *regs, void *pc, void *sp);
65887 +extern void pax_report_refcount_overflow(struct pt_regs *regs);
65888 +extern NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type) ATTRIB_NORET;
65889 +
65890 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
65891 +extern void pax_track_stack(void);
65892 +#else
65893 +static inline void pax_track_stack(void) {}
65894 +#endif
65895 +
65896 /* Future-safe accessor for struct task_struct's cpus_allowed. */
65897 #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
65898
65899 @@ -1740,7 +1831,7 @@ extern void thread_group_times(struct ta
65900 #define PF_DUMPCORE 0x00000200 /* dumped core */
65901 #define PF_SIGNALED 0x00000400 /* killed by a signal */
65902 #define PF_MEMALLOC 0x00000800 /* Allocating memory */
65903 -#define PF_FLUSHER 0x00001000 /* responsible for disk writeback */
65904 +#define PF_NPROC_EXCEEDED 0x00001000 /* set_user noticed that RLIMIT_NPROC was exceeded */
65905 #define PF_USED_MATH 0x00002000 /* if unset the fpu must be initialized before use */
65906 #define PF_FREEZING 0x00004000 /* freeze in progress. do not account to load */
65907 #define PF_NOFREEZE 0x00008000 /* this thread should not be frozen */
65908 @@ -1978,7 +2069,9 @@ void yield(void);
65909 extern struct exec_domain default_exec_domain;
65910
65911 union thread_union {
65912 +#ifndef CONFIG_X86
65913 struct thread_info thread_info;
65914 +#endif
65915 unsigned long stack[THREAD_SIZE/sizeof(long)];
65916 };
65917
65918 @@ -2011,6 +2104,7 @@ extern struct pid_namespace init_pid_ns;
65919 */
65920
65921 extern struct task_struct *find_task_by_vpid(pid_t nr);
65922 +extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
65923 extern struct task_struct *find_task_by_pid_ns(pid_t nr,
65924 struct pid_namespace *ns);
65925
65926 @@ -2155,7 +2249,7 @@ extern void __cleanup_sighand(struct sig
65927 extern void exit_itimers(struct signal_struct *);
65928 extern void flush_itimer_signals(void);
65929
65930 -extern NORET_TYPE void do_group_exit(int);
65931 +extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
65932
65933 extern void daemonize(const char *, ...);
65934 extern int allow_signal(int);
65935 @@ -2284,13 +2378,17 @@ static inline unsigned long *end_of_stac
65936
65937 #endif
65938
65939 -static inline int object_is_on_stack(void *obj)
65940 +static inline int object_starts_on_stack(void *obj)
65941 {
65942 - void *stack = task_stack_page(current);
65943 + const void *stack = task_stack_page(current);
65944
65945 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
65946 }
65947
65948 +#ifdef CONFIG_PAX_USERCOPY
65949 +extern int object_is_on_stack(const void *obj, unsigned long len);
65950 +#endif
65951 +
65952 extern void thread_info_cache_init(void);
65953
65954 #ifdef CONFIG_DEBUG_STACK_USAGE
65955 diff -urNp linux-2.6.32.49/include/linux/screen_info.h linux-2.6.32.49/include/linux/screen_info.h
65956 --- linux-2.6.32.49/include/linux/screen_info.h 2011-11-08 19:02:43.000000000 -0500
65957 +++ linux-2.6.32.49/include/linux/screen_info.h 2011-11-15 19:59:43.000000000 -0500
65958 @@ -42,7 +42,8 @@ struct screen_info {
65959 __u16 pages; /* 0x32 */
65960 __u16 vesa_attributes; /* 0x34 */
65961 __u32 capabilities; /* 0x36 */
65962 - __u8 _reserved[6]; /* 0x3a */
65963 + __u16 vesapm_size; /* 0x3a */
65964 + __u8 _reserved[4]; /* 0x3c */
65965 } __attribute__((packed));
65966
65967 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
65968 diff -urNp linux-2.6.32.49/include/linux/security.h linux-2.6.32.49/include/linux/security.h
65969 --- linux-2.6.32.49/include/linux/security.h 2011-11-08 19:02:43.000000000 -0500
65970 +++ linux-2.6.32.49/include/linux/security.h 2011-11-15 19:59:43.000000000 -0500
65971 @@ -34,6 +34,7 @@
65972 #include <linux/key.h>
65973 #include <linux/xfrm.h>
65974 #include <linux/gfp.h>
65975 +#include <linux/grsecurity.h>
65976 #include <net/flow.h>
65977
65978 /* Maximum number of letters for an LSM name string */
65979 diff -urNp linux-2.6.32.49/include/linux/seq_file.h linux-2.6.32.49/include/linux/seq_file.h
65980 --- linux-2.6.32.49/include/linux/seq_file.h 2011-11-08 19:02:43.000000000 -0500
65981 +++ linux-2.6.32.49/include/linux/seq_file.h 2011-11-15 19:59:43.000000000 -0500
65982 @@ -32,6 +32,7 @@ struct seq_operations {
65983 void * (*next) (struct seq_file *m, void *v, loff_t *pos);
65984 int (*show) (struct seq_file *m, void *v);
65985 };
65986 +typedef struct seq_operations __no_const seq_operations_no_const;
65987
65988 #define SEQ_SKIP 1
65989
65990 diff -urNp linux-2.6.32.49/include/linux/shm.h linux-2.6.32.49/include/linux/shm.h
65991 --- linux-2.6.32.49/include/linux/shm.h 2011-11-08 19:02:43.000000000 -0500
65992 +++ linux-2.6.32.49/include/linux/shm.h 2011-11-15 19:59:43.000000000 -0500
65993 @@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
65994 pid_t shm_cprid;
65995 pid_t shm_lprid;
65996 struct user_struct *mlock_user;
65997 +#ifdef CONFIG_GRKERNSEC
65998 + time_t shm_createtime;
65999 + pid_t shm_lapid;
66000 +#endif
66001 };
66002
66003 /* shm_mode upper byte flags */
66004 diff -urNp linux-2.6.32.49/include/linux/skbuff.h linux-2.6.32.49/include/linux/skbuff.h
66005 --- linux-2.6.32.49/include/linux/skbuff.h 2011-11-08 19:02:43.000000000 -0500
66006 +++ linux-2.6.32.49/include/linux/skbuff.h 2011-11-15 19:59:43.000000000 -0500
66007 @@ -14,6 +14,7 @@
66008 #ifndef _LINUX_SKBUFF_H
66009 #define _LINUX_SKBUFF_H
66010
66011 +#include <linux/const.h>
66012 #include <linux/kernel.h>
66013 #include <linux/kmemcheck.h>
66014 #include <linux/compiler.h>
66015 @@ -544,7 +545,7 @@ static inline union skb_shared_tx *skb_t
66016 */
66017 static inline int skb_queue_empty(const struct sk_buff_head *list)
66018 {
66019 - return list->next == (struct sk_buff *)list;
66020 + return list->next == (const struct sk_buff *)list;
66021 }
66022
66023 /**
66024 @@ -557,7 +558,7 @@ static inline int skb_queue_empty(const
66025 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
66026 const struct sk_buff *skb)
66027 {
66028 - return (skb->next == (struct sk_buff *) list);
66029 + return (skb->next == (const struct sk_buff *) list);
66030 }
66031
66032 /**
66033 @@ -570,7 +571,7 @@ static inline bool skb_queue_is_last(con
66034 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
66035 const struct sk_buff *skb)
66036 {
66037 - return (skb->prev == (struct sk_buff *) list);
66038 + return (skb->prev == (const struct sk_buff *) list);
66039 }
66040
66041 /**
66042 @@ -1367,7 +1368,7 @@ static inline int skb_network_offset(con
66043 * headroom, you should not reduce this.
66044 */
66045 #ifndef NET_SKB_PAD
66046 -#define NET_SKB_PAD 32
66047 +#define NET_SKB_PAD (_AC(32,UL))
66048 #endif
66049
66050 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
66051 diff -urNp linux-2.6.32.49/include/linux/slab_def.h linux-2.6.32.49/include/linux/slab_def.h
66052 --- linux-2.6.32.49/include/linux/slab_def.h 2011-11-08 19:02:43.000000000 -0500
66053 +++ linux-2.6.32.49/include/linux/slab_def.h 2011-11-15 19:59:43.000000000 -0500
66054 @@ -69,10 +69,10 @@ struct kmem_cache {
66055 unsigned long node_allocs;
66056 unsigned long node_frees;
66057 unsigned long node_overflow;
66058 - atomic_t allochit;
66059 - atomic_t allocmiss;
66060 - atomic_t freehit;
66061 - atomic_t freemiss;
66062 + atomic_unchecked_t allochit;
66063 + atomic_unchecked_t allocmiss;
66064 + atomic_unchecked_t freehit;
66065 + atomic_unchecked_t freemiss;
66066
66067 /*
66068 * If debugging is enabled, then the allocator can add additional
66069 diff -urNp linux-2.6.32.49/include/linux/slab.h linux-2.6.32.49/include/linux/slab.h
66070 --- linux-2.6.32.49/include/linux/slab.h 2011-11-08 19:02:43.000000000 -0500
66071 +++ linux-2.6.32.49/include/linux/slab.h 2011-11-15 19:59:43.000000000 -0500
66072 @@ -11,12 +11,20 @@
66073
66074 #include <linux/gfp.h>
66075 #include <linux/types.h>
66076 +#include <linux/err.h>
66077
66078 /*
66079 * Flags to pass to kmem_cache_create().
66080 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
66081 */
66082 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
66083 +
66084 +#ifdef CONFIG_PAX_USERCOPY
66085 +#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
66086 +#else
66087 +#define SLAB_USERCOPY 0x00000000UL
66088 +#endif
66089 +
66090 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
66091 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
66092 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
66093 @@ -82,10 +90,13 @@
66094 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
66095 * Both make kfree a no-op.
66096 */
66097 -#define ZERO_SIZE_PTR ((void *)16)
66098 +#define ZERO_SIZE_PTR \
66099 +({ \
66100 + BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
66101 + (void *)(-MAX_ERRNO-1L); \
66102 +})
66103
66104 -#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
66105 - (unsigned long)ZERO_SIZE_PTR)
66106 +#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
66107
66108 /*
66109 * struct kmem_cache related prototypes
66110 @@ -138,6 +149,7 @@ void * __must_check krealloc(const void
66111 void kfree(const void *);
66112 void kzfree(const void *);
66113 size_t ksize(const void *);
66114 +void check_object_size(const void *ptr, unsigned long n, bool to);
66115
66116 /*
66117 * Allocator specific definitions. These are mainly used to establish optimized
66118 @@ -328,4 +340,37 @@ static inline void *kzalloc_node(size_t
66119
66120 void __init kmem_cache_init_late(void);
66121
66122 +#define kmalloc(x, y) \
66123 +({ \
66124 + void *___retval; \
66125 + intoverflow_t ___x = (intoverflow_t)x; \
66126 + if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n"))\
66127 + ___retval = NULL; \
66128 + else \
66129 + ___retval = kmalloc((size_t)___x, (y)); \
66130 + ___retval; \
66131 +})
66132 +
66133 +#define kmalloc_node(x, y, z) \
66134 +({ \
66135 + void *___retval; \
66136 + intoverflow_t ___x = (intoverflow_t)x; \
66137 + if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
66138 + ___retval = NULL; \
66139 + else \
66140 + ___retval = kmalloc_node((size_t)___x, (y), (z));\
66141 + ___retval; \
66142 +})
66143 +
66144 +#define kzalloc(x, y) \
66145 +({ \
66146 + void *___retval; \
66147 + intoverflow_t ___x = (intoverflow_t)x; \
66148 + if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n"))\
66149 + ___retval = NULL; \
66150 + else \
66151 + ___retval = kzalloc((size_t)___x, (y)); \
66152 + ___retval; \
66153 +})
66154 +
66155 #endif /* _LINUX_SLAB_H */
66156 diff -urNp linux-2.6.32.49/include/linux/slub_def.h linux-2.6.32.49/include/linux/slub_def.h
66157 --- linux-2.6.32.49/include/linux/slub_def.h 2011-11-08 19:02:43.000000000 -0500
66158 +++ linux-2.6.32.49/include/linux/slub_def.h 2011-11-15 19:59:43.000000000 -0500
66159 @@ -86,7 +86,7 @@ struct kmem_cache {
66160 struct kmem_cache_order_objects max;
66161 struct kmem_cache_order_objects min;
66162 gfp_t allocflags; /* gfp flags to use on each alloc */
66163 - int refcount; /* Refcount for slab cache destroy */
66164 + atomic_t refcount; /* Refcount for slab cache destroy */
66165 void (*ctor)(void *);
66166 int inuse; /* Offset to metadata */
66167 int align; /* Alignment */
66168 @@ -215,7 +215,7 @@ static __always_inline struct kmem_cache
66169 #endif
66170
66171 void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
66172 -void *__kmalloc(size_t size, gfp_t flags);
66173 +void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1);
66174
66175 #ifdef CONFIG_KMEMTRACE
66176 extern void *kmem_cache_alloc_notrace(struct kmem_cache *s, gfp_t gfpflags);
66177 diff -urNp linux-2.6.32.49/include/linux/sonet.h linux-2.6.32.49/include/linux/sonet.h
66178 --- linux-2.6.32.49/include/linux/sonet.h 2011-11-08 19:02:43.000000000 -0500
66179 +++ linux-2.6.32.49/include/linux/sonet.h 2011-11-15 19:59:43.000000000 -0500
66180 @@ -61,7 +61,7 @@ struct sonet_stats {
66181 #include <asm/atomic.h>
66182
66183 struct k_sonet_stats {
66184 -#define __HANDLE_ITEM(i) atomic_t i
66185 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
66186 __SONET_ITEMS
66187 #undef __HANDLE_ITEM
66188 };
66189 diff -urNp linux-2.6.32.49/include/linux/sunrpc/cache.h linux-2.6.32.49/include/linux/sunrpc/cache.h
66190 --- linux-2.6.32.49/include/linux/sunrpc/cache.h 2011-11-08 19:02:43.000000000 -0500
66191 +++ linux-2.6.32.49/include/linux/sunrpc/cache.h 2011-11-15 19:59:43.000000000 -0500
66192 @@ -125,7 +125,7 @@ struct cache_detail {
66193 */
66194 struct cache_req {
66195 struct cache_deferred_req *(*defer)(struct cache_req *req);
66196 -};
66197 +} __no_const;
66198 /* this must be embedded in a deferred_request that is being
66199 * delayed awaiting cache-fill
66200 */
66201 diff -urNp linux-2.6.32.49/include/linux/sunrpc/clnt.h linux-2.6.32.49/include/linux/sunrpc/clnt.h
66202 --- linux-2.6.32.49/include/linux/sunrpc/clnt.h 2011-11-08 19:02:43.000000000 -0500
66203 +++ linux-2.6.32.49/include/linux/sunrpc/clnt.h 2011-11-15 19:59:43.000000000 -0500
66204 @@ -167,9 +167,9 @@ static inline unsigned short rpc_get_por
66205 {
66206 switch (sap->sa_family) {
66207 case AF_INET:
66208 - return ntohs(((struct sockaddr_in *)sap)->sin_port);
66209 + return ntohs(((const struct sockaddr_in *)sap)->sin_port);
66210 case AF_INET6:
66211 - return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
66212 + return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
66213 }
66214 return 0;
66215 }
66216 @@ -202,7 +202,7 @@ static inline bool __rpc_cmp_addr4(const
66217 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
66218 const struct sockaddr *src)
66219 {
66220 - const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
66221 + const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
66222 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
66223
66224 dsin->sin_family = ssin->sin_family;
66225 @@ -299,7 +299,7 @@ static inline u32 rpc_get_scope_id(const
66226 if (sa->sa_family != AF_INET6)
66227 return 0;
66228
66229 - return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
66230 + return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
66231 }
66232
66233 #endif /* __KERNEL__ */
66234 diff -urNp linux-2.6.32.49/include/linux/sunrpc/svc_rdma.h linux-2.6.32.49/include/linux/sunrpc/svc_rdma.h
66235 --- linux-2.6.32.49/include/linux/sunrpc/svc_rdma.h 2011-11-08 19:02:43.000000000 -0500
66236 +++ linux-2.6.32.49/include/linux/sunrpc/svc_rdma.h 2011-11-15 19:59:43.000000000 -0500
66237 @@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
66238 extern unsigned int svcrdma_max_requests;
66239 extern unsigned int svcrdma_max_req_size;
66240
66241 -extern atomic_t rdma_stat_recv;
66242 -extern atomic_t rdma_stat_read;
66243 -extern atomic_t rdma_stat_write;
66244 -extern atomic_t rdma_stat_sq_starve;
66245 -extern atomic_t rdma_stat_rq_starve;
66246 -extern atomic_t rdma_stat_rq_poll;
66247 -extern atomic_t rdma_stat_rq_prod;
66248 -extern atomic_t rdma_stat_sq_poll;
66249 -extern atomic_t rdma_stat_sq_prod;
66250 +extern atomic_unchecked_t rdma_stat_recv;
66251 +extern atomic_unchecked_t rdma_stat_read;
66252 +extern atomic_unchecked_t rdma_stat_write;
66253 +extern atomic_unchecked_t rdma_stat_sq_starve;
66254 +extern atomic_unchecked_t rdma_stat_rq_starve;
66255 +extern atomic_unchecked_t rdma_stat_rq_poll;
66256 +extern atomic_unchecked_t rdma_stat_rq_prod;
66257 +extern atomic_unchecked_t rdma_stat_sq_poll;
66258 +extern atomic_unchecked_t rdma_stat_sq_prod;
66259
66260 #define RPCRDMA_VERSION 1
66261
66262 diff -urNp linux-2.6.32.49/include/linux/suspend.h linux-2.6.32.49/include/linux/suspend.h
66263 --- linux-2.6.32.49/include/linux/suspend.h 2011-11-08 19:02:43.000000000 -0500
66264 +++ linux-2.6.32.49/include/linux/suspend.h 2011-11-15 19:59:43.000000000 -0500
66265 @@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
66266 * which require special recovery actions in that situation.
66267 */
66268 struct platform_suspend_ops {
66269 - int (*valid)(suspend_state_t state);
66270 - int (*begin)(suspend_state_t state);
66271 - int (*prepare)(void);
66272 - int (*prepare_late)(void);
66273 - int (*enter)(suspend_state_t state);
66274 - void (*wake)(void);
66275 - void (*finish)(void);
66276 - void (*end)(void);
66277 - void (*recover)(void);
66278 + int (* const valid)(suspend_state_t state);
66279 + int (* const begin)(suspend_state_t state);
66280 + int (* const prepare)(void);
66281 + int (* const prepare_late)(void);
66282 + int (* const enter)(suspend_state_t state);
66283 + void (* const wake)(void);
66284 + void (* const finish)(void);
66285 + void (* const end)(void);
66286 + void (* const recover)(void);
66287 };
66288
66289 #ifdef CONFIG_SUSPEND
66290 @@ -120,7 +120,7 @@ struct platform_suspend_ops {
66291 * suspend_set_ops - set platform dependent suspend operations
66292 * @ops: The new suspend operations to set.
66293 */
66294 -extern void suspend_set_ops(struct platform_suspend_ops *ops);
66295 +extern void suspend_set_ops(const struct platform_suspend_ops *ops);
66296 extern int suspend_valid_only_mem(suspend_state_t state);
66297
66298 /**
66299 @@ -145,7 +145,7 @@ extern int pm_suspend(suspend_state_t st
66300 #else /* !CONFIG_SUSPEND */
66301 #define suspend_valid_only_mem NULL
66302
66303 -static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
66304 +static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
66305 static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
66306 #endif /* !CONFIG_SUSPEND */
66307
66308 @@ -215,16 +215,16 @@ extern void mark_free_pages(struct zone
66309 * platforms which require special recovery actions in that situation.
66310 */
66311 struct platform_hibernation_ops {
66312 - int (*begin)(void);
66313 - void (*end)(void);
66314 - int (*pre_snapshot)(void);
66315 - void (*finish)(void);
66316 - int (*prepare)(void);
66317 - int (*enter)(void);
66318 - void (*leave)(void);
66319 - int (*pre_restore)(void);
66320 - void (*restore_cleanup)(void);
66321 - void (*recover)(void);
66322 + int (* const begin)(void);
66323 + void (* const end)(void);
66324 + int (* const pre_snapshot)(void);
66325 + void (* const finish)(void);
66326 + int (* const prepare)(void);
66327 + int (* const enter)(void);
66328 + void (* const leave)(void);
66329 + int (* const pre_restore)(void);
66330 + void (* const restore_cleanup)(void);
66331 + void (* const recover)(void);
66332 };
66333
66334 #ifdef CONFIG_HIBERNATION
66335 @@ -243,7 +243,7 @@ extern void swsusp_set_page_free(struct
66336 extern void swsusp_unset_page_free(struct page *);
66337 extern unsigned long get_safe_page(gfp_t gfp_mask);
66338
66339 -extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
66340 +extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
66341 extern int hibernate(void);
66342 extern bool system_entering_hibernation(void);
66343 #else /* CONFIG_HIBERNATION */
66344 @@ -251,7 +251,7 @@ static inline int swsusp_page_is_forbidd
66345 static inline void swsusp_set_page_free(struct page *p) {}
66346 static inline void swsusp_unset_page_free(struct page *p) {}
66347
66348 -static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
66349 +static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
66350 static inline int hibernate(void) { return -ENOSYS; }
66351 static inline bool system_entering_hibernation(void) { return false; }
66352 #endif /* CONFIG_HIBERNATION */
66353 diff -urNp linux-2.6.32.49/include/linux/sysctl.h linux-2.6.32.49/include/linux/sysctl.h
66354 --- linux-2.6.32.49/include/linux/sysctl.h 2011-11-08 19:02:43.000000000 -0500
66355 +++ linux-2.6.32.49/include/linux/sysctl.h 2011-11-15 19:59:43.000000000 -0500
66356 @@ -164,7 +164,11 @@ enum
66357 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
66358 };
66359
66360 -
66361 +#ifdef CONFIG_PAX_SOFTMODE
66362 +enum {
66363 + PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
66364 +};
66365 +#endif
66366
66367 /* CTL_VM names: */
66368 enum
66369 @@ -982,6 +986,8 @@ typedef int proc_handler (struct ctl_tab
66370
66371 extern int proc_dostring(struct ctl_table *, int,
66372 void __user *, size_t *, loff_t *);
66373 +extern int proc_dostring_modpriv(struct ctl_table *, int,
66374 + void __user *, size_t *, loff_t *);
66375 extern int proc_dointvec(struct ctl_table *, int,
66376 void __user *, size_t *, loff_t *);
66377 extern int proc_dointvec_minmax(struct ctl_table *, int,
66378 @@ -1003,6 +1009,7 @@ extern int do_sysctl (int __user *name,
66379
66380 extern ctl_handler sysctl_data;
66381 extern ctl_handler sysctl_string;
66382 +extern ctl_handler sysctl_string_modpriv;
66383 extern ctl_handler sysctl_intvec;
66384 extern ctl_handler sysctl_jiffies;
66385 extern ctl_handler sysctl_ms_jiffies;
66386 diff -urNp linux-2.6.32.49/include/linux/sysfs.h linux-2.6.32.49/include/linux/sysfs.h
66387 --- linux-2.6.32.49/include/linux/sysfs.h 2011-11-08 19:02:43.000000000 -0500
66388 +++ linux-2.6.32.49/include/linux/sysfs.h 2011-11-15 19:59:43.000000000 -0500
66389 @@ -75,8 +75,8 @@ struct bin_attribute {
66390 };
66391
66392 struct sysfs_ops {
66393 - ssize_t (*show)(struct kobject *, struct attribute *,char *);
66394 - ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
66395 + ssize_t (* const show)(struct kobject *, struct attribute *,char *);
66396 + ssize_t (* const store)(struct kobject *,struct attribute *,const char *, size_t);
66397 };
66398
66399 struct sysfs_dirent;
66400 diff -urNp linux-2.6.32.49/include/linux/thread_info.h linux-2.6.32.49/include/linux/thread_info.h
66401 --- linux-2.6.32.49/include/linux/thread_info.h 2011-11-08 19:02:43.000000000 -0500
66402 +++ linux-2.6.32.49/include/linux/thread_info.h 2011-11-15 19:59:43.000000000 -0500
66403 @@ -23,7 +23,7 @@ struct restart_block {
66404 };
66405 /* For futex_wait and futex_wait_requeue_pi */
66406 struct {
66407 - u32 *uaddr;
66408 + u32 __user *uaddr;
66409 u32 val;
66410 u32 flags;
66411 u32 bitset;
66412 diff -urNp linux-2.6.32.49/include/linux/tty.h linux-2.6.32.49/include/linux/tty.h
66413 --- linux-2.6.32.49/include/linux/tty.h 2011-11-08 19:02:43.000000000 -0500
66414 +++ linux-2.6.32.49/include/linux/tty.h 2011-11-15 19:59:43.000000000 -0500
66415 @@ -493,7 +493,6 @@ extern void tty_ldisc_begin(void);
66416 /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
66417 extern void tty_ldisc_enable(struct tty_struct *tty);
66418
66419 -
66420 /* n_tty.c */
66421 extern struct tty_ldisc_ops tty_ldisc_N_TTY;
66422
66423 diff -urNp linux-2.6.32.49/include/linux/tty_ldisc.h linux-2.6.32.49/include/linux/tty_ldisc.h
66424 --- linux-2.6.32.49/include/linux/tty_ldisc.h 2011-11-08 19:02:43.000000000 -0500
66425 +++ linux-2.6.32.49/include/linux/tty_ldisc.h 2011-11-15 19:59:43.000000000 -0500
66426 @@ -139,7 +139,7 @@ struct tty_ldisc_ops {
66427
66428 struct module *owner;
66429
66430 - int refcount;
66431 + atomic_t refcount;
66432 };
66433
66434 struct tty_ldisc {
66435 diff -urNp linux-2.6.32.49/include/linux/types.h linux-2.6.32.49/include/linux/types.h
66436 --- linux-2.6.32.49/include/linux/types.h 2011-11-08 19:02:43.000000000 -0500
66437 +++ linux-2.6.32.49/include/linux/types.h 2011-11-15 19:59:43.000000000 -0500
66438 @@ -191,10 +191,26 @@ typedef struct {
66439 volatile int counter;
66440 } atomic_t;
66441
66442 +#ifdef CONFIG_PAX_REFCOUNT
66443 +typedef struct {
66444 + volatile int counter;
66445 +} atomic_unchecked_t;
66446 +#else
66447 +typedef atomic_t atomic_unchecked_t;
66448 +#endif
66449 +
66450 #ifdef CONFIG_64BIT
66451 typedef struct {
66452 volatile long counter;
66453 } atomic64_t;
66454 +
66455 +#ifdef CONFIG_PAX_REFCOUNT
66456 +typedef struct {
66457 + volatile long counter;
66458 +} atomic64_unchecked_t;
66459 +#else
66460 +typedef atomic64_t atomic64_unchecked_t;
66461 +#endif
66462 #endif
66463
66464 struct ustat {
66465 diff -urNp linux-2.6.32.49/include/linux/uaccess.h linux-2.6.32.49/include/linux/uaccess.h
66466 --- linux-2.6.32.49/include/linux/uaccess.h 2011-11-08 19:02:43.000000000 -0500
66467 +++ linux-2.6.32.49/include/linux/uaccess.h 2011-11-15 19:59:43.000000000 -0500
66468 @@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
66469 long ret; \
66470 mm_segment_t old_fs = get_fs(); \
66471 \
66472 - set_fs(KERNEL_DS); \
66473 pagefault_disable(); \
66474 - ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
66475 - pagefault_enable(); \
66476 + set_fs(KERNEL_DS); \
66477 + ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \
66478 set_fs(old_fs); \
66479 + pagefault_enable(); \
66480 ret; \
66481 })
66482
66483 @@ -93,7 +93,7 @@ static inline unsigned long __copy_from_
66484 * Safely read from address @src to the buffer at @dst. If a kernel fault
66485 * happens, handle that and return -EFAULT.
66486 */
66487 -extern long probe_kernel_read(void *dst, void *src, size_t size);
66488 +extern long probe_kernel_read(void *dst, const void *src, size_t size);
66489
66490 /*
66491 * probe_kernel_write(): safely attempt to write to a location
66492 @@ -104,6 +104,6 @@ extern long probe_kernel_read(void *dst,
66493 * Safely write to address @dst from the buffer at @src. If a kernel fault
66494 * happens, handle that and return -EFAULT.
66495 */
66496 -extern long probe_kernel_write(void *dst, void *src, size_t size);
66497 +extern long probe_kernel_write(void *dst, const void *src, size_t size);
66498
66499 #endif /* __LINUX_UACCESS_H__ */
66500 diff -urNp linux-2.6.32.49/include/linux/unaligned/access_ok.h linux-2.6.32.49/include/linux/unaligned/access_ok.h
66501 --- linux-2.6.32.49/include/linux/unaligned/access_ok.h 2011-11-08 19:02:43.000000000 -0500
66502 +++ linux-2.6.32.49/include/linux/unaligned/access_ok.h 2011-11-15 19:59:43.000000000 -0500
66503 @@ -6,32 +6,32 @@
66504
66505 static inline u16 get_unaligned_le16(const void *p)
66506 {
66507 - return le16_to_cpup((__le16 *)p);
66508 + return le16_to_cpup((const __le16 *)p);
66509 }
66510
66511 static inline u32 get_unaligned_le32(const void *p)
66512 {
66513 - return le32_to_cpup((__le32 *)p);
66514 + return le32_to_cpup((const __le32 *)p);
66515 }
66516
66517 static inline u64 get_unaligned_le64(const void *p)
66518 {
66519 - return le64_to_cpup((__le64 *)p);
66520 + return le64_to_cpup((const __le64 *)p);
66521 }
66522
66523 static inline u16 get_unaligned_be16(const void *p)
66524 {
66525 - return be16_to_cpup((__be16 *)p);
66526 + return be16_to_cpup((const __be16 *)p);
66527 }
66528
66529 static inline u32 get_unaligned_be32(const void *p)
66530 {
66531 - return be32_to_cpup((__be32 *)p);
66532 + return be32_to_cpup((const __be32 *)p);
66533 }
66534
66535 static inline u64 get_unaligned_be64(const void *p)
66536 {
66537 - return be64_to_cpup((__be64 *)p);
66538 + return be64_to_cpup((const __be64 *)p);
66539 }
66540
66541 static inline void put_unaligned_le16(u16 val, void *p)
66542 diff -urNp linux-2.6.32.49/include/linux/vermagic.h linux-2.6.32.49/include/linux/vermagic.h
66543 --- linux-2.6.32.49/include/linux/vermagic.h 2011-11-08 19:02:43.000000000 -0500
66544 +++ linux-2.6.32.49/include/linux/vermagic.h 2011-11-18 18:09:44.000000000 -0500
66545 @@ -26,9 +26,35 @@
66546 #define MODULE_ARCH_VERMAGIC ""
66547 #endif
66548
66549 +#ifdef CONFIG_PAX_REFCOUNT
66550 +#define MODULE_PAX_REFCOUNT "REFCOUNT "
66551 +#else
66552 +#define MODULE_PAX_REFCOUNT ""
66553 +#endif
66554 +
66555 +#ifdef CONSTIFY_PLUGIN
66556 +#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN "
66557 +#else
66558 +#define MODULE_CONSTIFY_PLUGIN ""
66559 +#endif
66560 +
66561 +#ifdef STACKLEAK_PLUGIN
66562 +#define MODULE_STACKLEAK_PLUGIN "STACKLEAK_PLUGIN "
66563 +#else
66564 +#define MODULE_STACKLEAK_PLUGIN ""
66565 +#endif
66566 +
66567 +#ifdef CONFIG_GRKERNSEC
66568 +#define MODULE_GRSEC "GRSEC "
66569 +#else
66570 +#define MODULE_GRSEC ""
66571 +#endif
66572 +
66573 #define VERMAGIC_STRING \
66574 UTS_RELEASE " " \
66575 MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \
66576 MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \
66577 - MODULE_ARCH_VERMAGIC
66578 + MODULE_ARCH_VERMAGIC \
66579 + MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN MODULE_STACKLEAK_PLUGIN \
66580 + MODULE_GRSEC
66581
66582 diff -urNp linux-2.6.32.49/include/linux/vmalloc.h linux-2.6.32.49/include/linux/vmalloc.h
66583 --- linux-2.6.32.49/include/linux/vmalloc.h 2011-11-26 19:44:53.000000000 -0500
66584 +++ linux-2.6.32.49/include/linux/vmalloc.h 2011-11-26 19:46:42.000000000 -0500
66585 @@ -14,6 +14,11 @@ struct vm_area_struct; /* vma defining
66586 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
66587 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
66588 #define VM_UNLIST 0x00000020 /* vm_struct is not listed in vmlist */
66589 +
66590 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
66591 +#define VM_KERNEXEC 0x00000040 /* allocate from executable kernel memory range */
66592 +#endif
66593 +
66594 /* bits [20..32] reserved for arch specific ioremap internals */
66595
66596 /*
66597 @@ -124,4 +129,81 @@ struct vm_struct **pcpu_get_vm_areas(con
66598
66599 void pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms);
66600
66601 +#define vmalloc(x) \
66602 +({ \
66603 + void *___retval; \
66604 + intoverflow_t ___x = (intoverflow_t)x; \
66605 + if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
66606 + ___retval = NULL; \
66607 + else \
66608 + ___retval = vmalloc((unsigned long)___x); \
66609 + ___retval; \
66610 +})
66611 +
66612 +#define __vmalloc(x, y, z) \
66613 +({ \
66614 + void *___retval; \
66615 + intoverflow_t ___x = (intoverflow_t)x; \
66616 + if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
66617 + ___retval = NULL; \
66618 + else \
66619 + ___retval = __vmalloc((unsigned long)___x, (y), (z));\
66620 + ___retval; \
66621 +})
66622 +
66623 +#define vmalloc_user(x) \
66624 +({ \
66625 + void *___retval; \
66626 + intoverflow_t ___x = (intoverflow_t)x; \
66627 + if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
66628 + ___retval = NULL; \
66629 + else \
66630 + ___retval = vmalloc_user((unsigned long)___x); \
66631 + ___retval; \
66632 +})
66633 +
66634 +#define vmalloc_exec(x) \
66635 +({ \
66636 + void *___retval; \
66637 + intoverflow_t ___x = (intoverflow_t)x; \
66638 + if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
66639 + ___retval = NULL; \
66640 + else \
66641 + ___retval = vmalloc_exec((unsigned long)___x); \
66642 + ___retval; \
66643 +})
66644 +
66645 +#define vmalloc_node(x, y) \
66646 +({ \
66647 + void *___retval; \
66648 + intoverflow_t ___x = (intoverflow_t)x; \
66649 + if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
66650 + ___retval = NULL; \
66651 + else \
66652 + ___retval = vmalloc_node((unsigned long)___x, (y));\
66653 + ___retval; \
66654 +})
66655 +
66656 +#define vmalloc_32(x) \
66657 +({ \
66658 + void *___retval; \
66659 + intoverflow_t ___x = (intoverflow_t)x; \
66660 + if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
66661 + ___retval = NULL; \
66662 + else \
66663 + ___retval = vmalloc_32((unsigned long)___x); \
66664 + ___retval; \
66665 +})
66666 +
66667 +#define vmalloc_32_user(x) \
66668 +({ \
66669 + void *___retval; \
66670 + intoverflow_t ___x = (intoverflow_t)x; \
66671 + if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
66672 + ___retval = NULL; \
66673 + else \
66674 + ___retval = vmalloc_32_user((unsigned long)___x);\
66675 + ___retval; \
66676 +})
66677 +
66678 #endif /* _LINUX_VMALLOC_H */
66679 diff -urNp linux-2.6.32.49/include/linux/vmstat.h linux-2.6.32.49/include/linux/vmstat.h
66680 --- linux-2.6.32.49/include/linux/vmstat.h 2011-11-08 19:02:43.000000000 -0500
66681 +++ linux-2.6.32.49/include/linux/vmstat.h 2011-11-15 19:59:43.000000000 -0500
66682 @@ -136,18 +136,18 @@ static inline void vm_events_fold_cpu(in
66683 /*
66684 * Zone based page accounting with per cpu differentials.
66685 */
66686 -extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
66687 +extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
66688
66689 static inline void zone_page_state_add(long x, struct zone *zone,
66690 enum zone_stat_item item)
66691 {
66692 - atomic_long_add(x, &zone->vm_stat[item]);
66693 - atomic_long_add(x, &vm_stat[item]);
66694 + atomic_long_add_unchecked(x, &zone->vm_stat[item]);
66695 + atomic_long_add_unchecked(x, &vm_stat[item]);
66696 }
66697
66698 static inline unsigned long global_page_state(enum zone_stat_item item)
66699 {
66700 - long x = atomic_long_read(&vm_stat[item]);
66701 + long x = atomic_long_read_unchecked(&vm_stat[item]);
66702 #ifdef CONFIG_SMP
66703 if (x < 0)
66704 x = 0;
66705 @@ -158,7 +158,7 @@ static inline unsigned long global_page_
66706 static inline unsigned long zone_page_state(struct zone *zone,
66707 enum zone_stat_item item)
66708 {
66709 - long x = atomic_long_read(&zone->vm_stat[item]);
66710 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
66711 #ifdef CONFIG_SMP
66712 if (x < 0)
66713 x = 0;
66714 @@ -175,7 +175,7 @@ static inline unsigned long zone_page_st
66715 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
66716 enum zone_stat_item item)
66717 {
66718 - long x = atomic_long_read(&zone->vm_stat[item]);
66719 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
66720
66721 #ifdef CONFIG_SMP
66722 int cpu;
66723 @@ -264,8 +264,8 @@ static inline void __mod_zone_page_state
66724
66725 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
66726 {
66727 - atomic_long_inc(&zone->vm_stat[item]);
66728 - atomic_long_inc(&vm_stat[item]);
66729 + atomic_long_inc_unchecked(&zone->vm_stat[item]);
66730 + atomic_long_inc_unchecked(&vm_stat[item]);
66731 }
66732
66733 static inline void __inc_zone_page_state(struct page *page,
66734 @@ -276,8 +276,8 @@ static inline void __inc_zone_page_state
66735
66736 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
66737 {
66738 - atomic_long_dec(&zone->vm_stat[item]);
66739 - atomic_long_dec(&vm_stat[item]);
66740 + atomic_long_dec_unchecked(&zone->vm_stat[item]);
66741 + atomic_long_dec_unchecked(&vm_stat[item]);
66742 }
66743
66744 static inline void __dec_zone_page_state(struct page *page,
66745 diff -urNp linux-2.6.32.49/include/media/saa7146_vv.h linux-2.6.32.49/include/media/saa7146_vv.h
66746 --- linux-2.6.32.49/include/media/saa7146_vv.h 2011-11-08 19:02:43.000000000 -0500
66747 +++ linux-2.6.32.49/include/media/saa7146_vv.h 2011-11-15 19:59:43.000000000 -0500
66748 @@ -167,7 +167,7 @@ struct saa7146_ext_vv
66749 int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *);
66750
66751 /* the extension can override this */
66752 - struct v4l2_ioctl_ops ops;
66753 + v4l2_ioctl_ops_no_const ops;
66754 /* pointer to the saa7146 core ops */
66755 const struct v4l2_ioctl_ops *core_ops;
66756
66757 diff -urNp linux-2.6.32.49/include/media/v4l2-dev.h linux-2.6.32.49/include/media/v4l2-dev.h
66758 --- linux-2.6.32.49/include/media/v4l2-dev.h 2011-11-08 19:02:43.000000000 -0500
66759 +++ linux-2.6.32.49/include/media/v4l2-dev.h 2011-11-15 19:59:43.000000000 -0500
66760 @@ -34,7 +34,7 @@ struct v4l2_device;
66761 #define V4L2_FL_UNREGISTERED (0)
66762
66763 struct v4l2_file_operations {
66764 - struct module *owner;
66765 + struct module * const owner;
66766 ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
66767 ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
66768 unsigned int (*poll) (struct file *, struct poll_table_struct *);
66769 @@ -46,6 +46,7 @@ struct v4l2_file_operations {
66770 int (*open) (struct file *);
66771 int (*release) (struct file *);
66772 };
66773 +typedef struct v4l2_file_operations __no_const v4l2_file_operations_no_const;
66774
66775 /*
66776 * Newer version of video_device, handled by videodev2.c
66777 diff -urNp linux-2.6.32.49/include/media/v4l2-device.h linux-2.6.32.49/include/media/v4l2-device.h
66778 --- linux-2.6.32.49/include/media/v4l2-device.h 2011-11-08 19:02:43.000000000 -0500
66779 +++ linux-2.6.32.49/include/media/v4l2-device.h 2011-11-15 19:59:43.000000000 -0500
66780 @@ -71,7 +71,7 @@ int __must_check v4l2_device_register(st
66781 this function returns 0. If the name ends with a digit (e.g. cx18),
66782 then the name will be set to cx18-0 since cx180 looks really odd. */
66783 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
66784 - atomic_t *instance);
66785 + atomic_unchecked_t *instance);
66786
66787 /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
66788 Since the parent disappears this ensures that v4l2_dev doesn't have an
66789 diff -urNp linux-2.6.32.49/include/media/v4l2-ioctl.h linux-2.6.32.49/include/media/v4l2-ioctl.h
66790 --- linux-2.6.32.49/include/media/v4l2-ioctl.h 2011-11-08 19:02:43.000000000 -0500
66791 +++ linux-2.6.32.49/include/media/v4l2-ioctl.h 2011-11-15 19:59:43.000000000 -0500
66792 @@ -243,6 +243,7 @@ struct v4l2_ioctl_ops {
66793 long (*vidioc_default) (struct file *file, void *fh,
66794 int cmd, void *arg);
66795 };
66796 +typedef struct v4l2_ioctl_ops __no_const v4l2_ioctl_ops_no_const;
66797
66798
66799 /* v4l debugging and diagnostics */
66800 diff -urNp linux-2.6.32.49/include/net/flow.h linux-2.6.32.49/include/net/flow.h
66801 --- linux-2.6.32.49/include/net/flow.h 2011-11-08 19:02:43.000000000 -0500
66802 +++ linux-2.6.32.49/include/net/flow.h 2011-11-15 19:59:43.000000000 -0500
66803 @@ -92,7 +92,7 @@ typedef int (*flow_resolve_t)(struct net
66804 extern void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family,
66805 u8 dir, flow_resolve_t resolver);
66806 extern void flow_cache_flush(void);
66807 -extern atomic_t flow_cache_genid;
66808 +extern atomic_unchecked_t flow_cache_genid;
66809
66810 static inline int flow_cache_uli_match(struct flowi *fl1, struct flowi *fl2)
66811 {
66812 diff -urNp linux-2.6.32.49/include/net/inetpeer.h linux-2.6.32.49/include/net/inetpeer.h
66813 --- linux-2.6.32.49/include/net/inetpeer.h 2011-11-08 19:02:43.000000000 -0500
66814 +++ linux-2.6.32.49/include/net/inetpeer.h 2011-11-15 19:59:43.000000000 -0500
66815 @@ -24,7 +24,7 @@ struct inet_peer
66816 __u32 dtime; /* the time of last use of not
66817 * referenced entries */
66818 atomic_t refcnt;
66819 - atomic_t rid; /* Frag reception counter */
66820 + atomic_unchecked_t rid; /* Frag reception counter */
66821 __u32 tcp_ts;
66822 unsigned long tcp_ts_stamp;
66823 };
66824 diff -urNp linux-2.6.32.49/include/net/ip_vs.h linux-2.6.32.49/include/net/ip_vs.h
66825 --- linux-2.6.32.49/include/net/ip_vs.h 2011-11-08 19:02:43.000000000 -0500
66826 +++ linux-2.6.32.49/include/net/ip_vs.h 2011-11-15 19:59:43.000000000 -0500
66827 @@ -365,7 +365,7 @@ struct ip_vs_conn {
66828 struct ip_vs_conn *control; /* Master control connection */
66829 atomic_t n_control; /* Number of controlled ones */
66830 struct ip_vs_dest *dest; /* real server */
66831 - atomic_t in_pkts; /* incoming packet counter */
66832 + atomic_unchecked_t in_pkts; /* incoming packet counter */
66833
66834 /* packet transmitter for different forwarding methods. If it
66835 mangles the packet, it must return NF_DROP or better NF_STOLEN,
66836 @@ -466,7 +466,7 @@ struct ip_vs_dest {
66837 union nf_inet_addr addr; /* IP address of the server */
66838 __be16 port; /* port number of the server */
66839 volatile unsigned flags; /* dest status flags */
66840 - atomic_t conn_flags; /* flags to copy to conn */
66841 + atomic_unchecked_t conn_flags; /* flags to copy to conn */
66842 atomic_t weight; /* server weight */
66843
66844 atomic_t refcnt; /* reference counter */
66845 diff -urNp linux-2.6.32.49/include/net/irda/ircomm_core.h linux-2.6.32.49/include/net/irda/ircomm_core.h
66846 --- linux-2.6.32.49/include/net/irda/ircomm_core.h 2011-11-08 19:02:43.000000000 -0500
66847 +++ linux-2.6.32.49/include/net/irda/ircomm_core.h 2011-11-15 19:59:43.000000000 -0500
66848 @@ -51,7 +51,7 @@ typedef struct {
66849 int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
66850 int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *,
66851 struct ircomm_info *);
66852 -} call_t;
66853 +} __no_const call_t;
66854
66855 struct ircomm_cb {
66856 irda_queue_t queue;
66857 diff -urNp linux-2.6.32.49/include/net/irda/ircomm_tty.h linux-2.6.32.49/include/net/irda/ircomm_tty.h
66858 --- linux-2.6.32.49/include/net/irda/ircomm_tty.h 2011-11-08 19:02:43.000000000 -0500
66859 +++ linux-2.6.32.49/include/net/irda/ircomm_tty.h 2011-11-15 19:59:43.000000000 -0500
66860 @@ -35,6 +35,7 @@
66861 #include <linux/termios.h>
66862 #include <linux/timer.h>
66863 #include <linux/tty.h> /* struct tty_struct */
66864 +#include <asm/local.h>
66865
66866 #include <net/irda/irias_object.h>
66867 #include <net/irda/ircomm_core.h>
66868 @@ -105,8 +106,8 @@ struct ircomm_tty_cb {
66869 unsigned short close_delay;
66870 unsigned short closing_wait; /* time to wait before closing */
66871
66872 - int open_count;
66873 - int blocked_open; /* # of blocked opens */
66874 + local_t open_count;
66875 + local_t blocked_open; /* # of blocked opens */
66876
66877 /* Protect concurent access to :
66878 * o self->open_count
66879 diff -urNp linux-2.6.32.49/include/net/iucv/af_iucv.h linux-2.6.32.49/include/net/iucv/af_iucv.h
66880 --- linux-2.6.32.49/include/net/iucv/af_iucv.h 2011-11-08 19:02:43.000000000 -0500
66881 +++ linux-2.6.32.49/include/net/iucv/af_iucv.h 2011-11-15 19:59:43.000000000 -0500
66882 @@ -87,7 +87,7 @@ struct iucv_sock {
66883 struct iucv_sock_list {
66884 struct hlist_head head;
66885 rwlock_t lock;
66886 - atomic_t autobind_name;
66887 + atomic_unchecked_t autobind_name;
66888 };
66889
66890 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
66891 diff -urNp linux-2.6.32.49/include/net/lapb.h linux-2.6.32.49/include/net/lapb.h
66892 --- linux-2.6.32.49/include/net/lapb.h 2011-11-08 19:02:43.000000000 -0500
66893 +++ linux-2.6.32.49/include/net/lapb.h 2011-11-15 19:59:43.000000000 -0500
66894 @@ -95,7 +95,7 @@ struct lapb_cb {
66895 struct sk_buff_head write_queue;
66896 struct sk_buff_head ack_queue;
66897 unsigned char window;
66898 - struct lapb_register_struct callbacks;
66899 + struct lapb_register_struct *callbacks;
66900
66901 /* FRMR control information */
66902 struct lapb_frame frmr_data;
66903 diff -urNp linux-2.6.32.49/include/net/neighbour.h linux-2.6.32.49/include/net/neighbour.h
66904 --- linux-2.6.32.49/include/net/neighbour.h 2011-11-08 19:02:43.000000000 -0500
66905 +++ linux-2.6.32.49/include/net/neighbour.h 2011-11-15 19:59:43.000000000 -0500
66906 @@ -131,7 +131,7 @@ struct neigh_ops
66907 int (*connected_output)(struct sk_buff*);
66908 int (*hh_output)(struct sk_buff*);
66909 int (*queue_xmit)(struct sk_buff*);
66910 -};
66911 +} __do_const;
66912
66913 struct pneigh_entry
66914 {
66915 diff -urNp linux-2.6.32.49/include/net/netlink.h linux-2.6.32.49/include/net/netlink.h
66916 --- linux-2.6.32.49/include/net/netlink.h 2011-11-08 19:02:43.000000000 -0500
66917 +++ linux-2.6.32.49/include/net/netlink.h 2011-11-15 19:59:43.000000000 -0500
66918 @@ -335,7 +335,7 @@ static inline int nlmsg_ok(const struct
66919 {
66920 return (remaining >= (int) sizeof(struct nlmsghdr) &&
66921 nlh->nlmsg_len >= sizeof(struct nlmsghdr) &&
66922 - nlh->nlmsg_len <= remaining);
66923 + nlh->nlmsg_len <= (unsigned int)remaining);
66924 }
66925
66926 /**
66927 @@ -558,7 +558,7 @@ static inline void *nlmsg_get_pos(struct
66928 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
66929 {
66930 if (mark)
66931 - skb_trim(skb, (unsigned char *) mark - skb->data);
66932 + skb_trim(skb, (const unsigned char *) mark - skb->data);
66933 }
66934
66935 /**
66936 diff -urNp linux-2.6.32.49/include/net/netns/ipv4.h linux-2.6.32.49/include/net/netns/ipv4.h
66937 --- linux-2.6.32.49/include/net/netns/ipv4.h 2011-11-08 19:02:43.000000000 -0500
66938 +++ linux-2.6.32.49/include/net/netns/ipv4.h 2011-11-15 19:59:43.000000000 -0500
66939 @@ -54,7 +54,7 @@ struct netns_ipv4 {
66940 int current_rt_cache_rebuild_count;
66941
66942 struct timer_list rt_secret_timer;
66943 - atomic_t rt_genid;
66944 + atomic_unchecked_t rt_genid;
66945
66946 #ifdef CONFIG_IP_MROUTE
66947 struct sock *mroute_sk;
66948 diff -urNp linux-2.6.32.49/include/net/sctp/sctp.h linux-2.6.32.49/include/net/sctp/sctp.h
66949 --- linux-2.6.32.49/include/net/sctp/sctp.h 2011-11-08 19:02:43.000000000 -0500
66950 +++ linux-2.6.32.49/include/net/sctp/sctp.h 2011-11-15 19:59:43.000000000 -0500
66951 @@ -305,8 +305,8 @@ extern int sctp_debug_flag;
66952
66953 #else /* SCTP_DEBUG */
66954
66955 -#define SCTP_DEBUG_PRINTK(whatever...)
66956 -#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
66957 +#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
66958 +#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
66959 #define SCTP_ENABLE_DEBUG
66960 #define SCTP_DISABLE_DEBUG
66961 #define SCTP_ASSERT(expr, str, func)
66962 diff -urNp linux-2.6.32.49/include/net/secure_seq.h linux-2.6.32.49/include/net/secure_seq.h
66963 --- linux-2.6.32.49/include/net/secure_seq.h 2011-11-08 19:02:43.000000000 -0500
66964 +++ linux-2.6.32.49/include/net/secure_seq.h 2011-11-15 19:59:43.000000000 -0500
66965 @@ -7,14 +7,14 @@ extern __u32 secure_ip_id(__be32 daddr);
66966 extern __u32 secure_ipv6_id(const __be32 daddr[4]);
66967 extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
66968 extern u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
66969 - __be16 dport);
66970 + __be16 dport);
66971 extern __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
66972 __be16 sport, __be16 dport);
66973 extern __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
66974 - __be16 sport, __be16 dport);
66975 + __be16 sport, __be16 dport);
66976 extern u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
66977 - __be16 sport, __be16 dport);
66978 + __be16 sport, __be16 dport);
66979 extern u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr,
66980 - __be16 sport, __be16 dport);
66981 + __be16 sport, __be16 dport);
66982
66983 #endif /* _NET_SECURE_SEQ */
66984 diff -urNp linux-2.6.32.49/include/net/sock.h linux-2.6.32.49/include/net/sock.h
66985 --- linux-2.6.32.49/include/net/sock.h 2011-11-08 19:02:43.000000000 -0500
66986 +++ linux-2.6.32.49/include/net/sock.h 2011-11-15 19:59:43.000000000 -0500
66987 @@ -272,7 +272,7 @@ struct sock {
66988 rwlock_t sk_callback_lock;
66989 int sk_err,
66990 sk_err_soft;
66991 - atomic_t sk_drops;
66992 + atomic_unchecked_t sk_drops;
66993 unsigned short sk_ack_backlog;
66994 unsigned short sk_max_ack_backlog;
66995 __u32 sk_priority;
66996 @@ -737,7 +737,7 @@ static inline void sk_refcnt_debug_relea
66997 extern void sock_prot_inuse_add(struct net *net, struct proto *prot, int inc);
66998 extern int sock_prot_inuse_get(struct net *net, struct proto *proto);
66999 #else
67000 -static void inline sock_prot_inuse_add(struct net *net, struct proto *prot,
67001 +static inline void sock_prot_inuse_add(struct net *net, struct proto *prot,
67002 int inc)
67003 {
67004 }
67005 diff -urNp linux-2.6.32.49/include/net/tcp.h linux-2.6.32.49/include/net/tcp.h
67006 --- linux-2.6.32.49/include/net/tcp.h 2011-11-08 19:02:43.000000000 -0500
67007 +++ linux-2.6.32.49/include/net/tcp.h 2011-11-15 19:59:43.000000000 -0500
67008 @@ -1444,8 +1444,8 @@ enum tcp_seq_states {
67009 struct tcp_seq_afinfo {
67010 char *name;
67011 sa_family_t family;
67012 - struct file_operations seq_fops;
67013 - struct seq_operations seq_ops;
67014 + file_operations_no_const seq_fops;
67015 + seq_operations_no_const seq_ops;
67016 };
67017
67018 struct tcp_iter_state {
67019 diff -urNp linux-2.6.32.49/include/net/udp.h linux-2.6.32.49/include/net/udp.h
67020 --- linux-2.6.32.49/include/net/udp.h 2011-11-08 19:02:43.000000000 -0500
67021 +++ linux-2.6.32.49/include/net/udp.h 2011-11-15 19:59:43.000000000 -0500
67022 @@ -187,8 +187,8 @@ struct udp_seq_afinfo {
67023 char *name;
67024 sa_family_t family;
67025 struct udp_table *udp_table;
67026 - struct file_operations seq_fops;
67027 - struct seq_operations seq_ops;
67028 + file_operations_no_const seq_fops;
67029 + seq_operations_no_const seq_ops;
67030 };
67031
67032 struct udp_iter_state {
67033 diff -urNp linux-2.6.32.49/include/rdma/iw_cm.h linux-2.6.32.49/include/rdma/iw_cm.h
67034 --- linux-2.6.32.49/include/rdma/iw_cm.h 2011-11-08 19:02:43.000000000 -0500
67035 +++ linux-2.6.32.49/include/rdma/iw_cm.h 2011-11-15 19:59:43.000000000 -0500
67036 @@ -129,7 +129,7 @@ struct iw_cm_verbs {
67037 int backlog);
67038
67039 int (*destroy_listen)(struct iw_cm_id *cm_id);
67040 -};
67041 +} __no_const;
67042
67043 /**
67044 * iw_create_cm_id - Create an IW CM identifier.
67045 diff -urNp linux-2.6.32.49/include/scsi/libfc.h linux-2.6.32.49/include/scsi/libfc.h
67046 --- linux-2.6.32.49/include/scsi/libfc.h 2011-11-08 19:02:43.000000000 -0500
67047 +++ linux-2.6.32.49/include/scsi/libfc.h 2011-11-15 19:59:43.000000000 -0500
67048 @@ -675,6 +675,7 @@ struct libfc_function_template {
67049 */
67050 void (*disc_stop_final) (struct fc_lport *);
67051 };
67052 +typedef struct libfc_function_template __no_const libfc_function_template_no_const;
67053
67054 /* information used by the discovery layer */
67055 struct fc_disc {
67056 @@ -707,7 +708,7 @@ struct fc_lport {
67057 struct fc_disc disc;
67058
67059 /* Operational Information */
67060 - struct libfc_function_template tt;
67061 + libfc_function_template_no_const tt;
67062 u8 link_up;
67063 u8 qfull;
67064 enum fc_lport_state state;
67065 diff -urNp linux-2.6.32.49/include/scsi/scsi_device.h linux-2.6.32.49/include/scsi/scsi_device.h
67066 --- linux-2.6.32.49/include/scsi/scsi_device.h 2011-11-08 19:02:43.000000000 -0500
67067 +++ linux-2.6.32.49/include/scsi/scsi_device.h 2011-11-15 19:59:43.000000000 -0500
67068 @@ -156,9 +156,9 @@ struct scsi_device {
67069 unsigned int max_device_blocked; /* what device_blocked counts down from */
67070 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
67071
67072 - atomic_t iorequest_cnt;
67073 - atomic_t iodone_cnt;
67074 - atomic_t ioerr_cnt;
67075 + atomic_unchecked_t iorequest_cnt;
67076 + atomic_unchecked_t iodone_cnt;
67077 + atomic_unchecked_t ioerr_cnt;
67078
67079 struct device sdev_gendev,
67080 sdev_dev;
67081 diff -urNp linux-2.6.32.49/include/scsi/scsi_transport_fc.h linux-2.6.32.49/include/scsi/scsi_transport_fc.h
67082 --- linux-2.6.32.49/include/scsi/scsi_transport_fc.h 2011-11-08 19:02:43.000000000 -0500
67083 +++ linux-2.6.32.49/include/scsi/scsi_transport_fc.h 2011-11-15 19:59:43.000000000 -0500
67084 @@ -708,7 +708,7 @@ struct fc_function_template {
67085 unsigned long show_host_system_hostname:1;
67086
67087 unsigned long disable_target_scan:1;
67088 -};
67089 +} __do_const;
67090
67091
67092 /**
67093 diff -urNp linux-2.6.32.49/include/sound/ac97_codec.h linux-2.6.32.49/include/sound/ac97_codec.h
67094 --- linux-2.6.32.49/include/sound/ac97_codec.h 2011-11-08 19:02:43.000000000 -0500
67095 +++ linux-2.6.32.49/include/sound/ac97_codec.h 2011-11-15 19:59:43.000000000 -0500
67096 @@ -419,15 +419,15 @@
67097 struct snd_ac97;
67098
67099 struct snd_ac97_build_ops {
67100 - int (*build_3d) (struct snd_ac97 *ac97);
67101 - int (*build_specific) (struct snd_ac97 *ac97);
67102 - int (*build_spdif) (struct snd_ac97 *ac97);
67103 - int (*build_post_spdif) (struct snd_ac97 *ac97);
67104 + int (* const build_3d) (struct snd_ac97 *ac97);
67105 + int (* const build_specific) (struct snd_ac97 *ac97);
67106 + int (* const build_spdif) (struct snd_ac97 *ac97);
67107 + int (* const build_post_spdif) (struct snd_ac97 *ac97);
67108 #ifdef CONFIG_PM
67109 - void (*suspend) (struct snd_ac97 *ac97);
67110 - void (*resume) (struct snd_ac97 *ac97);
67111 + void (* const suspend) (struct snd_ac97 *ac97);
67112 + void (* const resume) (struct snd_ac97 *ac97);
67113 #endif
67114 - void (*update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
67115 + void (* const update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
67116 };
67117
67118 struct snd_ac97_bus_ops {
67119 @@ -477,7 +477,7 @@ struct snd_ac97_template {
67120
67121 struct snd_ac97 {
67122 /* -- lowlevel (hardware) driver specific -- */
67123 - struct snd_ac97_build_ops * build_ops;
67124 + const struct snd_ac97_build_ops * build_ops;
67125 void *private_data;
67126 void (*private_free) (struct snd_ac97 *ac97);
67127 /* --- */
67128 diff -urNp linux-2.6.32.49/include/sound/ak4xxx-adda.h linux-2.6.32.49/include/sound/ak4xxx-adda.h
67129 --- linux-2.6.32.49/include/sound/ak4xxx-adda.h 2011-11-08 19:02:43.000000000 -0500
67130 +++ linux-2.6.32.49/include/sound/ak4xxx-adda.h 2011-11-15 19:59:43.000000000 -0500
67131 @@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
67132 void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
67133 unsigned char val);
67134 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
67135 -};
67136 +} __no_const;
67137
67138 #define AK4XXX_IMAGE_SIZE (AK4XXX_MAX_CHIPS * 16) /* 64 bytes */
67139
67140 diff -urNp linux-2.6.32.49/include/sound/hwdep.h linux-2.6.32.49/include/sound/hwdep.h
67141 --- linux-2.6.32.49/include/sound/hwdep.h 2011-11-08 19:02:43.000000000 -0500
67142 +++ linux-2.6.32.49/include/sound/hwdep.h 2011-11-15 19:59:43.000000000 -0500
67143 @@ -49,7 +49,7 @@ struct snd_hwdep_ops {
67144 struct snd_hwdep_dsp_status *status);
67145 int (*dsp_load)(struct snd_hwdep *hw,
67146 struct snd_hwdep_dsp_image *image);
67147 -};
67148 +} __no_const;
67149
67150 struct snd_hwdep {
67151 struct snd_card *card;
67152 diff -urNp linux-2.6.32.49/include/sound/info.h linux-2.6.32.49/include/sound/info.h
67153 --- linux-2.6.32.49/include/sound/info.h 2011-11-08 19:02:43.000000000 -0500
67154 +++ linux-2.6.32.49/include/sound/info.h 2011-11-15 19:59:43.000000000 -0500
67155 @@ -44,7 +44,7 @@ struct snd_info_entry_text {
67156 struct snd_info_buffer *buffer);
67157 void (*write)(struct snd_info_entry *entry,
67158 struct snd_info_buffer *buffer);
67159 -};
67160 +} __no_const;
67161
67162 struct snd_info_entry_ops {
67163 int (*open)(struct snd_info_entry *entry,
67164 diff -urNp linux-2.6.32.49/include/sound/pcm.h linux-2.6.32.49/include/sound/pcm.h
67165 --- linux-2.6.32.49/include/sound/pcm.h 2011-11-08 19:02:43.000000000 -0500
67166 +++ linux-2.6.32.49/include/sound/pcm.h 2011-11-15 19:59:43.000000000 -0500
67167 @@ -80,6 +80,7 @@ struct snd_pcm_ops {
67168 int (*mmap)(struct snd_pcm_substream *substream, struct vm_area_struct *vma);
67169 int (*ack)(struct snd_pcm_substream *substream);
67170 };
67171 +typedef struct snd_pcm_ops __no_const snd_pcm_ops_no_const;
67172
67173 /*
67174 *
67175 diff -urNp linux-2.6.32.49/include/sound/sb16_csp.h linux-2.6.32.49/include/sound/sb16_csp.h
67176 --- linux-2.6.32.49/include/sound/sb16_csp.h 2011-11-08 19:02:43.000000000 -0500
67177 +++ linux-2.6.32.49/include/sound/sb16_csp.h 2011-11-15 19:59:43.000000000 -0500
67178 @@ -139,7 +139,7 @@ struct snd_sb_csp_ops {
67179 int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
67180 int (*csp_stop) (struct snd_sb_csp * p);
67181 int (*csp_qsound_transfer) (struct snd_sb_csp * p);
67182 -};
67183 +} __no_const;
67184
67185 /*
67186 * CSP private data
67187 diff -urNp linux-2.6.32.49/include/sound/ymfpci.h linux-2.6.32.49/include/sound/ymfpci.h
67188 --- linux-2.6.32.49/include/sound/ymfpci.h 2011-11-08 19:02:43.000000000 -0500
67189 +++ linux-2.6.32.49/include/sound/ymfpci.h 2011-11-15 19:59:43.000000000 -0500
67190 @@ -358,7 +358,7 @@ struct snd_ymfpci {
67191 spinlock_t reg_lock;
67192 spinlock_t voice_lock;
67193 wait_queue_head_t interrupt_sleep;
67194 - atomic_t interrupt_sleep_count;
67195 + atomic_unchecked_t interrupt_sleep_count;
67196 struct snd_info_entry *proc_entry;
67197 const struct firmware *dsp_microcode;
67198 const struct firmware *controller_microcode;
67199 diff -urNp linux-2.6.32.49/include/trace/events/irq.h linux-2.6.32.49/include/trace/events/irq.h
67200 --- linux-2.6.32.49/include/trace/events/irq.h 2011-11-08 19:02:43.000000000 -0500
67201 +++ linux-2.6.32.49/include/trace/events/irq.h 2011-11-15 19:59:43.000000000 -0500
67202 @@ -34,7 +34,7 @@
67203 */
67204 TRACE_EVENT(irq_handler_entry,
67205
67206 - TP_PROTO(int irq, struct irqaction *action),
67207 + TP_PROTO(int irq, const struct irqaction *action),
67208
67209 TP_ARGS(irq, action),
67210
67211 @@ -64,7 +64,7 @@ TRACE_EVENT(irq_handler_entry,
67212 */
67213 TRACE_EVENT(irq_handler_exit,
67214
67215 - TP_PROTO(int irq, struct irqaction *action, int ret),
67216 + TP_PROTO(int irq, const struct irqaction *action, int ret),
67217
67218 TP_ARGS(irq, action, ret),
67219
67220 @@ -95,7 +95,7 @@ TRACE_EVENT(irq_handler_exit,
67221 */
67222 TRACE_EVENT(softirq_entry,
67223
67224 - TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
67225 + TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
67226
67227 TP_ARGS(h, vec),
67228
67229 @@ -124,7 +124,7 @@ TRACE_EVENT(softirq_entry,
67230 */
67231 TRACE_EVENT(softirq_exit,
67232
67233 - TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
67234 + TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
67235
67236 TP_ARGS(h, vec),
67237
67238 diff -urNp linux-2.6.32.49/include/video/uvesafb.h linux-2.6.32.49/include/video/uvesafb.h
67239 --- linux-2.6.32.49/include/video/uvesafb.h 2011-11-08 19:02:43.000000000 -0500
67240 +++ linux-2.6.32.49/include/video/uvesafb.h 2011-11-15 19:59:43.000000000 -0500
67241 @@ -177,6 +177,7 @@ struct uvesafb_par {
67242 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
67243 u8 pmi_setpal; /* PMI for palette changes */
67244 u16 *pmi_base; /* protected mode interface location */
67245 + u8 *pmi_code; /* protected mode code location */
67246 void *pmi_start;
67247 void *pmi_pal;
67248 u8 *vbe_state_orig; /*
67249 diff -urNp linux-2.6.32.49/init/do_mounts.c linux-2.6.32.49/init/do_mounts.c
67250 --- linux-2.6.32.49/init/do_mounts.c 2011-11-08 19:02:43.000000000 -0500
67251 +++ linux-2.6.32.49/init/do_mounts.c 2011-11-15 19:59:43.000000000 -0500
67252 @@ -216,11 +216,11 @@ static void __init get_fs_names(char *pa
67253
67254 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
67255 {
67256 - int err = sys_mount(name, "/root", fs, flags, data);
67257 + int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
67258 if (err)
67259 return err;
67260
67261 - sys_chdir("/root");
67262 + sys_chdir((__force const char __user *)"/root");
67263 ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
67264 printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
67265 current->fs->pwd.mnt->mnt_sb->s_type->name,
67266 @@ -311,18 +311,18 @@ void __init change_floppy(char *fmt, ...
67267 va_start(args, fmt);
67268 vsprintf(buf, fmt, args);
67269 va_end(args);
67270 - fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
67271 + fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
67272 if (fd >= 0) {
67273 sys_ioctl(fd, FDEJECT, 0);
67274 sys_close(fd);
67275 }
67276 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
67277 - fd = sys_open("/dev/console", O_RDWR, 0);
67278 + fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
67279 if (fd >= 0) {
67280 sys_ioctl(fd, TCGETS, (long)&termios);
67281 termios.c_lflag &= ~ICANON;
67282 sys_ioctl(fd, TCSETSF, (long)&termios);
67283 - sys_read(fd, &c, 1);
67284 + sys_read(fd, (char __user *)&c, 1);
67285 termios.c_lflag |= ICANON;
67286 sys_ioctl(fd, TCSETSF, (long)&termios);
67287 sys_close(fd);
67288 @@ -416,6 +416,6 @@ void __init prepare_namespace(void)
67289 mount_root();
67290 out:
67291 devtmpfs_mount("dev");
67292 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
67293 - sys_chroot(".");
67294 + sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
67295 + sys_chroot((__force char __user *)".");
67296 }
67297 diff -urNp linux-2.6.32.49/init/do_mounts.h linux-2.6.32.49/init/do_mounts.h
67298 --- linux-2.6.32.49/init/do_mounts.h 2011-11-08 19:02:43.000000000 -0500
67299 +++ linux-2.6.32.49/init/do_mounts.h 2011-11-15 19:59:43.000000000 -0500
67300 @@ -15,15 +15,15 @@ extern int root_mountflags;
67301
67302 static inline int create_dev(char *name, dev_t dev)
67303 {
67304 - sys_unlink(name);
67305 - return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
67306 + sys_unlink((char __force_user *)name);
67307 + return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev));
67308 }
67309
67310 #if BITS_PER_LONG == 32
67311 static inline u32 bstat(char *name)
67312 {
67313 struct stat64 stat;
67314 - if (sys_stat64(name, &stat) != 0)
67315 + if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0)
67316 return 0;
67317 if (!S_ISBLK(stat.st_mode))
67318 return 0;
67319 @@ -35,7 +35,7 @@ static inline u32 bstat(char *name)
67320 static inline u32 bstat(char *name)
67321 {
67322 struct stat stat;
67323 - if (sys_newstat(name, &stat) != 0)
67324 + if (sys_newstat((const char __force_user *)name, (struct stat __force_user *)&stat) != 0)
67325 return 0;
67326 if (!S_ISBLK(stat.st_mode))
67327 return 0;
67328 diff -urNp linux-2.6.32.49/init/do_mounts_initrd.c linux-2.6.32.49/init/do_mounts_initrd.c
67329 --- linux-2.6.32.49/init/do_mounts_initrd.c 2011-11-08 19:02:43.000000000 -0500
67330 +++ linux-2.6.32.49/init/do_mounts_initrd.c 2011-11-15 19:59:43.000000000 -0500
67331 @@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shel
67332 sys_close(old_fd);sys_close(root_fd);
67333 sys_close(0);sys_close(1);sys_close(2);
67334 sys_setsid();
67335 - (void) sys_open("/dev/console",O_RDWR,0);
67336 + (void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
67337 (void) sys_dup(0);
67338 (void) sys_dup(0);
67339 return kernel_execve(shell, argv, envp_init);
67340 @@ -47,13 +47,13 @@ static void __init handle_initrd(void)
67341 create_dev("/dev/root.old", Root_RAM0);
67342 /* mount initrd on rootfs' /root */
67343 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
67344 - sys_mkdir("/old", 0700);
67345 - root_fd = sys_open("/", 0, 0);
67346 - old_fd = sys_open("/old", 0, 0);
67347 + sys_mkdir((const char __force_user *)"/old", 0700);
67348 + root_fd = sys_open((const char __force_user *)"/", 0, 0);
67349 + old_fd = sys_open((const char __force_user *)"/old", 0, 0);
67350 /* move initrd over / and chdir/chroot in initrd root */
67351 - sys_chdir("/root");
67352 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
67353 - sys_chroot(".");
67354 + sys_chdir((const char __force_user *)"/root");
67355 + sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
67356 + sys_chroot((const char __force_user *)".");
67357
67358 /*
67359 * In case that a resume from disk is carried out by linuxrc or one of
67360 @@ -70,15 +70,15 @@ static void __init handle_initrd(void)
67361
67362 /* move initrd to rootfs' /old */
67363 sys_fchdir(old_fd);
67364 - sys_mount("/", ".", NULL, MS_MOVE, NULL);
67365 + sys_mount((char __force_user *)"/", (char __force_user *)".", NULL, MS_MOVE, NULL);
67366 /* switch root and cwd back to / of rootfs */
67367 sys_fchdir(root_fd);
67368 - sys_chroot(".");
67369 + sys_chroot((const char __force_user *)".");
67370 sys_close(old_fd);
67371 sys_close(root_fd);
67372
67373 if (new_decode_dev(real_root_dev) == Root_RAM0) {
67374 - sys_chdir("/old");
67375 + sys_chdir((const char __force_user *)"/old");
67376 return;
67377 }
67378
67379 @@ -86,17 +86,17 @@ static void __init handle_initrd(void)
67380 mount_root();
67381
67382 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
67383 - error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
67384 + error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL);
67385 if (!error)
67386 printk("okay\n");
67387 else {
67388 - int fd = sys_open("/dev/root.old", O_RDWR, 0);
67389 + int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0);
67390 if (error == -ENOENT)
67391 printk("/initrd does not exist. Ignored.\n");
67392 else
67393 printk("failed\n");
67394 printk(KERN_NOTICE "Unmounting old root\n");
67395 - sys_umount("/old", MNT_DETACH);
67396 + sys_umount((char __force_user *)"/old", MNT_DETACH);
67397 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
67398 if (fd < 0) {
67399 error = fd;
67400 @@ -119,11 +119,11 @@ int __init initrd_load(void)
67401 * mounted in the normal path.
67402 */
67403 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
67404 - sys_unlink("/initrd.image");
67405 + sys_unlink((const char __force_user *)"/initrd.image");
67406 handle_initrd();
67407 return 1;
67408 }
67409 }
67410 - sys_unlink("/initrd.image");
67411 + sys_unlink((const char __force_user *)"/initrd.image");
67412 return 0;
67413 }
67414 diff -urNp linux-2.6.32.49/init/do_mounts_md.c linux-2.6.32.49/init/do_mounts_md.c
67415 --- linux-2.6.32.49/init/do_mounts_md.c 2011-11-08 19:02:43.000000000 -0500
67416 +++ linux-2.6.32.49/init/do_mounts_md.c 2011-11-15 19:59:43.000000000 -0500
67417 @@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
67418 partitioned ? "_d" : "", minor,
67419 md_setup_args[ent].device_names);
67420
67421 - fd = sys_open(name, 0, 0);
67422 + fd = sys_open((char __force_user *)name, 0, 0);
67423 if (fd < 0) {
67424 printk(KERN_ERR "md: open failed - cannot start "
67425 "array %s\n", name);
67426 @@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
67427 * array without it
67428 */
67429 sys_close(fd);
67430 - fd = sys_open(name, 0, 0);
67431 + fd = sys_open((char __force_user *)name, 0, 0);
67432 sys_ioctl(fd, BLKRRPART, 0);
67433 }
67434 sys_close(fd);
67435 @@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
67436
67437 wait_for_device_probe();
67438
67439 - fd = sys_open("/dev/md0", 0, 0);
67440 + fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
67441 if (fd >= 0) {
67442 sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
67443 sys_close(fd);
67444 diff -urNp linux-2.6.32.49/init/initramfs.c linux-2.6.32.49/init/initramfs.c
67445 --- linux-2.6.32.49/init/initramfs.c 2011-11-08 19:02:43.000000000 -0500
67446 +++ linux-2.6.32.49/init/initramfs.c 2011-11-15 19:59:43.000000000 -0500
67447 @@ -74,7 +74,7 @@ static void __init free_hash(void)
67448 }
67449 }
67450
67451 -static long __init do_utime(char __user *filename, time_t mtime)
67452 +static long __init do_utime(__force char __user *filename, time_t mtime)
67453 {
67454 struct timespec t[2];
67455
67456 @@ -109,7 +109,7 @@ static void __init dir_utime(void)
67457 struct dir_entry *de, *tmp;
67458 list_for_each_entry_safe(de, tmp, &dir_list, list) {
67459 list_del(&de->list);
67460 - do_utime(de->name, de->mtime);
67461 + do_utime((char __force_user *)de->name, de->mtime);
67462 kfree(de->name);
67463 kfree(de);
67464 }
67465 @@ -271,7 +271,7 @@ static int __init maybe_link(void)
67466 if (nlink >= 2) {
67467 char *old = find_link(major, minor, ino, mode, collected);
67468 if (old)
67469 - return (sys_link(old, collected) < 0) ? -1 : 1;
67470 + return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1;
67471 }
67472 return 0;
67473 }
67474 @@ -280,11 +280,11 @@ static void __init clean_path(char *path
67475 {
67476 struct stat st;
67477
67478 - if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
67479 + if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) {
67480 if (S_ISDIR(st.st_mode))
67481 - sys_rmdir(path);
67482 + sys_rmdir((char __force_user *)path);
67483 else
67484 - sys_unlink(path);
67485 + sys_unlink((char __force_user *)path);
67486 }
67487 }
67488
67489 @@ -305,7 +305,7 @@ static int __init do_name(void)
67490 int openflags = O_WRONLY|O_CREAT;
67491 if (ml != 1)
67492 openflags |= O_TRUNC;
67493 - wfd = sys_open(collected, openflags, mode);
67494 + wfd = sys_open((char __force_user *)collected, openflags, mode);
67495
67496 if (wfd >= 0) {
67497 sys_fchown(wfd, uid, gid);
67498 @@ -317,17 +317,17 @@ static int __init do_name(void)
67499 }
67500 }
67501 } else if (S_ISDIR(mode)) {
67502 - sys_mkdir(collected, mode);
67503 - sys_chown(collected, uid, gid);
67504 - sys_chmod(collected, mode);
67505 + sys_mkdir((char __force_user *)collected, mode);
67506 + sys_chown((char __force_user *)collected, uid, gid);
67507 + sys_chmod((char __force_user *)collected, mode);
67508 dir_add(collected, mtime);
67509 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
67510 S_ISFIFO(mode) || S_ISSOCK(mode)) {
67511 if (maybe_link() == 0) {
67512 - sys_mknod(collected, mode, rdev);
67513 - sys_chown(collected, uid, gid);
67514 - sys_chmod(collected, mode);
67515 - do_utime(collected, mtime);
67516 + sys_mknod((char __force_user *)collected, mode, rdev);
67517 + sys_chown((char __force_user *)collected, uid, gid);
67518 + sys_chmod((char __force_user *)collected, mode);
67519 + do_utime((char __force_user *)collected, mtime);
67520 }
67521 }
67522 return 0;
67523 @@ -336,15 +336,15 @@ static int __init do_name(void)
67524 static int __init do_copy(void)
67525 {
67526 if (count >= body_len) {
67527 - sys_write(wfd, victim, body_len);
67528 + sys_write(wfd, (char __force_user *)victim, body_len);
67529 sys_close(wfd);
67530 - do_utime(vcollected, mtime);
67531 + do_utime((char __force_user *)vcollected, mtime);
67532 kfree(vcollected);
67533 eat(body_len);
67534 state = SkipIt;
67535 return 0;
67536 } else {
67537 - sys_write(wfd, victim, count);
67538 + sys_write(wfd, (char __force_user *)victim, count);
67539 body_len -= count;
67540 eat(count);
67541 return 1;
67542 @@ -355,9 +355,9 @@ static int __init do_symlink(void)
67543 {
67544 collected[N_ALIGN(name_len) + body_len] = '\0';
67545 clean_path(collected, 0);
67546 - sys_symlink(collected + N_ALIGN(name_len), collected);
67547 - sys_lchown(collected, uid, gid);
67548 - do_utime(collected, mtime);
67549 + sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected);
67550 + sys_lchown((char __force_user *)collected, uid, gid);
67551 + do_utime((char __force_user *)collected, mtime);
67552 state = SkipIt;
67553 next_state = Reset;
67554 return 0;
67555 diff -urNp linux-2.6.32.49/init/Kconfig linux-2.6.32.49/init/Kconfig
67556 --- linux-2.6.32.49/init/Kconfig 2011-11-08 19:02:43.000000000 -0500
67557 +++ linux-2.6.32.49/init/Kconfig 2011-11-15 19:59:43.000000000 -0500
67558 @@ -1004,7 +1004,7 @@ config SLUB_DEBUG
67559
67560 config COMPAT_BRK
67561 bool "Disable heap randomization"
67562 - default y
67563 + default n
67564 help
67565 Randomizing heap placement makes heap exploits harder, but it
67566 also breaks ancient binaries (including anything libc5 based).
67567 diff -urNp linux-2.6.32.49/init/main.c linux-2.6.32.49/init/main.c
67568 --- linux-2.6.32.49/init/main.c 2011-11-08 19:02:43.000000000 -0500
67569 +++ linux-2.6.32.49/init/main.c 2011-11-15 19:59:43.000000000 -0500
67570 @@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void)
67571 #ifdef CONFIG_TC
67572 extern void tc_init(void);
67573 #endif
67574 +extern void grsecurity_init(void);
67575
67576 enum system_states system_state __read_mostly;
67577 EXPORT_SYMBOL(system_state);
67578 @@ -183,6 +184,49 @@ static int __init set_reset_devices(char
67579
67580 __setup("reset_devices", set_reset_devices);
67581
67582 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
67583 +extern char pax_enter_kernel_user[];
67584 +extern char pax_exit_kernel_user[];
67585 +extern pgdval_t clone_pgd_mask;
67586 +#endif
67587 +
67588 +#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
67589 +static int __init setup_pax_nouderef(char *str)
67590 +{
67591 +#ifdef CONFIG_X86_32
67592 + unsigned int cpu;
67593 + struct desc_struct *gdt;
67594 +
67595 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
67596 + gdt = get_cpu_gdt_table(cpu);
67597 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
67598 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
67599 + gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
67600 + gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
67601 + }
67602 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
67603 +#else
67604 + memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
67605 + memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
67606 + clone_pgd_mask = ~(pgdval_t)0UL;
67607 +#endif
67608 +
67609 + return 0;
67610 +}
67611 +early_param("pax_nouderef", setup_pax_nouderef);
67612 +#endif
67613 +
67614 +#ifdef CONFIG_PAX_SOFTMODE
67615 +int pax_softmode;
67616 +
67617 +static int __init setup_pax_softmode(char *str)
67618 +{
67619 + get_option(&str, &pax_softmode);
67620 + return 1;
67621 +}
67622 +__setup("pax_softmode=", setup_pax_softmode);
67623 +#endif
67624 +
67625 static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
67626 char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
67627 static const char *panic_later, *panic_param;
67628 @@ -705,52 +749,53 @@ int initcall_debug;
67629 core_param(initcall_debug, initcall_debug, bool, 0644);
67630
67631 static char msgbuf[64];
67632 -static struct boot_trace_call call;
67633 -static struct boot_trace_ret ret;
67634 +static struct boot_trace_call trace_call;
67635 +static struct boot_trace_ret trace_ret;
67636
67637 int do_one_initcall(initcall_t fn)
67638 {
67639 int count = preempt_count();
67640 ktime_t calltime, delta, rettime;
67641 + const char *msg1 = "", *msg2 = "";
67642
67643 if (initcall_debug) {
67644 - call.caller = task_pid_nr(current);
67645 - printk("calling %pF @ %i\n", fn, call.caller);
67646 + trace_call.caller = task_pid_nr(current);
67647 + printk("calling %pF @ %i\n", fn, trace_call.caller);
67648 calltime = ktime_get();
67649 - trace_boot_call(&call, fn);
67650 + trace_boot_call(&trace_call, fn);
67651 enable_boot_trace();
67652 }
67653
67654 - ret.result = fn();
67655 + trace_ret.result = fn();
67656
67657 if (initcall_debug) {
67658 disable_boot_trace();
67659 rettime = ktime_get();
67660 delta = ktime_sub(rettime, calltime);
67661 - ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
67662 - trace_boot_ret(&ret, fn);
67663 + trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
67664 + trace_boot_ret(&trace_ret, fn);
67665 printk("initcall %pF returned %d after %Ld usecs\n", fn,
67666 - ret.result, ret.duration);
67667 + trace_ret.result, trace_ret.duration);
67668 }
67669
67670 msgbuf[0] = 0;
67671
67672 - if (ret.result && ret.result != -ENODEV && initcall_debug)
67673 - sprintf(msgbuf, "error code %d ", ret.result);
67674 + if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
67675 + sprintf(msgbuf, "error code %d ", trace_ret.result);
67676
67677 if (preempt_count() != count) {
67678 - strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
67679 + msg1 = " preemption imbalance";
67680 preempt_count() = count;
67681 }
67682 if (irqs_disabled()) {
67683 - strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
67684 + msg2 = " disabled interrupts";
67685 local_irq_enable();
67686 }
67687 - if (msgbuf[0]) {
67688 - printk("initcall %pF returned with %s\n", fn, msgbuf);
67689 + if (msgbuf[0] || *msg1 || *msg2) {
67690 + printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
67691 }
67692
67693 - return ret.result;
67694 + return trace_ret.result;
67695 }
67696
67697
67698 @@ -893,11 +938,13 @@ static int __init kernel_init(void * unu
67699 if (!ramdisk_execute_command)
67700 ramdisk_execute_command = "/init";
67701
67702 - if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
67703 + if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) {
67704 ramdisk_execute_command = NULL;
67705 prepare_namespace();
67706 }
67707
67708 + grsecurity_init();
67709 +
67710 /*
67711 * Ok, we have completed the initial bootup, and
67712 * we're essentially up and running. Get rid of the
67713 diff -urNp linux-2.6.32.49/init/noinitramfs.c linux-2.6.32.49/init/noinitramfs.c
67714 --- linux-2.6.32.49/init/noinitramfs.c 2011-11-08 19:02:43.000000000 -0500
67715 +++ linux-2.6.32.49/init/noinitramfs.c 2011-11-15 19:59:43.000000000 -0500
67716 @@ -29,7 +29,7 @@ static int __init default_rootfs(void)
67717 {
67718 int err;
67719
67720 - err = sys_mkdir("/dev", 0755);
67721 + err = sys_mkdir((const char __user *)"/dev", 0755);
67722 if (err < 0)
67723 goto out;
67724
67725 @@ -39,7 +39,7 @@ static int __init default_rootfs(void)
67726 if (err < 0)
67727 goto out;
67728
67729 - err = sys_mkdir("/root", 0700);
67730 + err = sys_mkdir((const char __user *)"/root", 0700);
67731 if (err < 0)
67732 goto out;
67733
67734 diff -urNp linux-2.6.32.49/ipc/mqueue.c linux-2.6.32.49/ipc/mqueue.c
67735 --- linux-2.6.32.49/ipc/mqueue.c 2011-11-08 19:02:43.000000000 -0500
67736 +++ linux-2.6.32.49/ipc/mqueue.c 2011-11-15 19:59:43.000000000 -0500
67737 @@ -150,6 +150,7 @@ static struct inode *mqueue_get_inode(st
67738 mq_bytes = (mq_msg_tblsz +
67739 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
67740
67741 + gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
67742 spin_lock(&mq_lock);
67743 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
67744 u->mq_bytes + mq_bytes >
67745 diff -urNp linux-2.6.32.49/ipc/msg.c linux-2.6.32.49/ipc/msg.c
67746 --- linux-2.6.32.49/ipc/msg.c 2011-11-08 19:02:43.000000000 -0500
67747 +++ linux-2.6.32.49/ipc/msg.c 2011-11-15 19:59:43.000000000 -0500
67748 @@ -310,18 +310,19 @@ static inline int msg_security(struct ke
67749 return security_msg_queue_associate(msq, msgflg);
67750 }
67751
67752 +static struct ipc_ops msg_ops = {
67753 + .getnew = newque,
67754 + .associate = msg_security,
67755 + .more_checks = NULL
67756 +};
67757 +
67758 SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
67759 {
67760 struct ipc_namespace *ns;
67761 - struct ipc_ops msg_ops;
67762 struct ipc_params msg_params;
67763
67764 ns = current->nsproxy->ipc_ns;
67765
67766 - msg_ops.getnew = newque;
67767 - msg_ops.associate = msg_security;
67768 - msg_ops.more_checks = NULL;
67769 -
67770 msg_params.key = key;
67771 msg_params.flg = msgflg;
67772
67773 diff -urNp linux-2.6.32.49/ipc/sem.c linux-2.6.32.49/ipc/sem.c
67774 --- linux-2.6.32.49/ipc/sem.c 2011-11-08 19:02:43.000000000 -0500
67775 +++ linux-2.6.32.49/ipc/sem.c 2011-11-15 19:59:43.000000000 -0500
67776 @@ -309,10 +309,15 @@ static inline int sem_more_checks(struct
67777 return 0;
67778 }
67779
67780 +static struct ipc_ops sem_ops = {
67781 + .getnew = newary,
67782 + .associate = sem_security,
67783 + .more_checks = sem_more_checks
67784 +};
67785 +
67786 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
67787 {
67788 struct ipc_namespace *ns;
67789 - struct ipc_ops sem_ops;
67790 struct ipc_params sem_params;
67791
67792 ns = current->nsproxy->ipc_ns;
67793 @@ -320,10 +325,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int,
67794 if (nsems < 0 || nsems > ns->sc_semmsl)
67795 return -EINVAL;
67796
67797 - sem_ops.getnew = newary;
67798 - sem_ops.associate = sem_security;
67799 - sem_ops.more_checks = sem_more_checks;
67800 -
67801 sem_params.key = key;
67802 sem_params.flg = semflg;
67803 sem_params.u.nsems = nsems;
67804 @@ -671,6 +672,8 @@ static int semctl_main(struct ipc_namesp
67805 ushort* sem_io = fast_sem_io;
67806 int nsems;
67807
67808 + pax_track_stack();
67809 +
67810 sma = sem_lock_check(ns, semid);
67811 if (IS_ERR(sma))
67812 return PTR_ERR(sma);
67813 @@ -1071,6 +1074,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid,
67814 unsigned long jiffies_left = 0;
67815 struct ipc_namespace *ns;
67816
67817 + pax_track_stack();
67818 +
67819 ns = current->nsproxy->ipc_ns;
67820
67821 if (nsops < 1 || semid < 0)
67822 diff -urNp linux-2.6.32.49/ipc/shm.c linux-2.6.32.49/ipc/shm.c
67823 --- linux-2.6.32.49/ipc/shm.c 2011-11-08 19:02:43.000000000 -0500
67824 +++ linux-2.6.32.49/ipc/shm.c 2011-11-15 19:59:43.000000000 -0500
67825 @@ -70,6 +70,14 @@ static void shm_destroy (struct ipc_name
67826 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
67827 #endif
67828
67829 +#ifdef CONFIG_GRKERNSEC
67830 +extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
67831 + const time_t shm_createtime, const uid_t cuid,
67832 + const int shmid);
67833 +extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
67834 + const time_t shm_createtime);
67835 +#endif
67836 +
67837 void shm_init_ns(struct ipc_namespace *ns)
67838 {
67839 ns->shm_ctlmax = SHMMAX;
67840 @@ -396,6 +404,14 @@ static int newseg(struct ipc_namespace *
67841 shp->shm_lprid = 0;
67842 shp->shm_atim = shp->shm_dtim = 0;
67843 shp->shm_ctim = get_seconds();
67844 +#ifdef CONFIG_GRKERNSEC
67845 + {
67846 + struct timespec timeval;
67847 + do_posix_clock_monotonic_gettime(&timeval);
67848 +
67849 + shp->shm_createtime = timeval.tv_sec;
67850 + }
67851 +#endif
67852 shp->shm_segsz = size;
67853 shp->shm_nattch = 0;
67854 shp->shm_file = file;
67855 @@ -446,18 +462,19 @@ static inline int shm_more_checks(struct
67856 return 0;
67857 }
67858
67859 +static struct ipc_ops shm_ops = {
67860 + .getnew = newseg,
67861 + .associate = shm_security,
67862 + .more_checks = shm_more_checks
67863 +};
67864 +
67865 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
67866 {
67867 struct ipc_namespace *ns;
67868 - struct ipc_ops shm_ops;
67869 struct ipc_params shm_params;
67870
67871 ns = current->nsproxy->ipc_ns;
67872
67873 - shm_ops.getnew = newseg;
67874 - shm_ops.associate = shm_security;
67875 - shm_ops.more_checks = shm_more_checks;
67876 -
67877 shm_params.key = key;
67878 shm_params.flg = shmflg;
67879 shm_params.u.size = size;
67880 @@ -880,9 +897,21 @@ long do_shmat(int shmid, char __user *sh
67881 if (err)
67882 goto out_unlock;
67883
67884 +#ifdef CONFIG_GRKERNSEC
67885 + if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
67886 + shp->shm_perm.cuid, shmid) ||
67887 + !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
67888 + err = -EACCES;
67889 + goto out_unlock;
67890 + }
67891 +#endif
67892 +
67893 path.dentry = dget(shp->shm_file->f_path.dentry);
67894 path.mnt = shp->shm_file->f_path.mnt;
67895 shp->shm_nattch++;
67896 +#ifdef CONFIG_GRKERNSEC
67897 + shp->shm_lapid = current->pid;
67898 +#endif
67899 size = i_size_read(path.dentry->d_inode);
67900 shm_unlock(shp);
67901
67902 diff -urNp linux-2.6.32.49/kernel/acct.c linux-2.6.32.49/kernel/acct.c
67903 --- linux-2.6.32.49/kernel/acct.c 2011-11-08 19:02:43.000000000 -0500
67904 +++ linux-2.6.32.49/kernel/acct.c 2011-11-15 19:59:43.000000000 -0500
67905 @@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_a
67906 */
67907 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
67908 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
67909 - file->f_op->write(file, (char *)&ac,
67910 + file->f_op->write(file, (char __force_user *)&ac,
67911 sizeof(acct_t), &file->f_pos);
67912 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
67913 set_fs(fs);
67914 diff -urNp linux-2.6.32.49/kernel/audit.c linux-2.6.32.49/kernel/audit.c
67915 --- linux-2.6.32.49/kernel/audit.c 2011-11-08 19:02:43.000000000 -0500
67916 +++ linux-2.6.32.49/kernel/audit.c 2011-11-15 19:59:43.000000000 -0500
67917 @@ -110,7 +110,7 @@ u32 audit_sig_sid = 0;
67918 3) suppressed due to audit_rate_limit
67919 4) suppressed due to audit_backlog_limit
67920 */
67921 -static atomic_t audit_lost = ATOMIC_INIT(0);
67922 +static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
67923
67924 /* The netlink socket. */
67925 static struct sock *audit_sock;
67926 @@ -232,7 +232,7 @@ void audit_log_lost(const char *message)
67927 unsigned long now;
67928 int print;
67929
67930 - atomic_inc(&audit_lost);
67931 + atomic_inc_unchecked(&audit_lost);
67932
67933 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
67934
67935 @@ -251,7 +251,7 @@ void audit_log_lost(const char *message)
67936 printk(KERN_WARNING
67937 "audit: audit_lost=%d audit_rate_limit=%d "
67938 "audit_backlog_limit=%d\n",
67939 - atomic_read(&audit_lost),
67940 + atomic_read_unchecked(&audit_lost),
67941 audit_rate_limit,
67942 audit_backlog_limit);
67943 audit_panic(message);
67944 @@ -691,7 +691,7 @@ static int audit_receive_msg(struct sk_b
67945 status_set.pid = audit_pid;
67946 status_set.rate_limit = audit_rate_limit;
67947 status_set.backlog_limit = audit_backlog_limit;
67948 - status_set.lost = atomic_read(&audit_lost);
67949 + status_set.lost = atomic_read_unchecked(&audit_lost);
67950 status_set.backlog = skb_queue_len(&audit_skb_queue);
67951 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
67952 &status_set, sizeof(status_set));
67953 @@ -891,8 +891,10 @@ static int audit_receive_msg(struct sk_b
67954 spin_unlock_irq(&tsk->sighand->siglock);
67955 }
67956 read_unlock(&tasklist_lock);
67957 - audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
67958 - &s, sizeof(s));
67959 +
67960 + if (!err)
67961 + audit_send_reply(NETLINK_CB(skb).pid, seq,
67962 + AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
67963 break;
67964 }
67965 case AUDIT_TTY_SET: {
67966 diff -urNp linux-2.6.32.49/kernel/auditsc.c linux-2.6.32.49/kernel/auditsc.c
67967 --- linux-2.6.32.49/kernel/auditsc.c 2011-11-08 19:02:43.000000000 -0500
67968 +++ linux-2.6.32.49/kernel/auditsc.c 2011-11-15 19:59:43.000000000 -0500
67969 @@ -2113,7 +2113,7 @@ int auditsc_get_stamp(struct audit_conte
67970 }
67971
67972 /* global counter which is incremented every time something logs in */
67973 -static atomic_t session_id = ATOMIC_INIT(0);
67974 +static atomic_unchecked_t session_id = ATOMIC_INIT(0);
67975
67976 /**
67977 * audit_set_loginuid - set a task's audit_context loginuid
67978 @@ -2126,7 +2126,7 @@ static atomic_t session_id = ATOMIC_INIT
67979 */
67980 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
67981 {
67982 - unsigned int sessionid = atomic_inc_return(&session_id);
67983 + unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
67984 struct audit_context *context = task->audit_context;
67985
67986 if (context && context->in_syscall) {
67987 diff -urNp linux-2.6.32.49/kernel/capability.c linux-2.6.32.49/kernel/capability.c
67988 --- linux-2.6.32.49/kernel/capability.c 2011-11-08 19:02:43.000000000 -0500
67989 +++ linux-2.6.32.49/kernel/capability.c 2011-11-15 19:59:43.000000000 -0500
67990 @@ -305,10 +305,26 @@ int capable(int cap)
67991 BUG();
67992 }
67993
67994 - if (security_capable(cap) == 0) {
67995 + if (security_capable(cap) == 0 && gr_is_capable(cap)) {
67996 current->flags |= PF_SUPERPRIV;
67997 return 1;
67998 }
67999 return 0;
68000 }
68001 +
68002 +int capable_nolog(int cap)
68003 +{
68004 + if (unlikely(!cap_valid(cap))) {
68005 + printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
68006 + BUG();
68007 + }
68008 +
68009 + if (security_capable(cap) == 0 && gr_is_capable_nolog(cap)) {
68010 + current->flags |= PF_SUPERPRIV;
68011 + return 1;
68012 + }
68013 + return 0;
68014 +}
68015 +
68016 EXPORT_SYMBOL(capable);
68017 +EXPORT_SYMBOL(capable_nolog);
68018 diff -urNp linux-2.6.32.49/kernel/cgroup.c linux-2.6.32.49/kernel/cgroup.c
68019 --- linux-2.6.32.49/kernel/cgroup.c 2011-11-08 19:02:43.000000000 -0500
68020 +++ linux-2.6.32.49/kernel/cgroup.c 2011-11-15 19:59:43.000000000 -0500
68021 @@ -536,6 +536,8 @@ static struct css_set *find_css_set(
68022 struct hlist_head *hhead;
68023 struct cg_cgroup_link *link;
68024
68025 + pax_track_stack();
68026 +
68027 /* First see if we already have a cgroup group that matches
68028 * the desired set */
68029 read_lock(&css_set_lock);
68030 diff -urNp linux-2.6.32.49/kernel/compat.c linux-2.6.32.49/kernel/compat.c
68031 --- linux-2.6.32.49/kernel/compat.c 2011-11-08 19:02:43.000000000 -0500
68032 +++ linux-2.6.32.49/kernel/compat.c 2011-11-15 19:59:43.000000000 -0500
68033 @@ -108,7 +108,7 @@ static long compat_nanosleep_restart(str
68034 mm_segment_t oldfs;
68035 long ret;
68036
68037 - restart->nanosleep.rmtp = (struct timespec __user *) &rmt;
68038 + restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt;
68039 oldfs = get_fs();
68040 set_fs(KERNEL_DS);
68041 ret = hrtimer_nanosleep_restart(restart);
68042 @@ -140,7 +140,7 @@ asmlinkage long compat_sys_nanosleep(str
68043 oldfs = get_fs();
68044 set_fs(KERNEL_DS);
68045 ret = hrtimer_nanosleep(&tu,
68046 - rmtp ? (struct timespec __user *)&rmt : NULL,
68047 + rmtp ? (struct timespec __force_user *)&rmt : NULL,
68048 HRTIMER_MODE_REL, CLOCK_MONOTONIC);
68049 set_fs(oldfs);
68050
68051 @@ -247,7 +247,7 @@ asmlinkage long compat_sys_sigpending(co
68052 mm_segment_t old_fs = get_fs();
68053
68054 set_fs(KERNEL_DS);
68055 - ret = sys_sigpending((old_sigset_t __user *) &s);
68056 + ret = sys_sigpending((old_sigset_t __force_user *) &s);
68057 set_fs(old_fs);
68058 if (ret == 0)
68059 ret = put_user(s, set);
68060 @@ -266,8 +266,8 @@ asmlinkage long compat_sys_sigprocmask(i
68061 old_fs = get_fs();
68062 set_fs(KERNEL_DS);
68063 ret = sys_sigprocmask(how,
68064 - set ? (old_sigset_t __user *) &s : NULL,
68065 - oset ? (old_sigset_t __user *) &s : NULL);
68066 + set ? (old_sigset_t __force_user *) &s : NULL,
68067 + oset ? (old_sigset_t __force_user *) &s : NULL);
68068 set_fs(old_fs);
68069 if (ret == 0)
68070 if (oset)
68071 @@ -310,7 +310,7 @@ asmlinkage long compat_sys_old_getrlimit
68072 mm_segment_t old_fs = get_fs();
68073
68074 set_fs(KERNEL_DS);
68075 - ret = sys_old_getrlimit(resource, &r);
68076 + ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r);
68077 set_fs(old_fs);
68078
68079 if (!ret) {
68080 @@ -385,7 +385,7 @@ asmlinkage long compat_sys_getrusage(int
68081 mm_segment_t old_fs = get_fs();
68082
68083 set_fs(KERNEL_DS);
68084 - ret = sys_getrusage(who, (struct rusage __user *) &r);
68085 + ret = sys_getrusage(who, (struct rusage __force_user *) &r);
68086 set_fs(old_fs);
68087
68088 if (ret)
68089 @@ -412,8 +412,8 @@ compat_sys_wait4(compat_pid_t pid, compa
68090 set_fs (KERNEL_DS);
68091 ret = sys_wait4(pid,
68092 (stat_addr ?
68093 - (unsigned int __user *) &status : NULL),
68094 - options, (struct rusage __user *) &r);
68095 + (unsigned int __force_user *) &status : NULL),
68096 + options, (struct rusage __force_user *) &r);
68097 set_fs (old_fs);
68098
68099 if (ret > 0) {
68100 @@ -438,8 +438,8 @@ asmlinkage long compat_sys_waitid(int wh
68101 memset(&info, 0, sizeof(info));
68102
68103 set_fs(KERNEL_DS);
68104 - ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options,
68105 - uru ? (struct rusage __user *)&ru : NULL);
68106 + ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options,
68107 + uru ? (struct rusage __force_user *)&ru : NULL);
68108 set_fs(old_fs);
68109
68110 if ((ret < 0) || (info.si_signo == 0))
68111 @@ -569,8 +569,8 @@ long compat_sys_timer_settime(timer_t ti
68112 oldfs = get_fs();
68113 set_fs(KERNEL_DS);
68114 err = sys_timer_settime(timer_id, flags,
68115 - (struct itimerspec __user *) &newts,
68116 - (struct itimerspec __user *) &oldts);
68117 + (struct itimerspec __force_user *) &newts,
68118 + (struct itimerspec __force_user *) &oldts);
68119 set_fs(oldfs);
68120 if (!err && old && put_compat_itimerspec(old, &oldts))
68121 return -EFAULT;
68122 @@ -587,7 +587,7 @@ long compat_sys_timer_gettime(timer_t ti
68123 oldfs = get_fs();
68124 set_fs(KERNEL_DS);
68125 err = sys_timer_gettime(timer_id,
68126 - (struct itimerspec __user *) &ts);
68127 + (struct itimerspec __force_user *) &ts);
68128 set_fs(oldfs);
68129 if (!err && put_compat_itimerspec(setting, &ts))
68130 return -EFAULT;
68131 @@ -606,7 +606,7 @@ long compat_sys_clock_settime(clockid_t
68132 oldfs = get_fs();
68133 set_fs(KERNEL_DS);
68134 err = sys_clock_settime(which_clock,
68135 - (struct timespec __user *) &ts);
68136 + (struct timespec __force_user *) &ts);
68137 set_fs(oldfs);
68138 return err;
68139 }
68140 @@ -621,7 +621,7 @@ long compat_sys_clock_gettime(clockid_t
68141 oldfs = get_fs();
68142 set_fs(KERNEL_DS);
68143 err = sys_clock_gettime(which_clock,
68144 - (struct timespec __user *) &ts);
68145 + (struct timespec __force_user *) &ts);
68146 set_fs(oldfs);
68147 if (!err && put_compat_timespec(&ts, tp))
68148 return -EFAULT;
68149 @@ -638,7 +638,7 @@ long compat_sys_clock_getres(clockid_t w
68150 oldfs = get_fs();
68151 set_fs(KERNEL_DS);
68152 err = sys_clock_getres(which_clock,
68153 - (struct timespec __user *) &ts);
68154 + (struct timespec __force_user *) &ts);
68155 set_fs(oldfs);
68156 if (!err && tp && put_compat_timespec(&ts, tp))
68157 return -EFAULT;
68158 @@ -650,9 +650,9 @@ static long compat_clock_nanosleep_resta
68159 long err;
68160 mm_segment_t oldfs;
68161 struct timespec tu;
68162 - struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp;
68163 + struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp;
68164
68165 - restart->nanosleep.rmtp = (struct timespec __user *) &tu;
68166 + restart->nanosleep.rmtp = (struct timespec __force_user *) &tu;
68167 oldfs = get_fs();
68168 set_fs(KERNEL_DS);
68169 err = clock_nanosleep_restart(restart);
68170 @@ -684,8 +684,8 @@ long compat_sys_clock_nanosleep(clockid_
68171 oldfs = get_fs();
68172 set_fs(KERNEL_DS);
68173 err = sys_clock_nanosleep(which_clock, flags,
68174 - (struct timespec __user *) &in,
68175 - (struct timespec __user *) &out);
68176 + (struct timespec __force_user *) &in,
68177 + (struct timespec __force_user *) &out);
68178 set_fs(oldfs);
68179
68180 if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
68181 diff -urNp linux-2.6.32.49/kernel/configs.c linux-2.6.32.49/kernel/configs.c
68182 --- linux-2.6.32.49/kernel/configs.c 2011-11-08 19:02:43.000000000 -0500
68183 +++ linux-2.6.32.49/kernel/configs.c 2011-11-15 19:59:43.000000000 -0500
68184 @@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
68185 struct proc_dir_entry *entry;
68186
68187 /* create the current config file */
68188 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
68189 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
68190 + entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
68191 + &ikconfig_file_ops);
68192 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
68193 + entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
68194 + &ikconfig_file_ops);
68195 +#endif
68196 +#else
68197 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
68198 &ikconfig_file_ops);
68199 +#endif
68200 +
68201 if (!entry)
68202 return -ENOMEM;
68203
68204 diff -urNp linux-2.6.32.49/kernel/cpu.c linux-2.6.32.49/kernel/cpu.c
68205 --- linux-2.6.32.49/kernel/cpu.c 2011-11-08 19:02:43.000000000 -0500
68206 +++ linux-2.6.32.49/kernel/cpu.c 2011-11-15 19:59:43.000000000 -0500
68207 @@ -19,7 +19,7 @@
68208 /* Serializes the updates to cpu_online_mask, cpu_present_mask */
68209 static DEFINE_MUTEX(cpu_add_remove_lock);
68210
68211 -static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
68212 +static RAW_NOTIFIER_HEAD(cpu_chain);
68213
68214 /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
68215 * Should always be manipulated under cpu_add_remove_lock
68216 diff -urNp linux-2.6.32.49/kernel/cred.c linux-2.6.32.49/kernel/cred.c
68217 --- linux-2.6.32.49/kernel/cred.c 2011-11-08 19:02:43.000000000 -0500
68218 +++ linux-2.6.32.49/kernel/cred.c 2011-11-15 19:59:43.000000000 -0500
68219 @@ -160,6 +160,8 @@ static void put_cred_rcu(struct rcu_head
68220 */
68221 void __put_cred(struct cred *cred)
68222 {
68223 + pax_track_stack();
68224 +
68225 kdebug("__put_cred(%p{%d,%d})", cred,
68226 atomic_read(&cred->usage),
68227 read_cred_subscribers(cred));
68228 @@ -184,6 +186,8 @@ void exit_creds(struct task_struct *tsk)
68229 {
68230 struct cred *cred;
68231
68232 + pax_track_stack();
68233 +
68234 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
68235 atomic_read(&tsk->cred->usage),
68236 read_cred_subscribers(tsk->cred));
68237 @@ -222,6 +226,8 @@ const struct cred *get_task_cred(struct
68238 {
68239 const struct cred *cred;
68240
68241 + pax_track_stack();
68242 +
68243 rcu_read_lock();
68244
68245 do {
68246 @@ -241,6 +247,8 @@ struct cred *cred_alloc_blank(void)
68247 {
68248 struct cred *new;
68249
68250 + pax_track_stack();
68251 +
68252 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
68253 if (!new)
68254 return NULL;
68255 @@ -289,6 +297,8 @@ struct cred *prepare_creds(void)
68256 const struct cred *old;
68257 struct cred *new;
68258
68259 + pax_track_stack();
68260 +
68261 validate_process_creds();
68262
68263 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
68264 @@ -335,6 +345,8 @@ struct cred *prepare_exec_creds(void)
68265 struct thread_group_cred *tgcred = NULL;
68266 struct cred *new;
68267
68268 + pax_track_stack();
68269 +
68270 #ifdef CONFIG_KEYS
68271 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
68272 if (!tgcred)
68273 @@ -441,6 +453,8 @@ int copy_creds(struct task_struct *p, un
68274 struct cred *new;
68275 int ret;
68276
68277 + pax_track_stack();
68278 +
68279 mutex_init(&p->cred_guard_mutex);
68280
68281 if (
68282 @@ -528,6 +542,8 @@ int commit_creds(struct cred *new)
68283 struct task_struct *task = current;
68284 const struct cred *old = task->real_cred;
68285
68286 + pax_track_stack();
68287 +
68288 kdebug("commit_creds(%p{%d,%d})", new,
68289 atomic_read(&new->usage),
68290 read_cred_subscribers(new));
68291 @@ -544,6 +560,8 @@ int commit_creds(struct cred *new)
68292
68293 get_cred(new); /* we will require a ref for the subj creds too */
68294
68295 + gr_set_role_label(task, new->uid, new->gid);
68296 +
68297 /* dumpability changes */
68298 if (old->euid != new->euid ||
68299 old->egid != new->egid ||
68300 @@ -563,10 +581,8 @@ int commit_creds(struct cred *new)
68301 key_fsgid_changed(task);
68302
68303 /* do it
68304 - * - What if a process setreuid()'s and this brings the
68305 - * new uid over his NPROC rlimit? We can check this now
68306 - * cheaply with the new uid cache, so if it matters
68307 - * we should be checking for it. -DaveM
68308 + * RLIMIT_NPROC limits on user->processes have already been checked
68309 + * in set_user().
68310 */
68311 alter_cred_subscribers(new, 2);
68312 if (new->user != old->user)
68313 @@ -606,6 +622,8 @@ EXPORT_SYMBOL(commit_creds);
68314 */
68315 void abort_creds(struct cred *new)
68316 {
68317 + pax_track_stack();
68318 +
68319 kdebug("abort_creds(%p{%d,%d})", new,
68320 atomic_read(&new->usage),
68321 read_cred_subscribers(new));
68322 @@ -629,6 +647,8 @@ const struct cred *override_creds(const
68323 {
68324 const struct cred *old = current->cred;
68325
68326 + pax_track_stack();
68327 +
68328 kdebug("override_creds(%p{%d,%d})", new,
68329 atomic_read(&new->usage),
68330 read_cred_subscribers(new));
68331 @@ -658,6 +678,8 @@ void revert_creds(const struct cred *old
68332 {
68333 const struct cred *override = current->cred;
68334
68335 + pax_track_stack();
68336 +
68337 kdebug("revert_creds(%p{%d,%d})", old,
68338 atomic_read(&old->usage),
68339 read_cred_subscribers(old));
68340 @@ -704,6 +726,8 @@ struct cred *prepare_kernel_cred(struct
68341 const struct cred *old;
68342 struct cred *new;
68343
68344 + pax_track_stack();
68345 +
68346 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
68347 if (!new)
68348 return NULL;
68349 @@ -758,6 +782,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
68350 */
68351 int set_security_override(struct cred *new, u32 secid)
68352 {
68353 + pax_track_stack();
68354 +
68355 return security_kernel_act_as(new, secid);
68356 }
68357 EXPORT_SYMBOL(set_security_override);
68358 @@ -777,6 +803,8 @@ int set_security_override_from_ctx(struc
68359 u32 secid;
68360 int ret;
68361
68362 + pax_track_stack();
68363 +
68364 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
68365 if (ret < 0)
68366 return ret;
68367 diff -urNp linux-2.6.32.49/kernel/exit.c linux-2.6.32.49/kernel/exit.c
68368 --- linux-2.6.32.49/kernel/exit.c 2011-11-08 19:02:43.000000000 -0500
68369 +++ linux-2.6.32.49/kernel/exit.c 2011-11-15 19:59:43.000000000 -0500
68370 @@ -55,6 +55,10 @@
68371 #include <asm/pgtable.h>
68372 #include <asm/mmu_context.h>
68373
68374 +#ifdef CONFIG_GRKERNSEC
68375 +extern rwlock_t grsec_exec_file_lock;
68376 +#endif
68377 +
68378 static void exit_mm(struct task_struct * tsk);
68379
68380 static void __unhash_process(struct task_struct *p)
68381 @@ -174,6 +178,10 @@ void release_task(struct task_struct * p
68382 struct task_struct *leader;
68383 int zap_leader;
68384 repeat:
68385 +#ifdef CONFIG_NET
68386 + gr_del_task_from_ip_table(p);
68387 +#endif
68388 +
68389 tracehook_prepare_release_task(p);
68390 /* don't need to get the RCU readlock here - the process is dead and
68391 * can't be modifying its own credentials */
68392 @@ -341,11 +349,22 @@ static void reparent_to_kthreadd(void)
68393 {
68394 write_lock_irq(&tasklist_lock);
68395
68396 +#ifdef CONFIG_GRKERNSEC
68397 + write_lock(&grsec_exec_file_lock);
68398 + if (current->exec_file) {
68399 + fput(current->exec_file);
68400 + current->exec_file = NULL;
68401 + }
68402 + write_unlock(&grsec_exec_file_lock);
68403 +#endif
68404 +
68405 ptrace_unlink(current);
68406 /* Reparent to init */
68407 current->real_parent = current->parent = kthreadd_task;
68408 list_move_tail(&current->sibling, &current->real_parent->children);
68409
68410 + gr_set_kernel_label(current);
68411 +
68412 /* Set the exit signal to SIGCHLD so we signal init on exit */
68413 current->exit_signal = SIGCHLD;
68414
68415 @@ -397,7 +416,7 @@ int allow_signal(int sig)
68416 * know it'll be handled, so that they don't get converted to
68417 * SIGKILL or just silently dropped.
68418 */
68419 - current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
68420 + current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
68421 recalc_sigpending();
68422 spin_unlock_irq(&current->sighand->siglock);
68423 return 0;
68424 @@ -433,6 +452,17 @@ void daemonize(const char *name, ...)
68425 vsnprintf(current->comm, sizeof(current->comm), name, args);
68426 va_end(args);
68427
68428 +#ifdef CONFIG_GRKERNSEC
68429 + write_lock(&grsec_exec_file_lock);
68430 + if (current->exec_file) {
68431 + fput(current->exec_file);
68432 + current->exec_file = NULL;
68433 + }
68434 + write_unlock(&grsec_exec_file_lock);
68435 +#endif
68436 +
68437 + gr_set_kernel_label(current);
68438 +
68439 /*
68440 * If we were started as result of loading a module, close all of the
68441 * user space pages. We don't need them, and if we didn't close them
68442 @@ -897,17 +927,17 @@ NORET_TYPE void do_exit(long code)
68443 struct task_struct *tsk = current;
68444 int group_dead;
68445
68446 - profile_task_exit(tsk);
68447 -
68448 - WARN_ON(atomic_read(&tsk->fs_excl));
68449 -
68450 + /*
68451 + * Check this first since set_fs() below depends on
68452 + * current_thread_info(), which we better not access when we're in
68453 + * interrupt context. Other than that, we want to do the set_fs()
68454 + * as early as possible.
68455 + */
68456 if (unlikely(in_interrupt()))
68457 panic("Aiee, killing interrupt handler!");
68458 - if (unlikely(!tsk->pid))
68459 - panic("Attempted to kill the idle task!");
68460
68461 /*
68462 - * If do_exit is called because this processes oopsed, it's possible
68463 + * If do_exit is called because this processes Oops'ed, it's possible
68464 * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
68465 * continuing. Amongst other possible reasons, this is to prevent
68466 * mm_release()->clear_child_tid() from writing to a user-controlled
68467 @@ -915,6 +945,13 @@ NORET_TYPE void do_exit(long code)
68468 */
68469 set_fs(USER_DS);
68470
68471 + profile_task_exit(tsk);
68472 +
68473 + WARN_ON(atomic_read(&tsk->fs_excl));
68474 +
68475 + if (unlikely(!tsk->pid))
68476 + panic("Attempted to kill the idle task!");
68477 +
68478 tracehook_report_exit(&code);
68479
68480 validate_creds_for_do_exit(tsk);
68481 @@ -973,6 +1010,9 @@ NORET_TYPE void do_exit(long code)
68482 tsk->exit_code = code;
68483 taskstats_exit(tsk, group_dead);
68484
68485 + gr_acl_handle_psacct(tsk, code);
68486 + gr_acl_handle_exit();
68487 +
68488 exit_mm(tsk);
68489
68490 if (group_dead)
68491 @@ -1188,7 +1228,7 @@ static int wait_task_zombie(struct wait_
68492
68493 if (unlikely(wo->wo_flags & WNOWAIT)) {
68494 int exit_code = p->exit_code;
68495 - int why, status;
68496 + int why;
68497
68498 get_task_struct(p);
68499 read_unlock(&tasklist_lock);
68500 diff -urNp linux-2.6.32.49/kernel/fork.c linux-2.6.32.49/kernel/fork.c
68501 --- linux-2.6.32.49/kernel/fork.c 2011-11-08 19:02:43.000000000 -0500
68502 +++ linux-2.6.32.49/kernel/fork.c 2011-11-15 19:59:43.000000000 -0500
68503 @@ -253,7 +253,7 @@ static struct task_struct *dup_task_stru
68504 *stackend = STACK_END_MAGIC; /* for overflow detection */
68505
68506 #ifdef CONFIG_CC_STACKPROTECTOR
68507 - tsk->stack_canary = get_random_int();
68508 + tsk->stack_canary = pax_get_random_long();
68509 #endif
68510
68511 /* One for us, one for whoever does the "release_task()" (usually parent) */
68512 @@ -293,8 +293,8 @@ static int dup_mmap(struct mm_struct *mm
68513 mm->locked_vm = 0;
68514 mm->mmap = NULL;
68515 mm->mmap_cache = NULL;
68516 - mm->free_area_cache = oldmm->mmap_base;
68517 - mm->cached_hole_size = ~0UL;
68518 + mm->free_area_cache = oldmm->free_area_cache;
68519 + mm->cached_hole_size = oldmm->cached_hole_size;
68520 mm->map_count = 0;
68521 cpumask_clear(mm_cpumask(mm));
68522 mm->mm_rb = RB_ROOT;
68523 @@ -335,6 +335,7 @@ static int dup_mmap(struct mm_struct *mm
68524 tmp->vm_flags &= ~VM_LOCKED;
68525 tmp->vm_mm = mm;
68526 tmp->vm_next = tmp->vm_prev = NULL;
68527 + tmp->vm_mirror = NULL;
68528 anon_vma_link(tmp);
68529 file = tmp->vm_file;
68530 if (file) {
68531 @@ -384,6 +385,31 @@ static int dup_mmap(struct mm_struct *mm
68532 if (retval)
68533 goto out;
68534 }
68535 +
68536 +#ifdef CONFIG_PAX_SEGMEXEC
68537 + if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
68538 + struct vm_area_struct *mpnt_m;
68539 +
68540 + for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
68541 + BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
68542 +
68543 + if (!mpnt->vm_mirror)
68544 + continue;
68545 +
68546 + if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
68547 + BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
68548 + mpnt->vm_mirror = mpnt_m;
68549 + } else {
68550 + BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
68551 + mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
68552 + mpnt_m->vm_mirror->vm_mirror = mpnt_m;
68553 + mpnt->vm_mirror->vm_mirror = mpnt;
68554 + }
68555 + }
68556 + BUG_ON(mpnt_m);
68557 + }
68558 +#endif
68559 +
68560 /* a new mm has just been created */
68561 arch_dup_mmap(oldmm, mm);
68562 retval = 0;
68563 @@ -734,13 +760,14 @@ static int copy_fs(unsigned long clone_f
68564 write_unlock(&fs->lock);
68565 return -EAGAIN;
68566 }
68567 - fs->users++;
68568 + atomic_inc(&fs->users);
68569 write_unlock(&fs->lock);
68570 return 0;
68571 }
68572 tsk->fs = copy_fs_struct(fs);
68573 if (!tsk->fs)
68574 return -ENOMEM;
68575 + gr_set_chroot_entries(tsk, &tsk->fs->root);
68576 return 0;
68577 }
68578
68579 @@ -1033,12 +1060,16 @@ static struct task_struct *copy_process(
68580 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
68581 #endif
68582 retval = -EAGAIN;
68583 +
68584 + gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
68585 +
68586 if (atomic_read(&p->real_cred->user->processes) >=
68587 p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
68588 - if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
68589 - p->real_cred->user != INIT_USER)
68590 + if (p->real_cred->user != INIT_USER &&
68591 + !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
68592 goto bad_fork_free;
68593 }
68594 + current->flags &= ~PF_NPROC_EXCEEDED;
68595
68596 retval = copy_creds(p, clone_flags);
68597 if (retval < 0)
68598 @@ -1183,6 +1214,8 @@ static struct task_struct *copy_process(
68599 goto bad_fork_free_pid;
68600 }
68601
68602 + gr_copy_label(p);
68603 +
68604 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
68605 /*
68606 * Clear TID on mm_release()?
68607 @@ -1333,6 +1366,8 @@ bad_fork_cleanup_count:
68608 bad_fork_free:
68609 free_task(p);
68610 fork_out:
68611 + gr_log_forkfail(retval);
68612 +
68613 return ERR_PTR(retval);
68614 }
68615
68616 @@ -1426,6 +1461,8 @@ long do_fork(unsigned long clone_flags,
68617 if (clone_flags & CLONE_PARENT_SETTID)
68618 put_user(nr, parent_tidptr);
68619
68620 + gr_handle_brute_check();
68621 +
68622 if (clone_flags & CLONE_VFORK) {
68623 p->vfork_done = &vfork;
68624 init_completion(&vfork);
68625 @@ -1558,7 +1595,7 @@ static int unshare_fs(unsigned long unsh
68626 return 0;
68627
68628 /* don't need lock here; in the worst case we'll do useless copy */
68629 - if (fs->users == 1)
68630 + if (atomic_read(&fs->users) == 1)
68631 return 0;
68632
68633 *new_fsp = copy_fs_struct(fs);
68634 @@ -1681,7 +1718,8 @@ SYSCALL_DEFINE1(unshare, unsigned long,
68635 fs = current->fs;
68636 write_lock(&fs->lock);
68637 current->fs = new_fs;
68638 - if (--fs->users)
68639 + gr_set_chroot_entries(current, &current->fs->root);
68640 + if (atomic_dec_return(&fs->users))
68641 new_fs = NULL;
68642 else
68643 new_fs = fs;
68644 diff -urNp linux-2.6.32.49/kernel/futex.c linux-2.6.32.49/kernel/futex.c
68645 --- linux-2.6.32.49/kernel/futex.c 2011-11-08 19:02:43.000000000 -0500
68646 +++ linux-2.6.32.49/kernel/futex.c 2011-11-15 19:59:43.000000000 -0500
68647 @@ -54,6 +54,7 @@
68648 #include <linux/mount.h>
68649 #include <linux/pagemap.h>
68650 #include <linux/syscalls.h>
68651 +#include <linux/ptrace.h>
68652 #include <linux/signal.h>
68653 #include <linux/module.h>
68654 #include <linux/magic.h>
68655 @@ -223,6 +224,11 @@ get_futex_key(u32 __user *uaddr, int fsh
68656 struct page *page;
68657 int err, ro = 0;
68658
68659 +#ifdef CONFIG_PAX_SEGMEXEC
68660 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
68661 + return -EFAULT;
68662 +#endif
68663 +
68664 /*
68665 * The futex address must be "naturally" aligned.
68666 */
68667 @@ -1819,6 +1825,8 @@ static int futex_wait(u32 __user *uaddr,
68668 struct futex_q q;
68669 int ret;
68670
68671 + pax_track_stack();
68672 +
68673 if (!bitset)
68674 return -EINVAL;
68675
68676 @@ -1871,7 +1879,7 @@ retry:
68677
68678 restart = &current_thread_info()->restart_block;
68679 restart->fn = futex_wait_restart;
68680 - restart->futex.uaddr = (u32 *)uaddr;
68681 + restart->futex.uaddr = uaddr;
68682 restart->futex.val = val;
68683 restart->futex.time = abs_time->tv64;
68684 restart->futex.bitset = bitset;
68685 @@ -2233,6 +2241,8 @@ static int futex_wait_requeue_pi(u32 __u
68686 struct futex_q q;
68687 int res, ret;
68688
68689 + pax_track_stack();
68690 +
68691 if (!bitset)
68692 return -EINVAL;
68693
68694 @@ -2407,7 +2417,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
68695 {
68696 struct robust_list_head __user *head;
68697 unsigned long ret;
68698 +#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
68699 const struct cred *cred = current_cred(), *pcred;
68700 +#endif
68701
68702 if (!futex_cmpxchg_enabled)
68703 return -ENOSYS;
68704 @@ -2423,11 +2435,16 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
68705 if (!p)
68706 goto err_unlock;
68707 ret = -EPERM;
68708 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
68709 + if (!ptrace_may_access(p, PTRACE_MODE_READ))
68710 + goto err_unlock;
68711 +#else
68712 pcred = __task_cred(p);
68713 if (cred->euid != pcred->euid &&
68714 cred->euid != pcred->uid &&
68715 !capable(CAP_SYS_PTRACE))
68716 goto err_unlock;
68717 +#endif
68718 head = p->robust_list;
68719 rcu_read_unlock();
68720 }
68721 @@ -2489,7 +2506,7 @@ retry:
68722 */
68723 static inline int fetch_robust_entry(struct robust_list __user **entry,
68724 struct robust_list __user * __user *head,
68725 - int *pi)
68726 + unsigned int *pi)
68727 {
68728 unsigned long uentry;
68729
68730 @@ -2670,6 +2687,7 @@ static int __init futex_init(void)
68731 {
68732 u32 curval;
68733 int i;
68734 + mm_segment_t oldfs;
68735
68736 /*
68737 * This will fail and we want it. Some arch implementations do
68738 @@ -2681,7 +2699,10 @@ static int __init futex_init(void)
68739 * implementation, the non functional ones will return
68740 * -ENOSYS.
68741 */
68742 + oldfs = get_fs();
68743 + set_fs(USER_DS);
68744 curval = cmpxchg_futex_value_locked(NULL, 0, 0);
68745 + set_fs(oldfs);
68746 if (curval == -EFAULT)
68747 futex_cmpxchg_enabled = 1;
68748
68749 diff -urNp linux-2.6.32.49/kernel/futex_compat.c linux-2.6.32.49/kernel/futex_compat.c
68750 --- linux-2.6.32.49/kernel/futex_compat.c 2011-11-08 19:02:43.000000000 -0500
68751 +++ linux-2.6.32.49/kernel/futex_compat.c 2011-11-15 19:59:43.000000000 -0500
68752 @@ -10,6 +10,7 @@
68753 #include <linux/compat.h>
68754 #include <linux/nsproxy.h>
68755 #include <linux/futex.h>
68756 +#include <linux/ptrace.h>
68757
68758 #include <asm/uaccess.h>
68759
68760 @@ -135,7 +136,10 @@ compat_sys_get_robust_list(int pid, comp
68761 {
68762 struct compat_robust_list_head __user *head;
68763 unsigned long ret;
68764 - const struct cred *cred = current_cred(), *pcred;
68765 +#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
68766 + const struct cred *cred = current_cred();
68767 + const struct cred *pcred;
68768 +#endif
68769
68770 if (!futex_cmpxchg_enabled)
68771 return -ENOSYS;
68772 @@ -151,11 +155,16 @@ compat_sys_get_robust_list(int pid, comp
68773 if (!p)
68774 goto err_unlock;
68775 ret = -EPERM;
68776 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
68777 + if (!ptrace_may_access(p, PTRACE_MODE_READ))
68778 + goto err_unlock;
68779 +#else
68780 pcred = __task_cred(p);
68781 if (cred->euid != pcred->euid &&
68782 cred->euid != pcred->uid &&
68783 !capable(CAP_SYS_PTRACE))
68784 goto err_unlock;
68785 +#endif
68786 head = p->compat_robust_list;
68787 read_unlock(&tasklist_lock);
68788 }
68789 diff -urNp linux-2.6.32.49/kernel/gcov/base.c linux-2.6.32.49/kernel/gcov/base.c
68790 --- linux-2.6.32.49/kernel/gcov/base.c 2011-11-08 19:02:43.000000000 -0500
68791 +++ linux-2.6.32.49/kernel/gcov/base.c 2011-11-15 19:59:43.000000000 -0500
68792 @@ -102,11 +102,6 @@ void gcov_enable_events(void)
68793 }
68794
68795 #ifdef CONFIG_MODULES
68796 -static inline int within(void *addr, void *start, unsigned long size)
68797 -{
68798 - return ((addr >= start) && (addr < start + size));
68799 -}
68800 -
68801 /* Update list and generate events when modules are unloaded. */
68802 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
68803 void *data)
68804 @@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
68805 prev = NULL;
68806 /* Remove entries located in module from linked list. */
68807 for (info = gcov_info_head; info; info = info->next) {
68808 - if (within(info, mod->module_core, mod->core_size)) {
68809 + if (within_module_core_rw((unsigned long)info, mod)) {
68810 if (prev)
68811 prev->next = info->next;
68812 else
68813 diff -urNp linux-2.6.32.49/kernel/hrtimer.c linux-2.6.32.49/kernel/hrtimer.c
68814 --- linux-2.6.32.49/kernel/hrtimer.c 2011-11-08 19:02:43.000000000 -0500
68815 +++ linux-2.6.32.49/kernel/hrtimer.c 2011-11-15 19:59:43.000000000 -0500
68816 @@ -1391,7 +1391,7 @@ void hrtimer_peek_ahead_timers(void)
68817 local_irq_restore(flags);
68818 }
68819
68820 -static void run_hrtimer_softirq(struct softirq_action *h)
68821 +static void run_hrtimer_softirq(void)
68822 {
68823 hrtimer_peek_ahead_timers();
68824 }
68825 diff -urNp linux-2.6.32.49/kernel/kallsyms.c linux-2.6.32.49/kernel/kallsyms.c
68826 --- linux-2.6.32.49/kernel/kallsyms.c 2011-11-08 19:02:43.000000000 -0500
68827 +++ linux-2.6.32.49/kernel/kallsyms.c 2011-11-15 19:59:43.000000000 -0500
68828 @@ -11,6 +11,9 @@
68829 * Changed the compression method from stem compression to "table lookup"
68830 * compression (see scripts/kallsyms.c for a more complete description)
68831 */
68832 +#ifdef CONFIG_GRKERNSEC_HIDESYM
68833 +#define __INCLUDED_BY_HIDESYM 1
68834 +#endif
68835 #include <linux/kallsyms.h>
68836 #include <linux/module.h>
68837 #include <linux/init.h>
68838 @@ -51,12 +54,33 @@ extern const unsigned long kallsyms_mark
68839
68840 static inline int is_kernel_inittext(unsigned long addr)
68841 {
68842 + if (system_state != SYSTEM_BOOTING)
68843 + return 0;
68844 +
68845 if (addr >= (unsigned long)_sinittext
68846 && addr <= (unsigned long)_einittext)
68847 return 1;
68848 return 0;
68849 }
68850
68851 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
68852 +#ifdef CONFIG_MODULES
68853 +static inline int is_module_text(unsigned long addr)
68854 +{
68855 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
68856 + return 1;
68857 +
68858 + addr = ktla_ktva(addr);
68859 + return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
68860 +}
68861 +#else
68862 +static inline int is_module_text(unsigned long addr)
68863 +{
68864 + return 0;
68865 +}
68866 +#endif
68867 +#endif
68868 +
68869 static inline int is_kernel_text(unsigned long addr)
68870 {
68871 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
68872 @@ -67,13 +91,28 @@ static inline int is_kernel_text(unsigne
68873
68874 static inline int is_kernel(unsigned long addr)
68875 {
68876 +
68877 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
68878 + if (is_kernel_text(addr) || is_kernel_inittext(addr))
68879 + return 1;
68880 +
68881 + if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
68882 +#else
68883 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
68884 +#endif
68885 +
68886 return 1;
68887 return in_gate_area_no_task(addr);
68888 }
68889
68890 static int is_ksym_addr(unsigned long addr)
68891 {
68892 +
68893 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
68894 + if (is_module_text(addr))
68895 + return 0;
68896 +#endif
68897 +
68898 if (all_var)
68899 return is_kernel(addr);
68900
68901 @@ -413,7 +452,6 @@ static unsigned long get_ksymbol_core(st
68902
68903 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
68904 {
68905 - iter->name[0] = '\0';
68906 iter->nameoff = get_symbol_offset(new_pos);
68907 iter->pos = new_pos;
68908 }
68909 @@ -461,6 +499,11 @@ static int s_show(struct seq_file *m, vo
68910 {
68911 struct kallsym_iter *iter = m->private;
68912
68913 +#ifdef CONFIG_GRKERNSEC_HIDESYM
68914 + if (current_uid())
68915 + return 0;
68916 +#endif
68917 +
68918 /* Some debugging symbols have no name. Ignore them. */
68919 if (!iter->name[0])
68920 return 0;
68921 @@ -501,7 +544,7 @@ static int kallsyms_open(struct inode *i
68922 struct kallsym_iter *iter;
68923 int ret;
68924
68925 - iter = kmalloc(sizeof(*iter), GFP_KERNEL);
68926 + iter = kzalloc(sizeof(*iter), GFP_KERNEL);
68927 if (!iter)
68928 return -ENOMEM;
68929 reset_iter(iter, 0);
68930 diff -urNp linux-2.6.32.49/kernel/kexec.c linux-2.6.32.49/kernel/kexec.c
68931 --- linux-2.6.32.49/kernel/kexec.c 2011-11-08 19:02:43.000000000 -0500
68932 +++ linux-2.6.32.49/kernel/kexec.c 2011-11-15 19:59:43.000000000 -0500
68933 @@ -1028,7 +1028,8 @@ asmlinkage long compat_sys_kexec_load(un
68934 unsigned long flags)
68935 {
68936 struct compat_kexec_segment in;
68937 - struct kexec_segment out, __user *ksegments;
68938 + struct kexec_segment out;
68939 + struct kexec_segment __user *ksegments;
68940 unsigned long i, result;
68941
68942 /* Don't allow clients that don't understand the native
68943 diff -urNp linux-2.6.32.49/kernel/kgdb.c linux-2.6.32.49/kernel/kgdb.c
68944 --- linux-2.6.32.49/kernel/kgdb.c 2011-11-08 19:02:43.000000000 -0500
68945 +++ linux-2.6.32.49/kernel/kgdb.c 2011-11-15 19:59:43.000000000 -0500
68946 @@ -86,7 +86,7 @@ static int kgdb_io_module_registered;
68947 /* Guard for recursive entry */
68948 static int exception_level;
68949
68950 -static struct kgdb_io *kgdb_io_ops;
68951 +static const struct kgdb_io *kgdb_io_ops;
68952 static DEFINE_SPINLOCK(kgdb_registration_lock);
68953
68954 /* kgdb console driver is loaded */
68955 @@ -123,7 +123,7 @@ atomic_t kgdb_active = ATOMIC_INIT(-1)
68956 */
68957 static atomic_t passive_cpu_wait[NR_CPUS];
68958 static atomic_t cpu_in_kgdb[NR_CPUS];
68959 -atomic_t kgdb_setting_breakpoint;
68960 +atomic_unchecked_t kgdb_setting_breakpoint;
68961
68962 struct task_struct *kgdb_usethread;
68963 struct task_struct *kgdb_contthread;
68964 @@ -140,7 +140,7 @@ static unsigned long gdb_regs[(NUMREGBY
68965 sizeof(unsigned long)];
68966
68967 /* to keep track of the CPU which is doing the single stepping*/
68968 -atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
68969 +atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
68970
68971 /*
68972 * If you are debugging a problem where roundup (the collection of
68973 @@ -815,7 +815,7 @@ static int kgdb_io_ready(int print_wait)
68974 return 0;
68975 if (kgdb_connected)
68976 return 1;
68977 - if (atomic_read(&kgdb_setting_breakpoint))
68978 + if (atomic_read_unchecked(&kgdb_setting_breakpoint))
68979 return 1;
68980 if (print_wait)
68981 printk(KERN_CRIT "KGDB: Waiting for remote debugger\n");
68982 @@ -1426,8 +1426,8 @@ acquirelock:
68983 * instance of the exception handler wanted to come into the
68984 * debugger on a different CPU via a single step
68985 */
68986 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
68987 - atomic_read(&kgdb_cpu_doing_single_step) != cpu) {
68988 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
68989 + atomic_read_unchecked(&kgdb_cpu_doing_single_step) != cpu) {
68990
68991 atomic_set(&kgdb_active, -1);
68992 touch_softlockup_watchdog();
68993 @@ -1634,7 +1634,7 @@ static void kgdb_initial_breakpoint(void
68994 *
68995 * Register it with the KGDB core.
68996 */
68997 -int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
68998 +int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
68999 {
69000 int err;
69001
69002 @@ -1679,7 +1679,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
69003 *
69004 * Unregister it with the KGDB core.
69005 */
69006 -void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
69007 +void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
69008 {
69009 BUG_ON(kgdb_connected);
69010
69011 @@ -1712,11 +1712,11 @@ EXPORT_SYMBOL_GPL(kgdb_unregister_io_mod
69012 */
69013 void kgdb_breakpoint(void)
69014 {
69015 - atomic_set(&kgdb_setting_breakpoint, 1);
69016 + atomic_set_unchecked(&kgdb_setting_breakpoint, 1);
69017 wmb(); /* Sync point before breakpoint */
69018 arch_kgdb_breakpoint();
69019 wmb(); /* Sync point after breakpoint */
69020 - atomic_set(&kgdb_setting_breakpoint, 0);
69021 + atomic_set_unchecked(&kgdb_setting_breakpoint, 0);
69022 }
69023 EXPORT_SYMBOL_GPL(kgdb_breakpoint);
69024
69025 diff -urNp linux-2.6.32.49/kernel/kmod.c linux-2.6.32.49/kernel/kmod.c
69026 --- linux-2.6.32.49/kernel/kmod.c 2011-11-08 19:02:43.000000000 -0500
69027 +++ linux-2.6.32.49/kernel/kmod.c 2011-11-15 19:59:43.000000000 -0500
69028 @@ -65,13 +65,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb
69029 * If module auto-loading support is disabled then this function
69030 * becomes a no-operation.
69031 */
69032 -int __request_module(bool wait, const char *fmt, ...)
69033 +static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
69034 {
69035 - va_list args;
69036 char module_name[MODULE_NAME_LEN];
69037 unsigned int max_modprobes;
69038 int ret;
69039 - char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
69040 + char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
69041 static char *envp[] = { "HOME=/",
69042 "TERM=linux",
69043 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
69044 @@ -84,12 +83,24 @@ int __request_module(bool wait, const ch
69045 if (ret)
69046 return ret;
69047
69048 - va_start(args, fmt);
69049 - ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
69050 - va_end(args);
69051 + ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
69052 if (ret >= MODULE_NAME_LEN)
69053 return -ENAMETOOLONG;
69054
69055 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
69056 + if (!current_uid()) {
69057 + /* hack to workaround consolekit/udisks stupidity */
69058 + read_lock(&tasklist_lock);
69059 + if (!strcmp(current->comm, "mount") &&
69060 + current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
69061 + read_unlock(&tasklist_lock);
69062 + printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
69063 + return -EPERM;
69064 + }
69065 + read_unlock(&tasklist_lock);
69066 + }
69067 +#endif
69068 +
69069 /* If modprobe needs a service that is in a module, we get a recursive
69070 * loop. Limit the number of running kmod threads to max_threads/2 or
69071 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
69072 @@ -123,6 +134,48 @@ int __request_module(bool wait, const ch
69073 atomic_dec(&kmod_concurrent);
69074 return ret;
69075 }
69076 +
69077 +int ___request_module(bool wait, char *module_param, const char *fmt, ...)
69078 +{
69079 + va_list args;
69080 + int ret;
69081 +
69082 + va_start(args, fmt);
69083 + ret = ____request_module(wait, module_param, fmt, args);
69084 + va_end(args);
69085 +
69086 + return ret;
69087 +}
69088 +
69089 +int __request_module(bool wait, const char *fmt, ...)
69090 +{
69091 + va_list args;
69092 + int ret;
69093 +
69094 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
69095 + if (current_uid()) {
69096 + char module_param[MODULE_NAME_LEN];
69097 +
69098 + memset(module_param, 0, sizeof(module_param));
69099 +
69100 + snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
69101 +
69102 + va_start(args, fmt);
69103 + ret = ____request_module(wait, module_param, fmt, args);
69104 + va_end(args);
69105 +
69106 + return ret;
69107 + }
69108 +#endif
69109 +
69110 + va_start(args, fmt);
69111 + ret = ____request_module(wait, NULL, fmt, args);
69112 + va_end(args);
69113 +
69114 + return ret;
69115 +}
69116 +
69117 +
69118 EXPORT_SYMBOL(__request_module);
69119 #endif /* CONFIG_MODULES */
69120
69121 @@ -228,7 +281,7 @@ static int wait_for_helper(void *data)
69122 *
69123 * Thus the __user pointer cast is valid here.
69124 */
69125 - sys_wait4(pid, (int __user *)&ret, 0, NULL);
69126 + sys_wait4(pid, (int __force_user *)&ret, 0, NULL);
69127
69128 /*
69129 * If ret is 0, either ____call_usermodehelper failed and the
69130 diff -urNp linux-2.6.32.49/kernel/kprobes.c linux-2.6.32.49/kernel/kprobes.c
69131 --- linux-2.6.32.49/kernel/kprobes.c 2011-11-08 19:02:43.000000000 -0500
69132 +++ linux-2.6.32.49/kernel/kprobes.c 2011-11-15 19:59:43.000000000 -0500
69133 @@ -183,7 +183,7 @@ static kprobe_opcode_t __kprobes *__get_
69134 * kernel image and loaded module images reside. This is required
69135 * so x86_64 can correctly handle the %rip-relative fixups.
69136 */
69137 - kip->insns = module_alloc(PAGE_SIZE);
69138 + kip->insns = module_alloc_exec(PAGE_SIZE);
69139 if (!kip->insns) {
69140 kfree(kip);
69141 return NULL;
69142 @@ -220,7 +220,7 @@ static int __kprobes collect_one_slot(st
69143 */
69144 if (!list_is_singular(&kprobe_insn_pages)) {
69145 list_del(&kip->list);
69146 - module_free(NULL, kip->insns);
69147 + module_free_exec(NULL, kip->insns);
69148 kfree(kip);
69149 }
69150 return 1;
69151 @@ -1189,7 +1189,7 @@ static int __init init_kprobes(void)
69152 {
69153 int i, err = 0;
69154 unsigned long offset = 0, size = 0;
69155 - char *modname, namebuf[128];
69156 + char *modname, namebuf[KSYM_NAME_LEN];
69157 const char *symbol_name;
69158 void *addr;
69159 struct kprobe_blackpoint *kb;
69160 @@ -1304,7 +1304,7 @@ static int __kprobes show_kprobe_addr(st
69161 const char *sym = NULL;
69162 unsigned int i = *(loff_t *) v;
69163 unsigned long offset = 0;
69164 - char *modname, namebuf[128];
69165 + char *modname, namebuf[KSYM_NAME_LEN];
69166
69167 head = &kprobe_table[i];
69168 preempt_disable();
69169 diff -urNp linux-2.6.32.49/kernel/lockdep.c linux-2.6.32.49/kernel/lockdep.c
69170 --- linux-2.6.32.49/kernel/lockdep.c 2011-11-08 19:02:43.000000000 -0500
69171 +++ linux-2.6.32.49/kernel/lockdep.c 2011-11-15 19:59:43.000000000 -0500
69172 @@ -421,20 +421,20 @@ static struct stack_trace lockdep_init_t
69173 /*
69174 * Various lockdep statistics:
69175 */
69176 -atomic_t chain_lookup_hits;
69177 -atomic_t chain_lookup_misses;
69178 -atomic_t hardirqs_on_events;
69179 -atomic_t hardirqs_off_events;
69180 -atomic_t redundant_hardirqs_on;
69181 -atomic_t redundant_hardirqs_off;
69182 -atomic_t softirqs_on_events;
69183 -atomic_t softirqs_off_events;
69184 -atomic_t redundant_softirqs_on;
69185 -atomic_t redundant_softirqs_off;
69186 -atomic_t nr_unused_locks;
69187 -atomic_t nr_cyclic_checks;
69188 -atomic_t nr_find_usage_forwards_checks;
69189 -atomic_t nr_find_usage_backwards_checks;
69190 +atomic_unchecked_t chain_lookup_hits;
69191 +atomic_unchecked_t chain_lookup_misses;
69192 +atomic_unchecked_t hardirqs_on_events;
69193 +atomic_unchecked_t hardirqs_off_events;
69194 +atomic_unchecked_t redundant_hardirqs_on;
69195 +atomic_unchecked_t redundant_hardirqs_off;
69196 +atomic_unchecked_t softirqs_on_events;
69197 +atomic_unchecked_t softirqs_off_events;
69198 +atomic_unchecked_t redundant_softirqs_on;
69199 +atomic_unchecked_t redundant_softirqs_off;
69200 +atomic_unchecked_t nr_unused_locks;
69201 +atomic_unchecked_t nr_cyclic_checks;
69202 +atomic_unchecked_t nr_find_usage_forwards_checks;
69203 +atomic_unchecked_t nr_find_usage_backwards_checks;
69204 #endif
69205
69206 /*
69207 @@ -577,6 +577,10 @@ static int static_obj(void *obj)
69208 int i;
69209 #endif
69210
69211 +#ifdef CONFIG_PAX_KERNEXEC
69212 + start = ktla_ktva(start);
69213 +#endif
69214 +
69215 /*
69216 * static variable?
69217 */
69218 @@ -592,8 +596,7 @@ static int static_obj(void *obj)
69219 */
69220 for_each_possible_cpu(i) {
69221 start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
69222 - end = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
69223 - + per_cpu_offset(i);
69224 + end = start + PERCPU_ENOUGH_ROOM;
69225
69226 if ((addr >= start) && (addr < end))
69227 return 1;
69228 @@ -710,6 +713,7 @@ register_lock_class(struct lockdep_map *
69229 if (!static_obj(lock->key)) {
69230 debug_locks_off();
69231 printk("INFO: trying to register non-static key.\n");
69232 + printk("lock:%pS key:%pS.\n", lock, lock->key);
69233 printk("the code is fine but needs lockdep annotation.\n");
69234 printk("turning off the locking correctness validator.\n");
69235 dump_stack();
69236 @@ -2751,7 +2755,7 @@ static int __lock_acquire(struct lockdep
69237 if (!class)
69238 return 0;
69239 }
69240 - debug_atomic_inc((atomic_t *)&class->ops);
69241 + debug_atomic_inc((atomic_unchecked_t *)&class->ops);
69242 if (very_verbose(class)) {
69243 printk("\nacquire class [%p] %s", class->key, class->name);
69244 if (class->name_version > 1)
69245 diff -urNp linux-2.6.32.49/kernel/lockdep_internals.h linux-2.6.32.49/kernel/lockdep_internals.h
69246 --- linux-2.6.32.49/kernel/lockdep_internals.h 2011-11-08 19:02:43.000000000 -0500
69247 +++ linux-2.6.32.49/kernel/lockdep_internals.h 2011-11-15 19:59:43.000000000 -0500
69248 @@ -113,26 +113,26 @@ lockdep_count_backward_deps(struct lock_
69249 /*
69250 * Various lockdep statistics:
69251 */
69252 -extern atomic_t chain_lookup_hits;
69253 -extern atomic_t chain_lookup_misses;
69254 -extern atomic_t hardirqs_on_events;
69255 -extern atomic_t hardirqs_off_events;
69256 -extern atomic_t redundant_hardirqs_on;
69257 -extern atomic_t redundant_hardirqs_off;
69258 -extern atomic_t softirqs_on_events;
69259 -extern atomic_t softirqs_off_events;
69260 -extern atomic_t redundant_softirqs_on;
69261 -extern atomic_t redundant_softirqs_off;
69262 -extern atomic_t nr_unused_locks;
69263 -extern atomic_t nr_cyclic_checks;
69264 -extern atomic_t nr_cyclic_check_recursions;
69265 -extern atomic_t nr_find_usage_forwards_checks;
69266 -extern atomic_t nr_find_usage_forwards_recursions;
69267 -extern atomic_t nr_find_usage_backwards_checks;
69268 -extern atomic_t nr_find_usage_backwards_recursions;
69269 -# define debug_atomic_inc(ptr) atomic_inc(ptr)
69270 -# define debug_atomic_dec(ptr) atomic_dec(ptr)
69271 -# define debug_atomic_read(ptr) atomic_read(ptr)
69272 +extern atomic_unchecked_t chain_lookup_hits;
69273 +extern atomic_unchecked_t chain_lookup_misses;
69274 +extern atomic_unchecked_t hardirqs_on_events;
69275 +extern atomic_unchecked_t hardirqs_off_events;
69276 +extern atomic_unchecked_t redundant_hardirqs_on;
69277 +extern atomic_unchecked_t redundant_hardirqs_off;
69278 +extern atomic_unchecked_t softirqs_on_events;
69279 +extern atomic_unchecked_t softirqs_off_events;
69280 +extern atomic_unchecked_t redundant_softirqs_on;
69281 +extern atomic_unchecked_t redundant_softirqs_off;
69282 +extern atomic_unchecked_t nr_unused_locks;
69283 +extern atomic_unchecked_t nr_cyclic_checks;
69284 +extern atomic_unchecked_t nr_cyclic_check_recursions;
69285 +extern atomic_unchecked_t nr_find_usage_forwards_checks;
69286 +extern atomic_unchecked_t nr_find_usage_forwards_recursions;
69287 +extern atomic_unchecked_t nr_find_usage_backwards_checks;
69288 +extern atomic_unchecked_t nr_find_usage_backwards_recursions;
69289 +# define debug_atomic_inc(ptr) atomic_inc_unchecked(ptr)
69290 +# define debug_atomic_dec(ptr) atomic_dec_unchecked(ptr)
69291 +# define debug_atomic_read(ptr) atomic_read_unchecked(ptr)
69292 #else
69293 # define debug_atomic_inc(ptr) do { } while (0)
69294 # define debug_atomic_dec(ptr) do { } while (0)
69295 diff -urNp linux-2.6.32.49/kernel/lockdep_proc.c linux-2.6.32.49/kernel/lockdep_proc.c
69296 --- linux-2.6.32.49/kernel/lockdep_proc.c 2011-11-08 19:02:43.000000000 -0500
69297 +++ linux-2.6.32.49/kernel/lockdep_proc.c 2011-11-15 19:59:43.000000000 -0500
69298 @@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
69299
69300 static void print_name(struct seq_file *m, struct lock_class *class)
69301 {
69302 - char str[128];
69303 + char str[KSYM_NAME_LEN];
69304 const char *name = class->name;
69305
69306 if (!name) {
69307 diff -urNp linux-2.6.32.49/kernel/module.c linux-2.6.32.49/kernel/module.c
69308 --- linux-2.6.32.49/kernel/module.c 2011-11-08 19:02:43.000000000 -0500
69309 +++ linux-2.6.32.49/kernel/module.c 2011-11-15 19:59:43.000000000 -0500
69310 @@ -55,6 +55,7 @@
69311 #include <linux/async.h>
69312 #include <linux/percpu.h>
69313 #include <linux/kmemleak.h>
69314 +#include <linux/grsecurity.h>
69315
69316 #define CREATE_TRACE_POINTS
69317 #include <trace/events/module.h>
69318 @@ -89,7 +90,8 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq
69319 static BLOCKING_NOTIFIER_HEAD(module_notify_list);
69320
69321 /* Bounds of module allocation, for speeding __module_address */
69322 -static unsigned long module_addr_min = -1UL, module_addr_max = 0;
69323 +static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
69324 +static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
69325
69326 int register_module_notifier(struct notifier_block * nb)
69327 {
69328 @@ -245,7 +247,7 @@ bool each_symbol(bool (*fn)(const struct
69329 return true;
69330
69331 list_for_each_entry_rcu(mod, &modules, list) {
69332 - struct symsearch arr[] = {
69333 + struct symsearch modarr[] = {
69334 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
69335 NOT_GPL_ONLY, false },
69336 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
69337 @@ -267,7 +269,7 @@ bool each_symbol(bool (*fn)(const struct
69338 #endif
69339 };
69340
69341 - if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
69342 + if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
69343 return true;
69344 }
69345 return false;
69346 @@ -442,7 +444,7 @@ static void *percpu_modalloc(unsigned lo
69347 void *ptr;
69348 int cpu;
69349
69350 - if (align > PAGE_SIZE) {
69351 + if (align-1 >= PAGE_SIZE) {
69352 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
69353 name, align, PAGE_SIZE);
69354 align = PAGE_SIZE;
69355 @@ -1158,7 +1160,7 @@ static const struct kernel_symbol *resol
69356 * /sys/module/foo/sections stuff
69357 * J. Corbet <corbet@lwn.net>
69358 */
69359 -#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS)
69360 +#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
69361
69362 static inline bool sect_empty(const Elf_Shdr *sect)
69363 {
69364 @@ -1545,7 +1547,8 @@ static void free_module(struct module *m
69365 destroy_params(mod->kp, mod->num_kp);
69366
69367 /* This may be NULL, but that's OK */
69368 - module_free(mod, mod->module_init);
69369 + module_free(mod, mod->module_init_rw);
69370 + module_free_exec(mod, mod->module_init_rx);
69371 kfree(mod->args);
69372 if (mod->percpu)
69373 percpu_modfree(mod->percpu);
69374 @@ -1554,10 +1557,12 @@ static void free_module(struct module *m
69375 percpu_modfree(mod->refptr);
69376 #endif
69377 /* Free lock-classes: */
69378 - lockdep_free_key_range(mod->module_core, mod->core_size);
69379 + lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
69380 + lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
69381
69382 /* Finally, free the core (containing the module structure) */
69383 - module_free(mod, mod->module_core);
69384 + module_free_exec(mod, mod->module_core_rx);
69385 + module_free(mod, mod->module_core_rw);
69386
69387 #ifdef CONFIG_MPU
69388 update_protections(current->mm);
69389 @@ -1628,8 +1633,32 @@ static int simplify_symbols(Elf_Shdr *se
69390 unsigned int i, n = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
69391 int ret = 0;
69392 const struct kernel_symbol *ksym;
69393 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
69394 + int is_fs_load = 0;
69395 + int register_filesystem_found = 0;
69396 + char *p;
69397 +
69398 + p = strstr(mod->args, "grsec_modharden_fs");
69399 +
69400 + if (p) {
69401 + char *endptr = p + strlen("grsec_modharden_fs");
69402 + /* copy \0 as well */
69403 + memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
69404 + is_fs_load = 1;
69405 + }
69406 +#endif
69407 +
69408
69409 for (i = 1; i < n; i++) {
69410 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
69411 + const char *name = strtab + sym[i].st_name;
69412 +
69413 + /* it's a real shame this will never get ripped and copied
69414 + upstream! ;(
69415 + */
69416 + if (is_fs_load && !strcmp(name, "register_filesystem"))
69417 + register_filesystem_found = 1;
69418 +#endif
69419 switch (sym[i].st_shndx) {
69420 case SHN_COMMON:
69421 /* We compiled with -fno-common. These are not
69422 @@ -1651,7 +1680,9 @@ static int simplify_symbols(Elf_Shdr *se
69423 strtab + sym[i].st_name, mod);
69424 /* Ok if resolved. */
69425 if (ksym) {
69426 + pax_open_kernel();
69427 sym[i].st_value = ksym->value;
69428 + pax_close_kernel();
69429 break;
69430 }
69431
69432 @@ -1670,11 +1701,20 @@ static int simplify_symbols(Elf_Shdr *se
69433 secbase = (unsigned long)mod->percpu;
69434 else
69435 secbase = sechdrs[sym[i].st_shndx].sh_addr;
69436 + pax_open_kernel();
69437 sym[i].st_value += secbase;
69438 + pax_close_kernel();
69439 break;
69440 }
69441 }
69442
69443 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
69444 + if (is_fs_load && !register_filesystem_found) {
69445 + printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
69446 + ret = -EPERM;
69447 + }
69448 +#endif
69449 +
69450 return ret;
69451 }
69452
69453 @@ -1731,11 +1771,12 @@ static void layout_sections(struct modul
69454 || s->sh_entsize != ~0UL
69455 || strstarts(secstrings + s->sh_name, ".init"))
69456 continue;
69457 - s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
69458 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
69459 + s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
69460 + else
69461 + s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
69462 DEBUGP("\t%s\n", secstrings + s->sh_name);
69463 }
69464 - if (m == 0)
69465 - mod->core_text_size = mod->core_size;
69466 }
69467
69468 DEBUGP("Init section allocation order:\n");
69469 @@ -1748,12 +1789,13 @@ static void layout_sections(struct modul
69470 || s->sh_entsize != ~0UL
69471 || !strstarts(secstrings + s->sh_name, ".init"))
69472 continue;
69473 - s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
69474 - | INIT_OFFSET_MASK);
69475 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
69476 + s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
69477 + else
69478 + s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
69479 + s->sh_entsize |= INIT_OFFSET_MASK;
69480 DEBUGP("\t%s\n", secstrings + s->sh_name);
69481 }
69482 - if (m == 0)
69483 - mod->init_text_size = mod->init_size;
69484 }
69485 }
69486
69487 @@ -1857,9 +1899,8 @@ static int is_exported(const char *name,
69488
69489 /* As per nm */
69490 static char elf_type(const Elf_Sym *sym,
69491 - Elf_Shdr *sechdrs,
69492 - const char *secstrings,
69493 - struct module *mod)
69494 + const Elf_Shdr *sechdrs,
69495 + const char *secstrings)
69496 {
69497 if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
69498 if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
69499 @@ -1934,7 +1975,7 @@ static unsigned long layout_symtab(struc
69500
69501 /* Put symbol section at end of init part of module. */
69502 symsect->sh_flags |= SHF_ALLOC;
69503 - symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
69504 + symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
69505 symindex) | INIT_OFFSET_MASK;
69506 DEBUGP("\t%s\n", secstrings + symsect->sh_name);
69507
69508 @@ -1951,19 +1992,19 @@ static unsigned long layout_symtab(struc
69509 }
69510
69511 /* Append room for core symbols at end of core part. */
69512 - symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
69513 - mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
69514 + symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
69515 + mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
69516
69517 /* Put string table section at end of init part of module. */
69518 strsect->sh_flags |= SHF_ALLOC;
69519 - strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
69520 + strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
69521 strindex) | INIT_OFFSET_MASK;
69522 DEBUGP("\t%s\n", secstrings + strsect->sh_name);
69523
69524 /* Append room for core symbols' strings at end of core part. */
69525 - *pstroffs = mod->core_size;
69526 + *pstroffs = mod->core_size_rx;
69527 __set_bit(0, strmap);
69528 - mod->core_size += bitmap_weight(strmap, strsect->sh_size);
69529 + mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
69530
69531 return symoffs;
69532 }
69533 @@ -1987,12 +2028,14 @@ static void add_kallsyms(struct module *
69534 mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
69535 mod->strtab = (void *)sechdrs[strindex].sh_addr;
69536
69537 + pax_open_kernel();
69538 +
69539 /* Set types up while we still have access to sections. */
69540 for (i = 0; i < mod->num_symtab; i++)
69541 mod->symtab[i].st_info
69542 - = elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
69543 + = elf_type(&mod->symtab[i], sechdrs, secstrings);
69544
69545 - mod->core_symtab = dst = mod->module_core + symoffs;
69546 + mod->core_symtab = dst = mod->module_core_rx + symoffs;
69547 src = mod->symtab;
69548 *dst = *src;
69549 for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
69550 @@ -2004,10 +2047,12 @@ static void add_kallsyms(struct module *
69551 }
69552 mod->core_num_syms = ndst;
69553
69554 - mod->core_strtab = s = mod->module_core + stroffs;
69555 + mod->core_strtab = s = mod->module_core_rx + stroffs;
69556 for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
69557 if (test_bit(i, strmap))
69558 *++s = mod->strtab[i];
69559 +
69560 + pax_close_kernel();
69561 }
69562 #else
69563 static inline unsigned long layout_symtab(struct module *mod,
69564 @@ -2044,16 +2089,30 @@ static void dynamic_debug_setup(struct _
69565 #endif
69566 }
69567
69568 -static void *module_alloc_update_bounds(unsigned long size)
69569 +static void *module_alloc_update_bounds_rw(unsigned long size)
69570 {
69571 void *ret = module_alloc(size);
69572
69573 if (ret) {
69574 /* Update module bounds. */
69575 - if ((unsigned long)ret < module_addr_min)
69576 - module_addr_min = (unsigned long)ret;
69577 - if ((unsigned long)ret + size > module_addr_max)
69578 - module_addr_max = (unsigned long)ret + size;
69579 + if ((unsigned long)ret < module_addr_min_rw)
69580 + module_addr_min_rw = (unsigned long)ret;
69581 + if ((unsigned long)ret + size > module_addr_max_rw)
69582 + module_addr_max_rw = (unsigned long)ret + size;
69583 + }
69584 + return ret;
69585 +}
69586 +
69587 +static void *module_alloc_update_bounds_rx(unsigned long size)
69588 +{
69589 + void *ret = module_alloc_exec(size);
69590 +
69591 + if (ret) {
69592 + /* Update module bounds. */
69593 + if ((unsigned long)ret < module_addr_min_rx)
69594 + module_addr_min_rx = (unsigned long)ret;
69595 + if ((unsigned long)ret + size > module_addr_max_rx)
69596 + module_addr_max_rx = (unsigned long)ret + size;
69597 }
69598 return ret;
69599 }
69600 @@ -2065,8 +2124,8 @@ static void kmemleak_load_module(struct
69601 unsigned int i;
69602
69603 /* only scan the sections containing data */
69604 - kmemleak_scan_area(mod->module_core, (unsigned long)mod -
69605 - (unsigned long)mod->module_core,
69606 + kmemleak_scan_area(mod->module_core_rw, (unsigned long)mod -
69607 + (unsigned long)mod->module_core_rw,
69608 sizeof(struct module), GFP_KERNEL);
69609
69610 for (i = 1; i < hdr->e_shnum; i++) {
69611 @@ -2076,8 +2135,8 @@ static void kmemleak_load_module(struct
69612 && strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) != 0)
69613 continue;
69614
69615 - kmemleak_scan_area(mod->module_core, sechdrs[i].sh_addr -
69616 - (unsigned long)mod->module_core,
69617 + kmemleak_scan_area(mod->module_core_rw, sechdrs[i].sh_addr -
69618 + (unsigned long)mod->module_core_rw,
69619 sechdrs[i].sh_size, GFP_KERNEL);
69620 }
69621 }
69622 @@ -2263,7 +2322,7 @@ static noinline struct module *load_modu
69623 secstrings, &stroffs, strmap);
69624
69625 /* Do the allocs. */
69626 - ptr = module_alloc_update_bounds(mod->core_size);
69627 + ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
69628 /*
69629 * The pointer to this block is stored in the module structure
69630 * which is inside the block. Just mark it as not being a
69631 @@ -2274,23 +2333,47 @@ static noinline struct module *load_modu
69632 err = -ENOMEM;
69633 goto free_percpu;
69634 }
69635 - memset(ptr, 0, mod->core_size);
69636 - mod->module_core = ptr;
69637 + memset(ptr, 0, mod->core_size_rw);
69638 + mod->module_core_rw = ptr;
69639
69640 - ptr = module_alloc_update_bounds(mod->init_size);
69641 + ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
69642 /*
69643 * The pointer to this block is stored in the module structure
69644 * which is inside the block. This block doesn't need to be
69645 * scanned as it contains data and code that will be freed
69646 * after the module is initialized.
69647 */
69648 - kmemleak_ignore(ptr);
69649 - if (!ptr && mod->init_size) {
69650 + kmemleak_not_leak(ptr);
69651 + if (!ptr && mod->init_size_rw) {
69652 + err = -ENOMEM;
69653 + goto free_core_rw;
69654 + }
69655 + memset(ptr, 0, mod->init_size_rw);
69656 + mod->module_init_rw = ptr;
69657 +
69658 + ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
69659 + kmemleak_not_leak(ptr);
69660 + if (!ptr) {
69661 err = -ENOMEM;
69662 - goto free_core;
69663 + goto free_init_rw;
69664 }
69665 - memset(ptr, 0, mod->init_size);
69666 - mod->module_init = ptr;
69667 +
69668 + pax_open_kernel();
69669 + memset(ptr, 0, mod->core_size_rx);
69670 + pax_close_kernel();
69671 + mod->module_core_rx = ptr;
69672 +
69673 + ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
69674 + kmemleak_not_leak(ptr);
69675 + if (!ptr && mod->init_size_rx) {
69676 + err = -ENOMEM;
69677 + goto free_core_rx;
69678 + }
69679 +
69680 + pax_open_kernel();
69681 + memset(ptr, 0, mod->init_size_rx);
69682 + pax_close_kernel();
69683 + mod->module_init_rx = ptr;
69684
69685 /* Transfer each section which specifies SHF_ALLOC */
69686 DEBUGP("final section addresses:\n");
69687 @@ -2300,17 +2383,45 @@ static noinline struct module *load_modu
69688 if (!(sechdrs[i].sh_flags & SHF_ALLOC))
69689 continue;
69690
69691 - if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
69692 - dest = mod->module_init
69693 - + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
69694 - else
69695 - dest = mod->module_core + sechdrs[i].sh_entsize;
69696 + if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
69697 + if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
69698 + dest = mod->module_init_rw
69699 + + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
69700 + else
69701 + dest = mod->module_init_rx
69702 + + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
69703 + } else {
69704 + if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
69705 + dest = mod->module_core_rw + sechdrs[i].sh_entsize;
69706 + else
69707 + dest = mod->module_core_rx + sechdrs[i].sh_entsize;
69708 + }
69709 +
69710 + if (sechdrs[i].sh_type != SHT_NOBITS) {
69711
69712 - if (sechdrs[i].sh_type != SHT_NOBITS)
69713 - memcpy(dest, (void *)sechdrs[i].sh_addr,
69714 - sechdrs[i].sh_size);
69715 +#ifdef CONFIG_PAX_KERNEXEC
69716 +#ifdef CONFIG_X86_64
69717 + if ((sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_EXECINSTR))
69718 + set_memory_x((unsigned long)dest, (sechdrs[i].sh_size + PAGE_SIZE) >> PAGE_SHIFT);
69719 +#endif
69720 + if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
69721 + pax_open_kernel();
69722 + memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
69723 + pax_close_kernel();
69724 + } else
69725 +#endif
69726 +
69727 + memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
69728 + }
69729 /* Update sh_addr to point to copy in image. */
69730 - sechdrs[i].sh_addr = (unsigned long)dest;
69731 +
69732 +#ifdef CONFIG_PAX_KERNEXEC
69733 + if (sechdrs[i].sh_flags & SHF_EXECINSTR)
69734 + sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
69735 + else
69736 +#endif
69737 +
69738 + sechdrs[i].sh_addr = (unsigned long)dest;
69739 DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
69740 }
69741 /* Module has been moved. */
69742 @@ -2322,7 +2433,7 @@ static noinline struct module *load_modu
69743 mod->name);
69744 if (!mod->refptr) {
69745 err = -ENOMEM;
69746 - goto free_init;
69747 + goto free_init_rx;
69748 }
69749 #endif
69750 /* Now we've moved module, initialize linked lists, etc. */
69751 @@ -2351,6 +2462,31 @@ static noinline struct module *load_modu
69752 /* Set up MODINFO_ATTR fields */
69753 setup_modinfo(mod, sechdrs, infoindex);
69754
69755 + mod->args = args;
69756 +
69757 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
69758 + {
69759 + char *p, *p2;
69760 +
69761 + if (strstr(mod->args, "grsec_modharden_netdev")) {
69762 + printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
69763 + err = -EPERM;
69764 + goto cleanup;
69765 + } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
69766 + p += strlen("grsec_modharden_normal");
69767 + p2 = strstr(p, "_");
69768 + if (p2) {
69769 + *p2 = '\0';
69770 + printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
69771 + *p2 = '_';
69772 + }
69773 + err = -EPERM;
69774 + goto cleanup;
69775 + }
69776 + }
69777 +#endif
69778 +
69779 +
69780 /* Fix up syms, so that st_value is a pointer to location. */
69781 err = simplify_symbols(sechdrs, symindex, strtab, versindex, pcpuindex,
69782 mod);
69783 @@ -2431,8 +2567,8 @@ static noinline struct module *load_modu
69784
69785 /* Now do relocations. */
69786 for (i = 1; i < hdr->e_shnum; i++) {
69787 - const char *strtab = (char *)sechdrs[strindex].sh_addr;
69788 unsigned int info = sechdrs[i].sh_info;
69789 + strtab = (char *)sechdrs[strindex].sh_addr;
69790
69791 /* Not a valid relocation section? */
69792 if (info >= hdr->e_shnum)
69793 @@ -2493,16 +2629,15 @@ static noinline struct module *load_modu
69794 * Do it before processing of module parameters, so the module
69795 * can provide parameter accessor functions of its own.
69796 */
69797 - if (mod->module_init)
69798 - flush_icache_range((unsigned long)mod->module_init,
69799 - (unsigned long)mod->module_init
69800 - + mod->init_size);
69801 - flush_icache_range((unsigned long)mod->module_core,
69802 - (unsigned long)mod->module_core + mod->core_size);
69803 + if (mod->module_init_rx)
69804 + flush_icache_range((unsigned long)mod->module_init_rx,
69805 + (unsigned long)mod->module_init_rx
69806 + + mod->init_size_rx);
69807 + flush_icache_range((unsigned long)mod->module_core_rx,
69808 + (unsigned long)mod->module_core_rx + mod->core_size_rx);
69809
69810 set_fs(old_fs);
69811
69812 - mod->args = args;
69813 if (section_addr(hdr, sechdrs, secstrings, "__obsparm"))
69814 printk(KERN_WARNING "%s: Ignoring obsolete parameters\n",
69815 mod->name);
69816 @@ -2546,12 +2681,16 @@ static noinline struct module *load_modu
69817 free_unload:
69818 module_unload_free(mod);
69819 #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
69820 + free_init_rx:
69821 percpu_modfree(mod->refptr);
69822 - free_init:
69823 #endif
69824 - module_free(mod, mod->module_init);
69825 - free_core:
69826 - module_free(mod, mod->module_core);
69827 + module_free_exec(mod, mod->module_init_rx);
69828 + free_core_rx:
69829 + module_free_exec(mod, mod->module_core_rx);
69830 + free_init_rw:
69831 + module_free(mod, mod->module_init_rw);
69832 + free_core_rw:
69833 + module_free(mod, mod->module_core_rw);
69834 /* mod will be freed with core. Don't access it beyond this line! */
69835 free_percpu:
69836 if (percpu)
69837 @@ -2653,10 +2792,12 @@ SYSCALL_DEFINE3(init_module, void __user
69838 mod->symtab = mod->core_symtab;
69839 mod->strtab = mod->core_strtab;
69840 #endif
69841 - module_free(mod, mod->module_init);
69842 - mod->module_init = NULL;
69843 - mod->init_size = 0;
69844 - mod->init_text_size = 0;
69845 + module_free(mod, mod->module_init_rw);
69846 + module_free_exec(mod, mod->module_init_rx);
69847 + mod->module_init_rw = NULL;
69848 + mod->module_init_rx = NULL;
69849 + mod->init_size_rw = 0;
69850 + mod->init_size_rx = 0;
69851 mutex_unlock(&module_mutex);
69852
69853 return 0;
69854 @@ -2687,10 +2828,16 @@ static const char *get_ksymbol(struct mo
69855 unsigned long nextval;
69856
69857 /* At worse, next value is at end of module */
69858 - if (within_module_init(addr, mod))
69859 - nextval = (unsigned long)mod->module_init+mod->init_text_size;
69860 + if (within_module_init_rx(addr, mod))
69861 + nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
69862 + else if (within_module_init_rw(addr, mod))
69863 + nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
69864 + else if (within_module_core_rx(addr, mod))
69865 + nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
69866 + else if (within_module_core_rw(addr, mod))
69867 + nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
69868 else
69869 - nextval = (unsigned long)mod->module_core+mod->core_text_size;
69870 + return NULL;
69871
69872 /* Scan for closest preceeding symbol, and next symbol. (ELF
69873 starts real symbols at 1). */
69874 @@ -2936,7 +3083,7 @@ static int m_show(struct seq_file *m, vo
69875 char buf[8];
69876
69877 seq_printf(m, "%s %u",
69878 - mod->name, mod->init_size + mod->core_size);
69879 + mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
69880 print_unload_info(m, mod);
69881
69882 /* Informative for users. */
69883 @@ -2945,7 +3092,7 @@ static int m_show(struct seq_file *m, vo
69884 mod->state == MODULE_STATE_COMING ? "Loading":
69885 "Live");
69886 /* Used by oprofile and other similar tools. */
69887 - seq_printf(m, " 0x%p", mod->module_core);
69888 + seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
69889
69890 /* Taints info */
69891 if (mod->taints)
69892 @@ -2981,7 +3128,17 @@ static const struct file_operations proc
69893
69894 static int __init proc_modules_init(void)
69895 {
69896 +#ifndef CONFIG_GRKERNSEC_HIDESYM
69897 +#ifdef CONFIG_GRKERNSEC_PROC_USER
69898 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
69899 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
69900 + proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
69901 +#else
69902 proc_create("modules", 0, NULL, &proc_modules_operations);
69903 +#endif
69904 +#else
69905 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
69906 +#endif
69907 return 0;
69908 }
69909 module_init(proc_modules_init);
69910 @@ -3040,12 +3197,12 @@ struct module *__module_address(unsigned
69911 {
69912 struct module *mod;
69913
69914 - if (addr < module_addr_min || addr > module_addr_max)
69915 + if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
69916 + (addr < module_addr_min_rw || addr > module_addr_max_rw))
69917 return NULL;
69918
69919 list_for_each_entry_rcu(mod, &modules, list)
69920 - if (within_module_core(addr, mod)
69921 - || within_module_init(addr, mod))
69922 + if (within_module_init(addr, mod) || within_module_core(addr, mod))
69923 return mod;
69924 return NULL;
69925 }
69926 @@ -3079,11 +3236,20 @@ bool is_module_text_address(unsigned lon
69927 */
69928 struct module *__module_text_address(unsigned long addr)
69929 {
69930 - struct module *mod = __module_address(addr);
69931 + struct module *mod;
69932 +
69933 +#ifdef CONFIG_X86_32
69934 + addr = ktla_ktva(addr);
69935 +#endif
69936 +
69937 + if (addr < module_addr_min_rx || addr > module_addr_max_rx)
69938 + return NULL;
69939 +
69940 + mod = __module_address(addr);
69941 +
69942 if (mod) {
69943 /* Make sure it's within the text section. */
69944 - if (!within(addr, mod->module_init, mod->init_text_size)
69945 - && !within(addr, mod->module_core, mod->core_text_size))
69946 + if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
69947 mod = NULL;
69948 }
69949 return mod;
69950 diff -urNp linux-2.6.32.49/kernel/mutex.c linux-2.6.32.49/kernel/mutex.c
69951 --- linux-2.6.32.49/kernel/mutex.c 2011-11-08 19:02:43.000000000 -0500
69952 +++ linux-2.6.32.49/kernel/mutex.c 2011-11-15 19:59:43.000000000 -0500
69953 @@ -169,7 +169,7 @@ __mutex_lock_common(struct mutex *lock,
69954 */
69955
69956 for (;;) {
69957 - struct thread_info *owner;
69958 + struct task_struct *owner;
69959
69960 /*
69961 * If we own the BKL, then don't spin. The owner of
69962 @@ -214,7 +214,7 @@ __mutex_lock_common(struct mutex *lock,
69963 spin_lock_mutex(&lock->wait_lock, flags);
69964
69965 debug_mutex_lock_common(lock, &waiter);
69966 - debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
69967 + debug_mutex_add_waiter(lock, &waiter, task);
69968
69969 /* add waiting tasks to the end of the waitqueue (FIFO): */
69970 list_add_tail(&waiter.list, &lock->wait_list);
69971 @@ -243,8 +243,7 @@ __mutex_lock_common(struct mutex *lock,
69972 * TASK_UNINTERRUPTIBLE case.)
69973 */
69974 if (unlikely(signal_pending_state(state, task))) {
69975 - mutex_remove_waiter(lock, &waiter,
69976 - task_thread_info(task));
69977 + mutex_remove_waiter(lock, &waiter, task);
69978 mutex_release(&lock->dep_map, 1, ip);
69979 spin_unlock_mutex(&lock->wait_lock, flags);
69980
69981 @@ -265,7 +264,7 @@ __mutex_lock_common(struct mutex *lock,
69982 done:
69983 lock_acquired(&lock->dep_map, ip);
69984 /* got the lock - rejoice! */
69985 - mutex_remove_waiter(lock, &waiter, current_thread_info());
69986 + mutex_remove_waiter(lock, &waiter, task);
69987 mutex_set_owner(lock);
69988
69989 /* set it to 0 if there are no waiters left: */
69990 diff -urNp linux-2.6.32.49/kernel/mutex-debug.c linux-2.6.32.49/kernel/mutex-debug.c
69991 --- linux-2.6.32.49/kernel/mutex-debug.c 2011-11-08 19:02:43.000000000 -0500
69992 +++ linux-2.6.32.49/kernel/mutex-debug.c 2011-11-15 19:59:43.000000000 -0500
69993 @@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mute
69994 }
69995
69996 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
69997 - struct thread_info *ti)
69998 + struct task_struct *task)
69999 {
70000 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
70001
70002 /* Mark the current thread as blocked on the lock: */
70003 - ti->task->blocked_on = waiter;
70004 + task->blocked_on = waiter;
70005 }
70006
70007 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
70008 - struct thread_info *ti)
70009 + struct task_struct *task)
70010 {
70011 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
70012 - DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
70013 - DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
70014 - ti->task->blocked_on = NULL;
70015 + DEBUG_LOCKS_WARN_ON(waiter->task != task);
70016 + DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
70017 + task->blocked_on = NULL;
70018
70019 list_del_init(&waiter->list);
70020 waiter->task = NULL;
70021 @@ -75,7 +75,7 @@ void debug_mutex_unlock(struct mutex *lo
70022 return;
70023
70024 DEBUG_LOCKS_WARN_ON(lock->magic != lock);
70025 - DEBUG_LOCKS_WARN_ON(lock->owner != current_thread_info());
70026 + DEBUG_LOCKS_WARN_ON(lock->owner != current);
70027 DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
70028 mutex_clear_owner(lock);
70029 }
70030 diff -urNp linux-2.6.32.49/kernel/mutex-debug.h linux-2.6.32.49/kernel/mutex-debug.h
70031 --- linux-2.6.32.49/kernel/mutex-debug.h 2011-11-08 19:02:43.000000000 -0500
70032 +++ linux-2.6.32.49/kernel/mutex-debug.h 2011-11-15 19:59:43.000000000 -0500
70033 @@ -20,16 +20,16 @@ extern void debug_mutex_wake_waiter(stru
70034 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
70035 extern void debug_mutex_add_waiter(struct mutex *lock,
70036 struct mutex_waiter *waiter,
70037 - struct thread_info *ti);
70038 + struct task_struct *task);
70039 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
70040 - struct thread_info *ti);
70041 + struct task_struct *task);
70042 extern void debug_mutex_unlock(struct mutex *lock);
70043 extern void debug_mutex_init(struct mutex *lock, const char *name,
70044 struct lock_class_key *key);
70045
70046 static inline void mutex_set_owner(struct mutex *lock)
70047 {
70048 - lock->owner = current_thread_info();
70049 + lock->owner = current;
70050 }
70051
70052 static inline void mutex_clear_owner(struct mutex *lock)
70053 diff -urNp linux-2.6.32.49/kernel/mutex.h linux-2.6.32.49/kernel/mutex.h
70054 --- linux-2.6.32.49/kernel/mutex.h 2011-11-08 19:02:43.000000000 -0500
70055 +++ linux-2.6.32.49/kernel/mutex.h 2011-11-15 19:59:43.000000000 -0500
70056 @@ -19,7 +19,7 @@
70057 #ifdef CONFIG_SMP
70058 static inline void mutex_set_owner(struct mutex *lock)
70059 {
70060 - lock->owner = current_thread_info();
70061 + lock->owner = current;
70062 }
70063
70064 static inline void mutex_clear_owner(struct mutex *lock)
70065 diff -urNp linux-2.6.32.49/kernel/panic.c linux-2.6.32.49/kernel/panic.c
70066 --- linux-2.6.32.49/kernel/panic.c 2011-11-08 19:02:43.000000000 -0500
70067 +++ linux-2.6.32.49/kernel/panic.c 2011-11-15 19:59:43.000000000 -0500
70068 @@ -352,7 +352,7 @@ static void warn_slowpath_common(const c
70069 const char *board;
70070
70071 printk(KERN_WARNING "------------[ cut here ]------------\n");
70072 - printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
70073 + printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
70074 board = dmi_get_system_info(DMI_PRODUCT_NAME);
70075 if (board)
70076 printk(KERN_WARNING "Hardware name: %s\n", board);
70077 @@ -392,7 +392,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
70078 */
70079 void __stack_chk_fail(void)
70080 {
70081 - panic("stack-protector: Kernel stack is corrupted in: %p\n",
70082 + dump_stack();
70083 + panic("stack-protector: Kernel stack is corrupted in: %pA\n",
70084 __builtin_return_address(0));
70085 }
70086 EXPORT_SYMBOL(__stack_chk_fail);
70087 diff -urNp linux-2.6.32.49/kernel/params.c linux-2.6.32.49/kernel/params.c
70088 --- linux-2.6.32.49/kernel/params.c 2011-11-08 19:02:43.000000000 -0500
70089 +++ linux-2.6.32.49/kernel/params.c 2011-11-15 19:59:43.000000000 -0500
70090 @@ -725,7 +725,7 @@ static ssize_t module_attr_store(struct
70091 return ret;
70092 }
70093
70094 -static struct sysfs_ops module_sysfs_ops = {
70095 +static const struct sysfs_ops module_sysfs_ops = {
70096 .show = module_attr_show,
70097 .store = module_attr_store,
70098 };
70099 @@ -739,7 +739,7 @@ static int uevent_filter(struct kset *ks
70100 return 0;
70101 }
70102
70103 -static struct kset_uevent_ops module_uevent_ops = {
70104 +static const struct kset_uevent_ops module_uevent_ops = {
70105 .filter = uevent_filter,
70106 };
70107
70108 diff -urNp linux-2.6.32.49/kernel/perf_event.c linux-2.6.32.49/kernel/perf_event.c
70109 --- linux-2.6.32.49/kernel/perf_event.c 2011-11-08 19:02:43.000000000 -0500
70110 +++ linux-2.6.32.49/kernel/perf_event.c 2011-11-15 19:59:43.000000000 -0500
70111 @@ -77,7 +77,7 @@ int sysctl_perf_event_mlock __read_mostl
70112 */
70113 int sysctl_perf_event_sample_rate __read_mostly = 100000;
70114
70115 -static atomic64_t perf_event_id;
70116 +static atomic64_unchecked_t perf_event_id;
70117
70118 /*
70119 * Lock for (sysadmin-configurable) event reservations:
70120 @@ -1094,9 +1094,9 @@ static void __perf_event_sync_stat(struc
70121 * In order to keep per-task stats reliable we need to flip the event
70122 * values when we flip the contexts.
70123 */
70124 - value = atomic64_read(&next_event->count);
70125 - value = atomic64_xchg(&event->count, value);
70126 - atomic64_set(&next_event->count, value);
70127 + value = atomic64_read_unchecked(&next_event->count);
70128 + value = atomic64_xchg_unchecked(&event->count, value);
70129 + atomic64_set_unchecked(&next_event->count, value);
70130
70131 swap(event->total_time_enabled, next_event->total_time_enabled);
70132 swap(event->total_time_running, next_event->total_time_running);
70133 @@ -1552,7 +1552,7 @@ static u64 perf_event_read(struct perf_e
70134 update_event_times(event);
70135 }
70136
70137 - return atomic64_read(&event->count);
70138 + return atomic64_read_unchecked(&event->count);
70139 }
70140
70141 /*
70142 @@ -1790,11 +1790,11 @@ static int perf_event_read_group(struct
70143 values[n++] = 1 + leader->nr_siblings;
70144 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
70145 values[n++] = leader->total_time_enabled +
70146 - atomic64_read(&leader->child_total_time_enabled);
70147 + atomic64_read_unchecked(&leader->child_total_time_enabled);
70148 }
70149 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
70150 values[n++] = leader->total_time_running +
70151 - atomic64_read(&leader->child_total_time_running);
70152 + atomic64_read_unchecked(&leader->child_total_time_running);
70153 }
70154
70155 size = n * sizeof(u64);
70156 @@ -1829,11 +1829,11 @@ static int perf_event_read_one(struct pe
70157 values[n++] = perf_event_read_value(event);
70158 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
70159 values[n++] = event->total_time_enabled +
70160 - atomic64_read(&event->child_total_time_enabled);
70161 + atomic64_read_unchecked(&event->child_total_time_enabled);
70162 }
70163 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
70164 values[n++] = event->total_time_running +
70165 - atomic64_read(&event->child_total_time_running);
70166 + atomic64_read_unchecked(&event->child_total_time_running);
70167 }
70168 if (read_format & PERF_FORMAT_ID)
70169 values[n++] = primary_event_id(event);
70170 @@ -1903,7 +1903,7 @@ static unsigned int perf_poll(struct fil
70171 static void perf_event_reset(struct perf_event *event)
70172 {
70173 (void)perf_event_read(event);
70174 - atomic64_set(&event->count, 0);
70175 + atomic64_set_unchecked(&event->count, 0);
70176 perf_event_update_userpage(event);
70177 }
70178
70179 @@ -2079,15 +2079,15 @@ void perf_event_update_userpage(struct p
70180 ++userpg->lock;
70181 barrier();
70182 userpg->index = perf_event_index(event);
70183 - userpg->offset = atomic64_read(&event->count);
70184 + userpg->offset = atomic64_read_unchecked(&event->count);
70185 if (event->state == PERF_EVENT_STATE_ACTIVE)
70186 - userpg->offset -= atomic64_read(&event->hw.prev_count);
70187 + userpg->offset -= atomic64_read_unchecked(&event->hw.prev_count);
70188
70189 userpg->time_enabled = event->total_time_enabled +
70190 - atomic64_read(&event->child_total_time_enabled);
70191 + atomic64_read_unchecked(&event->child_total_time_enabled);
70192
70193 userpg->time_running = event->total_time_running +
70194 - atomic64_read(&event->child_total_time_running);
70195 + atomic64_read_unchecked(&event->child_total_time_running);
70196
70197 barrier();
70198 ++userpg->lock;
70199 @@ -2903,14 +2903,14 @@ static void perf_output_read_one(struct
70200 u64 values[4];
70201 int n = 0;
70202
70203 - values[n++] = atomic64_read(&event->count);
70204 + values[n++] = atomic64_read_unchecked(&event->count);
70205 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
70206 values[n++] = event->total_time_enabled +
70207 - atomic64_read(&event->child_total_time_enabled);
70208 + atomic64_read_unchecked(&event->child_total_time_enabled);
70209 }
70210 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
70211 values[n++] = event->total_time_running +
70212 - atomic64_read(&event->child_total_time_running);
70213 + atomic64_read_unchecked(&event->child_total_time_running);
70214 }
70215 if (read_format & PERF_FORMAT_ID)
70216 values[n++] = primary_event_id(event);
70217 @@ -2940,7 +2940,7 @@ static void perf_output_read_group(struc
70218 if (leader != event)
70219 leader->pmu->read(leader);
70220
70221 - values[n++] = atomic64_read(&leader->count);
70222 + values[n++] = atomic64_read_unchecked(&leader->count);
70223 if (read_format & PERF_FORMAT_ID)
70224 values[n++] = primary_event_id(leader);
70225
70226 @@ -2952,7 +2952,7 @@ static void perf_output_read_group(struc
70227 if (sub != event)
70228 sub->pmu->read(sub);
70229
70230 - values[n++] = atomic64_read(&sub->count);
70231 + values[n++] = atomic64_read_unchecked(&sub->count);
70232 if (read_format & PERF_FORMAT_ID)
70233 values[n++] = primary_event_id(sub);
70234
70235 @@ -3525,12 +3525,12 @@ static void perf_event_mmap_event(struct
70236 * need to add enough zero bytes after the string to handle
70237 * the 64bit alignment we do later.
70238 */
70239 - buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL);
70240 + buf = kzalloc(PATH_MAX, GFP_KERNEL);
70241 if (!buf) {
70242 name = strncpy(tmp, "//enomem", sizeof(tmp));
70243 goto got_name;
70244 }
70245 - name = d_path(&file->f_path, buf, PATH_MAX);
70246 + name = d_path(&file->f_path, buf, PATH_MAX - sizeof(u64));
70247 if (IS_ERR(name)) {
70248 name = strncpy(tmp, "//toolong", sizeof(tmp));
70249 goto got_name;
70250 @@ -3783,7 +3783,7 @@ static void perf_swevent_add(struct perf
70251 {
70252 struct hw_perf_event *hwc = &event->hw;
70253
70254 - atomic64_add(nr, &event->count);
70255 + atomic64_add_unchecked(nr, &event->count);
70256
70257 if (!hwc->sample_period)
70258 return;
70259 @@ -4040,9 +4040,9 @@ static void cpu_clock_perf_event_update(
70260 u64 now;
70261
70262 now = cpu_clock(cpu);
70263 - prev = atomic64_read(&event->hw.prev_count);
70264 - atomic64_set(&event->hw.prev_count, now);
70265 - atomic64_add(now - prev, &event->count);
70266 + prev = atomic64_read_unchecked(&event->hw.prev_count);
70267 + atomic64_set_unchecked(&event->hw.prev_count, now);
70268 + atomic64_add_unchecked(now - prev, &event->count);
70269 }
70270
70271 static int cpu_clock_perf_event_enable(struct perf_event *event)
70272 @@ -4050,7 +4050,7 @@ static int cpu_clock_perf_event_enable(s
70273 struct hw_perf_event *hwc = &event->hw;
70274 int cpu = raw_smp_processor_id();
70275
70276 - atomic64_set(&hwc->prev_count, cpu_clock(cpu));
70277 + atomic64_set_unchecked(&hwc->prev_count, cpu_clock(cpu));
70278 perf_swevent_start_hrtimer(event);
70279
70280 return 0;
70281 @@ -4082,9 +4082,9 @@ static void task_clock_perf_event_update
70282 u64 prev;
70283 s64 delta;
70284
70285 - prev = atomic64_xchg(&event->hw.prev_count, now);
70286 + prev = atomic64_xchg_unchecked(&event->hw.prev_count, now);
70287 delta = now - prev;
70288 - atomic64_add(delta, &event->count);
70289 + atomic64_add_unchecked(delta, &event->count);
70290 }
70291
70292 static int task_clock_perf_event_enable(struct perf_event *event)
70293 @@ -4094,7 +4094,7 @@ static int task_clock_perf_event_enable(
70294
70295 now = event->ctx->time;
70296
70297 - atomic64_set(&hwc->prev_count, now);
70298 + atomic64_set_unchecked(&hwc->prev_count, now);
70299
70300 perf_swevent_start_hrtimer(event);
70301
70302 @@ -4289,7 +4289,7 @@ perf_event_alloc(struct perf_event_attr
70303 event->parent = parent_event;
70304
70305 event->ns = get_pid_ns(current->nsproxy->pid_ns);
70306 - event->id = atomic64_inc_return(&perf_event_id);
70307 + event->id = atomic64_inc_return_unchecked(&perf_event_id);
70308
70309 event->state = PERF_EVENT_STATE_INACTIVE;
70310
70311 @@ -4720,15 +4720,15 @@ static void sync_child_event(struct perf
70312 if (child_event->attr.inherit_stat)
70313 perf_event_read_event(child_event, child);
70314
70315 - child_val = atomic64_read(&child_event->count);
70316 + child_val = atomic64_read_unchecked(&child_event->count);
70317
70318 /*
70319 * Add back the child's count to the parent's count:
70320 */
70321 - atomic64_add(child_val, &parent_event->count);
70322 - atomic64_add(child_event->total_time_enabled,
70323 + atomic64_add_unchecked(child_val, &parent_event->count);
70324 + atomic64_add_unchecked(child_event->total_time_enabled,
70325 &parent_event->child_total_time_enabled);
70326 - atomic64_add(child_event->total_time_running,
70327 + atomic64_add_unchecked(child_event->total_time_running,
70328 &parent_event->child_total_time_running);
70329
70330 /*
70331 diff -urNp linux-2.6.32.49/kernel/pid.c linux-2.6.32.49/kernel/pid.c
70332 --- linux-2.6.32.49/kernel/pid.c 2011-11-08 19:02:43.000000000 -0500
70333 +++ linux-2.6.32.49/kernel/pid.c 2011-11-15 19:59:43.000000000 -0500
70334 @@ -33,6 +33,7 @@
70335 #include <linux/rculist.h>
70336 #include <linux/bootmem.h>
70337 #include <linux/hash.h>
70338 +#include <linux/security.h>
70339 #include <linux/pid_namespace.h>
70340 #include <linux/init_task.h>
70341 #include <linux/syscalls.h>
70342 @@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
70343
70344 int pid_max = PID_MAX_DEFAULT;
70345
70346 -#define RESERVED_PIDS 300
70347 +#define RESERVED_PIDS 500
70348
70349 int pid_max_min = RESERVED_PIDS + 1;
70350 int pid_max_max = PID_MAX_LIMIT;
70351 @@ -383,7 +384,14 @@ EXPORT_SYMBOL(pid_task);
70352 */
70353 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
70354 {
70355 - return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
70356 + struct task_struct *task;
70357 +
70358 + task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
70359 +
70360 + if (gr_pid_is_chrooted(task))
70361 + return NULL;
70362 +
70363 + return task;
70364 }
70365
70366 struct task_struct *find_task_by_vpid(pid_t vnr)
70367 @@ -391,6 +399,11 @@ struct task_struct *find_task_by_vpid(pi
70368 return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
70369 }
70370
70371 +struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
70372 +{
70373 + return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
70374 +}
70375 +
70376 struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
70377 {
70378 struct pid *pid;
70379 diff -urNp linux-2.6.32.49/kernel/posix-cpu-timers.c linux-2.6.32.49/kernel/posix-cpu-timers.c
70380 --- linux-2.6.32.49/kernel/posix-cpu-timers.c 2011-11-08 19:02:43.000000000 -0500
70381 +++ linux-2.6.32.49/kernel/posix-cpu-timers.c 2011-11-15 19:59:43.000000000 -0500
70382 @@ -6,6 +6,7 @@
70383 #include <linux/posix-timers.h>
70384 #include <linux/errno.h>
70385 #include <linux/math64.h>
70386 +#include <linux/security.h>
70387 #include <asm/uaccess.h>
70388 #include <linux/kernel_stat.h>
70389 #include <trace/events/timer.h>
70390 @@ -1697,7 +1698,7 @@ static long thread_cpu_nsleep_restart(st
70391
70392 static __init int init_posix_cpu_timers(void)
70393 {
70394 - struct k_clock process = {
70395 + static struct k_clock process = {
70396 .clock_getres = process_cpu_clock_getres,
70397 .clock_get = process_cpu_clock_get,
70398 .clock_set = do_posix_clock_nosettime,
70399 @@ -1705,7 +1706,7 @@ static __init int init_posix_cpu_timers(
70400 .nsleep = process_cpu_nsleep,
70401 .nsleep_restart = process_cpu_nsleep_restart,
70402 };
70403 - struct k_clock thread = {
70404 + static struct k_clock thread = {
70405 .clock_getres = thread_cpu_clock_getres,
70406 .clock_get = thread_cpu_clock_get,
70407 .clock_set = do_posix_clock_nosettime,
70408 diff -urNp linux-2.6.32.49/kernel/posix-timers.c linux-2.6.32.49/kernel/posix-timers.c
70409 --- linux-2.6.32.49/kernel/posix-timers.c 2011-11-08 19:02:43.000000000 -0500
70410 +++ linux-2.6.32.49/kernel/posix-timers.c 2011-11-15 19:59:43.000000000 -0500
70411 @@ -42,6 +42,7 @@
70412 #include <linux/compiler.h>
70413 #include <linux/idr.h>
70414 #include <linux/posix-timers.h>
70415 +#include <linux/grsecurity.h>
70416 #include <linux/syscalls.h>
70417 #include <linux/wait.h>
70418 #include <linux/workqueue.h>
70419 @@ -131,7 +132,7 @@ static DEFINE_SPINLOCK(idr_lock);
70420 * which we beg off on and pass to do_sys_settimeofday().
70421 */
70422
70423 -static struct k_clock posix_clocks[MAX_CLOCKS];
70424 +static struct k_clock *posix_clocks[MAX_CLOCKS];
70425
70426 /*
70427 * These ones are defined below.
70428 @@ -157,8 +158,8 @@ static inline void unlock_timer(struct k
70429 */
70430 #define CLOCK_DISPATCH(clock, call, arglist) \
70431 ((clock) < 0 ? posix_cpu_##call arglist : \
70432 - (posix_clocks[clock].call != NULL \
70433 - ? (*posix_clocks[clock].call) arglist : common_##call arglist))
70434 + (posix_clocks[clock]->call != NULL \
70435 + ? (*posix_clocks[clock]->call) arglist : common_##call arglist))
70436
70437 /*
70438 * Default clock hook functions when the struct k_clock passed
70439 @@ -172,7 +173,7 @@ static inline int common_clock_getres(co
70440 struct timespec *tp)
70441 {
70442 tp->tv_sec = 0;
70443 - tp->tv_nsec = posix_clocks[which_clock].res;
70444 + tp->tv_nsec = posix_clocks[which_clock]->res;
70445 return 0;
70446 }
70447
70448 @@ -217,9 +218,11 @@ static inline int invalid_clockid(const
70449 return 0;
70450 if ((unsigned) which_clock >= MAX_CLOCKS)
70451 return 1;
70452 - if (posix_clocks[which_clock].clock_getres != NULL)
70453 + if (posix_clocks[which_clock] == NULL)
70454 return 0;
70455 - if (posix_clocks[which_clock].res != 0)
70456 + if (posix_clocks[which_clock]->clock_getres != NULL)
70457 + return 0;
70458 + if (posix_clocks[which_clock]->res != 0)
70459 return 0;
70460 return 1;
70461 }
70462 @@ -266,29 +269,29 @@ int posix_get_coarse_res(const clockid_t
70463 */
70464 static __init int init_posix_timers(void)
70465 {
70466 - struct k_clock clock_realtime = {
70467 + static struct k_clock clock_realtime = {
70468 .clock_getres = hrtimer_get_res,
70469 };
70470 - struct k_clock clock_monotonic = {
70471 + static struct k_clock clock_monotonic = {
70472 .clock_getres = hrtimer_get_res,
70473 .clock_get = posix_ktime_get_ts,
70474 .clock_set = do_posix_clock_nosettime,
70475 };
70476 - struct k_clock clock_monotonic_raw = {
70477 + static struct k_clock clock_monotonic_raw = {
70478 .clock_getres = hrtimer_get_res,
70479 .clock_get = posix_get_monotonic_raw,
70480 .clock_set = do_posix_clock_nosettime,
70481 .timer_create = no_timer_create,
70482 .nsleep = no_nsleep,
70483 };
70484 - struct k_clock clock_realtime_coarse = {
70485 + static struct k_clock clock_realtime_coarse = {
70486 .clock_getres = posix_get_coarse_res,
70487 .clock_get = posix_get_realtime_coarse,
70488 .clock_set = do_posix_clock_nosettime,
70489 .timer_create = no_timer_create,
70490 .nsleep = no_nsleep,
70491 };
70492 - struct k_clock clock_monotonic_coarse = {
70493 + static struct k_clock clock_monotonic_coarse = {
70494 .clock_getres = posix_get_coarse_res,
70495 .clock_get = posix_get_monotonic_coarse,
70496 .clock_set = do_posix_clock_nosettime,
70497 @@ -296,6 +299,8 @@ static __init int init_posix_timers(void
70498 .nsleep = no_nsleep,
70499 };
70500
70501 + pax_track_stack();
70502 +
70503 register_posix_clock(CLOCK_REALTIME, &clock_realtime);
70504 register_posix_clock(CLOCK_MONOTONIC, &clock_monotonic);
70505 register_posix_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
70506 @@ -484,7 +489,7 @@ void register_posix_clock(const clockid_
70507 return;
70508 }
70509
70510 - posix_clocks[clock_id] = *new_clock;
70511 + posix_clocks[clock_id] = new_clock;
70512 }
70513 EXPORT_SYMBOL_GPL(register_posix_clock);
70514
70515 @@ -948,6 +953,13 @@ SYSCALL_DEFINE2(clock_settime, const clo
70516 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
70517 return -EFAULT;
70518
70519 + /* only the CLOCK_REALTIME clock can be set, all other clocks
70520 + have their clock_set fptr set to a nosettime dummy function
70521 + CLOCK_REALTIME has a NULL clock_set fptr which causes it to
70522 + call common_clock_set, which calls do_sys_settimeofday, which
70523 + we hook
70524 + */
70525 +
70526 return CLOCK_DISPATCH(which_clock, clock_set, (which_clock, &new_tp));
70527 }
70528
70529 diff -urNp linux-2.6.32.49/kernel/power/hibernate.c linux-2.6.32.49/kernel/power/hibernate.c
70530 --- linux-2.6.32.49/kernel/power/hibernate.c 2011-11-08 19:02:43.000000000 -0500
70531 +++ linux-2.6.32.49/kernel/power/hibernate.c 2011-11-15 19:59:43.000000000 -0500
70532 @@ -48,14 +48,14 @@ enum {
70533
70534 static int hibernation_mode = HIBERNATION_SHUTDOWN;
70535
70536 -static struct platform_hibernation_ops *hibernation_ops;
70537 +static const struct platform_hibernation_ops *hibernation_ops;
70538
70539 /**
70540 * hibernation_set_ops - set the global hibernate operations
70541 * @ops: the hibernation operations to use in subsequent hibernation transitions
70542 */
70543
70544 -void hibernation_set_ops(struct platform_hibernation_ops *ops)
70545 +void hibernation_set_ops(const struct platform_hibernation_ops *ops)
70546 {
70547 if (ops && !(ops->begin && ops->end && ops->pre_snapshot
70548 && ops->prepare && ops->finish && ops->enter && ops->pre_restore
70549 diff -urNp linux-2.6.32.49/kernel/power/poweroff.c linux-2.6.32.49/kernel/power/poweroff.c
70550 --- linux-2.6.32.49/kernel/power/poweroff.c 2011-11-08 19:02:43.000000000 -0500
70551 +++ linux-2.6.32.49/kernel/power/poweroff.c 2011-11-15 19:59:43.000000000 -0500
70552 @@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_powerof
70553 .enable_mask = SYSRQ_ENABLE_BOOT,
70554 };
70555
70556 -static int pm_sysrq_init(void)
70557 +static int __init pm_sysrq_init(void)
70558 {
70559 register_sysrq_key('o', &sysrq_poweroff_op);
70560 return 0;
70561 diff -urNp linux-2.6.32.49/kernel/power/process.c linux-2.6.32.49/kernel/power/process.c
70562 --- linux-2.6.32.49/kernel/power/process.c 2011-11-08 19:02:43.000000000 -0500
70563 +++ linux-2.6.32.49/kernel/power/process.c 2011-11-15 19:59:43.000000000 -0500
70564 @@ -37,12 +37,15 @@ static int try_to_freeze_tasks(bool sig_
70565 struct timeval start, end;
70566 u64 elapsed_csecs64;
70567 unsigned int elapsed_csecs;
70568 + bool timedout = false;
70569
70570 do_gettimeofday(&start);
70571
70572 end_time = jiffies + TIMEOUT;
70573 do {
70574 todo = 0;
70575 + if (time_after(jiffies, end_time))
70576 + timedout = true;
70577 read_lock(&tasklist_lock);
70578 do_each_thread(g, p) {
70579 if (frozen(p) || !freezeable(p))
70580 @@ -57,15 +60,17 @@ static int try_to_freeze_tasks(bool sig_
70581 * It is "frozen enough". If the task does wake
70582 * up, it will immediately call try_to_freeze.
70583 */
70584 - if (!task_is_stopped_or_traced(p) &&
70585 - !freezer_should_skip(p))
70586 + if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
70587 todo++;
70588 + if (timedout) {
70589 + printk(KERN_ERR "Task refusing to freeze:\n");
70590 + sched_show_task(p);
70591 + }
70592 + }
70593 } while_each_thread(g, p);
70594 read_unlock(&tasklist_lock);
70595 yield(); /* Yield is okay here */
70596 - if (time_after(jiffies, end_time))
70597 - break;
70598 - } while (todo);
70599 + } while (todo && !timedout);
70600
70601 do_gettimeofday(&end);
70602 elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
70603 diff -urNp linux-2.6.32.49/kernel/power/suspend.c linux-2.6.32.49/kernel/power/suspend.c
70604 --- linux-2.6.32.49/kernel/power/suspend.c 2011-11-26 19:44:53.000000000 -0500
70605 +++ linux-2.6.32.49/kernel/power/suspend.c 2011-11-26 19:45:13.000000000 -0500
70606 @@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_M
70607 [PM_SUSPEND_MEM] = "mem",
70608 };
70609
70610 -static struct platform_suspend_ops *suspend_ops;
70611 +static const struct platform_suspend_ops *suspend_ops;
70612
70613 /**
70614 * suspend_set_ops - Set the global suspend method table.
70615 * @ops: Pointer to ops structure.
70616 */
70617 -void suspend_set_ops(struct platform_suspend_ops *ops)
70618 +void suspend_set_ops(const struct platform_suspend_ops *ops)
70619 {
70620 mutex_lock(&pm_mutex);
70621 suspend_ops = ops;
70622 diff -urNp linux-2.6.32.49/kernel/printk.c linux-2.6.32.49/kernel/printk.c
70623 --- linux-2.6.32.49/kernel/printk.c 2011-11-08 19:02:43.000000000 -0500
70624 +++ linux-2.6.32.49/kernel/printk.c 2011-11-15 19:59:43.000000000 -0500
70625 @@ -278,6 +278,11 @@ int do_syslog(int type, char __user *buf
70626 char c;
70627 int error = 0;
70628
70629 +#ifdef CONFIG_GRKERNSEC_DMESG
70630 + if (grsec_enable_dmesg && !capable(CAP_SYS_ADMIN))
70631 + return -EPERM;
70632 +#endif
70633 +
70634 error = security_syslog(type);
70635 if (error)
70636 return error;
70637 diff -urNp linux-2.6.32.49/kernel/profile.c linux-2.6.32.49/kernel/profile.c
70638 --- linux-2.6.32.49/kernel/profile.c 2011-11-08 19:02:43.000000000 -0500
70639 +++ linux-2.6.32.49/kernel/profile.c 2011-11-15 19:59:43.000000000 -0500
70640 @@ -39,7 +39,7 @@ struct profile_hit {
70641 /* Oprofile timer tick hook */
70642 static int (*timer_hook)(struct pt_regs *) __read_mostly;
70643
70644 -static atomic_t *prof_buffer;
70645 +static atomic_unchecked_t *prof_buffer;
70646 static unsigned long prof_len, prof_shift;
70647
70648 int prof_on __read_mostly;
70649 @@ -283,7 +283,7 @@ static void profile_flip_buffers(void)
70650 hits[i].pc = 0;
70651 continue;
70652 }
70653 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
70654 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
70655 hits[i].hits = hits[i].pc = 0;
70656 }
70657 }
70658 @@ -346,9 +346,9 @@ void profile_hits(int type, void *__pc,
70659 * Add the current hit(s) and flush the write-queue out
70660 * to the global buffer:
70661 */
70662 - atomic_add(nr_hits, &prof_buffer[pc]);
70663 + atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
70664 for (i = 0; i < NR_PROFILE_HIT; ++i) {
70665 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
70666 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
70667 hits[i].pc = hits[i].hits = 0;
70668 }
70669 out:
70670 @@ -426,7 +426,7 @@ void profile_hits(int type, void *__pc,
70671 if (prof_on != type || !prof_buffer)
70672 return;
70673 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
70674 - atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
70675 + atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
70676 }
70677 #endif /* !CONFIG_SMP */
70678 EXPORT_SYMBOL_GPL(profile_hits);
70679 @@ -517,7 +517,7 @@ read_profile(struct file *file, char __u
70680 return -EFAULT;
70681 buf++; p++; count--; read++;
70682 }
70683 - pnt = (char *)prof_buffer + p - sizeof(atomic_t);
70684 + pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
70685 if (copy_to_user(buf, (void *)pnt, count))
70686 return -EFAULT;
70687 read += count;
70688 @@ -548,7 +548,7 @@ static ssize_t write_profile(struct file
70689 }
70690 #endif
70691 profile_discard_flip_buffers();
70692 - memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
70693 + memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
70694 return count;
70695 }
70696
70697 diff -urNp linux-2.6.32.49/kernel/ptrace.c linux-2.6.32.49/kernel/ptrace.c
70698 --- linux-2.6.32.49/kernel/ptrace.c 2011-11-08 19:02:43.000000000 -0500
70699 +++ linux-2.6.32.49/kernel/ptrace.c 2011-11-15 19:59:43.000000000 -0500
70700 @@ -117,7 +117,8 @@ int ptrace_check_attach(struct task_stru
70701 return ret;
70702 }
70703
70704 -int __ptrace_may_access(struct task_struct *task, unsigned int mode)
70705 +static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
70706 + unsigned int log)
70707 {
70708 const struct cred *cred = current_cred(), *tcred;
70709
70710 @@ -141,7 +142,9 @@ int __ptrace_may_access(struct task_stru
70711 cred->gid != tcred->egid ||
70712 cred->gid != tcred->sgid ||
70713 cred->gid != tcred->gid) &&
70714 - !capable(CAP_SYS_PTRACE)) {
70715 + ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
70716 + (log && !capable(CAP_SYS_PTRACE)))
70717 + ) {
70718 rcu_read_unlock();
70719 return -EPERM;
70720 }
70721 @@ -149,7 +152,9 @@ int __ptrace_may_access(struct task_stru
70722 smp_rmb();
70723 if (task->mm)
70724 dumpable = get_dumpable(task->mm);
70725 - if (!dumpable && !capable(CAP_SYS_PTRACE))
70726 + if (!dumpable &&
70727 + ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
70728 + (log && !capable(CAP_SYS_PTRACE))))
70729 return -EPERM;
70730
70731 return security_ptrace_access_check(task, mode);
70732 @@ -159,7 +164,16 @@ bool ptrace_may_access(struct task_struc
70733 {
70734 int err;
70735 task_lock(task);
70736 - err = __ptrace_may_access(task, mode);
70737 + err = __ptrace_may_access(task, mode, 0);
70738 + task_unlock(task);
70739 + return !err;
70740 +}
70741 +
70742 +bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
70743 +{
70744 + int err;
70745 + task_lock(task);
70746 + err = __ptrace_may_access(task, mode, 1);
70747 task_unlock(task);
70748 return !err;
70749 }
70750 @@ -186,7 +200,7 @@ int ptrace_attach(struct task_struct *ta
70751 goto out;
70752
70753 task_lock(task);
70754 - retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
70755 + retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
70756 task_unlock(task);
70757 if (retval)
70758 goto unlock_creds;
70759 @@ -199,7 +213,7 @@ int ptrace_attach(struct task_struct *ta
70760 goto unlock_tasklist;
70761
70762 task->ptrace = PT_PTRACED;
70763 - if (capable(CAP_SYS_PTRACE))
70764 + if (capable_nolog(CAP_SYS_PTRACE))
70765 task->ptrace |= PT_PTRACE_CAP;
70766
70767 __ptrace_link(task, current);
70768 @@ -351,6 +365,8 @@ int ptrace_readdata(struct task_struct *
70769 {
70770 int copied = 0;
70771
70772 + pax_track_stack();
70773 +
70774 while (len > 0) {
70775 char buf[128];
70776 int this_len, retval;
70777 @@ -376,6 +392,8 @@ int ptrace_writedata(struct task_struct
70778 {
70779 int copied = 0;
70780
70781 + pax_track_stack();
70782 +
70783 while (len > 0) {
70784 char buf[128];
70785 int this_len, retval;
70786 @@ -517,6 +535,8 @@ int ptrace_request(struct task_struct *c
70787 int ret = -EIO;
70788 siginfo_t siginfo;
70789
70790 + pax_track_stack();
70791 +
70792 switch (request) {
70793 case PTRACE_PEEKTEXT:
70794 case PTRACE_PEEKDATA:
70795 @@ -532,18 +552,18 @@ int ptrace_request(struct task_struct *c
70796 ret = ptrace_setoptions(child, data);
70797 break;
70798 case PTRACE_GETEVENTMSG:
70799 - ret = put_user(child->ptrace_message, (unsigned long __user *) data);
70800 + ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
70801 break;
70802
70803 case PTRACE_GETSIGINFO:
70804 ret = ptrace_getsiginfo(child, &siginfo);
70805 if (!ret)
70806 - ret = copy_siginfo_to_user((siginfo_t __user *) data,
70807 + ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
70808 &siginfo);
70809 break;
70810
70811 case PTRACE_SETSIGINFO:
70812 - if (copy_from_user(&siginfo, (siginfo_t __user *) data,
70813 + if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
70814 sizeof siginfo))
70815 ret = -EFAULT;
70816 else
70817 @@ -621,14 +641,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
70818 goto out;
70819 }
70820
70821 + if (gr_handle_ptrace(child, request)) {
70822 + ret = -EPERM;
70823 + goto out_put_task_struct;
70824 + }
70825 +
70826 if (request == PTRACE_ATTACH) {
70827 ret = ptrace_attach(child);
70828 /*
70829 * Some architectures need to do book-keeping after
70830 * a ptrace attach.
70831 */
70832 - if (!ret)
70833 + if (!ret) {
70834 arch_ptrace_attach(child);
70835 + gr_audit_ptrace(child);
70836 + }
70837 goto out_put_task_struct;
70838 }
70839
70840 @@ -653,7 +680,7 @@ int generic_ptrace_peekdata(struct task_
70841 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
70842 if (copied != sizeof(tmp))
70843 return -EIO;
70844 - return put_user(tmp, (unsigned long __user *)data);
70845 + return put_user(tmp, (__force unsigned long __user *)data);
70846 }
70847
70848 int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
70849 @@ -675,6 +702,8 @@ int compat_ptrace_request(struct task_st
70850 siginfo_t siginfo;
70851 int ret;
70852
70853 + pax_track_stack();
70854 +
70855 switch (request) {
70856 case PTRACE_PEEKTEXT:
70857 case PTRACE_PEEKDATA:
70858 @@ -740,14 +769,21 @@ asmlinkage long compat_sys_ptrace(compat
70859 goto out;
70860 }
70861
70862 + if (gr_handle_ptrace(child, request)) {
70863 + ret = -EPERM;
70864 + goto out_put_task_struct;
70865 + }
70866 +
70867 if (request == PTRACE_ATTACH) {
70868 ret = ptrace_attach(child);
70869 /*
70870 * Some architectures need to do book-keeping after
70871 * a ptrace attach.
70872 */
70873 - if (!ret)
70874 + if (!ret) {
70875 arch_ptrace_attach(child);
70876 + gr_audit_ptrace(child);
70877 + }
70878 goto out_put_task_struct;
70879 }
70880
70881 diff -urNp linux-2.6.32.49/kernel/rcutorture.c linux-2.6.32.49/kernel/rcutorture.c
70882 --- linux-2.6.32.49/kernel/rcutorture.c 2011-11-08 19:02:43.000000000 -0500
70883 +++ linux-2.6.32.49/kernel/rcutorture.c 2011-11-15 19:59:43.000000000 -0500
70884 @@ -118,12 +118,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_
70885 { 0 };
70886 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
70887 { 0 };
70888 -static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
70889 -static atomic_t n_rcu_torture_alloc;
70890 -static atomic_t n_rcu_torture_alloc_fail;
70891 -static atomic_t n_rcu_torture_free;
70892 -static atomic_t n_rcu_torture_mberror;
70893 -static atomic_t n_rcu_torture_error;
70894 +static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
70895 +static atomic_unchecked_t n_rcu_torture_alloc;
70896 +static atomic_unchecked_t n_rcu_torture_alloc_fail;
70897 +static atomic_unchecked_t n_rcu_torture_free;
70898 +static atomic_unchecked_t n_rcu_torture_mberror;
70899 +static atomic_unchecked_t n_rcu_torture_error;
70900 static long n_rcu_torture_timers;
70901 static struct list_head rcu_torture_removed;
70902 static cpumask_var_t shuffle_tmp_mask;
70903 @@ -187,11 +187,11 @@ rcu_torture_alloc(void)
70904
70905 spin_lock_bh(&rcu_torture_lock);
70906 if (list_empty(&rcu_torture_freelist)) {
70907 - atomic_inc(&n_rcu_torture_alloc_fail);
70908 + atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
70909 spin_unlock_bh(&rcu_torture_lock);
70910 return NULL;
70911 }
70912 - atomic_inc(&n_rcu_torture_alloc);
70913 + atomic_inc_unchecked(&n_rcu_torture_alloc);
70914 p = rcu_torture_freelist.next;
70915 list_del_init(p);
70916 spin_unlock_bh(&rcu_torture_lock);
70917 @@ -204,7 +204,7 @@ rcu_torture_alloc(void)
70918 static void
70919 rcu_torture_free(struct rcu_torture *p)
70920 {
70921 - atomic_inc(&n_rcu_torture_free);
70922 + atomic_inc_unchecked(&n_rcu_torture_free);
70923 spin_lock_bh(&rcu_torture_lock);
70924 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
70925 spin_unlock_bh(&rcu_torture_lock);
70926 @@ -319,7 +319,7 @@ rcu_torture_cb(struct rcu_head *p)
70927 i = rp->rtort_pipe_count;
70928 if (i > RCU_TORTURE_PIPE_LEN)
70929 i = RCU_TORTURE_PIPE_LEN;
70930 - atomic_inc(&rcu_torture_wcount[i]);
70931 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
70932 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
70933 rp->rtort_mbtest = 0;
70934 rcu_torture_free(rp);
70935 @@ -359,7 +359,7 @@ static void rcu_sync_torture_deferred_fr
70936 i = rp->rtort_pipe_count;
70937 if (i > RCU_TORTURE_PIPE_LEN)
70938 i = RCU_TORTURE_PIPE_LEN;
70939 - atomic_inc(&rcu_torture_wcount[i]);
70940 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
70941 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
70942 rp->rtort_mbtest = 0;
70943 list_del(&rp->rtort_free);
70944 @@ -653,7 +653,7 @@ rcu_torture_writer(void *arg)
70945 i = old_rp->rtort_pipe_count;
70946 if (i > RCU_TORTURE_PIPE_LEN)
70947 i = RCU_TORTURE_PIPE_LEN;
70948 - atomic_inc(&rcu_torture_wcount[i]);
70949 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
70950 old_rp->rtort_pipe_count++;
70951 cur_ops->deferred_free(old_rp);
70952 }
70953 @@ -718,7 +718,7 @@ static void rcu_torture_timer(unsigned l
70954 return;
70955 }
70956 if (p->rtort_mbtest == 0)
70957 - atomic_inc(&n_rcu_torture_mberror);
70958 + atomic_inc_unchecked(&n_rcu_torture_mberror);
70959 spin_lock(&rand_lock);
70960 cur_ops->read_delay(&rand);
70961 n_rcu_torture_timers++;
70962 @@ -776,7 +776,7 @@ rcu_torture_reader(void *arg)
70963 continue;
70964 }
70965 if (p->rtort_mbtest == 0)
70966 - atomic_inc(&n_rcu_torture_mberror);
70967 + atomic_inc_unchecked(&n_rcu_torture_mberror);
70968 cur_ops->read_delay(&rand);
70969 preempt_disable();
70970 pipe_count = p->rtort_pipe_count;
70971 @@ -834,17 +834,17 @@ rcu_torture_printk(char *page)
70972 rcu_torture_current,
70973 rcu_torture_current_version,
70974 list_empty(&rcu_torture_freelist),
70975 - atomic_read(&n_rcu_torture_alloc),
70976 - atomic_read(&n_rcu_torture_alloc_fail),
70977 - atomic_read(&n_rcu_torture_free),
70978 - atomic_read(&n_rcu_torture_mberror),
70979 + atomic_read_unchecked(&n_rcu_torture_alloc),
70980 + atomic_read_unchecked(&n_rcu_torture_alloc_fail),
70981 + atomic_read_unchecked(&n_rcu_torture_free),
70982 + atomic_read_unchecked(&n_rcu_torture_mberror),
70983 n_rcu_torture_timers);
70984 - if (atomic_read(&n_rcu_torture_mberror) != 0)
70985 + if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0)
70986 cnt += sprintf(&page[cnt], " !!!");
70987 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
70988 if (i > 1) {
70989 cnt += sprintf(&page[cnt], "!!! ");
70990 - atomic_inc(&n_rcu_torture_error);
70991 + atomic_inc_unchecked(&n_rcu_torture_error);
70992 WARN_ON_ONCE(1);
70993 }
70994 cnt += sprintf(&page[cnt], "Reader Pipe: ");
70995 @@ -858,7 +858,7 @@ rcu_torture_printk(char *page)
70996 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
70997 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
70998 cnt += sprintf(&page[cnt], " %d",
70999 - atomic_read(&rcu_torture_wcount[i]));
71000 + atomic_read_unchecked(&rcu_torture_wcount[i]));
71001 }
71002 cnt += sprintf(&page[cnt], "\n");
71003 if (cur_ops->stats)
71004 @@ -1084,7 +1084,7 @@ rcu_torture_cleanup(void)
71005
71006 if (cur_ops->cleanup)
71007 cur_ops->cleanup();
71008 - if (atomic_read(&n_rcu_torture_error))
71009 + if (atomic_read_unchecked(&n_rcu_torture_error))
71010 rcu_torture_print_module_parms("End of test: FAILURE");
71011 else
71012 rcu_torture_print_module_parms("End of test: SUCCESS");
71013 @@ -1138,13 +1138,13 @@ rcu_torture_init(void)
71014
71015 rcu_torture_current = NULL;
71016 rcu_torture_current_version = 0;
71017 - atomic_set(&n_rcu_torture_alloc, 0);
71018 - atomic_set(&n_rcu_torture_alloc_fail, 0);
71019 - atomic_set(&n_rcu_torture_free, 0);
71020 - atomic_set(&n_rcu_torture_mberror, 0);
71021 - atomic_set(&n_rcu_torture_error, 0);
71022 + atomic_set_unchecked(&n_rcu_torture_alloc, 0);
71023 + atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
71024 + atomic_set_unchecked(&n_rcu_torture_free, 0);
71025 + atomic_set_unchecked(&n_rcu_torture_mberror, 0);
71026 + atomic_set_unchecked(&n_rcu_torture_error, 0);
71027 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
71028 - atomic_set(&rcu_torture_wcount[i], 0);
71029 + atomic_set_unchecked(&rcu_torture_wcount[i], 0);
71030 for_each_possible_cpu(cpu) {
71031 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
71032 per_cpu(rcu_torture_count, cpu)[i] = 0;
71033 diff -urNp linux-2.6.32.49/kernel/rcutree.c linux-2.6.32.49/kernel/rcutree.c
71034 --- linux-2.6.32.49/kernel/rcutree.c 2011-11-08 19:02:43.000000000 -0500
71035 +++ linux-2.6.32.49/kernel/rcutree.c 2011-11-15 19:59:43.000000000 -0500
71036 @@ -1303,7 +1303,7 @@ __rcu_process_callbacks(struct rcu_state
71037 /*
71038 * Do softirq processing for the current CPU.
71039 */
71040 -static void rcu_process_callbacks(struct softirq_action *unused)
71041 +static void rcu_process_callbacks(void)
71042 {
71043 /*
71044 * Memory references from any prior RCU read-side critical sections
71045 diff -urNp linux-2.6.32.49/kernel/rcutree_plugin.h linux-2.6.32.49/kernel/rcutree_plugin.h
71046 --- linux-2.6.32.49/kernel/rcutree_plugin.h 2011-11-08 19:02:43.000000000 -0500
71047 +++ linux-2.6.32.49/kernel/rcutree_plugin.h 2011-11-15 19:59:43.000000000 -0500
71048 @@ -145,7 +145,7 @@ static void rcu_preempt_note_context_swi
71049 */
71050 void __rcu_read_lock(void)
71051 {
71052 - ACCESS_ONCE(current->rcu_read_lock_nesting)++;
71053 + ACCESS_ONCE_RW(current->rcu_read_lock_nesting)++;
71054 barrier(); /* needed if we ever invoke rcu_read_lock in rcutree.c */
71055 }
71056 EXPORT_SYMBOL_GPL(__rcu_read_lock);
71057 @@ -251,7 +251,7 @@ void __rcu_read_unlock(void)
71058 struct task_struct *t = current;
71059
71060 barrier(); /* needed if we ever invoke rcu_read_unlock in rcutree.c */
71061 - if (--ACCESS_ONCE(t->rcu_read_lock_nesting) == 0 &&
71062 + if (--ACCESS_ONCE_RW(t->rcu_read_lock_nesting) == 0 &&
71063 unlikely(ACCESS_ONCE(t->rcu_read_unlock_special)))
71064 rcu_read_unlock_special(t);
71065 }
71066 diff -urNp linux-2.6.32.49/kernel/relay.c linux-2.6.32.49/kernel/relay.c
71067 --- linux-2.6.32.49/kernel/relay.c 2011-11-08 19:02:43.000000000 -0500
71068 +++ linux-2.6.32.49/kernel/relay.c 2011-11-15 19:59:43.000000000 -0500
71069 @@ -1222,7 +1222,7 @@ static int subbuf_splice_actor(struct fi
71070 unsigned int flags,
71071 int *nonpad_ret)
71072 {
71073 - unsigned int pidx, poff, total_len, subbuf_pages, nr_pages, ret;
71074 + unsigned int pidx, poff, total_len, subbuf_pages, nr_pages;
71075 struct rchan_buf *rbuf = in->private_data;
71076 unsigned int subbuf_size = rbuf->chan->subbuf_size;
71077 uint64_t pos = (uint64_t) *ppos;
71078 @@ -1241,6 +1241,9 @@ static int subbuf_splice_actor(struct fi
71079 .ops = &relay_pipe_buf_ops,
71080 .spd_release = relay_page_release,
71081 };
71082 + ssize_t ret;
71083 +
71084 + pax_track_stack();
71085
71086 if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
71087 return 0;
71088 diff -urNp linux-2.6.32.49/kernel/resource.c linux-2.6.32.49/kernel/resource.c
71089 --- linux-2.6.32.49/kernel/resource.c 2011-11-08 19:02:43.000000000 -0500
71090 +++ linux-2.6.32.49/kernel/resource.c 2011-11-15 19:59:43.000000000 -0500
71091 @@ -132,8 +132,18 @@ static const struct file_operations proc
71092
71093 static int __init ioresources_init(void)
71094 {
71095 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
71096 +#ifdef CONFIG_GRKERNSEC_PROC_USER
71097 + proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
71098 + proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
71099 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
71100 + proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
71101 + proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
71102 +#endif
71103 +#else
71104 proc_create("ioports", 0, NULL, &proc_ioports_operations);
71105 proc_create("iomem", 0, NULL, &proc_iomem_operations);
71106 +#endif
71107 return 0;
71108 }
71109 __initcall(ioresources_init);
71110 diff -urNp linux-2.6.32.49/kernel/rtmutex.c linux-2.6.32.49/kernel/rtmutex.c
71111 --- linux-2.6.32.49/kernel/rtmutex.c 2011-11-08 19:02:43.000000000 -0500
71112 +++ linux-2.6.32.49/kernel/rtmutex.c 2011-11-15 19:59:43.000000000 -0500
71113 @@ -511,7 +511,7 @@ static void wakeup_next_waiter(struct rt
71114 */
71115 spin_lock_irqsave(&pendowner->pi_lock, flags);
71116
71117 - WARN_ON(!pendowner->pi_blocked_on);
71118 + BUG_ON(!pendowner->pi_blocked_on);
71119 WARN_ON(pendowner->pi_blocked_on != waiter);
71120 WARN_ON(pendowner->pi_blocked_on->lock != lock);
71121
71122 diff -urNp linux-2.6.32.49/kernel/rtmutex-tester.c linux-2.6.32.49/kernel/rtmutex-tester.c
71123 --- linux-2.6.32.49/kernel/rtmutex-tester.c 2011-11-08 19:02:43.000000000 -0500
71124 +++ linux-2.6.32.49/kernel/rtmutex-tester.c 2011-11-15 19:59:43.000000000 -0500
71125 @@ -21,7 +21,7 @@
71126 #define MAX_RT_TEST_MUTEXES 8
71127
71128 static spinlock_t rttest_lock;
71129 -static atomic_t rttest_event;
71130 +static atomic_unchecked_t rttest_event;
71131
71132 struct test_thread_data {
71133 int opcode;
71134 @@ -64,7 +64,7 @@ static int handle_op(struct test_thread_
71135
71136 case RTTEST_LOCKCONT:
71137 td->mutexes[td->opdata] = 1;
71138 - td->event = atomic_add_return(1, &rttest_event);
71139 + td->event = atomic_add_return_unchecked(1, &rttest_event);
71140 return 0;
71141
71142 case RTTEST_RESET:
71143 @@ -82,7 +82,7 @@ static int handle_op(struct test_thread_
71144 return 0;
71145
71146 case RTTEST_RESETEVENT:
71147 - atomic_set(&rttest_event, 0);
71148 + atomic_set_unchecked(&rttest_event, 0);
71149 return 0;
71150
71151 default:
71152 @@ -99,9 +99,9 @@ static int handle_op(struct test_thread_
71153 return ret;
71154
71155 td->mutexes[id] = 1;
71156 - td->event = atomic_add_return(1, &rttest_event);
71157 + td->event = atomic_add_return_unchecked(1, &rttest_event);
71158 rt_mutex_lock(&mutexes[id]);
71159 - td->event = atomic_add_return(1, &rttest_event);
71160 + td->event = atomic_add_return_unchecked(1, &rttest_event);
71161 td->mutexes[id] = 4;
71162 return 0;
71163
71164 @@ -112,9 +112,9 @@ static int handle_op(struct test_thread_
71165 return ret;
71166
71167 td->mutexes[id] = 1;
71168 - td->event = atomic_add_return(1, &rttest_event);
71169 + td->event = atomic_add_return_unchecked(1, &rttest_event);
71170 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
71171 - td->event = atomic_add_return(1, &rttest_event);
71172 + td->event = atomic_add_return_unchecked(1, &rttest_event);
71173 td->mutexes[id] = ret ? 0 : 4;
71174 return ret ? -EINTR : 0;
71175
71176 @@ -123,9 +123,9 @@ static int handle_op(struct test_thread_
71177 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
71178 return ret;
71179
71180 - td->event = atomic_add_return(1, &rttest_event);
71181 + td->event = atomic_add_return_unchecked(1, &rttest_event);
71182 rt_mutex_unlock(&mutexes[id]);
71183 - td->event = atomic_add_return(1, &rttest_event);
71184 + td->event = atomic_add_return_unchecked(1, &rttest_event);
71185 td->mutexes[id] = 0;
71186 return 0;
71187
71188 @@ -187,7 +187,7 @@ void schedule_rt_mutex_test(struct rt_mu
71189 break;
71190
71191 td->mutexes[dat] = 2;
71192 - td->event = atomic_add_return(1, &rttest_event);
71193 + td->event = atomic_add_return_unchecked(1, &rttest_event);
71194 break;
71195
71196 case RTTEST_LOCKBKL:
71197 @@ -208,7 +208,7 @@ void schedule_rt_mutex_test(struct rt_mu
71198 return;
71199
71200 td->mutexes[dat] = 3;
71201 - td->event = atomic_add_return(1, &rttest_event);
71202 + td->event = atomic_add_return_unchecked(1, &rttest_event);
71203 break;
71204
71205 case RTTEST_LOCKNOWAIT:
71206 @@ -220,7 +220,7 @@ void schedule_rt_mutex_test(struct rt_mu
71207 return;
71208
71209 td->mutexes[dat] = 1;
71210 - td->event = atomic_add_return(1, &rttest_event);
71211 + td->event = atomic_add_return_unchecked(1, &rttest_event);
71212 return;
71213
71214 case RTTEST_LOCKBKL:
71215 diff -urNp linux-2.6.32.49/kernel/sched.c linux-2.6.32.49/kernel/sched.c
71216 --- linux-2.6.32.49/kernel/sched.c 2011-11-08 19:02:43.000000000 -0500
71217 +++ linux-2.6.32.49/kernel/sched.c 2011-11-15 19:59:43.000000000 -0500
71218 @@ -2764,9 +2764,10 @@ void wake_up_new_task(struct task_struct
71219 {
71220 unsigned long flags;
71221 struct rq *rq;
71222 - int cpu = get_cpu();
71223
71224 #ifdef CONFIG_SMP
71225 + int cpu = get_cpu();
71226 +
71227 rq = task_rq_lock(p, &flags);
71228 p->state = TASK_WAKING;
71229
71230 @@ -5043,7 +5044,7 @@ out:
71231 * In CONFIG_NO_HZ case, the idle load balance owner will do the
71232 * rebalancing for all the cpus for whom scheduler ticks are stopped.
71233 */
71234 -static void run_rebalance_domains(struct softirq_action *h)
71235 +static void run_rebalance_domains(void)
71236 {
71237 int this_cpu = smp_processor_id();
71238 struct rq *this_rq = cpu_rq(this_cpu);
71239 @@ -5700,6 +5701,8 @@ asmlinkage void __sched schedule(void)
71240 struct rq *rq;
71241 int cpu;
71242
71243 + pax_track_stack();
71244 +
71245 need_resched:
71246 preempt_disable();
71247 cpu = smp_processor_id();
71248 @@ -5770,7 +5773,7 @@ EXPORT_SYMBOL(schedule);
71249 * Look out! "owner" is an entirely speculative pointer
71250 * access and not reliable.
71251 */
71252 -int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
71253 +int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner)
71254 {
71255 unsigned int cpu;
71256 struct rq *rq;
71257 @@ -5784,10 +5787,10 @@ int mutex_spin_on_owner(struct mutex *lo
71258 * DEBUG_PAGEALLOC could have unmapped it if
71259 * the mutex owner just released it and exited.
71260 */
71261 - if (probe_kernel_address(&owner->cpu, cpu))
71262 + if (probe_kernel_address(&task_thread_info(owner)->cpu, cpu))
71263 return 0;
71264 #else
71265 - cpu = owner->cpu;
71266 + cpu = task_thread_info(owner)->cpu;
71267 #endif
71268
71269 /*
71270 @@ -5816,7 +5819,7 @@ int mutex_spin_on_owner(struct mutex *lo
71271 /*
71272 * Is that owner really running on that cpu?
71273 */
71274 - if (task_thread_info(rq->curr) != owner || need_resched())
71275 + if (rq->curr != owner || need_resched())
71276 return 0;
71277
71278 cpu_relax();
71279 @@ -6359,6 +6362,8 @@ int can_nice(const struct task_struct *p
71280 /* convert nice value [19,-20] to rlimit style value [1,40] */
71281 int nice_rlim = 20 - nice;
71282
71283 + gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
71284 +
71285 return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
71286 capable(CAP_SYS_NICE));
71287 }
71288 @@ -6392,7 +6397,8 @@ SYSCALL_DEFINE1(nice, int, increment)
71289 if (nice > 19)
71290 nice = 19;
71291
71292 - if (increment < 0 && !can_nice(current, nice))
71293 + if (increment < 0 && (!can_nice(current, nice) ||
71294 + gr_handle_chroot_nice()))
71295 return -EPERM;
71296
71297 retval = security_task_setnice(current, nice);
71298 @@ -8774,7 +8780,7 @@ static void init_sched_groups_power(int
71299 long power;
71300 int weight;
71301
71302 - WARN_ON(!sd || !sd->groups);
71303 + BUG_ON(!sd || !sd->groups);
71304
71305 if (cpu != group_first_cpu(sd->groups))
71306 return;
71307 diff -urNp linux-2.6.32.49/kernel/signal.c linux-2.6.32.49/kernel/signal.c
71308 --- linux-2.6.32.49/kernel/signal.c 2011-11-08 19:02:43.000000000 -0500
71309 +++ linux-2.6.32.49/kernel/signal.c 2011-11-15 19:59:43.000000000 -0500
71310 @@ -41,12 +41,12 @@
71311
71312 static struct kmem_cache *sigqueue_cachep;
71313
71314 -static void __user *sig_handler(struct task_struct *t, int sig)
71315 +static __sighandler_t sig_handler(struct task_struct *t, int sig)
71316 {
71317 return t->sighand->action[sig - 1].sa.sa_handler;
71318 }
71319
71320 -static int sig_handler_ignored(void __user *handler, int sig)
71321 +static int sig_handler_ignored(__sighandler_t handler, int sig)
71322 {
71323 /* Is it explicitly or implicitly ignored? */
71324 return handler == SIG_IGN ||
71325 @@ -56,7 +56,7 @@ static int sig_handler_ignored(void __us
71326 static int sig_task_ignored(struct task_struct *t, int sig,
71327 int from_ancestor_ns)
71328 {
71329 - void __user *handler;
71330 + __sighandler_t handler;
71331
71332 handler = sig_handler(t, sig);
71333
71334 @@ -207,6 +207,9 @@ static struct sigqueue *__sigqueue_alloc
71335 */
71336 user = get_uid(__task_cred(t)->user);
71337 atomic_inc(&user->sigpending);
71338 +
71339 + if (!override_rlimit)
71340 + gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
71341 if (override_rlimit ||
71342 atomic_read(&user->sigpending) <=
71343 t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
71344 @@ -327,7 +330,7 @@ flush_signal_handlers(struct task_struct
71345
71346 int unhandled_signal(struct task_struct *tsk, int sig)
71347 {
71348 - void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
71349 + __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
71350 if (is_global_init(tsk))
71351 return 1;
71352 if (handler != SIG_IGN && handler != SIG_DFL)
71353 @@ -627,6 +630,13 @@ static int check_kill_permission(int sig
71354 }
71355 }
71356
71357 + /* allow glibc communication via tgkill to other threads in our
71358 + thread group */
71359 + if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
71360 + sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
71361 + && gr_handle_signal(t, sig))
71362 + return -EPERM;
71363 +
71364 return security_task_kill(t, info, sig, 0);
71365 }
71366
71367 @@ -968,7 +978,7 @@ __group_send_sig_info(int sig, struct si
71368 return send_signal(sig, info, p, 1);
71369 }
71370
71371 -static int
71372 +int
71373 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
71374 {
71375 return send_signal(sig, info, t, 0);
71376 @@ -1005,6 +1015,7 @@ force_sig_info(int sig, struct siginfo *
71377 unsigned long int flags;
71378 int ret, blocked, ignored;
71379 struct k_sigaction *action;
71380 + int is_unhandled = 0;
71381
71382 spin_lock_irqsave(&t->sighand->siglock, flags);
71383 action = &t->sighand->action[sig-1];
71384 @@ -1019,9 +1030,18 @@ force_sig_info(int sig, struct siginfo *
71385 }
71386 if (action->sa.sa_handler == SIG_DFL)
71387 t->signal->flags &= ~SIGNAL_UNKILLABLE;
71388 + if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
71389 + is_unhandled = 1;
71390 ret = specific_send_sig_info(sig, info, t);
71391 spin_unlock_irqrestore(&t->sighand->siglock, flags);
71392
71393 + /* only deal with unhandled signals, java etc trigger SIGSEGV during
71394 + normal operation */
71395 + if (is_unhandled) {
71396 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
71397 + gr_handle_crash(t, sig);
71398 + }
71399 +
71400 return ret;
71401 }
71402
71403 @@ -1081,8 +1101,11 @@ int group_send_sig_info(int sig, struct
71404 {
71405 int ret = check_kill_permission(sig, info, p);
71406
71407 - if (!ret && sig)
71408 + if (!ret && sig) {
71409 ret = do_send_sig_info(sig, info, p, true);
71410 + if (!ret)
71411 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
71412 + }
71413
71414 return ret;
71415 }
71416 @@ -1644,6 +1667,8 @@ void ptrace_notify(int exit_code)
71417 {
71418 siginfo_t info;
71419
71420 + pax_track_stack();
71421 +
71422 BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
71423
71424 memset(&info, 0, sizeof info);
71425 @@ -2275,7 +2300,15 @@ do_send_specific(pid_t tgid, pid_t pid,
71426 int error = -ESRCH;
71427
71428 rcu_read_lock();
71429 - p = find_task_by_vpid(pid);
71430 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
71431 + /* allow glibc communication via tgkill to other threads in our
71432 + thread group */
71433 + if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
71434 + sig == (SIGRTMIN+1) && tgid == info->si_pid)
71435 + p = find_task_by_vpid_unrestricted(pid);
71436 + else
71437 +#endif
71438 + p = find_task_by_vpid(pid);
71439 if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
71440 error = check_kill_permission(sig, info, p);
71441 /*
71442 diff -urNp linux-2.6.32.49/kernel/smp.c linux-2.6.32.49/kernel/smp.c
71443 --- linux-2.6.32.49/kernel/smp.c 2011-11-08 19:02:43.000000000 -0500
71444 +++ linux-2.6.32.49/kernel/smp.c 2011-11-15 19:59:43.000000000 -0500
71445 @@ -522,22 +522,22 @@ int smp_call_function(void (*func)(void
71446 }
71447 EXPORT_SYMBOL(smp_call_function);
71448
71449 -void ipi_call_lock(void)
71450 +void ipi_call_lock(void) __acquires(call_function.lock)
71451 {
71452 spin_lock(&call_function.lock);
71453 }
71454
71455 -void ipi_call_unlock(void)
71456 +void ipi_call_unlock(void) __releases(call_function.lock)
71457 {
71458 spin_unlock(&call_function.lock);
71459 }
71460
71461 -void ipi_call_lock_irq(void)
71462 +void ipi_call_lock_irq(void) __acquires(call_function.lock)
71463 {
71464 spin_lock_irq(&call_function.lock);
71465 }
71466
71467 -void ipi_call_unlock_irq(void)
71468 +void ipi_call_unlock_irq(void) __releases(call_function.lock)
71469 {
71470 spin_unlock_irq(&call_function.lock);
71471 }
71472 diff -urNp linux-2.6.32.49/kernel/softirq.c linux-2.6.32.49/kernel/softirq.c
71473 --- linux-2.6.32.49/kernel/softirq.c 2011-11-08 19:02:43.000000000 -0500
71474 +++ linux-2.6.32.49/kernel/softirq.c 2011-11-15 19:59:43.000000000 -0500
71475 @@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
71476
71477 static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
71478
71479 -char *softirq_to_name[NR_SOFTIRQS] = {
71480 +const char * const softirq_to_name[NR_SOFTIRQS] = {
71481 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
71482 "TASKLET", "SCHED", "HRTIMER", "RCU"
71483 };
71484 @@ -206,7 +206,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
71485
71486 asmlinkage void __do_softirq(void)
71487 {
71488 - struct softirq_action *h;
71489 + const struct softirq_action *h;
71490 __u32 pending;
71491 int max_restart = MAX_SOFTIRQ_RESTART;
71492 int cpu;
71493 @@ -233,7 +233,7 @@ restart:
71494 kstat_incr_softirqs_this_cpu(h - softirq_vec);
71495
71496 trace_softirq_entry(h, softirq_vec);
71497 - h->action(h);
71498 + h->action();
71499 trace_softirq_exit(h, softirq_vec);
71500 if (unlikely(prev_count != preempt_count())) {
71501 printk(KERN_ERR "huh, entered softirq %td %s %p"
71502 @@ -363,9 +363,11 @@ void raise_softirq(unsigned int nr)
71503 local_irq_restore(flags);
71504 }
71505
71506 -void open_softirq(int nr, void (*action)(struct softirq_action *))
71507 +void open_softirq(int nr, void (*action)(void))
71508 {
71509 - softirq_vec[nr].action = action;
71510 + pax_open_kernel();
71511 + *(void **)&softirq_vec[nr].action = action;
71512 + pax_close_kernel();
71513 }
71514
71515 /*
71516 @@ -419,7 +421,7 @@ void __tasklet_hi_schedule_first(struct
71517
71518 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
71519
71520 -static void tasklet_action(struct softirq_action *a)
71521 +static void tasklet_action(void)
71522 {
71523 struct tasklet_struct *list;
71524
71525 @@ -454,7 +456,7 @@ static void tasklet_action(struct softir
71526 }
71527 }
71528
71529 -static void tasklet_hi_action(struct softirq_action *a)
71530 +static void tasklet_hi_action(void)
71531 {
71532 struct tasklet_struct *list;
71533
71534 diff -urNp linux-2.6.32.49/kernel/sys.c linux-2.6.32.49/kernel/sys.c
71535 --- linux-2.6.32.49/kernel/sys.c 2011-11-08 19:02:43.000000000 -0500
71536 +++ linux-2.6.32.49/kernel/sys.c 2011-11-15 19:59:43.000000000 -0500
71537 @@ -133,6 +133,12 @@ static int set_one_prio(struct task_stru
71538 error = -EACCES;
71539 goto out;
71540 }
71541 +
71542 + if (gr_handle_chroot_setpriority(p, niceval)) {
71543 + error = -EACCES;
71544 + goto out;
71545 + }
71546 +
71547 no_nice = security_task_setnice(p, niceval);
71548 if (no_nice) {
71549 error = no_nice;
71550 @@ -190,10 +196,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
71551 !(user = find_user(who)))
71552 goto out_unlock; /* No processes for this user */
71553
71554 - do_each_thread(g, p)
71555 + do_each_thread(g, p) {
71556 if (__task_cred(p)->uid == who)
71557 error = set_one_prio(p, niceval, error);
71558 - while_each_thread(g, p);
71559 + } while_each_thread(g, p);
71560 if (who != cred->uid)
71561 free_uid(user); /* For find_user() */
71562 break;
71563 @@ -253,13 +259,13 @@ SYSCALL_DEFINE2(getpriority, int, which,
71564 !(user = find_user(who)))
71565 goto out_unlock; /* No processes for this user */
71566
71567 - do_each_thread(g, p)
71568 + do_each_thread(g, p) {
71569 if (__task_cred(p)->uid == who) {
71570 niceval = 20 - task_nice(p);
71571 if (niceval > retval)
71572 retval = niceval;
71573 }
71574 - while_each_thread(g, p);
71575 + } while_each_thread(g, p);
71576 if (who != cred->uid)
71577 free_uid(user); /* for find_user() */
71578 break;
71579 @@ -509,6 +515,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
71580 goto error;
71581 }
71582
71583 + if (gr_check_group_change(new->gid, new->egid, -1))
71584 + goto error;
71585 +
71586 if (rgid != (gid_t) -1 ||
71587 (egid != (gid_t) -1 && egid != old->gid))
71588 new->sgid = new->egid;
71589 @@ -542,6 +551,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
71590 goto error;
71591
71592 retval = -EPERM;
71593 +
71594 + if (gr_check_group_change(gid, gid, gid))
71595 + goto error;
71596 +
71597 if (capable(CAP_SETGID))
71598 new->gid = new->egid = new->sgid = new->fsgid = gid;
71599 else if (gid == old->gid || gid == old->sgid)
71600 @@ -567,12 +580,19 @@ static int set_user(struct cred *new)
71601 if (!new_user)
71602 return -EAGAIN;
71603
71604 + /*
71605 + * We don't fail in case of NPROC limit excess here because too many
71606 + * poorly written programs don't check set*uid() return code, assuming
71607 + * it never fails if called by root. We may still enforce NPROC limit
71608 + * for programs doing set*uid()+execve() by harmlessly deferring the
71609 + * failure to the execve() stage.
71610 + */
71611 if (atomic_read(&new_user->processes) >=
71612 current->signal->rlim[RLIMIT_NPROC].rlim_cur &&
71613 - new_user != INIT_USER) {
71614 - free_uid(new_user);
71615 - return -EAGAIN;
71616 - }
71617 + new_user != INIT_USER)
71618 + current->flags |= PF_NPROC_EXCEEDED;
71619 + else
71620 + current->flags &= ~PF_NPROC_EXCEEDED;
71621
71622 free_uid(new->user);
71623 new->user = new_user;
71624 @@ -627,6 +647,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
71625 goto error;
71626 }
71627
71628 + if (gr_check_user_change(new->uid, new->euid, -1))
71629 + goto error;
71630 +
71631 if (new->uid != old->uid) {
71632 retval = set_user(new);
71633 if (retval < 0)
71634 @@ -675,6 +698,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
71635 goto error;
71636
71637 retval = -EPERM;
71638 +
71639 + if (gr_check_crash_uid(uid))
71640 + goto error;
71641 + if (gr_check_user_change(uid, uid, uid))
71642 + goto error;
71643 +
71644 if (capable(CAP_SETUID)) {
71645 new->suid = new->uid = uid;
71646 if (uid != old->uid) {
71647 @@ -732,6 +761,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
71648 goto error;
71649 }
71650
71651 + if (gr_check_user_change(ruid, euid, -1))
71652 + goto error;
71653 +
71654 if (ruid != (uid_t) -1) {
71655 new->uid = ruid;
71656 if (ruid != old->uid) {
71657 @@ -800,6 +832,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
71658 goto error;
71659 }
71660
71661 + if (gr_check_group_change(rgid, egid, -1))
71662 + goto error;
71663 +
71664 if (rgid != (gid_t) -1)
71665 new->gid = rgid;
71666 if (egid != (gid_t) -1)
71667 @@ -849,6 +884,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
71668 if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
71669 goto error;
71670
71671 + if (gr_check_user_change(-1, -1, uid))
71672 + goto error;
71673 +
71674 if (uid == old->uid || uid == old->euid ||
71675 uid == old->suid || uid == old->fsuid ||
71676 capable(CAP_SETUID)) {
71677 @@ -889,6 +927,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
71678 if (gid == old->gid || gid == old->egid ||
71679 gid == old->sgid || gid == old->fsgid ||
71680 capable(CAP_SETGID)) {
71681 + if (gr_check_group_change(-1, -1, gid))
71682 + goto error;
71683 +
71684 if (gid != old_fsgid) {
71685 new->fsgid = gid;
71686 goto change_okay;
71687 @@ -1454,7 +1495,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
71688 error = get_dumpable(me->mm);
71689 break;
71690 case PR_SET_DUMPABLE:
71691 - if (arg2 < 0 || arg2 > 1) {
71692 + if (arg2 > 1) {
71693 error = -EINVAL;
71694 break;
71695 }
71696 diff -urNp linux-2.6.32.49/kernel/sysctl.c linux-2.6.32.49/kernel/sysctl.c
71697 --- linux-2.6.32.49/kernel/sysctl.c 2011-11-08 19:02:43.000000000 -0500
71698 +++ linux-2.6.32.49/kernel/sysctl.c 2011-11-15 19:59:43.000000000 -0500
71699 @@ -63,6 +63,13 @@
71700 static int deprecated_sysctl_warning(struct __sysctl_args *args);
71701
71702 #if defined(CONFIG_SYSCTL)
71703 +#include <linux/grsecurity.h>
71704 +#include <linux/grinternal.h>
71705 +
71706 +extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
71707 +extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
71708 + const int op);
71709 +extern int gr_handle_chroot_sysctl(const int op);
71710
71711 /* External variables not in a header file. */
71712 extern int C_A_D;
71713 @@ -168,6 +175,7 @@ static int proc_do_cad_pid(struct ctl_ta
71714 static int proc_taint(struct ctl_table *table, int write,
71715 void __user *buffer, size_t *lenp, loff_t *ppos);
71716 #endif
71717 +extern ctl_table grsecurity_table[];
71718
71719 static struct ctl_table root_table[];
71720 static struct ctl_table_root sysctl_table_root;
71721 @@ -200,6 +208,21 @@ extern struct ctl_table epoll_table[];
71722 int sysctl_legacy_va_layout;
71723 #endif
71724
71725 +#ifdef CONFIG_PAX_SOFTMODE
71726 +static ctl_table pax_table[] = {
71727 + {
71728 + .ctl_name = CTL_UNNUMBERED,
71729 + .procname = "softmode",
71730 + .data = &pax_softmode,
71731 + .maxlen = sizeof(unsigned int),
71732 + .mode = 0600,
71733 + .proc_handler = &proc_dointvec,
71734 + },
71735 +
71736 + { .ctl_name = 0 }
71737 +};
71738 +#endif
71739 +
71740 extern int prove_locking;
71741 extern int lock_stat;
71742
71743 @@ -251,6 +274,24 @@ static int max_wakeup_granularity_ns = N
71744 #endif
71745
71746 static struct ctl_table kern_table[] = {
71747 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
71748 + {
71749 + .ctl_name = CTL_UNNUMBERED,
71750 + .procname = "grsecurity",
71751 + .mode = 0500,
71752 + .child = grsecurity_table,
71753 + },
71754 +#endif
71755 +
71756 +#ifdef CONFIG_PAX_SOFTMODE
71757 + {
71758 + .ctl_name = CTL_UNNUMBERED,
71759 + .procname = "pax",
71760 + .mode = 0500,
71761 + .child = pax_table,
71762 + },
71763 +#endif
71764 +
71765 {
71766 .ctl_name = CTL_UNNUMBERED,
71767 .procname = "sched_child_runs_first",
71768 @@ -567,8 +608,8 @@ static struct ctl_table kern_table[] = {
71769 .data = &modprobe_path,
71770 .maxlen = KMOD_PATH_LEN,
71771 .mode = 0644,
71772 - .proc_handler = &proc_dostring,
71773 - .strategy = &sysctl_string,
71774 + .proc_handler = &proc_dostring_modpriv,
71775 + .strategy = &sysctl_string_modpriv,
71776 },
71777 {
71778 .ctl_name = CTL_UNNUMBERED,
71779 @@ -1247,6 +1288,13 @@ static struct ctl_table vm_table[] = {
71780 .mode = 0644,
71781 .proc_handler = &proc_dointvec
71782 },
71783 + {
71784 + .procname = "heap_stack_gap",
71785 + .data = &sysctl_heap_stack_gap,
71786 + .maxlen = sizeof(sysctl_heap_stack_gap),
71787 + .mode = 0644,
71788 + .proc_handler = proc_doulongvec_minmax,
71789 + },
71790 #else
71791 {
71792 .ctl_name = CTL_UNNUMBERED,
71793 @@ -1803,6 +1851,8 @@ static int do_sysctl_strategy(struct ctl
71794 return 0;
71795 }
71796
71797 +static int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op);
71798 +
71799 static int parse_table(int __user *name, int nlen,
71800 void __user *oldval, size_t __user *oldlenp,
71801 void __user *newval, size_t newlen,
71802 @@ -1821,7 +1871,7 @@ repeat:
71803 if (n == table->ctl_name) {
71804 int error;
71805 if (table->child) {
71806 - if (sysctl_perm(root, table, MAY_EXEC))
71807 + if (sysctl_perm_nochk(root, table, MAY_EXEC))
71808 return -EPERM;
71809 name++;
71810 nlen--;
71811 @@ -1906,6 +1956,33 @@ int sysctl_perm(struct ctl_table_root *r
71812 int error;
71813 int mode;
71814
71815 + if (table->parent != NULL && table->parent->procname != NULL &&
71816 + table->procname != NULL &&
71817 + gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
71818 + return -EACCES;
71819 + if (gr_handle_chroot_sysctl(op))
71820 + return -EACCES;
71821 + error = gr_handle_sysctl(table, op);
71822 + if (error)
71823 + return error;
71824 +
71825 + error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
71826 + if (error)
71827 + return error;
71828 +
71829 + if (root->permissions)
71830 + mode = root->permissions(root, current->nsproxy, table);
71831 + else
71832 + mode = table->mode;
71833 +
71834 + return test_perm(mode, op);
71835 +}
71836 +
71837 +int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op)
71838 +{
71839 + int error;
71840 + int mode;
71841 +
71842 error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
71843 if (error)
71844 return error;
71845 @@ -2335,6 +2412,16 @@ int proc_dostring(struct ctl_table *tabl
71846 buffer, lenp, ppos);
71847 }
71848
71849 +int proc_dostring_modpriv(struct ctl_table *table, int write,
71850 + void __user *buffer, size_t *lenp, loff_t *ppos)
71851 +{
71852 + if (write && !capable(CAP_SYS_MODULE))
71853 + return -EPERM;
71854 +
71855 + return _proc_do_string(table->data, table->maxlen, write,
71856 + buffer, lenp, ppos);
71857 +}
71858 +
71859
71860 static int do_proc_dointvec_conv(int *negp, unsigned long *lvalp,
71861 int *valp,
71862 @@ -2609,7 +2696,7 @@ static int __do_proc_doulongvec_minmax(v
71863 vleft = table->maxlen / sizeof(unsigned long);
71864 left = *lenp;
71865
71866 - for (; left && vleft--; i++, min++, max++, first=0) {
71867 + for (; left && vleft--; i++, first=0) {
71868 if (write) {
71869 while (left) {
71870 char c;
71871 @@ -2910,6 +2997,12 @@ int proc_dostring(struct ctl_table *tabl
71872 return -ENOSYS;
71873 }
71874
71875 +int proc_dostring_modpriv(struct ctl_table *table, int write,
71876 + void __user *buffer, size_t *lenp, loff_t *ppos)
71877 +{
71878 + return -ENOSYS;
71879 +}
71880 +
71881 int proc_dointvec(struct ctl_table *table, int write,
71882 void __user *buffer, size_t *lenp, loff_t *ppos)
71883 {
71884 @@ -3038,6 +3131,16 @@ int sysctl_string(struct ctl_table *tabl
71885 return 1;
71886 }
71887
71888 +int sysctl_string_modpriv(struct ctl_table *table,
71889 + void __user *oldval, size_t __user *oldlenp,
71890 + void __user *newval, size_t newlen)
71891 +{
71892 + if (newval && newlen && !capable(CAP_SYS_MODULE))
71893 + return -EPERM;
71894 +
71895 + return sysctl_string(table, oldval, oldlenp, newval, newlen);
71896 +}
71897 +
71898 /*
71899 * This function makes sure that all of the integers in the vector
71900 * are between the minimum and maximum values given in the arrays
71901 @@ -3182,6 +3285,13 @@ int sysctl_string(struct ctl_table *tabl
71902 return -ENOSYS;
71903 }
71904
71905 +int sysctl_string_modpriv(struct ctl_table *table,
71906 + void __user *oldval, size_t __user *oldlenp,
71907 + void __user *newval, size_t newlen)
71908 +{
71909 + return -ENOSYS;
71910 +}
71911 +
71912 int sysctl_intvec(struct ctl_table *table,
71913 void __user *oldval, size_t __user *oldlenp,
71914 void __user *newval, size_t newlen)
71915 @@ -3246,6 +3356,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
71916 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
71917 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
71918 EXPORT_SYMBOL(proc_dostring);
71919 +EXPORT_SYMBOL(proc_dostring_modpriv);
71920 EXPORT_SYMBOL(proc_doulongvec_minmax);
71921 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
71922 EXPORT_SYMBOL(register_sysctl_table);
71923 @@ -3254,5 +3365,6 @@ EXPORT_SYMBOL(sysctl_intvec);
71924 EXPORT_SYMBOL(sysctl_jiffies);
71925 EXPORT_SYMBOL(sysctl_ms_jiffies);
71926 EXPORT_SYMBOL(sysctl_string);
71927 +EXPORT_SYMBOL(sysctl_string_modpriv);
71928 EXPORT_SYMBOL(sysctl_data);
71929 EXPORT_SYMBOL(unregister_sysctl_table);
71930 diff -urNp linux-2.6.32.49/kernel/sysctl_check.c linux-2.6.32.49/kernel/sysctl_check.c
71931 --- linux-2.6.32.49/kernel/sysctl_check.c 2011-11-08 19:02:43.000000000 -0500
71932 +++ linux-2.6.32.49/kernel/sysctl_check.c 2011-11-15 19:59:43.000000000 -0500
71933 @@ -1489,10 +1489,12 @@ int sysctl_check_table(struct nsproxy *n
71934 } else {
71935 if ((table->strategy == sysctl_data) ||
71936 (table->strategy == sysctl_string) ||
71937 + (table->strategy == sysctl_string_modpriv) ||
71938 (table->strategy == sysctl_intvec) ||
71939 (table->strategy == sysctl_jiffies) ||
71940 (table->strategy == sysctl_ms_jiffies) ||
71941 (table->proc_handler == proc_dostring) ||
71942 + (table->proc_handler == proc_dostring_modpriv) ||
71943 (table->proc_handler == proc_dointvec) ||
71944 (table->proc_handler == proc_dointvec_minmax) ||
71945 (table->proc_handler == proc_dointvec_jiffies) ||
71946 diff -urNp linux-2.6.32.49/kernel/taskstats.c linux-2.6.32.49/kernel/taskstats.c
71947 --- linux-2.6.32.49/kernel/taskstats.c 2011-11-08 19:02:43.000000000 -0500
71948 +++ linux-2.6.32.49/kernel/taskstats.c 2011-11-15 19:59:43.000000000 -0500
71949 @@ -26,9 +26,12 @@
71950 #include <linux/cgroup.h>
71951 #include <linux/fs.h>
71952 #include <linux/file.h>
71953 +#include <linux/grsecurity.h>
71954 #include <net/genetlink.h>
71955 #include <asm/atomic.h>
71956
71957 +extern int gr_is_taskstats_denied(int pid);
71958 +
71959 /*
71960 * Maximum length of a cpumask that can be specified in
71961 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
71962 @@ -442,6 +445,9 @@ static int taskstats_user_cmd(struct sk_
71963 size_t size;
71964 cpumask_var_t mask;
71965
71966 + if (gr_is_taskstats_denied(current->pid))
71967 + return -EACCES;
71968 +
71969 if (!alloc_cpumask_var(&mask, GFP_KERNEL))
71970 return -ENOMEM;
71971
71972 diff -urNp linux-2.6.32.49/kernel/time/tick-broadcast.c linux-2.6.32.49/kernel/time/tick-broadcast.c
71973 --- linux-2.6.32.49/kernel/time/tick-broadcast.c 2011-11-08 19:02:43.000000000 -0500
71974 +++ linux-2.6.32.49/kernel/time/tick-broadcast.c 2011-11-15 19:59:43.000000000 -0500
71975 @@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct cl
71976 * then clear the broadcast bit.
71977 */
71978 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
71979 - int cpu = smp_processor_id();
71980 + cpu = smp_processor_id();
71981
71982 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
71983 tick_broadcast_clear_oneshot(cpu);
71984 diff -urNp linux-2.6.32.49/kernel/time/timekeeping.c linux-2.6.32.49/kernel/time/timekeeping.c
71985 --- linux-2.6.32.49/kernel/time/timekeeping.c 2011-11-08 19:02:43.000000000 -0500
71986 +++ linux-2.6.32.49/kernel/time/timekeeping.c 2011-11-15 19:59:43.000000000 -0500
71987 @@ -14,6 +14,7 @@
71988 #include <linux/init.h>
71989 #include <linux/mm.h>
71990 #include <linux/sched.h>
71991 +#include <linux/grsecurity.h>
71992 #include <linux/sysdev.h>
71993 #include <linux/clocksource.h>
71994 #include <linux/jiffies.h>
71995 @@ -180,7 +181,7 @@ void update_xtime_cache(u64 nsec)
71996 */
71997 struct timespec ts = xtime;
71998 timespec_add_ns(&ts, nsec);
71999 - ACCESS_ONCE(xtime_cache) = ts;
72000 + ACCESS_ONCE_RW(xtime_cache) = ts;
72001 }
72002
72003 /* must hold xtime_lock */
72004 @@ -333,6 +334,8 @@ int do_settimeofday(struct timespec *tv)
72005 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
72006 return -EINVAL;
72007
72008 + gr_log_timechange();
72009 +
72010 write_seqlock_irqsave(&xtime_lock, flags);
72011
72012 timekeeping_forward_now();
72013 diff -urNp linux-2.6.32.49/kernel/time/timer_list.c linux-2.6.32.49/kernel/time/timer_list.c
72014 --- linux-2.6.32.49/kernel/time/timer_list.c 2011-11-08 19:02:43.000000000 -0500
72015 +++ linux-2.6.32.49/kernel/time/timer_list.c 2011-11-15 19:59:43.000000000 -0500
72016 @@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base,
72017
72018 static void print_name_offset(struct seq_file *m, void *sym)
72019 {
72020 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72021 + SEQ_printf(m, "<%p>", NULL);
72022 +#else
72023 char symname[KSYM_NAME_LEN];
72024
72025 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
72026 SEQ_printf(m, "<%p>", sym);
72027 else
72028 SEQ_printf(m, "%s", symname);
72029 +#endif
72030 }
72031
72032 static void
72033 @@ -112,7 +116,11 @@ next_one:
72034 static void
72035 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
72036 {
72037 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72038 + SEQ_printf(m, " .base: %p\n", NULL);
72039 +#else
72040 SEQ_printf(m, " .base: %p\n", base);
72041 +#endif
72042 SEQ_printf(m, " .index: %d\n",
72043 base->index);
72044 SEQ_printf(m, " .resolution: %Lu nsecs\n",
72045 @@ -289,7 +297,11 @@ static int __init init_timer_list_procfs
72046 {
72047 struct proc_dir_entry *pe;
72048
72049 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
72050 + pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
72051 +#else
72052 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
72053 +#endif
72054 if (!pe)
72055 return -ENOMEM;
72056 return 0;
72057 diff -urNp linux-2.6.32.49/kernel/time/timer_stats.c linux-2.6.32.49/kernel/time/timer_stats.c
72058 --- linux-2.6.32.49/kernel/time/timer_stats.c 2011-11-08 19:02:43.000000000 -0500
72059 +++ linux-2.6.32.49/kernel/time/timer_stats.c 2011-11-15 19:59:43.000000000 -0500
72060 @@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
72061 static unsigned long nr_entries;
72062 static struct entry entries[MAX_ENTRIES];
72063
72064 -static atomic_t overflow_count;
72065 +static atomic_unchecked_t overflow_count;
72066
72067 /*
72068 * The entries are in a hash-table, for fast lookup:
72069 @@ -140,7 +140,7 @@ static void reset_entries(void)
72070 nr_entries = 0;
72071 memset(entries, 0, sizeof(entries));
72072 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
72073 - atomic_set(&overflow_count, 0);
72074 + atomic_set_unchecked(&overflow_count, 0);
72075 }
72076
72077 static struct entry *alloc_entry(void)
72078 @@ -261,7 +261,7 @@ void timer_stats_update_stats(void *time
72079 if (likely(entry))
72080 entry->count++;
72081 else
72082 - atomic_inc(&overflow_count);
72083 + atomic_inc_unchecked(&overflow_count);
72084
72085 out_unlock:
72086 spin_unlock_irqrestore(lock, flags);
72087 @@ -269,12 +269,16 @@ void timer_stats_update_stats(void *time
72088
72089 static void print_name_offset(struct seq_file *m, unsigned long addr)
72090 {
72091 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72092 + seq_printf(m, "<%p>", NULL);
72093 +#else
72094 char symname[KSYM_NAME_LEN];
72095
72096 if (lookup_symbol_name(addr, symname) < 0)
72097 seq_printf(m, "<%p>", (void *)addr);
72098 else
72099 seq_printf(m, "%s", symname);
72100 +#endif
72101 }
72102
72103 static int tstats_show(struct seq_file *m, void *v)
72104 @@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *
72105
72106 seq_puts(m, "Timer Stats Version: v0.2\n");
72107 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
72108 - if (atomic_read(&overflow_count))
72109 + if (atomic_read_unchecked(&overflow_count))
72110 seq_printf(m, "Overflow: %d entries\n",
72111 - atomic_read(&overflow_count));
72112 + atomic_read_unchecked(&overflow_count));
72113
72114 for (i = 0; i < nr_entries; i++) {
72115 entry = entries + i;
72116 @@ -415,7 +419,11 @@ static int __init init_tstats_procfs(voi
72117 {
72118 struct proc_dir_entry *pe;
72119
72120 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
72121 + pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
72122 +#else
72123 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
72124 +#endif
72125 if (!pe)
72126 return -ENOMEM;
72127 return 0;
72128 diff -urNp linux-2.6.32.49/kernel/time.c linux-2.6.32.49/kernel/time.c
72129 --- linux-2.6.32.49/kernel/time.c 2011-11-08 19:02:43.000000000 -0500
72130 +++ linux-2.6.32.49/kernel/time.c 2011-11-15 19:59:43.000000000 -0500
72131 @@ -165,6 +165,11 @@ int do_sys_settimeofday(struct timespec
72132 return error;
72133
72134 if (tz) {
72135 + /* we log in do_settimeofday called below, so don't log twice
72136 + */
72137 + if (!tv)
72138 + gr_log_timechange();
72139 +
72140 /* SMP safe, global irq locking makes it work. */
72141 sys_tz = *tz;
72142 update_vsyscall_tz();
72143 @@ -240,7 +245,7 @@ EXPORT_SYMBOL(current_fs_time);
72144 * Avoid unnecessary multiplications/divisions in the
72145 * two most common HZ cases:
72146 */
72147 -unsigned int inline jiffies_to_msecs(const unsigned long j)
72148 +inline unsigned int jiffies_to_msecs(const unsigned long j)
72149 {
72150 #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
72151 return (MSEC_PER_SEC / HZ) * j;
72152 @@ -256,7 +261,7 @@ unsigned int inline jiffies_to_msecs(con
72153 }
72154 EXPORT_SYMBOL(jiffies_to_msecs);
72155
72156 -unsigned int inline jiffies_to_usecs(const unsigned long j)
72157 +inline unsigned int jiffies_to_usecs(const unsigned long j)
72158 {
72159 #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
72160 return (USEC_PER_SEC / HZ) * j;
72161 diff -urNp linux-2.6.32.49/kernel/timer.c linux-2.6.32.49/kernel/timer.c
72162 --- linux-2.6.32.49/kernel/timer.c 2011-11-08 19:02:43.000000000 -0500
72163 +++ linux-2.6.32.49/kernel/timer.c 2011-11-15 19:59:43.000000000 -0500
72164 @@ -1213,7 +1213,7 @@ void update_process_times(int user_tick)
72165 /*
72166 * This function runs timers and the timer-tq in bottom half context.
72167 */
72168 -static void run_timer_softirq(struct softirq_action *h)
72169 +static void run_timer_softirq(void)
72170 {
72171 struct tvec_base *base = __get_cpu_var(tvec_bases);
72172
72173 diff -urNp linux-2.6.32.49/kernel/trace/blktrace.c linux-2.6.32.49/kernel/trace/blktrace.c
72174 --- linux-2.6.32.49/kernel/trace/blktrace.c 2011-11-08 19:02:43.000000000 -0500
72175 +++ linux-2.6.32.49/kernel/trace/blktrace.c 2011-11-15 19:59:43.000000000 -0500
72176 @@ -313,7 +313,7 @@ static ssize_t blk_dropped_read(struct f
72177 struct blk_trace *bt = filp->private_data;
72178 char buf[16];
72179
72180 - snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
72181 + snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
72182
72183 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
72184 }
72185 @@ -376,7 +376,7 @@ static int blk_subbuf_start_callback(str
72186 return 1;
72187
72188 bt = buf->chan->private_data;
72189 - atomic_inc(&bt->dropped);
72190 + atomic_inc_unchecked(&bt->dropped);
72191 return 0;
72192 }
72193
72194 @@ -477,7 +477,7 @@ int do_blk_trace_setup(struct request_qu
72195
72196 bt->dir = dir;
72197 bt->dev = dev;
72198 - atomic_set(&bt->dropped, 0);
72199 + atomic_set_unchecked(&bt->dropped, 0);
72200
72201 ret = -EIO;
72202 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
72203 diff -urNp linux-2.6.32.49/kernel/trace/ftrace.c linux-2.6.32.49/kernel/trace/ftrace.c
72204 --- linux-2.6.32.49/kernel/trace/ftrace.c 2011-11-08 19:02:43.000000000 -0500
72205 +++ linux-2.6.32.49/kernel/trace/ftrace.c 2011-11-15 19:59:43.000000000 -0500
72206 @@ -1100,13 +1100,18 @@ ftrace_code_disable(struct module *mod,
72207
72208 ip = rec->ip;
72209
72210 + ret = ftrace_arch_code_modify_prepare();
72211 + FTRACE_WARN_ON(ret);
72212 + if (ret)
72213 + return 0;
72214 +
72215 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
72216 + FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
72217 if (ret) {
72218 ftrace_bug(ret, ip);
72219 rec->flags |= FTRACE_FL_FAILED;
72220 - return 0;
72221 }
72222 - return 1;
72223 + return ret ? 0 : 1;
72224 }
72225
72226 /*
72227 diff -urNp linux-2.6.32.49/kernel/trace/ring_buffer.c linux-2.6.32.49/kernel/trace/ring_buffer.c
72228 --- linux-2.6.32.49/kernel/trace/ring_buffer.c 2011-11-08 19:02:43.000000000 -0500
72229 +++ linux-2.6.32.49/kernel/trace/ring_buffer.c 2011-11-15 19:59:43.000000000 -0500
72230 @@ -606,7 +606,7 @@ static struct list_head *rb_list_head(st
72231 * the reader page). But if the next page is a header page,
72232 * its flags will be non zero.
72233 */
72234 -static int inline
72235 +static inline int
72236 rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
72237 struct buffer_page *page, struct list_head *list)
72238 {
72239 diff -urNp linux-2.6.32.49/kernel/trace/trace.c linux-2.6.32.49/kernel/trace/trace.c
72240 --- linux-2.6.32.49/kernel/trace/trace.c 2011-11-08 19:02:43.000000000 -0500
72241 +++ linux-2.6.32.49/kernel/trace/trace.c 2011-11-15 19:59:43.000000000 -0500
72242 @@ -3193,6 +3193,8 @@ static ssize_t tracing_splice_read_pipe(
72243 size_t rem;
72244 unsigned int i;
72245
72246 + pax_track_stack();
72247 +
72248 /* copy the tracer to avoid using a global lock all around */
72249 mutex_lock(&trace_types_lock);
72250 if (unlikely(old_tracer != current_trace && current_trace)) {
72251 @@ -3659,6 +3661,8 @@ tracing_buffers_splice_read(struct file
72252 int entries, size, i;
72253 size_t ret;
72254
72255 + pax_track_stack();
72256 +
72257 if (*ppos & (PAGE_SIZE - 1)) {
72258 WARN_ONCE(1, "Ftrace: previous read must page-align\n");
72259 return -EINVAL;
72260 @@ -3816,10 +3820,9 @@ static const struct file_operations trac
72261 };
72262 #endif
72263
72264 -static struct dentry *d_tracer;
72265 -
72266 struct dentry *tracing_init_dentry(void)
72267 {
72268 + static struct dentry *d_tracer;
72269 static int once;
72270
72271 if (d_tracer)
72272 @@ -3839,10 +3842,9 @@ struct dentry *tracing_init_dentry(void)
72273 return d_tracer;
72274 }
72275
72276 -static struct dentry *d_percpu;
72277 -
72278 struct dentry *tracing_dentry_percpu(void)
72279 {
72280 + static struct dentry *d_percpu;
72281 static int once;
72282 struct dentry *d_tracer;
72283
72284 diff -urNp linux-2.6.32.49/kernel/trace/trace_events.c linux-2.6.32.49/kernel/trace/trace_events.c
72285 --- linux-2.6.32.49/kernel/trace/trace_events.c 2011-11-08 19:02:43.000000000 -0500
72286 +++ linux-2.6.32.49/kernel/trace/trace_events.c 2011-11-15 19:59:43.000000000 -0500
72287 @@ -951,13 +951,10 @@ static LIST_HEAD(ftrace_module_file_list
72288 * Modules must own their file_operations to keep up with
72289 * reference counting.
72290 */
72291 +
72292 struct ftrace_module_file_ops {
72293 struct list_head list;
72294 struct module *mod;
72295 - struct file_operations id;
72296 - struct file_operations enable;
72297 - struct file_operations format;
72298 - struct file_operations filter;
72299 };
72300
72301 static void remove_subsystem_dir(const char *name)
72302 @@ -1004,17 +1001,12 @@ trace_create_file_ops(struct module *mod
72303
72304 file_ops->mod = mod;
72305
72306 - file_ops->id = ftrace_event_id_fops;
72307 - file_ops->id.owner = mod;
72308 -
72309 - file_ops->enable = ftrace_enable_fops;
72310 - file_ops->enable.owner = mod;
72311 -
72312 - file_ops->filter = ftrace_event_filter_fops;
72313 - file_ops->filter.owner = mod;
72314 -
72315 - file_ops->format = ftrace_event_format_fops;
72316 - file_ops->format.owner = mod;
72317 + pax_open_kernel();
72318 + *(void **)&mod->trace_id.owner = mod;
72319 + *(void **)&mod->trace_enable.owner = mod;
72320 + *(void **)&mod->trace_filter.owner = mod;
72321 + *(void **)&mod->trace_format.owner = mod;
72322 + pax_close_kernel();
72323
72324 list_add(&file_ops->list, &ftrace_module_file_list);
72325
72326 @@ -1063,8 +1055,8 @@ static void trace_module_add_events(stru
72327 call->mod = mod;
72328 list_add(&call->list, &ftrace_events);
72329 event_create_dir(call, d_events,
72330 - &file_ops->id, &file_ops->enable,
72331 - &file_ops->filter, &file_ops->format);
72332 + &mod->trace_id, &mod->trace_enable,
72333 + &mod->trace_filter, &mod->trace_format);
72334 }
72335 }
72336
72337 diff -urNp linux-2.6.32.49/kernel/trace/trace_mmiotrace.c linux-2.6.32.49/kernel/trace/trace_mmiotrace.c
72338 --- linux-2.6.32.49/kernel/trace/trace_mmiotrace.c 2011-11-08 19:02:43.000000000 -0500
72339 +++ linux-2.6.32.49/kernel/trace/trace_mmiotrace.c 2011-11-15 19:59:43.000000000 -0500
72340 @@ -23,7 +23,7 @@ struct header_iter {
72341 static struct trace_array *mmio_trace_array;
72342 static bool overrun_detected;
72343 static unsigned long prev_overruns;
72344 -static atomic_t dropped_count;
72345 +static atomic_unchecked_t dropped_count;
72346
72347 static void mmio_reset_data(struct trace_array *tr)
72348 {
72349 @@ -126,7 +126,7 @@ static void mmio_close(struct trace_iter
72350
72351 static unsigned long count_overruns(struct trace_iterator *iter)
72352 {
72353 - unsigned long cnt = atomic_xchg(&dropped_count, 0);
72354 + unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
72355 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
72356
72357 if (over > prev_overruns)
72358 @@ -316,7 +316,7 @@ static void __trace_mmiotrace_rw(struct
72359 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
72360 sizeof(*entry), 0, pc);
72361 if (!event) {
72362 - atomic_inc(&dropped_count);
72363 + atomic_inc_unchecked(&dropped_count);
72364 return;
72365 }
72366 entry = ring_buffer_event_data(event);
72367 @@ -346,7 +346,7 @@ static void __trace_mmiotrace_map(struct
72368 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
72369 sizeof(*entry), 0, pc);
72370 if (!event) {
72371 - atomic_inc(&dropped_count);
72372 + atomic_inc_unchecked(&dropped_count);
72373 return;
72374 }
72375 entry = ring_buffer_event_data(event);
72376 diff -urNp linux-2.6.32.49/kernel/trace/trace_output.c linux-2.6.32.49/kernel/trace/trace_output.c
72377 --- linux-2.6.32.49/kernel/trace/trace_output.c 2011-11-08 19:02:43.000000000 -0500
72378 +++ linux-2.6.32.49/kernel/trace/trace_output.c 2011-11-15 19:59:43.000000000 -0500
72379 @@ -237,7 +237,7 @@ int trace_seq_path(struct trace_seq *s,
72380 return 0;
72381 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
72382 if (!IS_ERR(p)) {
72383 - p = mangle_path(s->buffer + s->len, p, "\n");
72384 + p = mangle_path(s->buffer + s->len, p, "\n\\");
72385 if (p) {
72386 s->len = p - s->buffer;
72387 return 1;
72388 diff -urNp linux-2.6.32.49/kernel/trace/trace_stack.c linux-2.6.32.49/kernel/trace/trace_stack.c
72389 --- linux-2.6.32.49/kernel/trace/trace_stack.c 2011-11-08 19:02:43.000000000 -0500
72390 +++ linux-2.6.32.49/kernel/trace/trace_stack.c 2011-11-15 19:59:43.000000000 -0500
72391 @@ -50,7 +50,7 @@ static inline void check_stack(void)
72392 return;
72393
72394 /* we do not handle interrupt stacks yet */
72395 - if (!object_is_on_stack(&this_size))
72396 + if (!object_starts_on_stack(&this_size))
72397 return;
72398
72399 local_irq_save(flags);
72400 diff -urNp linux-2.6.32.49/kernel/trace/trace_workqueue.c linux-2.6.32.49/kernel/trace/trace_workqueue.c
72401 --- linux-2.6.32.49/kernel/trace/trace_workqueue.c 2011-11-08 19:02:43.000000000 -0500
72402 +++ linux-2.6.32.49/kernel/trace/trace_workqueue.c 2011-11-15 19:59:43.000000000 -0500
72403 @@ -21,7 +21,7 @@ struct cpu_workqueue_stats {
72404 int cpu;
72405 pid_t pid;
72406 /* Can be inserted from interrupt or user context, need to be atomic */
72407 - atomic_t inserted;
72408 + atomic_unchecked_t inserted;
72409 /*
72410 * Don't need to be atomic, works are serialized in a single workqueue thread
72411 * on a single CPU.
72412 @@ -58,7 +58,7 @@ probe_workqueue_insertion(struct task_st
72413 spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
72414 list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
72415 if (node->pid == wq_thread->pid) {
72416 - atomic_inc(&node->inserted);
72417 + atomic_inc_unchecked(&node->inserted);
72418 goto found;
72419 }
72420 }
72421 @@ -205,7 +205,7 @@ static int workqueue_stat_show(struct se
72422 tsk = get_pid_task(pid, PIDTYPE_PID);
72423 if (tsk) {
72424 seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
72425 - atomic_read(&cws->inserted), cws->executed,
72426 + atomic_read_unchecked(&cws->inserted), cws->executed,
72427 tsk->comm);
72428 put_task_struct(tsk);
72429 }
72430 diff -urNp linux-2.6.32.49/kernel/user.c linux-2.6.32.49/kernel/user.c
72431 --- linux-2.6.32.49/kernel/user.c 2011-11-08 19:02:43.000000000 -0500
72432 +++ linux-2.6.32.49/kernel/user.c 2011-11-15 19:59:43.000000000 -0500
72433 @@ -159,6 +159,7 @@ struct user_struct *alloc_uid(struct use
72434 spin_lock_irq(&uidhash_lock);
72435 up = uid_hash_find(uid, hashent);
72436 if (up) {
72437 + put_user_ns(ns);
72438 key_put(new->uid_keyring);
72439 key_put(new->session_keyring);
72440 kmem_cache_free(uid_cachep, new);
72441 diff -urNp linux-2.6.32.49/lib/bitmap.c linux-2.6.32.49/lib/bitmap.c
72442 --- linux-2.6.32.49/lib/bitmap.c 2011-11-08 19:02:43.000000000 -0500
72443 +++ linux-2.6.32.49/lib/bitmap.c 2011-11-15 19:59:43.000000000 -0500
72444 @@ -341,7 +341,7 @@ int __bitmap_parse(const char *buf, unsi
72445 {
72446 int c, old_c, totaldigits, ndigits, nchunks, nbits;
72447 u32 chunk;
72448 - const char __user *ubuf = buf;
72449 + const char __user *ubuf = (const char __force_user *)buf;
72450
72451 bitmap_zero(maskp, nmaskbits);
72452
72453 @@ -426,7 +426,7 @@ int bitmap_parse_user(const char __user
72454 {
72455 if (!access_ok(VERIFY_READ, ubuf, ulen))
72456 return -EFAULT;
72457 - return __bitmap_parse((const char *)ubuf, ulen, 1, maskp, nmaskbits);
72458 + return __bitmap_parse((const char __force_kernel *)ubuf, ulen, 1, maskp, nmaskbits);
72459 }
72460 EXPORT_SYMBOL(bitmap_parse_user);
72461
72462 diff -urNp linux-2.6.32.49/lib/bug.c linux-2.6.32.49/lib/bug.c
72463 --- linux-2.6.32.49/lib/bug.c 2011-11-08 19:02:43.000000000 -0500
72464 +++ linux-2.6.32.49/lib/bug.c 2011-11-15 19:59:43.000000000 -0500
72465 @@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned l
72466 return BUG_TRAP_TYPE_NONE;
72467
72468 bug = find_bug(bugaddr);
72469 + if (!bug)
72470 + return BUG_TRAP_TYPE_NONE;
72471
72472 printk(KERN_EMERG "------------[ cut here ]------------\n");
72473
72474 diff -urNp linux-2.6.32.49/lib/debugobjects.c linux-2.6.32.49/lib/debugobjects.c
72475 --- linux-2.6.32.49/lib/debugobjects.c 2011-11-08 19:02:43.000000000 -0500
72476 +++ linux-2.6.32.49/lib/debugobjects.c 2011-11-15 19:59:43.000000000 -0500
72477 @@ -277,7 +277,7 @@ static void debug_object_is_on_stack(voi
72478 if (limit > 4)
72479 return;
72480
72481 - is_on_stack = object_is_on_stack(addr);
72482 + is_on_stack = object_starts_on_stack(addr);
72483 if (is_on_stack == onstack)
72484 return;
72485
72486 diff -urNp linux-2.6.32.49/lib/devres.c linux-2.6.32.49/lib/devres.c
72487 --- linux-2.6.32.49/lib/devres.c 2011-11-08 19:02:43.000000000 -0500
72488 +++ linux-2.6.32.49/lib/devres.c 2011-11-15 19:59:43.000000000 -0500
72489 @@ -80,7 +80,7 @@ void devm_iounmap(struct device *dev, vo
72490 {
72491 iounmap(addr);
72492 WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match,
72493 - (void *)addr));
72494 + (void __force *)addr));
72495 }
72496 EXPORT_SYMBOL(devm_iounmap);
72497
72498 @@ -140,7 +140,7 @@ void devm_ioport_unmap(struct device *de
72499 {
72500 ioport_unmap(addr);
72501 WARN_ON(devres_destroy(dev, devm_ioport_map_release,
72502 - devm_ioport_map_match, (void *)addr));
72503 + devm_ioport_map_match, (void __force *)addr));
72504 }
72505 EXPORT_SYMBOL(devm_ioport_unmap);
72506
72507 diff -urNp linux-2.6.32.49/lib/dma-debug.c linux-2.6.32.49/lib/dma-debug.c
72508 --- linux-2.6.32.49/lib/dma-debug.c 2011-11-08 19:02:43.000000000 -0500
72509 +++ linux-2.6.32.49/lib/dma-debug.c 2011-11-15 19:59:43.000000000 -0500
72510 @@ -861,7 +861,7 @@ out:
72511
72512 static void check_for_stack(struct device *dev, void *addr)
72513 {
72514 - if (object_is_on_stack(addr))
72515 + if (object_starts_on_stack(addr))
72516 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
72517 "stack [addr=%p]\n", addr);
72518 }
72519 diff -urNp linux-2.6.32.49/lib/idr.c linux-2.6.32.49/lib/idr.c
72520 --- linux-2.6.32.49/lib/idr.c 2011-11-08 19:02:43.000000000 -0500
72521 +++ linux-2.6.32.49/lib/idr.c 2011-11-15 19:59:43.000000000 -0500
72522 @@ -156,7 +156,7 @@ static int sub_alloc(struct idr *idp, in
72523 id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
72524
72525 /* if already at the top layer, we need to grow */
72526 - if (id >= 1 << (idp->layers * IDR_BITS)) {
72527 + if (id >= (1 << (idp->layers * IDR_BITS))) {
72528 *starting_id = id;
72529 return IDR_NEED_TO_GROW;
72530 }
72531 diff -urNp linux-2.6.32.49/lib/inflate.c linux-2.6.32.49/lib/inflate.c
72532 --- linux-2.6.32.49/lib/inflate.c 2011-11-08 19:02:43.000000000 -0500
72533 +++ linux-2.6.32.49/lib/inflate.c 2011-11-15 19:59:43.000000000 -0500
72534 @@ -266,7 +266,7 @@ static void free(void *where)
72535 malloc_ptr = free_mem_ptr;
72536 }
72537 #else
72538 -#define malloc(a) kmalloc(a, GFP_KERNEL)
72539 +#define malloc(a) kmalloc((a), GFP_KERNEL)
72540 #define free(a) kfree(a)
72541 #endif
72542
72543 diff -urNp linux-2.6.32.49/lib/Kconfig.debug linux-2.6.32.49/lib/Kconfig.debug
72544 --- linux-2.6.32.49/lib/Kconfig.debug 2011-11-08 19:02:43.000000000 -0500
72545 +++ linux-2.6.32.49/lib/Kconfig.debug 2011-11-15 19:59:43.000000000 -0500
72546 @@ -905,7 +905,7 @@ config LATENCYTOP
72547 select STACKTRACE
72548 select SCHEDSTATS
72549 select SCHED_DEBUG
72550 - depends on HAVE_LATENCYTOP_SUPPORT
72551 + depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
72552 help
72553 Enable this option if you want to use the LatencyTOP tool
72554 to find out which userspace is blocking on what kernel operations.
72555 diff -urNp linux-2.6.32.49/lib/kobject.c linux-2.6.32.49/lib/kobject.c
72556 --- linux-2.6.32.49/lib/kobject.c 2011-11-08 19:02:43.000000000 -0500
72557 +++ linux-2.6.32.49/lib/kobject.c 2011-11-15 19:59:43.000000000 -0500
72558 @@ -700,7 +700,7 @@ static ssize_t kobj_attr_store(struct ko
72559 return ret;
72560 }
72561
72562 -struct sysfs_ops kobj_sysfs_ops = {
72563 +const struct sysfs_ops kobj_sysfs_ops = {
72564 .show = kobj_attr_show,
72565 .store = kobj_attr_store,
72566 };
72567 @@ -789,7 +789,7 @@ static struct kobj_type kset_ktype = {
72568 * If the kset was not able to be created, NULL will be returned.
72569 */
72570 static struct kset *kset_create(const char *name,
72571 - struct kset_uevent_ops *uevent_ops,
72572 + const struct kset_uevent_ops *uevent_ops,
72573 struct kobject *parent_kobj)
72574 {
72575 struct kset *kset;
72576 @@ -832,7 +832,7 @@ static struct kset *kset_create(const ch
72577 * If the kset was not able to be created, NULL will be returned.
72578 */
72579 struct kset *kset_create_and_add(const char *name,
72580 - struct kset_uevent_ops *uevent_ops,
72581 + const struct kset_uevent_ops *uevent_ops,
72582 struct kobject *parent_kobj)
72583 {
72584 struct kset *kset;
72585 diff -urNp linux-2.6.32.49/lib/kobject_uevent.c linux-2.6.32.49/lib/kobject_uevent.c
72586 --- linux-2.6.32.49/lib/kobject_uevent.c 2011-11-08 19:02:43.000000000 -0500
72587 +++ linux-2.6.32.49/lib/kobject_uevent.c 2011-11-15 19:59:43.000000000 -0500
72588 @@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *k
72589 const char *subsystem;
72590 struct kobject *top_kobj;
72591 struct kset *kset;
72592 - struct kset_uevent_ops *uevent_ops;
72593 + const struct kset_uevent_ops *uevent_ops;
72594 u64 seq;
72595 int i = 0;
72596 int retval = 0;
72597 diff -urNp linux-2.6.32.49/lib/kref.c linux-2.6.32.49/lib/kref.c
72598 --- linux-2.6.32.49/lib/kref.c 2011-11-08 19:02:43.000000000 -0500
72599 +++ linux-2.6.32.49/lib/kref.c 2011-11-15 19:59:43.000000000 -0500
72600 @@ -61,7 +61,7 @@ void kref_get(struct kref *kref)
72601 */
72602 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
72603 {
72604 - WARN_ON(release == NULL);
72605 + BUG_ON(release == NULL);
72606 WARN_ON(release == (void (*)(struct kref *))kfree);
72607
72608 if (atomic_dec_and_test(&kref->refcount)) {
72609 diff -urNp linux-2.6.32.49/lib/parser.c linux-2.6.32.49/lib/parser.c
72610 --- linux-2.6.32.49/lib/parser.c 2011-11-08 19:02:43.000000000 -0500
72611 +++ linux-2.6.32.49/lib/parser.c 2011-11-15 19:59:43.000000000 -0500
72612 @@ -126,7 +126,7 @@ static int match_number(substring_t *s,
72613 char *buf;
72614 int ret;
72615
72616 - buf = kmalloc(s->to - s->from + 1, GFP_KERNEL);
72617 + buf = kmalloc((s->to - s->from) + 1, GFP_KERNEL);
72618 if (!buf)
72619 return -ENOMEM;
72620 memcpy(buf, s->from, s->to - s->from);
72621 diff -urNp linux-2.6.32.49/lib/radix-tree.c linux-2.6.32.49/lib/radix-tree.c
72622 --- linux-2.6.32.49/lib/radix-tree.c 2011-11-08 19:02:43.000000000 -0500
72623 +++ linux-2.6.32.49/lib/radix-tree.c 2011-11-15 19:59:43.000000000 -0500
72624 @@ -81,7 +81,7 @@ struct radix_tree_preload {
72625 int nr;
72626 struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
72627 };
72628 -static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
72629 +static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
72630
72631 static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
72632 {
72633 diff -urNp linux-2.6.32.49/lib/random32.c linux-2.6.32.49/lib/random32.c
72634 --- linux-2.6.32.49/lib/random32.c 2011-11-08 19:02:43.000000000 -0500
72635 +++ linux-2.6.32.49/lib/random32.c 2011-11-15 19:59:43.000000000 -0500
72636 @@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *
72637 */
72638 static inline u32 __seed(u32 x, u32 m)
72639 {
72640 - return (x < m) ? x + m : x;
72641 + return (x <= m) ? x + m + 1 : x;
72642 }
72643
72644 /**
72645 diff -urNp linux-2.6.32.49/lib/vsprintf.c linux-2.6.32.49/lib/vsprintf.c
72646 --- linux-2.6.32.49/lib/vsprintf.c 2011-11-08 19:02:43.000000000 -0500
72647 +++ linux-2.6.32.49/lib/vsprintf.c 2011-11-15 19:59:43.000000000 -0500
72648 @@ -16,6 +16,9 @@
72649 * - scnprintf and vscnprintf
72650 */
72651
72652 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72653 +#define __INCLUDED_BY_HIDESYM 1
72654 +#endif
72655 #include <stdarg.h>
72656 #include <linux/module.h>
72657 #include <linux/types.h>
72658 @@ -546,12 +549,12 @@ static char *number(char *buf, char *end
72659 return buf;
72660 }
72661
72662 -static char *string(char *buf, char *end, char *s, struct printf_spec spec)
72663 +static char *string(char *buf, char *end, const char *s, struct printf_spec spec)
72664 {
72665 int len, i;
72666
72667 if ((unsigned long)s < PAGE_SIZE)
72668 - s = "<NULL>";
72669 + s = "(null)";
72670
72671 len = strnlen(s, spec.precision);
72672
72673 @@ -581,7 +584,7 @@ static char *symbol_string(char *buf, ch
72674 unsigned long value = (unsigned long) ptr;
72675 #ifdef CONFIG_KALLSYMS
72676 char sym[KSYM_SYMBOL_LEN];
72677 - if (ext != 'f' && ext != 's')
72678 + if (ext != 'f' && ext != 's' && ext != 'a')
72679 sprint_symbol(sym, value);
72680 else
72681 kallsyms_lookup(value, NULL, NULL, NULL, sym);
72682 @@ -801,6 +804,8 @@ static char *ip4_addr_string(char *buf,
72683 * - 'f' For simple symbolic function names without offset
72684 * - 'S' For symbolic direct pointers with offset
72685 * - 's' For symbolic direct pointers without offset
72686 + * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
72687 + * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
72688 * - 'R' For a struct resource pointer, it prints the range of
72689 * addresses (not the name nor the flags)
72690 * - 'M' For a 6-byte MAC address, it prints the address in the
72691 @@ -822,7 +827,7 @@ static char *pointer(const char *fmt, ch
72692 struct printf_spec spec)
72693 {
72694 if (!ptr)
72695 - return string(buf, end, "(null)", spec);
72696 + return string(buf, end, "(nil)", spec);
72697
72698 switch (*fmt) {
72699 case 'F':
72700 @@ -831,6 +836,14 @@ static char *pointer(const char *fmt, ch
72701 case 's':
72702 /* Fallthrough */
72703 case 'S':
72704 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72705 + break;
72706 +#else
72707 + return symbol_string(buf, end, ptr, spec, *fmt);
72708 +#endif
72709 + case 'a':
72710 + /* Fallthrough */
72711 + case 'A':
72712 return symbol_string(buf, end, ptr, spec, *fmt);
72713 case 'R':
72714 return resource_string(buf, end, ptr, spec);
72715 @@ -1445,7 +1458,7 @@ do { \
72716 size_t len;
72717 if ((unsigned long)save_str > (unsigned long)-PAGE_SIZE
72718 || (unsigned long)save_str < PAGE_SIZE)
72719 - save_str = "<NULL>";
72720 + save_str = "(null)";
72721 len = strlen(save_str);
72722 if (str + len + 1 < end)
72723 memcpy(str, save_str, len + 1);
72724 @@ -1555,11 +1568,11 @@ int bstr_printf(char *buf, size_t size,
72725 typeof(type) value; \
72726 if (sizeof(type) == 8) { \
72727 args = PTR_ALIGN(args, sizeof(u32)); \
72728 - *(u32 *)&value = *(u32 *)args; \
72729 - *((u32 *)&value + 1) = *(u32 *)(args + 4); \
72730 + *(u32 *)&value = *(const u32 *)args; \
72731 + *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
72732 } else { \
72733 args = PTR_ALIGN(args, sizeof(type)); \
72734 - value = *(typeof(type) *)args; \
72735 + value = *(const typeof(type) *)args; \
72736 } \
72737 args += sizeof(type); \
72738 value; \
72739 @@ -1622,7 +1635,7 @@ int bstr_printf(char *buf, size_t size,
72740 const char *str_arg = args;
72741 size_t len = strlen(str_arg);
72742 args += len + 1;
72743 - str = string(str, end, (char *)str_arg, spec);
72744 + str = string(str, end, str_arg, spec);
72745 break;
72746 }
72747
72748 diff -urNp linux-2.6.32.49/localversion-grsec linux-2.6.32.49/localversion-grsec
72749 --- linux-2.6.32.49/localversion-grsec 1969-12-31 19:00:00.000000000 -0500
72750 +++ linux-2.6.32.49/localversion-grsec 2011-11-15 19:59:43.000000000 -0500
72751 @@ -0,0 +1 @@
72752 +-grsec
72753 diff -urNp linux-2.6.32.49/Makefile linux-2.6.32.49/Makefile
72754 --- linux-2.6.32.49/Makefile 2011-11-26 19:44:53.000000000 -0500
72755 +++ linux-2.6.32.49/Makefile 2011-11-26 19:45:05.000000000 -0500
72756 @@ -221,8 +221,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
72757
72758 HOSTCC = gcc
72759 HOSTCXX = g++
72760 -HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
72761 -HOSTCXXFLAGS = -O2
72762 +HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
72763 +HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
72764 +HOSTCXXFLAGS = -O2 -Wall -W -fno-delete-null-pointer-checks
72765
72766 # Decide whether to build built-in, modular, or both.
72767 # Normally, just do built-in.
72768 @@ -376,8 +377,8 @@ export RCS_TAR_IGNORE := --exclude SCCS
72769 # Rules shared between *config targets and build targets
72770
72771 # Basic helpers built in scripts/
72772 -PHONY += scripts_basic
72773 -scripts_basic:
72774 +PHONY += scripts_basic gcc-plugins
72775 +scripts_basic: gcc-plugins
72776 $(Q)$(MAKE) $(build)=scripts/basic
72777
72778 # To avoid any implicit rule to kick in, define an empty command.
72779 @@ -403,7 +404,7 @@ endif
72780 # of make so .config is not included in this case either (for *config).
72781
72782 no-dot-config-targets := clean mrproper distclean \
72783 - cscope TAGS tags help %docs check% \
72784 + cscope gtags TAGS tags help %docs check% \
72785 include/linux/version.h headers_% \
72786 kernelrelease kernelversion
72787
72788 @@ -526,6 +527,41 @@ else
72789 KBUILD_CFLAGS += -O2
72790 endif
72791
72792 +ifndef DISABLE_PAX_PLUGINS
72793 +ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(CC)"), y)
72794 +ifndef DISABLE_PAX_CONSTIFY_PLUGIN
72795 +CONSTIFY_PLUGIN := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
72796 +endif
72797 +ifdef CONFIG_PAX_MEMORY_STACKLEAK
72798 +STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -DSTACKLEAK_PLUGIN
72799 +STACKLEAK_PLUGIN += -fplugin-arg-stackleak_plugin-track-lowest-sp=100
72800 +endif
72801 +ifdef CONFIG_KALLOCSTAT_PLUGIN
72802 +KALLOCSTAT_PLUGIN := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
72803 +endif
72804 +ifdef CONFIG_PAX_KERNEXEC_PLUGIN
72805 +KERNEXEC_PLUGIN := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
72806 +endif
72807 +ifdef CONFIG_CHECKER_PLUGIN
72808 +ifeq ($(call cc-ifversion, -ge, 0406, y), y)
72809 +CHECKER_PLUGIN := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
72810 +endif
72811 +endif
72812 +GCC_PLUGINS := $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) $(KALLOCSTAT_PLUGIN) $(KERNEXEC_PLUGIN) $(CHECKER_PLUGIN)
72813 +export CONSTIFY_PLUGIN STACKLEAK_PLUGIN KERNEXEC_PLUGIN CHECKER_PLUGIN
72814 +gcc-plugins:
72815 + $(Q)$(MAKE) $(build)=tools/gcc
72816 +else
72817 +gcc-plugins:
72818 +ifeq ($(call cc-ifversion, -ge, 0405, y), y)
72819 + $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev. If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.))
72820 +else
72821 + $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
72822 +endif
72823 + $(Q)echo "PAX_MEMORY_STACKLEAK and constification will be less secure"
72824 +endif
72825 +endif
72826 +
72827 include $(srctree)/arch/$(SRCARCH)/Makefile
72828
72829 ifneq ($(CONFIG_FRAME_WARN),0)
72830 @@ -647,7 +683,7 @@ export mod_strip_cmd
72831
72832
72833 ifeq ($(KBUILD_EXTMOD),)
72834 -core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
72835 +core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
72836
72837 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
72838 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
72839 @@ -868,6 +904,7 @@ vmlinux.o: $(modpost-init) $(vmlinux-mai
72840
72841 # The actual objects are generated when descending,
72842 # make sure no implicit rule kicks in
72843 +$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): KBUILD_CFLAGS += $(GCC_PLUGINS)
72844 $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
72845
72846 # Handle descending into subdirectories listed in $(vmlinux-dirs)
72847 @@ -877,7 +914,7 @@ $(sort $(vmlinux-init) $(vmlinux-main))
72848 # Error messages still appears in the original language
72849
72850 PHONY += $(vmlinux-dirs)
72851 -$(vmlinux-dirs): prepare scripts
72852 +$(vmlinux-dirs): gcc-plugins prepare scripts
72853 $(Q)$(MAKE) $(build)=$@
72854
72855 # Build the kernel release string
72856 @@ -986,6 +1023,7 @@ prepare0: archprepare FORCE
72857 $(Q)$(MAKE) $(build)=. missing-syscalls
72858
72859 # All the preparing..
72860 +prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS),$(KBUILD_CFLAGS))
72861 prepare: prepare0
72862
72863 # The asm symlink changes when $(ARCH) changes.
72864 @@ -1127,6 +1165,7 @@ all: modules
72865 # using awk while concatenating to the final file.
72866
72867 PHONY += modules
72868 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
72869 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux)
72870 $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
72871 @$(kecho) ' Building modules, stage 2.';
72872 @@ -1136,7 +1175,7 @@ modules: $(vmlinux-dirs) $(if $(KBUILD_B
72873
72874 # Target to prepare building external modules
72875 PHONY += modules_prepare
72876 -modules_prepare: prepare scripts
72877 +modules_prepare: gcc-plugins prepare scripts
72878
72879 # Target to install modules
72880 PHONY += modules_install
72881 @@ -1201,7 +1240,7 @@ MRPROPER_FILES += .config .config.old in
72882 include/linux/autoconf.h include/linux/version.h \
72883 include/linux/utsrelease.h \
72884 include/linux/bounds.h include/asm*/asm-offsets.h \
72885 - Module.symvers Module.markers tags TAGS cscope*
72886 + Module.symvers Module.markers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS
72887
72888 # clean - Delete most, but leave enough to build external modules
72889 #
72890 @@ -1245,7 +1284,7 @@ distclean: mrproper
72891 @find $(srctree) $(RCS_FIND_IGNORE) \
72892 \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
72893 -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
72894 - -o -name '.*.rej' -o -size 0 \
72895 + -o -name '.*.rej' -o -name '*.so' -o -size 0 \
72896 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
72897 -type f -print | xargs rm -f
72898
72899 @@ -1292,6 +1331,7 @@ help:
72900 @echo ' modules_prepare - Set up for building external modules'
72901 @echo ' tags/TAGS - Generate tags file for editors'
72902 @echo ' cscope - Generate cscope index'
72903 + @echo ' gtags - Generate GNU GLOBAL index'
72904 @echo ' kernelrelease - Output the release version string'
72905 @echo ' kernelversion - Output the version stored in Makefile'
72906 @echo ' headers_install - Install sanitised kernel headers to INSTALL_HDR_PATH'; \
72907 @@ -1393,6 +1433,7 @@ PHONY += $(module-dirs) modules
72908 $(module-dirs): crmodverdir $(objtree)/Module.symvers
72909 $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
72910
72911 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
72912 modules: $(module-dirs)
72913 @$(kecho) ' Building modules, stage 2.';
72914 $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
72915 @@ -1448,7 +1489,7 @@ endif # KBUILD_EXTMOD
72916 quiet_cmd_tags = GEN $@
72917 cmd_tags = $(CONFIG_SHELL) $(srctree)/scripts/tags.sh $@
72918
72919 -tags TAGS cscope: FORCE
72920 +tags TAGS cscope gtags: FORCE
72921 $(call cmd,tags)
72922
72923 # Scripts to check various things for consistency
72924 @@ -1513,17 +1554,19 @@ else
72925 target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
72926 endif
72927
72928 -%.s: %.c prepare scripts FORCE
72929 +%.s: KBUILD_CFLAGS += $(GCC_PLUGINS)
72930 +%.s: %.c gcc-plugins prepare scripts FORCE
72931 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
72932 %.i: %.c prepare scripts FORCE
72933 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
72934 -%.o: %.c prepare scripts FORCE
72935 +%.o: KBUILD_CFLAGS += $(GCC_PLUGINS)
72936 +%.o: %.c gcc-plugins prepare scripts FORCE
72937 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
72938 %.lst: %.c prepare scripts FORCE
72939 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
72940 -%.s: %.S prepare scripts FORCE
72941 +%.s: %.S gcc-plugins prepare scripts FORCE
72942 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
72943 -%.o: %.S prepare scripts FORCE
72944 +%.o: %.S gcc-plugins prepare scripts FORCE
72945 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
72946 %.symtypes: %.c prepare scripts FORCE
72947 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
72948 @@ -1533,11 +1576,13 @@ endif
72949 $(cmd_crmodverdir)
72950 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
72951 $(build)=$(build-dir)
72952 -%/: prepare scripts FORCE
72953 +%/: KBUILD_CFLAGS += $(GCC_PLUGINS)
72954 +%/: gcc-plugins prepare scripts FORCE
72955 $(cmd_crmodverdir)
72956 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
72957 $(build)=$(build-dir)
72958 -%.ko: prepare scripts FORCE
72959 +%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS)
72960 +%.ko: gcc-plugins prepare scripts FORCE
72961 $(cmd_crmodverdir)
72962 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
72963 $(build)=$(build-dir) $(@:.ko=.o)
72964 diff -urNp linux-2.6.32.49/mm/backing-dev.c linux-2.6.32.49/mm/backing-dev.c
72965 --- linux-2.6.32.49/mm/backing-dev.c 2011-11-08 19:02:43.000000000 -0500
72966 +++ linux-2.6.32.49/mm/backing-dev.c 2011-11-15 19:59:43.000000000 -0500
72967 @@ -272,7 +272,7 @@ static void bdi_task_init(struct backing
72968 list_add_tail_rcu(&wb->list, &bdi->wb_list);
72969 spin_unlock(&bdi->wb_lock);
72970
72971 - tsk->flags |= PF_FLUSHER | PF_SWAPWRITE;
72972 + tsk->flags |= PF_SWAPWRITE;
72973 set_freezable();
72974
72975 /*
72976 @@ -484,7 +484,7 @@ static void bdi_add_to_pending(struct rc
72977 * Add the default flusher task that gets created for any bdi
72978 * that has dirty data pending writeout
72979 */
72980 -void static bdi_add_default_flusher_task(struct backing_dev_info *bdi)
72981 +static void bdi_add_default_flusher_task(struct backing_dev_info *bdi)
72982 {
72983 if (!bdi_cap_writeback_dirty(bdi))
72984 return;
72985 diff -urNp linux-2.6.32.49/mm/filemap.c linux-2.6.32.49/mm/filemap.c
72986 --- linux-2.6.32.49/mm/filemap.c 2011-11-08 19:02:43.000000000 -0500
72987 +++ linux-2.6.32.49/mm/filemap.c 2011-11-15 19:59:43.000000000 -0500
72988 @@ -1631,7 +1631,7 @@ int generic_file_mmap(struct file * file
72989 struct address_space *mapping = file->f_mapping;
72990
72991 if (!mapping->a_ops->readpage)
72992 - return -ENOEXEC;
72993 + return -ENODEV;
72994 file_accessed(file);
72995 vma->vm_ops = &generic_file_vm_ops;
72996 vma->vm_flags |= VM_CAN_NONLINEAR;
72997 @@ -2027,6 +2027,7 @@ inline int generic_write_checks(struct f
72998 *pos = i_size_read(inode);
72999
73000 if (limit != RLIM_INFINITY) {
73001 + gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
73002 if (*pos >= limit) {
73003 send_sig(SIGXFSZ, current, 0);
73004 return -EFBIG;
73005 diff -urNp linux-2.6.32.49/mm/fremap.c linux-2.6.32.49/mm/fremap.c
73006 --- linux-2.6.32.49/mm/fremap.c 2011-11-08 19:02:43.000000000 -0500
73007 +++ linux-2.6.32.49/mm/fremap.c 2011-11-15 19:59:43.000000000 -0500
73008 @@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
73009 retry:
73010 vma = find_vma(mm, start);
73011
73012 +#ifdef CONFIG_PAX_SEGMEXEC
73013 + if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
73014 + goto out;
73015 +#endif
73016 +
73017 /*
73018 * Make sure the vma is shared, that it supports prefaulting,
73019 * and that the remapped range is valid and fully within
73020 @@ -221,7 +226,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
73021 /*
73022 * drop PG_Mlocked flag for over-mapped range
73023 */
73024 - unsigned int saved_flags = vma->vm_flags;
73025 + unsigned long saved_flags = vma->vm_flags;
73026 munlock_vma_pages_range(vma, start, start + size);
73027 vma->vm_flags = saved_flags;
73028 }
73029 diff -urNp linux-2.6.32.49/mm/highmem.c linux-2.6.32.49/mm/highmem.c
73030 --- linux-2.6.32.49/mm/highmem.c 2011-11-08 19:02:43.000000000 -0500
73031 +++ linux-2.6.32.49/mm/highmem.c 2011-11-15 19:59:43.000000000 -0500
73032 @@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
73033 * So no dangers, even with speculative execution.
73034 */
73035 page = pte_page(pkmap_page_table[i]);
73036 + pax_open_kernel();
73037 pte_clear(&init_mm, (unsigned long)page_address(page),
73038 &pkmap_page_table[i]);
73039 -
73040 + pax_close_kernel();
73041 set_page_address(page, NULL);
73042 need_flush = 1;
73043 }
73044 @@ -177,9 +178,11 @@ start:
73045 }
73046 }
73047 vaddr = PKMAP_ADDR(last_pkmap_nr);
73048 +
73049 + pax_open_kernel();
73050 set_pte_at(&init_mm, vaddr,
73051 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
73052 -
73053 + pax_close_kernel();
73054 pkmap_count[last_pkmap_nr] = 1;
73055 set_page_address(page, (void *)vaddr);
73056
73057 diff -urNp linux-2.6.32.49/mm/hugetlb.c linux-2.6.32.49/mm/hugetlb.c
73058 --- linux-2.6.32.49/mm/hugetlb.c 2011-11-08 19:02:43.000000000 -0500
73059 +++ linux-2.6.32.49/mm/hugetlb.c 2011-11-15 19:59:43.000000000 -0500
73060 @@ -1933,6 +1933,26 @@ static int unmap_ref_private(struct mm_s
73061 return 1;
73062 }
73063
73064 +#ifdef CONFIG_PAX_SEGMEXEC
73065 +static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
73066 +{
73067 + struct mm_struct *mm = vma->vm_mm;
73068 + struct vm_area_struct *vma_m;
73069 + unsigned long address_m;
73070 + pte_t *ptep_m;
73071 +
73072 + vma_m = pax_find_mirror_vma(vma);
73073 + if (!vma_m)
73074 + return;
73075 +
73076 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
73077 + address_m = address + SEGMEXEC_TASK_SIZE;
73078 + ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
73079 + get_page(page_m);
73080 + set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
73081 +}
73082 +#endif
73083 +
73084 static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
73085 unsigned long address, pte_t *ptep, pte_t pte,
73086 struct page *pagecache_page)
73087 @@ -2004,6 +2024,11 @@ retry_avoidcopy:
73088 huge_ptep_clear_flush(vma, address, ptep);
73089 set_huge_pte_at(mm, address, ptep,
73090 make_huge_pte(vma, new_page, 1));
73091 +
73092 +#ifdef CONFIG_PAX_SEGMEXEC
73093 + pax_mirror_huge_pte(vma, address, new_page);
73094 +#endif
73095 +
73096 /* Make the old page be freed below */
73097 new_page = old_page;
73098 }
73099 @@ -2135,6 +2160,10 @@ retry:
73100 && (vma->vm_flags & VM_SHARED)));
73101 set_huge_pte_at(mm, address, ptep, new_pte);
73102
73103 +#ifdef CONFIG_PAX_SEGMEXEC
73104 + pax_mirror_huge_pte(vma, address, page);
73105 +#endif
73106 +
73107 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
73108 /* Optimization, do the COW without a second fault */
73109 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
73110 @@ -2163,6 +2192,28 @@ int hugetlb_fault(struct mm_struct *mm,
73111 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
73112 struct hstate *h = hstate_vma(vma);
73113
73114 +#ifdef CONFIG_PAX_SEGMEXEC
73115 + struct vm_area_struct *vma_m;
73116 +
73117 + vma_m = pax_find_mirror_vma(vma);
73118 + if (vma_m) {
73119 + unsigned long address_m;
73120 +
73121 + if (vma->vm_start > vma_m->vm_start) {
73122 + address_m = address;
73123 + address -= SEGMEXEC_TASK_SIZE;
73124 + vma = vma_m;
73125 + h = hstate_vma(vma);
73126 + } else
73127 + address_m = address + SEGMEXEC_TASK_SIZE;
73128 +
73129 + if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
73130 + return VM_FAULT_OOM;
73131 + address_m &= HPAGE_MASK;
73132 + unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
73133 + }
73134 +#endif
73135 +
73136 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
73137 if (!ptep)
73138 return VM_FAULT_OOM;
73139 diff -urNp linux-2.6.32.49/mm/internal.h linux-2.6.32.49/mm/internal.h
73140 --- linux-2.6.32.49/mm/internal.h 2011-11-08 19:02:43.000000000 -0500
73141 +++ linux-2.6.32.49/mm/internal.h 2011-11-15 19:59:43.000000000 -0500
73142 @@ -49,6 +49,7 @@ extern void putback_lru_page(struct page
73143 * in mm/page_alloc.c
73144 */
73145 extern void __free_pages_bootmem(struct page *page, unsigned int order);
73146 +extern void free_compound_page(struct page *page);
73147 extern void prep_compound_page(struct page *page, unsigned long order);
73148
73149
73150 diff -urNp linux-2.6.32.49/mm/Kconfig linux-2.6.32.49/mm/Kconfig
73151 --- linux-2.6.32.49/mm/Kconfig 2011-11-08 19:02:43.000000000 -0500
73152 +++ linux-2.6.32.49/mm/Kconfig 2011-11-15 19:59:43.000000000 -0500
73153 @@ -228,7 +228,7 @@ config KSM
73154 config DEFAULT_MMAP_MIN_ADDR
73155 int "Low address space to protect from user allocation"
73156 depends on MMU
73157 - default 4096
73158 + default 65536
73159 help
73160 This is the portion of low virtual memory which should be protected
73161 from userspace allocation. Keeping a user from writing to low pages
73162 diff -urNp linux-2.6.32.49/mm/kmemleak.c linux-2.6.32.49/mm/kmemleak.c
73163 --- linux-2.6.32.49/mm/kmemleak.c 2011-11-08 19:02:43.000000000 -0500
73164 +++ linux-2.6.32.49/mm/kmemleak.c 2011-11-15 19:59:43.000000000 -0500
73165 @@ -358,7 +358,7 @@ static void print_unreferenced(struct se
73166
73167 for (i = 0; i < object->trace_len; i++) {
73168 void *ptr = (void *)object->trace[i];
73169 - seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
73170 + seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
73171 }
73172 }
73173
73174 diff -urNp linux-2.6.32.49/mm/maccess.c linux-2.6.32.49/mm/maccess.c
73175 --- linux-2.6.32.49/mm/maccess.c 2011-11-08 19:02:43.000000000 -0500
73176 +++ linux-2.6.32.49/mm/maccess.c 2011-11-15 19:59:43.000000000 -0500
73177 @@ -14,7 +14,7 @@
73178 * Safely read from address @src to the buffer at @dst. If a kernel fault
73179 * happens, handle that and return -EFAULT.
73180 */
73181 -long probe_kernel_read(void *dst, void *src, size_t size)
73182 +long probe_kernel_read(void *dst, const void *src, size_t size)
73183 {
73184 long ret;
73185 mm_segment_t old_fs = get_fs();
73186 @@ -22,7 +22,7 @@ long probe_kernel_read(void *dst, void *
73187 set_fs(KERNEL_DS);
73188 pagefault_disable();
73189 ret = __copy_from_user_inatomic(dst,
73190 - (__force const void __user *)src, size);
73191 + (const void __force_user *)src, size);
73192 pagefault_enable();
73193 set_fs(old_fs);
73194
73195 @@ -39,14 +39,14 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
73196 * Safely write to address @dst from the buffer at @src. If a kernel fault
73197 * happens, handle that and return -EFAULT.
73198 */
73199 -long notrace __weak probe_kernel_write(void *dst, void *src, size_t size)
73200 +long notrace __weak probe_kernel_write(void *dst, const void *src, size_t size)
73201 {
73202 long ret;
73203 mm_segment_t old_fs = get_fs();
73204
73205 set_fs(KERNEL_DS);
73206 pagefault_disable();
73207 - ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
73208 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
73209 pagefault_enable();
73210 set_fs(old_fs);
73211
73212 diff -urNp linux-2.6.32.49/mm/madvise.c linux-2.6.32.49/mm/madvise.c
73213 --- linux-2.6.32.49/mm/madvise.c 2011-11-08 19:02:43.000000000 -0500
73214 +++ linux-2.6.32.49/mm/madvise.c 2011-11-15 19:59:43.000000000 -0500
73215 @@ -44,6 +44,10 @@ static long madvise_behavior(struct vm_a
73216 pgoff_t pgoff;
73217 unsigned long new_flags = vma->vm_flags;
73218
73219 +#ifdef CONFIG_PAX_SEGMEXEC
73220 + struct vm_area_struct *vma_m;
73221 +#endif
73222 +
73223 switch (behavior) {
73224 case MADV_NORMAL:
73225 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
73226 @@ -103,6 +107,13 @@ success:
73227 /*
73228 * vm_flags is protected by the mmap_sem held in write mode.
73229 */
73230 +
73231 +#ifdef CONFIG_PAX_SEGMEXEC
73232 + vma_m = pax_find_mirror_vma(vma);
73233 + if (vma_m)
73234 + vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
73235 +#endif
73236 +
73237 vma->vm_flags = new_flags;
73238
73239 out:
73240 @@ -161,6 +172,11 @@ static long madvise_dontneed(struct vm_a
73241 struct vm_area_struct ** prev,
73242 unsigned long start, unsigned long end)
73243 {
73244 +
73245 +#ifdef CONFIG_PAX_SEGMEXEC
73246 + struct vm_area_struct *vma_m;
73247 +#endif
73248 +
73249 *prev = vma;
73250 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
73251 return -EINVAL;
73252 @@ -173,6 +189,21 @@ static long madvise_dontneed(struct vm_a
73253 zap_page_range(vma, start, end - start, &details);
73254 } else
73255 zap_page_range(vma, start, end - start, NULL);
73256 +
73257 +#ifdef CONFIG_PAX_SEGMEXEC
73258 + vma_m = pax_find_mirror_vma(vma);
73259 + if (vma_m) {
73260 + if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
73261 + struct zap_details details = {
73262 + .nonlinear_vma = vma_m,
73263 + .last_index = ULONG_MAX,
73264 + };
73265 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
73266 + } else
73267 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
73268 + }
73269 +#endif
73270 +
73271 return 0;
73272 }
73273
73274 @@ -359,6 +390,16 @@ SYSCALL_DEFINE3(madvise, unsigned long,
73275 if (end < start)
73276 goto out;
73277
73278 +#ifdef CONFIG_PAX_SEGMEXEC
73279 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
73280 + if (end > SEGMEXEC_TASK_SIZE)
73281 + goto out;
73282 + } else
73283 +#endif
73284 +
73285 + if (end > TASK_SIZE)
73286 + goto out;
73287 +
73288 error = 0;
73289 if (end == start)
73290 goto out;
73291 diff -urNp linux-2.6.32.49/mm/memory.c linux-2.6.32.49/mm/memory.c
73292 --- linux-2.6.32.49/mm/memory.c 2011-11-08 19:02:43.000000000 -0500
73293 +++ linux-2.6.32.49/mm/memory.c 2011-11-15 19:59:43.000000000 -0500
73294 @@ -187,8 +187,12 @@ static inline void free_pmd_range(struct
73295 return;
73296
73297 pmd = pmd_offset(pud, start);
73298 +
73299 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
73300 pud_clear(pud);
73301 pmd_free_tlb(tlb, pmd, start);
73302 +#endif
73303 +
73304 }
73305
73306 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
73307 @@ -219,9 +223,12 @@ static inline void free_pud_range(struct
73308 if (end - 1 > ceiling - 1)
73309 return;
73310
73311 +#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
73312 pud = pud_offset(pgd, start);
73313 pgd_clear(pgd);
73314 pud_free_tlb(tlb, pud, start);
73315 +#endif
73316 +
73317 }
73318
73319 /*
73320 @@ -1251,10 +1258,10 @@ int __get_user_pages(struct task_struct
73321 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
73322 i = 0;
73323
73324 - do {
73325 + while (nr_pages) {
73326 struct vm_area_struct *vma;
73327
73328 - vma = find_extend_vma(mm, start);
73329 + vma = find_vma(mm, start);
73330 if (!vma && in_gate_area(tsk, start)) {
73331 unsigned long pg = start & PAGE_MASK;
73332 struct vm_area_struct *gate_vma = get_gate_vma(tsk);
73333 @@ -1306,7 +1313,7 @@ int __get_user_pages(struct task_struct
73334 continue;
73335 }
73336
73337 - if (!vma ||
73338 + if (!vma || start < vma->vm_start ||
73339 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
73340 !(vm_flags & vma->vm_flags))
73341 return i ? : -EFAULT;
73342 @@ -1381,7 +1388,7 @@ int __get_user_pages(struct task_struct
73343 start += PAGE_SIZE;
73344 nr_pages--;
73345 } while (nr_pages && start < vma->vm_end);
73346 - } while (nr_pages);
73347 + }
73348 return i;
73349 }
73350
73351 @@ -1526,6 +1533,10 @@ static int insert_page(struct vm_area_st
73352 page_add_file_rmap(page);
73353 set_pte_at(mm, addr, pte, mk_pte(page, prot));
73354
73355 +#ifdef CONFIG_PAX_SEGMEXEC
73356 + pax_mirror_file_pte(vma, addr, page, ptl);
73357 +#endif
73358 +
73359 retval = 0;
73360 pte_unmap_unlock(pte, ptl);
73361 return retval;
73362 @@ -1560,10 +1571,22 @@ out:
73363 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
73364 struct page *page)
73365 {
73366 +
73367 +#ifdef CONFIG_PAX_SEGMEXEC
73368 + struct vm_area_struct *vma_m;
73369 +#endif
73370 +
73371 if (addr < vma->vm_start || addr >= vma->vm_end)
73372 return -EFAULT;
73373 if (!page_count(page))
73374 return -EINVAL;
73375 +
73376 +#ifdef CONFIG_PAX_SEGMEXEC
73377 + vma_m = pax_find_mirror_vma(vma);
73378 + if (vma_m)
73379 + vma_m->vm_flags |= VM_INSERTPAGE;
73380 +#endif
73381 +
73382 vma->vm_flags |= VM_INSERTPAGE;
73383 return insert_page(vma, addr, page, vma->vm_page_prot);
73384 }
73385 @@ -1649,6 +1672,7 @@ int vm_insert_mixed(struct vm_area_struc
73386 unsigned long pfn)
73387 {
73388 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
73389 + BUG_ON(vma->vm_mirror);
73390
73391 if (addr < vma->vm_start || addr >= vma->vm_end)
73392 return -EFAULT;
73393 @@ -1977,6 +2001,186 @@ static inline void cow_user_page(struct
73394 copy_user_highpage(dst, src, va, vma);
73395 }
73396
73397 +#ifdef CONFIG_PAX_SEGMEXEC
73398 +static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
73399 +{
73400 + struct mm_struct *mm = vma->vm_mm;
73401 + spinlock_t *ptl;
73402 + pte_t *pte, entry;
73403 +
73404 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
73405 + entry = *pte;
73406 + if (!pte_present(entry)) {
73407 + if (!pte_none(entry)) {
73408 + BUG_ON(pte_file(entry));
73409 + free_swap_and_cache(pte_to_swp_entry(entry));
73410 + pte_clear_not_present_full(mm, address, pte, 0);
73411 + }
73412 + } else {
73413 + struct page *page;
73414 +
73415 + flush_cache_page(vma, address, pte_pfn(entry));
73416 + entry = ptep_clear_flush(vma, address, pte);
73417 + BUG_ON(pte_dirty(entry));
73418 + page = vm_normal_page(vma, address, entry);
73419 + if (page) {
73420 + update_hiwater_rss(mm);
73421 + if (PageAnon(page))
73422 + dec_mm_counter(mm, anon_rss);
73423 + else
73424 + dec_mm_counter(mm, file_rss);
73425 + page_remove_rmap(page);
73426 + page_cache_release(page);
73427 + }
73428 + }
73429 + pte_unmap_unlock(pte, ptl);
73430 +}
73431 +
73432 +/* PaX: if vma is mirrored, synchronize the mirror's PTE
73433 + *
73434 + * the ptl of the lower mapped page is held on entry and is not released on exit
73435 + * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
73436 + */
73437 +static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
73438 +{
73439 + struct mm_struct *mm = vma->vm_mm;
73440 + unsigned long address_m;
73441 + spinlock_t *ptl_m;
73442 + struct vm_area_struct *vma_m;
73443 + pmd_t *pmd_m;
73444 + pte_t *pte_m, entry_m;
73445 +
73446 + BUG_ON(!page_m || !PageAnon(page_m));
73447 +
73448 + vma_m = pax_find_mirror_vma(vma);
73449 + if (!vma_m)
73450 + return;
73451 +
73452 + BUG_ON(!PageLocked(page_m));
73453 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
73454 + address_m = address + SEGMEXEC_TASK_SIZE;
73455 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
73456 + pte_m = pte_offset_map_nested(pmd_m, address_m);
73457 + ptl_m = pte_lockptr(mm, pmd_m);
73458 + if (ptl != ptl_m) {
73459 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
73460 + if (!pte_none(*pte_m))
73461 + goto out;
73462 + }
73463 +
73464 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
73465 + page_cache_get(page_m);
73466 + page_add_anon_rmap(page_m, vma_m, address_m);
73467 + inc_mm_counter(mm, anon_rss);
73468 + set_pte_at(mm, address_m, pte_m, entry_m);
73469 + update_mmu_cache(vma_m, address_m, entry_m);
73470 +out:
73471 + if (ptl != ptl_m)
73472 + spin_unlock(ptl_m);
73473 + pte_unmap_nested(pte_m);
73474 + unlock_page(page_m);
73475 +}
73476 +
73477 +void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
73478 +{
73479 + struct mm_struct *mm = vma->vm_mm;
73480 + unsigned long address_m;
73481 + spinlock_t *ptl_m;
73482 + struct vm_area_struct *vma_m;
73483 + pmd_t *pmd_m;
73484 + pte_t *pte_m, entry_m;
73485 +
73486 + BUG_ON(!page_m || PageAnon(page_m));
73487 +
73488 + vma_m = pax_find_mirror_vma(vma);
73489 + if (!vma_m)
73490 + return;
73491 +
73492 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
73493 + address_m = address + SEGMEXEC_TASK_SIZE;
73494 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
73495 + pte_m = pte_offset_map_nested(pmd_m, address_m);
73496 + ptl_m = pte_lockptr(mm, pmd_m);
73497 + if (ptl != ptl_m) {
73498 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
73499 + if (!pte_none(*pte_m))
73500 + goto out;
73501 + }
73502 +
73503 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
73504 + page_cache_get(page_m);
73505 + page_add_file_rmap(page_m);
73506 + inc_mm_counter(mm, file_rss);
73507 + set_pte_at(mm, address_m, pte_m, entry_m);
73508 + update_mmu_cache(vma_m, address_m, entry_m);
73509 +out:
73510 + if (ptl != ptl_m)
73511 + spin_unlock(ptl_m);
73512 + pte_unmap_nested(pte_m);
73513 +}
73514 +
73515 +static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
73516 +{
73517 + struct mm_struct *mm = vma->vm_mm;
73518 + unsigned long address_m;
73519 + spinlock_t *ptl_m;
73520 + struct vm_area_struct *vma_m;
73521 + pmd_t *pmd_m;
73522 + pte_t *pte_m, entry_m;
73523 +
73524 + vma_m = pax_find_mirror_vma(vma);
73525 + if (!vma_m)
73526 + return;
73527 +
73528 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
73529 + address_m = address + SEGMEXEC_TASK_SIZE;
73530 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
73531 + pte_m = pte_offset_map_nested(pmd_m, address_m);
73532 + ptl_m = pte_lockptr(mm, pmd_m);
73533 + if (ptl != ptl_m) {
73534 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
73535 + if (!pte_none(*pte_m))
73536 + goto out;
73537 + }
73538 +
73539 + entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
73540 + set_pte_at(mm, address_m, pte_m, entry_m);
73541 +out:
73542 + if (ptl != ptl_m)
73543 + spin_unlock(ptl_m);
73544 + pte_unmap_nested(pte_m);
73545 +}
73546 +
73547 +static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
73548 +{
73549 + struct page *page_m;
73550 + pte_t entry;
73551 +
73552 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
73553 + goto out;
73554 +
73555 + entry = *pte;
73556 + page_m = vm_normal_page(vma, address, entry);
73557 + if (!page_m)
73558 + pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
73559 + else if (PageAnon(page_m)) {
73560 + if (pax_find_mirror_vma(vma)) {
73561 + pte_unmap_unlock(pte, ptl);
73562 + lock_page(page_m);
73563 + pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
73564 + if (pte_same(entry, *pte))
73565 + pax_mirror_anon_pte(vma, address, page_m, ptl);
73566 + else
73567 + unlock_page(page_m);
73568 + }
73569 + } else
73570 + pax_mirror_file_pte(vma, address, page_m, ptl);
73571 +
73572 +out:
73573 + pte_unmap_unlock(pte, ptl);
73574 +}
73575 +#endif
73576 +
73577 /*
73578 * This routine handles present pages, when users try to write
73579 * to a shared page. It is done by copying the page to a new address
73580 @@ -2156,6 +2360,12 @@ gotten:
73581 */
73582 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
73583 if (likely(pte_same(*page_table, orig_pte))) {
73584 +
73585 +#ifdef CONFIG_PAX_SEGMEXEC
73586 + if (pax_find_mirror_vma(vma))
73587 + BUG_ON(!trylock_page(new_page));
73588 +#endif
73589 +
73590 if (old_page) {
73591 if (!PageAnon(old_page)) {
73592 dec_mm_counter(mm, file_rss);
73593 @@ -2207,6 +2417,10 @@ gotten:
73594 page_remove_rmap(old_page);
73595 }
73596
73597 +#ifdef CONFIG_PAX_SEGMEXEC
73598 + pax_mirror_anon_pte(vma, address, new_page, ptl);
73599 +#endif
73600 +
73601 /* Free the old page.. */
73602 new_page = old_page;
73603 ret |= VM_FAULT_WRITE;
73604 @@ -2606,6 +2820,11 @@ static int do_swap_page(struct mm_struct
73605 swap_free(entry);
73606 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
73607 try_to_free_swap(page);
73608 +
73609 +#ifdef CONFIG_PAX_SEGMEXEC
73610 + if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
73611 +#endif
73612 +
73613 unlock_page(page);
73614
73615 if (flags & FAULT_FLAG_WRITE) {
73616 @@ -2617,6 +2836,11 @@ static int do_swap_page(struct mm_struct
73617
73618 /* No need to invalidate - it was non-present before */
73619 update_mmu_cache(vma, address, pte);
73620 +
73621 +#ifdef CONFIG_PAX_SEGMEXEC
73622 + pax_mirror_anon_pte(vma, address, page, ptl);
73623 +#endif
73624 +
73625 unlock:
73626 pte_unmap_unlock(page_table, ptl);
73627 out:
73628 @@ -2632,40 +2856,6 @@ out_release:
73629 }
73630
73631 /*
73632 - * This is like a special single-page "expand_{down|up}wards()",
73633 - * except we must first make sure that 'address{-|+}PAGE_SIZE'
73634 - * doesn't hit another vma.
73635 - */
73636 -static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
73637 -{
73638 - address &= PAGE_MASK;
73639 - if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
73640 - struct vm_area_struct *prev = vma->vm_prev;
73641 -
73642 - /*
73643 - * Is there a mapping abutting this one below?
73644 - *
73645 - * That's only ok if it's the same stack mapping
73646 - * that has gotten split..
73647 - */
73648 - if (prev && prev->vm_end == address)
73649 - return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
73650 -
73651 - expand_stack(vma, address - PAGE_SIZE);
73652 - }
73653 - if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
73654 - struct vm_area_struct *next = vma->vm_next;
73655 -
73656 - /* As VM_GROWSDOWN but s/below/above/ */
73657 - if (next && next->vm_start == address + PAGE_SIZE)
73658 - return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
73659 -
73660 - expand_upwards(vma, address + PAGE_SIZE);
73661 - }
73662 - return 0;
73663 -}
73664 -
73665 -/*
73666 * We enter with non-exclusive mmap_sem (to exclude vma changes,
73667 * but allow concurrent faults), and pte mapped but not yet locked.
73668 * We return with mmap_sem still held, but pte unmapped and unlocked.
73669 @@ -2674,27 +2864,23 @@ static int do_anonymous_page(struct mm_s
73670 unsigned long address, pte_t *page_table, pmd_t *pmd,
73671 unsigned int flags)
73672 {
73673 - struct page *page;
73674 + struct page *page = NULL;
73675 spinlock_t *ptl;
73676 pte_t entry;
73677
73678 - pte_unmap(page_table);
73679 -
73680 - /* Check if we need to add a guard page to the stack */
73681 - if (check_stack_guard_page(vma, address) < 0)
73682 - return VM_FAULT_SIGBUS;
73683 -
73684 - /* Use the zero-page for reads */
73685 if (!(flags & FAULT_FLAG_WRITE)) {
73686 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
73687 vma->vm_page_prot));
73688 - page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
73689 + ptl = pte_lockptr(mm, pmd);
73690 + spin_lock(ptl);
73691 if (!pte_none(*page_table))
73692 goto unlock;
73693 goto setpte;
73694 }
73695
73696 /* Allocate our own private page. */
73697 + pte_unmap(page_table);
73698 +
73699 if (unlikely(anon_vma_prepare(vma)))
73700 goto oom;
73701 page = alloc_zeroed_user_highpage_movable(vma, address);
73702 @@ -2713,6 +2899,11 @@ static int do_anonymous_page(struct mm_s
73703 if (!pte_none(*page_table))
73704 goto release;
73705
73706 +#ifdef CONFIG_PAX_SEGMEXEC
73707 + if (pax_find_mirror_vma(vma))
73708 + BUG_ON(!trylock_page(page));
73709 +#endif
73710 +
73711 inc_mm_counter(mm, anon_rss);
73712 page_add_new_anon_rmap(page, vma, address);
73713 setpte:
73714 @@ -2720,6 +2911,12 @@ setpte:
73715
73716 /* No need to invalidate - it was non-present before */
73717 update_mmu_cache(vma, address, entry);
73718 +
73719 +#ifdef CONFIG_PAX_SEGMEXEC
73720 + if (page)
73721 + pax_mirror_anon_pte(vma, address, page, ptl);
73722 +#endif
73723 +
73724 unlock:
73725 pte_unmap_unlock(page_table, ptl);
73726 return 0;
73727 @@ -2862,6 +3059,12 @@ static int __do_fault(struct mm_struct *
73728 */
73729 /* Only go through if we didn't race with anybody else... */
73730 if (likely(pte_same(*page_table, orig_pte))) {
73731 +
73732 +#ifdef CONFIG_PAX_SEGMEXEC
73733 + if (anon && pax_find_mirror_vma(vma))
73734 + BUG_ON(!trylock_page(page));
73735 +#endif
73736 +
73737 flush_icache_page(vma, page);
73738 entry = mk_pte(page, vma->vm_page_prot);
73739 if (flags & FAULT_FLAG_WRITE)
73740 @@ -2881,6 +3084,14 @@ static int __do_fault(struct mm_struct *
73741
73742 /* no need to invalidate: a not-present page won't be cached */
73743 update_mmu_cache(vma, address, entry);
73744 +
73745 +#ifdef CONFIG_PAX_SEGMEXEC
73746 + if (anon)
73747 + pax_mirror_anon_pte(vma, address, page, ptl);
73748 + else
73749 + pax_mirror_file_pte(vma, address, page, ptl);
73750 +#endif
73751 +
73752 } else {
73753 if (charged)
73754 mem_cgroup_uncharge_page(page);
73755 @@ -3028,6 +3239,12 @@ static inline int handle_pte_fault(struc
73756 if (flags & FAULT_FLAG_WRITE)
73757 flush_tlb_page(vma, address);
73758 }
73759 +
73760 +#ifdef CONFIG_PAX_SEGMEXEC
73761 + pax_mirror_pte(vma, address, pte, pmd, ptl);
73762 + return 0;
73763 +#endif
73764 +
73765 unlock:
73766 pte_unmap_unlock(pte, ptl);
73767 return 0;
73768 @@ -3044,6 +3261,10 @@ int handle_mm_fault(struct mm_struct *mm
73769 pmd_t *pmd;
73770 pte_t *pte;
73771
73772 +#ifdef CONFIG_PAX_SEGMEXEC
73773 + struct vm_area_struct *vma_m;
73774 +#endif
73775 +
73776 __set_current_state(TASK_RUNNING);
73777
73778 count_vm_event(PGFAULT);
73779 @@ -3051,6 +3272,34 @@ int handle_mm_fault(struct mm_struct *mm
73780 if (unlikely(is_vm_hugetlb_page(vma)))
73781 return hugetlb_fault(mm, vma, address, flags);
73782
73783 +#ifdef CONFIG_PAX_SEGMEXEC
73784 + vma_m = pax_find_mirror_vma(vma);
73785 + if (vma_m) {
73786 + unsigned long address_m;
73787 + pgd_t *pgd_m;
73788 + pud_t *pud_m;
73789 + pmd_t *pmd_m;
73790 +
73791 + if (vma->vm_start > vma_m->vm_start) {
73792 + address_m = address;
73793 + address -= SEGMEXEC_TASK_SIZE;
73794 + vma = vma_m;
73795 + } else
73796 + address_m = address + SEGMEXEC_TASK_SIZE;
73797 +
73798 + pgd_m = pgd_offset(mm, address_m);
73799 + pud_m = pud_alloc(mm, pgd_m, address_m);
73800 + if (!pud_m)
73801 + return VM_FAULT_OOM;
73802 + pmd_m = pmd_alloc(mm, pud_m, address_m);
73803 + if (!pmd_m)
73804 + return VM_FAULT_OOM;
73805 + if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
73806 + return VM_FAULT_OOM;
73807 + pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
73808 + }
73809 +#endif
73810 +
73811 pgd = pgd_offset(mm, address);
73812 pud = pud_alloc(mm, pgd, address);
73813 if (!pud)
73814 @@ -3148,7 +3397,7 @@ static int __init gate_vma_init(void)
73815 gate_vma.vm_start = FIXADDR_USER_START;
73816 gate_vma.vm_end = FIXADDR_USER_END;
73817 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
73818 - gate_vma.vm_page_prot = __P101;
73819 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
73820 /*
73821 * Make sure the vDSO gets into every core dump.
73822 * Dumping its contents makes post-mortem fully interpretable later
73823 diff -urNp linux-2.6.32.49/mm/memory-failure.c linux-2.6.32.49/mm/memory-failure.c
73824 --- linux-2.6.32.49/mm/memory-failure.c 2011-11-08 19:02:43.000000000 -0500
73825 +++ linux-2.6.32.49/mm/memory-failure.c 2011-11-15 19:59:43.000000000 -0500
73826 @@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __r
73827
73828 int sysctl_memory_failure_recovery __read_mostly = 1;
73829
73830 -atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
73831 +atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
73832
73833 /*
73834 * Send all the processes who have the page mapped an ``action optional''
73835 @@ -64,7 +64,7 @@ static int kill_proc_ao(struct task_stru
73836 si.si_signo = SIGBUS;
73837 si.si_errno = 0;
73838 si.si_code = BUS_MCEERR_AO;
73839 - si.si_addr = (void *)addr;
73840 + si.si_addr = (void __user *)addr;
73841 #ifdef __ARCH_SI_TRAPNO
73842 si.si_trapno = trapno;
73843 #endif
73844 @@ -745,7 +745,7 @@ int __memory_failure(unsigned long pfn,
73845 return 0;
73846 }
73847
73848 - atomic_long_add(1, &mce_bad_pages);
73849 + atomic_long_add_unchecked(1, &mce_bad_pages);
73850
73851 /*
73852 * We need/can do nothing about count=0 pages.
73853 diff -urNp linux-2.6.32.49/mm/mempolicy.c linux-2.6.32.49/mm/mempolicy.c
73854 --- linux-2.6.32.49/mm/mempolicy.c 2011-11-08 19:02:43.000000000 -0500
73855 +++ linux-2.6.32.49/mm/mempolicy.c 2011-11-15 19:59:43.000000000 -0500
73856 @@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_st
73857 struct vm_area_struct *next;
73858 int err;
73859
73860 +#ifdef CONFIG_PAX_SEGMEXEC
73861 + struct vm_area_struct *vma_m;
73862 +#endif
73863 +
73864 err = 0;
73865 for (; vma && vma->vm_start < end; vma = next) {
73866 next = vma->vm_next;
73867 @@ -584,6 +588,16 @@ static int mbind_range(struct vm_area_st
73868 err = policy_vma(vma, new);
73869 if (err)
73870 break;
73871 +
73872 +#ifdef CONFIG_PAX_SEGMEXEC
73873 + vma_m = pax_find_mirror_vma(vma);
73874 + if (vma_m) {
73875 + err = policy_vma(vma_m, new);
73876 + if (err)
73877 + break;
73878 + }
73879 +#endif
73880 +
73881 }
73882 return err;
73883 }
73884 @@ -1002,6 +1016,17 @@ static long do_mbind(unsigned long start
73885
73886 if (end < start)
73887 return -EINVAL;
73888 +
73889 +#ifdef CONFIG_PAX_SEGMEXEC
73890 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
73891 + if (end > SEGMEXEC_TASK_SIZE)
73892 + return -EINVAL;
73893 + } else
73894 +#endif
73895 +
73896 + if (end > TASK_SIZE)
73897 + return -EINVAL;
73898 +
73899 if (end == start)
73900 return 0;
73901
73902 @@ -1207,6 +1232,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
73903 if (!mm)
73904 return -EINVAL;
73905
73906 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
73907 + if (mm != current->mm &&
73908 + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
73909 + err = -EPERM;
73910 + goto out;
73911 + }
73912 +#endif
73913 +
73914 /*
73915 * Check if this process has the right to modify the specified
73916 * process. The right exists if the process has administrative
73917 @@ -1216,8 +1249,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
73918 rcu_read_lock();
73919 tcred = __task_cred(task);
73920 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
73921 - cred->uid != tcred->suid && cred->uid != tcred->uid &&
73922 - !capable(CAP_SYS_NICE)) {
73923 + cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
73924 rcu_read_unlock();
73925 err = -EPERM;
73926 goto out;
73927 @@ -2396,7 +2428,7 @@ int show_numa_map(struct seq_file *m, vo
73928
73929 if (file) {
73930 seq_printf(m, " file=");
73931 - seq_path(m, &file->f_path, "\n\t= ");
73932 + seq_path(m, &file->f_path, "\n\t\\= ");
73933 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
73934 seq_printf(m, " heap");
73935 } else if (vma->vm_start <= mm->start_stack &&
73936 diff -urNp linux-2.6.32.49/mm/migrate.c linux-2.6.32.49/mm/migrate.c
73937 --- linux-2.6.32.49/mm/migrate.c 2011-11-08 19:02:43.000000000 -0500
73938 +++ linux-2.6.32.49/mm/migrate.c 2011-11-15 19:59:43.000000000 -0500
73939 @@ -916,6 +916,8 @@ static int do_pages_move(struct mm_struc
73940 unsigned long chunk_start;
73941 int err;
73942
73943 + pax_track_stack();
73944 +
73945 task_nodes = cpuset_mems_allowed(task);
73946
73947 err = -ENOMEM;
73948 @@ -1106,6 +1108,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
73949 if (!mm)
73950 return -EINVAL;
73951
73952 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
73953 + if (mm != current->mm &&
73954 + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
73955 + err = -EPERM;
73956 + goto out;
73957 + }
73958 +#endif
73959 +
73960 /*
73961 * Check if this process has the right to modify the specified
73962 * process. The right exists if the process has administrative
73963 @@ -1115,8 +1125,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
73964 rcu_read_lock();
73965 tcred = __task_cred(task);
73966 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
73967 - cred->uid != tcred->suid && cred->uid != tcred->uid &&
73968 - !capable(CAP_SYS_NICE)) {
73969 + cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
73970 rcu_read_unlock();
73971 err = -EPERM;
73972 goto out;
73973 diff -urNp linux-2.6.32.49/mm/mlock.c linux-2.6.32.49/mm/mlock.c
73974 --- linux-2.6.32.49/mm/mlock.c 2011-11-08 19:02:43.000000000 -0500
73975 +++ linux-2.6.32.49/mm/mlock.c 2011-11-15 19:59:43.000000000 -0500
73976 @@ -13,6 +13,7 @@
73977 #include <linux/pagemap.h>
73978 #include <linux/mempolicy.h>
73979 #include <linux/syscalls.h>
73980 +#include <linux/security.h>
73981 #include <linux/sched.h>
73982 #include <linux/module.h>
73983 #include <linux/rmap.h>
73984 @@ -138,13 +139,6 @@ void munlock_vma_page(struct page *page)
73985 }
73986 }
73987
73988 -static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
73989 -{
73990 - return (vma->vm_flags & VM_GROWSDOWN) &&
73991 - (vma->vm_start == addr) &&
73992 - !vma_stack_continue(vma->vm_prev, addr);
73993 -}
73994 -
73995 /**
73996 * __mlock_vma_pages_range() - mlock a range of pages in the vma.
73997 * @vma: target vma
73998 @@ -177,12 +171,6 @@ static long __mlock_vma_pages_range(stru
73999 if (vma->vm_flags & VM_WRITE)
74000 gup_flags |= FOLL_WRITE;
74001
74002 - /* We don't try to access the guard page of a stack vma */
74003 - if (stack_guard_page(vma, start)) {
74004 - addr += PAGE_SIZE;
74005 - nr_pages--;
74006 - }
74007 -
74008 while (nr_pages > 0) {
74009 int i;
74010
74011 @@ -440,7 +428,7 @@ static int do_mlock(unsigned long start,
74012 {
74013 unsigned long nstart, end, tmp;
74014 struct vm_area_struct * vma, * prev;
74015 - int error;
74016 + int error = -EINVAL;
74017
74018 len = PAGE_ALIGN(len);
74019 end = start + len;
74020 @@ -448,6 +436,9 @@ static int do_mlock(unsigned long start,
74021 return -EINVAL;
74022 if (end == start)
74023 return 0;
74024 + if (end > TASK_SIZE)
74025 + return -EINVAL;
74026 +
74027 vma = find_vma_prev(current->mm, start, &prev);
74028 if (!vma || vma->vm_start > start)
74029 return -ENOMEM;
74030 @@ -458,6 +449,11 @@ static int do_mlock(unsigned long start,
74031 for (nstart = start ; ; ) {
74032 unsigned int newflags;
74033
74034 +#ifdef CONFIG_PAX_SEGMEXEC
74035 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
74036 + break;
74037 +#endif
74038 +
74039 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
74040
74041 newflags = vma->vm_flags | VM_LOCKED;
74042 @@ -507,6 +503,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
74043 lock_limit >>= PAGE_SHIFT;
74044
74045 /* check against resource limits */
74046 + gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
74047 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
74048 error = do_mlock(start, len, 1);
74049 up_write(&current->mm->mmap_sem);
74050 @@ -528,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long,
74051 static int do_mlockall(int flags)
74052 {
74053 struct vm_area_struct * vma, * prev = NULL;
74054 - unsigned int def_flags = 0;
74055
74056 if (flags & MCL_FUTURE)
74057 - def_flags = VM_LOCKED;
74058 - current->mm->def_flags = def_flags;
74059 + current->mm->def_flags |= VM_LOCKED;
74060 + else
74061 + current->mm->def_flags &= ~VM_LOCKED;
74062 if (flags == MCL_FUTURE)
74063 goto out;
74064
74065 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
74066 - unsigned int newflags;
74067 + unsigned long newflags;
74068 +
74069 +#ifdef CONFIG_PAX_SEGMEXEC
74070 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
74071 + break;
74072 +#endif
74073
74074 + BUG_ON(vma->vm_end > TASK_SIZE);
74075 newflags = vma->vm_flags | VM_LOCKED;
74076 if (!(flags & MCL_CURRENT))
74077 newflags &= ~VM_LOCKED;
74078 @@ -570,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
74079 lock_limit >>= PAGE_SHIFT;
74080
74081 ret = -ENOMEM;
74082 + gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
74083 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
74084 capable(CAP_IPC_LOCK))
74085 ret = do_mlockall(flags);
74086 diff -urNp linux-2.6.32.49/mm/mmap.c linux-2.6.32.49/mm/mmap.c
74087 --- linux-2.6.32.49/mm/mmap.c 2011-11-08 19:02:43.000000000 -0500
74088 +++ linux-2.6.32.49/mm/mmap.c 2011-11-15 19:59:43.000000000 -0500
74089 @@ -45,6 +45,16 @@
74090 #define arch_rebalance_pgtables(addr, len) (addr)
74091 #endif
74092
74093 +static inline void verify_mm_writelocked(struct mm_struct *mm)
74094 +{
74095 +#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
74096 + if (unlikely(down_read_trylock(&mm->mmap_sem))) {
74097 + up_read(&mm->mmap_sem);
74098 + BUG();
74099 + }
74100 +#endif
74101 +}
74102 +
74103 static void unmap_region(struct mm_struct *mm,
74104 struct vm_area_struct *vma, struct vm_area_struct *prev,
74105 unsigned long start, unsigned long end);
74106 @@ -70,22 +80,32 @@ static void unmap_region(struct mm_struc
74107 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
74108 *
74109 */
74110 -pgprot_t protection_map[16] = {
74111 +pgprot_t protection_map[16] __read_only = {
74112 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
74113 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
74114 };
74115
74116 pgprot_t vm_get_page_prot(unsigned long vm_flags)
74117 {
74118 - return __pgprot(pgprot_val(protection_map[vm_flags &
74119 + pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
74120 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
74121 pgprot_val(arch_vm_get_page_prot(vm_flags)));
74122 +
74123 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
74124 + if (!nx_enabled &&
74125 + (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
74126 + (vm_flags & (VM_READ | VM_WRITE)))
74127 + prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
74128 +#endif
74129 +
74130 + return prot;
74131 }
74132 EXPORT_SYMBOL(vm_get_page_prot);
74133
74134 int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
74135 int sysctl_overcommit_ratio = 50; /* default is 50% */
74136 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
74137 +unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
74138 struct percpu_counter vm_committed_as;
74139
74140 /*
74141 @@ -231,6 +251,7 @@ static struct vm_area_struct *remove_vma
74142 struct vm_area_struct *next = vma->vm_next;
74143
74144 might_sleep();
74145 + BUG_ON(vma->vm_mirror);
74146 if (vma->vm_ops && vma->vm_ops->close)
74147 vma->vm_ops->close(vma);
74148 if (vma->vm_file) {
74149 @@ -267,6 +288,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
74150 * not page aligned -Ram Gupta
74151 */
74152 rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
74153 + gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
74154 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
74155 (mm->end_data - mm->start_data) > rlim)
74156 goto out;
74157 @@ -704,6 +726,12 @@ static int
74158 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
74159 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
74160 {
74161 +
74162 +#ifdef CONFIG_PAX_SEGMEXEC
74163 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
74164 + return 0;
74165 +#endif
74166 +
74167 if (is_mergeable_vma(vma, file, vm_flags) &&
74168 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
74169 if (vma->vm_pgoff == vm_pgoff)
74170 @@ -723,6 +751,12 @@ static int
74171 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
74172 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
74173 {
74174 +
74175 +#ifdef CONFIG_PAX_SEGMEXEC
74176 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
74177 + return 0;
74178 +#endif
74179 +
74180 if (is_mergeable_vma(vma, file, vm_flags) &&
74181 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
74182 pgoff_t vm_pglen;
74183 @@ -765,12 +799,19 @@ can_vma_merge_after(struct vm_area_struc
74184 struct vm_area_struct *vma_merge(struct mm_struct *mm,
74185 struct vm_area_struct *prev, unsigned long addr,
74186 unsigned long end, unsigned long vm_flags,
74187 - struct anon_vma *anon_vma, struct file *file,
74188 + struct anon_vma *anon_vma, struct file *file,
74189 pgoff_t pgoff, struct mempolicy *policy)
74190 {
74191 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
74192 struct vm_area_struct *area, *next;
74193
74194 +#ifdef CONFIG_PAX_SEGMEXEC
74195 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
74196 + struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
74197 +
74198 + BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
74199 +#endif
74200 +
74201 /*
74202 * We later require that vma->vm_flags == vm_flags,
74203 * so this tests vma->vm_flags & VM_SPECIAL, too.
74204 @@ -786,6 +827,15 @@ struct vm_area_struct *vma_merge(struct
74205 if (next && next->vm_end == end) /* cases 6, 7, 8 */
74206 next = next->vm_next;
74207
74208 +#ifdef CONFIG_PAX_SEGMEXEC
74209 + if (prev)
74210 + prev_m = pax_find_mirror_vma(prev);
74211 + if (area)
74212 + area_m = pax_find_mirror_vma(area);
74213 + if (next)
74214 + next_m = pax_find_mirror_vma(next);
74215 +#endif
74216 +
74217 /*
74218 * Can it merge with the predecessor?
74219 */
74220 @@ -805,9 +855,24 @@ struct vm_area_struct *vma_merge(struct
74221 /* cases 1, 6 */
74222 vma_adjust(prev, prev->vm_start,
74223 next->vm_end, prev->vm_pgoff, NULL);
74224 - } else /* cases 2, 5, 7 */
74225 +
74226 +#ifdef CONFIG_PAX_SEGMEXEC
74227 + if (prev_m)
74228 + vma_adjust(prev_m, prev_m->vm_start,
74229 + next_m->vm_end, prev_m->vm_pgoff, NULL);
74230 +#endif
74231 +
74232 + } else { /* cases 2, 5, 7 */
74233 vma_adjust(prev, prev->vm_start,
74234 end, prev->vm_pgoff, NULL);
74235 +
74236 +#ifdef CONFIG_PAX_SEGMEXEC
74237 + if (prev_m)
74238 + vma_adjust(prev_m, prev_m->vm_start,
74239 + end_m, prev_m->vm_pgoff, NULL);
74240 +#endif
74241 +
74242 + }
74243 return prev;
74244 }
74245
74246 @@ -818,12 +883,27 @@ struct vm_area_struct *vma_merge(struct
74247 mpol_equal(policy, vma_policy(next)) &&
74248 can_vma_merge_before(next, vm_flags,
74249 anon_vma, file, pgoff+pglen)) {
74250 - if (prev && addr < prev->vm_end) /* case 4 */
74251 + if (prev && addr < prev->vm_end) { /* case 4 */
74252 vma_adjust(prev, prev->vm_start,
74253 addr, prev->vm_pgoff, NULL);
74254 - else /* cases 3, 8 */
74255 +
74256 +#ifdef CONFIG_PAX_SEGMEXEC
74257 + if (prev_m)
74258 + vma_adjust(prev_m, prev_m->vm_start,
74259 + addr_m, prev_m->vm_pgoff, NULL);
74260 +#endif
74261 +
74262 + } else { /* cases 3, 8 */
74263 vma_adjust(area, addr, next->vm_end,
74264 next->vm_pgoff - pglen, NULL);
74265 +
74266 +#ifdef CONFIG_PAX_SEGMEXEC
74267 + if (area_m)
74268 + vma_adjust(area_m, addr_m, next_m->vm_end,
74269 + next_m->vm_pgoff - pglen, NULL);
74270 +#endif
74271 +
74272 + }
74273 return area;
74274 }
74275
74276 @@ -898,14 +978,11 @@ none:
74277 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
74278 struct file *file, long pages)
74279 {
74280 - const unsigned long stack_flags
74281 - = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
74282 -
74283 if (file) {
74284 mm->shared_vm += pages;
74285 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
74286 mm->exec_vm += pages;
74287 - } else if (flags & stack_flags)
74288 + } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
74289 mm->stack_vm += pages;
74290 if (flags & (VM_RESERVED|VM_IO))
74291 mm->reserved_vm += pages;
74292 @@ -932,7 +1009,7 @@ unsigned long do_mmap_pgoff(struct file
74293 * (the exception is when the underlying filesystem is noexec
74294 * mounted, in which case we dont add PROT_EXEC.)
74295 */
74296 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
74297 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
74298 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
74299 prot |= PROT_EXEC;
74300
74301 @@ -958,7 +1035,7 @@ unsigned long do_mmap_pgoff(struct file
74302 /* Obtain the address to map to. we verify (or select) it and ensure
74303 * that it represents a valid section of the address space.
74304 */
74305 - addr = get_unmapped_area(file, addr, len, pgoff, flags);
74306 + addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
74307 if (addr & ~PAGE_MASK)
74308 return addr;
74309
74310 @@ -969,6 +1046,36 @@ unsigned long do_mmap_pgoff(struct file
74311 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
74312 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
74313
74314 +#ifdef CONFIG_PAX_MPROTECT
74315 + if (mm->pax_flags & MF_PAX_MPROTECT) {
74316 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
74317 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
74318 + gr_log_rwxmmap(file);
74319 +
74320 +#ifdef CONFIG_PAX_EMUPLT
74321 + vm_flags &= ~VM_EXEC;
74322 +#else
74323 + return -EPERM;
74324 +#endif
74325 +
74326 + }
74327 +
74328 + if (!(vm_flags & VM_EXEC))
74329 + vm_flags &= ~VM_MAYEXEC;
74330 +#else
74331 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
74332 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
74333 +#endif
74334 + else
74335 + vm_flags &= ~VM_MAYWRITE;
74336 + }
74337 +#endif
74338 +
74339 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
74340 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
74341 + vm_flags &= ~VM_PAGEEXEC;
74342 +#endif
74343 +
74344 if (flags & MAP_LOCKED)
74345 if (!can_do_mlock())
74346 return -EPERM;
74347 @@ -980,6 +1087,7 @@ unsigned long do_mmap_pgoff(struct file
74348 locked += mm->locked_vm;
74349 lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
74350 lock_limit >>= PAGE_SHIFT;
74351 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
74352 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
74353 return -EAGAIN;
74354 }
74355 @@ -1053,6 +1161,9 @@ unsigned long do_mmap_pgoff(struct file
74356 if (error)
74357 return error;
74358
74359 + if (!gr_acl_handle_mmap(file, prot))
74360 + return -EACCES;
74361 +
74362 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
74363 }
74364 EXPORT_SYMBOL(do_mmap_pgoff);
74365 @@ -1065,10 +1176,10 @@ EXPORT_SYMBOL(do_mmap_pgoff);
74366 */
74367 int vma_wants_writenotify(struct vm_area_struct *vma)
74368 {
74369 - unsigned int vm_flags = vma->vm_flags;
74370 + unsigned long vm_flags = vma->vm_flags;
74371
74372 /* If it was private or non-writable, the write bit is already clear */
74373 - if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
74374 + if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
74375 return 0;
74376
74377 /* The backer wishes to know when pages are first written to? */
74378 @@ -1117,14 +1228,24 @@ unsigned long mmap_region(struct file *f
74379 unsigned long charged = 0;
74380 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
74381
74382 +#ifdef CONFIG_PAX_SEGMEXEC
74383 + struct vm_area_struct *vma_m = NULL;
74384 +#endif
74385 +
74386 + /*
74387 + * mm->mmap_sem is required to protect against another thread
74388 + * changing the mappings in case we sleep.
74389 + */
74390 + verify_mm_writelocked(mm);
74391 +
74392 /* Clear old maps */
74393 error = -ENOMEM;
74394 -munmap_back:
74395 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
74396 if (vma && vma->vm_start < addr + len) {
74397 if (do_munmap(mm, addr, len))
74398 return -ENOMEM;
74399 - goto munmap_back;
74400 + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
74401 + BUG_ON(vma && vma->vm_start < addr + len);
74402 }
74403
74404 /* Check against address space limit. */
74405 @@ -1173,6 +1294,16 @@ munmap_back:
74406 goto unacct_error;
74407 }
74408
74409 +#ifdef CONFIG_PAX_SEGMEXEC
74410 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
74411 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
74412 + if (!vma_m) {
74413 + error = -ENOMEM;
74414 + goto free_vma;
74415 + }
74416 + }
74417 +#endif
74418 +
74419 vma->vm_mm = mm;
74420 vma->vm_start = addr;
74421 vma->vm_end = addr + len;
74422 @@ -1195,6 +1326,19 @@ munmap_back:
74423 error = file->f_op->mmap(file, vma);
74424 if (error)
74425 goto unmap_and_free_vma;
74426 +
74427 +#ifdef CONFIG_PAX_SEGMEXEC
74428 + if (vma_m && (vm_flags & VM_EXECUTABLE))
74429 + added_exe_file_vma(mm);
74430 +#endif
74431 +
74432 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
74433 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
74434 + vma->vm_flags |= VM_PAGEEXEC;
74435 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
74436 + }
74437 +#endif
74438 +
74439 if (vm_flags & VM_EXECUTABLE)
74440 added_exe_file_vma(mm);
74441
74442 @@ -1218,6 +1362,11 @@ munmap_back:
74443 vma_link(mm, vma, prev, rb_link, rb_parent);
74444 file = vma->vm_file;
74445
74446 +#ifdef CONFIG_PAX_SEGMEXEC
74447 + if (vma_m)
74448 + pax_mirror_vma(vma_m, vma);
74449 +#endif
74450 +
74451 /* Once vma denies write, undo our temporary denial count */
74452 if (correct_wcount)
74453 atomic_inc(&inode->i_writecount);
74454 @@ -1226,6 +1375,7 @@ out:
74455
74456 mm->total_vm += len >> PAGE_SHIFT;
74457 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
74458 + track_exec_limit(mm, addr, addr + len, vm_flags);
74459 if (vm_flags & VM_LOCKED) {
74460 /*
74461 * makes pages present; downgrades, drops, reacquires mmap_sem
74462 @@ -1248,6 +1398,12 @@ unmap_and_free_vma:
74463 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
74464 charged = 0;
74465 free_vma:
74466 +
74467 +#ifdef CONFIG_PAX_SEGMEXEC
74468 + if (vma_m)
74469 + kmem_cache_free(vm_area_cachep, vma_m);
74470 +#endif
74471 +
74472 kmem_cache_free(vm_area_cachep, vma);
74473 unacct_error:
74474 if (charged)
74475 @@ -1255,6 +1411,44 @@ unacct_error:
74476 return error;
74477 }
74478
74479 +bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
74480 +{
74481 + if (!vma) {
74482 +#ifdef CONFIG_STACK_GROWSUP
74483 + if (addr > sysctl_heap_stack_gap)
74484 + vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
74485 + else
74486 + vma = find_vma(current->mm, 0);
74487 + if (vma && (vma->vm_flags & VM_GROWSUP))
74488 + return false;
74489 +#endif
74490 + return true;
74491 + }
74492 +
74493 + if (addr + len > vma->vm_start)
74494 + return false;
74495 +
74496 + if (vma->vm_flags & VM_GROWSDOWN)
74497 + return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
74498 +#ifdef CONFIG_STACK_GROWSUP
74499 + else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
74500 + return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
74501 +#endif
74502 +
74503 + return true;
74504 +}
74505 +
74506 +unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
74507 +{
74508 + if (vma->vm_start < len)
74509 + return -ENOMEM;
74510 + if (!(vma->vm_flags & VM_GROWSDOWN))
74511 + return vma->vm_start - len;
74512 + if (sysctl_heap_stack_gap <= vma->vm_start - len)
74513 + return vma->vm_start - len - sysctl_heap_stack_gap;
74514 + return -ENOMEM;
74515 +}
74516 +
74517 /* Get an address range which is currently unmapped.
74518 * For shmat() with addr=0.
74519 *
74520 @@ -1281,18 +1475,23 @@ arch_get_unmapped_area(struct file *filp
74521 if (flags & MAP_FIXED)
74522 return addr;
74523
74524 +#ifdef CONFIG_PAX_RANDMMAP
74525 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
74526 +#endif
74527 +
74528 if (addr) {
74529 addr = PAGE_ALIGN(addr);
74530 - vma = find_vma(mm, addr);
74531 - if (TASK_SIZE - len >= addr &&
74532 - (!vma || addr + len <= vma->vm_start))
74533 - return addr;
74534 + if (TASK_SIZE - len >= addr) {
74535 + vma = find_vma(mm, addr);
74536 + if (check_heap_stack_gap(vma, addr, len))
74537 + return addr;
74538 + }
74539 }
74540 if (len > mm->cached_hole_size) {
74541 - start_addr = addr = mm->free_area_cache;
74542 + start_addr = addr = mm->free_area_cache;
74543 } else {
74544 - start_addr = addr = TASK_UNMAPPED_BASE;
74545 - mm->cached_hole_size = 0;
74546 + start_addr = addr = mm->mmap_base;
74547 + mm->cached_hole_size = 0;
74548 }
74549
74550 full_search:
74551 @@ -1303,34 +1502,40 @@ full_search:
74552 * Start a new search - just in case we missed
74553 * some holes.
74554 */
74555 - if (start_addr != TASK_UNMAPPED_BASE) {
74556 - addr = TASK_UNMAPPED_BASE;
74557 - start_addr = addr;
74558 + if (start_addr != mm->mmap_base) {
74559 + start_addr = addr = mm->mmap_base;
74560 mm->cached_hole_size = 0;
74561 goto full_search;
74562 }
74563 return -ENOMEM;
74564 }
74565 - if (!vma || addr + len <= vma->vm_start) {
74566 - /*
74567 - * Remember the place where we stopped the search:
74568 - */
74569 - mm->free_area_cache = addr + len;
74570 - return addr;
74571 - }
74572 + if (check_heap_stack_gap(vma, addr, len))
74573 + break;
74574 if (addr + mm->cached_hole_size < vma->vm_start)
74575 mm->cached_hole_size = vma->vm_start - addr;
74576 addr = vma->vm_end;
74577 }
74578 +
74579 + /*
74580 + * Remember the place where we stopped the search:
74581 + */
74582 + mm->free_area_cache = addr + len;
74583 + return addr;
74584 }
74585 #endif
74586
74587 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
74588 {
74589 +
74590 +#ifdef CONFIG_PAX_SEGMEXEC
74591 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
74592 + return;
74593 +#endif
74594 +
74595 /*
74596 * Is this a new hole at the lowest possible address?
74597 */
74598 - if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
74599 + if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
74600 mm->free_area_cache = addr;
74601 mm->cached_hole_size = ~0UL;
74602 }
74603 @@ -1348,7 +1553,7 @@ arch_get_unmapped_area_topdown(struct fi
74604 {
74605 struct vm_area_struct *vma;
74606 struct mm_struct *mm = current->mm;
74607 - unsigned long addr = addr0;
74608 + unsigned long base = mm->mmap_base, addr = addr0;
74609
74610 /* requested length too big for entire address space */
74611 if (len > TASK_SIZE)
74612 @@ -1357,13 +1562,18 @@ arch_get_unmapped_area_topdown(struct fi
74613 if (flags & MAP_FIXED)
74614 return addr;
74615
74616 +#ifdef CONFIG_PAX_RANDMMAP
74617 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
74618 +#endif
74619 +
74620 /* requesting a specific address */
74621 if (addr) {
74622 addr = PAGE_ALIGN(addr);
74623 - vma = find_vma(mm, addr);
74624 - if (TASK_SIZE - len >= addr &&
74625 - (!vma || addr + len <= vma->vm_start))
74626 - return addr;
74627 + if (TASK_SIZE - len >= addr) {
74628 + vma = find_vma(mm, addr);
74629 + if (check_heap_stack_gap(vma, addr, len))
74630 + return addr;
74631 + }
74632 }
74633
74634 /* check if free_area_cache is useful for us */
74635 @@ -1378,7 +1588,7 @@ arch_get_unmapped_area_topdown(struct fi
74636 /* make sure it can fit in the remaining address space */
74637 if (addr > len) {
74638 vma = find_vma(mm, addr-len);
74639 - if (!vma || addr <= vma->vm_start)
74640 + if (check_heap_stack_gap(vma, addr - len, len))
74641 /* remember the address as a hint for next time */
74642 return (mm->free_area_cache = addr-len);
74643 }
74644 @@ -1395,7 +1605,7 @@ arch_get_unmapped_area_topdown(struct fi
74645 * return with success:
74646 */
74647 vma = find_vma(mm, addr);
74648 - if (!vma || addr+len <= vma->vm_start)
74649 + if (check_heap_stack_gap(vma, addr, len))
74650 /* remember the address as a hint for next time */
74651 return (mm->free_area_cache = addr);
74652
74653 @@ -1404,8 +1614,8 @@ arch_get_unmapped_area_topdown(struct fi
74654 mm->cached_hole_size = vma->vm_start - addr;
74655
74656 /* try just below the current vma->vm_start */
74657 - addr = vma->vm_start-len;
74658 - } while (len < vma->vm_start);
74659 + addr = skip_heap_stack_gap(vma, len);
74660 + } while (!IS_ERR_VALUE(addr));
74661
74662 bottomup:
74663 /*
74664 @@ -1414,13 +1624,21 @@ bottomup:
74665 * can happen with large stack limits and large mmap()
74666 * allocations.
74667 */
74668 + mm->mmap_base = TASK_UNMAPPED_BASE;
74669 +
74670 +#ifdef CONFIG_PAX_RANDMMAP
74671 + if (mm->pax_flags & MF_PAX_RANDMMAP)
74672 + mm->mmap_base += mm->delta_mmap;
74673 +#endif
74674 +
74675 + mm->free_area_cache = mm->mmap_base;
74676 mm->cached_hole_size = ~0UL;
74677 - mm->free_area_cache = TASK_UNMAPPED_BASE;
74678 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
74679 /*
74680 * Restore the topdown base:
74681 */
74682 - mm->free_area_cache = mm->mmap_base;
74683 + mm->mmap_base = base;
74684 + mm->free_area_cache = base;
74685 mm->cached_hole_size = ~0UL;
74686
74687 return addr;
74688 @@ -1429,6 +1647,12 @@ bottomup:
74689
74690 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
74691 {
74692 +
74693 +#ifdef CONFIG_PAX_SEGMEXEC
74694 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
74695 + return;
74696 +#endif
74697 +
74698 /*
74699 * Is this a new hole at the highest possible address?
74700 */
74701 @@ -1436,8 +1660,10 @@ void arch_unmap_area_topdown(struct mm_s
74702 mm->free_area_cache = addr;
74703
74704 /* dont allow allocations above current base */
74705 - if (mm->free_area_cache > mm->mmap_base)
74706 + if (mm->free_area_cache > mm->mmap_base) {
74707 mm->free_area_cache = mm->mmap_base;
74708 + mm->cached_hole_size = ~0UL;
74709 + }
74710 }
74711
74712 unsigned long
74713 @@ -1545,6 +1771,27 @@ out:
74714 return prev ? prev->vm_next : vma;
74715 }
74716
74717 +#ifdef CONFIG_PAX_SEGMEXEC
74718 +struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
74719 +{
74720 + struct vm_area_struct *vma_m;
74721 +
74722 + BUG_ON(!vma || vma->vm_start >= vma->vm_end);
74723 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
74724 + BUG_ON(vma->vm_mirror);
74725 + return NULL;
74726 + }
74727 + BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
74728 + vma_m = vma->vm_mirror;
74729 + BUG_ON(!vma_m || vma_m->vm_mirror != vma);
74730 + BUG_ON(vma->vm_file != vma_m->vm_file);
74731 + BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
74732 + BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
74733 + BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
74734 + return vma_m;
74735 +}
74736 +#endif
74737 +
74738 /*
74739 * Verify that the stack growth is acceptable and
74740 * update accounting. This is shared with both the
74741 @@ -1561,6 +1808,7 @@ static int acct_stack_growth(struct vm_a
74742 return -ENOMEM;
74743
74744 /* Stack limit test */
74745 + gr_learn_resource(current, RLIMIT_STACK, size, 1);
74746 if (size > rlim[RLIMIT_STACK].rlim_cur)
74747 return -ENOMEM;
74748
74749 @@ -1570,6 +1818,7 @@ static int acct_stack_growth(struct vm_a
74750 unsigned long limit;
74751 locked = mm->locked_vm + grow;
74752 limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
74753 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
74754 if (locked > limit && !capable(CAP_IPC_LOCK))
74755 return -ENOMEM;
74756 }
74757 @@ -1600,37 +1849,48 @@ static int acct_stack_growth(struct vm_a
74758 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
74759 * vma is the last one with address > vma->vm_end. Have to extend vma.
74760 */
74761 +#ifndef CONFIG_IA64
74762 +static
74763 +#endif
74764 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
74765 {
74766 int error;
74767 + bool locknext;
74768
74769 if (!(vma->vm_flags & VM_GROWSUP))
74770 return -EFAULT;
74771
74772 + /* Also guard against wrapping around to address 0. */
74773 + if (address < PAGE_ALIGN(address+1))
74774 + address = PAGE_ALIGN(address+1);
74775 + else
74776 + return -ENOMEM;
74777 +
74778 /*
74779 * We must make sure the anon_vma is allocated
74780 * so that the anon_vma locking is not a noop.
74781 */
74782 if (unlikely(anon_vma_prepare(vma)))
74783 return -ENOMEM;
74784 + locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
74785 + if (locknext && anon_vma_prepare(vma->vm_next))
74786 + return -ENOMEM;
74787 anon_vma_lock(vma);
74788 + if (locknext)
74789 + anon_vma_lock(vma->vm_next);
74790
74791 /*
74792 * vma->vm_start/vm_end cannot change under us because the caller
74793 * is required to hold the mmap_sem in read mode. We need the
74794 - * anon_vma lock to serialize against concurrent expand_stacks.
74795 - * Also guard against wrapping around to address 0.
74796 + * anon_vma locks to serialize against concurrent expand_stacks
74797 + * and expand_upwards.
74798 */
74799 - if (address < PAGE_ALIGN(address+4))
74800 - address = PAGE_ALIGN(address+4);
74801 - else {
74802 - anon_vma_unlock(vma);
74803 - return -ENOMEM;
74804 - }
74805 error = 0;
74806
74807 /* Somebody else might have raced and expanded it already */
74808 - if (address > vma->vm_end) {
74809 + if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
74810 + error = -ENOMEM;
74811 + else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
74812 unsigned long size, grow;
74813
74814 size = address - vma->vm_start;
74815 @@ -1643,6 +1903,8 @@ int expand_upwards(struct vm_area_struct
74816 vma->vm_end = address;
74817 }
74818 }
74819 + if (locknext)
74820 + anon_vma_unlock(vma->vm_next);
74821 anon_vma_unlock(vma);
74822 return error;
74823 }
74824 @@ -1655,6 +1917,8 @@ static int expand_downwards(struct vm_ar
74825 unsigned long address)
74826 {
74827 int error;
74828 + bool lockprev = false;
74829 + struct vm_area_struct *prev;
74830
74831 /*
74832 * We must make sure the anon_vma is allocated
74833 @@ -1668,6 +1932,15 @@ static int expand_downwards(struct vm_ar
74834 if (error)
74835 return error;
74836
74837 + prev = vma->vm_prev;
74838 +#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
74839 + lockprev = prev && (prev->vm_flags & VM_GROWSUP);
74840 +#endif
74841 + if (lockprev && anon_vma_prepare(prev))
74842 + return -ENOMEM;
74843 + if (lockprev)
74844 + anon_vma_lock(prev);
74845 +
74846 anon_vma_lock(vma);
74847
74848 /*
74849 @@ -1677,9 +1950,17 @@ static int expand_downwards(struct vm_ar
74850 */
74851
74852 /* Somebody else might have raced and expanded it already */
74853 - if (address < vma->vm_start) {
74854 + if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
74855 + error = -ENOMEM;
74856 + else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
74857 unsigned long size, grow;
74858
74859 +#ifdef CONFIG_PAX_SEGMEXEC
74860 + struct vm_area_struct *vma_m;
74861 +
74862 + vma_m = pax_find_mirror_vma(vma);
74863 +#endif
74864 +
74865 size = vma->vm_end - address;
74866 grow = (vma->vm_start - address) >> PAGE_SHIFT;
74867
74868 @@ -1689,10 +1970,22 @@ static int expand_downwards(struct vm_ar
74869 if (!error) {
74870 vma->vm_start = address;
74871 vma->vm_pgoff -= grow;
74872 + track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
74873 +
74874 +#ifdef CONFIG_PAX_SEGMEXEC
74875 + if (vma_m) {
74876 + vma_m->vm_start -= grow << PAGE_SHIFT;
74877 + vma_m->vm_pgoff -= grow;
74878 + }
74879 +#endif
74880 +
74881 +
74882 }
74883 }
74884 }
74885 anon_vma_unlock(vma);
74886 + if (lockprev)
74887 + anon_vma_unlock(prev);
74888 return error;
74889 }
74890
74891 @@ -1768,6 +2061,13 @@ static void remove_vma_list(struct mm_st
74892 do {
74893 long nrpages = vma_pages(vma);
74894
74895 +#ifdef CONFIG_PAX_SEGMEXEC
74896 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
74897 + vma = remove_vma(vma);
74898 + continue;
74899 + }
74900 +#endif
74901 +
74902 mm->total_vm -= nrpages;
74903 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
74904 vma = remove_vma(vma);
74905 @@ -1813,6 +2113,16 @@ detach_vmas_to_be_unmapped(struct mm_str
74906 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
74907 vma->vm_prev = NULL;
74908 do {
74909 +
74910 +#ifdef CONFIG_PAX_SEGMEXEC
74911 + if (vma->vm_mirror) {
74912 + BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
74913 + vma->vm_mirror->vm_mirror = NULL;
74914 + vma->vm_mirror->vm_flags &= ~VM_EXEC;
74915 + vma->vm_mirror = NULL;
74916 + }
74917 +#endif
74918 +
74919 rb_erase(&vma->vm_rb, &mm->mm_rb);
74920 mm->map_count--;
74921 tail_vma = vma;
74922 @@ -1840,10 +2150,25 @@ int split_vma(struct mm_struct * mm, str
74923 struct mempolicy *pol;
74924 struct vm_area_struct *new;
74925
74926 +#ifdef CONFIG_PAX_SEGMEXEC
74927 + struct vm_area_struct *vma_m, *new_m = NULL;
74928 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
74929 +#endif
74930 +
74931 if (is_vm_hugetlb_page(vma) && (addr &
74932 ~(huge_page_mask(hstate_vma(vma)))))
74933 return -EINVAL;
74934
74935 +#ifdef CONFIG_PAX_SEGMEXEC
74936 + vma_m = pax_find_mirror_vma(vma);
74937 +
74938 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
74939 + BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
74940 + if (mm->map_count >= sysctl_max_map_count-1)
74941 + return -ENOMEM;
74942 + } else
74943 +#endif
74944 +
74945 if (mm->map_count >= sysctl_max_map_count)
74946 return -ENOMEM;
74947
74948 @@ -1851,6 +2176,16 @@ int split_vma(struct mm_struct * mm, str
74949 if (!new)
74950 return -ENOMEM;
74951
74952 +#ifdef CONFIG_PAX_SEGMEXEC
74953 + if (vma_m) {
74954 + new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
74955 + if (!new_m) {
74956 + kmem_cache_free(vm_area_cachep, new);
74957 + return -ENOMEM;
74958 + }
74959 + }
74960 +#endif
74961 +
74962 /* most fields are the same, copy all, and then fixup */
74963 *new = *vma;
74964
74965 @@ -1861,8 +2196,29 @@ int split_vma(struct mm_struct * mm, str
74966 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
74967 }
74968
74969 +#ifdef CONFIG_PAX_SEGMEXEC
74970 + if (vma_m) {
74971 + *new_m = *vma_m;
74972 + new_m->vm_mirror = new;
74973 + new->vm_mirror = new_m;
74974 +
74975 + if (new_below)
74976 + new_m->vm_end = addr_m;
74977 + else {
74978 + new_m->vm_start = addr_m;
74979 + new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
74980 + }
74981 + }
74982 +#endif
74983 +
74984 pol = mpol_dup(vma_policy(vma));
74985 if (IS_ERR(pol)) {
74986 +
74987 +#ifdef CONFIG_PAX_SEGMEXEC
74988 + if (new_m)
74989 + kmem_cache_free(vm_area_cachep, new_m);
74990 +#endif
74991 +
74992 kmem_cache_free(vm_area_cachep, new);
74993 return PTR_ERR(pol);
74994 }
74995 @@ -1883,6 +2239,28 @@ int split_vma(struct mm_struct * mm, str
74996 else
74997 vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
74998
74999 +#ifdef CONFIG_PAX_SEGMEXEC
75000 + if (vma_m) {
75001 + mpol_get(pol);
75002 + vma_set_policy(new_m, pol);
75003 +
75004 + if (new_m->vm_file) {
75005 + get_file(new_m->vm_file);
75006 + if (vma_m->vm_flags & VM_EXECUTABLE)
75007 + added_exe_file_vma(mm);
75008 + }
75009 +
75010 + if (new_m->vm_ops && new_m->vm_ops->open)
75011 + new_m->vm_ops->open(new_m);
75012 +
75013 + if (new_below)
75014 + vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
75015 + ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
75016 + else
75017 + vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
75018 + }
75019 +#endif
75020 +
75021 return 0;
75022 }
75023
75024 @@ -1891,11 +2269,30 @@ int split_vma(struct mm_struct * mm, str
75025 * work. This now handles partial unmappings.
75026 * Jeremy Fitzhardinge <jeremy@goop.org>
75027 */
75028 +#ifdef CONFIG_PAX_SEGMEXEC
75029 +int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
75030 +{
75031 + int ret = __do_munmap(mm, start, len);
75032 + if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
75033 + return ret;
75034 +
75035 + return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
75036 +}
75037 +
75038 +int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
75039 +#else
75040 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
75041 +#endif
75042 {
75043 unsigned long end;
75044 struct vm_area_struct *vma, *prev, *last;
75045
75046 + /*
75047 + * mm->mmap_sem is required to protect against another thread
75048 + * changing the mappings in case we sleep.
75049 + */
75050 + verify_mm_writelocked(mm);
75051 +
75052 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
75053 return -EINVAL;
75054
75055 @@ -1959,6 +2356,8 @@ int do_munmap(struct mm_struct *mm, unsi
75056 /* Fix up all other VM information */
75057 remove_vma_list(mm, vma);
75058
75059 + track_exec_limit(mm, start, end, 0UL);
75060 +
75061 return 0;
75062 }
75063
75064 @@ -1971,22 +2370,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
75065
75066 profile_munmap(addr);
75067
75068 +#ifdef CONFIG_PAX_SEGMEXEC
75069 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
75070 + (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
75071 + return -EINVAL;
75072 +#endif
75073 +
75074 down_write(&mm->mmap_sem);
75075 ret = do_munmap(mm, addr, len);
75076 up_write(&mm->mmap_sem);
75077 return ret;
75078 }
75079
75080 -static inline void verify_mm_writelocked(struct mm_struct *mm)
75081 -{
75082 -#ifdef CONFIG_DEBUG_VM
75083 - if (unlikely(down_read_trylock(&mm->mmap_sem))) {
75084 - WARN_ON(1);
75085 - up_read(&mm->mmap_sem);
75086 - }
75087 -#endif
75088 -}
75089 -
75090 /*
75091 * this is really a simplified "do_mmap". it only handles
75092 * anonymous maps. eventually we may be able to do some
75093 @@ -2000,6 +2395,7 @@ unsigned long do_brk(unsigned long addr,
75094 struct rb_node ** rb_link, * rb_parent;
75095 pgoff_t pgoff = addr >> PAGE_SHIFT;
75096 int error;
75097 + unsigned long charged;
75098
75099 len = PAGE_ALIGN(len);
75100 if (!len)
75101 @@ -2011,16 +2407,30 @@ unsigned long do_brk(unsigned long addr,
75102
75103 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
75104
75105 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
75106 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
75107 + flags &= ~VM_EXEC;
75108 +
75109 +#ifdef CONFIG_PAX_MPROTECT
75110 + if (mm->pax_flags & MF_PAX_MPROTECT)
75111 + flags &= ~VM_MAYEXEC;
75112 +#endif
75113 +
75114 + }
75115 +#endif
75116 +
75117 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
75118 if (error & ~PAGE_MASK)
75119 return error;
75120
75121 + charged = len >> PAGE_SHIFT;
75122 +
75123 /*
75124 * mlock MCL_FUTURE?
75125 */
75126 if (mm->def_flags & VM_LOCKED) {
75127 unsigned long locked, lock_limit;
75128 - locked = len >> PAGE_SHIFT;
75129 + locked = charged;
75130 locked += mm->locked_vm;
75131 lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
75132 lock_limit >>= PAGE_SHIFT;
75133 @@ -2037,22 +2447,22 @@ unsigned long do_brk(unsigned long addr,
75134 /*
75135 * Clear old maps. this also does some error checking for us
75136 */
75137 - munmap_back:
75138 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
75139 if (vma && vma->vm_start < addr + len) {
75140 if (do_munmap(mm, addr, len))
75141 return -ENOMEM;
75142 - goto munmap_back;
75143 + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
75144 + BUG_ON(vma && vma->vm_start < addr + len);
75145 }
75146
75147 /* Check against address space limits *after* clearing old maps... */
75148 - if (!may_expand_vm(mm, len >> PAGE_SHIFT))
75149 + if (!may_expand_vm(mm, charged))
75150 return -ENOMEM;
75151
75152 if (mm->map_count > sysctl_max_map_count)
75153 return -ENOMEM;
75154
75155 - if (security_vm_enough_memory(len >> PAGE_SHIFT))
75156 + if (security_vm_enough_memory(charged))
75157 return -ENOMEM;
75158
75159 /* Can we just expand an old private anonymous mapping? */
75160 @@ -2066,7 +2476,7 @@ unsigned long do_brk(unsigned long addr,
75161 */
75162 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
75163 if (!vma) {
75164 - vm_unacct_memory(len >> PAGE_SHIFT);
75165 + vm_unacct_memory(charged);
75166 return -ENOMEM;
75167 }
75168
75169 @@ -2078,11 +2488,12 @@ unsigned long do_brk(unsigned long addr,
75170 vma->vm_page_prot = vm_get_page_prot(flags);
75171 vma_link(mm, vma, prev, rb_link, rb_parent);
75172 out:
75173 - mm->total_vm += len >> PAGE_SHIFT;
75174 + mm->total_vm += charged;
75175 if (flags & VM_LOCKED) {
75176 if (!mlock_vma_pages_range(vma, addr, addr + len))
75177 - mm->locked_vm += (len >> PAGE_SHIFT);
75178 + mm->locked_vm += charged;
75179 }
75180 + track_exec_limit(mm, addr, addr + len, flags);
75181 return addr;
75182 }
75183
75184 @@ -2129,8 +2540,10 @@ void exit_mmap(struct mm_struct *mm)
75185 * Walk the list again, actually closing and freeing it,
75186 * with preemption enabled, without holding any MM locks.
75187 */
75188 - while (vma)
75189 + while (vma) {
75190 + vma->vm_mirror = NULL;
75191 vma = remove_vma(vma);
75192 + }
75193
75194 BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
75195 }
75196 @@ -2144,6 +2557,10 @@ int insert_vm_struct(struct mm_struct *
75197 struct vm_area_struct * __vma, * prev;
75198 struct rb_node ** rb_link, * rb_parent;
75199
75200 +#ifdef CONFIG_PAX_SEGMEXEC
75201 + struct vm_area_struct *vma_m = NULL;
75202 +#endif
75203 +
75204 /*
75205 * The vm_pgoff of a purely anonymous vma should be irrelevant
75206 * until its first write fault, when page's anon_vma and index
75207 @@ -2166,7 +2583,22 @@ int insert_vm_struct(struct mm_struct *
75208 if ((vma->vm_flags & VM_ACCOUNT) &&
75209 security_vm_enough_memory_mm(mm, vma_pages(vma)))
75210 return -ENOMEM;
75211 +
75212 +#ifdef CONFIG_PAX_SEGMEXEC
75213 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
75214 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
75215 + if (!vma_m)
75216 + return -ENOMEM;
75217 + }
75218 +#endif
75219 +
75220 vma_link(mm, vma, prev, rb_link, rb_parent);
75221 +
75222 +#ifdef CONFIG_PAX_SEGMEXEC
75223 + if (vma_m)
75224 + pax_mirror_vma(vma_m, vma);
75225 +#endif
75226 +
75227 return 0;
75228 }
75229
75230 @@ -2184,6 +2616,8 @@ struct vm_area_struct *copy_vma(struct v
75231 struct rb_node **rb_link, *rb_parent;
75232 struct mempolicy *pol;
75233
75234 + BUG_ON(vma->vm_mirror);
75235 +
75236 /*
75237 * If anonymous vma has not yet been faulted, update new pgoff
75238 * to match new location, to increase its chance of merging.
75239 @@ -2227,6 +2661,35 @@ struct vm_area_struct *copy_vma(struct v
75240 return new_vma;
75241 }
75242
75243 +#ifdef CONFIG_PAX_SEGMEXEC
75244 +void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
75245 +{
75246 + struct vm_area_struct *prev_m;
75247 + struct rb_node **rb_link_m, *rb_parent_m;
75248 + struct mempolicy *pol_m;
75249 +
75250 + BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
75251 + BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
75252 + BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
75253 + *vma_m = *vma;
75254 + pol_m = vma_policy(vma_m);
75255 + mpol_get(pol_m);
75256 + vma_set_policy(vma_m, pol_m);
75257 + vma_m->vm_start += SEGMEXEC_TASK_SIZE;
75258 + vma_m->vm_end += SEGMEXEC_TASK_SIZE;
75259 + vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
75260 + vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
75261 + if (vma_m->vm_file)
75262 + get_file(vma_m->vm_file);
75263 + if (vma_m->vm_ops && vma_m->vm_ops->open)
75264 + vma_m->vm_ops->open(vma_m);
75265 + find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
75266 + vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
75267 + vma_m->vm_mirror = vma;
75268 + vma->vm_mirror = vma_m;
75269 +}
75270 +#endif
75271 +
75272 /*
75273 * Return true if the calling process may expand its vm space by the passed
75274 * number of pages
75275 @@ -2237,7 +2700,7 @@ int may_expand_vm(struct mm_struct *mm,
75276 unsigned long lim;
75277
75278 lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
75279 -
75280 + gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
75281 if (cur + npages > lim)
75282 return 0;
75283 return 1;
75284 @@ -2307,6 +2770,22 @@ int install_special_mapping(struct mm_st
75285 vma->vm_start = addr;
75286 vma->vm_end = addr + len;
75287
75288 +#ifdef CONFIG_PAX_MPROTECT
75289 + if (mm->pax_flags & MF_PAX_MPROTECT) {
75290 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
75291 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
75292 + return -EPERM;
75293 + if (!(vm_flags & VM_EXEC))
75294 + vm_flags &= ~VM_MAYEXEC;
75295 +#else
75296 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
75297 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
75298 +#endif
75299 + else
75300 + vm_flags &= ~VM_MAYWRITE;
75301 + }
75302 +#endif
75303 +
75304 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
75305 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
75306
75307 diff -urNp linux-2.6.32.49/mm/mprotect.c linux-2.6.32.49/mm/mprotect.c
75308 --- linux-2.6.32.49/mm/mprotect.c 2011-11-08 19:02:43.000000000 -0500
75309 +++ linux-2.6.32.49/mm/mprotect.c 2011-11-15 19:59:43.000000000 -0500
75310 @@ -24,10 +24,16 @@
75311 #include <linux/mmu_notifier.h>
75312 #include <linux/migrate.h>
75313 #include <linux/perf_event.h>
75314 +
75315 +#ifdef CONFIG_PAX_MPROTECT
75316 +#include <linux/elf.h>
75317 +#endif
75318 +
75319 #include <asm/uaccess.h>
75320 #include <asm/pgtable.h>
75321 #include <asm/cacheflush.h>
75322 #include <asm/tlbflush.h>
75323 +#include <asm/mmu_context.h>
75324
75325 #ifndef pgprot_modify
75326 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
75327 @@ -132,6 +138,48 @@ static void change_protection(struct vm_
75328 flush_tlb_range(vma, start, end);
75329 }
75330
75331 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
75332 +/* called while holding the mmap semaphor for writing except stack expansion */
75333 +void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
75334 +{
75335 + unsigned long oldlimit, newlimit = 0UL;
75336 +
75337 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || nx_enabled)
75338 + return;
75339 +
75340 + spin_lock(&mm->page_table_lock);
75341 + oldlimit = mm->context.user_cs_limit;
75342 + if ((prot & VM_EXEC) && oldlimit < end)
75343 + /* USER_CS limit moved up */
75344 + newlimit = end;
75345 + else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
75346 + /* USER_CS limit moved down */
75347 + newlimit = start;
75348 +
75349 + if (newlimit) {
75350 + mm->context.user_cs_limit = newlimit;
75351 +
75352 +#ifdef CONFIG_SMP
75353 + wmb();
75354 + cpus_clear(mm->context.cpu_user_cs_mask);
75355 + cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
75356 +#endif
75357 +
75358 + set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
75359 + }
75360 + spin_unlock(&mm->page_table_lock);
75361 + if (newlimit == end) {
75362 + struct vm_area_struct *vma = find_vma(mm, oldlimit);
75363 +
75364 + for (; vma && vma->vm_start < end; vma = vma->vm_next)
75365 + if (is_vm_hugetlb_page(vma))
75366 + hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
75367 + else
75368 + change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
75369 + }
75370 +}
75371 +#endif
75372 +
75373 int
75374 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
75375 unsigned long start, unsigned long end, unsigned long newflags)
75376 @@ -144,11 +192,29 @@ mprotect_fixup(struct vm_area_struct *vm
75377 int error;
75378 int dirty_accountable = 0;
75379
75380 +#ifdef CONFIG_PAX_SEGMEXEC
75381 + struct vm_area_struct *vma_m = NULL;
75382 + unsigned long start_m, end_m;
75383 +
75384 + start_m = start + SEGMEXEC_TASK_SIZE;
75385 + end_m = end + SEGMEXEC_TASK_SIZE;
75386 +#endif
75387 +
75388 if (newflags == oldflags) {
75389 *pprev = vma;
75390 return 0;
75391 }
75392
75393 + if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
75394 + struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
75395 +
75396 + if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
75397 + return -ENOMEM;
75398 +
75399 + if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
75400 + return -ENOMEM;
75401 + }
75402 +
75403 /*
75404 * If we make a private mapping writable we increase our commit;
75405 * but (without finer accounting) cannot reduce our commit if we
75406 @@ -165,6 +231,38 @@ mprotect_fixup(struct vm_area_struct *vm
75407 }
75408 }
75409
75410 +#ifdef CONFIG_PAX_SEGMEXEC
75411 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
75412 + if (start != vma->vm_start) {
75413 + error = split_vma(mm, vma, start, 1);
75414 + if (error)
75415 + goto fail;
75416 + BUG_ON(!*pprev || (*pprev)->vm_next == vma);
75417 + *pprev = (*pprev)->vm_next;
75418 + }
75419 +
75420 + if (end != vma->vm_end) {
75421 + error = split_vma(mm, vma, end, 0);
75422 + if (error)
75423 + goto fail;
75424 + }
75425 +
75426 + if (pax_find_mirror_vma(vma)) {
75427 + error = __do_munmap(mm, start_m, end_m - start_m);
75428 + if (error)
75429 + goto fail;
75430 + } else {
75431 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
75432 + if (!vma_m) {
75433 + error = -ENOMEM;
75434 + goto fail;
75435 + }
75436 + vma->vm_flags = newflags;
75437 + pax_mirror_vma(vma_m, vma);
75438 + }
75439 + }
75440 +#endif
75441 +
75442 /*
75443 * First try to merge with previous and/or next vma.
75444 */
75445 @@ -195,9 +293,21 @@ success:
75446 * vm_flags and vm_page_prot are protected by the mmap_sem
75447 * held in write mode.
75448 */
75449 +
75450 +#ifdef CONFIG_PAX_SEGMEXEC
75451 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
75452 + pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
75453 +#endif
75454 +
75455 vma->vm_flags = newflags;
75456 +
75457 +#ifdef CONFIG_PAX_MPROTECT
75458 + if (mm->binfmt && mm->binfmt->handle_mprotect)
75459 + mm->binfmt->handle_mprotect(vma, newflags);
75460 +#endif
75461 +
75462 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
75463 - vm_get_page_prot(newflags));
75464 + vm_get_page_prot(vma->vm_flags));
75465
75466 if (vma_wants_writenotify(vma)) {
75467 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
75468 @@ -239,6 +349,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
75469 end = start + len;
75470 if (end <= start)
75471 return -ENOMEM;
75472 +
75473 +#ifdef CONFIG_PAX_SEGMEXEC
75474 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
75475 + if (end > SEGMEXEC_TASK_SIZE)
75476 + return -EINVAL;
75477 + } else
75478 +#endif
75479 +
75480 + if (end > TASK_SIZE)
75481 + return -EINVAL;
75482 +
75483 if (!arch_validate_prot(prot))
75484 return -EINVAL;
75485
75486 @@ -246,7 +367,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
75487 /*
75488 * Does the application expect PROT_READ to imply PROT_EXEC:
75489 */
75490 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
75491 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
75492 prot |= PROT_EXEC;
75493
75494 vm_flags = calc_vm_prot_bits(prot);
75495 @@ -278,6 +399,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
75496 if (start > vma->vm_start)
75497 prev = vma;
75498
75499 +#ifdef CONFIG_PAX_MPROTECT
75500 + if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
75501 + current->mm->binfmt->handle_mprotect(vma, vm_flags);
75502 +#endif
75503 +
75504 for (nstart = start ; ; ) {
75505 unsigned long newflags;
75506
75507 @@ -287,6 +413,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
75508
75509 /* newflags >> 4 shift VM_MAY% in place of VM_% */
75510 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
75511 + if (prot & (PROT_WRITE | PROT_EXEC))
75512 + gr_log_rwxmprotect(vma->vm_file);
75513 +
75514 + error = -EACCES;
75515 + goto out;
75516 + }
75517 +
75518 + if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
75519 error = -EACCES;
75520 goto out;
75521 }
75522 @@ -301,6 +435,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
75523 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
75524 if (error)
75525 goto out;
75526 +
75527 + track_exec_limit(current->mm, nstart, tmp, vm_flags);
75528 +
75529 nstart = tmp;
75530
75531 if (nstart < prev->vm_end)
75532 diff -urNp linux-2.6.32.49/mm/mremap.c linux-2.6.32.49/mm/mremap.c
75533 --- linux-2.6.32.49/mm/mremap.c 2011-11-08 19:02:43.000000000 -0500
75534 +++ linux-2.6.32.49/mm/mremap.c 2011-11-15 19:59:43.000000000 -0500
75535 @@ -112,6 +112,12 @@ static void move_ptes(struct vm_area_str
75536 continue;
75537 pte = ptep_clear_flush(vma, old_addr, old_pte);
75538 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
75539 +
75540 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
75541 + if (!nx_enabled && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
75542 + pte = pte_exprotect(pte);
75543 +#endif
75544 +
75545 set_pte_at(mm, new_addr, new_pte, pte);
75546 }
75547
75548 @@ -271,6 +277,11 @@ static struct vm_area_struct *vma_to_res
75549 if (is_vm_hugetlb_page(vma))
75550 goto Einval;
75551
75552 +#ifdef CONFIG_PAX_SEGMEXEC
75553 + if (pax_find_mirror_vma(vma))
75554 + goto Einval;
75555 +#endif
75556 +
75557 /* We can't remap across vm area boundaries */
75558 if (old_len > vma->vm_end - addr)
75559 goto Efault;
75560 @@ -327,20 +338,25 @@ static unsigned long mremap_to(unsigned
75561 unsigned long ret = -EINVAL;
75562 unsigned long charged = 0;
75563 unsigned long map_flags;
75564 + unsigned long pax_task_size = TASK_SIZE;
75565
75566 if (new_addr & ~PAGE_MASK)
75567 goto out;
75568
75569 - if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
75570 +#ifdef CONFIG_PAX_SEGMEXEC
75571 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
75572 + pax_task_size = SEGMEXEC_TASK_SIZE;
75573 +#endif
75574 +
75575 + pax_task_size -= PAGE_SIZE;
75576 +
75577 + if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
75578 goto out;
75579
75580 /* Check if the location we're moving into overlaps the
75581 * old location at all, and fail if it does.
75582 */
75583 - if ((new_addr <= addr) && (new_addr+new_len) > addr)
75584 - goto out;
75585 -
75586 - if ((addr <= new_addr) && (addr+old_len) > new_addr)
75587 + if (addr + old_len > new_addr && new_addr + new_len > addr)
75588 goto out;
75589
75590 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
75591 @@ -412,6 +428,7 @@ unsigned long do_mremap(unsigned long ad
75592 struct vm_area_struct *vma;
75593 unsigned long ret = -EINVAL;
75594 unsigned long charged = 0;
75595 + unsigned long pax_task_size = TASK_SIZE;
75596
75597 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
75598 goto out;
75599 @@ -430,6 +447,17 @@ unsigned long do_mremap(unsigned long ad
75600 if (!new_len)
75601 goto out;
75602
75603 +#ifdef CONFIG_PAX_SEGMEXEC
75604 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
75605 + pax_task_size = SEGMEXEC_TASK_SIZE;
75606 +#endif
75607 +
75608 + pax_task_size -= PAGE_SIZE;
75609 +
75610 + if (new_len > pax_task_size || addr > pax_task_size-new_len ||
75611 + old_len > pax_task_size || addr > pax_task_size-old_len)
75612 + goto out;
75613 +
75614 if (flags & MREMAP_FIXED) {
75615 if (flags & MREMAP_MAYMOVE)
75616 ret = mremap_to(addr, old_len, new_addr, new_len);
75617 @@ -476,6 +504,7 @@ unsigned long do_mremap(unsigned long ad
75618 addr + new_len);
75619 }
75620 ret = addr;
75621 + track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
75622 goto out;
75623 }
75624 }
75625 @@ -502,7 +531,13 @@ unsigned long do_mremap(unsigned long ad
75626 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
75627 if (ret)
75628 goto out;
75629 +
75630 + map_flags = vma->vm_flags;
75631 ret = move_vma(vma, addr, old_len, new_len, new_addr);
75632 + if (!(ret & ~PAGE_MASK)) {
75633 + track_exec_limit(current->mm, addr, addr + old_len, 0UL);
75634 + track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
75635 + }
75636 }
75637 out:
75638 if (ret & ~PAGE_MASK)
75639 diff -urNp linux-2.6.32.49/mm/nommu.c linux-2.6.32.49/mm/nommu.c
75640 --- linux-2.6.32.49/mm/nommu.c 2011-11-08 19:02:43.000000000 -0500
75641 +++ linux-2.6.32.49/mm/nommu.c 2011-11-15 19:59:43.000000000 -0500
75642 @@ -67,7 +67,6 @@ int sysctl_overcommit_memory = OVERCOMMI
75643 int sysctl_overcommit_ratio = 50; /* default is 50% */
75644 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
75645 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
75646 -int heap_stack_gap = 0;
75647
75648 atomic_long_t mmap_pages_allocated;
75649
75650 @@ -761,15 +760,6 @@ struct vm_area_struct *find_vma(struct m
75651 EXPORT_SYMBOL(find_vma);
75652
75653 /*
75654 - * find a VMA
75655 - * - we don't extend stack VMAs under NOMMU conditions
75656 - */
75657 -struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
75658 -{
75659 - return find_vma(mm, addr);
75660 -}
75661 -
75662 -/*
75663 * expand a stack to a given address
75664 * - not supported under NOMMU conditions
75665 */
75666 diff -urNp linux-2.6.32.49/mm/page_alloc.c linux-2.6.32.49/mm/page_alloc.c
75667 --- linux-2.6.32.49/mm/page_alloc.c 2011-11-08 19:02:43.000000000 -0500
75668 +++ linux-2.6.32.49/mm/page_alloc.c 2011-11-15 19:59:43.000000000 -0500
75669 @@ -289,7 +289,7 @@ out:
75670 * This usage means that zero-order pages may not be compound.
75671 */
75672
75673 -static void free_compound_page(struct page *page)
75674 +void free_compound_page(struct page *page)
75675 {
75676 __free_pages_ok(page, compound_order(page));
75677 }
75678 @@ -587,6 +587,10 @@ static void __free_pages_ok(struct page
75679 int bad = 0;
75680 int wasMlocked = __TestClearPageMlocked(page);
75681
75682 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
75683 + unsigned long index = 1UL << order;
75684 +#endif
75685 +
75686 kmemcheck_free_shadow(page, order);
75687
75688 for (i = 0 ; i < (1 << order) ; ++i)
75689 @@ -599,6 +603,12 @@ static void __free_pages_ok(struct page
75690 debug_check_no_obj_freed(page_address(page),
75691 PAGE_SIZE << order);
75692 }
75693 +
75694 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
75695 + for (; index; --index)
75696 + sanitize_highpage(page + index - 1);
75697 +#endif
75698 +
75699 arch_free_page(page, order);
75700 kernel_map_pages(page, 1 << order, 0);
75701
75702 @@ -702,8 +712,10 @@ static int prep_new_page(struct page *pa
75703 arch_alloc_page(page, order);
75704 kernel_map_pages(page, 1 << order, 1);
75705
75706 +#ifndef CONFIG_PAX_MEMORY_SANITIZE
75707 if (gfp_flags & __GFP_ZERO)
75708 prep_zero_page(page, order, gfp_flags);
75709 +#endif
75710
75711 if (order && (gfp_flags & __GFP_COMP))
75712 prep_compound_page(page, order);
75713 @@ -1097,6 +1109,11 @@ static void free_hot_cold_page(struct pa
75714 debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
75715 debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
75716 }
75717 +
75718 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
75719 + sanitize_highpage(page);
75720 +#endif
75721 +
75722 arch_free_page(page, 0);
75723 kernel_map_pages(page, 1, 0);
75724
75725 @@ -2179,6 +2196,8 @@ void show_free_areas(void)
75726 int cpu;
75727 struct zone *zone;
75728
75729 + pax_track_stack();
75730 +
75731 for_each_populated_zone(zone) {
75732 show_node(zone);
75733 printk("%s per-cpu:\n", zone->name);
75734 @@ -3736,7 +3755,7 @@ static void __init setup_usemap(struct p
75735 zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
75736 }
75737 #else
75738 -static void inline setup_usemap(struct pglist_data *pgdat,
75739 +static inline void setup_usemap(struct pglist_data *pgdat,
75740 struct zone *zone, unsigned long zonesize) {}
75741 #endif /* CONFIG_SPARSEMEM */
75742
75743 diff -urNp linux-2.6.32.49/mm/percpu.c linux-2.6.32.49/mm/percpu.c
75744 --- linux-2.6.32.49/mm/percpu.c 2011-11-08 19:02:43.000000000 -0500
75745 +++ linux-2.6.32.49/mm/percpu.c 2011-11-15 19:59:43.000000000 -0500
75746 @@ -115,7 +115,7 @@ static unsigned int pcpu_first_unit_cpu
75747 static unsigned int pcpu_last_unit_cpu __read_mostly;
75748
75749 /* the address of the first chunk which starts with the kernel static area */
75750 -void *pcpu_base_addr __read_mostly;
75751 +void *pcpu_base_addr __read_only;
75752 EXPORT_SYMBOL_GPL(pcpu_base_addr);
75753
75754 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
75755 diff -urNp linux-2.6.32.49/mm/rmap.c linux-2.6.32.49/mm/rmap.c
75756 --- linux-2.6.32.49/mm/rmap.c 2011-11-08 19:02:43.000000000 -0500
75757 +++ linux-2.6.32.49/mm/rmap.c 2011-11-15 19:59:43.000000000 -0500
75758 @@ -121,6 +121,17 @@ int anon_vma_prepare(struct vm_area_stru
75759 /* page_table_lock to protect against threads */
75760 spin_lock(&mm->page_table_lock);
75761 if (likely(!vma->anon_vma)) {
75762 +
75763 +#ifdef CONFIG_PAX_SEGMEXEC
75764 + struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
75765 +
75766 + if (vma_m) {
75767 + BUG_ON(vma_m->anon_vma);
75768 + vma_m->anon_vma = anon_vma;
75769 + list_add_tail(&vma_m->anon_vma_node, &anon_vma->head);
75770 + }
75771 +#endif
75772 +
75773 vma->anon_vma = anon_vma;
75774 list_add_tail(&vma->anon_vma_node, &anon_vma->head);
75775 allocated = NULL;
75776 diff -urNp linux-2.6.32.49/mm/shmem.c linux-2.6.32.49/mm/shmem.c
75777 --- linux-2.6.32.49/mm/shmem.c 2011-11-08 19:02:43.000000000 -0500
75778 +++ linux-2.6.32.49/mm/shmem.c 2011-11-15 19:59:43.000000000 -0500
75779 @@ -31,7 +31,7 @@
75780 #include <linux/swap.h>
75781 #include <linux/ima.h>
75782
75783 -static struct vfsmount *shm_mnt;
75784 +struct vfsmount *shm_mnt;
75785
75786 #ifdef CONFIG_SHMEM
75787 /*
75788 @@ -1061,6 +1061,8 @@ static int shmem_writepage(struct page *
75789 goto unlock;
75790 }
75791 entry = shmem_swp_entry(info, index, NULL);
75792 + if (!entry)
75793 + goto unlock;
75794 if (entry->val) {
75795 /*
75796 * The more uptodate page coming down from a stacked
75797 @@ -1144,6 +1146,8 @@ static struct page *shmem_swapin(swp_ent
75798 struct vm_area_struct pvma;
75799 struct page *page;
75800
75801 + pax_track_stack();
75802 +
75803 spol = mpol_cond_copy(&mpol,
75804 mpol_shared_policy_lookup(&info->policy, idx));
75805
75806 @@ -1962,7 +1966,7 @@ static int shmem_symlink(struct inode *d
75807
75808 info = SHMEM_I(inode);
75809 inode->i_size = len-1;
75810 - if (len <= (char *)inode - (char *)info) {
75811 + if (len <= (char *)inode - (char *)info && len <= 64) {
75812 /* do it inline */
75813 memcpy(info, symname, len);
75814 inode->i_op = &shmem_symlink_inline_operations;
75815 @@ -2310,8 +2314,7 @@ int shmem_fill_super(struct super_block
75816 int err = -ENOMEM;
75817
75818 /* Round up to L1_CACHE_BYTES to resist false sharing */
75819 - sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
75820 - L1_CACHE_BYTES), GFP_KERNEL);
75821 + sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
75822 if (!sbinfo)
75823 return -ENOMEM;
75824
75825 diff -urNp linux-2.6.32.49/mm/slab.c linux-2.6.32.49/mm/slab.c
75826 --- linux-2.6.32.49/mm/slab.c 2011-11-08 19:02:43.000000000 -0500
75827 +++ linux-2.6.32.49/mm/slab.c 2011-11-18 18:01:52.000000000 -0500
75828 @@ -174,7 +174,7 @@
75829
75830 /* Legal flag mask for kmem_cache_create(). */
75831 #if DEBUG
75832 -# define CREATE_MASK (SLAB_RED_ZONE | \
75833 +# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
75834 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
75835 SLAB_CACHE_DMA | \
75836 SLAB_STORE_USER | \
75837 @@ -182,7 +182,7 @@
75838 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
75839 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
75840 #else
75841 -# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
75842 +# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
75843 SLAB_CACHE_DMA | \
75844 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
75845 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
75846 @@ -308,7 +308,7 @@ struct kmem_list3 {
75847 * Need this for bootstrapping a per node allocator.
75848 */
75849 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
75850 -struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
75851 +struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
75852 #define CACHE_CACHE 0
75853 #define SIZE_AC MAX_NUMNODES
75854 #define SIZE_L3 (2 * MAX_NUMNODES)
75855 @@ -409,10 +409,10 @@ static void kmem_list3_init(struct kmem_
75856 if ((x)->max_freeable < i) \
75857 (x)->max_freeable = i; \
75858 } while (0)
75859 -#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
75860 -#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
75861 -#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
75862 -#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
75863 +#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
75864 +#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
75865 +#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
75866 +#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
75867 #else
75868 #define STATS_INC_ACTIVE(x) do { } while (0)
75869 #define STATS_DEC_ACTIVE(x) do { } while (0)
75870 @@ -558,7 +558,7 @@ static inline void *index_to_obj(struct
75871 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
75872 */
75873 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
75874 - const struct slab *slab, void *obj)
75875 + const struct slab *slab, const void *obj)
75876 {
75877 u32 offset = (obj - slab->s_mem);
75878 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
75879 @@ -1453,7 +1453,7 @@ void __init kmem_cache_init(void)
75880 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
75881 sizes[INDEX_AC].cs_size,
75882 ARCH_KMALLOC_MINALIGN,
75883 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
75884 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
75885 NULL);
75886
75887 if (INDEX_AC != INDEX_L3) {
75888 @@ -1461,7 +1461,7 @@ void __init kmem_cache_init(void)
75889 kmem_cache_create(names[INDEX_L3].name,
75890 sizes[INDEX_L3].cs_size,
75891 ARCH_KMALLOC_MINALIGN,
75892 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
75893 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
75894 NULL);
75895 }
75896
75897 @@ -1479,7 +1479,7 @@ void __init kmem_cache_init(void)
75898 sizes->cs_cachep = kmem_cache_create(names->name,
75899 sizes->cs_size,
75900 ARCH_KMALLOC_MINALIGN,
75901 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
75902 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
75903 NULL);
75904 }
75905 #ifdef CONFIG_ZONE_DMA
75906 @@ -4211,10 +4211,10 @@ static int s_show(struct seq_file *m, vo
75907 }
75908 /* cpu stats */
75909 {
75910 - unsigned long allochit = atomic_read(&cachep->allochit);
75911 - unsigned long allocmiss = atomic_read(&cachep->allocmiss);
75912 - unsigned long freehit = atomic_read(&cachep->freehit);
75913 - unsigned long freemiss = atomic_read(&cachep->freemiss);
75914 + unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
75915 + unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
75916 + unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
75917 + unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
75918
75919 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
75920 allochit, allocmiss, freehit, freemiss);
75921 @@ -4471,15 +4471,70 @@ static const struct file_operations proc
75922
75923 static int __init slab_proc_init(void)
75924 {
75925 - proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
75926 + mode_t gr_mode = S_IRUGO;
75927 +
75928 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
75929 + gr_mode = S_IRUSR;
75930 +#endif
75931 +
75932 + proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
75933 #ifdef CONFIG_DEBUG_SLAB_LEAK
75934 - proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
75935 + proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
75936 #endif
75937 return 0;
75938 }
75939 module_init(slab_proc_init);
75940 #endif
75941
75942 +void check_object_size(const void *ptr, unsigned long n, bool to)
75943 +{
75944 +
75945 +#ifdef CONFIG_PAX_USERCOPY
75946 + struct page *page;
75947 + struct kmem_cache *cachep = NULL;
75948 + struct slab *slabp;
75949 + unsigned int objnr;
75950 + unsigned long offset;
75951 + const char *type;
75952 +
75953 + if (!n)
75954 + return;
75955 +
75956 + type = "<null>";
75957 + if (ZERO_OR_NULL_PTR(ptr))
75958 + goto report;
75959 +
75960 + if (!virt_addr_valid(ptr))
75961 + return;
75962 +
75963 + page = virt_to_head_page(ptr);
75964 +
75965 + type = "<process stack>";
75966 + if (!PageSlab(page)) {
75967 + if (object_is_on_stack(ptr, n) == -1)
75968 + goto report;
75969 + return;
75970 + }
75971 +
75972 + cachep = page_get_cache(page);
75973 + type = cachep->name;
75974 + if (!(cachep->flags & SLAB_USERCOPY))
75975 + goto report;
75976 +
75977 + slabp = page_get_slab(page);
75978 + objnr = obj_to_index(cachep, slabp, ptr);
75979 + BUG_ON(objnr >= cachep->num);
75980 + offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
75981 + if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
75982 + return;
75983 +
75984 +report:
75985 + pax_report_usercopy(ptr, n, to, type);
75986 +#endif
75987 +
75988 +}
75989 +EXPORT_SYMBOL(check_object_size);
75990 +
75991 /**
75992 * ksize - get the actual amount of memory allocated for a given object
75993 * @objp: Pointer to the object
75994 diff -urNp linux-2.6.32.49/mm/slob.c linux-2.6.32.49/mm/slob.c
75995 --- linux-2.6.32.49/mm/slob.c 2011-11-08 19:02:43.000000000 -0500
75996 +++ linux-2.6.32.49/mm/slob.c 2011-11-18 18:01:52.000000000 -0500
75997 @@ -29,7 +29,7 @@
75998 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
75999 * alloc_pages() directly, allocating compound pages so the page order
76000 * does not have to be separately tracked, and also stores the exact
76001 - * allocation size in page->private so that it can be used to accurately
76002 + * allocation size in slob_page->size so that it can be used to accurately
76003 * provide ksize(). These objects are detected in kfree() because slob_page()
76004 * is false for them.
76005 *
76006 @@ -58,6 +58,7 @@
76007 */
76008
76009 #include <linux/kernel.h>
76010 +#include <linux/sched.h>
76011 #include <linux/slab.h>
76012 #include <linux/mm.h>
76013 #include <linux/swap.h> /* struct reclaim_state */
76014 @@ -100,7 +101,8 @@ struct slob_page {
76015 unsigned long flags; /* mandatory */
76016 atomic_t _count; /* mandatory */
76017 slobidx_t units; /* free units left in page */
76018 - unsigned long pad[2];
76019 + unsigned long pad[1];
76020 + unsigned long size; /* size when >=PAGE_SIZE */
76021 slob_t *free; /* first free slob_t in page */
76022 struct list_head list; /* linked list of free pages */
76023 };
76024 @@ -133,7 +135,7 @@ static LIST_HEAD(free_slob_large);
76025 */
76026 static inline int is_slob_page(struct slob_page *sp)
76027 {
76028 - return PageSlab((struct page *)sp);
76029 + return PageSlab((struct page *)sp) && !sp->size;
76030 }
76031
76032 static inline void set_slob_page(struct slob_page *sp)
76033 @@ -148,7 +150,7 @@ static inline void clear_slob_page(struc
76034
76035 static inline struct slob_page *slob_page(const void *addr)
76036 {
76037 - return (struct slob_page *)virt_to_page(addr);
76038 + return (struct slob_page *)virt_to_head_page(addr);
76039 }
76040
76041 /*
76042 @@ -208,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_
76043 /*
76044 * Return the size of a slob block.
76045 */
76046 -static slobidx_t slob_units(slob_t *s)
76047 +static slobidx_t slob_units(const slob_t *s)
76048 {
76049 if (s->units > 0)
76050 return s->units;
76051 @@ -218,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
76052 /*
76053 * Return the next free slob block pointer after this one.
76054 */
76055 -static slob_t *slob_next(slob_t *s)
76056 +static slob_t *slob_next(const slob_t *s)
76057 {
76058 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
76059 slobidx_t next;
76060 @@ -233,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
76061 /*
76062 * Returns true if s is the last free block in its page.
76063 */
76064 -static int slob_last(slob_t *s)
76065 +static int slob_last(const slob_t *s)
76066 {
76067 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
76068 }
76069 @@ -252,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, i
76070 if (!page)
76071 return NULL;
76072
76073 + set_slob_page(page);
76074 return page_address(page);
76075 }
76076
76077 @@ -368,11 +371,11 @@ static void *slob_alloc(size_t size, gfp
76078 if (!b)
76079 return NULL;
76080 sp = slob_page(b);
76081 - set_slob_page(sp);
76082
76083 spin_lock_irqsave(&slob_lock, flags);
76084 sp->units = SLOB_UNITS(PAGE_SIZE);
76085 sp->free = b;
76086 + sp->size = 0;
76087 INIT_LIST_HEAD(&sp->list);
76088 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
76089 set_slob_page_free(sp, slob_list);
76090 @@ -475,10 +478,9 @@ out:
76091 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
76092 #endif
76093
76094 -void *__kmalloc_node(size_t size, gfp_t gfp, int node)
76095 +static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
76096 {
76097 - unsigned int *m;
76098 - int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
76099 + slob_t *m;
76100 void *ret;
76101
76102 lockdep_trace_alloc(gfp);
76103 @@ -491,7 +493,10 @@ void *__kmalloc_node(size_t size, gfp_t
76104
76105 if (!m)
76106 return NULL;
76107 - *m = size;
76108 + BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
76109 + BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
76110 + m[0].units = size;
76111 + m[1].units = align;
76112 ret = (void *)m + align;
76113
76114 trace_kmalloc_node(_RET_IP_, ret,
76115 @@ -501,16 +506,25 @@ void *__kmalloc_node(size_t size, gfp_t
76116
76117 ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
76118 if (ret) {
76119 - struct page *page;
76120 - page = virt_to_page(ret);
76121 - page->private = size;
76122 + struct slob_page *sp;
76123 + sp = slob_page(ret);
76124 + sp->size = size;
76125 }
76126
76127 trace_kmalloc_node(_RET_IP_, ret,
76128 size, PAGE_SIZE << order, gfp, node);
76129 }
76130
76131 - kmemleak_alloc(ret, size, 1, gfp);
76132 + return ret;
76133 +}
76134 +
76135 +void *__kmalloc_node(size_t size, gfp_t gfp, int node)
76136 +{
76137 + int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
76138 + void *ret = __kmalloc_node_align(size, gfp, node, align);
76139 +
76140 + if (!ZERO_OR_NULL_PTR(ret))
76141 + kmemleak_alloc(ret, size, 1, gfp);
76142 return ret;
76143 }
76144 EXPORT_SYMBOL(__kmalloc_node);
76145 @@ -528,13 +542,92 @@ void kfree(const void *block)
76146 sp = slob_page(block);
76147 if (is_slob_page(sp)) {
76148 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
76149 - unsigned int *m = (unsigned int *)(block - align);
76150 - slob_free(m, *m + align);
76151 - } else
76152 + slob_t *m = (slob_t *)(block - align);
76153 + slob_free(m, m[0].units + align);
76154 + } else {
76155 + clear_slob_page(sp);
76156 + free_slob_page(sp);
76157 + sp->size = 0;
76158 put_page(&sp->page);
76159 + }
76160 }
76161 EXPORT_SYMBOL(kfree);
76162
76163 +void check_object_size(const void *ptr, unsigned long n, bool to)
76164 +{
76165 +
76166 +#ifdef CONFIG_PAX_USERCOPY
76167 + struct slob_page *sp;
76168 + const slob_t *free;
76169 + const void *base;
76170 + unsigned long flags;
76171 + const char *type;
76172 +
76173 + if (!n)
76174 + return;
76175 +
76176 + type = "<null>";
76177 + if (ZERO_OR_NULL_PTR(ptr))
76178 + goto report;
76179 +
76180 + if (!virt_addr_valid(ptr))
76181 + return;
76182 +
76183 + type = "<process stack>";
76184 + sp = slob_page(ptr);
76185 + if (!PageSlab((struct page*)sp)) {
76186 + if (object_is_on_stack(ptr, n) == -1)
76187 + goto report;
76188 + return;
76189 + }
76190 +
76191 + type = "<slob>";
76192 + if (sp->size) {
76193 + base = page_address(&sp->page);
76194 + if (base <= ptr && n <= sp->size - (ptr - base))
76195 + return;
76196 + goto report;
76197 + }
76198 +
76199 + /* some tricky double walking to find the chunk */
76200 + spin_lock_irqsave(&slob_lock, flags);
76201 + base = (void *)((unsigned long)ptr & PAGE_MASK);
76202 + free = sp->free;
76203 +
76204 + while (!slob_last(free) && (void *)free <= ptr) {
76205 + base = free + slob_units(free);
76206 + free = slob_next(free);
76207 + }
76208 +
76209 + while (base < (void *)free) {
76210 + slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
76211 + int size = SLOB_UNIT * SLOB_UNITS(m + align);
76212 + int offset;
76213 +
76214 + if (ptr < base + align)
76215 + break;
76216 +
76217 + offset = ptr - base - align;
76218 + if (offset >= m) {
76219 + base += size;
76220 + continue;
76221 + }
76222 +
76223 + if (n > m - offset)
76224 + break;
76225 +
76226 + spin_unlock_irqrestore(&slob_lock, flags);
76227 + return;
76228 + }
76229 +
76230 + spin_unlock_irqrestore(&slob_lock, flags);
76231 +report:
76232 + pax_report_usercopy(ptr, n, to, type);
76233 +#endif
76234 +
76235 +}
76236 +EXPORT_SYMBOL(check_object_size);
76237 +
76238 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
76239 size_t ksize(const void *block)
76240 {
76241 @@ -547,10 +640,10 @@ size_t ksize(const void *block)
76242 sp = slob_page(block);
76243 if (is_slob_page(sp)) {
76244 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
76245 - unsigned int *m = (unsigned int *)(block - align);
76246 - return SLOB_UNITS(*m) * SLOB_UNIT;
76247 + slob_t *m = (slob_t *)(block - align);
76248 + return SLOB_UNITS(m[0].units) * SLOB_UNIT;
76249 } else
76250 - return sp->page.private;
76251 + return sp->size;
76252 }
76253 EXPORT_SYMBOL(ksize);
76254
76255 @@ -566,8 +659,13 @@ struct kmem_cache *kmem_cache_create(con
76256 {
76257 struct kmem_cache *c;
76258
76259 +#ifdef CONFIG_PAX_USERCOPY
76260 + c = __kmalloc_node_align(sizeof(struct kmem_cache),
76261 + GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
76262 +#else
76263 c = slob_alloc(sizeof(struct kmem_cache),
76264 GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
76265 +#endif
76266
76267 if (c) {
76268 c->name = name;
76269 @@ -605,17 +703,25 @@ void *kmem_cache_alloc_node(struct kmem_
76270 {
76271 void *b;
76272
76273 +#ifdef CONFIG_PAX_USERCOPY
76274 + b = __kmalloc_node_align(c->size, flags, node, c->align);
76275 +#else
76276 if (c->size < PAGE_SIZE) {
76277 b = slob_alloc(c->size, flags, c->align, node);
76278 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
76279 SLOB_UNITS(c->size) * SLOB_UNIT,
76280 flags, node);
76281 } else {
76282 + struct slob_page *sp;
76283 +
76284 b = slob_new_pages(flags, get_order(c->size), node);
76285 + sp = slob_page(b);
76286 + sp->size = c->size;
76287 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
76288 PAGE_SIZE << get_order(c->size),
76289 flags, node);
76290 }
76291 +#endif
76292
76293 if (c->ctor)
76294 c->ctor(b);
76295 @@ -627,10 +733,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
76296
76297 static void __kmem_cache_free(void *b, int size)
76298 {
76299 - if (size < PAGE_SIZE)
76300 + struct slob_page *sp = slob_page(b);
76301 +
76302 + if (is_slob_page(sp))
76303 slob_free(b, size);
76304 - else
76305 + else {
76306 + clear_slob_page(sp);
76307 + free_slob_page(sp);
76308 + sp->size = 0;
76309 slob_free_pages(b, get_order(size));
76310 + }
76311 }
76312
76313 static void kmem_rcu_free(struct rcu_head *head)
76314 @@ -643,18 +755,32 @@ static void kmem_rcu_free(struct rcu_hea
76315
76316 void kmem_cache_free(struct kmem_cache *c, void *b)
76317 {
76318 + int size = c->size;
76319 +
76320 +#ifdef CONFIG_PAX_USERCOPY
76321 + if (size + c->align < PAGE_SIZE) {
76322 + size += c->align;
76323 + b -= c->align;
76324 + }
76325 +#endif
76326 +
76327 kmemleak_free_recursive(b, c->flags);
76328 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
76329 struct slob_rcu *slob_rcu;
76330 - slob_rcu = b + (c->size - sizeof(struct slob_rcu));
76331 + slob_rcu = b + (size - sizeof(struct slob_rcu));
76332 INIT_RCU_HEAD(&slob_rcu->head);
76333 - slob_rcu->size = c->size;
76334 + slob_rcu->size = size;
76335 call_rcu(&slob_rcu->head, kmem_rcu_free);
76336 } else {
76337 - __kmem_cache_free(b, c->size);
76338 + __kmem_cache_free(b, size);
76339 }
76340
76341 +#ifdef CONFIG_PAX_USERCOPY
76342 + trace_kfree(_RET_IP_, b);
76343 +#else
76344 trace_kmem_cache_free(_RET_IP_, b);
76345 +#endif
76346 +
76347 }
76348 EXPORT_SYMBOL(kmem_cache_free);
76349
76350 diff -urNp linux-2.6.32.49/mm/slub.c linux-2.6.32.49/mm/slub.c
76351 --- linux-2.6.32.49/mm/slub.c 2011-11-08 19:02:43.000000000 -0500
76352 +++ linux-2.6.32.49/mm/slub.c 2011-11-18 18:01:52.000000000 -0500
76353 @@ -201,7 +201,7 @@ struct track {
76354
76355 enum track_item { TRACK_ALLOC, TRACK_FREE };
76356
76357 -#ifdef CONFIG_SLUB_DEBUG
76358 +#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
76359 static int sysfs_slab_add(struct kmem_cache *);
76360 static int sysfs_slab_alias(struct kmem_cache *, const char *);
76361 static void sysfs_slab_remove(struct kmem_cache *);
76362 @@ -410,7 +410,7 @@ static void print_track(const char *s, s
76363 if (!t->addr)
76364 return;
76365
76366 - printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
76367 + printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
76368 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
76369 }
76370
76371 @@ -1893,6 +1893,8 @@ void kmem_cache_free(struct kmem_cache *
76372
76373 page = virt_to_head_page(x);
76374
76375 + BUG_ON(!PageSlab(page));
76376 +
76377 slab_free(s, page, x, _RET_IP_);
76378
76379 trace_kmem_cache_free(_RET_IP_, x);
76380 @@ -1937,7 +1939,7 @@ static int slub_min_objects;
76381 * Merge control. If this is set then no merging of slab caches will occur.
76382 * (Could be removed. This was introduced to pacify the merge skeptics.)
76383 */
76384 -static int slub_nomerge;
76385 +static int slub_nomerge = 1;
76386
76387 /*
76388 * Calculate the order of allocation given an slab object size.
76389 @@ -2493,7 +2495,7 @@ static int kmem_cache_open(struct kmem_c
76390 * list to avoid pounding the page allocator excessively.
76391 */
76392 set_min_partial(s, ilog2(s->size));
76393 - s->refcount = 1;
76394 + atomic_set(&s->refcount, 1);
76395 #ifdef CONFIG_NUMA
76396 s->remote_node_defrag_ratio = 1000;
76397 #endif
76398 @@ -2630,8 +2632,7 @@ static inline int kmem_cache_close(struc
76399 void kmem_cache_destroy(struct kmem_cache *s)
76400 {
76401 down_write(&slub_lock);
76402 - s->refcount--;
76403 - if (!s->refcount) {
76404 + if (atomic_dec_and_test(&s->refcount)) {
76405 list_del(&s->list);
76406 up_write(&slub_lock);
76407 if (kmem_cache_close(s)) {
76408 @@ -2691,12 +2692,10 @@ static int __init setup_slub_nomerge(cha
76409 __setup("slub_nomerge", setup_slub_nomerge);
76410
76411 static struct kmem_cache *create_kmalloc_cache(struct kmem_cache *s,
76412 - const char *name, int size, gfp_t gfp_flags)
76413 + const char *name, int size, gfp_t gfp_flags, unsigned int flags)
76414 {
76415 - unsigned int flags = 0;
76416 -
76417 if (gfp_flags & SLUB_DMA)
76418 - flags = SLAB_CACHE_DMA;
76419 + flags |= SLAB_CACHE_DMA;
76420
76421 /*
76422 * This function is called with IRQs disabled during early-boot on
76423 @@ -2915,6 +2914,50 @@ void *__kmalloc_node(size_t size, gfp_t
76424 EXPORT_SYMBOL(__kmalloc_node);
76425 #endif
76426
76427 +void check_object_size(const void *ptr, unsigned long n, bool to)
76428 +{
76429 +
76430 +#ifdef CONFIG_PAX_USERCOPY
76431 + struct page *page;
76432 + struct kmem_cache *s = NULL;
76433 + unsigned long offset;
76434 + const char *type;
76435 +
76436 + if (!n)
76437 + return;
76438 +
76439 + type = "<null>";
76440 + if (ZERO_OR_NULL_PTR(ptr))
76441 + goto report;
76442 +
76443 + if (!virt_addr_valid(ptr))
76444 + return;
76445 +
76446 + page = get_object_page(ptr);
76447 +
76448 + type = "<process stack>";
76449 + if (!page) {
76450 + if (object_is_on_stack(ptr, n) == -1)
76451 + goto report;
76452 + return;
76453 + }
76454 +
76455 + s = page->slab;
76456 + type = s->name;
76457 + if (!(s->flags & SLAB_USERCOPY))
76458 + goto report;
76459 +
76460 + offset = (ptr - page_address(page)) % s->size;
76461 + if (offset <= s->objsize && n <= s->objsize - offset)
76462 + return;
76463 +
76464 +report:
76465 + pax_report_usercopy(ptr, n, to, type);
76466 +#endif
76467 +
76468 +}
76469 +EXPORT_SYMBOL(check_object_size);
76470 +
76471 size_t ksize(const void *object)
76472 {
76473 struct page *page;
76474 @@ -3185,8 +3228,8 @@ void __init kmem_cache_init(void)
76475 * kmem_cache_open for slab_state == DOWN.
76476 */
76477 create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
76478 - sizeof(struct kmem_cache_node), GFP_NOWAIT);
76479 - kmalloc_caches[0].refcount = -1;
76480 + sizeof(struct kmem_cache_node), GFP_NOWAIT, 0);
76481 + atomic_set(&kmalloc_caches[0].refcount, -1);
76482 caches++;
76483
76484 hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
76485 @@ -3198,18 +3241,18 @@ void __init kmem_cache_init(void)
76486 /* Caches that are not of the two-to-the-power-of size */
76487 if (KMALLOC_MIN_SIZE <= 32) {
76488 create_kmalloc_cache(&kmalloc_caches[1],
76489 - "kmalloc-96", 96, GFP_NOWAIT);
76490 + "kmalloc-96", 96, GFP_NOWAIT, SLAB_USERCOPY);
76491 caches++;
76492 }
76493 if (KMALLOC_MIN_SIZE <= 64) {
76494 create_kmalloc_cache(&kmalloc_caches[2],
76495 - "kmalloc-192", 192, GFP_NOWAIT);
76496 + "kmalloc-192", 192, GFP_NOWAIT, SLAB_USERCOPY);
76497 caches++;
76498 }
76499
76500 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
76501 create_kmalloc_cache(&kmalloc_caches[i],
76502 - "kmalloc", 1 << i, GFP_NOWAIT);
76503 + "kmalloc", 1 << i, GFP_NOWAIT, SLAB_USERCOPY);
76504 caches++;
76505 }
76506
76507 @@ -3293,7 +3336,7 @@ static int slab_unmergeable(struct kmem_
76508 /*
76509 * We may have set a slab to be unmergeable during bootstrap.
76510 */
76511 - if (s->refcount < 0)
76512 + if (atomic_read(&s->refcount) < 0)
76513 return 1;
76514
76515 return 0;
76516 @@ -3353,7 +3396,7 @@ struct kmem_cache *kmem_cache_create(con
76517 if (s) {
76518 int cpu;
76519
76520 - s->refcount++;
76521 + atomic_inc(&s->refcount);
76522 /*
76523 * Adjust the object sizes so that we clear
76524 * the complete object on kzalloc.
76525 @@ -3372,7 +3415,7 @@ struct kmem_cache *kmem_cache_create(con
76526
76527 if (sysfs_slab_alias(s, name)) {
76528 down_write(&slub_lock);
76529 - s->refcount--;
76530 + atomic_dec(&s->refcount);
76531 up_write(&slub_lock);
76532 goto err;
76533 }
76534 @@ -4101,7 +4144,7 @@ SLAB_ATTR_RO(ctor);
76535
76536 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
76537 {
76538 - return sprintf(buf, "%d\n", s->refcount - 1);
76539 + return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
76540 }
76541 SLAB_ATTR_RO(aliases);
76542
76543 @@ -4503,7 +4546,7 @@ static void kmem_cache_release(struct ko
76544 kfree(s);
76545 }
76546
76547 -static struct sysfs_ops slab_sysfs_ops = {
76548 +static const struct sysfs_ops slab_sysfs_ops = {
76549 .show = slab_attr_show,
76550 .store = slab_attr_store,
76551 };
76552 @@ -4522,7 +4565,7 @@ static int uevent_filter(struct kset *ks
76553 return 0;
76554 }
76555
76556 -static struct kset_uevent_ops slab_uevent_ops = {
76557 +static const struct kset_uevent_ops slab_uevent_ops = {
76558 .filter = uevent_filter,
76559 };
76560
76561 @@ -4564,6 +4607,7 @@ static char *create_unique_id(struct kme
76562 return name;
76563 }
76564
76565 +#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
76566 static int sysfs_slab_add(struct kmem_cache *s)
76567 {
76568 int err;
76569 @@ -4619,6 +4663,7 @@ static void sysfs_slab_remove(struct kme
76570 kobject_del(&s->kobj);
76571 kobject_put(&s->kobj);
76572 }
76573 +#endif
76574
76575 /*
76576 * Need to buffer aliases during bootup until sysfs becomes
76577 @@ -4632,6 +4677,7 @@ struct saved_alias {
76578
76579 static struct saved_alias *alias_list;
76580
76581 +#if defined(CONFIG_SLUB_DEBUG) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
76582 static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
76583 {
76584 struct saved_alias *al;
76585 @@ -4654,6 +4700,7 @@ static int sysfs_slab_alias(struct kmem_
76586 alias_list = al;
76587 return 0;
76588 }
76589 +#endif
76590
76591 static int __init slab_sysfs_init(void)
76592 {
76593 @@ -4785,7 +4832,13 @@ static const struct file_operations proc
76594
76595 static int __init slab_proc_init(void)
76596 {
76597 - proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
76598 + mode_t gr_mode = S_IRUGO;
76599 +
76600 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
76601 + gr_mode = S_IRUSR;
76602 +#endif
76603 +
76604 + proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
76605 return 0;
76606 }
76607 module_init(slab_proc_init);
76608 diff -urNp linux-2.6.32.49/mm/swap.c linux-2.6.32.49/mm/swap.c
76609 --- linux-2.6.32.49/mm/swap.c 2011-11-08 19:02:43.000000000 -0500
76610 +++ linux-2.6.32.49/mm/swap.c 2011-11-15 19:59:43.000000000 -0500
76611 @@ -30,6 +30,7 @@
76612 #include <linux/notifier.h>
76613 #include <linux/backing-dev.h>
76614 #include <linux/memcontrol.h>
76615 +#include <linux/hugetlb.h>
76616
76617 #include "internal.h"
76618
76619 @@ -65,6 +66,8 @@ static void put_compound_page(struct pag
76620 compound_page_dtor *dtor;
76621
76622 dtor = get_compound_page_dtor(page);
76623 + if (!PageHuge(page))
76624 + BUG_ON(dtor != free_compound_page);
76625 (*dtor)(page);
76626 }
76627 }
76628 diff -urNp linux-2.6.32.49/mm/util.c linux-2.6.32.49/mm/util.c
76629 --- linux-2.6.32.49/mm/util.c 2011-11-08 19:02:43.000000000 -0500
76630 +++ linux-2.6.32.49/mm/util.c 2011-11-15 19:59:43.000000000 -0500
76631 @@ -228,6 +228,12 @@ EXPORT_SYMBOL(strndup_user);
76632 void arch_pick_mmap_layout(struct mm_struct *mm)
76633 {
76634 mm->mmap_base = TASK_UNMAPPED_BASE;
76635 +
76636 +#ifdef CONFIG_PAX_RANDMMAP
76637 + if (mm->pax_flags & MF_PAX_RANDMMAP)
76638 + mm->mmap_base += mm->delta_mmap;
76639 +#endif
76640 +
76641 mm->get_unmapped_area = arch_get_unmapped_area;
76642 mm->unmap_area = arch_unmap_area;
76643 }
76644 diff -urNp linux-2.6.32.49/mm/vmalloc.c linux-2.6.32.49/mm/vmalloc.c
76645 --- linux-2.6.32.49/mm/vmalloc.c 2011-11-26 19:44:53.000000000 -0500
76646 +++ linux-2.6.32.49/mm/vmalloc.c 2011-11-26 19:49:57.000000000 -0500
76647 @@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd,
76648
76649 pte = pte_offset_kernel(pmd, addr);
76650 do {
76651 - pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
76652 - WARN_ON(!pte_none(ptent) && !pte_present(ptent));
76653 +
76654 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
76655 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
76656 + BUG_ON(!pte_exec(*pte));
76657 + set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
76658 + continue;
76659 + }
76660 +#endif
76661 +
76662 + {
76663 + pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
76664 + WARN_ON(!pte_none(ptent) && !pte_present(ptent));
76665 + }
76666 } while (pte++, addr += PAGE_SIZE, addr != end);
76667 }
76668
76669 @@ -92,6 +103,7 @@ static int vmap_pte_range(pmd_t *pmd, un
76670 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
76671 {
76672 pte_t *pte;
76673 + int ret = -ENOMEM;
76674
76675 /*
76676 * nr is a running index into the array which helps higher level
76677 @@ -101,17 +113,32 @@ static int vmap_pte_range(pmd_t *pmd, un
76678 pte = pte_alloc_kernel(pmd, addr);
76679 if (!pte)
76680 return -ENOMEM;
76681 +
76682 + pax_open_kernel();
76683 do {
76684 struct page *page = pages[*nr];
76685
76686 - if (WARN_ON(!pte_none(*pte)))
76687 - return -EBUSY;
76688 - if (WARN_ON(!page))
76689 - return -ENOMEM;
76690 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
76691 + if (!(pgprot_val(prot) & _PAGE_NX))
76692 + BUG_ON(!pte_exec(*pte) || pte_pfn(*pte) != __pa(addr) >> PAGE_SHIFT);
76693 + else
76694 +#endif
76695 +
76696 + if (WARN_ON(!pte_none(*pte))) {
76697 + ret = -EBUSY;
76698 + goto out;
76699 + }
76700 + if (WARN_ON(!page)) {
76701 + ret = -ENOMEM;
76702 + goto out;
76703 + }
76704 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
76705 (*nr)++;
76706 } while (pte++, addr += PAGE_SIZE, addr != end);
76707 - return 0;
76708 + ret = 0;
76709 +out:
76710 + pax_close_kernel();
76711 + return ret;
76712 }
76713
76714 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
76715 @@ -192,11 +219,20 @@ int is_vmalloc_or_module_addr(const void
76716 * and fall back on vmalloc() if that fails. Others
76717 * just put it in the vmalloc space.
76718 */
76719 -#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
76720 +#ifdef CONFIG_MODULES
76721 +#ifdef MODULES_VADDR
76722 unsigned long addr = (unsigned long)x;
76723 if (addr >= MODULES_VADDR && addr < MODULES_END)
76724 return 1;
76725 #endif
76726 +
76727 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
76728 + if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
76729 + return 1;
76730 +#endif
76731 +
76732 +#endif
76733 +
76734 return is_vmalloc_addr(x);
76735 }
76736
76737 @@ -217,8 +253,14 @@ struct page *vmalloc_to_page(const void
76738
76739 if (!pgd_none(*pgd)) {
76740 pud_t *pud = pud_offset(pgd, addr);
76741 +#ifdef CONFIG_X86
76742 + if (!pud_large(*pud))
76743 +#endif
76744 if (!pud_none(*pud)) {
76745 pmd_t *pmd = pmd_offset(pud, addr);
76746 +#ifdef CONFIG_X86
76747 + if (!pmd_large(*pmd))
76748 +#endif
76749 if (!pmd_none(*pmd)) {
76750 pte_t *ptep, pte;
76751
76752 @@ -292,13 +334,13 @@ static void __insert_vmap_area(struct vm
76753 struct rb_node *tmp;
76754
76755 while (*p) {
76756 - struct vmap_area *tmp;
76757 + struct vmap_area *varea;
76758
76759 parent = *p;
76760 - tmp = rb_entry(parent, struct vmap_area, rb_node);
76761 - if (va->va_start < tmp->va_end)
76762 + varea = rb_entry(parent, struct vmap_area, rb_node);
76763 + if (va->va_start < varea->va_end)
76764 p = &(*p)->rb_left;
76765 - else if (va->va_end > tmp->va_start)
76766 + else if (va->va_end > varea->va_start)
76767 p = &(*p)->rb_right;
76768 else
76769 BUG();
76770 @@ -1245,6 +1287,16 @@ static struct vm_struct *__get_vm_area_n
76771 struct vm_struct *area;
76772
76773 BUG_ON(in_interrupt());
76774 +
76775 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
76776 + if (flags & VM_KERNEXEC) {
76777 + if (start != VMALLOC_START || end != VMALLOC_END)
76778 + return NULL;
76779 + start = (unsigned long)MODULES_EXEC_VADDR;
76780 + end = (unsigned long)MODULES_EXEC_END;
76781 + }
76782 +#endif
76783 +
76784 if (flags & VM_IOREMAP) {
76785 int bit = fls(size);
76786
76787 @@ -1484,6 +1536,11 @@ void *vmap(struct page **pages, unsigned
76788 if (count > totalram_pages)
76789 return NULL;
76790
76791 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
76792 + if (!(pgprot_val(prot) & _PAGE_NX))
76793 + flags |= VM_KERNEXEC;
76794 +#endif
76795 +
76796 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
76797 __builtin_return_address(0));
76798 if (!area)
76799 @@ -1594,6 +1651,13 @@ static void *__vmalloc_node(unsigned lon
76800 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
76801 return NULL;
76802
76803 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
76804 + if (!(pgprot_val(prot) & _PAGE_NX))
76805 + area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST | VM_KERNEXEC,
76806 + VMALLOC_START, VMALLOC_END, node, gfp_mask, caller);
76807 + else
76808 +#endif
76809 +
76810 area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST,
76811 VMALLOC_START, VMALLOC_END, node,
76812 gfp_mask, caller);
76813 @@ -1619,6 +1683,7 @@ static void *__vmalloc_node(unsigned lon
76814 return addr;
76815 }
76816
76817 +#undef __vmalloc
76818 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
76819 {
76820 return __vmalloc_node(size, 1, gfp_mask, prot, -1,
76821 @@ -1635,6 +1700,7 @@ EXPORT_SYMBOL(__vmalloc);
76822 * For tight control over page level allocator and protection flags
76823 * use __vmalloc() instead.
76824 */
76825 +#undef vmalloc
76826 void *vmalloc(unsigned long size)
76827 {
76828 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
76829 @@ -1649,6 +1715,7 @@ EXPORT_SYMBOL(vmalloc);
76830 * The resulting memory area is zeroed so it can be mapped to userspace
76831 * without leaking data.
76832 */
76833 +#undef vmalloc_user
76834 void *vmalloc_user(unsigned long size)
76835 {
76836 struct vm_struct *area;
76837 @@ -1676,6 +1743,7 @@ EXPORT_SYMBOL(vmalloc_user);
76838 * For tight control over page level allocator and protection flags
76839 * use __vmalloc() instead.
76840 */
76841 +#undef vmalloc_node
76842 void *vmalloc_node(unsigned long size, int node)
76843 {
76844 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
76845 @@ -1698,10 +1766,10 @@ EXPORT_SYMBOL(vmalloc_node);
76846 * For tight control over page level allocator and protection flags
76847 * use __vmalloc() instead.
76848 */
76849 -
76850 +#undef vmalloc_exec
76851 void *vmalloc_exec(unsigned long size)
76852 {
76853 - return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
76854 + return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
76855 -1, __builtin_return_address(0));
76856 }
76857
76858 @@ -1720,6 +1788,7 @@ void *vmalloc_exec(unsigned long size)
76859 * Allocate enough 32bit PA addressable pages to cover @size from the
76860 * page level allocator and map them into contiguous kernel virtual space.
76861 */
76862 +#undef vmalloc_32
76863 void *vmalloc_32(unsigned long size)
76864 {
76865 return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
76866 @@ -1734,6 +1803,7 @@ EXPORT_SYMBOL(vmalloc_32);
76867 * The resulting memory area is 32bit addressable and zeroed so it can be
76868 * mapped to userspace without leaking data.
76869 */
76870 +#undef vmalloc_32_user
76871 void *vmalloc_32_user(unsigned long size)
76872 {
76873 struct vm_struct *area;
76874 @@ -1998,6 +2068,8 @@ int remap_vmalloc_range(struct vm_area_s
76875 unsigned long uaddr = vma->vm_start;
76876 unsigned long usize = vma->vm_end - vma->vm_start;
76877
76878 + BUG_ON(vma->vm_mirror);
76879 +
76880 if ((PAGE_SIZE-1) & (unsigned long)addr)
76881 return -EINVAL;
76882
76883 diff -urNp linux-2.6.32.49/mm/vmstat.c linux-2.6.32.49/mm/vmstat.c
76884 --- linux-2.6.32.49/mm/vmstat.c 2011-11-08 19:02:43.000000000 -0500
76885 +++ linux-2.6.32.49/mm/vmstat.c 2011-11-15 19:59:43.000000000 -0500
76886 @@ -74,7 +74,7 @@ void vm_events_fold_cpu(int cpu)
76887 *
76888 * vm_stat contains the global counters
76889 */
76890 -atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
76891 +atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
76892 EXPORT_SYMBOL(vm_stat);
76893
76894 #ifdef CONFIG_SMP
76895 @@ -324,7 +324,7 @@ void refresh_cpu_vm_stats(int cpu)
76896 v = p->vm_stat_diff[i];
76897 p->vm_stat_diff[i] = 0;
76898 local_irq_restore(flags);
76899 - atomic_long_add(v, &zone->vm_stat[i]);
76900 + atomic_long_add_unchecked(v, &zone->vm_stat[i]);
76901 global_diff[i] += v;
76902 #ifdef CONFIG_NUMA
76903 /* 3 seconds idle till flush */
76904 @@ -362,7 +362,7 @@ void refresh_cpu_vm_stats(int cpu)
76905
76906 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
76907 if (global_diff[i])
76908 - atomic_long_add(global_diff[i], &vm_stat[i]);
76909 + atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
76910 }
76911
76912 #endif
76913 @@ -953,10 +953,20 @@ static int __init setup_vmstat(void)
76914 start_cpu_timer(cpu);
76915 #endif
76916 #ifdef CONFIG_PROC_FS
76917 - proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
76918 - proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
76919 - proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
76920 - proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
76921 + {
76922 + mode_t gr_mode = S_IRUGO;
76923 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
76924 + gr_mode = S_IRUSR;
76925 +#endif
76926 + proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
76927 + proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
76928 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
76929 + proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
76930 +#else
76931 + proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
76932 +#endif
76933 + proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
76934 + }
76935 #endif
76936 return 0;
76937 }
76938 diff -urNp linux-2.6.32.49/net/8021q/vlan.c linux-2.6.32.49/net/8021q/vlan.c
76939 --- linux-2.6.32.49/net/8021q/vlan.c 2011-11-08 19:02:43.000000000 -0500
76940 +++ linux-2.6.32.49/net/8021q/vlan.c 2011-11-15 19:59:43.000000000 -0500
76941 @@ -622,8 +622,7 @@ static int vlan_ioctl_handler(struct net
76942 err = -EPERM;
76943 if (!capable(CAP_NET_ADMIN))
76944 break;
76945 - if ((args.u.name_type >= 0) &&
76946 - (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
76947 + if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
76948 struct vlan_net *vn;
76949
76950 vn = net_generic(net, vlan_net_id);
76951 diff -urNp linux-2.6.32.49/net/9p/trans_fd.c linux-2.6.32.49/net/9p/trans_fd.c
76952 --- linux-2.6.32.49/net/9p/trans_fd.c 2011-11-08 19:02:43.000000000 -0500
76953 +++ linux-2.6.32.49/net/9p/trans_fd.c 2011-11-15 19:59:43.000000000 -0500
76954 @@ -419,7 +419,7 @@ static int p9_fd_write(struct p9_client
76955 oldfs = get_fs();
76956 set_fs(get_ds());
76957 /* The cast to a user pointer is valid due to the set_fs() */
76958 - ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
76959 + ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos);
76960 set_fs(oldfs);
76961
76962 if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
76963 diff -urNp linux-2.6.32.49/net/atm/atm_misc.c linux-2.6.32.49/net/atm/atm_misc.c
76964 --- linux-2.6.32.49/net/atm/atm_misc.c 2011-11-08 19:02:43.000000000 -0500
76965 +++ linux-2.6.32.49/net/atm/atm_misc.c 2011-11-15 19:59:43.000000000 -0500
76966 @@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int t
76967 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
76968 return 1;
76969 atm_return(vcc,truesize);
76970 - atomic_inc(&vcc->stats->rx_drop);
76971 + atomic_inc_unchecked(&vcc->stats->rx_drop);
76972 return 0;
76973 }
76974
76975 @@ -41,7 +41,7 @@ struct sk_buff *atm_alloc_charge(struct
76976 }
76977 }
76978 atm_return(vcc,guess);
76979 - atomic_inc(&vcc->stats->rx_drop);
76980 + atomic_inc_unchecked(&vcc->stats->rx_drop);
76981 return NULL;
76982 }
76983
76984 @@ -88,7 +88,7 @@ int atm_pcr_goal(const struct atm_trafpr
76985
76986 void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
76987 {
76988 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
76989 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
76990 __SONET_ITEMS
76991 #undef __HANDLE_ITEM
76992 }
76993 @@ -96,7 +96,7 @@ void sonet_copy_stats(struct k_sonet_sta
76994
76995 void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
76996 {
76997 -#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
76998 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
76999 __SONET_ITEMS
77000 #undef __HANDLE_ITEM
77001 }
77002 diff -urNp linux-2.6.32.49/net/atm/lec.h linux-2.6.32.49/net/atm/lec.h
77003 --- linux-2.6.32.49/net/atm/lec.h 2011-11-08 19:02:43.000000000 -0500
77004 +++ linux-2.6.32.49/net/atm/lec.h 2011-11-15 19:59:43.000000000 -0500
77005 @@ -48,7 +48,7 @@ struct lane2_ops {
77006 const u8 *tlvs, u32 sizeoftlvs);
77007 void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
77008 const u8 *tlvs, u32 sizeoftlvs);
77009 -};
77010 +} __no_const;
77011
77012 /*
77013 * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
77014 diff -urNp linux-2.6.32.49/net/atm/mpc.h linux-2.6.32.49/net/atm/mpc.h
77015 --- linux-2.6.32.49/net/atm/mpc.h 2011-11-08 19:02:43.000000000 -0500
77016 +++ linux-2.6.32.49/net/atm/mpc.h 2011-11-15 19:59:43.000000000 -0500
77017 @@ -33,7 +33,7 @@ struct mpoa_client {
77018 struct mpc_parameters parameters; /* parameters for this client */
77019
77020 const struct net_device_ops *old_ops;
77021 - struct net_device_ops new_ops;
77022 + net_device_ops_no_const new_ops;
77023 };
77024
77025
77026 diff -urNp linux-2.6.32.49/net/atm/mpoa_caches.c linux-2.6.32.49/net/atm/mpoa_caches.c
77027 --- linux-2.6.32.49/net/atm/mpoa_caches.c 2011-11-08 19:02:43.000000000 -0500
77028 +++ linux-2.6.32.49/net/atm/mpoa_caches.c 2011-11-15 19:59:43.000000000 -0500
77029 @@ -498,6 +498,8 @@ static void clear_expired(struct mpoa_cl
77030 struct timeval now;
77031 struct k_message msg;
77032
77033 + pax_track_stack();
77034 +
77035 do_gettimeofday(&now);
77036
77037 write_lock_irq(&client->egress_lock);
77038 diff -urNp linux-2.6.32.49/net/atm/proc.c linux-2.6.32.49/net/atm/proc.c
77039 --- linux-2.6.32.49/net/atm/proc.c 2011-11-08 19:02:43.000000000 -0500
77040 +++ linux-2.6.32.49/net/atm/proc.c 2011-11-15 19:59:43.000000000 -0500
77041 @@ -43,9 +43,9 @@ static void add_stats(struct seq_file *s
77042 const struct k_atm_aal_stats *stats)
77043 {
77044 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
77045 - atomic_read(&stats->tx),atomic_read(&stats->tx_err),
77046 - atomic_read(&stats->rx),atomic_read(&stats->rx_err),
77047 - atomic_read(&stats->rx_drop));
77048 + atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
77049 + atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
77050 + atomic_read_unchecked(&stats->rx_drop));
77051 }
77052
77053 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
77054 @@ -188,7 +188,12 @@ static void vcc_info(struct seq_file *se
77055 {
77056 struct sock *sk = sk_atm(vcc);
77057
77058 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77059 + seq_printf(seq, "%p ", NULL);
77060 +#else
77061 seq_printf(seq, "%p ", vcc);
77062 +#endif
77063 +
77064 if (!vcc->dev)
77065 seq_printf(seq, "Unassigned ");
77066 else
77067 @@ -214,7 +219,11 @@ static void svc_info(struct seq_file *se
77068 {
77069 if (!vcc->dev)
77070 seq_printf(seq, sizeof(void *) == 4 ?
77071 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77072 + "N/A@%p%10s" : "N/A@%p%2s", NULL, "");
77073 +#else
77074 "N/A@%p%10s" : "N/A@%p%2s", vcc, "");
77075 +#endif
77076 else
77077 seq_printf(seq, "%3d %3d %5d ",
77078 vcc->dev->number, vcc->vpi, vcc->vci);
77079 diff -urNp linux-2.6.32.49/net/atm/resources.c linux-2.6.32.49/net/atm/resources.c
77080 --- linux-2.6.32.49/net/atm/resources.c 2011-11-08 19:02:43.000000000 -0500
77081 +++ linux-2.6.32.49/net/atm/resources.c 2011-11-15 19:59:43.000000000 -0500
77082 @@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *
77083 static void copy_aal_stats(struct k_atm_aal_stats *from,
77084 struct atm_aal_stats *to)
77085 {
77086 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
77087 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
77088 __AAL_STAT_ITEMS
77089 #undef __HANDLE_ITEM
77090 }
77091 @@ -170,7 +170,7 @@ static void copy_aal_stats(struct k_atm_
77092 static void subtract_aal_stats(struct k_atm_aal_stats *from,
77093 struct atm_aal_stats *to)
77094 {
77095 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
77096 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
77097 __AAL_STAT_ITEMS
77098 #undef __HANDLE_ITEM
77099 }
77100 diff -urNp linux-2.6.32.49/net/bridge/br_private.h linux-2.6.32.49/net/bridge/br_private.h
77101 --- linux-2.6.32.49/net/bridge/br_private.h 2011-11-08 19:02:43.000000000 -0500
77102 +++ linux-2.6.32.49/net/bridge/br_private.h 2011-11-15 19:59:43.000000000 -0500
77103 @@ -255,7 +255,7 @@ extern void br_ifinfo_notify(int event,
77104
77105 #ifdef CONFIG_SYSFS
77106 /* br_sysfs_if.c */
77107 -extern struct sysfs_ops brport_sysfs_ops;
77108 +extern const struct sysfs_ops brport_sysfs_ops;
77109 extern int br_sysfs_addif(struct net_bridge_port *p);
77110
77111 /* br_sysfs_br.c */
77112 diff -urNp linux-2.6.32.49/net/bridge/br_stp_if.c linux-2.6.32.49/net/bridge/br_stp_if.c
77113 --- linux-2.6.32.49/net/bridge/br_stp_if.c 2011-11-08 19:02:43.000000000 -0500
77114 +++ linux-2.6.32.49/net/bridge/br_stp_if.c 2011-11-15 19:59:43.000000000 -0500
77115 @@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridg
77116 char *envp[] = { NULL };
77117
77118 if (br->stp_enabled == BR_USER_STP) {
77119 - r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
77120 + r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
77121 printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
77122 br->dev->name, r);
77123
77124 diff -urNp linux-2.6.32.49/net/bridge/br_sysfs_if.c linux-2.6.32.49/net/bridge/br_sysfs_if.c
77125 --- linux-2.6.32.49/net/bridge/br_sysfs_if.c 2011-11-08 19:02:43.000000000 -0500
77126 +++ linux-2.6.32.49/net/bridge/br_sysfs_if.c 2011-11-15 19:59:43.000000000 -0500
77127 @@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobje
77128 return ret;
77129 }
77130
77131 -struct sysfs_ops brport_sysfs_ops = {
77132 +const struct sysfs_ops brport_sysfs_ops = {
77133 .show = brport_show,
77134 .store = brport_store,
77135 };
77136 diff -urNp linux-2.6.32.49/net/bridge/netfilter/ebtables.c linux-2.6.32.49/net/bridge/netfilter/ebtables.c
77137 --- linux-2.6.32.49/net/bridge/netfilter/ebtables.c 2011-11-08 19:02:43.000000000 -0500
77138 +++ linux-2.6.32.49/net/bridge/netfilter/ebtables.c 2011-11-15 19:59:43.000000000 -0500
77139 @@ -1337,6 +1337,8 @@ static int copy_everything_to_user(struc
77140 unsigned int entries_size, nentries;
77141 char *entries;
77142
77143 + pax_track_stack();
77144 +
77145 if (cmd == EBT_SO_GET_ENTRIES) {
77146 entries_size = t->private->entries_size;
77147 nentries = t->private->nentries;
77148 diff -urNp linux-2.6.32.49/net/can/bcm.c linux-2.6.32.49/net/can/bcm.c
77149 --- linux-2.6.32.49/net/can/bcm.c 2011-11-08 19:02:43.000000000 -0500
77150 +++ linux-2.6.32.49/net/can/bcm.c 2011-11-15 19:59:43.000000000 -0500
77151 @@ -164,9 +164,15 @@ static int bcm_proc_show(struct seq_file
77152 struct bcm_sock *bo = bcm_sk(sk);
77153 struct bcm_op *op;
77154
77155 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77156 + seq_printf(m, ">>> socket %p", NULL);
77157 + seq_printf(m, " / sk %p", NULL);
77158 + seq_printf(m, " / bo %p", NULL);
77159 +#else
77160 seq_printf(m, ">>> socket %p", sk->sk_socket);
77161 seq_printf(m, " / sk %p", sk);
77162 seq_printf(m, " / bo %p", bo);
77163 +#endif
77164 seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
77165 seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
77166 seq_printf(m, " <<<\n");
77167 diff -urNp linux-2.6.32.49/net/compat.c linux-2.6.32.49/net/compat.c
77168 --- linux-2.6.32.49/net/compat.c 2011-11-08 19:02:43.000000000 -0500
77169 +++ linux-2.6.32.49/net/compat.c 2011-11-15 19:59:43.000000000 -0500
77170 @@ -69,9 +69,9 @@ int get_compat_msghdr(struct msghdr *kms
77171 __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
77172 __get_user(kmsg->msg_flags, &umsg->msg_flags))
77173 return -EFAULT;
77174 - kmsg->msg_name = compat_ptr(tmp1);
77175 - kmsg->msg_iov = compat_ptr(tmp2);
77176 - kmsg->msg_control = compat_ptr(tmp3);
77177 + kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1);
77178 + kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2);
77179 + kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3);
77180 return 0;
77181 }
77182
77183 @@ -94,7 +94,7 @@ int verify_compat_iovec(struct msghdr *k
77184 kern_msg->msg_name = NULL;
77185
77186 tot_len = iov_from_user_compat_to_kern(kern_iov,
77187 - (struct compat_iovec __user *)kern_msg->msg_iov,
77188 + (struct compat_iovec __force_user *)kern_msg->msg_iov,
77189 kern_msg->msg_iovlen);
77190 if (tot_len >= 0)
77191 kern_msg->msg_iov = kern_iov;
77192 @@ -114,20 +114,20 @@ int verify_compat_iovec(struct msghdr *k
77193
77194 #define CMSG_COMPAT_FIRSTHDR(msg) \
77195 (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
77196 - (struct compat_cmsghdr __user *)((msg)->msg_control) : \
77197 + (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \
77198 (struct compat_cmsghdr __user *)NULL)
77199
77200 #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
77201 ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
77202 (ucmlen) <= (unsigned long) \
77203 ((mhdr)->msg_controllen - \
77204 - ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
77205 + ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control)))
77206
77207 static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
77208 struct compat_cmsghdr __user *cmsg, int cmsg_len)
77209 {
77210 char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
77211 - if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
77212 + if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) >
77213 msg->msg_controllen)
77214 return NULL;
77215 return (struct compat_cmsghdr __user *)ptr;
77216 @@ -219,7 +219,7 @@ int put_cmsg_compat(struct msghdr *kmsg,
77217 {
77218 struct compat_timeval ctv;
77219 struct compat_timespec cts[3];
77220 - struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
77221 + struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
77222 struct compat_cmsghdr cmhdr;
77223 int cmlen;
77224
77225 @@ -271,7 +271,7 @@ int put_cmsg_compat(struct msghdr *kmsg,
77226
77227 void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
77228 {
77229 - struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
77230 + struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
77231 int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
77232 int fdnum = scm->fp->count;
77233 struct file **fp = scm->fp->fp;
77234 @@ -433,7 +433,7 @@ static int do_get_sock_timeout(struct so
77235 len = sizeof(ktime);
77236 old_fs = get_fs();
77237 set_fs(KERNEL_DS);
77238 - err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len);
77239 + err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len);
77240 set_fs(old_fs);
77241
77242 if (!err) {
77243 @@ -570,7 +570,7 @@ int compat_mc_setsockopt(struct sock *so
77244 case MCAST_JOIN_GROUP:
77245 case MCAST_LEAVE_GROUP:
77246 {
77247 - struct compat_group_req __user *gr32 = (void *)optval;
77248 + struct compat_group_req __user *gr32 = (void __user *)optval;
77249 struct group_req __user *kgr =
77250 compat_alloc_user_space(sizeof(struct group_req));
77251 u32 interface;
77252 @@ -591,7 +591,7 @@ int compat_mc_setsockopt(struct sock *so
77253 case MCAST_BLOCK_SOURCE:
77254 case MCAST_UNBLOCK_SOURCE:
77255 {
77256 - struct compat_group_source_req __user *gsr32 = (void *)optval;
77257 + struct compat_group_source_req __user *gsr32 = (void __user *)optval;
77258 struct group_source_req __user *kgsr = compat_alloc_user_space(
77259 sizeof(struct group_source_req));
77260 u32 interface;
77261 @@ -612,7 +612,7 @@ int compat_mc_setsockopt(struct sock *so
77262 }
77263 case MCAST_MSFILTER:
77264 {
77265 - struct compat_group_filter __user *gf32 = (void *)optval;
77266 + struct compat_group_filter __user *gf32 = (void __user *)optval;
77267 struct group_filter __user *kgf;
77268 u32 interface, fmode, numsrc;
77269
77270 diff -urNp linux-2.6.32.49/net/core/dev.c linux-2.6.32.49/net/core/dev.c
77271 --- linux-2.6.32.49/net/core/dev.c 2011-11-08 19:02:43.000000000 -0500
77272 +++ linux-2.6.32.49/net/core/dev.c 2011-11-15 19:59:43.000000000 -0500
77273 @@ -1047,10 +1047,14 @@ void dev_load(struct net *net, const cha
77274 if (no_module && capable(CAP_NET_ADMIN))
77275 no_module = request_module("netdev-%s", name);
77276 if (no_module && capable(CAP_SYS_MODULE)) {
77277 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
77278 + ___request_module(true, "grsec_modharden_netdev", "%s", name);
77279 +#else
77280 if (!request_module("%s", name))
77281 pr_err("Loading kernel module for a network device "
77282 "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
77283 "instead\n", name);
77284 +#endif
77285 }
77286 }
77287 EXPORT_SYMBOL(dev_load);
77288 @@ -1654,7 +1658,7 @@ static inline int illegal_highdma(struct
77289
77290 struct dev_gso_cb {
77291 void (*destructor)(struct sk_buff *skb);
77292 -};
77293 +} __no_const;
77294
77295 #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
77296
77297 @@ -2063,7 +2067,7 @@ int netif_rx_ni(struct sk_buff *skb)
77298 }
77299 EXPORT_SYMBOL(netif_rx_ni);
77300
77301 -static void net_tx_action(struct softirq_action *h)
77302 +static void net_tx_action(void)
77303 {
77304 struct softnet_data *sd = &__get_cpu_var(softnet_data);
77305
77306 @@ -2826,7 +2830,7 @@ void netif_napi_del(struct napi_struct *
77307 EXPORT_SYMBOL(netif_napi_del);
77308
77309
77310 -static void net_rx_action(struct softirq_action *h)
77311 +static void net_rx_action(void)
77312 {
77313 struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
77314 unsigned long time_limit = jiffies + 2;
77315 diff -urNp linux-2.6.32.49/net/core/flow.c linux-2.6.32.49/net/core/flow.c
77316 --- linux-2.6.32.49/net/core/flow.c 2011-11-08 19:02:43.000000000 -0500
77317 +++ linux-2.6.32.49/net/core/flow.c 2011-11-15 19:59:43.000000000 -0500
77318 @@ -35,11 +35,11 @@ struct flow_cache_entry {
77319 atomic_t *object_ref;
77320 };
77321
77322 -atomic_t flow_cache_genid = ATOMIC_INIT(0);
77323 +atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
77324
77325 static u32 flow_hash_shift;
77326 #define flow_hash_size (1 << flow_hash_shift)
77327 -static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
77328 +static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
77329
77330 #define flow_table(cpu) (per_cpu(flow_tables, cpu))
77331
77332 @@ -52,7 +52,7 @@ struct flow_percpu_info {
77333 u32 hash_rnd;
77334 int count;
77335 };
77336 -static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
77337 +static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
77338
77339 #define flow_hash_rnd_recalc(cpu) \
77340 (per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
77341 @@ -69,7 +69,7 @@ struct flow_flush_info {
77342 atomic_t cpuleft;
77343 struct completion completion;
77344 };
77345 -static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
77346 +static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
77347
77348 #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
77349
77350 @@ -190,7 +190,7 @@ void *flow_cache_lookup(struct net *net,
77351 if (fle->family == family &&
77352 fle->dir == dir &&
77353 flow_key_compare(key, &fle->key) == 0) {
77354 - if (fle->genid == atomic_read(&flow_cache_genid)) {
77355 + if (fle->genid == atomic_read_unchecked(&flow_cache_genid)) {
77356 void *ret = fle->object;
77357
77358 if (ret)
77359 @@ -228,7 +228,7 @@ nocache:
77360 err = resolver(net, key, family, dir, &obj, &obj_ref);
77361
77362 if (fle && !err) {
77363 - fle->genid = atomic_read(&flow_cache_genid);
77364 + fle->genid = atomic_read_unchecked(&flow_cache_genid);
77365
77366 if (fle->object)
77367 atomic_dec(fle->object_ref);
77368 @@ -258,7 +258,7 @@ static void flow_cache_flush_tasklet(uns
77369
77370 fle = flow_table(cpu)[i];
77371 for (; fle; fle = fle->next) {
77372 - unsigned genid = atomic_read(&flow_cache_genid);
77373 + unsigned genid = atomic_read_unchecked(&flow_cache_genid);
77374
77375 if (!fle->object || fle->genid == genid)
77376 continue;
77377 diff -urNp linux-2.6.32.49/net/core/rtnetlink.c linux-2.6.32.49/net/core/rtnetlink.c
77378 --- linux-2.6.32.49/net/core/rtnetlink.c 2011-11-08 19:02:43.000000000 -0500
77379 +++ linux-2.6.32.49/net/core/rtnetlink.c 2011-11-15 19:59:43.000000000 -0500
77380 @@ -57,7 +57,7 @@ struct rtnl_link
77381 {
77382 rtnl_doit_func doit;
77383 rtnl_dumpit_func dumpit;
77384 -};
77385 +} __no_const;
77386
77387 static DEFINE_MUTEX(rtnl_mutex);
77388
77389 diff -urNp linux-2.6.32.49/net/core/scm.c linux-2.6.32.49/net/core/scm.c
77390 --- linux-2.6.32.49/net/core/scm.c 2011-11-08 19:02:43.000000000 -0500
77391 +++ linux-2.6.32.49/net/core/scm.c 2011-11-15 19:59:43.000000000 -0500
77392 @@ -191,7 +191,7 @@ error:
77393 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
77394 {
77395 struct cmsghdr __user *cm
77396 - = (__force struct cmsghdr __user *)msg->msg_control;
77397 + = (struct cmsghdr __force_user *)msg->msg_control;
77398 struct cmsghdr cmhdr;
77399 int cmlen = CMSG_LEN(len);
77400 int err;
77401 @@ -214,7 +214,7 @@ int put_cmsg(struct msghdr * msg, int le
77402 err = -EFAULT;
77403 if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
77404 goto out;
77405 - if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
77406 + if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr)))
77407 goto out;
77408 cmlen = CMSG_SPACE(len);
77409 if (msg->msg_controllen < cmlen)
77410 @@ -229,7 +229,7 @@ out:
77411 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
77412 {
77413 struct cmsghdr __user *cm
77414 - = (__force struct cmsghdr __user*)msg->msg_control;
77415 + = (struct cmsghdr __force_user *)msg->msg_control;
77416
77417 int fdmax = 0;
77418 int fdnum = scm->fp->count;
77419 @@ -249,7 +249,7 @@ void scm_detach_fds(struct msghdr *msg,
77420 if (fdnum < fdmax)
77421 fdmax = fdnum;
77422
77423 - for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
77424 + for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax;
77425 i++, cmfptr++)
77426 {
77427 int new_fd;
77428 diff -urNp linux-2.6.32.49/net/core/secure_seq.c linux-2.6.32.49/net/core/secure_seq.c
77429 --- linux-2.6.32.49/net/core/secure_seq.c 2011-11-08 19:02:43.000000000 -0500
77430 +++ linux-2.6.32.49/net/core/secure_seq.c 2011-11-15 19:59:43.000000000 -0500
77431 @@ -57,7 +57,7 @@ __u32 secure_tcpv6_sequence_number(__be3
77432 EXPORT_SYMBOL(secure_tcpv6_sequence_number);
77433
77434 u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
77435 - __be16 dport)
77436 + __be16 dport)
77437 {
77438 u32 secret[MD5_MESSAGE_BYTES / 4];
77439 u32 hash[MD5_DIGEST_WORDS];
77440 @@ -71,7 +71,6 @@ u32 secure_ipv6_port_ephemeral(const __b
77441 secret[i] = net_secret[i];
77442
77443 md5_transform(hash, secret);
77444 -
77445 return hash[0];
77446 }
77447 #endif
77448 diff -urNp linux-2.6.32.49/net/core/skbuff.c linux-2.6.32.49/net/core/skbuff.c
77449 --- linux-2.6.32.49/net/core/skbuff.c 2011-11-08 19:02:43.000000000 -0500
77450 +++ linux-2.6.32.49/net/core/skbuff.c 2011-11-15 19:59:43.000000000 -0500
77451 @@ -1544,6 +1544,8 @@ int skb_splice_bits(struct sk_buff *skb,
77452 struct sk_buff *frag_iter;
77453 struct sock *sk = skb->sk;
77454
77455 + pax_track_stack();
77456 +
77457 /*
77458 * __skb_splice_bits() only fails if the output has no room left,
77459 * so no point in going over the frag_list for the error case.
77460 diff -urNp linux-2.6.32.49/net/core/sock.c linux-2.6.32.49/net/core/sock.c
77461 --- linux-2.6.32.49/net/core/sock.c 2011-11-08 19:02:43.000000000 -0500
77462 +++ linux-2.6.32.49/net/core/sock.c 2011-11-15 19:59:43.000000000 -0500
77463 @@ -864,11 +864,15 @@ int sock_getsockopt(struct socket *sock,
77464 break;
77465
77466 case SO_PEERCRED:
77467 + {
77468 + struct ucred peercred;
77469 if (len > sizeof(sk->sk_peercred))
77470 len = sizeof(sk->sk_peercred);
77471 - if (copy_to_user(optval, &sk->sk_peercred, len))
77472 + peercred = sk->sk_peercred;
77473 + if (copy_to_user(optval, &peercred, len))
77474 return -EFAULT;
77475 goto lenout;
77476 + }
77477
77478 case SO_PEERNAME:
77479 {
77480 @@ -1892,7 +1896,7 @@ void sock_init_data(struct socket *sock,
77481 */
77482 smp_wmb();
77483 atomic_set(&sk->sk_refcnt, 1);
77484 - atomic_set(&sk->sk_drops, 0);
77485 + atomic_set_unchecked(&sk->sk_drops, 0);
77486 }
77487 EXPORT_SYMBOL(sock_init_data);
77488
77489 diff -urNp linux-2.6.32.49/net/decnet/sysctl_net_decnet.c linux-2.6.32.49/net/decnet/sysctl_net_decnet.c
77490 --- linux-2.6.32.49/net/decnet/sysctl_net_decnet.c 2011-11-08 19:02:43.000000000 -0500
77491 +++ linux-2.6.32.49/net/decnet/sysctl_net_decnet.c 2011-11-15 19:59:43.000000000 -0500
77492 @@ -206,7 +206,7 @@ static int dn_node_address_handler(ctl_t
77493
77494 if (len > *lenp) len = *lenp;
77495
77496 - if (copy_to_user(buffer, addr, len))
77497 + if (len > sizeof addr || copy_to_user(buffer, addr, len))
77498 return -EFAULT;
77499
77500 *lenp = len;
77501 @@ -327,7 +327,7 @@ static int dn_def_dev_handler(ctl_table
77502
77503 if (len > *lenp) len = *lenp;
77504
77505 - if (copy_to_user(buffer, devname, len))
77506 + if (len > sizeof devname || copy_to_user(buffer, devname, len))
77507 return -EFAULT;
77508
77509 *lenp = len;
77510 diff -urNp linux-2.6.32.49/net/econet/Kconfig linux-2.6.32.49/net/econet/Kconfig
77511 --- linux-2.6.32.49/net/econet/Kconfig 2011-11-08 19:02:43.000000000 -0500
77512 +++ linux-2.6.32.49/net/econet/Kconfig 2011-11-15 19:59:43.000000000 -0500
77513 @@ -4,7 +4,7 @@
77514
77515 config ECONET
77516 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
77517 - depends on EXPERIMENTAL && INET
77518 + depends on EXPERIMENTAL && INET && BROKEN
77519 ---help---
77520 Econet is a fairly old and slow networking protocol mainly used by
77521 Acorn computers to access file and print servers. It uses native
77522 diff -urNp linux-2.6.32.49/net/ieee802154/dgram.c linux-2.6.32.49/net/ieee802154/dgram.c
77523 --- linux-2.6.32.49/net/ieee802154/dgram.c 2011-11-08 19:02:43.000000000 -0500
77524 +++ linux-2.6.32.49/net/ieee802154/dgram.c 2011-11-15 19:59:43.000000000 -0500
77525 @@ -318,7 +318,7 @@ out:
77526 static int dgram_rcv_skb(struct sock *sk, struct sk_buff *skb)
77527 {
77528 if (sock_queue_rcv_skb(sk, skb) < 0) {
77529 - atomic_inc(&sk->sk_drops);
77530 + atomic_inc_unchecked(&sk->sk_drops);
77531 kfree_skb(skb);
77532 return NET_RX_DROP;
77533 }
77534 diff -urNp linux-2.6.32.49/net/ieee802154/raw.c linux-2.6.32.49/net/ieee802154/raw.c
77535 --- linux-2.6.32.49/net/ieee802154/raw.c 2011-11-08 19:02:43.000000000 -0500
77536 +++ linux-2.6.32.49/net/ieee802154/raw.c 2011-11-15 19:59:43.000000000 -0500
77537 @@ -206,7 +206,7 @@ out:
77538 static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
77539 {
77540 if (sock_queue_rcv_skb(sk, skb) < 0) {
77541 - atomic_inc(&sk->sk_drops);
77542 + atomic_inc_unchecked(&sk->sk_drops);
77543 kfree_skb(skb);
77544 return NET_RX_DROP;
77545 }
77546 diff -urNp linux-2.6.32.49/net/ipv4/inet_diag.c linux-2.6.32.49/net/ipv4/inet_diag.c
77547 --- linux-2.6.32.49/net/ipv4/inet_diag.c 2011-11-08 19:02:43.000000000 -0500
77548 +++ linux-2.6.32.49/net/ipv4/inet_diag.c 2011-11-15 19:59:43.000000000 -0500
77549 @@ -113,8 +113,13 @@ static int inet_csk_diag_fill(struct soc
77550 r->idiag_retrans = 0;
77551
77552 r->id.idiag_if = sk->sk_bound_dev_if;
77553 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77554 + r->id.idiag_cookie[0] = 0;
77555 + r->id.idiag_cookie[1] = 0;
77556 +#else
77557 r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
77558 r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
77559 +#endif
77560
77561 r->id.idiag_sport = inet->sport;
77562 r->id.idiag_dport = inet->dport;
77563 @@ -200,8 +205,15 @@ static int inet_twsk_diag_fill(struct in
77564 r->idiag_family = tw->tw_family;
77565 r->idiag_retrans = 0;
77566 r->id.idiag_if = tw->tw_bound_dev_if;
77567 +
77568 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77569 + r->id.idiag_cookie[0] = 0;
77570 + r->id.idiag_cookie[1] = 0;
77571 +#else
77572 r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
77573 r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
77574 +#endif
77575 +
77576 r->id.idiag_sport = tw->tw_sport;
77577 r->id.idiag_dport = tw->tw_dport;
77578 r->id.idiag_src[0] = tw->tw_rcv_saddr;
77579 @@ -284,12 +296,14 @@ static int inet_diag_get_exact(struct sk
77580 if (sk == NULL)
77581 goto unlock;
77582
77583 +#ifndef CONFIG_GRKERNSEC_HIDESYM
77584 err = -ESTALE;
77585 if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
77586 req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
77587 ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
77588 (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
77589 goto out;
77590 +#endif
77591
77592 err = -ENOMEM;
77593 rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
77594 @@ -579,8 +593,14 @@ static int inet_diag_fill_req(struct sk_
77595 r->idiag_retrans = req->retrans;
77596
77597 r->id.idiag_if = sk->sk_bound_dev_if;
77598 +
77599 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77600 + r->id.idiag_cookie[0] = 0;
77601 + r->id.idiag_cookie[1] = 0;
77602 +#else
77603 r->id.idiag_cookie[0] = (u32)(unsigned long)req;
77604 r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
77605 +#endif
77606
77607 tmo = req->expires - jiffies;
77608 if (tmo < 0)
77609 diff -urNp linux-2.6.32.49/net/ipv4/inet_hashtables.c linux-2.6.32.49/net/ipv4/inet_hashtables.c
77610 --- linux-2.6.32.49/net/ipv4/inet_hashtables.c 2011-11-08 19:02:43.000000000 -0500
77611 +++ linux-2.6.32.49/net/ipv4/inet_hashtables.c 2011-11-15 19:59:43.000000000 -0500
77612 @@ -18,12 +18,15 @@
77613 #include <linux/sched.h>
77614 #include <linux/slab.h>
77615 #include <linux/wait.h>
77616 +#include <linux/security.h>
77617
77618 #include <net/inet_connection_sock.h>
77619 #include <net/inet_hashtables.h>
77620 #include <net/secure_seq.h>
77621 #include <net/ip.h>
77622
77623 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
77624 +
77625 /*
77626 * Allocate and initialize a new local port bind bucket.
77627 * The bindhash mutex for snum's hash chain must be held here.
77628 @@ -491,6 +494,8 @@ ok:
77629 }
77630 spin_unlock(&head->lock);
77631
77632 + gr_update_task_in_ip_table(current, inet_sk(sk));
77633 +
77634 if (tw) {
77635 inet_twsk_deschedule(tw, death_row);
77636 inet_twsk_put(tw);
77637 diff -urNp linux-2.6.32.49/net/ipv4/inetpeer.c linux-2.6.32.49/net/ipv4/inetpeer.c
77638 --- linux-2.6.32.49/net/ipv4/inetpeer.c 2011-11-08 19:02:43.000000000 -0500
77639 +++ linux-2.6.32.49/net/ipv4/inetpeer.c 2011-11-15 19:59:43.000000000 -0500
77640 @@ -367,6 +367,8 @@ struct inet_peer *inet_getpeer(__be32 da
77641 struct inet_peer *p, *n;
77642 struct inet_peer **stack[PEER_MAXDEPTH], ***stackptr;
77643
77644 + pax_track_stack();
77645 +
77646 /* Look up for the address quickly. */
77647 read_lock_bh(&peer_pool_lock);
77648 p = lookup(daddr, NULL);
77649 @@ -390,7 +392,7 @@ struct inet_peer *inet_getpeer(__be32 da
77650 return NULL;
77651 n->v4daddr = daddr;
77652 atomic_set(&n->refcnt, 1);
77653 - atomic_set(&n->rid, 0);
77654 + atomic_set_unchecked(&n->rid, 0);
77655 n->ip_id_count = secure_ip_id(daddr);
77656 n->tcp_ts_stamp = 0;
77657
77658 diff -urNp linux-2.6.32.49/net/ipv4/ipconfig.c linux-2.6.32.49/net/ipv4/ipconfig.c
77659 --- linux-2.6.32.49/net/ipv4/ipconfig.c 2011-11-08 19:02:43.000000000 -0500
77660 +++ linux-2.6.32.49/net/ipv4/ipconfig.c 2011-11-15 19:59:43.000000000 -0500
77661 @@ -295,7 +295,7 @@ static int __init ic_devinet_ioctl(unsig
77662
77663 mm_segment_t oldfs = get_fs();
77664 set_fs(get_ds());
77665 - res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
77666 + res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
77667 set_fs(oldfs);
77668 return res;
77669 }
77670 @@ -306,7 +306,7 @@ static int __init ic_dev_ioctl(unsigned
77671
77672 mm_segment_t oldfs = get_fs();
77673 set_fs(get_ds());
77674 - res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
77675 + res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
77676 set_fs(oldfs);
77677 return res;
77678 }
77679 @@ -317,7 +317,7 @@ static int __init ic_route_ioctl(unsigne
77680
77681 mm_segment_t oldfs = get_fs();
77682 set_fs(get_ds());
77683 - res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg);
77684 + res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg);
77685 set_fs(oldfs);
77686 return res;
77687 }
77688 diff -urNp linux-2.6.32.49/net/ipv4/ip_fragment.c linux-2.6.32.49/net/ipv4/ip_fragment.c
77689 --- linux-2.6.32.49/net/ipv4/ip_fragment.c 2011-11-08 19:02:43.000000000 -0500
77690 +++ linux-2.6.32.49/net/ipv4/ip_fragment.c 2011-11-15 19:59:43.000000000 -0500
77691 @@ -255,7 +255,7 @@ static inline int ip_frag_too_far(struct
77692 return 0;
77693
77694 start = qp->rid;
77695 - end = atomic_inc_return(&peer->rid);
77696 + end = atomic_inc_return_unchecked(&peer->rid);
77697 qp->rid = end;
77698
77699 rc = qp->q.fragments && (end - start) > max;
77700 diff -urNp linux-2.6.32.49/net/ipv4/ip_sockglue.c linux-2.6.32.49/net/ipv4/ip_sockglue.c
77701 --- linux-2.6.32.49/net/ipv4/ip_sockglue.c 2011-11-08 19:02:43.000000000 -0500
77702 +++ linux-2.6.32.49/net/ipv4/ip_sockglue.c 2011-11-15 19:59:43.000000000 -0500
77703 @@ -1015,6 +1015,8 @@ static int do_ip_getsockopt(struct sock
77704 int val;
77705 int len;
77706
77707 + pax_track_stack();
77708 +
77709 if (level != SOL_IP)
77710 return -EOPNOTSUPP;
77711
77712 @@ -1173,7 +1175,7 @@ static int do_ip_getsockopt(struct sock
77713 if (sk->sk_type != SOCK_STREAM)
77714 return -ENOPROTOOPT;
77715
77716 - msg.msg_control = optval;
77717 + msg.msg_control = (void __force_kernel *)optval;
77718 msg.msg_controllen = len;
77719 msg.msg_flags = 0;
77720
77721 diff -urNp linux-2.6.32.49/net/ipv4/netfilter/arp_tables.c linux-2.6.32.49/net/ipv4/netfilter/arp_tables.c
77722 --- linux-2.6.32.49/net/ipv4/netfilter/arp_tables.c 2011-11-08 19:02:43.000000000 -0500
77723 +++ linux-2.6.32.49/net/ipv4/netfilter/arp_tables.c 2011-11-15 19:59:43.000000000 -0500
77724 @@ -934,6 +934,7 @@ static int get_info(struct net *net, voi
77725 private = &tmp;
77726 }
77727 #endif
77728 + memset(&info, 0, sizeof(info));
77729 info.valid_hooks = t->valid_hooks;
77730 memcpy(info.hook_entry, private->hook_entry,
77731 sizeof(info.hook_entry));
77732 diff -urNp linux-2.6.32.49/net/ipv4/netfilter/ip_queue.c linux-2.6.32.49/net/ipv4/netfilter/ip_queue.c
77733 --- linux-2.6.32.49/net/ipv4/netfilter/ip_queue.c 2011-11-08 19:02:43.000000000 -0500
77734 +++ linux-2.6.32.49/net/ipv4/netfilter/ip_queue.c 2011-11-15 19:59:43.000000000 -0500
77735 @@ -286,6 +286,9 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, st
77736
77737 if (v->data_len < sizeof(*user_iph))
77738 return 0;
77739 + if (v->data_len > 65535)
77740 + return -EMSGSIZE;
77741 +
77742 diff = v->data_len - e->skb->len;
77743 if (diff < 0) {
77744 if (pskb_trim(e->skb, v->data_len))
77745 @@ -409,7 +412,8 @@ ipq_dev_drop(int ifindex)
77746 static inline void
77747 __ipq_rcv_skb(struct sk_buff *skb)
77748 {
77749 - int status, type, pid, flags, nlmsglen, skblen;
77750 + int status, type, pid, flags;
77751 + unsigned int nlmsglen, skblen;
77752 struct nlmsghdr *nlh;
77753
77754 skblen = skb->len;
77755 diff -urNp linux-2.6.32.49/net/ipv4/netfilter/ip_tables.c linux-2.6.32.49/net/ipv4/netfilter/ip_tables.c
77756 --- linux-2.6.32.49/net/ipv4/netfilter/ip_tables.c 2011-11-08 19:02:43.000000000 -0500
77757 +++ linux-2.6.32.49/net/ipv4/netfilter/ip_tables.c 2011-11-15 19:59:43.000000000 -0500
77758 @@ -1141,6 +1141,7 @@ static int get_info(struct net *net, voi
77759 private = &tmp;
77760 }
77761 #endif
77762 + memset(&info, 0, sizeof(info));
77763 info.valid_hooks = t->valid_hooks;
77764 memcpy(info.hook_entry, private->hook_entry,
77765 sizeof(info.hook_entry));
77766 diff -urNp linux-2.6.32.49/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.32.49/net/ipv4/netfilter/nf_nat_snmp_basic.c
77767 --- linux-2.6.32.49/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-11-08 19:02:43.000000000 -0500
77768 +++ linux-2.6.32.49/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-11-15 19:59:43.000000000 -0500
77769 @@ -397,7 +397,7 @@ static unsigned char asn1_octets_decode(
77770
77771 *len = 0;
77772
77773 - *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
77774 + *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
77775 if (*octets == NULL) {
77776 if (net_ratelimit())
77777 printk("OOM in bsalg (%d)\n", __LINE__);
77778 diff -urNp linux-2.6.32.49/net/ipv4/raw.c linux-2.6.32.49/net/ipv4/raw.c
77779 --- linux-2.6.32.49/net/ipv4/raw.c 2011-11-08 19:02:43.000000000 -0500
77780 +++ linux-2.6.32.49/net/ipv4/raw.c 2011-11-15 19:59:43.000000000 -0500
77781 @@ -292,7 +292,7 @@ static int raw_rcv_skb(struct sock * sk,
77782 /* Charge it to the socket. */
77783
77784 if (sock_queue_rcv_skb(sk, skb) < 0) {
77785 - atomic_inc(&sk->sk_drops);
77786 + atomic_inc_unchecked(&sk->sk_drops);
77787 kfree_skb(skb);
77788 return NET_RX_DROP;
77789 }
77790 @@ -303,7 +303,7 @@ static int raw_rcv_skb(struct sock * sk,
77791 int raw_rcv(struct sock *sk, struct sk_buff *skb)
77792 {
77793 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
77794 - atomic_inc(&sk->sk_drops);
77795 + atomic_inc_unchecked(&sk->sk_drops);
77796 kfree_skb(skb);
77797 return NET_RX_DROP;
77798 }
77799 @@ -724,16 +724,23 @@ static int raw_init(struct sock *sk)
77800
77801 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
77802 {
77803 + struct icmp_filter filter;
77804 +
77805 + if (optlen < 0)
77806 + return -EINVAL;
77807 if (optlen > sizeof(struct icmp_filter))
77808 optlen = sizeof(struct icmp_filter);
77809 - if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
77810 + if (copy_from_user(&filter, optval, optlen))
77811 return -EFAULT;
77812 + raw_sk(sk)->filter = filter;
77813 +
77814 return 0;
77815 }
77816
77817 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
77818 {
77819 int len, ret = -EFAULT;
77820 + struct icmp_filter filter;
77821
77822 if (get_user(len, optlen))
77823 goto out;
77824 @@ -743,8 +750,9 @@ static int raw_geticmpfilter(struct sock
77825 if (len > sizeof(struct icmp_filter))
77826 len = sizeof(struct icmp_filter);
77827 ret = -EFAULT;
77828 - if (put_user(len, optlen) ||
77829 - copy_to_user(optval, &raw_sk(sk)->filter, len))
77830 + filter = raw_sk(sk)->filter;
77831 + if (put_user(len, optlen) || len > sizeof filter ||
77832 + copy_to_user(optval, &filter, len))
77833 goto out;
77834 ret = 0;
77835 out: return ret;
77836 @@ -954,7 +962,13 @@ static void raw_sock_seq_show(struct seq
77837 sk_wmem_alloc_get(sp),
77838 sk_rmem_alloc_get(sp),
77839 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
77840 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
77841 + atomic_read(&sp->sk_refcnt),
77842 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77843 + NULL,
77844 +#else
77845 + sp,
77846 +#endif
77847 + atomic_read_unchecked(&sp->sk_drops));
77848 }
77849
77850 static int raw_seq_show(struct seq_file *seq, void *v)
77851 diff -urNp linux-2.6.32.49/net/ipv4/route.c linux-2.6.32.49/net/ipv4/route.c
77852 --- linux-2.6.32.49/net/ipv4/route.c 2011-11-08 19:02:43.000000000 -0500
77853 +++ linux-2.6.32.49/net/ipv4/route.c 2011-11-15 19:59:43.000000000 -0500
77854 @@ -269,7 +269,7 @@ static inline unsigned int rt_hash(__be3
77855
77856 static inline int rt_genid(struct net *net)
77857 {
77858 - return atomic_read(&net->ipv4.rt_genid);
77859 + return atomic_read_unchecked(&net->ipv4.rt_genid);
77860 }
77861
77862 #ifdef CONFIG_PROC_FS
77863 @@ -889,7 +889,7 @@ static void rt_cache_invalidate(struct n
77864 unsigned char shuffle;
77865
77866 get_random_bytes(&shuffle, sizeof(shuffle));
77867 - atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
77868 + atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
77869 }
77870
77871 /*
77872 @@ -3357,7 +3357,7 @@ static __net_initdata struct pernet_oper
77873
77874 static __net_init int rt_secret_timer_init(struct net *net)
77875 {
77876 - atomic_set(&net->ipv4.rt_genid,
77877 + atomic_set_unchecked(&net->ipv4.rt_genid,
77878 (int) ((num_physpages ^ (num_physpages>>8)) ^
77879 (jiffies ^ (jiffies >> 7))));
77880
77881 diff -urNp linux-2.6.32.49/net/ipv4/tcp.c linux-2.6.32.49/net/ipv4/tcp.c
77882 --- linux-2.6.32.49/net/ipv4/tcp.c 2011-11-08 19:02:43.000000000 -0500
77883 +++ linux-2.6.32.49/net/ipv4/tcp.c 2011-11-15 19:59:43.000000000 -0500
77884 @@ -2085,6 +2085,8 @@ static int do_tcp_setsockopt(struct sock
77885 int val;
77886 int err = 0;
77887
77888 + pax_track_stack();
77889 +
77890 /* This is a string value all the others are int's */
77891 if (optname == TCP_CONGESTION) {
77892 char name[TCP_CA_NAME_MAX];
77893 @@ -2355,6 +2357,8 @@ static int do_tcp_getsockopt(struct sock
77894 struct tcp_sock *tp = tcp_sk(sk);
77895 int val, len;
77896
77897 + pax_track_stack();
77898 +
77899 if (get_user(len, optlen))
77900 return -EFAULT;
77901
77902 diff -urNp linux-2.6.32.49/net/ipv4/tcp_ipv4.c linux-2.6.32.49/net/ipv4/tcp_ipv4.c
77903 --- linux-2.6.32.49/net/ipv4/tcp_ipv4.c 2011-11-08 19:02:43.000000000 -0500
77904 +++ linux-2.6.32.49/net/ipv4/tcp_ipv4.c 2011-11-15 19:59:43.000000000 -0500
77905 @@ -85,6 +85,9 @@
77906 int sysctl_tcp_tw_reuse __read_mostly;
77907 int sysctl_tcp_low_latency __read_mostly;
77908
77909 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77910 +extern int grsec_enable_blackhole;
77911 +#endif
77912
77913 #ifdef CONFIG_TCP_MD5SIG
77914 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
77915 @@ -1543,6 +1546,9 @@ int tcp_v4_do_rcv(struct sock *sk, struc
77916 return 0;
77917
77918 reset:
77919 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77920 + if (!grsec_enable_blackhole)
77921 +#endif
77922 tcp_v4_send_reset(rsk, skb);
77923 discard:
77924 kfree_skb(skb);
77925 @@ -1604,12 +1610,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
77926 TCP_SKB_CB(skb)->sacked = 0;
77927
77928 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
77929 - if (!sk)
77930 + if (!sk) {
77931 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77932 + ret = 1;
77933 +#endif
77934 goto no_tcp_socket;
77935 + }
77936
77937 process:
77938 - if (sk->sk_state == TCP_TIME_WAIT)
77939 + if (sk->sk_state == TCP_TIME_WAIT) {
77940 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77941 + ret = 2;
77942 +#endif
77943 goto do_time_wait;
77944 + }
77945
77946 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
77947 goto discard_and_relse;
77948 @@ -1651,6 +1665,10 @@ no_tcp_socket:
77949 bad_packet:
77950 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
77951 } else {
77952 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77953 + if (!grsec_enable_blackhole || (ret == 1 &&
77954 + (skb->dev->flags & IFF_LOOPBACK)))
77955 +#endif
77956 tcp_v4_send_reset(NULL, skb);
77957 }
77958
77959 @@ -2238,7 +2256,11 @@ static void get_openreq4(struct sock *sk
77960 0, /* non standard timer */
77961 0, /* open_requests have no inode */
77962 atomic_read(&sk->sk_refcnt),
77963 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77964 + NULL,
77965 +#else
77966 req,
77967 +#endif
77968 len);
77969 }
77970
77971 @@ -2280,7 +2302,12 @@ static void get_tcp4_sock(struct sock *s
77972 sock_i_uid(sk),
77973 icsk->icsk_probes_out,
77974 sock_i_ino(sk),
77975 - atomic_read(&sk->sk_refcnt), sk,
77976 + atomic_read(&sk->sk_refcnt),
77977 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77978 + NULL,
77979 +#else
77980 + sk,
77981 +#endif
77982 jiffies_to_clock_t(icsk->icsk_rto),
77983 jiffies_to_clock_t(icsk->icsk_ack.ato),
77984 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
77985 @@ -2308,7 +2335,13 @@ static void get_timewait4_sock(struct in
77986 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
77987 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
77988 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
77989 - atomic_read(&tw->tw_refcnt), tw, len);
77990 + atomic_read(&tw->tw_refcnt),
77991 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77992 + NULL,
77993 +#else
77994 + tw,
77995 +#endif
77996 + len);
77997 }
77998
77999 #define TMPSZ 150
78000 diff -urNp linux-2.6.32.49/net/ipv4/tcp_minisocks.c linux-2.6.32.49/net/ipv4/tcp_minisocks.c
78001 --- linux-2.6.32.49/net/ipv4/tcp_minisocks.c 2011-11-08 19:02:43.000000000 -0500
78002 +++ linux-2.6.32.49/net/ipv4/tcp_minisocks.c 2011-11-15 19:59:43.000000000 -0500
78003 @@ -26,6 +26,10 @@
78004 #include <net/inet_common.h>
78005 #include <net/xfrm.h>
78006
78007 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
78008 +extern int grsec_enable_blackhole;
78009 +#endif
78010 +
78011 #ifdef CONFIG_SYSCTL
78012 #define SYNC_INIT 0 /* let the user enable it */
78013 #else
78014 @@ -672,6 +676,10 @@ listen_overflow:
78015
78016 embryonic_reset:
78017 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
78018 +
78019 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
78020 + if (!grsec_enable_blackhole)
78021 +#endif
78022 if (!(flg & TCP_FLAG_RST))
78023 req->rsk_ops->send_reset(sk, skb);
78024
78025 diff -urNp linux-2.6.32.49/net/ipv4/tcp_output.c linux-2.6.32.49/net/ipv4/tcp_output.c
78026 --- linux-2.6.32.49/net/ipv4/tcp_output.c 2011-11-08 19:02:43.000000000 -0500
78027 +++ linux-2.6.32.49/net/ipv4/tcp_output.c 2011-11-15 19:59:43.000000000 -0500
78028 @@ -2234,6 +2234,8 @@ struct sk_buff *tcp_make_synack(struct s
78029 __u8 *md5_hash_location;
78030 int mss;
78031
78032 + pax_track_stack();
78033 +
78034 skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
78035 if (skb == NULL)
78036 return NULL;
78037 diff -urNp linux-2.6.32.49/net/ipv4/tcp_probe.c linux-2.6.32.49/net/ipv4/tcp_probe.c
78038 --- linux-2.6.32.49/net/ipv4/tcp_probe.c 2011-11-08 19:02:43.000000000 -0500
78039 +++ linux-2.6.32.49/net/ipv4/tcp_probe.c 2011-11-15 19:59:43.000000000 -0500
78040 @@ -200,7 +200,7 @@ static ssize_t tcpprobe_read(struct file
78041 if (cnt + width >= len)
78042 break;
78043
78044 - if (copy_to_user(buf + cnt, tbuf, width))
78045 + if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
78046 return -EFAULT;
78047 cnt += width;
78048 }
78049 diff -urNp linux-2.6.32.49/net/ipv4/tcp_timer.c linux-2.6.32.49/net/ipv4/tcp_timer.c
78050 --- linux-2.6.32.49/net/ipv4/tcp_timer.c 2011-11-08 19:02:43.000000000 -0500
78051 +++ linux-2.6.32.49/net/ipv4/tcp_timer.c 2011-11-15 19:59:43.000000000 -0500
78052 @@ -21,6 +21,10 @@
78053 #include <linux/module.h>
78054 #include <net/tcp.h>
78055
78056 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
78057 +extern int grsec_lastack_retries;
78058 +#endif
78059 +
78060 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
78061 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
78062 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
78063 @@ -164,6 +168,13 @@ static int tcp_write_timeout(struct sock
78064 }
78065 }
78066
78067 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
78068 + if ((sk->sk_state == TCP_LAST_ACK) &&
78069 + (grsec_lastack_retries > 0) &&
78070 + (grsec_lastack_retries < retry_until))
78071 + retry_until = grsec_lastack_retries;
78072 +#endif
78073 +
78074 if (retransmits_timed_out(sk, retry_until)) {
78075 /* Has it gone just too far? */
78076 tcp_write_err(sk);
78077 diff -urNp linux-2.6.32.49/net/ipv4/udp.c linux-2.6.32.49/net/ipv4/udp.c
78078 --- linux-2.6.32.49/net/ipv4/udp.c 2011-11-08 19:02:43.000000000 -0500
78079 +++ linux-2.6.32.49/net/ipv4/udp.c 2011-11-15 19:59:43.000000000 -0500
78080 @@ -86,6 +86,7 @@
78081 #include <linux/types.h>
78082 #include <linux/fcntl.h>
78083 #include <linux/module.h>
78084 +#include <linux/security.h>
78085 #include <linux/socket.h>
78086 #include <linux/sockios.h>
78087 #include <linux/igmp.h>
78088 @@ -106,6 +107,10 @@
78089 #include <net/xfrm.h>
78090 #include "udp_impl.h"
78091
78092 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
78093 +extern int grsec_enable_blackhole;
78094 +#endif
78095 +
78096 struct udp_table udp_table;
78097 EXPORT_SYMBOL(udp_table);
78098
78099 @@ -371,6 +376,9 @@ found:
78100 return s;
78101 }
78102
78103 +extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
78104 +extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
78105 +
78106 /*
78107 * This routine is called by the ICMP module when it gets some
78108 * sort of error condition. If err < 0 then the socket should
78109 @@ -639,9 +647,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
78110 dport = usin->sin_port;
78111 if (dport == 0)
78112 return -EINVAL;
78113 +
78114 + err = gr_search_udp_sendmsg(sk, usin);
78115 + if (err)
78116 + return err;
78117 } else {
78118 if (sk->sk_state != TCP_ESTABLISHED)
78119 return -EDESTADDRREQ;
78120 +
78121 + err = gr_search_udp_sendmsg(sk, NULL);
78122 + if (err)
78123 + return err;
78124 +
78125 daddr = inet->daddr;
78126 dport = inet->dport;
78127 /* Open fast path for connected socket.
78128 @@ -945,6 +962,10 @@ try_again:
78129 if (!skb)
78130 goto out;
78131
78132 + err = gr_search_udp_recvmsg(sk, skb);
78133 + if (err)
78134 + goto out_free;
78135 +
78136 ulen = skb->len - sizeof(struct udphdr);
78137 copied = len;
78138 if (copied > ulen)
78139 @@ -1068,7 +1089,7 @@ static int __udp_queue_rcv_skb(struct so
78140 if (rc == -ENOMEM) {
78141 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
78142 is_udplite);
78143 - atomic_inc(&sk->sk_drops);
78144 + atomic_inc_unchecked(&sk->sk_drops);
78145 }
78146 goto drop;
78147 }
78148 @@ -1338,6 +1359,9 @@ int __udp4_lib_rcv(struct sk_buff *skb,
78149 goto csum_error;
78150
78151 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
78152 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
78153 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
78154 +#endif
78155 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
78156
78157 /*
78158 @@ -1758,8 +1782,13 @@ static void udp4_format_sock(struct sock
78159 sk_wmem_alloc_get(sp),
78160 sk_rmem_alloc_get(sp),
78161 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
78162 - atomic_read(&sp->sk_refcnt), sp,
78163 - atomic_read(&sp->sk_drops), len);
78164 + atomic_read(&sp->sk_refcnt),
78165 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78166 + NULL,
78167 +#else
78168 + sp,
78169 +#endif
78170 + atomic_read_unchecked(&sp->sk_drops), len);
78171 }
78172
78173 int udp4_seq_show(struct seq_file *seq, void *v)
78174 diff -urNp linux-2.6.32.49/net/ipv6/addrconf.c linux-2.6.32.49/net/ipv6/addrconf.c
78175 --- linux-2.6.32.49/net/ipv6/addrconf.c 2011-11-08 19:02:43.000000000 -0500
78176 +++ linux-2.6.32.49/net/ipv6/addrconf.c 2011-11-15 19:59:43.000000000 -0500
78177 @@ -2053,7 +2053,7 @@ int addrconf_set_dstaddr(struct net *net
78178 p.iph.ihl = 5;
78179 p.iph.protocol = IPPROTO_IPV6;
78180 p.iph.ttl = 64;
78181 - ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
78182 + ifr.ifr_ifru.ifru_data = (void __force_user *)&p;
78183
78184 if (ops->ndo_do_ioctl) {
78185 mm_segment_t oldfs = get_fs();
78186 diff -urNp linux-2.6.32.49/net/ipv6/inet6_connection_sock.c linux-2.6.32.49/net/ipv6/inet6_connection_sock.c
78187 --- linux-2.6.32.49/net/ipv6/inet6_connection_sock.c 2011-11-08 19:02:43.000000000 -0500
78188 +++ linux-2.6.32.49/net/ipv6/inet6_connection_sock.c 2011-11-15 19:59:43.000000000 -0500
78189 @@ -152,7 +152,7 @@ void __inet6_csk_dst_store(struct sock *
78190 #ifdef CONFIG_XFRM
78191 {
78192 struct rt6_info *rt = (struct rt6_info *)dst;
78193 - rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
78194 + rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
78195 }
78196 #endif
78197 }
78198 @@ -167,7 +167,7 @@ struct dst_entry *__inet6_csk_dst_check(
78199 #ifdef CONFIG_XFRM
78200 if (dst) {
78201 struct rt6_info *rt = (struct rt6_info *)dst;
78202 - if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
78203 + if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
78204 sk->sk_dst_cache = NULL;
78205 dst_release(dst);
78206 dst = NULL;
78207 diff -urNp linux-2.6.32.49/net/ipv6/inet6_hashtables.c linux-2.6.32.49/net/ipv6/inet6_hashtables.c
78208 --- linux-2.6.32.49/net/ipv6/inet6_hashtables.c 2011-11-08 19:02:43.000000000 -0500
78209 +++ linux-2.6.32.49/net/ipv6/inet6_hashtables.c 2011-11-15 19:59:43.000000000 -0500
78210 @@ -119,7 +119,7 @@ out:
78211 }
78212 EXPORT_SYMBOL(__inet6_lookup_established);
78213
78214 -static int inline compute_score(struct sock *sk, struct net *net,
78215 +static inline int compute_score(struct sock *sk, struct net *net,
78216 const unsigned short hnum,
78217 const struct in6_addr *daddr,
78218 const int dif)
78219 diff -urNp linux-2.6.32.49/net/ipv6/ipv6_sockglue.c linux-2.6.32.49/net/ipv6/ipv6_sockglue.c
78220 --- linux-2.6.32.49/net/ipv6/ipv6_sockglue.c 2011-11-08 19:02:43.000000000 -0500
78221 +++ linux-2.6.32.49/net/ipv6/ipv6_sockglue.c 2011-11-15 19:59:43.000000000 -0500
78222 @@ -130,6 +130,8 @@ static int do_ipv6_setsockopt(struct soc
78223 int val, valbool;
78224 int retv = -ENOPROTOOPT;
78225
78226 + pax_track_stack();
78227 +
78228 if (optval == NULL)
78229 val=0;
78230 else {
78231 @@ -881,6 +883,8 @@ static int do_ipv6_getsockopt(struct soc
78232 int len;
78233 int val;
78234
78235 + pax_track_stack();
78236 +
78237 if (ip6_mroute_opt(optname))
78238 return ip6_mroute_getsockopt(sk, optname, optval, optlen);
78239
78240 @@ -922,7 +926,7 @@ static int do_ipv6_getsockopt(struct soc
78241 if (sk->sk_type != SOCK_STREAM)
78242 return -ENOPROTOOPT;
78243
78244 - msg.msg_control = optval;
78245 + msg.msg_control = (void __force_kernel *)optval;
78246 msg.msg_controllen = len;
78247 msg.msg_flags = 0;
78248
78249 diff -urNp linux-2.6.32.49/net/ipv6/netfilter/ip6_queue.c linux-2.6.32.49/net/ipv6/netfilter/ip6_queue.c
78250 --- linux-2.6.32.49/net/ipv6/netfilter/ip6_queue.c 2011-11-08 19:02:43.000000000 -0500
78251 +++ linux-2.6.32.49/net/ipv6/netfilter/ip6_queue.c 2011-11-15 19:59:43.000000000 -0500
78252 @@ -287,6 +287,9 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, st
78253
78254 if (v->data_len < sizeof(*user_iph))
78255 return 0;
78256 + if (v->data_len > 65535)
78257 + return -EMSGSIZE;
78258 +
78259 diff = v->data_len - e->skb->len;
78260 if (diff < 0) {
78261 if (pskb_trim(e->skb, v->data_len))
78262 @@ -411,7 +414,8 @@ ipq_dev_drop(int ifindex)
78263 static inline void
78264 __ipq_rcv_skb(struct sk_buff *skb)
78265 {
78266 - int status, type, pid, flags, nlmsglen, skblen;
78267 + int status, type, pid, flags;
78268 + unsigned int nlmsglen, skblen;
78269 struct nlmsghdr *nlh;
78270
78271 skblen = skb->len;
78272 diff -urNp linux-2.6.32.49/net/ipv6/netfilter/ip6_tables.c linux-2.6.32.49/net/ipv6/netfilter/ip6_tables.c
78273 --- linux-2.6.32.49/net/ipv6/netfilter/ip6_tables.c 2011-11-08 19:02:43.000000000 -0500
78274 +++ linux-2.6.32.49/net/ipv6/netfilter/ip6_tables.c 2011-11-15 19:59:43.000000000 -0500
78275 @@ -1173,6 +1173,7 @@ static int get_info(struct net *net, voi
78276 private = &tmp;
78277 }
78278 #endif
78279 + memset(&info, 0, sizeof(info));
78280 info.valid_hooks = t->valid_hooks;
78281 memcpy(info.hook_entry, private->hook_entry,
78282 sizeof(info.hook_entry));
78283 diff -urNp linux-2.6.32.49/net/ipv6/raw.c linux-2.6.32.49/net/ipv6/raw.c
78284 --- linux-2.6.32.49/net/ipv6/raw.c 2011-11-08 19:02:43.000000000 -0500
78285 +++ linux-2.6.32.49/net/ipv6/raw.c 2011-11-15 19:59:43.000000000 -0500
78286 @@ -375,14 +375,14 @@ static inline int rawv6_rcv_skb(struct s
78287 {
78288 if ((raw6_sk(sk)->checksum || sk->sk_filter) &&
78289 skb_checksum_complete(skb)) {
78290 - atomic_inc(&sk->sk_drops);
78291 + atomic_inc_unchecked(&sk->sk_drops);
78292 kfree_skb(skb);
78293 return NET_RX_DROP;
78294 }
78295
78296 /* Charge it to the socket. */
78297 if (sock_queue_rcv_skb(sk,skb)<0) {
78298 - atomic_inc(&sk->sk_drops);
78299 + atomic_inc_unchecked(&sk->sk_drops);
78300 kfree_skb(skb);
78301 return NET_RX_DROP;
78302 }
78303 @@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk
78304 struct raw6_sock *rp = raw6_sk(sk);
78305
78306 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
78307 - atomic_inc(&sk->sk_drops);
78308 + atomic_inc_unchecked(&sk->sk_drops);
78309 kfree_skb(skb);
78310 return NET_RX_DROP;
78311 }
78312 @@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk
78313
78314 if (inet->hdrincl) {
78315 if (skb_checksum_complete(skb)) {
78316 - atomic_inc(&sk->sk_drops);
78317 + atomic_inc_unchecked(&sk->sk_drops);
78318 kfree_skb(skb);
78319 return NET_RX_DROP;
78320 }
78321 @@ -518,7 +518,7 @@ csum_copy_err:
78322 as some normal condition.
78323 */
78324 err = (flags&MSG_DONTWAIT) ? -EAGAIN : -EHOSTUNREACH;
78325 - atomic_inc(&sk->sk_drops);
78326 + atomic_inc_unchecked(&sk->sk_drops);
78327 goto out;
78328 }
78329
78330 @@ -600,7 +600,7 @@ out:
78331 return err;
78332 }
78333
78334 -static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
78335 +static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
78336 struct flowi *fl, struct rt6_info *rt,
78337 unsigned int flags)
78338 {
78339 @@ -738,6 +738,8 @@ static int rawv6_sendmsg(struct kiocb *i
78340 u16 proto;
78341 int err;
78342
78343 + pax_track_stack();
78344 +
78345 /* Rough check on arithmetic overflow,
78346 better check is made in ip6_append_data().
78347 */
78348 @@ -916,12 +918,17 @@ do_confirm:
78349 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
78350 char __user *optval, int optlen)
78351 {
78352 + struct icmp6_filter filter;
78353 +
78354 switch (optname) {
78355 case ICMPV6_FILTER:
78356 + if (optlen < 0)
78357 + return -EINVAL;
78358 if (optlen > sizeof(struct icmp6_filter))
78359 optlen = sizeof(struct icmp6_filter);
78360 - if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
78361 + if (copy_from_user(&filter, optval, optlen))
78362 return -EFAULT;
78363 + raw6_sk(sk)->filter = filter;
78364 return 0;
78365 default:
78366 return -ENOPROTOOPT;
78367 @@ -934,6 +941,7 @@ static int rawv6_geticmpfilter(struct so
78368 char __user *optval, int __user *optlen)
78369 {
78370 int len;
78371 + struct icmp6_filter filter;
78372
78373 switch (optname) {
78374 case ICMPV6_FILTER:
78375 @@ -945,7 +953,8 @@ static int rawv6_geticmpfilter(struct so
78376 len = sizeof(struct icmp6_filter);
78377 if (put_user(len, optlen))
78378 return -EFAULT;
78379 - if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
78380 + filter = raw6_sk(sk)->filter;
78381 + if (len > sizeof filter || copy_to_user(optval, &filter, len))
78382 return -EFAULT;
78383 return 0;
78384 default:
78385 @@ -1241,7 +1250,13 @@ static void raw6_sock_seq_show(struct se
78386 0, 0L, 0,
78387 sock_i_uid(sp), 0,
78388 sock_i_ino(sp),
78389 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
78390 + atomic_read(&sp->sk_refcnt),
78391 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78392 + NULL,
78393 +#else
78394 + sp,
78395 +#endif
78396 + atomic_read_unchecked(&sp->sk_drops));
78397 }
78398
78399 static int raw6_seq_show(struct seq_file *seq, void *v)
78400 diff -urNp linux-2.6.32.49/net/ipv6/tcp_ipv6.c linux-2.6.32.49/net/ipv6/tcp_ipv6.c
78401 --- linux-2.6.32.49/net/ipv6/tcp_ipv6.c 2011-11-08 19:02:43.000000000 -0500
78402 +++ linux-2.6.32.49/net/ipv6/tcp_ipv6.c 2011-11-15 19:59:43.000000000 -0500
78403 @@ -89,6 +89,10 @@ static struct tcp_md5sig_key *tcp_v6_md5
78404 }
78405 #endif
78406
78407 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
78408 +extern int grsec_enable_blackhole;
78409 +#endif
78410 +
78411 static void tcp_v6_hash(struct sock *sk)
78412 {
78413 if (sk->sk_state != TCP_CLOSE) {
78414 @@ -1579,6 +1583,9 @@ static int tcp_v6_do_rcv(struct sock *sk
78415 return 0;
78416
78417 reset:
78418 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
78419 + if (!grsec_enable_blackhole)
78420 +#endif
78421 tcp_v6_send_reset(sk, skb);
78422 discard:
78423 if (opt_skb)
78424 @@ -1656,12 +1663,20 @@ static int tcp_v6_rcv(struct sk_buff *sk
78425 TCP_SKB_CB(skb)->sacked = 0;
78426
78427 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
78428 - if (!sk)
78429 + if (!sk) {
78430 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
78431 + ret = 1;
78432 +#endif
78433 goto no_tcp_socket;
78434 + }
78435
78436 process:
78437 - if (sk->sk_state == TCP_TIME_WAIT)
78438 + if (sk->sk_state == TCP_TIME_WAIT) {
78439 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
78440 + ret = 2;
78441 +#endif
78442 goto do_time_wait;
78443 + }
78444
78445 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
78446 goto discard_and_relse;
78447 @@ -1701,6 +1716,10 @@ no_tcp_socket:
78448 bad_packet:
78449 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
78450 } else {
78451 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
78452 + if (!grsec_enable_blackhole || (ret == 1 &&
78453 + (skb->dev->flags & IFF_LOOPBACK)))
78454 +#endif
78455 tcp_v6_send_reset(NULL, skb);
78456 }
78457
78458 @@ -1916,7 +1935,13 @@ static void get_openreq6(struct seq_file
78459 uid,
78460 0, /* non standard timer */
78461 0, /* open_requests have no inode */
78462 - 0, req);
78463 + 0,
78464 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78465 + NULL
78466 +#else
78467 + req
78468 +#endif
78469 + );
78470 }
78471
78472 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
78473 @@ -1966,7 +1991,12 @@ static void get_tcp6_sock(struct seq_fil
78474 sock_i_uid(sp),
78475 icsk->icsk_probes_out,
78476 sock_i_ino(sp),
78477 - atomic_read(&sp->sk_refcnt), sp,
78478 + atomic_read(&sp->sk_refcnt),
78479 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78480 + NULL,
78481 +#else
78482 + sp,
78483 +#endif
78484 jiffies_to_clock_t(icsk->icsk_rto),
78485 jiffies_to_clock_t(icsk->icsk_ack.ato),
78486 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
78487 @@ -2001,7 +2031,13 @@ static void get_timewait6_sock(struct se
78488 dest->s6_addr32[2], dest->s6_addr32[3], destp,
78489 tw->tw_substate, 0, 0,
78490 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
78491 - atomic_read(&tw->tw_refcnt), tw);
78492 + atomic_read(&tw->tw_refcnt),
78493 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78494 + NULL
78495 +#else
78496 + tw
78497 +#endif
78498 + );
78499 }
78500
78501 static int tcp6_seq_show(struct seq_file *seq, void *v)
78502 diff -urNp linux-2.6.32.49/net/ipv6/udp.c linux-2.6.32.49/net/ipv6/udp.c
78503 --- linux-2.6.32.49/net/ipv6/udp.c 2011-11-26 19:44:53.000000000 -0500
78504 +++ linux-2.6.32.49/net/ipv6/udp.c 2011-11-26 19:45:13.000000000 -0500
78505 @@ -49,6 +49,10 @@
78506 #include <linux/seq_file.h>
78507 #include "udp_impl.h"
78508
78509 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
78510 +extern int grsec_enable_blackhole;
78511 +#endif
78512 +
78513 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
78514 {
78515 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
78516 @@ -391,7 +395,7 @@ int udpv6_queue_rcv_skb(struct sock * sk
78517 if (rc == -ENOMEM) {
78518 UDP6_INC_STATS_BH(sock_net(sk),
78519 UDP_MIB_RCVBUFERRORS, is_udplite);
78520 - atomic_inc(&sk->sk_drops);
78521 + atomic_inc_unchecked(&sk->sk_drops);
78522 }
78523 goto drop;
78524 }
78525 @@ -590,6 +594,9 @@ int __udp6_lib_rcv(struct sk_buff *skb,
78526 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
78527 proto == IPPROTO_UDPLITE);
78528
78529 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
78530 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
78531 +#endif
78532 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
78533
78534 kfree_skb(skb);
78535 @@ -1209,8 +1216,13 @@ static void udp6_sock_seq_show(struct se
78536 0, 0L, 0,
78537 sock_i_uid(sp), 0,
78538 sock_i_ino(sp),
78539 - atomic_read(&sp->sk_refcnt), sp,
78540 - atomic_read(&sp->sk_drops));
78541 + atomic_read(&sp->sk_refcnt),
78542 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78543 + NULL,
78544 +#else
78545 + sp,
78546 +#endif
78547 + atomic_read_unchecked(&sp->sk_drops));
78548 }
78549
78550 int udp6_seq_show(struct seq_file *seq, void *v)
78551 diff -urNp linux-2.6.32.49/net/irda/ircomm/ircomm_tty.c linux-2.6.32.49/net/irda/ircomm/ircomm_tty.c
78552 --- linux-2.6.32.49/net/irda/ircomm/ircomm_tty.c 2011-11-08 19:02:43.000000000 -0500
78553 +++ linux-2.6.32.49/net/irda/ircomm/ircomm_tty.c 2011-11-15 19:59:43.000000000 -0500
78554 @@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(st
78555 add_wait_queue(&self->open_wait, &wait);
78556
78557 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
78558 - __FILE__,__LINE__, tty->driver->name, self->open_count );
78559 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
78560
78561 /* As far as I can see, we protect open_count - Jean II */
78562 spin_lock_irqsave(&self->spinlock, flags);
78563 if (!tty_hung_up_p(filp)) {
78564 extra_count = 1;
78565 - self->open_count--;
78566 + local_dec(&self->open_count);
78567 }
78568 spin_unlock_irqrestore(&self->spinlock, flags);
78569 - self->blocked_open++;
78570 + local_inc(&self->blocked_open);
78571
78572 while (1) {
78573 if (tty->termios->c_cflag & CBAUD) {
78574 @@ -329,7 +329,7 @@ static int ircomm_tty_block_til_ready(st
78575 }
78576
78577 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
78578 - __FILE__,__LINE__, tty->driver->name, self->open_count );
78579 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
78580
78581 schedule();
78582 }
78583 @@ -340,13 +340,13 @@ static int ircomm_tty_block_til_ready(st
78584 if (extra_count) {
78585 /* ++ is not atomic, so this should be protected - Jean II */
78586 spin_lock_irqsave(&self->spinlock, flags);
78587 - self->open_count++;
78588 + local_inc(&self->open_count);
78589 spin_unlock_irqrestore(&self->spinlock, flags);
78590 }
78591 - self->blocked_open--;
78592 + local_dec(&self->blocked_open);
78593
78594 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
78595 - __FILE__,__LINE__, tty->driver->name, self->open_count);
78596 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
78597
78598 if (!retval)
78599 self->flags |= ASYNC_NORMAL_ACTIVE;
78600 @@ -415,14 +415,14 @@ static int ircomm_tty_open(struct tty_st
78601 }
78602 /* ++ is not atomic, so this should be protected - Jean II */
78603 spin_lock_irqsave(&self->spinlock, flags);
78604 - self->open_count++;
78605 + local_inc(&self->open_count);
78606
78607 tty->driver_data = self;
78608 self->tty = tty;
78609 spin_unlock_irqrestore(&self->spinlock, flags);
78610
78611 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
78612 - self->line, self->open_count);
78613 + self->line, local_read(&self->open_count));
78614
78615 /* Not really used by us, but lets do it anyway */
78616 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
78617 @@ -511,7 +511,7 @@ static void ircomm_tty_close(struct tty_
78618 return;
78619 }
78620
78621 - if ((tty->count == 1) && (self->open_count != 1)) {
78622 + if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
78623 /*
78624 * Uh, oh. tty->count is 1, which means that the tty
78625 * structure will be freed. state->count should always
78626 @@ -521,16 +521,16 @@ static void ircomm_tty_close(struct tty_
78627 */
78628 IRDA_DEBUG(0, "%s(), bad serial port count; "
78629 "tty->count is 1, state->count is %d\n", __func__ ,
78630 - self->open_count);
78631 - self->open_count = 1;
78632 + local_read(&self->open_count));
78633 + local_set(&self->open_count, 1);
78634 }
78635
78636 - if (--self->open_count < 0) {
78637 + if (local_dec_return(&self->open_count) < 0) {
78638 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
78639 - __func__, self->line, self->open_count);
78640 - self->open_count = 0;
78641 + __func__, self->line, local_read(&self->open_count));
78642 + local_set(&self->open_count, 0);
78643 }
78644 - if (self->open_count) {
78645 + if (local_read(&self->open_count)) {
78646 spin_unlock_irqrestore(&self->spinlock, flags);
78647
78648 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
78649 @@ -562,7 +562,7 @@ static void ircomm_tty_close(struct tty_
78650 tty->closing = 0;
78651 self->tty = NULL;
78652
78653 - if (self->blocked_open) {
78654 + if (local_read(&self->blocked_open)) {
78655 if (self->close_delay)
78656 schedule_timeout_interruptible(self->close_delay);
78657 wake_up_interruptible(&self->open_wait);
78658 @@ -1017,7 +1017,7 @@ static void ircomm_tty_hangup(struct tty
78659 spin_lock_irqsave(&self->spinlock, flags);
78660 self->flags &= ~ASYNC_NORMAL_ACTIVE;
78661 self->tty = NULL;
78662 - self->open_count = 0;
78663 + local_set(&self->open_count, 0);
78664 spin_unlock_irqrestore(&self->spinlock, flags);
78665
78666 wake_up_interruptible(&self->open_wait);
78667 @@ -1369,7 +1369,7 @@ static void ircomm_tty_line_info(struct
78668 seq_putc(m, '\n');
78669
78670 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
78671 - seq_printf(m, "Open count: %d\n", self->open_count);
78672 + seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
78673 seq_printf(m, "Max data size: %d\n", self->max_data_size);
78674 seq_printf(m, "Max header size: %d\n", self->max_header_size);
78675
78676 diff -urNp linux-2.6.32.49/net/iucv/af_iucv.c linux-2.6.32.49/net/iucv/af_iucv.c
78677 --- linux-2.6.32.49/net/iucv/af_iucv.c 2011-11-08 19:02:43.000000000 -0500
78678 +++ linux-2.6.32.49/net/iucv/af_iucv.c 2011-11-15 19:59:43.000000000 -0500
78679 @@ -651,10 +651,10 @@ static int iucv_sock_autobind(struct soc
78680
78681 write_lock_bh(&iucv_sk_list.lock);
78682
78683 - sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
78684 + sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
78685 while (__iucv_get_sock_by_name(name)) {
78686 sprintf(name, "%08x",
78687 - atomic_inc_return(&iucv_sk_list.autobind_name));
78688 + atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
78689 }
78690
78691 write_unlock_bh(&iucv_sk_list.lock);
78692 diff -urNp linux-2.6.32.49/net/key/af_key.c linux-2.6.32.49/net/key/af_key.c
78693 --- linux-2.6.32.49/net/key/af_key.c 2011-11-08 19:02:43.000000000 -0500
78694 +++ linux-2.6.32.49/net/key/af_key.c 2011-11-15 19:59:43.000000000 -0500
78695 @@ -2489,6 +2489,8 @@ static int pfkey_migrate(struct sock *sk
78696 struct xfrm_migrate m[XFRM_MAX_DEPTH];
78697 struct xfrm_kmaddress k;
78698
78699 + pax_track_stack();
78700 +
78701 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
78702 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
78703 !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
78704 @@ -3660,7 +3662,11 @@ static int pfkey_seq_show(struct seq_fil
78705 seq_printf(f ,"sk RefCnt Rmem Wmem User Inode\n");
78706 else
78707 seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
78708 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78709 + NULL,
78710 +#else
78711 s,
78712 +#endif
78713 atomic_read(&s->sk_refcnt),
78714 sk_rmem_alloc_get(s),
78715 sk_wmem_alloc_get(s),
78716 diff -urNp linux-2.6.32.49/net/lapb/lapb_iface.c linux-2.6.32.49/net/lapb/lapb_iface.c
78717 --- linux-2.6.32.49/net/lapb/lapb_iface.c 2011-11-08 19:02:43.000000000 -0500
78718 +++ linux-2.6.32.49/net/lapb/lapb_iface.c 2011-11-15 19:59:43.000000000 -0500
78719 @@ -157,7 +157,7 @@ int lapb_register(struct net_device *dev
78720 goto out;
78721
78722 lapb->dev = dev;
78723 - lapb->callbacks = *callbacks;
78724 + lapb->callbacks = callbacks;
78725
78726 __lapb_insert_cb(lapb);
78727
78728 @@ -379,32 +379,32 @@ int lapb_data_received(struct net_device
78729
78730 void lapb_connect_confirmation(struct lapb_cb *lapb, int reason)
78731 {
78732 - if (lapb->callbacks.connect_confirmation)
78733 - lapb->callbacks.connect_confirmation(lapb->dev, reason);
78734 + if (lapb->callbacks->connect_confirmation)
78735 + lapb->callbacks->connect_confirmation(lapb->dev, reason);
78736 }
78737
78738 void lapb_connect_indication(struct lapb_cb *lapb, int reason)
78739 {
78740 - if (lapb->callbacks.connect_indication)
78741 - lapb->callbacks.connect_indication(lapb->dev, reason);
78742 + if (lapb->callbacks->connect_indication)
78743 + lapb->callbacks->connect_indication(lapb->dev, reason);
78744 }
78745
78746 void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason)
78747 {
78748 - if (lapb->callbacks.disconnect_confirmation)
78749 - lapb->callbacks.disconnect_confirmation(lapb->dev, reason);
78750 + if (lapb->callbacks->disconnect_confirmation)
78751 + lapb->callbacks->disconnect_confirmation(lapb->dev, reason);
78752 }
78753
78754 void lapb_disconnect_indication(struct lapb_cb *lapb, int reason)
78755 {
78756 - if (lapb->callbacks.disconnect_indication)
78757 - lapb->callbacks.disconnect_indication(lapb->dev, reason);
78758 + if (lapb->callbacks->disconnect_indication)
78759 + lapb->callbacks->disconnect_indication(lapb->dev, reason);
78760 }
78761
78762 int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
78763 {
78764 - if (lapb->callbacks.data_indication)
78765 - return lapb->callbacks.data_indication(lapb->dev, skb);
78766 + if (lapb->callbacks->data_indication)
78767 + return lapb->callbacks->data_indication(lapb->dev, skb);
78768
78769 kfree_skb(skb);
78770 return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
78771 @@ -414,8 +414,8 @@ int lapb_data_transmit(struct lapb_cb *l
78772 {
78773 int used = 0;
78774
78775 - if (lapb->callbacks.data_transmit) {
78776 - lapb->callbacks.data_transmit(lapb->dev, skb);
78777 + if (lapb->callbacks->data_transmit) {
78778 + lapb->callbacks->data_transmit(lapb->dev, skb);
78779 used = 1;
78780 }
78781
78782 diff -urNp linux-2.6.32.49/net/mac80211/cfg.c linux-2.6.32.49/net/mac80211/cfg.c
78783 --- linux-2.6.32.49/net/mac80211/cfg.c 2011-11-08 19:02:43.000000000 -0500
78784 +++ linux-2.6.32.49/net/mac80211/cfg.c 2011-11-15 19:59:43.000000000 -0500
78785 @@ -1369,7 +1369,7 @@ static int ieee80211_set_bitrate_mask(st
78786 return err;
78787 }
78788
78789 -struct cfg80211_ops mac80211_config_ops = {
78790 +const struct cfg80211_ops mac80211_config_ops = {
78791 .add_virtual_intf = ieee80211_add_iface,
78792 .del_virtual_intf = ieee80211_del_iface,
78793 .change_virtual_intf = ieee80211_change_iface,
78794 diff -urNp linux-2.6.32.49/net/mac80211/cfg.h linux-2.6.32.49/net/mac80211/cfg.h
78795 --- linux-2.6.32.49/net/mac80211/cfg.h 2011-11-08 19:02:43.000000000 -0500
78796 +++ linux-2.6.32.49/net/mac80211/cfg.h 2011-11-15 19:59:43.000000000 -0500
78797 @@ -4,6 +4,6 @@
78798 #ifndef __CFG_H
78799 #define __CFG_H
78800
78801 -extern struct cfg80211_ops mac80211_config_ops;
78802 +extern const struct cfg80211_ops mac80211_config_ops;
78803
78804 #endif /* __CFG_H */
78805 diff -urNp linux-2.6.32.49/net/mac80211/debugfs_key.c linux-2.6.32.49/net/mac80211/debugfs_key.c
78806 --- linux-2.6.32.49/net/mac80211/debugfs_key.c 2011-11-08 19:02:43.000000000 -0500
78807 +++ linux-2.6.32.49/net/mac80211/debugfs_key.c 2011-11-15 19:59:43.000000000 -0500
78808 @@ -211,9 +211,13 @@ static ssize_t key_key_read(struct file
78809 size_t count, loff_t *ppos)
78810 {
78811 struct ieee80211_key *key = file->private_data;
78812 - int i, res, bufsize = 2 * key->conf.keylen + 2;
78813 + int i, bufsize = 2 * key->conf.keylen + 2;
78814 char *buf = kmalloc(bufsize, GFP_KERNEL);
78815 char *p = buf;
78816 + ssize_t res;
78817 +
78818 + if (buf == NULL)
78819 + return -ENOMEM;
78820
78821 for (i = 0; i < key->conf.keylen; i++)
78822 p += scnprintf(p, bufsize + buf - p, "%02x", key->conf.key[i]);
78823 diff -urNp linux-2.6.32.49/net/mac80211/debugfs_sta.c linux-2.6.32.49/net/mac80211/debugfs_sta.c
78824 --- linux-2.6.32.49/net/mac80211/debugfs_sta.c 2011-11-08 19:02:43.000000000 -0500
78825 +++ linux-2.6.32.49/net/mac80211/debugfs_sta.c 2011-11-15 19:59:43.000000000 -0500
78826 @@ -124,6 +124,8 @@ static ssize_t sta_agg_status_read(struc
78827 int i;
78828 struct sta_info *sta = file->private_data;
78829
78830 + pax_track_stack();
78831 +
78832 spin_lock_bh(&sta->lock);
78833 p += scnprintf(p, sizeof(buf)+buf-p, "next dialog_token is %#02x\n",
78834 sta->ampdu_mlme.dialog_token_allocator + 1);
78835 diff -urNp linux-2.6.32.49/net/mac80211/ieee80211_i.h linux-2.6.32.49/net/mac80211/ieee80211_i.h
78836 --- linux-2.6.32.49/net/mac80211/ieee80211_i.h 2011-11-08 19:02:43.000000000 -0500
78837 +++ linux-2.6.32.49/net/mac80211/ieee80211_i.h 2011-11-15 19:59:43.000000000 -0500
78838 @@ -25,6 +25,7 @@
78839 #include <linux/etherdevice.h>
78840 #include <net/cfg80211.h>
78841 #include <net/mac80211.h>
78842 +#include <asm/local.h>
78843 #include "key.h"
78844 #include "sta_info.h"
78845
78846 @@ -635,7 +636,7 @@ struct ieee80211_local {
78847 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
78848 spinlock_t queue_stop_reason_lock;
78849
78850 - int open_count;
78851 + local_t open_count;
78852 int monitors, cooked_mntrs;
78853 /* number of interfaces with corresponding FIF_ flags */
78854 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
78855 diff -urNp linux-2.6.32.49/net/mac80211/iface.c linux-2.6.32.49/net/mac80211/iface.c
78856 --- linux-2.6.32.49/net/mac80211/iface.c 2011-11-08 19:02:43.000000000 -0500
78857 +++ linux-2.6.32.49/net/mac80211/iface.c 2011-11-15 19:59:43.000000000 -0500
78858 @@ -166,7 +166,7 @@ static int ieee80211_open(struct net_dev
78859 break;
78860 }
78861
78862 - if (local->open_count == 0) {
78863 + if (local_read(&local->open_count) == 0) {
78864 res = drv_start(local);
78865 if (res)
78866 goto err_del_bss;
78867 @@ -196,7 +196,7 @@ static int ieee80211_open(struct net_dev
78868 * Validate the MAC address for this device.
78869 */
78870 if (!is_valid_ether_addr(dev->dev_addr)) {
78871 - if (!local->open_count)
78872 + if (!local_read(&local->open_count))
78873 drv_stop(local);
78874 return -EADDRNOTAVAIL;
78875 }
78876 @@ -292,7 +292,7 @@ static int ieee80211_open(struct net_dev
78877
78878 hw_reconf_flags |= __ieee80211_recalc_idle(local);
78879
78880 - local->open_count++;
78881 + local_inc(&local->open_count);
78882 if (hw_reconf_flags) {
78883 ieee80211_hw_config(local, hw_reconf_flags);
78884 /*
78885 @@ -320,7 +320,7 @@ static int ieee80211_open(struct net_dev
78886 err_del_interface:
78887 drv_remove_interface(local, &conf);
78888 err_stop:
78889 - if (!local->open_count)
78890 + if (!local_read(&local->open_count))
78891 drv_stop(local);
78892 err_del_bss:
78893 sdata->bss = NULL;
78894 @@ -420,7 +420,7 @@ static int ieee80211_stop(struct net_dev
78895 WARN_ON(!list_empty(&sdata->u.ap.vlans));
78896 }
78897
78898 - local->open_count--;
78899 + local_dec(&local->open_count);
78900
78901 switch (sdata->vif.type) {
78902 case NL80211_IFTYPE_AP_VLAN:
78903 @@ -526,7 +526,7 @@ static int ieee80211_stop(struct net_dev
78904
78905 ieee80211_recalc_ps(local, -1);
78906
78907 - if (local->open_count == 0) {
78908 + if (local_read(&local->open_count) == 0) {
78909 ieee80211_clear_tx_pending(local);
78910 ieee80211_stop_device(local);
78911
78912 diff -urNp linux-2.6.32.49/net/mac80211/main.c linux-2.6.32.49/net/mac80211/main.c
78913 --- linux-2.6.32.49/net/mac80211/main.c 2011-11-08 19:02:43.000000000 -0500
78914 +++ linux-2.6.32.49/net/mac80211/main.c 2011-11-15 19:59:43.000000000 -0500
78915 @@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211
78916 local->hw.conf.power_level = power;
78917 }
78918
78919 - if (changed && local->open_count) {
78920 + if (changed && local_read(&local->open_count)) {
78921 ret = drv_config(local, changed);
78922 /*
78923 * Goal:
78924 diff -urNp linux-2.6.32.49/net/mac80211/mlme.c linux-2.6.32.49/net/mac80211/mlme.c
78925 --- linux-2.6.32.49/net/mac80211/mlme.c 2011-11-08 19:02:43.000000000 -0500
78926 +++ linux-2.6.32.49/net/mac80211/mlme.c 2011-11-15 19:59:43.000000000 -0500
78927 @@ -1438,6 +1438,8 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee
78928 bool have_higher_than_11mbit = false, newsta = false;
78929 u16 ap_ht_cap_flags;
78930
78931 + pax_track_stack();
78932 +
78933 /*
78934 * AssocResp and ReassocResp have identical structure, so process both
78935 * of them in this function.
78936 diff -urNp linux-2.6.32.49/net/mac80211/pm.c linux-2.6.32.49/net/mac80211/pm.c
78937 --- linux-2.6.32.49/net/mac80211/pm.c 2011-11-08 19:02:43.000000000 -0500
78938 +++ linux-2.6.32.49/net/mac80211/pm.c 2011-11-15 19:59:43.000000000 -0500
78939 @@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211
78940 }
78941
78942 /* stop hardware - this must stop RX */
78943 - if (local->open_count)
78944 + if (local_read(&local->open_count))
78945 ieee80211_stop_device(local);
78946
78947 local->suspended = true;
78948 diff -urNp linux-2.6.32.49/net/mac80211/rate.c linux-2.6.32.49/net/mac80211/rate.c
78949 --- linux-2.6.32.49/net/mac80211/rate.c 2011-11-08 19:02:43.000000000 -0500
78950 +++ linux-2.6.32.49/net/mac80211/rate.c 2011-11-15 19:59:43.000000000 -0500
78951 @@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct
78952 struct rate_control_ref *ref, *old;
78953
78954 ASSERT_RTNL();
78955 - if (local->open_count)
78956 + if (local_read(&local->open_count))
78957 return -EBUSY;
78958
78959 ref = rate_control_alloc(name, local);
78960 diff -urNp linux-2.6.32.49/net/mac80211/tx.c linux-2.6.32.49/net/mac80211/tx.c
78961 --- linux-2.6.32.49/net/mac80211/tx.c 2011-11-08 19:02:43.000000000 -0500
78962 +++ linux-2.6.32.49/net/mac80211/tx.c 2011-11-15 19:59:43.000000000 -0500
78963 @@ -173,7 +173,7 @@ static __le16 ieee80211_duration(struct
78964 return cpu_to_le16(dur);
78965 }
78966
78967 -static int inline is_ieee80211_device(struct ieee80211_local *local,
78968 +static inline int is_ieee80211_device(struct ieee80211_local *local,
78969 struct net_device *dev)
78970 {
78971 return local == wdev_priv(dev->ieee80211_ptr);
78972 diff -urNp linux-2.6.32.49/net/mac80211/util.c linux-2.6.32.49/net/mac80211/util.c
78973 --- linux-2.6.32.49/net/mac80211/util.c 2011-11-08 19:02:43.000000000 -0500
78974 +++ linux-2.6.32.49/net/mac80211/util.c 2011-11-15 19:59:43.000000000 -0500
78975 @@ -1042,7 +1042,7 @@ int ieee80211_reconfig(struct ieee80211_
78976 local->resuming = true;
78977
78978 /* restart hardware */
78979 - if (local->open_count) {
78980 + if (local_read(&local->open_count)) {
78981 /*
78982 * Upon resume hardware can sometimes be goofy due to
78983 * various platform / driver / bus issues, so restarting
78984 diff -urNp linux-2.6.32.49/net/netfilter/ipvs/ip_vs_app.c linux-2.6.32.49/net/netfilter/ipvs/ip_vs_app.c
78985 --- linux-2.6.32.49/net/netfilter/ipvs/ip_vs_app.c 2011-11-08 19:02:43.000000000 -0500
78986 +++ linux-2.6.32.49/net/netfilter/ipvs/ip_vs_app.c 2011-11-15 19:59:43.000000000 -0500
78987 @@ -564,7 +564,7 @@ static const struct file_operations ip_v
78988 .open = ip_vs_app_open,
78989 .read = seq_read,
78990 .llseek = seq_lseek,
78991 - .release = seq_release,
78992 + .release = seq_release_net,
78993 };
78994 #endif
78995
78996 diff -urNp linux-2.6.32.49/net/netfilter/ipvs/ip_vs_conn.c linux-2.6.32.49/net/netfilter/ipvs/ip_vs_conn.c
78997 --- linux-2.6.32.49/net/netfilter/ipvs/ip_vs_conn.c 2011-11-08 19:02:43.000000000 -0500
78998 +++ linux-2.6.32.49/net/netfilter/ipvs/ip_vs_conn.c 2011-11-15 19:59:43.000000000 -0500
78999 @@ -453,10 +453,10 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
79000 /* if the connection is not template and is created
79001 * by sync, preserve the activity flag.
79002 */
79003 - cp->flags |= atomic_read(&dest->conn_flags) &
79004 + cp->flags |= atomic_read_unchecked(&dest->conn_flags) &
79005 (~IP_VS_CONN_F_INACTIVE);
79006 else
79007 - cp->flags |= atomic_read(&dest->conn_flags);
79008 + cp->flags |= atomic_read_unchecked(&dest->conn_flags);
79009 cp->dest = dest;
79010
79011 IP_VS_DBG_BUF(7, "Bind-dest %s c:%s:%d v:%s:%d "
79012 @@ -723,7 +723,7 @@ ip_vs_conn_new(int af, int proto, const
79013 atomic_set(&cp->refcnt, 1);
79014
79015 atomic_set(&cp->n_control, 0);
79016 - atomic_set(&cp->in_pkts, 0);
79017 + atomic_set_unchecked(&cp->in_pkts, 0);
79018
79019 atomic_inc(&ip_vs_conn_count);
79020 if (flags & IP_VS_CONN_F_NO_CPORT)
79021 @@ -871,7 +871,7 @@ static const struct file_operations ip_v
79022 .open = ip_vs_conn_open,
79023 .read = seq_read,
79024 .llseek = seq_lseek,
79025 - .release = seq_release,
79026 + .release = seq_release_net,
79027 };
79028
79029 static const char *ip_vs_origin_name(unsigned flags)
79030 @@ -934,7 +934,7 @@ static const struct file_operations ip_v
79031 .open = ip_vs_conn_sync_open,
79032 .read = seq_read,
79033 .llseek = seq_lseek,
79034 - .release = seq_release,
79035 + .release = seq_release_net,
79036 };
79037
79038 #endif
79039 @@ -961,7 +961,7 @@ static inline int todrop_entry(struct ip
79040
79041 /* Don't drop the entry if its number of incoming packets is not
79042 located in [0, 8] */
79043 - i = atomic_read(&cp->in_pkts);
79044 + i = atomic_read_unchecked(&cp->in_pkts);
79045 if (i > 8 || i < 0) return 0;
79046
79047 if (!todrop_rate[i]) return 0;
79048 diff -urNp linux-2.6.32.49/net/netfilter/ipvs/ip_vs_core.c linux-2.6.32.49/net/netfilter/ipvs/ip_vs_core.c
79049 --- linux-2.6.32.49/net/netfilter/ipvs/ip_vs_core.c 2011-11-08 19:02:43.000000000 -0500
79050 +++ linux-2.6.32.49/net/netfilter/ipvs/ip_vs_core.c 2011-11-15 19:59:43.000000000 -0500
79051 @@ -485,7 +485,7 @@ int ip_vs_leave(struct ip_vs_service *sv
79052 ret = cp->packet_xmit(skb, cp, pp);
79053 /* do not touch skb anymore */
79054
79055 - atomic_inc(&cp->in_pkts);
79056 + atomic_inc_unchecked(&cp->in_pkts);
79057 ip_vs_conn_put(cp);
79058 return ret;
79059 }
79060 @@ -1357,7 +1357,7 @@ ip_vs_in(unsigned int hooknum, struct sk
79061 * Sync connection if it is about to close to
79062 * encorage the standby servers to update the connections timeout
79063 */
79064 - pkts = atomic_add_return(1, &cp->in_pkts);
79065 + pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
79066 if (af == AF_INET &&
79067 (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
79068 (((cp->protocol != IPPROTO_TCP ||
79069 diff -urNp linux-2.6.32.49/net/netfilter/ipvs/ip_vs_ctl.c linux-2.6.32.49/net/netfilter/ipvs/ip_vs_ctl.c
79070 --- linux-2.6.32.49/net/netfilter/ipvs/ip_vs_ctl.c 2011-11-08 19:02:43.000000000 -0500
79071 +++ linux-2.6.32.49/net/netfilter/ipvs/ip_vs_ctl.c 2011-11-15 19:59:43.000000000 -0500
79072 @@ -792,7 +792,7 @@ __ip_vs_update_dest(struct ip_vs_service
79073 ip_vs_rs_hash(dest);
79074 write_unlock_bh(&__ip_vs_rs_lock);
79075 }
79076 - atomic_set(&dest->conn_flags, conn_flags);
79077 + atomic_set_unchecked(&dest->conn_flags, conn_flags);
79078
79079 /* bind the service */
79080 if (!dest->svc) {
79081 @@ -1888,7 +1888,7 @@ static int ip_vs_info_seq_show(struct se
79082 " %-7s %-6d %-10d %-10d\n",
79083 &dest->addr.in6,
79084 ntohs(dest->port),
79085 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
79086 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
79087 atomic_read(&dest->weight),
79088 atomic_read(&dest->activeconns),
79089 atomic_read(&dest->inactconns));
79090 @@ -1899,7 +1899,7 @@ static int ip_vs_info_seq_show(struct se
79091 "%-7s %-6d %-10d %-10d\n",
79092 ntohl(dest->addr.ip),
79093 ntohs(dest->port),
79094 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
79095 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
79096 atomic_read(&dest->weight),
79097 atomic_read(&dest->activeconns),
79098 atomic_read(&dest->inactconns));
79099 @@ -1927,7 +1927,7 @@ static const struct file_operations ip_v
79100 .open = ip_vs_info_open,
79101 .read = seq_read,
79102 .llseek = seq_lseek,
79103 - .release = seq_release_private,
79104 + .release = seq_release_net,
79105 };
79106
79107 #endif
79108 @@ -1976,7 +1976,7 @@ static const struct file_operations ip_v
79109 .open = ip_vs_stats_seq_open,
79110 .read = seq_read,
79111 .llseek = seq_lseek,
79112 - .release = single_release,
79113 + .release = single_release_net,
79114 };
79115
79116 #endif
79117 @@ -2292,7 +2292,7 @@ __ip_vs_get_dest_entries(const struct ip
79118
79119 entry.addr = dest->addr.ip;
79120 entry.port = dest->port;
79121 - entry.conn_flags = atomic_read(&dest->conn_flags);
79122 + entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
79123 entry.weight = atomic_read(&dest->weight);
79124 entry.u_threshold = dest->u_threshold;
79125 entry.l_threshold = dest->l_threshold;
79126 @@ -2353,6 +2353,8 @@ do_ip_vs_get_ctl(struct sock *sk, int cm
79127 unsigned char arg[128];
79128 int ret = 0;
79129
79130 + pax_track_stack();
79131 +
79132 if (!capable(CAP_NET_ADMIN))
79133 return -EPERM;
79134
79135 @@ -2802,7 +2804,7 @@ static int ip_vs_genl_fill_dest(struct s
79136 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
79137
79138 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
79139 - atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
79140 + atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
79141 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
79142 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
79143 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
79144 diff -urNp linux-2.6.32.49/net/netfilter/ipvs/ip_vs_sync.c linux-2.6.32.49/net/netfilter/ipvs/ip_vs_sync.c
79145 --- linux-2.6.32.49/net/netfilter/ipvs/ip_vs_sync.c 2011-11-08 19:02:43.000000000 -0500
79146 +++ linux-2.6.32.49/net/netfilter/ipvs/ip_vs_sync.c 2011-11-15 19:59:43.000000000 -0500
79147 @@ -438,7 +438,7 @@ static void ip_vs_process_message(const
79148
79149 if (opt)
79150 memcpy(&cp->in_seq, opt, sizeof(*opt));
79151 - atomic_set(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
79152 + atomic_set_unchecked(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
79153 cp->state = state;
79154 cp->old_state = cp->state;
79155 /*
79156 diff -urNp linux-2.6.32.49/net/netfilter/ipvs/ip_vs_xmit.c linux-2.6.32.49/net/netfilter/ipvs/ip_vs_xmit.c
79157 --- linux-2.6.32.49/net/netfilter/ipvs/ip_vs_xmit.c 2011-11-08 19:02:43.000000000 -0500
79158 +++ linux-2.6.32.49/net/netfilter/ipvs/ip_vs_xmit.c 2011-11-15 19:59:43.000000000 -0500
79159 @@ -875,7 +875,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, str
79160 else
79161 rc = NF_ACCEPT;
79162 /* do not touch skb anymore */
79163 - atomic_inc(&cp->in_pkts);
79164 + atomic_inc_unchecked(&cp->in_pkts);
79165 goto out;
79166 }
79167
79168 @@ -949,7 +949,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb,
79169 else
79170 rc = NF_ACCEPT;
79171 /* do not touch skb anymore */
79172 - atomic_inc(&cp->in_pkts);
79173 + atomic_inc_unchecked(&cp->in_pkts);
79174 goto out;
79175 }
79176
79177 diff -urNp linux-2.6.32.49/net/netfilter/Kconfig linux-2.6.32.49/net/netfilter/Kconfig
79178 --- linux-2.6.32.49/net/netfilter/Kconfig 2011-11-08 19:02:43.000000000 -0500
79179 +++ linux-2.6.32.49/net/netfilter/Kconfig 2011-11-15 19:59:43.000000000 -0500
79180 @@ -635,6 +635,16 @@ config NETFILTER_XT_MATCH_ESP
79181
79182 To compile it as a module, choose M here. If unsure, say N.
79183
79184 +config NETFILTER_XT_MATCH_GRADM
79185 + tristate '"gradm" match support'
79186 + depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
79187 + depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
79188 + ---help---
79189 + The gradm match allows to match on grsecurity RBAC being enabled.
79190 + It is useful when iptables rules are applied early on bootup to
79191 + prevent connections to the machine (except from a trusted host)
79192 + while the RBAC system is disabled.
79193 +
79194 config NETFILTER_XT_MATCH_HASHLIMIT
79195 tristate '"hashlimit" match support'
79196 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
79197 diff -urNp linux-2.6.32.49/net/netfilter/Makefile linux-2.6.32.49/net/netfilter/Makefile
79198 --- linux-2.6.32.49/net/netfilter/Makefile 2011-11-08 19:02:43.000000000 -0500
79199 +++ linux-2.6.32.49/net/netfilter/Makefile 2011-11-15 19:59:43.000000000 -0500
79200 @@ -68,6 +68,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_CONNTRAC
79201 obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
79202 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
79203 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
79204 +obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
79205 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
79206 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
79207 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
79208 diff -urNp linux-2.6.32.49/net/netfilter/nf_conntrack_netlink.c linux-2.6.32.49/net/netfilter/nf_conntrack_netlink.c
79209 --- linux-2.6.32.49/net/netfilter/nf_conntrack_netlink.c 2011-11-08 19:02:43.000000000 -0500
79210 +++ linux-2.6.32.49/net/netfilter/nf_conntrack_netlink.c 2011-11-15 19:59:43.000000000 -0500
79211 @@ -706,7 +706,7 @@ ctnetlink_parse_tuple_proto(struct nlatt
79212 static int
79213 ctnetlink_parse_tuple(const struct nlattr * const cda[],
79214 struct nf_conntrack_tuple *tuple,
79215 - enum ctattr_tuple type, u_int8_t l3num)
79216 + enum ctattr_type type, u_int8_t l3num)
79217 {
79218 struct nlattr *tb[CTA_TUPLE_MAX+1];
79219 int err;
79220 diff -urNp linux-2.6.32.49/net/netfilter/nfnetlink_log.c linux-2.6.32.49/net/netfilter/nfnetlink_log.c
79221 --- linux-2.6.32.49/net/netfilter/nfnetlink_log.c 2011-11-08 19:02:43.000000000 -0500
79222 +++ linux-2.6.32.49/net/netfilter/nfnetlink_log.c 2011-11-15 19:59:43.000000000 -0500
79223 @@ -68,7 +68,7 @@ struct nfulnl_instance {
79224 };
79225
79226 static DEFINE_RWLOCK(instances_lock);
79227 -static atomic_t global_seq;
79228 +static atomic_unchecked_t global_seq;
79229
79230 #define INSTANCE_BUCKETS 16
79231 static struct hlist_head instance_table[INSTANCE_BUCKETS];
79232 @@ -493,7 +493,7 @@ __build_packet_message(struct nfulnl_ins
79233 /* global sequence number */
79234 if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
79235 NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
79236 - htonl(atomic_inc_return(&global_seq)));
79237 + htonl(atomic_inc_return_unchecked(&global_seq)));
79238
79239 if (data_len) {
79240 struct nlattr *nla;
79241 diff -urNp linux-2.6.32.49/net/netfilter/xt_gradm.c linux-2.6.32.49/net/netfilter/xt_gradm.c
79242 --- linux-2.6.32.49/net/netfilter/xt_gradm.c 1969-12-31 19:00:00.000000000 -0500
79243 +++ linux-2.6.32.49/net/netfilter/xt_gradm.c 2011-11-15 19:59:43.000000000 -0500
79244 @@ -0,0 +1,51 @@
79245 +/*
79246 + * gradm match for netfilter
79247 + * Copyright © Zbigniew Krzystolik, 2010
79248 + *
79249 + * This program is free software; you can redistribute it and/or modify
79250 + * it under the terms of the GNU General Public License; either version
79251 + * 2 or 3 as published by the Free Software Foundation.
79252 + */
79253 +#include <linux/module.h>
79254 +#include <linux/moduleparam.h>
79255 +#include <linux/skbuff.h>
79256 +#include <linux/netfilter/x_tables.h>
79257 +#include <linux/grsecurity.h>
79258 +#include <linux/netfilter/xt_gradm.h>
79259 +
79260 +static bool
79261 +gradm_mt(const struct sk_buff *skb, const struct xt_match_param *par)
79262 +{
79263 + const struct xt_gradm_mtinfo *info = par->matchinfo;
79264 + bool retval = false;
79265 + if (gr_acl_is_enabled())
79266 + retval = true;
79267 + return retval ^ info->invflags;
79268 +}
79269 +
79270 +static struct xt_match gradm_mt_reg __read_mostly = {
79271 + .name = "gradm",
79272 + .revision = 0,
79273 + .family = NFPROTO_UNSPEC,
79274 + .match = gradm_mt,
79275 + .matchsize = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
79276 + .me = THIS_MODULE,
79277 +};
79278 +
79279 +static int __init gradm_mt_init(void)
79280 +{
79281 + return xt_register_match(&gradm_mt_reg);
79282 +}
79283 +
79284 +static void __exit gradm_mt_exit(void)
79285 +{
79286 + xt_unregister_match(&gradm_mt_reg);
79287 +}
79288 +
79289 +module_init(gradm_mt_init);
79290 +module_exit(gradm_mt_exit);
79291 +MODULE_AUTHOR("Zbigniew Krzystolik <zbyniu@destrukcja.pl>");
79292 +MODULE_DESCRIPTION("Xtables: Grsecurity RBAC match");
79293 +MODULE_LICENSE("GPL");
79294 +MODULE_ALIAS("ipt_gradm");
79295 +MODULE_ALIAS("ip6t_gradm");
79296 diff -urNp linux-2.6.32.49/net/netlink/af_netlink.c linux-2.6.32.49/net/netlink/af_netlink.c
79297 --- linux-2.6.32.49/net/netlink/af_netlink.c 2011-11-08 19:02:43.000000000 -0500
79298 +++ linux-2.6.32.49/net/netlink/af_netlink.c 2011-11-15 19:59:43.000000000 -0500
79299 @@ -733,7 +733,7 @@ static void netlink_overrun(struct sock
79300 sk->sk_error_report(sk);
79301 }
79302 }
79303 - atomic_inc(&sk->sk_drops);
79304 + atomic_inc_unchecked(&sk->sk_drops);
79305 }
79306
79307 static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
79308 @@ -1964,15 +1964,23 @@ static int netlink_seq_show(struct seq_f
79309 struct netlink_sock *nlk = nlk_sk(s);
79310
79311 seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d\n",
79312 +#ifdef CONFIG_GRKERNSEC_HIDESYM
79313 + NULL,
79314 +#else
79315 s,
79316 +#endif
79317 s->sk_protocol,
79318 nlk->pid,
79319 nlk->groups ? (u32)nlk->groups[0] : 0,
79320 sk_rmem_alloc_get(s),
79321 sk_wmem_alloc_get(s),
79322 +#ifdef CONFIG_GRKERNSEC_HIDESYM
79323 + NULL,
79324 +#else
79325 nlk->cb,
79326 +#endif
79327 atomic_read(&s->sk_refcnt),
79328 - atomic_read(&s->sk_drops)
79329 + atomic_read_unchecked(&s->sk_drops)
79330 );
79331
79332 }
79333 diff -urNp linux-2.6.32.49/net/netrom/af_netrom.c linux-2.6.32.49/net/netrom/af_netrom.c
79334 --- linux-2.6.32.49/net/netrom/af_netrom.c 2011-11-08 19:02:43.000000000 -0500
79335 +++ linux-2.6.32.49/net/netrom/af_netrom.c 2011-11-15 19:59:43.000000000 -0500
79336 @@ -838,6 +838,7 @@ static int nr_getname(struct socket *soc
79337 struct sock *sk = sock->sk;
79338 struct nr_sock *nr = nr_sk(sk);
79339
79340 + memset(sax, 0, sizeof(*sax));
79341 lock_sock(sk);
79342 if (peer != 0) {
79343 if (sk->sk_state != TCP_ESTABLISHED) {
79344 @@ -852,7 +853,6 @@ static int nr_getname(struct socket *soc
79345 *uaddr_len = sizeof(struct full_sockaddr_ax25);
79346 } else {
79347 sax->fsa_ax25.sax25_family = AF_NETROM;
79348 - sax->fsa_ax25.sax25_ndigis = 0;
79349 sax->fsa_ax25.sax25_call = nr->source_addr;
79350 *uaddr_len = sizeof(struct sockaddr_ax25);
79351 }
79352 diff -urNp linux-2.6.32.49/net/packet/af_packet.c linux-2.6.32.49/net/packet/af_packet.c
79353 --- linux-2.6.32.49/net/packet/af_packet.c 2011-11-08 19:02:43.000000000 -0500
79354 +++ linux-2.6.32.49/net/packet/af_packet.c 2011-11-15 19:59:43.000000000 -0500
79355 @@ -2429,7 +2429,11 @@ static int packet_seq_show(struct seq_fi
79356
79357 seq_printf(seq,
79358 "%p %-6d %-4d %04x %-5d %1d %-6u %-6u %-6lu\n",
79359 +#ifdef CONFIG_GRKERNSEC_HIDESYM
79360 + NULL,
79361 +#else
79362 s,
79363 +#endif
79364 atomic_read(&s->sk_refcnt),
79365 s->sk_type,
79366 ntohs(po->num),
79367 diff -urNp linux-2.6.32.49/net/phonet/af_phonet.c linux-2.6.32.49/net/phonet/af_phonet.c
79368 --- linux-2.6.32.49/net/phonet/af_phonet.c 2011-11-08 19:02:43.000000000 -0500
79369 +++ linux-2.6.32.49/net/phonet/af_phonet.c 2011-11-15 19:59:43.000000000 -0500
79370 @@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_pr
79371 {
79372 struct phonet_protocol *pp;
79373
79374 - if (protocol >= PHONET_NPROTO)
79375 + if (protocol < 0 || protocol >= PHONET_NPROTO)
79376 return NULL;
79377
79378 spin_lock(&proto_tab_lock);
79379 @@ -402,7 +402,7 @@ int __init_or_module phonet_proto_regist
79380 {
79381 int err = 0;
79382
79383 - if (protocol >= PHONET_NPROTO)
79384 + if (protocol < 0 || protocol >= PHONET_NPROTO)
79385 return -EINVAL;
79386
79387 err = proto_register(pp->prot, 1);
79388 diff -urNp linux-2.6.32.49/net/phonet/datagram.c linux-2.6.32.49/net/phonet/datagram.c
79389 --- linux-2.6.32.49/net/phonet/datagram.c 2011-11-08 19:02:43.000000000 -0500
79390 +++ linux-2.6.32.49/net/phonet/datagram.c 2011-11-15 19:59:43.000000000 -0500
79391 @@ -162,7 +162,7 @@ static int pn_backlog_rcv(struct sock *s
79392 if (err < 0) {
79393 kfree_skb(skb);
79394 if (err == -ENOMEM)
79395 - atomic_inc(&sk->sk_drops);
79396 + atomic_inc_unchecked(&sk->sk_drops);
79397 }
79398 return err ? NET_RX_DROP : NET_RX_SUCCESS;
79399 }
79400 diff -urNp linux-2.6.32.49/net/phonet/pep.c linux-2.6.32.49/net/phonet/pep.c
79401 --- linux-2.6.32.49/net/phonet/pep.c 2011-11-08 19:02:43.000000000 -0500
79402 +++ linux-2.6.32.49/net/phonet/pep.c 2011-11-15 19:59:43.000000000 -0500
79403 @@ -348,7 +348,7 @@ static int pipe_do_rcv(struct sock *sk,
79404
79405 case PNS_PEP_CTRL_REQ:
79406 if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
79407 - atomic_inc(&sk->sk_drops);
79408 + atomic_inc_unchecked(&sk->sk_drops);
79409 break;
79410 }
79411 __skb_pull(skb, 4);
79412 @@ -362,12 +362,12 @@ static int pipe_do_rcv(struct sock *sk,
79413 if (!err)
79414 return 0;
79415 if (err == -ENOMEM)
79416 - atomic_inc(&sk->sk_drops);
79417 + atomic_inc_unchecked(&sk->sk_drops);
79418 break;
79419 }
79420
79421 if (pn->rx_credits == 0) {
79422 - atomic_inc(&sk->sk_drops);
79423 + atomic_inc_unchecked(&sk->sk_drops);
79424 err = -ENOBUFS;
79425 break;
79426 }
79427 diff -urNp linux-2.6.32.49/net/phonet/socket.c linux-2.6.32.49/net/phonet/socket.c
79428 --- linux-2.6.32.49/net/phonet/socket.c 2011-11-08 19:02:43.000000000 -0500
79429 +++ linux-2.6.32.49/net/phonet/socket.c 2011-11-15 19:59:43.000000000 -0500
79430 @@ -482,8 +482,13 @@ static int pn_sock_seq_show(struct seq_f
79431 sk->sk_state,
79432 sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
79433 sock_i_uid(sk), sock_i_ino(sk),
79434 - atomic_read(&sk->sk_refcnt), sk,
79435 - atomic_read(&sk->sk_drops), &len);
79436 + atomic_read(&sk->sk_refcnt),
79437 +#ifdef CONFIG_GRKERNSEC_HIDESYM
79438 + NULL,
79439 +#else
79440 + sk,
79441 +#endif
79442 + atomic_read_unchecked(&sk->sk_drops), &len);
79443 }
79444 seq_printf(seq, "%*s\n", 127 - len, "");
79445 return 0;
79446 diff -urNp linux-2.6.32.49/net/rds/cong.c linux-2.6.32.49/net/rds/cong.c
79447 --- linux-2.6.32.49/net/rds/cong.c 2011-11-08 19:02:43.000000000 -0500
79448 +++ linux-2.6.32.49/net/rds/cong.c 2011-11-15 19:59:43.000000000 -0500
79449 @@ -77,7 +77,7 @@
79450 * finds that the saved generation number is smaller than the global generation
79451 * number, it wakes up the process.
79452 */
79453 -static atomic_t rds_cong_generation = ATOMIC_INIT(0);
79454 +static atomic_unchecked_t rds_cong_generation = ATOMIC_INIT(0);
79455
79456 /*
79457 * Congestion monitoring
79458 @@ -232,7 +232,7 @@ void rds_cong_map_updated(struct rds_con
79459 rdsdebug("waking map %p for %pI4\n",
79460 map, &map->m_addr);
79461 rds_stats_inc(s_cong_update_received);
79462 - atomic_inc(&rds_cong_generation);
79463 + atomic_inc_unchecked(&rds_cong_generation);
79464 if (waitqueue_active(&map->m_waitq))
79465 wake_up(&map->m_waitq);
79466 if (waitqueue_active(&rds_poll_waitq))
79467 @@ -258,7 +258,7 @@ EXPORT_SYMBOL_GPL(rds_cong_map_updated);
79468
79469 int rds_cong_updated_since(unsigned long *recent)
79470 {
79471 - unsigned long gen = atomic_read(&rds_cong_generation);
79472 + unsigned long gen = atomic_read_unchecked(&rds_cong_generation);
79473
79474 if (likely(*recent == gen))
79475 return 0;
79476 diff -urNp linux-2.6.32.49/net/rds/iw_rdma.c linux-2.6.32.49/net/rds/iw_rdma.c
79477 --- linux-2.6.32.49/net/rds/iw_rdma.c 2011-11-08 19:02:43.000000000 -0500
79478 +++ linux-2.6.32.49/net/rds/iw_rdma.c 2011-11-15 19:59:43.000000000 -0500
79479 @@ -181,6 +181,8 @@ int rds_iw_update_cm_id(struct rds_iw_de
79480 struct rdma_cm_id *pcm_id;
79481 int rc;
79482
79483 + pax_track_stack();
79484 +
79485 src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
79486 dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
79487
79488 diff -urNp linux-2.6.32.49/net/rds/Kconfig linux-2.6.32.49/net/rds/Kconfig
79489 --- linux-2.6.32.49/net/rds/Kconfig 2011-11-08 19:02:43.000000000 -0500
79490 +++ linux-2.6.32.49/net/rds/Kconfig 2011-11-15 19:59:43.000000000 -0500
79491 @@ -1,7 +1,7 @@
79492
79493 config RDS
79494 tristate "The RDS Protocol (EXPERIMENTAL)"
79495 - depends on INET && EXPERIMENTAL
79496 + depends on INET && EXPERIMENTAL && BROKEN
79497 ---help---
79498 The RDS (Reliable Datagram Sockets) protocol provides reliable,
79499 sequenced delivery of datagrams over Infiniband, iWARP,
79500 diff -urNp linux-2.6.32.49/net/rds/tcp.c linux-2.6.32.49/net/rds/tcp.c
79501 --- linux-2.6.32.49/net/rds/tcp.c 2011-11-08 19:02:43.000000000 -0500
79502 +++ linux-2.6.32.49/net/rds/tcp.c 2011-11-15 19:59:43.000000000 -0500
79503 @@ -57,7 +57,7 @@ void rds_tcp_nonagle(struct socket *sock
79504 int val = 1;
79505
79506 set_fs(KERNEL_DS);
79507 - sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __user *)&val,
79508 + sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __force_user *)&val,
79509 sizeof(val));
79510 set_fs(oldfs);
79511 }
79512 diff -urNp linux-2.6.32.49/net/rds/tcp_send.c linux-2.6.32.49/net/rds/tcp_send.c
79513 --- linux-2.6.32.49/net/rds/tcp_send.c 2011-11-08 19:02:43.000000000 -0500
79514 +++ linux-2.6.32.49/net/rds/tcp_send.c 2011-11-15 19:59:43.000000000 -0500
79515 @@ -43,7 +43,7 @@ static void rds_tcp_cork(struct socket *
79516
79517 oldfs = get_fs();
79518 set_fs(KERNEL_DS);
79519 - sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __user *)&val,
79520 + sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __force_user *)&val,
79521 sizeof(val));
79522 set_fs(oldfs);
79523 }
79524 diff -urNp linux-2.6.32.49/net/rxrpc/af_rxrpc.c linux-2.6.32.49/net/rxrpc/af_rxrpc.c
79525 --- linux-2.6.32.49/net/rxrpc/af_rxrpc.c 2011-11-08 19:02:43.000000000 -0500
79526 +++ linux-2.6.32.49/net/rxrpc/af_rxrpc.c 2011-11-15 19:59:43.000000000 -0500
79527 @@ -38,7 +38,7 @@ static const struct proto_ops rxrpc_rpc_
79528 __be32 rxrpc_epoch;
79529
79530 /* current debugging ID */
79531 -atomic_t rxrpc_debug_id;
79532 +atomic_unchecked_t rxrpc_debug_id;
79533
79534 /* count of skbs currently in use */
79535 atomic_t rxrpc_n_skbs;
79536 diff -urNp linux-2.6.32.49/net/rxrpc/ar-ack.c linux-2.6.32.49/net/rxrpc/ar-ack.c
79537 --- linux-2.6.32.49/net/rxrpc/ar-ack.c 2011-11-08 19:02:43.000000000 -0500
79538 +++ linux-2.6.32.49/net/rxrpc/ar-ack.c 2011-11-15 19:59:43.000000000 -0500
79539 @@ -174,7 +174,7 @@ static void rxrpc_resend(struct rxrpc_ca
79540
79541 _enter("{%d,%d,%d,%d},",
79542 call->acks_hard, call->acks_unacked,
79543 - atomic_read(&call->sequence),
79544 + atomic_read_unchecked(&call->sequence),
79545 CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
79546
79547 stop = 0;
79548 @@ -198,7 +198,7 @@ static void rxrpc_resend(struct rxrpc_ca
79549
79550 /* each Tx packet has a new serial number */
79551 sp->hdr.serial =
79552 - htonl(atomic_inc_return(&call->conn->serial));
79553 + htonl(atomic_inc_return_unchecked(&call->conn->serial));
79554
79555 hdr = (struct rxrpc_header *) txb->head;
79556 hdr->serial = sp->hdr.serial;
79557 @@ -401,7 +401,7 @@ static void rxrpc_rotate_tx_window(struc
79558 */
79559 static void rxrpc_clear_tx_window(struct rxrpc_call *call)
79560 {
79561 - rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
79562 + rxrpc_rotate_tx_window(call, atomic_read_unchecked(&call->sequence));
79563 }
79564
79565 /*
79566 @@ -627,7 +627,7 @@ process_further:
79567
79568 latest = ntohl(sp->hdr.serial);
79569 hard = ntohl(ack.firstPacket);
79570 - tx = atomic_read(&call->sequence);
79571 + tx = atomic_read_unchecked(&call->sequence);
79572
79573 _proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
79574 latest,
79575 @@ -840,6 +840,8 @@ void rxrpc_process_call(struct work_stru
79576 u32 abort_code = RX_PROTOCOL_ERROR;
79577 u8 *acks = NULL;
79578
79579 + pax_track_stack();
79580 +
79581 //printk("\n--------------------\n");
79582 _enter("{%d,%s,%lx} [%lu]",
79583 call->debug_id, rxrpc_call_states[call->state], call->events,
79584 @@ -1159,7 +1161,7 @@ void rxrpc_process_call(struct work_stru
79585 goto maybe_reschedule;
79586
79587 send_ACK_with_skew:
79588 - ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
79589 + ack.maxSkew = htons(atomic_read_unchecked(&call->conn->hi_serial) -
79590 ntohl(ack.serial));
79591 send_ACK:
79592 mtu = call->conn->trans->peer->if_mtu;
79593 @@ -1171,7 +1173,7 @@ send_ACK:
79594 ackinfo.rxMTU = htonl(5692);
79595 ackinfo.jumbo_max = htonl(4);
79596
79597 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
79598 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
79599 _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
79600 ntohl(hdr.serial),
79601 ntohs(ack.maxSkew),
79602 @@ -1189,7 +1191,7 @@ send_ACK:
79603 send_message:
79604 _debug("send message");
79605
79606 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
79607 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
79608 _proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
79609 send_message_2:
79610
79611 diff -urNp linux-2.6.32.49/net/rxrpc/ar-call.c linux-2.6.32.49/net/rxrpc/ar-call.c
79612 --- linux-2.6.32.49/net/rxrpc/ar-call.c 2011-11-08 19:02:43.000000000 -0500
79613 +++ linux-2.6.32.49/net/rxrpc/ar-call.c 2011-11-15 19:59:43.000000000 -0500
79614 @@ -82,7 +82,7 @@ static struct rxrpc_call *rxrpc_alloc_ca
79615 spin_lock_init(&call->lock);
79616 rwlock_init(&call->state_lock);
79617 atomic_set(&call->usage, 1);
79618 - call->debug_id = atomic_inc_return(&rxrpc_debug_id);
79619 + call->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
79620 call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
79621
79622 memset(&call->sock_node, 0xed, sizeof(call->sock_node));
79623 diff -urNp linux-2.6.32.49/net/rxrpc/ar-connection.c linux-2.6.32.49/net/rxrpc/ar-connection.c
79624 --- linux-2.6.32.49/net/rxrpc/ar-connection.c 2011-11-08 19:02:43.000000000 -0500
79625 +++ linux-2.6.32.49/net/rxrpc/ar-connection.c 2011-11-15 19:59:43.000000000 -0500
79626 @@ -205,7 +205,7 @@ static struct rxrpc_connection *rxrpc_al
79627 rwlock_init(&conn->lock);
79628 spin_lock_init(&conn->state_lock);
79629 atomic_set(&conn->usage, 1);
79630 - conn->debug_id = atomic_inc_return(&rxrpc_debug_id);
79631 + conn->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
79632 conn->avail_calls = RXRPC_MAXCALLS;
79633 conn->size_align = 4;
79634 conn->header_size = sizeof(struct rxrpc_header);
79635 diff -urNp linux-2.6.32.49/net/rxrpc/ar-connevent.c linux-2.6.32.49/net/rxrpc/ar-connevent.c
79636 --- linux-2.6.32.49/net/rxrpc/ar-connevent.c 2011-11-08 19:02:43.000000000 -0500
79637 +++ linux-2.6.32.49/net/rxrpc/ar-connevent.c 2011-11-15 19:59:43.000000000 -0500
79638 @@ -109,7 +109,7 @@ static int rxrpc_abort_connection(struct
79639
79640 len = iov[0].iov_len + iov[1].iov_len;
79641
79642 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
79643 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
79644 _proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
79645
79646 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
79647 diff -urNp linux-2.6.32.49/net/rxrpc/ar-input.c linux-2.6.32.49/net/rxrpc/ar-input.c
79648 --- linux-2.6.32.49/net/rxrpc/ar-input.c 2011-11-08 19:02:43.000000000 -0500
79649 +++ linux-2.6.32.49/net/rxrpc/ar-input.c 2011-11-15 19:59:43.000000000 -0500
79650 @@ -339,9 +339,9 @@ void rxrpc_fast_process_packet(struct rx
79651 /* track the latest serial number on this connection for ACK packet
79652 * information */
79653 serial = ntohl(sp->hdr.serial);
79654 - hi_serial = atomic_read(&call->conn->hi_serial);
79655 + hi_serial = atomic_read_unchecked(&call->conn->hi_serial);
79656 while (serial > hi_serial)
79657 - hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
79658 + hi_serial = atomic_cmpxchg_unchecked(&call->conn->hi_serial, hi_serial,
79659 serial);
79660
79661 /* request ACK generation for any ACK or DATA packet that requests
79662 diff -urNp linux-2.6.32.49/net/rxrpc/ar-internal.h linux-2.6.32.49/net/rxrpc/ar-internal.h
79663 --- linux-2.6.32.49/net/rxrpc/ar-internal.h 2011-11-08 19:02:43.000000000 -0500
79664 +++ linux-2.6.32.49/net/rxrpc/ar-internal.h 2011-11-15 19:59:43.000000000 -0500
79665 @@ -272,8 +272,8 @@ struct rxrpc_connection {
79666 int error; /* error code for local abort */
79667 int debug_id; /* debug ID for printks */
79668 unsigned call_counter; /* call ID counter */
79669 - atomic_t serial; /* packet serial number counter */
79670 - atomic_t hi_serial; /* highest serial number received */
79671 + atomic_unchecked_t serial; /* packet serial number counter */
79672 + atomic_unchecked_t hi_serial; /* highest serial number received */
79673 u8 avail_calls; /* number of calls available */
79674 u8 size_align; /* data size alignment (for security) */
79675 u8 header_size; /* rxrpc + security header size */
79676 @@ -346,7 +346,7 @@ struct rxrpc_call {
79677 spinlock_t lock;
79678 rwlock_t state_lock; /* lock for state transition */
79679 atomic_t usage;
79680 - atomic_t sequence; /* Tx data packet sequence counter */
79681 + atomic_unchecked_t sequence; /* Tx data packet sequence counter */
79682 u32 abort_code; /* local/remote abort code */
79683 enum { /* current state of call */
79684 RXRPC_CALL_CLIENT_SEND_REQUEST, /* - client sending request phase */
79685 @@ -420,7 +420,7 @@ static inline void rxrpc_abort_call(stru
79686 */
79687 extern atomic_t rxrpc_n_skbs;
79688 extern __be32 rxrpc_epoch;
79689 -extern atomic_t rxrpc_debug_id;
79690 +extern atomic_unchecked_t rxrpc_debug_id;
79691 extern struct workqueue_struct *rxrpc_workqueue;
79692
79693 /*
79694 diff -urNp linux-2.6.32.49/net/rxrpc/ar-key.c linux-2.6.32.49/net/rxrpc/ar-key.c
79695 --- linux-2.6.32.49/net/rxrpc/ar-key.c 2011-11-08 19:02:43.000000000 -0500
79696 +++ linux-2.6.32.49/net/rxrpc/ar-key.c 2011-11-15 19:59:43.000000000 -0500
79697 @@ -88,11 +88,11 @@ static int rxrpc_instantiate_xdr_rxkad(s
79698 return ret;
79699
79700 plen -= sizeof(*token);
79701 - token = kmalloc(sizeof(*token), GFP_KERNEL);
79702 + token = kzalloc(sizeof(*token), GFP_KERNEL);
79703 if (!token)
79704 return -ENOMEM;
79705
79706 - token->kad = kmalloc(plen, GFP_KERNEL);
79707 + token->kad = kzalloc(plen, GFP_KERNEL);
79708 if (!token->kad) {
79709 kfree(token);
79710 return -ENOMEM;
79711 @@ -730,10 +730,10 @@ static int rxrpc_instantiate(struct key
79712 goto error;
79713
79714 ret = -ENOMEM;
79715 - token = kmalloc(sizeof(*token), GFP_KERNEL);
79716 + token = kzalloc(sizeof(*token), GFP_KERNEL);
79717 if (!token)
79718 goto error;
79719 - token->kad = kmalloc(plen, GFP_KERNEL);
79720 + token->kad = kzalloc(plen, GFP_KERNEL);
79721 if (!token->kad)
79722 goto error_free;
79723
79724 diff -urNp linux-2.6.32.49/net/rxrpc/ar-local.c linux-2.6.32.49/net/rxrpc/ar-local.c
79725 --- linux-2.6.32.49/net/rxrpc/ar-local.c 2011-11-08 19:02:43.000000000 -0500
79726 +++ linux-2.6.32.49/net/rxrpc/ar-local.c 2011-11-15 19:59:43.000000000 -0500
79727 @@ -44,7 +44,7 @@ struct rxrpc_local *rxrpc_alloc_local(st
79728 spin_lock_init(&local->lock);
79729 rwlock_init(&local->services_lock);
79730 atomic_set(&local->usage, 1);
79731 - local->debug_id = atomic_inc_return(&rxrpc_debug_id);
79732 + local->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
79733 memcpy(&local->srx, srx, sizeof(*srx));
79734 }
79735
79736 diff -urNp linux-2.6.32.49/net/rxrpc/ar-output.c linux-2.6.32.49/net/rxrpc/ar-output.c
79737 --- linux-2.6.32.49/net/rxrpc/ar-output.c 2011-11-08 19:02:43.000000000 -0500
79738 +++ linux-2.6.32.49/net/rxrpc/ar-output.c 2011-11-15 19:59:43.000000000 -0500
79739 @@ -680,9 +680,9 @@ static int rxrpc_send_data(struct kiocb
79740 sp->hdr.cid = call->cid;
79741 sp->hdr.callNumber = call->call_id;
79742 sp->hdr.seq =
79743 - htonl(atomic_inc_return(&call->sequence));
79744 + htonl(atomic_inc_return_unchecked(&call->sequence));
79745 sp->hdr.serial =
79746 - htonl(atomic_inc_return(&conn->serial));
79747 + htonl(atomic_inc_return_unchecked(&conn->serial));
79748 sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
79749 sp->hdr.userStatus = 0;
79750 sp->hdr.securityIndex = conn->security_ix;
79751 diff -urNp linux-2.6.32.49/net/rxrpc/ar-peer.c linux-2.6.32.49/net/rxrpc/ar-peer.c
79752 --- linux-2.6.32.49/net/rxrpc/ar-peer.c 2011-11-08 19:02:43.000000000 -0500
79753 +++ linux-2.6.32.49/net/rxrpc/ar-peer.c 2011-11-15 19:59:43.000000000 -0500
79754 @@ -86,7 +86,7 @@ static struct rxrpc_peer *rxrpc_alloc_pe
79755 INIT_LIST_HEAD(&peer->error_targets);
79756 spin_lock_init(&peer->lock);
79757 atomic_set(&peer->usage, 1);
79758 - peer->debug_id = atomic_inc_return(&rxrpc_debug_id);
79759 + peer->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
79760 memcpy(&peer->srx, srx, sizeof(*srx));
79761
79762 rxrpc_assess_MTU_size(peer);
79763 diff -urNp linux-2.6.32.49/net/rxrpc/ar-proc.c linux-2.6.32.49/net/rxrpc/ar-proc.c
79764 --- linux-2.6.32.49/net/rxrpc/ar-proc.c 2011-11-08 19:02:43.000000000 -0500
79765 +++ linux-2.6.32.49/net/rxrpc/ar-proc.c 2011-11-15 19:59:43.000000000 -0500
79766 @@ -164,8 +164,8 @@ static int rxrpc_connection_seq_show(str
79767 atomic_read(&conn->usage),
79768 rxrpc_conn_states[conn->state],
79769 key_serial(conn->key),
79770 - atomic_read(&conn->serial),
79771 - atomic_read(&conn->hi_serial));
79772 + atomic_read_unchecked(&conn->serial),
79773 + atomic_read_unchecked(&conn->hi_serial));
79774
79775 return 0;
79776 }
79777 diff -urNp linux-2.6.32.49/net/rxrpc/ar-transport.c linux-2.6.32.49/net/rxrpc/ar-transport.c
79778 --- linux-2.6.32.49/net/rxrpc/ar-transport.c 2011-11-08 19:02:43.000000000 -0500
79779 +++ linux-2.6.32.49/net/rxrpc/ar-transport.c 2011-11-15 19:59:43.000000000 -0500
79780 @@ -46,7 +46,7 @@ static struct rxrpc_transport *rxrpc_all
79781 spin_lock_init(&trans->client_lock);
79782 rwlock_init(&trans->conn_lock);
79783 atomic_set(&trans->usage, 1);
79784 - trans->debug_id = atomic_inc_return(&rxrpc_debug_id);
79785 + trans->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
79786
79787 if (peer->srx.transport.family == AF_INET) {
79788 switch (peer->srx.transport_type) {
79789 diff -urNp linux-2.6.32.49/net/rxrpc/rxkad.c linux-2.6.32.49/net/rxrpc/rxkad.c
79790 --- linux-2.6.32.49/net/rxrpc/rxkad.c 2011-11-08 19:02:43.000000000 -0500
79791 +++ linux-2.6.32.49/net/rxrpc/rxkad.c 2011-11-15 19:59:43.000000000 -0500
79792 @@ -210,6 +210,8 @@ static int rxkad_secure_packet_encrypt(c
79793 u16 check;
79794 int nsg;
79795
79796 + pax_track_stack();
79797 +
79798 sp = rxrpc_skb(skb);
79799
79800 _enter("");
79801 @@ -337,6 +339,8 @@ static int rxkad_verify_packet_auth(cons
79802 u16 check;
79803 int nsg;
79804
79805 + pax_track_stack();
79806 +
79807 _enter("");
79808
79809 sp = rxrpc_skb(skb);
79810 @@ -609,7 +613,7 @@ static int rxkad_issue_challenge(struct
79811
79812 len = iov[0].iov_len + iov[1].iov_len;
79813
79814 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
79815 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
79816 _proto("Tx CHALLENGE %%%u", ntohl(hdr.serial));
79817
79818 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
79819 @@ -659,7 +663,7 @@ static int rxkad_send_response(struct rx
79820
79821 len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
79822
79823 - hdr->serial = htonl(atomic_inc_return(&conn->serial));
79824 + hdr->serial = htonl(atomic_inc_return_unchecked(&conn->serial));
79825 _proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
79826
79827 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
79828 diff -urNp linux-2.6.32.49/net/sctp/proc.c linux-2.6.32.49/net/sctp/proc.c
79829 --- linux-2.6.32.49/net/sctp/proc.c 2011-11-08 19:02:43.000000000 -0500
79830 +++ linux-2.6.32.49/net/sctp/proc.c 2011-11-15 19:59:43.000000000 -0500
79831 @@ -213,7 +213,12 @@ static int sctp_eps_seq_show(struct seq_
79832 sctp_for_each_hentry(epb, node, &head->chain) {
79833 ep = sctp_ep(epb);
79834 sk = epb->sk;
79835 - seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ", ep, sk,
79836 + seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ",
79837 +#ifdef CONFIG_GRKERNSEC_HIDESYM
79838 + NULL, NULL,
79839 +#else
79840 + ep, sk,
79841 +#endif
79842 sctp_sk(sk)->type, sk->sk_state, hash,
79843 epb->bind_addr.port,
79844 sock_i_uid(sk), sock_i_ino(sk));
79845 @@ -320,7 +325,12 @@ static int sctp_assocs_seq_show(struct s
79846 seq_printf(seq,
79847 "%8p %8p %-3d %-3d %-2d %-4d "
79848 "%4d %8d %8d %7d %5lu %-5d %5d ",
79849 - assoc, sk, sctp_sk(sk)->type, sk->sk_state,
79850 +#ifdef CONFIG_GRKERNSEC_HIDESYM
79851 + NULL, NULL,
79852 +#else
79853 + assoc, sk,
79854 +#endif
79855 + sctp_sk(sk)->type, sk->sk_state,
79856 assoc->state, hash,
79857 assoc->assoc_id,
79858 assoc->sndbuf_used,
79859 diff -urNp linux-2.6.32.49/net/sctp/socket.c linux-2.6.32.49/net/sctp/socket.c
79860 --- linux-2.6.32.49/net/sctp/socket.c 2011-11-08 19:02:43.000000000 -0500
79861 +++ linux-2.6.32.49/net/sctp/socket.c 2011-11-15 19:59:43.000000000 -0500
79862 @@ -5802,7 +5802,6 @@ pp_found:
79863 */
79864 int reuse = sk->sk_reuse;
79865 struct sock *sk2;
79866 - struct hlist_node *node;
79867
79868 SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
79869 if (pp->fastreuse && sk->sk_reuse &&
79870 diff -urNp linux-2.6.32.49/net/socket.c linux-2.6.32.49/net/socket.c
79871 --- linux-2.6.32.49/net/socket.c 2011-11-08 19:02:43.000000000 -0500
79872 +++ linux-2.6.32.49/net/socket.c 2011-11-15 19:59:43.000000000 -0500
79873 @@ -87,6 +87,7 @@
79874 #include <linux/wireless.h>
79875 #include <linux/nsproxy.h>
79876 #include <linux/magic.h>
79877 +#include <linux/in.h>
79878
79879 #include <asm/uaccess.h>
79880 #include <asm/unistd.h>
79881 @@ -97,6 +98,21 @@
79882 #include <net/sock.h>
79883 #include <linux/netfilter.h>
79884
79885 +extern void gr_attach_curr_ip(const struct sock *sk);
79886 +extern int gr_handle_sock_all(const int family, const int type,
79887 + const int protocol);
79888 +extern int gr_handle_sock_server(const struct sockaddr *sck);
79889 +extern int gr_handle_sock_server_other(const struct sock *sck);
79890 +extern int gr_handle_sock_client(const struct sockaddr *sck);
79891 +extern int gr_search_connect(struct socket * sock,
79892 + struct sockaddr_in * addr);
79893 +extern int gr_search_bind(struct socket * sock,
79894 + struct sockaddr_in * addr);
79895 +extern int gr_search_listen(struct socket * sock);
79896 +extern int gr_search_accept(struct socket * sock);
79897 +extern int gr_search_socket(const int domain, const int type,
79898 + const int protocol);
79899 +
79900 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
79901 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
79902 unsigned long nr_segs, loff_t pos);
79903 @@ -298,7 +314,7 @@ static int sockfs_get_sb(struct file_sys
79904 mnt);
79905 }
79906
79907 -static struct vfsmount *sock_mnt __read_mostly;
79908 +struct vfsmount *sock_mnt __read_mostly;
79909
79910 static struct file_system_type sock_fs_type = {
79911 .name = "sockfs",
79912 @@ -1154,6 +1170,8 @@ static int __sock_create(struct net *net
79913 return -EAFNOSUPPORT;
79914 if (type < 0 || type >= SOCK_MAX)
79915 return -EINVAL;
79916 + if (protocol < 0)
79917 + return -EINVAL;
79918
79919 /* Compatibility.
79920
79921 @@ -1283,6 +1301,16 @@ SYSCALL_DEFINE3(socket, int, family, int
79922 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
79923 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
79924
79925 + if(!gr_search_socket(family, type, protocol)) {
79926 + retval = -EACCES;
79927 + goto out;
79928 + }
79929 +
79930 + if (gr_handle_sock_all(family, type, protocol)) {
79931 + retval = -EACCES;
79932 + goto out;
79933 + }
79934 +
79935 retval = sock_create(family, type, protocol, &sock);
79936 if (retval < 0)
79937 goto out;
79938 @@ -1415,6 +1443,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
79939 if (sock) {
79940 err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
79941 if (err >= 0) {
79942 + if (gr_handle_sock_server((struct sockaddr *)&address)) {
79943 + err = -EACCES;
79944 + goto error;
79945 + }
79946 + err = gr_search_bind(sock, (struct sockaddr_in *)&address);
79947 + if (err)
79948 + goto error;
79949 +
79950 err = security_socket_bind(sock,
79951 (struct sockaddr *)&address,
79952 addrlen);
79953 @@ -1423,6 +1459,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
79954 (struct sockaddr *)
79955 &address, addrlen);
79956 }
79957 +error:
79958 fput_light(sock->file, fput_needed);
79959 }
79960 return err;
79961 @@ -1446,10 +1483,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
79962 if ((unsigned)backlog > somaxconn)
79963 backlog = somaxconn;
79964
79965 + if (gr_handle_sock_server_other(sock->sk)) {
79966 + err = -EPERM;
79967 + goto error;
79968 + }
79969 +
79970 + err = gr_search_listen(sock);
79971 + if (err)
79972 + goto error;
79973 +
79974 err = security_socket_listen(sock, backlog);
79975 if (!err)
79976 err = sock->ops->listen(sock, backlog);
79977
79978 +error:
79979 fput_light(sock->file, fput_needed);
79980 }
79981 return err;
79982 @@ -1492,6 +1539,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
79983 newsock->type = sock->type;
79984 newsock->ops = sock->ops;
79985
79986 + if (gr_handle_sock_server_other(sock->sk)) {
79987 + err = -EPERM;
79988 + sock_release(newsock);
79989 + goto out_put;
79990 + }
79991 +
79992 + err = gr_search_accept(sock);
79993 + if (err) {
79994 + sock_release(newsock);
79995 + goto out_put;
79996 + }
79997 +
79998 /*
79999 * We don't need try_module_get here, as the listening socket (sock)
80000 * has the protocol module (sock->ops->owner) held.
80001 @@ -1534,6 +1593,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
80002 fd_install(newfd, newfile);
80003 err = newfd;
80004
80005 + gr_attach_curr_ip(newsock->sk);
80006 +
80007 out_put:
80008 fput_light(sock->file, fput_needed);
80009 out:
80010 @@ -1571,6 +1632,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct
80011 int, addrlen)
80012 {
80013 struct socket *sock;
80014 + struct sockaddr *sck;
80015 struct sockaddr_storage address;
80016 int err, fput_needed;
80017
80018 @@ -1581,6 +1643,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct
80019 if (err < 0)
80020 goto out_put;
80021
80022 + sck = (struct sockaddr *)&address;
80023 +
80024 + if (gr_handle_sock_client(sck)) {
80025 + err = -EACCES;
80026 + goto out_put;
80027 + }
80028 +
80029 + err = gr_search_connect(sock, (struct sockaddr_in *)sck);
80030 + if (err)
80031 + goto out_put;
80032 +
80033 err =
80034 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
80035 if (err)
80036 @@ -1882,6 +1955,8 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct
80037 int err, ctl_len, iov_size, total_len;
80038 int fput_needed;
80039
80040 + pax_track_stack();
80041 +
80042 err = -EFAULT;
80043 if (MSG_CMSG_COMPAT & flags) {
80044 if (get_compat_msghdr(&msg_sys, msg_compat))
80045 @@ -2022,7 +2097,7 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct
80046 * kernel msghdr to use the kernel address space)
80047 */
80048
80049 - uaddr = (__force void __user *)msg_sys.msg_name;
80050 + uaddr = (void __force_user *)msg_sys.msg_name;
80051 uaddr_len = COMPAT_NAMELEN(msg);
80052 if (MSG_CMSG_COMPAT & flags) {
80053 err = verify_compat_iovec(&msg_sys, iov,
80054 diff -urNp linux-2.6.32.49/net/sunrpc/sched.c linux-2.6.32.49/net/sunrpc/sched.c
80055 --- linux-2.6.32.49/net/sunrpc/sched.c 2011-11-08 19:02:43.000000000 -0500
80056 +++ linux-2.6.32.49/net/sunrpc/sched.c 2011-11-15 19:59:43.000000000 -0500
80057 @@ -234,10 +234,10 @@ static int rpc_wait_bit_killable(void *w
80058 #ifdef RPC_DEBUG
80059 static void rpc_task_set_debuginfo(struct rpc_task *task)
80060 {
80061 - static atomic_t rpc_pid;
80062 + static atomic_unchecked_t rpc_pid;
80063
80064 task->tk_magic = RPC_TASK_MAGIC_ID;
80065 - task->tk_pid = atomic_inc_return(&rpc_pid);
80066 + task->tk_pid = atomic_inc_return_unchecked(&rpc_pid);
80067 }
80068 #else
80069 static inline void rpc_task_set_debuginfo(struct rpc_task *task)
80070 diff -urNp linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma.c
80071 --- linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma.c 2011-11-08 19:02:43.000000000 -0500
80072 +++ linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma.c 2011-11-15 19:59:43.000000000 -0500
80073 @@ -59,15 +59,15 @@ unsigned int svcrdma_max_req_size = RPCR
80074 static unsigned int min_max_inline = 4096;
80075 static unsigned int max_max_inline = 65536;
80076
80077 -atomic_t rdma_stat_recv;
80078 -atomic_t rdma_stat_read;
80079 -atomic_t rdma_stat_write;
80080 -atomic_t rdma_stat_sq_starve;
80081 -atomic_t rdma_stat_rq_starve;
80082 -atomic_t rdma_stat_rq_poll;
80083 -atomic_t rdma_stat_rq_prod;
80084 -atomic_t rdma_stat_sq_poll;
80085 -atomic_t rdma_stat_sq_prod;
80086 +atomic_unchecked_t rdma_stat_recv;
80087 +atomic_unchecked_t rdma_stat_read;
80088 +atomic_unchecked_t rdma_stat_write;
80089 +atomic_unchecked_t rdma_stat_sq_starve;
80090 +atomic_unchecked_t rdma_stat_rq_starve;
80091 +atomic_unchecked_t rdma_stat_rq_poll;
80092 +atomic_unchecked_t rdma_stat_rq_prod;
80093 +atomic_unchecked_t rdma_stat_sq_poll;
80094 +atomic_unchecked_t rdma_stat_sq_prod;
80095
80096 /* Temporary NFS request map and context caches */
80097 struct kmem_cache *svc_rdma_map_cachep;
80098 @@ -105,7 +105,7 @@ static int read_reset_stat(ctl_table *ta
80099 len -= *ppos;
80100 if (len > *lenp)
80101 len = *lenp;
80102 - if (len && copy_to_user(buffer, str_buf, len))
80103 + if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
80104 return -EFAULT;
80105 *lenp = len;
80106 *ppos += len;
80107 @@ -149,63 +149,63 @@ static ctl_table svcrdma_parm_table[] =
80108 {
80109 .procname = "rdma_stat_read",
80110 .data = &rdma_stat_read,
80111 - .maxlen = sizeof(atomic_t),
80112 + .maxlen = sizeof(atomic_unchecked_t),
80113 .mode = 0644,
80114 .proc_handler = &read_reset_stat,
80115 },
80116 {
80117 .procname = "rdma_stat_recv",
80118 .data = &rdma_stat_recv,
80119 - .maxlen = sizeof(atomic_t),
80120 + .maxlen = sizeof(atomic_unchecked_t),
80121 .mode = 0644,
80122 .proc_handler = &read_reset_stat,
80123 },
80124 {
80125 .procname = "rdma_stat_write",
80126 .data = &rdma_stat_write,
80127 - .maxlen = sizeof(atomic_t),
80128 + .maxlen = sizeof(atomic_unchecked_t),
80129 .mode = 0644,
80130 .proc_handler = &read_reset_stat,
80131 },
80132 {
80133 .procname = "rdma_stat_sq_starve",
80134 .data = &rdma_stat_sq_starve,
80135 - .maxlen = sizeof(atomic_t),
80136 + .maxlen = sizeof(atomic_unchecked_t),
80137 .mode = 0644,
80138 .proc_handler = &read_reset_stat,
80139 },
80140 {
80141 .procname = "rdma_stat_rq_starve",
80142 .data = &rdma_stat_rq_starve,
80143 - .maxlen = sizeof(atomic_t),
80144 + .maxlen = sizeof(atomic_unchecked_t),
80145 .mode = 0644,
80146 .proc_handler = &read_reset_stat,
80147 },
80148 {
80149 .procname = "rdma_stat_rq_poll",
80150 .data = &rdma_stat_rq_poll,
80151 - .maxlen = sizeof(atomic_t),
80152 + .maxlen = sizeof(atomic_unchecked_t),
80153 .mode = 0644,
80154 .proc_handler = &read_reset_stat,
80155 },
80156 {
80157 .procname = "rdma_stat_rq_prod",
80158 .data = &rdma_stat_rq_prod,
80159 - .maxlen = sizeof(atomic_t),
80160 + .maxlen = sizeof(atomic_unchecked_t),
80161 .mode = 0644,
80162 .proc_handler = &read_reset_stat,
80163 },
80164 {
80165 .procname = "rdma_stat_sq_poll",
80166 .data = &rdma_stat_sq_poll,
80167 - .maxlen = sizeof(atomic_t),
80168 + .maxlen = sizeof(atomic_unchecked_t),
80169 .mode = 0644,
80170 .proc_handler = &read_reset_stat,
80171 },
80172 {
80173 .procname = "rdma_stat_sq_prod",
80174 .data = &rdma_stat_sq_prod,
80175 - .maxlen = sizeof(atomic_t),
80176 + .maxlen = sizeof(atomic_unchecked_t),
80177 .mode = 0644,
80178 .proc_handler = &read_reset_stat,
80179 },
80180 diff -urNp linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
80181 --- linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-11-08 19:02:43.000000000 -0500
80182 +++ linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-11-15 19:59:43.000000000 -0500
80183 @@ -495,7 +495,7 @@ next_sge:
80184 svc_rdma_put_context(ctxt, 0);
80185 goto out;
80186 }
80187 - atomic_inc(&rdma_stat_read);
80188 + atomic_inc_unchecked(&rdma_stat_read);
80189
80190 if (read_wr.num_sge < chl_map->ch[ch_no].count) {
80191 chl_map->ch[ch_no].count -= read_wr.num_sge;
80192 @@ -606,7 +606,7 @@ int svc_rdma_recvfrom(struct svc_rqst *r
80193 dto_q);
80194 list_del_init(&ctxt->dto_q);
80195 } else {
80196 - atomic_inc(&rdma_stat_rq_starve);
80197 + atomic_inc_unchecked(&rdma_stat_rq_starve);
80198 clear_bit(XPT_DATA, &xprt->xpt_flags);
80199 ctxt = NULL;
80200 }
80201 @@ -626,7 +626,7 @@ int svc_rdma_recvfrom(struct svc_rqst *r
80202 dprintk("svcrdma: processing ctxt=%p on xprt=%p, rqstp=%p, status=%d\n",
80203 ctxt, rdma_xprt, rqstp, ctxt->wc_status);
80204 BUG_ON(ctxt->wc_status != IB_WC_SUCCESS);
80205 - atomic_inc(&rdma_stat_recv);
80206 + atomic_inc_unchecked(&rdma_stat_recv);
80207
80208 /* Build up the XDR from the receive buffers. */
80209 rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
80210 diff -urNp linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma_sendto.c linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma_sendto.c
80211 --- linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-11-08 19:02:43.000000000 -0500
80212 +++ linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-11-15 19:59:43.000000000 -0500
80213 @@ -328,7 +328,7 @@ static int send_write(struct svcxprt_rdm
80214 write_wr.wr.rdma.remote_addr = to;
80215
80216 /* Post It */
80217 - atomic_inc(&rdma_stat_write);
80218 + atomic_inc_unchecked(&rdma_stat_write);
80219 if (svc_rdma_send(xprt, &write_wr))
80220 goto err;
80221 return 0;
80222 diff -urNp linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma_transport.c linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma_transport.c
80223 --- linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-11-08 19:02:43.000000000 -0500
80224 +++ linux-2.6.32.49/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-11-15 19:59:43.000000000 -0500
80225 @@ -292,7 +292,7 @@ static void rq_cq_reap(struct svcxprt_rd
80226 return;
80227
80228 ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
80229 - atomic_inc(&rdma_stat_rq_poll);
80230 + atomic_inc_unchecked(&rdma_stat_rq_poll);
80231
80232 while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
80233 ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
80234 @@ -314,7 +314,7 @@ static void rq_cq_reap(struct svcxprt_rd
80235 }
80236
80237 if (ctxt)
80238 - atomic_inc(&rdma_stat_rq_prod);
80239 + atomic_inc_unchecked(&rdma_stat_rq_prod);
80240
80241 set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
80242 /*
80243 @@ -386,7 +386,7 @@ static void sq_cq_reap(struct svcxprt_rd
80244 return;
80245
80246 ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
80247 - atomic_inc(&rdma_stat_sq_poll);
80248 + atomic_inc_unchecked(&rdma_stat_sq_poll);
80249 while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
80250 if (wc.status != IB_WC_SUCCESS)
80251 /* Close the transport */
80252 @@ -404,7 +404,7 @@ static void sq_cq_reap(struct svcxprt_rd
80253 }
80254
80255 if (ctxt)
80256 - atomic_inc(&rdma_stat_sq_prod);
80257 + atomic_inc_unchecked(&rdma_stat_sq_prod);
80258 }
80259
80260 static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
80261 @@ -1260,7 +1260,7 @@ int svc_rdma_send(struct svcxprt_rdma *x
80262 spin_lock_bh(&xprt->sc_lock);
80263 if (xprt->sc_sq_depth < atomic_read(&xprt->sc_sq_count) + wr_count) {
80264 spin_unlock_bh(&xprt->sc_lock);
80265 - atomic_inc(&rdma_stat_sq_starve);
80266 + atomic_inc_unchecked(&rdma_stat_sq_starve);
80267
80268 /* See if we can opportunistically reap SQ WR to make room */
80269 sq_cq_reap(xprt);
80270 diff -urNp linux-2.6.32.49/net/sysctl_net.c linux-2.6.32.49/net/sysctl_net.c
80271 --- linux-2.6.32.49/net/sysctl_net.c 2011-11-08 19:02:43.000000000 -0500
80272 +++ linux-2.6.32.49/net/sysctl_net.c 2011-11-15 19:59:43.000000000 -0500
80273 @@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
80274 struct ctl_table *table)
80275 {
80276 /* Allow network administrator to have same access as root. */
80277 - if (capable(CAP_NET_ADMIN)) {
80278 + if (capable_nolog(CAP_NET_ADMIN)) {
80279 int mode = (table->mode >> 6) & 7;
80280 return (mode << 6) | (mode << 3) | mode;
80281 }
80282 diff -urNp linux-2.6.32.49/net/tipc/link.c linux-2.6.32.49/net/tipc/link.c
80283 --- linux-2.6.32.49/net/tipc/link.c 2011-11-08 19:02:43.000000000 -0500
80284 +++ linux-2.6.32.49/net/tipc/link.c 2011-11-15 19:59:43.000000000 -0500
80285 @@ -1418,7 +1418,7 @@ again:
80286
80287 if (!sect_rest) {
80288 sect_rest = msg_sect[++curr_sect].iov_len;
80289 - sect_crs = (const unchar *)msg_sect[curr_sect].iov_base;
80290 + sect_crs = (const unchar __user *)msg_sect[curr_sect].iov_base;
80291 }
80292
80293 if (sect_rest < fragm_rest)
80294 @@ -1437,7 +1437,7 @@ error:
80295 }
80296 } else
80297 skb_copy_to_linear_data_offset(buf, fragm_crs,
80298 - sect_crs, sz);
80299 + (const void __force_kernel *)sect_crs, sz);
80300 sect_crs += sz;
80301 sect_rest -= sz;
80302 fragm_crs += sz;
80303 diff -urNp linux-2.6.32.49/net/tipc/subscr.c linux-2.6.32.49/net/tipc/subscr.c
80304 --- linux-2.6.32.49/net/tipc/subscr.c 2011-11-08 19:02:43.000000000 -0500
80305 +++ linux-2.6.32.49/net/tipc/subscr.c 2011-11-15 19:59:43.000000000 -0500
80306 @@ -104,7 +104,7 @@ static void subscr_send_event(struct sub
80307 {
80308 struct iovec msg_sect;
80309
80310 - msg_sect.iov_base = (void *)&sub->evt;
80311 + msg_sect.iov_base = (void __force_user *)&sub->evt;
80312 msg_sect.iov_len = sizeof(struct tipc_event);
80313
80314 sub->evt.event = htohl(event, sub->swap);
80315 diff -urNp linux-2.6.32.49/net/unix/af_unix.c linux-2.6.32.49/net/unix/af_unix.c
80316 --- linux-2.6.32.49/net/unix/af_unix.c 2011-11-08 19:02:43.000000000 -0500
80317 +++ linux-2.6.32.49/net/unix/af_unix.c 2011-11-15 19:59:43.000000000 -0500
80318 @@ -745,6 +745,12 @@ static struct sock *unix_find_other(stru
80319 err = -ECONNREFUSED;
80320 if (!S_ISSOCK(inode->i_mode))
80321 goto put_fail;
80322 +
80323 + if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
80324 + err = -EACCES;
80325 + goto put_fail;
80326 + }
80327 +
80328 u = unix_find_socket_byinode(net, inode);
80329 if (!u)
80330 goto put_fail;
80331 @@ -765,6 +771,13 @@ static struct sock *unix_find_other(stru
80332 if (u) {
80333 struct dentry *dentry;
80334 dentry = unix_sk(u)->dentry;
80335 +
80336 + if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
80337 + err = -EPERM;
80338 + sock_put(u);
80339 + goto fail;
80340 + }
80341 +
80342 if (dentry)
80343 touch_atime(unix_sk(u)->mnt, dentry);
80344 } else
80345 @@ -850,11 +863,18 @@ static int unix_bind(struct socket *sock
80346 err = security_path_mknod(&nd.path, dentry, mode, 0);
80347 if (err)
80348 goto out_mknod_drop_write;
80349 + if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
80350 + err = -EACCES;
80351 + goto out_mknod_drop_write;
80352 + }
80353 err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
80354 out_mknod_drop_write:
80355 mnt_drop_write(nd.path.mnt);
80356 if (err)
80357 goto out_mknod_dput;
80358 +
80359 + gr_handle_create(dentry, nd.path.mnt);
80360 +
80361 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
80362 dput(nd.path.dentry);
80363 nd.path.dentry = dentry;
80364 @@ -2211,7 +2231,11 @@ static int unix_seq_show(struct seq_file
80365 unix_state_lock(s);
80366
80367 seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu",
80368 +#ifdef CONFIG_GRKERNSEC_HIDESYM
80369 + NULL,
80370 +#else
80371 s,
80372 +#endif
80373 atomic_read(&s->sk_refcnt),
80374 0,
80375 s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
80376 diff -urNp linux-2.6.32.49/net/wireless/core.h linux-2.6.32.49/net/wireless/core.h
80377 --- linux-2.6.32.49/net/wireless/core.h 2011-11-08 19:02:43.000000000 -0500
80378 +++ linux-2.6.32.49/net/wireless/core.h 2011-11-15 19:59:43.000000000 -0500
80379 @@ -27,7 +27,7 @@ struct cfg80211_registered_device {
80380 struct mutex mtx;
80381
80382 /* rfkill support */
80383 - struct rfkill_ops rfkill_ops;
80384 + rfkill_ops_no_const rfkill_ops;
80385 struct rfkill *rfkill;
80386 struct work_struct rfkill_sync;
80387
80388 diff -urNp linux-2.6.32.49/net/wireless/wext.c linux-2.6.32.49/net/wireless/wext.c
80389 --- linux-2.6.32.49/net/wireless/wext.c 2011-11-08 19:02:43.000000000 -0500
80390 +++ linux-2.6.32.49/net/wireless/wext.c 2011-11-15 19:59:43.000000000 -0500
80391 @@ -816,8 +816,7 @@ static int ioctl_standard_iw_point(struc
80392 */
80393
80394 /* Support for very large requests */
80395 - if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
80396 - (user_length > descr->max_tokens)) {
80397 + if (user_length > descr->max_tokens) {
80398 /* Allow userspace to GET more than max so
80399 * we can support any size GET requests.
80400 * There is still a limit : -ENOMEM.
80401 @@ -854,22 +853,6 @@ static int ioctl_standard_iw_point(struc
80402 }
80403 }
80404
80405 - if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
80406 - /*
80407 - * If this is a GET, but not NOMAX, it means that the extra
80408 - * data is not bounded by userspace, but by max_tokens. Thus
80409 - * set the length to max_tokens. This matches the extra data
80410 - * allocation.
80411 - * The driver should fill it with the number of tokens it
80412 - * provided, and it may check iwp->length rather than having
80413 - * knowledge of max_tokens. If the driver doesn't change the
80414 - * iwp->length, this ioctl just copies back max_token tokens
80415 - * filled with zeroes. Hopefully the driver isn't claiming
80416 - * them to be valid data.
80417 - */
80418 - iwp->length = descr->max_tokens;
80419 - }
80420 -
80421 err = handler(dev, info, (union iwreq_data *) iwp, extra);
80422
80423 iwp->length += essid_compat;
80424 diff -urNp linux-2.6.32.49/net/xfrm/xfrm_policy.c linux-2.6.32.49/net/xfrm/xfrm_policy.c
80425 --- linux-2.6.32.49/net/xfrm/xfrm_policy.c 2011-11-08 19:02:43.000000000 -0500
80426 +++ linux-2.6.32.49/net/xfrm/xfrm_policy.c 2011-11-15 19:59:43.000000000 -0500
80427 @@ -586,7 +586,7 @@ int xfrm_policy_insert(int dir, struct x
80428 hlist_add_head(&policy->bydst, chain);
80429 xfrm_pol_hold(policy);
80430 net->xfrm.policy_count[dir]++;
80431 - atomic_inc(&flow_cache_genid);
80432 + atomic_inc_unchecked(&flow_cache_genid);
80433 if (delpol)
80434 __xfrm_policy_unlink(delpol, dir);
80435 policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
80436 @@ -669,7 +669,7 @@ struct xfrm_policy *xfrm_policy_bysel_ct
80437 write_unlock_bh(&xfrm_policy_lock);
80438
80439 if (ret && delete) {
80440 - atomic_inc(&flow_cache_genid);
80441 + atomic_inc_unchecked(&flow_cache_genid);
80442 xfrm_policy_kill(ret);
80443 }
80444 return ret;
80445 @@ -710,7 +710,7 @@ struct xfrm_policy *xfrm_policy_byid(str
80446 write_unlock_bh(&xfrm_policy_lock);
80447
80448 if (ret && delete) {
80449 - atomic_inc(&flow_cache_genid);
80450 + atomic_inc_unchecked(&flow_cache_genid);
80451 xfrm_policy_kill(ret);
80452 }
80453 return ret;
80454 @@ -824,7 +824,7 @@ int xfrm_policy_flush(struct net *net, u
80455 }
80456
80457 }
80458 - atomic_inc(&flow_cache_genid);
80459 + atomic_inc_unchecked(&flow_cache_genid);
80460 out:
80461 write_unlock_bh(&xfrm_policy_lock);
80462 return err;
80463 @@ -1088,7 +1088,7 @@ int xfrm_policy_delete(struct xfrm_polic
80464 write_unlock_bh(&xfrm_policy_lock);
80465 if (pol) {
80466 if (dir < XFRM_POLICY_MAX)
80467 - atomic_inc(&flow_cache_genid);
80468 + atomic_inc_unchecked(&flow_cache_genid);
80469 xfrm_policy_kill(pol);
80470 return 0;
80471 }
80472 @@ -1477,7 +1477,7 @@ free_dst:
80473 goto out;
80474 }
80475
80476 -static int inline
80477 +static inline int
80478 xfrm_dst_alloc_copy(void **target, void *src, int size)
80479 {
80480 if (!*target) {
80481 @@ -1489,7 +1489,7 @@ xfrm_dst_alloc_copy(void **target, void
80482 return 0;
80483 }
80484
80485 -static int inline
80486 +static inline int
80487 xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
80488 {
80489 #ifdef CONFIG_XFRM_SUB_POLICY
80490 @@ -1501,7 +1501,7 @@ xfrm_dst_update_parent(struct dst_entry
80491 #endif
80492 }
80493
80494 -static int inline
80495 +static inline int
80496 xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
80497 {
80498 #ifdef CONFIG_XFRM_SUB_POLICY
80499 @@ -1537,7 +1537,7 @@ int __xfrm_lookup(struct net *net, struc
80500 u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
80501
80502 restart:
80503 - genid = atomic_read(&flow_cache_genid);
80504 + genid = atomic_read_unchecked(&flow_cache_genid);
80505 policy = NULL;
80506 for (pi = 0; pi < ARRAY_SIZE(pols); pi++)
80507 pols[pi] = NULL;
80508 @@ -1680,7 +1680,7 @@ restart:
80509 goto error;
80510 }
80511 if (nx == -EAGAIN ||
80512 - genid != atomic_read(&flow_cache_genid)) {
80513 + genid != atomic_read_unchecked(&flow_cache_genid)) {
80514 xfrm_pols_put(pols, npols);
80515 goto restart;
80516 }
80517 diff -urNp linux-2.6.32.49/net/xfrm/xfrm_user.c linux-2.6.32.49/net/xfrm/xfrm_user.c
80518 --- linux-2.6.32.49/net/xfrm/xfrm_user.c 2011-11-08 19:02:43.000000000 -0500
80519 +++ linux-2.6.32.49/net/xfrm/xfrm_user.c 2011-11-15 19:59:43.000000000 -0500
80520 @@ -1169,6 +1169,8 @@ static int copy_to_user_tmpl(struct xfrm
80521 struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
80522 int i;
80523
80524 + pax_track_stack();
80525 +
80526 if (xp->xfrm_nr == 0)
80527 return 0;
80528
80529 @@ -1784,6 +1786,8 @@ static int xfrm_do_migrate(struct sk_buf
80530 int err;
80531 int n = 0;
80532
80533 + pax_track_stack();
80534 +
80535 if (attrs[XFRMA_MIGRATE] == NULL)
80536 return -EINVAL;
80537
80538 diff -urNp linux-2.6.32.49/samples/kobject/kset-example.c linux-2.6.32.49/samples/kobject/kset-example.c
80539 --- linux-2.6.32.49/samples/kobject/kset-example.c 2011-11-08 19:02:43.000000000 -0500
80540 +++ linux-2.6.32.49/samples/kobject/kset-example.c 2011-11-15 19:59:43.000000000 -0500
80541 @@ -87,7 +87,7 @@ static ssize_t foo_attr_store(struct kob
80542 }
80543
80544 /* Our custom sysfs_ops that we will associate with our ktype later on */
80545 -static struct sysfs_ops foo_sysfs_ops = {
80546 +static const struct sysfs_ops foo_sysfs_ops = {
80547 .show = foo_attr_show,
80548 .store = foo_attr_store,
80549 };
80550 diff -urNp linux-2.6.32.49/scripts/basic/fixdep.c linux-2.6.32.49/scripts/basic/fixdep.c
80551 --- linux-2.6.32.49/scripts/basic/fixdep.c 2011-11-08 19:02:43.000000000 -0500
80552 +++ linux-2.6.32.49/scripts/basic/fixdep.c 2011-11-15 19:59:43.000000000 -0500
80553 @@ -162,7 +162,7 @@ static void grow_config(int len)
80554 /*
80555 * Lookup a value in the configuration string.
80556 */
80557 -static int is_defined_config(const char * name, int len)
80558 +static int is_defined_config(const char * name, unsigned int len)
80559 {
80560 const char * pconfig;
80561 const char * plast = str_config + len_config - len;
80562 @@ -199,7 +199,7 @@ static void clear_config(void)
80563 /*
80564 * Record the use of a CONFIG_* word.
80565 */
80566 -static void use_config(char *m, int slen)
80567 +static void use_config(char *m, unsigned int slen)
80568 {
80569 char s[PATH_MAX];
80570 char *p;
80571 @@ -222,9 +222,9 @@ static void use_config(char *m, int slen
80572
80573 static void parse_config_file(char *map, size_t len)
80574 {
80575 - int *end = (int *) (map + len);
80576 + unsigned int *end = (unsigned int *) (map + len);
80577 /* start at +1, so that p can never be < map */
80578 - int *m = (int *) map + 1;
80579 + unsigned int *m = (unsigned int *) map + 1;
80580 char *p, *q;
80581
80582 for (; m < end; m++) {
80583 @@ -371,7 +371,7 @@ static void print_deps(void)
80584 static void traps(void)
80585 {
80586 static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
80587 - int *p = (int *)test;
80588 + unsigned int *p = (unsigned int *)test;
80589
80590 if (*p != INT_CONF) {
80591 fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
80592 diff -urNp linux-2.6.32.49/scripts/gcc-plugin.sh linux-2.6.32.49/scripts/gcc-plugin.sh
80593 --- linux-2.6.32.49/scripts/gcc-plugin.sh 1969-12-31 19:00:00.000000000 -0500
80594 +++ linux-2.6.32.49/scripts/gcc-plugin.sh 2011-11-20 19:22:02.000000000 -0500
80595 @@ -0,0 +1,2 @@
80596 +#!/bin/sh
80597 +echo -e "#include \"gcc-plugin.h\"\n#include \"tree.h\"\n#include \"tm.h\"\n#include \"rtl.h\"" | $1 -x c -shared - -o /dev/null -I`$2 -print-file-name=plugin`/include >/dev/null 2>&1 && echo "y"
80598 diff -urNp linux-2.6.32.49/scripts/Makefile.build linux-2.6.32.49/scripts/Makefile.build
80599 --- linux-2.6.32.49/scripts/Makefile.build 2011-11-08 19:02:43.000000000 -0500
80600 +++ linux-2.6.32.49/scripts/Makefile.build 2011-11-15 19:59:43.000000000 -0500
80601 @@ -59,7 +59,7 @@ endif
80602 endif
80603
80604 # Do not include host rules unless needed
80605 -ifneq ($(hostprogs-y)$(hostprogs-m),)
80606 +ifneq ($(hostprogs-y)$(hostprogs-m)$(hostlibs-y)$(hostlibs-m),)
80607 include scripts/Makefile.host
80608 endif
80609
80610 diff -urNp linux-2.6.32.49/scripts/Makefile.clean linux-2.6.32.49/scripts/Makefile.clean
80611 --- linux-2.6.32.49/scripts/Makefile.clean 2011-11-08 19:02:43.000000000 -0500
80612 +++ linux-2.6.32.49/scripts/Makefile.clean 2011-11-15 19:59:43.000000000 -0500
80613 @@ -43,7 +43,8 @@ subdir-ymn := $(addprefix $(obj)/,$(subd
80614 __clean-files := $(extra-y) $(always) \
80615 $(targets) $(clean-files) \
80616 $(host-progs) \
80617 - $(hostprogs-y) $(hostprogs-m) $(hostprogs-)
80618 + $(hostprogs-y) $(hostprogs-m) $(hostprogs-) \
80619 + $(hostlibs-y) $(hostlibs-m) $(hostlibs-)
80620
80621 # as clean-files is given relative to the current directory, this adds
80622 # a $(obj) prefix, except for absolute paths
80623 diff -urNp linux-2.6.32.49/scripts/Makefile.host linux-2.6.32.49/scripts/Makefile.host
80624 --- linux-2.6.32.49/scripts/Makefile.host 2011-11-08 19:02:43.000000000 -0500
80625 +++ linux-2.6.32.49/scripts/Makefile.host 2011-11-15 19:59:43.000000000 -0500
80626 @@ -31,6 +31,7 @@
80627 # Note: Shared libraries consisting of C++ files are not supported
80628
80629 __hostprogs := $(sort $(hostprogs-y) $(hostprogs-m))
80630 +__hostlibs := $(sort $(hostlibs-y) $(hostlibs-m))
80631
80632 # C code
80633 # Executables compiled from a single .c file
80634 @@ -54,6 +55,7 @@ host-cxxobjs := $(sort $(foreach m,$(hos
80635 # Shared libaries (only .c supported)
80636 # Shared libraries (.so) - all .so files referenced in "xxx-objs"
80637 host-cshlib := $(sort $(filter %.so, $(host-cobjs)))
80638 +host-cshlib += $(sort $(filter %.so, $(__hostlibs)))
80639 # Remove .so files from "xxx-objs"
80640 host-cobjs := $(filter-out %.so,$(host-cobjs))
80641
80642 diff -urNp linux-2.6.32.49/scripts/mod/file2alias.c linux-2.6.32.49/scripts/mod/file2alias.c
80643 --- linux-2.6.32.49/scripts/mod/file2alias.c 2011-11-08 19:02:43.000000000 -0500
80644 +++ linux-2.6.32.49/scripts/mod/file2alias.c 2011-11-15 19:59:43.000000000 -0500
80645 @@ -72,7 +72,7 @@ static void device_id_check(const char *
80646 unsigned long size, unsigned long id_size,
80647 void *symval)
80648 {
80649 - int i;
80650 + unsigned int i;
80651
80652 if (size % id_size || size < id_size) {
80653 if (cross_build != 0)
80654 @@ -102,7 +102,7 @@ static void device_id_check(const char *
80655 /* USB is special because the bcdDevice can be matched against a numeric range */
80656 /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
80657 static void do_usb_entry(struct usb_device_id *id,
80658 - unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
80659 + unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
80660 unsigned char range_lo, unsigned char range_hi,
80661 struct module *mod)
80662 {
80663 @@ -151,7 +151,7 @@ static void do_usb_entry_multi(struct us
80664 {
80665 unsigned int devlo, devhi;
80666 unsigned char chi, clo;
80667 - int ndigits;
80668 + unsigned int ndigits;
80669
80670 id->match_flags = TO_NATIVE(id->match_flags);
80671 id->idVendor = TO_NATIVE(id->idVendor);
80672 @@ -368,7 +368,7 @@ static void do_pnp_device_entry(void *sy
80673 for (i = 0; i < count; i++) {
80674 const char *id = (char *)devs[i].id;
80675 char acpi_id[sizeof(devs[0].id)];
80676 - int j;
80677 + unsigned int j;
80678
80679 buf_printf(&mod->dev_table_buf,
80680 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
80681 @@ -398,7 +398,7 @@ static void do_pnp_card_entries(void *sy
80682
80683 for (j = 0; j < PNP_MAX_DEVICES; j++) {
80684 const char *id = (char *)card->devs[j].id;
80685 - int i2, j2;
80686 + unsigned int i2, j2;
80687 int dup = 0;
80688
80689 if (!id[0])
80690 @@ -424,7 +424,7 @@ static void do_pnp_card_entries(void *sy
80691 /* add an individual alias for every device entry */
80692 if (!dup) {
80693 char acpi_id[sizeof(card->devs[0].id)];
80694 - int k;
80695 + unsigned int k;
80696
80697 buf_printf(&mod->dev_table_buf,
80698 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
80699 @@ -699,7 +699,7 @@ static void dmi_ascii_filter(char *d, co
80700 static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
80701 char *alias)
80702 {
80703 - int i, j;
80704 + unsigned int i, j;
80705
80706 sprintf(alias, "dmi*");
80707
80708 diff -urNp linux-2.6.32.49/scripts/mod/modpost.c linux-2.6.32.49/scripts/mod/modpost.c
80709 --- linux-2.6.32.49/scripts/mod/modpost.c 2011-11-08 19:02:43.000000000 -0500
80710 +++ linux-2.6.32.49/scripts/mod/modpost.c 2011-11-15 19:59:43.000000000 -0500
80711 @@ -835,6 +835,7 @@ enum mismatch {
80712 INIT_TO_EXIT,
80713 EXIT_TO_INIT,
80714 EXPORT_TO_INIT_EXIT,
80715 + DATA_TO_TEXT
80716 };
80717
80718 struct sectioncheck {
80719 @@ -920,6 +921,12 @@ const struct sectioncheck sectioncheck[]
80720 .fromsec = { "__ksymtab*", NULL },
80721 .tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
80722 .mismatch = EXPORT_TO_INIT_EXIT
80723 +},
80724 +/* Do not reference code from writable data */
80725 +{
80726 + .fromsec = { DATA_SECTIONS, NULL },
80727 + .tosec = { TEXT_SECTIONS, NULL },
80728 + .mismatch = DATA_TO_TEXT
80729 }
80730 };
80731
80732 @@ -1024,10 +1031,10 @@ static Elf_Sym *find_elf_symbol(struct e
80733 continue;
80734 if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
80735 continue;
80736 - if (sym->st_value == addr)
80737 - return sym;
80738 /* Find a symbol nearby - addr are maybe negative */
80739 d = sym->st_value - addr;
80740 + if (d == 0)
80741 + return sym;
80742 if (d < 0)
80743 d = addr - sym->st_value;
80744 if (d < distance) {
80745 @@ -1268,6 +1275,14 @@ static void report_sec_mismatch(const ch
80746 "Fix this by removing the %sannotation of %s "
80747 "or drop the export.\n",
80748 tosym, sec2annotation(tosec), sec2annotation(tosec), tosym);
80749 + case DATA_TO_TEXT:
80750 +/*
80751 + fprintf(stderr,
80752 + "The variable %s references\n"
80753 + "the %s %s%s%s\n",
80754 + fromsym, to, sec2annotation(tosec), tosym, to_p);
80755 +*/
80756 + break;
80757 case NO_MISMATCH:
80758 /* To get warnings on missing members */
80759 break;
80760 @@ -1495,7 +1510,7 @@ static void section_rel(const char *modn
80761 static void check_sec_ref(struct module *mod, const char *modname,
80762 struct elf_info *elf)
80763 {
80764 - int i;
80765 + unsigned int i;
80766 Elf_Shdr *sechdrs = elf->sechdrs;
80767
80768 /* Walk through all sections */
80769 @@ -1651,7 +1666,7 @@ void __attribute__((format(printf, 2, 3)
80770 va_end(ap);
80771 }
80772
80773 -void buf_write(struct buffer *buf, const char *s, int len)
80774 +void buf_write(struct buffer *buf, const char *s, unsigned int len)
80775 {
80776 if (buf->size - buf->pos < len) {
80777 buf->size += len + SZ;
80778 @@ -1863,7 +1878,7 @@ static void write_if_changed(struct buff
80779 if (fstat(fileno(file), &st) < 0)
80780 goto close_write;
80781
80782 - if (st.st_size != b->pos)
80783 + if (st.st_size != (off_t)b->pos)
80784 goto close_write;
80785
80786 tmp = NOFAIL(malloc(b->pos));
80787 diff -urNp linux-2.6.32.49/scripts/mod/modpost.h linux-2.6.32.49/scripts/mod/modpost.h
80788 --- linux-2.6.32.49/scripts/mod/modpost.h 2011-11-08 19:02:43.000000000 -0500
80789 +++ linux-2.6.32.49/scripts/mod/modpost.h 2011-11-15 19:59:43.000000000 -0500
80790 @@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
80791
80792 struct buffer {
80793 char *p;
80794 - int pos;
80795 - int size;
80796 + unsigned int pos;
80797 + unsigned int size;
80798 };
80799
80800 void __attribute__((format(printf, 2, 3)))
80801 buf_printf(struct buffer *buf, const char *fmt, ...);
80802
80803 void
80804 -buf_write(struct buffer *buf, const char *s, int len);
80805 +buf_write(struct buffer *buf, const char *s, unsigned int len);
80806
80807 struct module {
80808 struct module *next;
80809 diff -urNp linux-2.6.32.49/scripts/mod/sumversion.c linux-2.6.32.49/scripts/mod/sumversion.c
80810 --- linux-2.6.32.49/scripts/mod/sumversion.c 2011-11-08 19:02:43.000000000 -0500
80811 +++ linux-2.6.32.49/scripts/mod/sumversion.c 2011-11-15 19:59:43.000000000 -0500
80812 @@ -455,7 +455,7 @@ static void write_version(const char *fi
80813 goto out;
80814 }
80815
80816 - if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
80817 + if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
80818 warn("writing sum in %s failed: %s\n",
80819 filename, strerror(errno));
80820 goto out;
80821 diff -urNp linux-2.6.32.49/scripts/package/mkspec linux-2.6.32.49/scripts/package/mkspec
80822 --- linux-2.6.32.49/scripts/package/mkspec 2011-11-08 19:02:43.000000000 -0500
80823 +++ linux-2.6.32.49/scripts/package/mkspec 2011-11-15 19:59:43.000000000 -0500
80824 @@ -70,7 +70,7 @@ echo 'mkdir -p $RPM_BUILD_ROOT/boot $RPM
80825 echo 'mkdir -p $RPM_BUILD_ROOT/lib/firmware'
80826 echo "%endif"
80827
80828 -echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{_smp_mflags} KBUILD_SRC= modules_install'
80829 +echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{?_smp_mflags} KBUILD_SRC= modules_install'
80830 echo "%ifarch ia64"
80831 echo 'cp $KBUILD_IMAGE $RPM_BUILD_ROOT'"/boot/efi/vmlinuz-$KERNELRELEASE"
80832 echo 'ln -s '"efi/vmlinuz-$KERNELRELEASE" '$RPM_BUILD_ROOT'"/boot/"
80833 diff -urNp linux-2.6.32.49/scripts/pnmtologo.c linux-2.6.32.49/scripts/pnmtologo.c
80834 --- linux-2.6.32.49/scripts/pnmtologo.c 2011-11-08 19:02:43.000000000 -0500
80835 +++ linux-2.6.32.49/scripts/pnmtologo.c 2011-11-15 19:59:43.000000000 -0500
80836 @@ -237,14 +237,14 @@ static void write_header(void)
80837 fprintf(out, " * Linux logo %s\n", logoname);
80838 fputs(" */\n\n", out);
80839 fputs("#include <linux/linux_logo.h>\n\n", out);
80840 - fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
80841 + fprintf(out, "static unsigned char %s_data[] = {\n",
80842 logoname);
80843 }
80844
80845 static void write_footer(void)
80846 {
80847 fputs("\n};\n\n", out);
80848 - fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
80849 + fprintf(out, "const struct linux_logo %s = {\n", logoname);
80850 fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
80851 fprintf(out, "\t.width\t\t= %d,\n", logo_width);
80852 fprintf(out, "\t.height\t\t= %d,\n", logo_height);
80853 @@ -374,7 +374,7 @@ static void write_logo_clut224(void)
80854 fputs("\n};\n\n", out);
80855
80856 /* write logo clut */
80857 - fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
80858 + fprintf(out, "static unsigned char %s_clut[] = {\n",
80859 logoname);
80860 write_hex_cnt = 0;
80861 for (i = 0; i < logo_clutsize; i++) {
80862 diff -urNp linux-2.6.32.49/scripts/tags.sh linux-2.6.32.49/scripts/tags.sh
80863 --- linux-2.6.32.49/scripts/tags.sh 2011-11-08 19:02:43.000000000 -0500
80864 +++ linux-2.6.32.49/scripts/tags.sh 2011-11-15 19:59:43.000000000 -0500
80865 @@ -93,6 +93,11 @@ docscope()
80866 cscope -b -f cscope.out
80867 }
80868
80869 +dogtags()
80870 +{
80871 + all_sources | gtags -f -
80872 +}
80873 +
80874 exuberant()
80875 {
80876 all_sources | xargs $1 -a \
80877 @@ -164,6 +169,10 @@ case "$1" in
80878 docscope
80879 ;;
80880
80881 + "gtags")
80882 + dogtags
80883 + ;;
80884 +
80885 "tags")
80886 rm -f tags
80887 xtags ctags
80888 diff -urNp linux-2.6.32.49/security/capability.c linux-2.6.32.49/security/capability.c
80889 --- linux-2.6.32.49/security/capability.c 2011-11-08 19:02:43.000000000 -0500
80890 +++ linux-2.6.32.49/security/capability.c 2011-11-15 19:59:43.000000000 -0500
80891 @@ -890,7 +890,7 @@ static void cap_audit_rule_free(void *ls
80892 }
80893 #endif /* CONFIG_AUDIT */
80894
80895 -struct security_operations default_security_ops = {
80896 +struct security_operations default_security_ops __read_only = {
80897 .name = "default",
80898 };
80899
80900 diff -urNp linux-2.6.32.49/security/commoncap.c linux-2.6.32.49/security/commoncap.c
80901 --- linux-2.6.32.49/security/commoncap.c 2011-11-08 19:02:43.000000000 -0500
80902 +++ linux-2.6.32.49/security/commoncap.c 2011-11-15 19:59:43.000000000 -0500
80903 @@ -27,7 +27,7 @@
80904 #include <linux/sched.h>
80905 #include <linux/prctl.h>
80906 #include <linux/securebits.h>
80907 -
80908 +#include <net/sock.h>
80909 /*
80910 * If a non-root user executes a setuid-root binary in
80911 * !secure(SECURE_NOROOT) mode, then we raise capabilities.
80912 @@ -50,9 +50,18 @@ static void warn_setuid_and_fcaps_mixed(
80913 }
80914 }
80915
80916 +#ifdef CONFIG_NET
80917 +extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
80918 +#endif
80919 +
80920 int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
80921 {
80922 +#ifdef CONFIG_NET
80923 + NETLINK_CB(skb).eff_cap = gr_cap_rtnetlink(sk);
80924 +#else
80925 NETLINK_CB(skb).eff_cap = current_cap();
80926 +#endif
80927 +
80928 return 0;
80929 }
80930
80931 @@ -582,6 +591,9 @@ int cap_bprm_secureexec(struct linux_bin
80932 {
80933 const struct cred *cred = current_cred();
80934
80935 + if (gr_acl_enable_at_secure())
80936 + return 1;
80937 +
80938 if (cred->uid != 0) {
80939 if (bprm->cap_effective)
80940 return 1;
80941 diff -urNp linux-2.6.32.49/security/integrity/ima/ima_api.c linux-2.6.32.49/security/integrity/ima/ima_api.c
80942 --- linux-2.6.32.49/security/integrity/ima/ima_api.c 2011-11-08 19:02:43.000000000 -0500
80943 +++ linux-2.6.32.49/security/integrity/ima/ima_api.c 2011-11-15 19:59:43.000000000 -0500
80944 @@ -74,7 +74,7 @@ void ima_add_violation(struct inode *ino
80945 int result;
80946
80947 /* can overflow, only indicator */
80948 - atomic_long_inc(&ima_htable.violations);
80949 + atomic_long_inc_unchecked(&ima_htable.violations);
80950
80951 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
80952 if (!entry) {
80953 diff -urNp linux-2.6.32.49/security/integrity/ima/ima_fs.c linux-2.6.32.49/security/integrity/ima/ima_fs.c
80954 --- linux-2.6.32.49/security/integrity/ima/ima_fs.c 2011-11-08 19:02:43.000000000 -0500
80955 +++ linux-2.6.32.49/security/integrity/ima/ima_fs.c 2011-11-15 19:59:43.000000000 -0500
80956 @@ -27,12 +27,12 @@
80957 static int valid_policy = 1;
80958 #define TMPBUFLEN 12
80959 static ssize_t ima_show_htable_value(char __user *buf, size_t count,
80960 - loff_t *ppos, atomic_long_t *val)
80961 + loff_t *ppos, atomic_long_unchecked_t *val)
80962 {
80963 char tmpbuf[TMPBUFLEN];
80964 ssize_t len;
80965
80966 - len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
80967 + len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
80968 return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
80969 }
80970
80971 diff -urNp linux-2.6.32.49/security/integrity/ima/ima.h linux-2.6.32.49/security/integrity/ima/ima.h
80972 --- linux-2.6.32.49/security/integrity/ima/ima.h 2011-11-08 19:02:43.000000000 -0500
80973 +++ linux-2.6.32.49/security/integrity/ima/ima.h 2011-11-15 19:59:43.000000000 -0500
80974 @@ -84,8 +84,8 @@ void ima_add_violation(struct inode *ino
80975 extern spinlock_t ima_queue_lock;
80976
80977 struct ima_h_table {
80978 - atomic_long_t len; /* number of stored measurements in the list */
80979 - atomic_long_t violations;
80980 + atomic_long_unchecked_t len; /* number of stored measurements in the list */
80981 + atomic_long_unchecked_t violations;
80982 struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
80983 };
80984 extern struct ima_h_table ima_htable;
80985 diff -urNp linux-2.6.32.49/security/integrity/ima/ima_queue.c linux-2.6.32.49/security/integrity/ima/ima_queue.c
80986 --- linux-2.6.32.49/security/integrity/ima/ima_queue.c 2011-11-08 19:02:43.000000000 -0500
80987 +++ linux-2.6.32.49/security/integrity/ima/ima_queue.c 2011-11-15 19:59:43.000000000 -0500
80988 @@ -78,7 +78,7 @@ static int ima_add_digest_entry(struct i
80989 INIT_LIST_HEAD(&qe->later);
80990 list_add_tail_rcu(&qe->later, &ima_measurements);
80991
80992 - atomic_long_inc(&ima_htable.len);
80993 + atomic_long_inc_unchecked(&ima_htable.len);
80994 key = ima_hash_key(entry->digest);
80995 hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
80996 return 0;
80997 diff -urNp linux-2.6.32.49/security/Kconfig linux-2.6.32.49/security/Kconfig
80998 --- linux-2.6.32.49/security/Kconfig 2011-11-08 19:02:43.000000000 -0500
80999 +++ linux-2.6.32.49/security/Kconfig 2011-11-15 19:59:43.000000000 -0500
81000 @@ -4,6 +4,559 @@
81001
81002 menu "Security options"
81003
81004 +source grsecurity/Kconfig
81005 +
81006 +menu "PaX"
81007 +
81008 + config ARCH_TRACK_EXEC_LIMIT
81009 + bool
81010 +
81011 + config PAX_KERNEXEC_PLUGIN
81012 + bool
81013 +
81014 + config PAX_PER_CPU_PGD
81015 + bool
81016 +
81017 + config TASK_SIZE_MAX_SHIFT
81018 + int
81019 + depends on X86_64
81020 + default 47 if !PAX_PER_CPU_PGD
81021 + default 42 if PAX_PER_CPU_PGD
81022 +
81023 + config PAX_ENABLE_PAE
81024 + bool
81025 + default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
81026 +
81027 +config PAX
81028 + bool "Enable various PaX features"
81029 + depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
81030 + help
81031 + This allows you to enable various PaX features. PaX adds
81032 + intrusion prevention mechanisms to the kernel that reduce
81033 + the risks posed by exploitable memory corruption bugs.
81034 +
81035 +menu "PaX Control"
81036 + depends on PAX
81037 +
81038 +config PAX_SOFTMODE
81039 + bool 'Support soft mode'
81040 + select PAX_PT_PAX_FLAGS
81041 + help
81042 + Enabling this option will allow you to run PaX in soft mode, that
81043 + is, PaX features will not be enforced by default, only on executables
81044 + marked explicitly. You must also enable PT_PAX_FLAGS support as it
81045 + is the only way to mark executables for soft mode use.
81046 +
81047 + Soft mode can be activated by using the "pax_softmode=1" kernel command
81048 + line option on boot. Furthermore you can control various PaX features
81049 + at runtime via the entries in /proc/sys/kernel/pax.
81050 +
81051 +config PAX_EI_PAX
81052 + bool 'Use legacy ELF header marking'
81053 + help
81054 + Enabling this option will allow you to control PaX features on
81055 + a per executable basis via the 'chpax' utility available at
81056 + http://pax.grsecurity.net/. The control flags will be read from
81057 + an otherwise reserved part of the ELF header. This marking has
81058 + numerous drawbacks (no support for soft-mode, toolchain does not
81059 + know about the non-standard use of the ELF header) therefore it
81060 + has been deprecated in favour of PT_PAX_FLAGS support.
81061 +
81062 + Note that if you enable PT_PAX_FLAGS marking support as well,
81063 + the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
81064 +
81065 +config PAX_PT_PAX_FLAGS
81066 + bool 'Use ELF program header marking'
81067 + help
81068 + Enabling this option will allow you to control PaX features on
81069 + a per executable basis via the 'paxctl' utility available at
81070 + http://pax.grsecurity.net/. The control flags will be read from
81071 + a PaX specific ELF program header (PT_PAX_FLAGS). This marking
81072 + has the benefits of supporting both soft mode and being fully
81073 + integrated into the toolchain (the binutils patch is available
81074 + from http://pax.grsecurity.net).
81075 +
81076 + If your toolchain does not support PT_PAX_FLAGS markings,
81077 + you can create one in most cases with 'paxctl -C'.
81078 +
81079 + Note that if you enable the legacy EI_PAX marking support as well,
81080 + the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
81081 +
81082 +choice
81083 + prompt 'MAC system integration'
81084 + default PAX_HAVE_ACL_FLAGS
81085 + help
81086 + Mandatory Access Control systems have the option of controlling
81087 + PaX flags on a per executable basis, choose the method supported
81088 + by your particular system.
81089 +
81090 + - "none": if your MAC system does not interact with PaX,
81091 + - "direct": if your MAC system defines pax_set_initial_flags() itself,
81092 + - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
81093 +
81094 + NOTE: this option is for developers/integrators only.
81095 +
81096 + config PAX_NO_ACL_FLAGS
81097 + bool 'none'
81098 +
81099 + config PAX_HAVE_ACL_FLAGS
81100 + bool 'direct'
81101 +
81102 + config PAX_HOOK_ACL_FLAGS
81103 + bool 'hook'
81104 +endchoice
81105 +
81106 +endmenu
81107 +
81108 +menu "Non-executable pages"
81109 + depends on PAX
81110 +
81111 +config PAX_NOEXEC
81112 + bool "Enforce non-executable pages"
81113 + depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86)
81114 + help
81115 + By design some architectures do not allow for protecting memory
81116 + pages against execution or even if they do, Linux does not make
81117 + use of this feature. In practice this means that if a page is
81118 + readable (such as the stack or heap) it is also executable.
81119 +
81120 + There is a well known exploit technique that makes use of this
81121 + fact and a common programming mistake where an attacker can
81122 + introduce code of his choice somewhere in the attacked program's
81123 + memory (typically the stack or the heap) and then execute it.
81124 +
81125 + If the attacked program was running with different (typically
81126 + higher) privileges than that of the attacker, then he can elevate
81127 + his own privilege level (e.g. get a root shell, write to files for
81128 + which he does not have write access to, etc).
81129 +
81130 + Enabling this option will let you choose from various features
81131 + that prevent the injection and execution of 'foreign' code in
81132 + a program.
81133 +
81134 + This will also break programs that rely on the old behaviour and
81135 + expect that dynamically allocated memory via the malloc() family
81136 + of functions is executable (which it is not). Notable examples
81137 + are the XFree86 4.x server, the java runtime and wine.
81138 +
81139 +config PAX_PAGEEXEC
81140 + bool "Paging based non-executable pages"
81141 + depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
81142 + select S390_SWITCH_AMODE if S390
81143 + select S390_EXEC_PROTECT if S390
81144 + select ARCH_TRACK_EXEC_LIMIT if X86_32
81145 + help
81146 + This implementation is based on the paging feature of the CPU.
81147 + On i386 without hardware non-executable bit support there is a
81148 + variable but usually low performance impact, however on Intel's
81149 + P4 core based CPUs it is very high so you should not enable this
81150 + for kernels meant to be used on such CPUs.
81151 +
81152 + On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
81153 + with hardware non-executable bit support there is no performance
81154 + impact, on ppc the impact is negligible.
81155 +
81156 + Note that several architectures require various emulations due to
81157 + badly designed userland ABIs, this will cause a performance impact
81158 + but will disappear as soon as userland is fixed. For example, ppc
81159 + userland MUST have been built with secure-plt by a recent toolchain.
81160 +
81161 +config PAX_SEGMEXEC
81162 + bool "Segmentation based non-executable pages"
81163 + depends on PAX_NOEXEC && X86_32
81164 + help
81165 + This implementation is based on the segmentation feature of the
81166 + CPU and has a very small performance impact, however applications
81167 + will be limited to a 1.5 GB address space instead of the normal
81168 + 3 GB.
81169 +
81170 +config PAX_EMUTRAMP
81171 + bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
81172 + default y if PARISC
81173 + help
81174 + There are some programs and libraries that for one reason or
81175 + another attempt to execute special small code snippets from
81176 + non-executable memory pages. Most notable examples are the
81177 + signal handler return code generated by the kernel itself and
81178 + the GCC trampolines.
81179 +
81180 + If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
81181 + such programs will no longer work under your kernel.
81182 +
81183 + As a remedy you can say Y here and use the 'chpax' or 'paxctl'
81184 + utilities to enable trampoline emulation for the affected programs
81185 + yet still have the protection provided by the non-executable pages.
81186 +
81187 + On parisc you MUST enable this option and EMUSIGRT as well, otherwise
81188 + your system will not even boot.
81189 +
81190 + Alternatively you can say N here and use the 'chpax' or 'paxctl'
81191 + utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
81192 + for the affected files.
81193 +
81194 + NOTE: enabling this feature *may* open up a loophole in the
81195 + protection provided by non-executable pages that an attacker
81196 + could abuse. Therefore the best solution is to not have any
81197 + files on your system that would require this option. This can
81198 + be achieved by not using libc5 (which relies on the kernel
81199 + signal handler return code) and not using or rewriting programs
81200 + that make use of the nested function implementation of GCC.
81201 + Skilled users can just fix GCC itself so that it implements
81202 + nested function calls in a way that does not interfere with PaX.
81203 +
81204 +config PAX_EMUSIGRT
81205 + bool "Automatically emulate sigreturn trampolines"
81206 + depends on PAX_EMUTRAMP && PARISC
81207 + default y
81208 + help
81209 + Enabling this option will have the kernel automatically detect
81210 + and emulate signal return trampolines executing on the stack
81211 + that would otherwise lead to task termination.
81212 +
81213 + This solution is intended as a temporary one for users with
81214 + legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
81215 + Modula-3 runtime, etc) or executables linked to such, basically
81216 + everything that does not specify its own SA_RESTORER function in
81217 + normal executable memory like glibc 2.1+ does.
81218 +
81219 + On parisc you MUST enable this option, otherwise your system will
81220 + not even boot.
81221 +
81222 + NOTE: this feature cannot be disabled on a per executable basis
81223 + and since it *does* open up a loophole in the protection provided
81224 + by non-executable pages, the best solution is to not have any
81225 + files on your system that would require this option.
81226 +
81227 +config PAX_MPROTECT
81228 + bool "Restrict mprotect()"
81229 + depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
81230 + help
81231 + Enabling this option will prevent programs from
81232 + - changing the executable status of memory pages that were
81233 + not originally created as executable,
81234 + - making read-only executable pages writable again,
81235 + - creating executable pages from anonymous memory,
81236 + - making read-only-after-relocations (RELRO) data pages writable again.
81237 +
81238 + You should say Y here to complete the protection provided by
81239 + the enforcement of non-executable pages.
81240 +
81241 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
81242 + this feature on a per file basis.
81243 +
81244 +config PAX_MPROTECT_COMPAT
81245 + bool "Use legacy/compat protection demoting (read help)"
81246 + depends on PAX_MPROTECT
81247 + default n
81248 + help
81249 + The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
81250 + by sending the proper error code to the application. For some broken
81251 + userland, this can cause problems with Python or other applications. The
81252 + current implementation however allows for applications like clamav to
81253 + detect if JIT compilation/execution is allowed and to fall back gracefully
81254 + to an interpreter-based mode if it does not. While we encourage everyone
81255 + to use the current implementation as-is and push upstream to fix broken
81256 + userland (note that the RWX logging option can assist with this), in some
81257 + environments this may not be possible. Having to disable MPROTECT
81258 + completely on certain binaries reduces the security benefit of PaX,
81259 + so this option is provided for those environments to revert to the old
81260 + behavior.
81261 +
81262 +config PAX_ELFRELOCS
81263 + bool "Allow ELF text relocations (read help)"
81264 + depends on PAX_MPROTECT
81265 + default n
81266 + help
81267 + Non-executable pages and mprotect() restrictions are effective
81268 + in preventing the introduction of new executable code into an
81269 + attacked task's address space. There remain only two venues
81270 + for this kind of attack: if the attacker can execute already
81271 + existing code in the attacked task then he can either have it
81272 + create and mmap() a file containing his code or have it mmap()
81273 + an already existing ELF library that does not have position
81274 + independent code in it and use mprotect() on it to make it
81275 + writable and copy his code there. While protecting against
81276 + the former approach is beyond PaX, the latter can be prevented
81277 + by having only PIC ELF libraries on one's system (which do not
81278 + need to relocate their code). If you are sure this is your case,
81279 + as is the case with all modern Linux distributions, then leave
81280 + this option disabled. You should say 'n' here.
81281 +
81282 +config PAX_ETEXECRELOCS
81283 + bool "Allow ELF ET_EXEC text relocations"
81284 + depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
81285 + select PAX_ELFRELOCS
81286 + default y
81287 + help
81288 + On some architectures there are incorrectly created applications
81289 + that require text relocations and would not work without enabling
81290 + this option. If you are an alpha, ia64 or parisc user, you should
81291 + enable this option and disable it once you have made sure that
81292 + none of your applications need it.
81293 +
81294 +config PAX_EMUPLT
81295 + bool "Automatically emulate ELF PLT"
81296 + depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
81297 + default y
81298 + help
81299 + Enabling this option will have the kernel automatically detect
81300 + and emulate the Procedure Linkage Table entries in ELF files.
81301 + On some architectures such entries are in writable memory, and
81302 + become non-executable leading to task termination. Therefore
81303 + it is mandatory that you enable this option on alpha, parisc,
81304 + sparc and sparc64, otherwise your system would not even boot.
81305 +
81306 + NOTE: this feature *does* open up a loophole in the protection
81307 + provided by the non-executable pages, therefore the proper
81308 + solution is to modify the toolchain to produce a PLT that does
81309 + not need to be writable.
81310 +
81311 +config PAX_DLRESOLVE
81312 + bool 'Emulate old glibc resolver stub'
81313 + depends on PAX_EMUPLT && SPARC
81314 + default n
81315 + help
81316 + This option is needed if userland has an old glibc (before 2.4)
81317 + that puts a 'save' instruction into the runtime generated resolver
81318 + stub that needs special emulation.
81319 +
81320 +config PAX_KERNEXEC
81321 + bool "Enforce non-executable kernel pages"
81322 + depends on (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
81323 + select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
81324 + select PAX_KERNEXEC_PLUGIN if X86_64
81325 + help
81326 + This is the kernel land equivalent of PAGEEXEC and MPROTECT,
81327 + that is, enabling this option will make it harder to inject
81328 + and execute 'foreign' code in kernel memory itself.
81329 +
81330 + Note that on x86_64 kernels there is a known regression when
81331 + this feature and KVM/VMX are both enabled in the host kernel.
81332 +
81333 +config PAX_KERNEXEC_MODULE_TEXT
81334 + int "Minimum amount of memory reserved for module code"
81335 + default "4"
81336 + depends on PAX_KERNEXEC && X86_32 && MODULES
81337 + help
81338 + Due to implementation details the kernel must reserve a fixed
81339 + amount of memory for module code at compile time that cannot be
81340 + changed at runtime. Here you can specify the minimum amount
81341 + in MB that will be reserved. Due to the same implementation
81342 + details this size will always be rounded up to the next 2/4 MB
81343 + boundary (depends on PAE) so the actually available memory for
81344 + module code will usually be more than this minimum.
81345 +
81346 + The default 4 MB should be enough for most users but if you have
81347 + an excessive number of modules (e.g., most distribution configs
81348 + compile many drivers as modules) or use huge modules such as
81349 + nvidia's kernel driver, you will need to adjust this amount.
81350 + A good rule of thumb is to look at your currently loaded kernel
81351 + modules and add up their sizes.
81352 +
81353 +endmenu
81354 +
81355 +menu "Address Space Layout Randomization"
81356 + depends on PAX
81357 +
81358 +config PAX_ASLR
81359 + bool "Address Space Layout Randomization"
81360 + depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
81361 + help
81362 + Many if not most exploit techniques rely on the knowledge of
81363 + certain addresses in the attacked program. The following options
81364 + will allow the kernel to apply a certain amount of randomization
81365 + to specific parts of the program thereby forcing an attacker to
81366 + guess them in most cases. Any failed guess will most likely crash
81367 + the attacked program which allows the kernel to detect such attempts
81368 + and react on them. PaX itself provides no reaction mechanisms,
81369 + instead it is strongly encouraged that you make use of Nergal's
81370 + segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
81371 + (http://www.grsecurity.net/) built-in crash detection features or
81372 + develop one yourself.
81373 +
81374 + By saying Y here you can choose to randomize the following areas:
81375 + - top of the task's kernel stack
81376 + - top of the task's userland stack
81377 + - base address for mmap() requests that do not specify one
81378 + (this includes all libraries)
81379 + - base address of the main executable
81380 +
81381 + It is strongly recommended to say Y here as address space layout
81382 + randomization has negligible impact on performance yet it provides
81383 + a very effective protection.
81384 +
81385 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
81386 + this feature on a per file basis.
81387 +
81388 +config PAX_RANDKSTACK
81389 + bool "Randomize kernel stack base"
81390 + depends on X86_TSC && X86
81391 + help
81392 + By saying Y here the kernel will randomize every task's kernel
81393 + stack on every system call. This will not only force an attacker
81394 + to guess it but also prevent him from making use of possible
81395 + leaked information about it.
81396 +
81397 + Since the kernel stack is a rather scarce resource, randomization
81398 + may cause unexpected stack overflows, therefore you should very
81399 + carefully test your system. Note that once enabled in the kernel
81400 + configuration, this feature cannot be disabled on a per file basis.
81401 +
81402 +config PAX_RANDUSTACK
81403 + bool "Randomize user stack base"
81404 + depends on PAX_ASLR
81405 + help
81406 + By saying Y here the kernel will randomize every task's userland
81407 + stack. The randomization is done in two steps where the second
81408 + one may apply a big amount of shift to the top of the stack and
81409 + cause problems for programs that want to use lots of memory (more
81410 + than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
81411 + For this reason the second step can be controlled by 'chpax' or
81412 + 'paxctl' on a per file basis.
81413 +
81414 +config PAX_RANDMMAP
81415 + bool "Randomize mmap() base"
81416 + depends on PAX_ASLR
81417 + help
81418 + By saying Y here the kernel will use a randomized base address for
81419 + mmap() requests that do not specify one themselves. As a result
81420 + all dynamically loaded libraries will appear at random addresses
81421 + and therefore be harder to exploit by a technique where an attacker
81422 + attempts to execute library code for his purposes (e.g. spawn a
81423 + shell from an exploited program that is running at an elevated
81424 + privilege level).
81425 +
81426 + Furthermore, if a program is relinked as a dynamic ELF file, its
81427 + base address will be randomized as well, completing the full
81428 + randomization of the address space layout. Attacking such programs
81429 + becomes a guess game. You can find an example of doing this at
81430 + http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
81431 + http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
81432 +
81433 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
81434 + feature on a per file basis.
81435 +
81436 +endmenu
81437 +
81438 +menu "Miscellaneous hardening features"
81439 +
81440 +config PAX_MEMORY_SANITIZE
81441 + bool "Sanitize all freed memory"
81442 + help
81443 + By saying Y here the kernel will erase memory pages as soon as they
81444 + are freed. This in turn reduces the lifetime of data stored in the
81445 + pages, making it less likely that sensitive information such as
81446 + passwords, cryptographic secrets, etc stay in memory for too long.
81447 +
81448 + This is especially useful for programs whose runtime is short, long
81449 + lived processes and the kernel itself benefit from this as long as
81450 + they operate on whole memory pages and ensure timely freeing of pages
81451 + that may hold sensitive information.
81452 +
81453 + The tradeoff is performance impact, on a single CPU system kernel
81454 + compilation sees a 3% slowdown, other systems and workloads may vary
81455 + and you are advised to test this feature on your expected workload
81456 + before deploying it.
81457 +
81458 + Note that this feature does not protect data stored in live pages,
81459 + e.g., process memory swapped to disk may stay there for a long time.
81460 +
81461 +config PAX_MEMORY_STACKLEAK
81462 + bool "Sanitize kernel stack"
81463 + depends on X86
81464 + help
81465 + By saying Y here the kernel will erase the kernel stack before it
81466 + returns from a system call. This in turn reduces the information
81467 + that a kernel stack leak bug can reveal.
81468 +
81469 + Note that such a bug can still leak information that was put on
81470 + the stack by the current system call (the one eventually triggering
81471 + the bug) but traces of earlier system calls on the kernel stack
81472 + cannot leak anymore.
81473 +
81474 + The tradeoff is performance impact, on a single CPU system kernel
81475 + compilation sees a 1% slowdown, other systems and workloads may vary
81476 + and you are advised to test this feature on your expected workload
81477 + before deploying it.
81478 +
81479 + Note: full support for this feature requires gcc with plugin support
81480 + so make sure your compiler is at least gcc 4.5.0 (cross compilation
81481 + is not supported). Using older gcc versions means that functions
81482 + with large enough stack frames may leave uninitialized memory behind
81483 + that may be exposed to a later syscall leaking the stack.
81484 +
81485 +config PAX_MEMORY_UDEREF
81486 + bool "Prevent invalid userland pointer dereference"
81487 + depends on X86 && !UML_X86 && !XEN
81488 + select PAX_PER_CPU_PGD if X86_64
81489 + help
81490 + By saying Y here the kernel will be prevented from dereferencing
81491 + userland pointers in contexts where the kernel expects only kernel
81492 + pointers. This is both a useful runtime debugging feature and a
81493 + security measure that prevents exploiting a class of kernel bugs.
81494 +
81495 + The tradeoff is that some virtualization solutions may experience
81496 + a huge slowdown and therefore you should not enable this feature
81497 + for kernels meant to run in such environments. Whether a given VM
81498 + solution is affected or not is best determined by simply trying it
81499 + out, the performance impact will be obvious right on boot as this
81500 + mechanism engages from very early on. A good rule of thumb is that
81501 + VMs running on CPUs without hardware virtualization support (i.e.,
81502 + the majority of IA-32 CPUs) will likely experience the slowdown.
81503 +
81504 +config PAX_REFCOUNT
81505 + bool "Prevent various kernel object reference counter overflows"
81506 + depends on GRKERNSEC && (X86 || SPARC64)
81507 + help
81508 + By saying Y here the kernel will detect and prevent overflowing
81509 + various (but not all) kinds of object reference counters. Such
81510 + overflows can normally occur due to bugs only and are often, if
81511 + not always, exploitable.
81512 +
81513 + The tradeoff is that data structures protected by an overflowed
81514 + refcount will never be freed and therefore will leak memory. Note
81515 + that this leak also happens even without this protection but in
81516 + that case the overflow can eventually trigger the freeing of the
81517 + data structure while it is still being used elsewhere, resulting
81518 + in the exploitable situation that this feature prevents.
81519 +
81520 + Since this has a negligible performance impact, you should enable
81521 + this feature.
81522 +
81523 +config PAX_USERCOPY
81524 + bool "Harden heap object copies between kernel and userland"
81525 + depends on X86 || PPC || SPARC || ARM
81526 + depends on GRKERNSEC && (SLAB || SLUB || SLOB)
81527 + help
81528 + By saying Y here the kernel will enforce the size of heap objects
81529 + when they are copied in either direction between the kernel and
81530 + userland, even if only a part of the heap object is copied.
81531 +
81532 + Specifically, this checking prevents information leaking from the
81533 + kernel heap during kernel to userland copies (if the kernel heap
81534 + object is otherwise fully initialized) and prevents kernel heap
81535 + overflows during userland to kernel copies.
81536 +
81537 + Note that the current implementation provides the strictest bounds
81538 + checks for the SLUB allocator.
81539 +
81540 + Enabling this option also enables per-slab cache protection against
81541 + data in a given cache being copied into/out of via userland
81542 + accessors. Though the whitelist of regions will be reduced over
81543 + time, it notably protects important data structures like task structs.
81544 +
81545 +
81546 + If frame pointers are enabled on x86, this option will also
81547 + restrict copies into and out of the kernel stack to local variables
81548 + within a single frame.
81549 +
81550 + Since this has a negligible performance impact, you should enable
81551 + this feature.
81552 +
81553 +endmenu
81554 +
81555 +endmenu
81556 +
81557 config KEYS
81558 bool "Enable access key retention support"
81559 help
81560 @@ -146,7 +699,7 @@ config INTEL_TXT
81561 config LSM_MMAP_MIN_ADDR
81562 int "Low address space for LSM to protect from user allocation"
81563 depends on SECURITY && SECURITY_SELINUX
81564 - default 65536
81565 + default 32768
81566 help
81567 This is the portion of low virtual memory which should be protected
81568 from userspace allocation. Keeping a user from writing to low pages
81569 diff -urNp linux-2.6.32.49/security/keys/keyring.c linux-2.6.32.49/security/keys/keyring.c
81570 --- linux-2.6.32.49/security/keys/keyring.c 2011-11-08 19:02:43.000000000 -0500
81571 +++ linux-2.6.32.49/security/keys/keyring.c 2011-11-15 19:59:43.000000000 -0500
81572 @@ -214,15 +214,15 @@ static long keyring_read(const struct ke
81573 ret = -EFAULT;
81574
81575 for (loop = 0; loop < klist->nkeys; loop++) {
81576 + key_serial_t serial;
81577 key = klist->keys[loop];
81578 + serial = key->serial;
81579
81580 tmp = sizeof(key_serial_t);
81581 if (tmp > buflen)
81582 tmp = buflen;
81583
81584 - if (copy_to_user(buffer,
81585 - &key->serial,
81586 - tmp) != 0)
81587 + if (copy_to_user(buffer, &serial, tmp))
81588 goto error;
81589
81590 buflen -= tmp;
81591 diff -urNp linux-2.6.32.49/security/min_addr.c linux-2.6.32.49/security/min_addr.c
81592 --- linux-2.6.32.49/security/min_addr.c 2011-11-08 19:02:43.000000000 -0500
81593 +++ linux-2.6.32.49/security/min_addr.c 2011-11-15 19:59:43.000000000 -0500
81594 @@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
81595 */
81596 static void update_mmap_min_addr(void)
81597 {
81598 +#ifndef SPARC
81599 #ifdef CONFIG_LSM_MMAP_MIN_ADDR
81600 if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
81601 mmap_min_addr = dac_mmap_min_addr;
81602 @@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
81603 #else
81604 mmap_min_addr = dac_mmap_min_addr;
81605 #endif
81606 +#endif
81607 }
81608
81609 /*
81610 diff -urNp linux-2.6.32.49/security/root_plug.c linux-2.6.32.49/security/root_plug.c
81611 --- linux-2.6.32.49/security/root_plug.c 2011-11-08 19:02:43.000000000 -0500
81612 +++ linux-2.6.32.49/security/root_plug.c 2011-11-15 19:59:43.000000000 -0500
81613 @@ -70,7 +70,7 @@ static int rootplug_bprm_check_security
81614 return 0;
81615 }
81616
81617 -static struct security_operations rootplug_security_ops = {
81618 +static struct security_operations rootplug_security_ops __read_only = {
81619 .bprm_check_security = rootplug_bprm_check_security,
81620 };
81621
81622 diff -urNp linux-2.6.32.49/security/security.c linux-2.6.32.49/security/security.c
81623 --- linux-2.6.32.49/security/security.c 2011-11-08 19:02:43.000000000 -0500
81624 +++ linux-2.6.32.49/security/security.c 2011-11-15 19:59:43.000000000 -0500
81625 @@ -24,7 +24,7 @@ static __initdata char chosen_lsm[SECURI
81626 extern struct security_operations default_security_ops;
81627 extern void security_fixup_ops(struct security_operations *ops);
81628
81629 -struct security_operations *security_ops; /* Initialized to NULL */
81630 +struct security_operations *security_ops __read_only; /* Initialized to NULL */
81631
81632 static inline int verify(struct security_operations *ops)
81633 {
81634 @@ -106,7 +106,7 @@ int __init security_module_enable(struct
81635 * If there is already a security module registered with the kernel,
81636 * an error will be returned. Otherwise %0 is returned on success.
81637 */
81638 -int register_security(struct security_operations *ops)
81639 +int __init register_security(struct security_operations *ops)
81640 {
81641 if (verify(ops)) {
81642 printk(KERN_DEBUG "%s could not verify "
81643 diff -urNp linux-2.6.32.49/security/selinux/hooks.c linux-2.6.32.49/security/selinux/hooks.c
81644 --- linux-2.6.32.49/security/selinux/hooks.c 2011-11-08 19:02:43.000000000 -0500
81645 +++ linux-2.6.32.49/security/selinux/hooks.c 2011-11-15 19:59:43.000000000 -0500
81646 @@ -131,7 +131,7 @@ int selinux_enabled = 1;
81647 * Minimal support for a secondary security module,
81648 * just to allow the use of the capability module.
81649 */
81650 -static struct security_operations *secondary_ops;
81651 +static struct security_operations *secondary_ops __read_only;
81652
81653 /* Lists of inode and superblock security structures initialized
81654 before the policy was loaded. */
81655 @@ -5457,7 +5457,7 @@ static int selinux_key_getsecurity(struc
81656
81657 #endif
81658
81659 -static struct security_operations selinux_ops = {
81660 +static struct security_operations selinux_ops __read_only = {
81661 .name = "selinux",
81662
81663 .ptrace_access_check = selinux_ptrace_access_check,
81664 @@ -5841,7 +5841,9 @@ int selinux_disable(void)
81665 avc_disable();
81666
81667 /* Reset security_ops to the secondary module, dummy or capability. */
81668 + pax_open_kernel();
81669 security_ops = secondary_ops;
81670 + pax_close_kernel();
81671
81672 /* Unregister netfilter hooks. */
81673 selinux_nf_ip_exit();
81674 diff -urNp linux-2.6.32.49/security/selinux/include/xfrm.h linux-2.6.32.49/security/selinux/include/xfrm.h
81675 --- linux-2.6.32.49/security/selinux/include/xfrm.h 2011-11-08 19:02:43.000000000 -0500
81676 +++ linux-2.6.32.49/security/selinux/include/xfrm.h 2011-11-15 19:59:43.000000000 -0500
81677 @@ -48,7 +48,7 @@ int selinux_xfrm_decode_session(struct s
81678
81679 static inline void selinux_xfrm_notify_policyload(void)
81680 {
81681 - atomic_inc(&flow_cache_genid);
81682 + atomic_inc_unchecked(&flow_cache_genid);
81683 }
81684 #else
81685 static inline int selinux_xfrm_enabled(void)
81686 diff -urNp linux-2.6.32.49/security/selinux/ss/services.c linux-2.6.32.49/security/selinux/ss/services.c
81687 --- linux-2.6.32.49/security/selinux/ss/services.c 2011-11-08 19:02:43.000000000 -0500
81688 +++ linux-2.6.32.49/security/selinux/ss/services.c 2011-11-15 19:59:43.000000000 -0500
81689 @@ -1715,6 +1715,8 @@ int security_load_policy(void *data, siz
81690 int rc = 0;
81691 struct policy_file file = { data, len }, *fp = &file;
81692
81693 + pax_track_stack();
81694 +
81695 if (!ss_initialized) {
81696 avtab_cache_init();
81697 if (policydb_read(&policydb, fp)) {
81698 diff -urNp linux-2.6.32.49/security/smack/smack_lsm.c linux-2.6.32.49/security/smack/smack_lsm.c
81699 --- linux-2.6.32.49/security/smack/smack_lsm.c 2011-11-08 19:02:43.000000000 -0500
81700 +++ linux-2.6.32.49/security/smack/smack_lsm.c 2011-11-15 19:59:43.000000000 -0500
81701 @@ -3073,7 +3073,7 @@ static int smack_inode_getsecctx(struct
81702 return 0;
81703 }
81704
81705 -struct security_operations smack_ops = {
81706 +struct security_operations smack_ops __read_only = {
81707 .name = "smack",
81708
81709 .ptrace_access_check = smack_ptrace_access_check,
81710 diff -urNp linux-2.6.32.49/security/tomoyo/tomoyo.c linux-2.6.32.49/security/tomoyo/tomoyo.c
81711 --- linux-2.6.32.49/security/tomoyo/tomoyo.c 2011-11-08 19:02:43.000000000 -0500
81712 +++ linux-2.6.32.49/security/tomoyo/tomoyo.c 2011-11-15 19:59:43.000000000 -0500
81713 @@ -275,7 +275,7 @@ static int tomoyo_dentry_open(struct fil
81714 * tomoyo_security_ops is a "struct security_operations" which is used for
81715 * registering TOMOYO.
81716 */
81717 -static struct security_operations tomoyo_security_ops = {
81718 +static struct security_operations tomoyo_security_ops __read_only = {
81719 .name = "tomoyo",
81720 .cred_alloc_blank = tomoyo_cred_alloc_blank,
81721 .cred_prepare = tomoyo_cred_prepare,
81722 diff -urNp linux-2.6.32.49/sound/aoa/codecs/onyx.c linux-2.6.32.49/sound/aoa/codecs/onyx.c
81723 --- linux-2.6.32.49/sound/aoa/codecs/onyx.c 2011-11-08 19:02:43.000000000 -0500
81724 +++ linux-2.6.32.49/sound/aoa/codecs/onyx.c 2011-11-15 19:59:43.000000000 -0500
81725 @@ -53,7 +53,7 @@ struct onyx {
81726 spdif_locked:1,
81727 analog_locked:1,
81728 original_mute:2;
81729 - int open_count;
81730 + local_t open_count;
81731 struct codec_info *codec_info;
81732
81733 /* mutex serializes concurrent access to the device
81734 @@ -752,7 +752,7 @@ static int onyx_open(struct codec_info_i
81735 struct onyx *onyx = cii->codec_data;
81736
81737 mutex_lock(&onyx->mutex);
81738 - onyx->open_count++;
81739 + local_inc(&onyx->open_count);
81740 mutex_unlock(&onyx->mutex);
81741
81742 return 0;
81743 @@ -764,8 +764,7 @@ static int onyx_close(struct codec_info_
81744 struct onyx *onyx = cii->codec_data;
81745
81746 mutex_lock(&onyx->mutex);
81747 - onyx->open_count--;
81748 - if (!onyx->open_count)
81749 + if (local_dec_and_test(&onyx->open_count))
81750 onyx->spdif_locked = onyx->analog_locked = 0;
81751 mutex_unlock(&onyx->mutex);
81752
81753 diff -urNp linux-2.6.32.49/sound/aoa/codecs/onyx.h linux-2.6.32.49/sound/aoa/codecs/onyx.h
81754 --- linux-2.6.32.49/sound/aoa/codecs/onyx.h 2011-11-08 19:02:43.000000000 -0500
81755 +++ linux-2.6.32.49/sound/aoa/codecs/onyx.h 2011-11-15 19:59:43.000000000 -0500
81756 @@ -11,6 +11,7 @@
81757 #include <linux/i2c.h>
81758 #include <asm/pmac_low_i2c.h>
81759 #include <asm/prom.h>
81760 +#include <asm/local.h>
81761
81762 /* PCM3052 register definitions */
81763
81764 diff -urNp linux-2.6.32.49/sound/core/oss/pcm_oss.c linux-2.6.32.49/sound/core/oss/pcm_oss.c
81765 --- linux-2.6.32.49/sound/core/oss/pcm_oss.c 2011-11-08 19:02:43.000000000 -0500
81766 +++ linux-2.6.32.49/sound/core/oss/pcm_oss.c 2011-11-15 19:59:43.000000000 -0500
81767 @@ -1395,7 +1395,7 @@ static ssize_t snd_pcm_oss_write1(struct
81768 }
81769 } else {
81770 tmp = snd_pcm_oss_write2(substream,
81771 - (const char __force *)buf,
81772 + (const char __force_kernel *)buf,
81773 runtime->oss.period_bytes, 0);
81774 if (tmp <= 0)
81775 goto err;
81776 @@ -1483,7 +1483,7 @@ static ssize_t snd_pcm_oss_read1(struct
81777 xfer += tmp;
81778 runtime->oss.buffer_used -= tmp;
81779 } else {
81780 - tmp = snd_pcm_oss_read2(substream, (char __force *)buf,
81781 + tmp = snd_pcm_oss_read2(substream, (char __force_kernel *)buf,
81782 runtime->oss.period_bytes, 0);
81783 if (tmp <= 0)
81784 goto err;
81785 diff -urNp linux-2.6.32.49/sound/core/pcm_compat.c linux-2.6.32.49/sound/core/pcm_compat.c
81786 --- linux-2.6.32.49/sound/core/pcm_compat.c 2011-11-08 19:02:43.000000000 -0500
81787 +++ linux-2.6.32.49/sound/core/pcm_compat.c 2011-11-15 19:59:43.000000000 -0500
81788 @@ -30,7 +30,7 @@ static int snd_pcm_ioctl_delay_compat(st
81789 int err;
81790
81791 fs = snd_enter_user();
81792 - err = snd_pcm_delay(substream, &delay);
81793 + err = snd_pcm_delay(substream, (snd_pcm_sframes_t __force_user *)&delay);
81794 snd_leave_user(fs);
81795 if (err < 0)
81796 return err;
81797 diff -urNp linux-2.6.32.49/sound/core/pcm_native.c linux-2.6.32.49/sound/core/pcm_native.c
81798 --- linux-2.6.32.49/sound/core/pcm_native.c 2011-11-08 19:02:43.000000000 -0500
81799 +++ linux-2.6.32.49/sound/core/pcm_native.c 2011-11-15 19:59:43.000000000 -0500
81800 @@ -2747,11 +2747,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_
81801 switch (substream->stream) {
81802 case SNDRV_PCM_STREAM_PLAYBACK:
81803 result = snd_pcm_playback_ioctl1(NULL, substream, cmd,
81804 - (void __user *)arg);
81805 + (void __force_user *)arg);
81806 break;
81807 case SNDRV_PCM_STREAM_CAPTURE:
81808 result = snd_pcm_capture_ioctl1(NULL, substream, cmd,
81809 - (void __user *)arg);
81810 + (void __force_user *)arg);
81811 break;
81812 default:
81813 result = -EINVAL;
81814 diff -urNp linux-2.6.32.49/sound/core/seq/seq_device.c linux-2.6.32.49/sound/core/seq/seq_device.c
81815 --- linux-2.6.32.49/sound/core/seq/seq_device.c 2011-11-08 19:02:43.000000000 -0500
81816 +++ linux-2.6.32.49/sound/core/seq/seq_device.c 2011-11-15 19:59:43.000000000 -0500
81817 @@ -63,7 +63,7 @@ struct ops_list {
81818 int argsize; /* argument size */
81819
81820 /* operators */
81821 - struct snd_seq_dev_ops ops;
81822 + struct snd_seq_dev_ops *ops;
81823
81824 /* registred devices */
81825 struct list_head dev_list; /* list of devices */
81826 @@ -332,7 +332,7 @@ int snd_seq_device_register_driver(char
81827
81828 mutex_lock(&ops->reg_mutex);
81829 /* copy driver operators */
81830 - ops->ops = *entry;
81831 + ops->ops = entry;
81832 ops->driver |= DRIVER_LOADED;
81833 ops->argsize = argsize;
81834
81835 @@ -462,7 +462,7 @@ static int init_device(struct snd_seq_de
81836 dev->name, ops->id, ops->argsize, dev->argsize);
81837 return -EINVAL;
81838 }
81839 - if (ops->ops.init_device(dev) >= 0) {
81840 + if (ops->ops->init_device(dev) >= 0) {
81841 dev->status = SNDRV_SEQ_DEVICE_REGISTERED;
81842 ops->num_init_devices++;
81843 } else {
81844 @@ -489,7 +489,7 @@ static int free_device(struct snd_seq_de
81845 dev->name, ops->id, ops->argsize, dev->argsize);
81846 return -EINVAL;
81847 }
81848 - if ((result = ops->ops.free_device(dev)) >= 0 || result == -ENXIO) {
81849 + if ((result = ops->ops->free_device(dev)) >= 0 || result == -ENXIO) {
81850 dev->status = SNDRV_SEQ_DEVICE_FREE;
81851 dev->driver_data = NULL;
81852 ops->num_init_devices--;
81853 diff -urNp linux-2.6.32.49/sound/drivers/mts64.c linux-2.6.32.49/sound/drivers/mts64.c
81854 --- linux-2.6.32.49/sound/drivers/mts64.c 2011-11-08 19:02:43.000000000 -0500
81855 +++ linux-2.6.32.49/sound/drivers/mts64.c 2011-11-15 19:59:43.000000000 -0500
81856 @@ -27,6 +27,7 @@
81857 #include <sound/initval.h>
81858 #include <sound/rawmidi.h>
81859 #include <sound/control.h>
81860 +#include <asm/local.h>
81861
81862 #define CARD_NAME "Miditerminal 4140"
81863 #define DRIVER_NAME "MTS64"
81864 @@ -65,7 +66,7 @@ struct mts64 {
81865 struct pardevice *pardev;
81866 int pardev_claimed;
81867
81868 - int open_count;
81869 + local_t open_count;
81870 int current_midi_output_port;
81871 int current_midi_input_port;
81872 u8 mode[MTS64_NUM_INPUT_PORTS];
81873 @@ -695,7 +696,7 @@ static int snd_mts64_rawmidi_open(struct
81874 {
81875 struct mts64 *mts = substream->rmidi->private_data;
81876
81877 - if (mts->open_count == 0) {
81878 + if (local_read(&mts->open_count) == 0) {
81879 /* We don't need a spinlock here, because this is just called
81880 if the device has not been opened before.
81881 So there aren't any IRQs from the device */
81882 @@ -703,7 +704,7 @@ static int snd_mts64_rawmidi_open(struct
81883
81884 msleep(50);
81885 }
81886 - ++(mts->open_count);
81887 + local_inc(&mts->open_count);
81888
81889 return 0;
81890 }
81891 @@ -713,8 +714,7 @@ static int snd_mts64_rawmidi_close(struc
81892 struct mts64 *mts = substream->rmidi->private_data;
81893 unsigned long flags;
81894
81895 - --(mts->open_count);
81896 - if (mts->open_count == 0) {
81897 + if (local_dec_return(&mts->open_count) == 0) {
81898 /* We need the spinlock_irqsave here because we can still
81899 have IRQs at this point */
81900 spin_lock_irqsave(&mts->lock, flags);
81901 @@ -723,8 +723,8 @@ static int snd_mts64_rawmidi_close(struc
81902
81903 msleep(500);
81904
81905 - } else if (mts->open_count < 0)
81906 - mts->open_count = 0;
81907 + } else if (local_read(&mts->open_count) < 0)
81908 + local_set(&mts->open_count, 0);
81909
81910 return 0;
81911 }
81912 diff -urNp linux-2.6.32.49/sound/drivers/opl4/opl4_lib.c linux-2.6.32.49/sound/drivers/opl4/opl4_lib.c
81913 --- linux-2.6.32.49/sound/drivers/opl4/opl4_lib.c 2011-11-08 19:02:43.000000000 -0500
81914 +++ linux-2.6.32.49/sound/drivers/opl4/opl4_lib.c 2011-11-15 19:59:43.000000000 -0500
81915 @@ -27,7 +27,7 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@
81916 MODULE_DESCRIPTION("OPL4 driver");
81917 MODULE_LICENSE("GPL");
81918
81919 -static void inline snd_opl4_wait(struct snd_opl4 *opl4)
81920 +static inline void snd_opl4_wait(struct snd_opl4 *opl4)
81921 {
81922 int timeout = 10;
81923 while ((inb(opl4->fm_port) & OPL4_STATUS_BUSY) && --timeout > 0)
81924 diff -urNp linux-2.6.32.49/sound/drivers/portman2x4.c linux-2.6.32.49/sound/drivers/portman2x4.c
81925 --- linux-2.6.32.49/sound/drivers/portman2x4.c 2011-11-08 19:02:43.000000000 -0500
81926 +++ linux-2.6.32.49/sound/drivers/portman2x4.c 2011-11-15 19:59:43.000000000 -0500
81927 @@ -46,6 +46,7 @@
81928 #include <sound/initval.h>
81929 #include <sound/rawmidi.h>
81930 #include <sound/control.h>
81931 +#include <asm/local.h>
81932
81933 #define CARD_NAME "Portman 2x4"
81934 #define DRIVER_NAME "portman"
81935 @@ -83,7 +84,7 @@ struct portman {
81936 struct pardevice *pardev;
81937 int pardev_claimed;
81938
81939 - int open_count;
81940 + local_t open_count;
81941 int mode[PORTMAN_NUM_INPUT_PORTS];
81942 struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
81943 };
81944 diff -urNp linux-2.6.32.49/sound/isa/cmi8330.c linux-2.6.32.49/sound/isa/cmi8330.c
81945 --- linux-2.6.32.49/sound/isa/cmi8330.c 2011-11-08 19:02:43.000000000 -0500
81946 +++ linux-2.6.32.49/sound/isa/cmi8330.c 2011-11-15 19:59:43.000000000 -0500
81947 @@ -173,7 +173,7 @@ struct snd_cmi8330 {
81948
81949 struct snd_pcm *pcm;
81950 struct snd_cmi8330_stream {
81951 - struct snd_pcm_ops ops;
81952 + snd_pcm_ops_no_const ops;
81953 snd_pcm_open_callback_t open;
81954 void *private_data; /* sb or wss */
81955 } streams[2];
81956 diff -urNp linux-2.6.32.49/sound/oss/sb_audio.c linux-2.6.32.49/sound/oss/sb_audio.c
81957 --- linux-2.6.32.49/sound/oss/sb_audio.c 2011-11-08 19:02:43.000000000 -0500
81958 +++ linux-2.6.32.49/sound/oss/sb_audio.c 2011-11-15 19:59:43.000000000 -0500
81959 @@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
81960 buf16 = (signed short *)(localbuf + localoffs);
81961 while (c)
81962 {
81963 - locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
81964 + locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
81965 if (copy_from_user(lbuf8,
81966 userbuf+useroffs + p,
81967 locallen))
81968 diff -urNp linux-2.6.32.49/sound/oss/swarm_cs4297a.c linux-2.6.32.49/sound/oss/swarm_cs4297a.c
81969 --- linux-2.6.32.49/sound/oss/swarm_cs4297a.c 2011-11-08 19:02:43.000000000 -0500
81970 +++ linux-2.6.32.49/sound/oss/swarm_cs4297a.c 2011-11-15 19:59:43.000000000 -0500
81971 @@ -2577,7 +2577,6 @@ static int __init cs4297a_init(void)
81972 {
81973 struct cs4297a_state *s;
81974 u32 pwr, id;
81975 - mm_segment_t fs;
81976 int rval;
81977 #ifndef CONFIG_BCM_CS4297A_CSWARM
81978 u64 cfg;
81979 @@ -2667,22 +2666,23 @@ static int __init cs4297a_init(void)
81980 if (!rval) {
81981 char *sb1250_duart_present;
81982
81983 +#if 0
81984 + mm_segment_t fs;
81985 fs = get_fs();
81986 set_fs(KERNEL_DS);
81987 -#if 0
81988 val = SOUND_MASK_LINE;
81989 mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
81990 for (i = 0; i < ARRAY_SIZE(initvol); i++) {
81991 val = initvol[i].vol;
81992 mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
81993 }
81994 + set_fs(fs);
81995 // cs4297a_write_ac97(s, 0x18, 0x0808);
81996 #else
81997 // cs4297a_write_ac97(s, 0x5e, 0x180);
81998 cs4297a_write_ac97(s, 0x02, 0x0808);
81999 cs4297a_write_ac97(s, 0x18, 0x0808);
82000 #endif
82001 - set_fs(fs);
82002
82003 list_add(&s->list, &cs4297a_devs);
82004
82005 diff -urNp linux-2.6.32.49/sound/pci/ac97/ac97_codec.c linux-2.6.32.49/sound/pci/ac97/ac97_codec.c
82006 --- linux-2.6.32.49/sound/pci/ac97/ac97_codec.c 2011-11-08 19:02:43.000000000 -0500
82007 +++ linux-2.6.32.49/sound/pci/ac97/ac97_codec.c 2011-11-15 19:59:43.000000000 -0500
82008 @@ -1952,7 +1952,7 @@ static int snd_ac97_dev_disconnect(struc
82009 }
82010
82011 /* build_ops to do nothing */
82012 -static struct snd_ac97_build_ops null_build_ops;
82013 +static const struct snd_ac97_build_ops null_build_ops;
82014
82015 #ifdef CONFIG_SND_AC97_POWER_SAVE
82016 static void do_update_power(struct work_struct *work)
82017 diff -urNp linux-2.6.32.49/sound/pci/ac97/ac97_patch.c linux-2.6.32.49/sound/pci/ac97/ac97_patch.c
82018 --- linux-2.6.32.49/sound/pci/ac97/ac97_patch.c 2011-11-08 19:02:43.000000000 -0500
82019 +++ linux-2.6.32.49/sound/pci/ac97/ac97_patch.c 2011-11-15 19:59:43.000000000 -0500
82020 @@ -371,7 +371,7 @@ static int patch_yamaha_ymf743_build_spd
82021 return 0;
82022 }
82023
82024 -static struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
82025 +static const struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
82026 .build_spdif = patch_yamaha_ymf743_build_spdif,
82027 .build_3d = patch_yamaha_ymf7x3_3d,
82028 };
82029 @@ -455,7 +455,7 @@ static int patch_yamaha_ymf753_post_spdi
82030 return 0;
82031 }
82032
82033 -static struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
82034 +static const struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
82035 .build_3d = patch_yamaha_ymf7x3_3d,
82036 .build_post_spdif = patch_yamaha_ymf753_post_spdif
82037 };
82038 @@ -502,7 +502,7 @@ static int patch_wolfson_wm9703_specific
82039 return 0;
82040 }
82041
82042 -static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
82043 +static const struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
82044 .build_specific = patch_wolfson_wm9703_specific,
82045 };
82046
82047 @@ -533,7 +533,7 @@ static int patch_wolfson_wm9704_specific
82048 return 0;
82049 }
82050
82051 -static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
82052 +static const struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
82053 .build_specific = patch_wolfson_wm9704_specific,
82054 };
82055
82056 @@ -555,7 +555,7 @@ static int patch_wolfson_wm9705_specific
82057 return 0;
82058 }
82059
82060 -static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
82061 +static const struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
82062 .build_specific = patch_wolfson_wm9705_specific,
82063 };
82064
82065 @@ -692,7 +692,7 @@ static int patch_wolfson_wm9711_specific
82066 return 0;
82067 }
82068
82069 -static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
82070 +static const struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
82071 .build_specific = patch_wolfson_wm9711_specific,
82072 };
82073
82074 @@ -886,7 +886,7 @@ static void patch_wolfson_wm9713_resume
82075 }
82076 #endif
82077
82078 -static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
82079 +static const struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
82080 .build_specific = patch_wolfson_wm9713_specific,
82081 .build_3d = patch_wolfson_wm9713_3d,
82082 #ifdef CONFIG_PM
82083 @@ -991,7 +991,7 @@ static int patch_sigmatel_stac97xx_speci
82084 return 0;
82085 }
82086
82087 -static struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
82088 +static const struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
82089 .build_3d = patch_sigmatel_stac9700_3d,
82090 .build_specific = patch_sigmatel_stac97xx_specific
82091 };
82092 @@ -1038,7 +1038,7 @@ static int patch_sigmatel_stac9708_speci
82093 return patch_sigmatel_stac97xx_specific(ac97);
82094 }
82095
82096 -static struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
82097 +static const struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
82098 .build_3d = patch_sigmatel_stac9708_3d,
82099 .build_specific = patch_sigmatel_stac9708_specific
82100 };
82101 @@ -1267,7 +1267,7 @@ static int patch_sigmatel_stac9758_speci
82102 return 0;
82103 }
82104
82105 -static struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
82106 +static const struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
82107 .build_3d = patch_sigmatel_stac9700_3d,
82108 .build_specific = patch_sigmatel_stac9758_specific
82109 };
82110 @@ -1342,7 +1342,7 @@ static int patch_cirrus_build_spdif(stru
82111 return 0;
82112 }
82113
82114 -static struct snd_ac97_build_ops patch_cirrus_ops = {
82115 +static const struct snd_ac97_build_ops patch_cirrus_ops = {
82116 .build_spdif = patch_cirrus_build_spdif
82117 };
82118
82119 @@ -1399,7 +1399,7 @@ static int patch_conexant_build_spdif(st
82120 return 0;
82121 }
82122
82123 -static struct snd_ac97_build_ops patch_conexant_ops = {
82124 +static const struct snd_ac97_build_ops patch_conexant_ops = {
82125 .build_spdif = patch_conexant_build_spdif
82126 };
82127
82128 @@ -1575,7 +1575,7 @@ static void patch_ad1881_chained(struct
82129 }
82130 }
82131
82132 -static struct snd_ac97_build_ops patch_ad1881_build_ops = {
82133 +static const struct snd_ac97_build_ops patch_ad1881_build_ops = {
82134 #ifdef CONFIG_PM
82135 .resume = ad18xx_resume
82136 #endif
82137 @@ -1662,7 +1662,7 @@ static int patch_ad1885_specific(struct
82138 return 0;
82139 }
82140
82141 -static struct snd_ac97_build_ops patch_ad1885_build_ops = {
82142 +static const struct snd_ac97_build_ops patch_ad1885_build_ops = {
82143 .build_specific = &patch_ad1885_specific,
82144 #ifdef CONFIG_PM
82145 .resume = ad18xx_resume
82146 @@ -1689,7 +1689,7 @@ static int patch_ad1886_specific(struct
82147 return 0;
82148 }
82149
82150 -static struct snd_ac97_build_ops patch_ad1886_build_ops = {
82151 +static const struct snd_ac97_build_ops patch_ad1886_build_ops = {
82152 .build_specific = &patch_ad1886_specific,
82153 #ifdef CONFIG_PM
82154 .resume = ad18xx_resume
82155 @@ -1896,7 +1896,7 @@ static int patch_ad1981a_specific(struct
82156 ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
82157 }
82158
82159 -static struct snd_ac97_build_ops patch_ad1981a_build_ops = {
82160 +static const struct snd_ac97_build_ops patch_ad1981a_build_ops = {
82161 .build_post_spdif = patch_ad198x_post_spdif,
82162 .build_specific = patch_ad1981a_specific,
82163 #ifdef CONFIG_PM
82164 @@ -1952,7 +1952,7 @@ static int patch_ad1981b_specific(struct
82165 ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
82166 }
82167
82168 -static struct snd_ac97_build_ops patch_ad1981b_build_ops = {
82169 +static const struct snd_ac97_build_ops patch_ad1981b_build_ops = {
82170 .build_post_spdif = patch_ad198x_post_spdif,
82171 .build_specific = patch_ad1981b_specific,
82172 #ifdef CONFIG_PM
82173 @@ -2091,7 +2091,7 @@ static int patch_ad1888_specific(struct
82174 return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
82175 }
82176
82177 -static struct snd_ac97_build_ops patch_ad1888_build_ops = {
82178 +static const struct snd_ac97_build_ops patch_ad1888_build_ops = {
82179 .build_post_spdif = patch_ad198x_post_spdif,
82180 .build_specific = patch_ad1888_specific,
82181 #ifdef CONFIG_PM
82182 @@ -2140,7 +2140,7 @@ static int patch_ad1980_specific(struct
82183 return patch_build_controls(ac97, &snd_ac97_ad198x_2cmic, 1);
82184 }
82185
82186 -static struct snd_ac97_build_ops patch_ad1980_build_ops = {
82187 +static const struct snd_ac97_build_ops patch_ad1980_build_ops = {
82188 .build_post_spdif = patch_ad198x_post_spdif,
82189 .build_specific = patch_ad1980_specific,
82190 #ifdef CONFIG_PM
82191 @@ -2255,7 +2255,7 @@ static int patch_ad1985_specific(struct
82192 ARRAY_SIZE(snd_ac97_ad1985_controls));
82193 }
82194
82195 -static struct snd_ac97_build_ops patch_ad1985_build_ops = {
82196 +static const struct snd_ac97_build_ops patch_ad1985_build_ops = {
82197 .build_post_spdif = patch_ad198x_post_spdif,
82198 .build_specific = patch_ad1985_specific,
82199 #ifdef CONFIG_PM
82200 @@ -2547,7 +2547,7 @@ static int patch_ad1986_specific(struct
82201 ARRAY_SIZE(snd_ac97_ad1985_controls));
82202 }
82203
82204 -static struct snd_ac97_build_ops patch_ad1986_build_ops = {
82205 +static const struct snd_ac97_build_ops patch_ad1986_build_ops = {
82206 .build_post_spdif = patch_ad198x_post_spdif,
82207 .build_specific = patch_ad1986_specific,
82208 #ifdef CONFIG_PM
82209 @@ -2652,7 +2652,7 @@ static int patch_alc650_specific(struct
82210 return 0;
82211 }
82212
82213 -static struct snd_ac97_build_ops patch_alc650_ops = {
82214 +static const struct snd_ac97_build_ops patch_alc650_ops = {
82215 .build_specific = patch_alc650_specific,
82216 .update_jacks = alc650_update_jacks
82217 };
82218 @@ -2804,7 +2804,7 @@ static int patch_alc655_specific(struct
82219 return 0;
82220 }
82221
82222 -static struct snd_ac97_build_ops patch_alc655_ops = {
82223 +static const struct snd_ac97_build_ops patch_alc655_ops = {
82224 .build_specific = patch_alc655_specific,
82225 .update_jacks = alc655_update_jacks
82226 };
82227 @@ -2916,7 +2916,7 @@ static int patch_alc850_specific(struct
82228 return 0;
82229 }
82230
82231 -static struct snd_ac97_build_ops patch_alc850_ops = {
82232 +static const struct snd_ac97_build_ops patch_alc850_ops = {
82233 .build_specific = patch_alc850_specific,
82234 .update_jacks = alc850_update_jacks
82235 };
82236 @@ -2978,7 +2978,7 @@ static int patch_cm9738_specific(struct
82237 return patch_build_controls(ac97, snd_ac97_cm9738_controls, ARRAY_SIZE(snd_ac97_cm9738_controls));
82238 }
82239
82240 -static struct snd_ac97_build_ops patch_cm9738_ops = {
82241 +static const struct snd_ac97_build_ops patch_cm9738_ops = {
82242 .build_specific = patch_cm9738_specific,
82243 .update_jacks = cm9738_update_jacks
82244 };
82245 @@ -3069,7 +3069,7 @@ static int patch_cm9739_post_spdif(struc
82246 return patch_build_controls(ac97, snd_ac97_cm9739_controls_spdif, ARRAY_SIZE(snd_ac97_cm9739_controls_spdif));
82247 }
82248
82249 -static struct snd_ac97_build_ops patch_cm9739_ops = {
82250 +static const struct snd_ac97_build_ops patch_cm9739_ops = {
82251 .build_specific = patch_cm9739_specific,
82252 .build_post_spdif = patch_cm9739_post_spdif,
82253 .update_jacks = cm9739_update_jacks
82254 @@ -3243,7 +3243,7 @@ static int patch_cm9761_specific(struct
82255 return patch_build_controls(ac97, snd_ac97_cm9761_controls, ARRAY_SIZE(snd_ac97_cm9761_controls));
82256 }
82257
82258 -static struct snd_ac97_build_ops patch_cm9761_ops = {
82259 +static const struct snd_ac97_build_ops patch_cm9761_ops = {
82260 .build_specific = patch_cm9761_specific,
82261 .build_post_spdif = patch_cm9761_post_spdif,
82262 .update_jacks = cm9761_update_jacks
82263 @@ -3339,7 +3339,7 @@ static int patch_cm9780_specific(struct
82264 return patch_build_controls(ac97, cm9780_controls, ARRAY_SIZE(cm9780_controls));
82265 }
82266
82267 -static struct snd_ac97_build_ops patch_cm9780_ops = {
82268 +static const struct snd_ac97_build_ops patch_cm9780_ops = {
82269 .build_specific = patch_cm9780_specific,
82270 .build_post_spdif = patch_cm9761_post_spdif /* identical with CM9761 */
82271 };
82272 @@ -3459,7 +3459,7 @@ static int patch_vt1616_specific(struct
82273 return 0;
82274 }
82275
82276 -static struct snd_ac97_build_ops patch_vt1616_ops = {
82277 +static const struct snd_ac97_build_ops patch_vt1616_ops = {
82278 .build_specific = patch_vt1616_specific
82279 };
82280
82281 @@ -3813,7 +3813,7 @@ static int patch_it2646_specific(struct
82282 return 0;
82283 }
82284
82285 -static struct snd_ac97_build_ops patch_it2646_ops = {
82286 +static const struct snd_ac97_build_ops patch_it2646_ops = {
82287 .build_specific = patch_it2646_specific,
82288 .update_jacks = it2646_update_jacks
82289 };
82290 @@ -3847,7 +3847,7 @@ static int patch_si3036_specific(struct
82291 return 0;
82292 }
82293
82294 -static struct snd_ac97_build_ops patch_si3036_ops = {
82295 +static const struct snd_ac97_build_ops patch_si3036_ops = {
82296 .build_specific = patch_si3036_specific,
82297 };
82298
82299 @@ -3914,7 +3914,7 @@ static int patch_ucb1400_specific(struct
82300 return 0;
82301 }
82302
82303 -static struct snd_ac97_build_ops patch_ucb1400_ops = {
82304 +static const struct snd_ac97_build_ops patch_ucb1400_ops = {
82305 .build_specific = patch_ucb1400_specific,
82306 };
82307
82308 diff -urNp linux-2.6.32.49/sound/pci/hda/hda_codec.h linux-2.6.32.49/sound/pci/hda/hda_codec.h
82309 --- linux-2.6.32.49/sound/pci/hda/hda_codec.h 2011-11-08 19:02:43.000000000 -0500
82310 +++ linux-2.6.32.49/sound/pci/hda/hda_codec.h 2011-11-15 19:59:43.000000000 -0500
82311 @@ -580,7 +580,7 @@ struct hda_bus_ops {
82312 /* notify power-up/down from codec to controller */
82313 void (*pm_notify)(struct hda_bus *bus);
82314 #endif
82315 -};
82316 +} __no_const;
82317
82318 /* template to pass to the bus constructor */
82319 struct hda_bus_template {
82320 @@ -675,6 +675,7 @@ struct hda_codec_ops {
82321 int (*check_power_status)(struct hda_codec *codec, hda_nid_t nid);
82322 #endif
82323 };
82324 +typedef struct hda_codec_ops __no_const hda_codec_ops_no_const;
82325
82326 /* record for amp information cache */
82327 struct hda_cache_head {
82328 @@ -705,7 +706,7 @@ struct hda_pcm_ops {
82329 struct snd_pcm_substream *substream);
82330 int (*cleanup)(struct hda_pcm_stream *info, struct hda_codec *codec,
82331 struct snd_pcm_substream *substream);
82332 -};
82333 +} __no_const;
82334
82335 /* PCM information for each substream */
82336 struct hda_pcm_stream {
82337 @@ -760,7 +761,7 @@ struct hda_codec {
82338 const char *modelname; /* model name for preset */
82339
82340 /* set by patch */
82341 - struct hda_codec_ops patch_ops;
82342 + hda_codec_ops_no_const patch_ops;
82343
82344 /* PCM to create, set by patch_ops.build_pcms callback */
82345 unsigned int num_pcms;
82346 diff -urNp linux-2.6.32.49/sound/pci/hda/patch_atihdmi.c linux-2.6.32.49/sound/pci/hda/patch_atihdmi.c
82347 --- linux-2.6.32.49/sound/pci/hda/patch_atihdmi.c 2011-11-08 19:02:43.000000000 -0500
82348 +++ linux-2.6.32.49/sound/pci/hda/patch_atihdmi.c 2011-11-15 19:59:43.000000000 -0500
82349 @@ -177,7 +177,7 @@ static int patch_atihdmi(struct hda_code
82350 */
82351 spec->multiout.dig_out_nid = CVT_NID;
82352
82353 - codec->patch_ops = atihdmi_patch_ops;
82354 + memcpy((void *)&codec->patch_ops, &atihdmi_patch_ops, sizeof(atihdmi_patch_ops));
82355
82356 return 0;
82357 }
82358 diff -urNp linux-2.6.32.49/sound/pci/hda/patch_intelhdmi.c linux-2.6.32.49/sound/pci/hda/patch_intelhdmi.c
82359 --- linux-2.6.32.49/sound/pci/hda/patch_intelhdmi.c 2011-11-08 19:02:43.000000000 -0500
82360 +++ linux-2.6.32.49/sound/pci/hda/patch_intelhdmi.c 2011-11-15 19:59:43.000000000 -0500
82361 @@ -511,10 +511,10 @@ static void hdmi_non_intrinsic_event(str
82362 cp_ready);
82363
82364 /* TODO */
82365 - if (cp_state)
82366 - ;
82367 - if (cp_ready)
82368 - ;
82369 + if (cp_state) {
82370 + }
82371 + if (cp_ready) {
82372 + }
82373 }
82374
82375
82376 @@ -656,7 +656,7 @@ static int do_patch_intel_hdmi(struct hd
82377 spec->multiout.dig_out_nid = cvt_nid;
82378
82379 codec->spec = spec;
82380 - codec->patch_ops = intel_hdmi_patch_ops;
82381 + memcpy((void *)&codec->patch_ops, &intel_hdmi_patch_ops, sizeof(intel_hdmi_patch_ops));
82382
82383 snd_hda_eld_proc_new(codec, &spec->sink_eld);
82384
82385 diff -urNp linux-2.6.32.49/sound/pci/hda/patch_nvhdmi.c linux-2.6.32.49/sound/pci/hda/patch_nvhdmi.c
82386 --- linux-2.6.32.49/sound/pci/hda/patch_nvhdmi.c 2011-11-08 19:02:43.000000000 -0500
82387 +++ linux-2.6.32.49/sound/pci/hda/patch_nvhdmi.c 2011-11-15 19:59:43.000000000 -0500
82388 @@ -367,7 +367,7 @@ static int patch_nvhdmi_8ch(struct hda_c
82389 spec->multiout.max_channels = 8;
82390 spec->multiout.dig_out_nid = Nv_Master_Convert_nid;
82391
82392 - codec->patch_ops = nvhdmi_patch_ops_8ch;
82393 + memcpy((void *)&codec->patch_ops, &nvhdmi_patch_ops_8ch, sizeof(nvhdmi_patch_ops_8ch));
82394
82395 return 0;
82396 }
82397 @@ -386,7 +386,7 @@ static int patch_nvhdmi_2ch(struct hda_c
82398 spec->multiout.max_channels = 2;
82399 spec->multiout.dig_out_nid = Nv_Master_Convert_nid;
82400
82401 - codec->patch_ops = nvhdmi_patch_ops_2ch;
82402 + memcpy((void *)&codec->patch_ops, &nvhdmi_patch_ops_2ch, sizeof(nvhdmi_patch_ops_2ch));
82403
82404 return 0;
82405 }
82406 diff -urNp linux-2.6.32.49/sound/pci/hda/patch_sigmatel.c linux-2.6.32.49/sound/pci/hda/patch_sigmatel.c
82407 --- linux-2.6.32.49/sound/pci/hda/patch_sigmatel.c 2011-11-08 19:02:43.000000000 -0500
82408 +++ linux-2.6.32.49/sound/pci/hda/patch_sigmatel.c 2011-11-15 19:59:43.000000000 -0500
82409 @@ -5220,7 +5220,7 @@ again:
82410 snd_hda_codec_write_cache(codec, nid, 0,
82411 AC_VERB_SET_CONNECT_SEL, num_dacs);
82412
82413 - codec->patch_ops = stac92xx_patch_ops;
82414 + memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
82415
82416 codec->proc_widget_hook = stac92hd_proc_hook;
82417
82418 @@ -5294,7 +5294,7 @@ static int patch_stac92hd71bxx(struct hd
82419 return -ENOMEM;
82420
82421 codec->spec = spec;
82422 - codec->patch_ops = stac92xx_patch_ops;
82423 + memcpy((void *)&codec->patch_ops, &stac92xx_patch_ops, sizeof(stac92xx_patch_ops));
82424 spec->num_pins = STAC92HD71BXX_NUM_PINS;
82425 switch (codec->vendor_id) {
82426 case 0x111d76b6:
82427 diff -urNp linux-2.6.32.49/sound/pci/ice1712/ice1712.h linux-2.6.32.49/sound/pci/ice1712/ice1712.h
82428 --- linux-2.6.32.49/sound/pci/ice1712/ice1712.h 2011-11-08 19:02:43.000000000 -0500
82429 +++ linux-2.6.32.49/sound/pci/ice1712/ice1712.h 2011-11-15 19:59:43.000000000 -0500
82430 @@ -269,7 +269,7 @@ struct snd_ak4xxx_private {
82431 unsigned int mask_flags; /* total mask bits */
82432 struct snd_akm4xxx_ops {
82433 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
82434 - } ops;
82435 + } __no_const ops;
82436 };
82437
82438 struct snd_ice1712_spdif {
82439 @@ -285,7 +285,7 @@ struct snd_ice1712_spdif {
82440 int (*default_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
82441 void (*stream_get)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
82442 int (*stream_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
82443 - } ops;
82444 + } __no_const ops;
82445 };
82446
82447
82448 diff -urNp linux-2.6.32.49/sound/pci/intel8x0m.c linux-2.6.32.49/sound/pci/intel8x0m.c
82449 --- linux-2.6.32.49/sound/pci/intel8x0m.c 2011-11-08 19:02:43.000000000 -0500
82450 +++ linux-2.6.32.49/sound/pci/intel8x0m.c 2011-11-15 19:59:43.000000000 -0500
82451 @@ -1264,7 +1264,7 @@ static struct shortname_table {
82452 { 0x5455, "ALi M5455" },
82453 { 0x746d, "AMD AMD8111" },
82454 #endif
82455 - { 0 },
82456 + { 0, },
82457 };
82458
82459 static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
82460 diff -urNp linux-2.6.32.49/sound/pci/ymfpci/ymfpci_main.c linux-2.6.32.49/sound/pci/ymfpci/ymfpci_main.c
82461 --- linux-2.6.32.49/sound/pci/ymfpci/ymfpci_main.c 2011-11-08 19:02:43.000000000 -0500
82462 +++ linux-2.6.32.49/sound/pci/ymfpci/ymfpci_main.c 2011-11-15 19:59:43.000000000 -0500
82463 @@ -202,8 +202,8 @@ static void snd_ymfpci_hw_stop(struct sn
82464 if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
82465 break;
82466 }
82467 - if (atomic_read(&chip->interrupt_sleep_count)) {
82468 - atomic_set(&chip->interrupt_sleep_count, 0);
82469 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
82470 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
82471 wake_up(&chip->interrupt_sleep);
82472 }
82473 __end:
82474 @@ -787,7 +787,7 @@ static void snd_ymfpci_irq_wait(struct s
82475 continue;
82476 init_waitqueue_entry(&wait, current);
82477 add_wait_queue(&chip->interrupt_sleep, &wait);
82478 - atomic_inc(&chip->interrupt_sleep_count);
82479 + atomic_inc_unchecked(&chip->interrupt_sleep_count);
82480 schedule_timeout_uninterruptible(msecs_to_jiffies(50));
82481 remove_wait_queue(&chip->interrupt_sleep, &wait);
82482 }
82483 @@ -825,8 +825,8 @@ static irqreturn_t snd_ymfpci_interrupt(
82484 snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
82485 spin_unlock(&chip->reg_lock);
82486
82487 - if (atomic_read(&chip->interrupt_sleep_count)) {
82488 - atomic_set(&chip->interrupt_sleep_count, 0);
82489 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
82490 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
82491 wake_up(&chip->interrupt_sleep);
82492 }
82493 }
82494 @@ -2369,7 +2369,7 @@ int __devinit snd_ymfpci_create(struct s
82495 spin_lock_init(&chip->reg_lock);
82496 spin_lock_init(&chip->voice_lock);
82497 init_waitqueue_head(&chip->interrupt_sleep);
82498 - atomic_set(&chip->interrupt_sleep_count, 0);
82499 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
82500 chip->card = card;
82501 chip->pci = pci;
82502 chip->irq = -1;
82503 diff -urNp linux-2.6.32.49/sound/soc/soc-core.c linux-2.6.32.49/sound/soc/soc-core.c
82504 --- linux-2.6.32.49/sound/soc/soc-core.c 2011-11-08 19:02:43.000000000 -0500
82505 +++ linux-2.6.32.49/sound/soc/soc-core.c 2011-11-15 19:59:43.000000000 -0500
82506 @@ -609,7 +609,7 @@ static int soc_pcm_trigger(struct snd_pc
82507 }
82508
82509 /* ASoC PCM operations */
82510 -static struct snd_pcm_ops soc_pcm_ops = {
82511 +static snd_pcm_ops_no_const soc_pcm_ops = {
82512 .open = soc_pcm_open,
82513 .close = soc_codec_close,
82514 .hw_params = soc_pcm_hw_params,
82515 diff -urNp linux-2.6.32.49/sound/usb/usbaudio.c linux-2.6.32.49/sound/usb/usbaudio.c
82516 --- linux-2.6.32.49/sound/usb/usbaudio.c 2011-11-08 19:02:43.000000000 -0500
82517 +++ linux-2.6.32.49/sound/usb/usbaudio.c 2011-11-15 19:59:43.000000000 -0500
82518 @@ -963,12 +963,12 @@ static int snd_usb_pcm_playback_trigger(
82519 switch (cmd) {
82520 case SNDRV_PCM_TRIGGER_START:
82521 case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
82522 - subs->ops.prepare = prepare_playback_urb;
82523 + *(void **)&subs->ops.prepare = prepare_playback_urb;
82524 return 0;
82525 case SNDRV_PCM_TRIGGER_STOP:
82526 return deactivate_urbs(subs, 0, 0);
82527 case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
82528 - subs->ops.prepare = prepare_nodata_playback_urb;
82529 + *(void **)&subs->ops.prepare = prepare_nodata_playback_urb;
82530 return 0;
82531 default:
82532 return -EINVAL;
82533 @@ -985,15 +985,15 @@ static int snd_usb_pcm_capture_trigger(s
82534
82535 switch (cmd) {
82536 case SNDRV_PCM_TRIGGER_START:
82537 - subs->ops.retire = retire_capture_urb;
82538 + *(void **)&subs->ops.retire = retire_capture_urb;
82539 return start_urbs(subs, substream->runtime);
82540 case SNDRV_PCM_TRIGGER_STOP:
82541 return deactivate_urbs(subs, 0, 0);
82542 case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
82543 - subs->ops.retire = retire_paused_capture_urb;
82544 + *(void **)&subs->ops.retire = retire_paused_capture_urb;
82545 return 0;
82546 case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
82547 - subs->ops.retire = retire_capture_urb;
82548 + *(void **)&subs->ops.retire = retire_capture_urb;
82549 return 0;
82550 default:
82551 return -EINVAL;
82552 @@ -1542,7 +1542,7 @@ static int snd_usb_pcm_prepare(struct sn
82553 /* for playback, submit the URBs now; otherwise, the first hwptr_done
82554 * updates for all URBs would happen at the same time when starting */
82555 if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK) {
82556 - subs->ops.prepare = prepare_nodata_playback_urb;
82557 + *(void **)&subs->ops.prepare = prepare_nodata_playback_urb;
82558 return start_urbs(subs, runtime);
82559 } else
82560 return 0;
82561 @@ -2228,14 +2228,14 @@ static void init_substream(struct snd_us
82562 subs->direction = stream;
82563 subs->dev = as->chip->dev;
82564 if (snd_usb_get_speed(subs->dev) == USB_SPEED_FULL) {
82565 - subs->ops = audio_urb_ops[stream];
82566 + memcpy((void *)&subs->ops, &audio_urb_ops[stream], sizeof(subs->ops));
82567 } else {
82568 - subs->ops = audio_urb_ops_high_speed[stream];
82569 + memcpy((void *)&subs->ops, &audio_urb_ops_high_speed[stream], sizeof(subs->ops));
82570 switch (as->chip->usb_id) {
82571 case USB_ID(0x041e, 0x3f02): /* E-Mu 0202 USB */
82572 case USB_ID(0x041e, 0x3f04): /* E-Mu 0404 USB */
82573 case USB_ID(0x041e, 0x3f0a): /* E-Mu Tracker Pre */
82574 - subs->ops.retire_sync = retire_playback_sync_urb_hs_emu;
82575 + *(void **)&subs->ops.retire_sync = retire_playback_sync_urb_hs_emu;
82576 break;
82577 }
82578 }
82579 diff -urNp linux-2.6.32.49/tools/gcc/checker_plugin.c linux-2.6.32.49/tools/gcc/checker_plugin.c
82580 --- linux-2.6.32.49/tools/gcc/checker_plugin.c 1969-12-31 19:00:00.000000000 -0500
82581 +++ linux-2.6.32.49/tools/gcc/checker_plugin.c 2011-11-18 18:01:52.000000000 -0500
82582 @@ -0,0 +1,171 @@
82583 +/*
82584 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
82585 + * Licensed under the GPL v2
82586 + *
82587 + * Note: the choice of the license means that the compilation process is
82588 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
82589 + * but for the kernel it doesn't matter since it doesn't link against
82590 + * any of the gcc libraries
82591 + *
82592 + * gcc plugin to implement various sparse (source code checker) features
82593 + *
82594 + * TODO:
82595 + * - define separate __iomem, __percpu and __rcu address spaces (lots of code to patch)
82596 + *
82597 + * BUGS:
82598 + * - none known
82599 + */
82600 +#include "gcc-plugin.h"
82601 +#include "config.h"
82602 +#include "system.h"
82603 +#include "coretypes.h"
82604 +#include "tree.h"
82605 +#include "tree-pass.h"
82606 +#include "flags.h"
82607 +#include "intl.h"
82608 +#include "toplev.h"
82609 +#include "plugin.h"
82610 +//#include "expr.h" where are you...
82611 +#include "diagnostic.h"
82612 +#include "plugin-version.h"
82613 +#include "tm.h"
82614 +#include "function.h"
82615 +#include "basic-block.h"
82616 +#include "gimple.h"
82617 +#include "rtl.h"
82618 +#include "emit-rtl.h"
82619 +#include "tree-flow.h"
82620 +#include "target.h"
82621 +
82622 +extern void c_register_addr_space (const char *str, addr_space_t as);
82623 +extern enum machine_mode default_addr_space_pointer_mode (addr_space_t);
82624 +extern enum machine_mode default_addr_space_address_mode (addr_space_t);
82625 +extern bool default_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as);
82626 +extern bool default_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as);
82627 +extern rtx default_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as);
82628 +
82629 +extern void print_gimple_stmt(FILE *, gimple, int, int);
82630 +extern rtx emit_move_insn(rtx x, rtx y);
82631 +
82632 +int plugin_is_GPL_compatible;
82633 +
82634 +static struct plugin_info checker_plugin_info = {
82635 + .version = "201111150100",
82636 +};
82637 +
82638 +#define ADDR_SPACE_KERNEL 0
82639 +#define ADDR_SPACE_FORCE_KERNEL 1
82640 +#define ADDR_SPACE_USER 2
82641 +#define ADDR_SPACE_FORCE_USER 3
82642 +#define ADDR_SPACE_IOMEM 0
82643 +#define ADDR_SPACE_FORCE_IOMEM 0
82644 +#define ADDR_SPACE_PERCPU 0
82645 +#define ADDR_SPACE_FORCE_PERCPU 0
82646 +#define ADDR_SPACE_RCU 0
82647 +#define ADDR_SPACE_FORCE_RCU 0
82648 +
82649 +static enum machine_mode checker_addr_space_pointer_mode(addr_space_t addrspace)
82650 +{
82651 + return default_addr_space_pointer_mode(ADDR_SPACE_GENERIC);
82652 +}
82653 +
82654 +static enum machine_mode checker_addr_space_address_mode(addr_space_t addrspace)
82655 +{
82656 + return default_addr_space_address_mode(ADDR_SPACE_GENERIC);
82657 +}
82658 +
82659 +static bool checker_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as)
82660 +{
82661 + return default_addr_space_valid_pointer_mode(mode, as);
82662 +}
82663 +
82664 +static bool checker_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as)
82665 +{
82666 + return default_addr_space_legitimate_address_p(mode, mem, strict, ADDR_SPACE_GENERIC);
82667 +}
82668 +
82669 +static rtx checker_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as)
82670 +{
82671 + return default_addr_space_legitimize_address(x, oldx, mode, as);
82672 +}
82673 +
82674 +static bool checker_addr_space_subset_p(addr_space_t subset, addr_space_t superset)
82675 +{
82676 + if (subset == ADDR_SPACE_FORCE_KERNEL && superset == ADDR_SPACE_KERNEL)
82677 + return true;
82678 +
82679 + if (subset == ADDR_SPACE_FORCE_USER && superset == ADDR_SPACE_USER)
82680 + return true;
82681 +
82682 + if (subset == ADDR_SPACE_FORCE_IOMEM && superset == ADDR_SPACE_IOMEM)
82683 + return true;
82684 +
82685 + if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_USER)
82686 + return true;
82687 +
82688 + if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_IOMEM)
82689 + return true;
82690 +
82691 + if (subset == ADDR_SPACE_USER && superset == ADDR_SPACE_FORCE_KERNEL)
82692 + return true;
82693 +
82694 + if (subset == ADDR_SPACE_IOMEM && superset == ADDR_SPACE_FORCE_KERNEL)
82695 + return true;
82696 +
82697 + return subset == superset;
82698 +}
82699 +
82700 +static rtx checker_addr_space_convert(rtx op, tree from_type, tree to_type)
82701 +{
82702 +// addr_space_t from_as = TYPE_ADDR_SPACE(TREE_TYPE(from_type));
82703 +// addr_space_t to_as = TYPE_ADDR_SPACE(TREE_TYPE(to_type));
82704 +
82705 + return op;
82706 +}
82707 +
82708 +static void register_checker_address_spaces(void *event_data, void *data)
82709 +{
82710 + c_register_addr_space("__kernel", ADDR_SPACE_KERNEL);
82711 + c_register_addr_space("__force_kernel", ADDR_SPACE_FORCE_KERNEL);
82712 + c_register_addr_space("__user", ADDR_SPACE_USER);
82713 + c_register_addr_space("__force_user", ADDR_SPACE_FORCE_USER);
82714 +// c_register_addr_space("__iomem", ADDR_SPACE_IOMEM);
82715 +// c_register_addr_space("__force_iomem", ADDR_SPACE_FORCE_IOMEM);
82716 +// c_register_addr_space("__percpu", ADDR_SPACE_PERCPU);
82717 +// c_register_addr_space("__force_percpu", ADDR_SPACE_FORCE_PERCPU);
82718 +// c_register_addr_space("__rcu", ADDR_SPACE_RCU);
82719 +// c_register_addr_space("__force_rcu", ADDR_SPACE_FORCE_RCU);
82720 +
82721 + targetm.addr_space.pointer_mode = checker_addr_space_pointer_mode;
82722 + targetm.addr_space.address_mode = checker_addr_space_address_mode;
82723 + targetm.addr_space.valid_pointer_mode = checker_addr_space_valid_pointer_mode;
82724 + targetm.addr_space.legitimate_address_p = checker_addr_space_legitimate_address_p;
82725 +// targetm.addr_space.legitimize_address = checker_addr_space_legitimize_address;
82726 + targetm.addr_space.subset_p = checker_addr_space_subset_p;
82727 + targetm.addr_space.convert = checker_addr_space_convert;
82728 +}
82729 +
82730 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
82731 +{
82732 + const char * const plugin_name = plugin_info->base_name;
82733 + const int argc = plugin_info->argc;
82734 + const struct plugin_argument * const argv = plugin_info->argv;
82735 + int i;
82736 +
82737 + if (!plugin_default_version_check(version, &gcc_version)) {
82738 + error(G_("incompatible gcc/plugin versions"));
82739 + return 1;
82740 + }
82741 +
82742 + register_callback(plugin_name, PLUGIN_INFO, NULL, &checker_plugin_info);
82743 +
82744 + for (i = 0; i < argc; ++i)
82745 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
82746 +
82747 + if (TARGET_64BIT == 0)
82748 + return 0;
82749 +
82750 + register_callback (plugin_name, PLUGIN_PRAGMAS, register_checker_address_spaces, NULL);
82751 +
82752 + return 0;
82753 +}
82754 diff -urNp linux-2.6.32.49/tools/gcc/constify_plugin.c linux-2.6.32.49/tools/gcc/constify_plugin.c
82755 --- linux-2.6.32.49/tools/gcc/constify_plugin.c 1969-12-31 19:00:00.000000000 -0500
82756 +++ linux-2.6.32.49/tools/gcc/constify_plugin.c 2011-11-18 18:01:52.000000000 -0500
82757 @@ -0,0 +1,303 @@
82758 +/*
82759 + * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
82760 + * Copyright 2011 by PaX Team <pageexec@freemail.hu>
82761 + * Licensed under the GPL v2, or (at your option) v3
82762 + *
82763 + * This gcc plugin constifies all structures which contain only function pointers or are explicitly marked for constification.
82764 + *
82765 + * Homepage:
82766 + * http://www.grsecurity.net/~ephox/const_plugin/
82767 + *
82768 + * Usage:
82769 + * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o constify_plugin.so constify_plugin.c
82770 + * $ gcc -fplugin=constify_plugin.so test.c -O2
82771 + */
82772 +
82773 +#include "gcc-plugin.h"
82774 +#include "config.h"
82775 +#include "system.h"
82776 +#include "coretypes.h"
82777 +#include "tree.h"
82778 +#include "tree-pass.h"
82779 +#include "flags.h"
82780 +#include "intl.h"
82781 +#include "toplev.h"
82782 +#include "plugin.h"
82783 +#include "diagnostic.h"
82784 +#include "plugin-version.h"
82785 +#include "tm.h"
82786 +#include "function.h"
82787 +#include "basic-block.h"
82788 +#include "gimple.h"
82789 +#include "rtl.h"
82790 +#include "emit-rtl.h"
82791 +#include "tree-flow.h"
82792 +
82793 +#define C_TYPE_FIELDS_READONLY(TYPE) TREE_LANG_FLAG_1(TYPE)
82794 +
82795 +int plugin_is_GPL_compatible;
82796 +
82797 +static struct plugin_info const_plugin_info = {
82798 + .version = "201111150100",
82799 + .help = "no-constify\tturn off constification\n",
82800 +};
82801 +
82802 +static void constify_type(tree type);
82803 +static bool walk_struct(tree node);
82804 +
82805 +static tree deconstify_type(tree old_type)
82806 +{
82807 + tree new_type, field;
82808 +
82809 + new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
82810 + TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
82811 + for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
82812 + DECL_FIELD_CONTEXT(field) = new_type;
82813 + TYPE_READONLY(new_type) = 0;
82814 + C_TYPE_FIELDS_READONLY(new_type) = 0;
82815 + return new_type;
82816 +}
82817 +
82818 +static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
82819 +{
82820 + tree type;
82821 +
82822 + *no_add_attrs = true;
82823 + if (TREE_CODE(*node) == FUNCTION_DECL) {
82824 + error("%qE attribute does not apply to functions", name);
82825 + return NULL_TREE;
82826 + }
82827 +
82828 + if (TREE_CODE(*node) == VAR_DECL) {
82829 + error("%qE attribute does not apply to variables", name);
82830 + return NULL_TREE;
82831 + }
82832 +
82833 + if (TYPE_P(*node)) {
82834 + if (TREE_CODE(*node) == RECORD_TYPE || TREE_CODE(*node) == UNION_TYPE)
82835 + *no_add_attrs = false;
82836 + else
82837 + error("%qE attribute applies to struct and union types only", name);
82838 + return NULL_TREE;
82839 + }
82840 +
82841 + type = TREE_TYPE(*node);
82842 +
82843 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE) {
82844 + error("%qE attribute applies to struct and union types only", name);
82845 + return NULL_TREE;
82846 + }
82847 +
82848 + if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(type))) {
82849 + error("%qE attribute is already applied to the type", name);
82850 + return NULL_TREE;
82851 + }
82852 +
82853 + if (TREE_CODE(*node) == TYPE_DECL && !TYPE_READONLY(type)) {
82854 + error("%qE attribute used on type that is not constified", name);
82855 + return NULL_TREE;
82856 + }
82857 +
82858 + if (TREE_CODE(*node) == TYPE_DECL) {
82859 + TREE_TYPE(*node) = deconstify_type(type);
82860 + TREE_READONLY(*node) = 0;
82861 + return NULL_TREE;
82862 + }
82863 +
82864 + return NULL_TREE;
82865 +}
82866 +
82867 +static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
82868 +{
82869 + *no_add_attrs = true;
82870 + if (!TYPE_P(*node)) {
82871 + error("%qE attribute applies to types only", name);
82872 + return NULL_TREE;
82873 + }
82874 +
82875 + if (TREE_CODE(*node) != RECORD_TYPE && TREE_CODE(*node) != UNION_TYPE) {
82876 + error("%qE attribute applies to struct and union types only", name);
82877 + return NULL_TREE;
82878 + }
82879 +
82880 + *no_add_attrs = false;
82881 + constify_type(*node);
82882 + return NULL_TREE;
82883 +}
82884 +
82885 +static struct attribute_spec no_const_attr = {
82886 + .name = "no_const",
82887 + .min_length = 0,
82888 + .max_length = 0,
82889 + .decl_required = false,
82890 + .type_required = false,
82891 + .function_type_required = false,
82892 + .handler = handle_no_const_attribute,
82893 +#if __GNUC__ > 4 || __GNUC_MINOR__ >= 7
82894 + .affects_type_identity = true
82895 +#endif
82896 +};
82897 +
82898 +static struct attribute_spec do_const_attr = {
82899 + .name = "do_const",
82900 + .min_length = 0,
82901 + .max_length = 0,
82902 + .decl_required = false,
82903 + .type_required = false,
82904 + .function_type_required = false,
82905 + .handler = handle_do_const_attribute,
82906 +#if __GNUC__ > 4 || __GNUC_MINOR__ >= 7
82907 + .affects_type_identity = true
82908 +#endif
82909 +};
82910 +
82911 +static void register_attributes(void *event_data, void *data)
82912 +{
82913 + register_attribute(&no_const_attr);
82914 + register_attribute(&do_const_attr);
82915 +}
82916 +
82917 +static void constify_type(tree type)
82918 +{
82919 + TYPE_READONLY(type) = 1;
82920 + C_TYPE_FIELDS_READONLY(type) = 1;
82921 +}
82922 +
82923 +static bool is_fptr(tree field)
82924 +{
82925 + tree ptr = TREE_TYPE(field);
82926 +
82927 + if (TREE_CODE(ptr) != POINTER_TYPE)
82928 + return false;
82929 +
82930 + return TREE_CODE(TREE_TYPE(ptr)) == FUNCTION_TYPE;
82931 +}
82932 +
82933 +static bool walk_struct(tree node)
82934 +{
82935 + tree field;
82936 +
82937 + if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node)))
82938 + return false;
82939 +
82940 + if (TYPE_FIELDS(node) == NULL_TREE)
82941 + return false;
82942 +
82943 + for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
82944 + tree type = TREE_TYPE(field);
82945 + enum tree_code code = TREE_CODE(type);
82946 + if (code == RECORD_TYPE || code == UNION_TYPE) {
82947 + if (!(walk_struct(type)))
82948 + return false;
82949 + } else if (!is_fptr(field) && !TREE_READONLY(field))
82950 + return false;
82951 + }
82952 + return true;
82953 +}
82954 +
82955 +static void finish_type(void *event_data, void *data)
82956 +{
82957 + tree type = (tree)event_data;
82958 +
82959 + if (type == NULL_TREE)
82960 + return;
82961 +
82962 + if (TYPE_READONLY(type))
82963 + return;
82964 +
82965 + if (walk_struct(type))
82966 + constify_type(type);
82967 +}
82968 +
82969 +static unsigned int check_local_variables(void);
82970 +
82971 +struct gimple_opt_pass pass_local_variable = {
82972 + {
82973 + .type = GIMPLE_PASS,
82974 + .name = "check_local_variables",
82975 + .gate = NULL,
82976 + .execute = check_local_variables,
82977 + .sub = NULL,
82978 + .next = NULL,
82979 + .static_pass_number = 0,
82980 + .tv_id = TV_NONE,
82981 + .properties_required = 0,
82982 + .properties_provided = 0,
82983 + .properties_destroyed = 0,
82984 + .todo_flags_start = 0,
82985 + .todo_flags_finish = 0
82986 + }
82987 +};
82988 +
82989 +static unsigned int check_local_variables(void)
82990 +{
82991 + tree var;
82992 + referenced_var_iterator rvi;
82993 +
82994 +#if __GNUC__ == 4 && __GNUC_MINOR__ == 5
82995 + FOR_EACH_REFERENCED_VAR(var, rvi) {
82996 +#else
82997 + FOR_EACH_REFERENCED_VAR(cfun, var, rvi) {
82998 +#endif
82999 + tree type = TREE_TYPE(var);
83000 +
83001 + if (!DECL_P(var) || TREE_STATIC(var) || DECL_EXTERNAL(var))
83002 + continue;
83003 +
83004 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
83005 + continue;
83006 +
83007 + if (!TYPE_READONLY(type))
83008 + continue;
83009 +
83010 +// if (lookup_attribute("no_const", DECL_ATTRIBUTES(var)))
83011 +// continue;
83012 +
83013 +// if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type)))
83014 +// continue;
83015 +
83016 + if (walk_struct(type)) {
83017 + error("constified variable %qE cannot be local", var);
83018 + return 1;
83019 + }
83020 + }
83021 + return 0;
83022 +}
83023 +
83024 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
83025 +{
83026 + const char * const plugin_name = plugin_info->base_name;
83027 + const int argc = plugin_info->argc;
83028 + const struct plugin_argument * const argv = plugin_info->argv;
83029 + int i;
83030 + bool constify = true;
83031 +
83032 + struct register_pass_info local_variable_pass_info = {
83033 + .pass = &pass_local_variable.pass,
83034 + .reference_pass_name = "*referenced_vars",
83035 + .ref_pass_instance_number = 0,
83036 + .pos_op = PASS_POS_INSERT_AFTER
83037 + };
83038 +
83039 + if (!plugin_default_version_check(version, &gcc_version)) {
83040 + error(G_("incompatible gcc/plugin versions"));
83041 + return 1;
83042 + }
83043 +
83044 + for (i = 0; i < argc; ++i) {
83045 + if (!(strcmp(argv[i].key, "no-constify"))) {
83046 + constify = false;
83047 + continue;
83048 + }
83049 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
83050 + }
83051 +
83052 + register_callback(plugin_name, PLUGIN_INFO, NULL, &const_plugin_info);
83053 + if (constify) {
83054 + register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
83055 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &local_variable_pass_info);
83056 + }
83057 + register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
83058 +
83059 + return 0;
83060 +}
83061 diff -urNp linux-2.6.32.49/tools/gcc/kallocstat_plugin.c linux-2.6.32.49/tools/gcc/kallocstat_plugin.c
83062 --- linux-2.6.32.49/tools/gcc/kallocstat_plugin.c 1969-12-31 19:00:00.000000000 -0500
83063 +++ linux-2.6.32.49/tools/gcc/kallocstat_plugin.c 2011-11-18 18:01:52.000000000 -0500
83064 @@ -0,0 +1,167 @@
83065 +/*
83066 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
83067 + * Licensed under the GPL v2
83068 + *
83069 + * Note: the choice of the license means that the compilation process is
83070 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
83071 + * but for the kernel it doesn't matter since it doesn't link against
83072 + * any of the gcc libraries
83073 + *
83074 + * gcc plugin to find the distribution of k*alloc sizes
83075 + *
83076 + * TODO:
83077 + *
83078 + * BUGS:
83079 + * - none known
83080 + */
83081 +#include "gcc-plugin.h"
83082 +#include "config.h"
83083 +#include "system.h"
83084 +#include "coretypes.h"
83085 +#include "tree.h"
83086 +#include "tree-pass.h"
83087 +#include "flags.h"
83088 +#include "intl.h"
83089 +#include "toplev.h"
83090 +#include "plugin.h"
83091 +//#include "expr.h" where are you...
83092 +#include "diagnostic.h"
83093 +#include "plugin-version.h"
83094 +#include "tm.h"
83095 +#include "function.h"
83096 +#include "basic-block.h"
83097 +#include "gimple.h"
83098 +#include "rtl.h"
83099 +#include "emit-rtl.h"
83100 +
83101 +extern void print_gimple_stmt(FILE *, gimple, int, int);
83102 +
83103 +int plugin_is_GPL_compatible;
83104 +
83105 +static const char * const kalloc_functions[] = {
83106 + "__kmalloc",
83107 + "kmalloc",
83108 + "kmalloc_large",
83109 + "kmalloc_node",
83110 + "kmalloc_order",
83111 + "kmalloc_order_trace",
83112 + "kmalloc_slab",
83113 + "kzalloc",
83114 + "kzalloc_node",
83115 +};
83116 +
83117 +static struct plugin_info kallocstat_plugin_info = {
83118 + .version = "201111150100",
83119 +};
83120 +
83121 +static unsigned int execute_kallocstat(void);
83122 +
83123 +static struct gimple_opt_pass kallocstat_pass = {
83124 + .pass = {
83125 + .type = GIMPLE_PASS,
83126 + .name = "kallocstat",
83127 + .gate = NULL,
83128 + .execute = execute_kallocstat,
83129 + .sub = NULL,
83130 + .next = NULL,
83131 + .static_pass_number = 0,
83132 + .tv_id = TV_NONE,
83133 + .properties_required = 0,
83134 + .properties_provided = 0,
83135 + .properties_destroyed = 0,
83136 + .todo_flags_start = 0,
83137 + .todo_flags_finish = 0
83138 + }
83139 +};
83140 +
83141 +static bool is_kalloc(const char *fnname)
83142 +{
83143 + size_t i;
83144 +
83145 + for (i = 0; i < ARRAY_SIZE(kalloc_functions); i++)
83146 + if (!strcmp(fnname, kalloc_functions[i]))
83147 + return true;
83148 + return false;
83149 +}
83150 +
83151 +static unsigned int execute_kallocstat(void)
83152 +{
83153 + basic_block bb;
83154 +
83155 + // 1. loop through BBs and GIMPLE statements
83156 + FOR_EACH_BB(bb) {
83157 + gimple_stmt_iterator gsi;
83158 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
83159 + // gimple match:
83160 + tree fndecl, size;
83161 + gimple call_stmt;
83162 + const char *fnname;
83163 +
83164 + // is it a call
83165 + call_stmt = gsi_stmt(gsi);
83166 + if (!is_gimple_call(call_stmt))
83167 + continue;
83168 + fndecl = gimple_call_fndecl(call_stmt);
83169 + if (fndecl == NULL_TREE)
83170 + continue;
83171 + if (TREE_CODE(fndecl) != FUNCTION_DECL)
83172 + continue;
83173 +
83174 + // is it a call to k*alloc
83175 + fnname = IDENTIFIER_POINTER(DECL_NAME(fndecl));
83176 + if (!is_kalloc(fnname))
83177 + continue;
83178 +
83179 + // is the size arg the result of a simple const assignment
83180 + size = gimple_call_arg(call_stmt, 0);
83181 + while (true) {
83182 + gimple def_stmt;
83183 + expanded_location xloc;
83184 + size_t size_val;
83185 +
83186 + if (TREE_CODE(size) != SSA_NAME)
83187 + break;
83188 + def_stmt = SSA_NAME_DEF_STMT(size);
83189 + if (!def_stmt || !is_gimple_assign(def_stmt))
83190 + break;
83191 + if (gimple_num_ops(def_stmt) != 2)
83192 + break;
83193 + size = gimple_assign_rhs1(def_stmt);
83194 + if (!TREE_CONSTANT(size))
83195 + continue;
83196 + xloc = expand_location(gimple_location(def_stmt));
83197 + if (!xloc.file)
83198 + xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
83199 + size_val = TREE_INT_CST_LOW(size);
83200 + fprintf(stderr, "kallocsize: %8zu %8zx %s %s:%u\n", size_val, size_val, fnname, xloc.file, xloc.line);
83201 + break;
83202 + }
83203 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
83204 +//debug_tree(gimple_call_fn(call_stmt));
83205 +//print_node(stderr, "pax", fndecl, 4);
83206 + }
83207 + }
83208 +
83209 + return 0;
83210 +}
83211 +
83212 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
83213 +{
83214 + const char * const plugin_name = plugin_info->base_name;
83215 + struct register_pass_info kallocstat_pass_info = {
83216 + .pass = &kallocstat_pass.pass,
83217 + .reference_pass_name = "ssa",
83218 + .ref_pass_instance_number = 0,
83219 + .pos_op = PASS_POS_INSERT_AFTER
83220 + };
83221 +
83222 + if (!plugin_default_version_check(version, &gcc_version)) {
83223 + error(G_("incompatible gcc/plugin versions"));
83224 + return 1;
83225 + }
83226 +
83227 + register_callback(plugin_name, PLUGIN_INFO, NULL, &kallocstat_plugin_info);
83228 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kallocstat_pass_info);
83229 +
83230 + return 0;
83231 +}
83232 diff -urNp linux-2.6.32.49/tools/gcc/kernexec_plugin.c linux-2.6.32.49/tools/gcc/kernexec_plugin.c
83233 --- linux-2.6.32.49/tools/gcc/kernexec_plugin.c 1969-12-31 19:00:00.000000000 -0500
83234 +++ linux-2.6.32.49/tools/gcc/kernexec_plugin.c 2011-11-18 18:01:52.000000000 -0500
83235 @@ -0,0 +1,275 @@
83236 +/*
83237 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
83238 + * Licensed under the GPL v2
83239 + *
83240 + * Note: the choice of the license means that the compilation process is
83241 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
83242 + * but for the kernel it doesn't matter since it doesn't link against
83243 + * any of the gcc libraries
83244 + *
83245 + * gcc plugin to make KERNEXEC/amd64 almost as good as it is on i386
83246 + *
83247 + * TODO:
83248 + *
83249 + * BUGS:
83250 + * - none known
83251 + */
83252 +#include "gcc-plugin.h"
83253 +#include "config.h"
83254 +#include "system.h"
83255 +#include "coretypes.h"
83256 +#include "tree.h"
83257 +#include "tree-pass.h"
83258 +#include "flags.h"
83259 +#include "intl.h"
83260 +#include "toplev.h"
83261 +#include "plugin.h"
83262 +//#include "expr.h" where are you...
83263 +#include "diagnostic.h"
83264 +#include "plugin-version.h"
83265 +#include "tm.h"
83266 +#include "function.h"
83267 +#include "basic-block.h"
83268 +#include "gimple.h"
83269 +#include "rtl.h"
83270 +#include "emit-rtl.h"
83271 +#include "tree-flow.h"
83272 +
83273 +extern void print_gimple_stmt(FILE *, gimple, int, int);
83274 +extern rtx emit_move_insn(rtx x, rtx y);
83275 +
83276 +int plugin_is_GPL_compatible;
83277 +
83278 +static struct plugin_info kernexec_plugin_info = {
83279 + .version = "201111150100",
83280 +};
83281 +
83282 +static unsigned int execute_kernexec_fptr(void);
83283 +static unsigned int execute_kernexec_retaddr(void);
83284 +static bool kernexec_cmodel_check(void);
83285 +
83286 +static struct gimple_opt_pass kernexec_fptr_pass = {
83287 + .pass = {
83288 + .type = GIMPLE_PASS,
83289 + .name = "kernexec_fptr",
83290 + .gate = kernexec_cmodel_check,
83291 + .execute = execute_kernexec_fptr,
83292 + .sub = NULL,
83293 + .next = NULL,
83294 + .static_pass_number = 0,
83295 + .tv_id = TV_NONE,
83296 + .properties_required = 0,
83297 + .properties_provided = 0,
83298 + .properties_destroyed = 0,
83299 + .todo_flags_start = 0,
83300 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
83301 + }
83302 +};
83303 +
83304 +static struct rtl_opt_pass kernexec_retaddr_pass = {
83305 + .pass = {
83306 + .type = RTL_PASS,
83307 + .name = "kernexec_retaddr",
83308 + .gate = kernexec_cmodel_check,
83309 + .execute = execute_kernexec_retaddr,
83310 + .sub = NULL,
83311 + .next = NULL,
83312 + .static_pass_number = 0,
83313 + .tv_id = TV_NONE,
83314 + .properties_required = 0,
83315 + .properties_provided = 0,
83316 + .properties_destroyed = 0,
83317 + .todo_flags_start = 0,
83318 + .todo_flags_finish = TODO_dump_func | TODO_ggc_collect
83319 + }
83320 +};
83321 +
83322 +static bool kernexec_cmodel_check(void)
83323 +{
83324 + tree section;
83325 +
83326 + if (ix86_cmodel != CM_KERNEL)
83327 + return false;
83328 +
83329 + section = lookup_attribute("section", DECL_ATTRIBUTES(current_function_decl));
83330 + if (!section || !TREE_VALUE(section))
83331 + return true;
83332 +
83333 + section = TREE_VALUE(TREE_VALUE(section));
83334 + if (strncmp(TREE_STRING_POINTER(section), ".vsyscall_", 10))
83335 + return true;
83336 +
83337 + return false;
83338 +}
83339 +
83340 +/*
83341 + * add special KERNEXEC instrumentation: force MSB of fptr to 1, which will produce
83342 + * a non-canonical address from a userland ptr and will just trigger a GPF on dereference
83343 + */
83344 +static void kernexec_instrument_fptr(gimple_stmt_iterator gsi)
83345 +{
83346 + gimple assign_intptr, assign_new_fptr, call_stmt;
83347 + tree intptr, old_fptr, new_fptr, kernexec_mask;
83348 +
83349 + call_stmt = gsi_stmt(gsi);
83350 + old_fptr = gimple_call_fn(call_stmt);
83351 +
83352 + // create temporary unsigned long variable used for bitops and cast fptr to it
83353 + intptr = create_tmp_var(long_unsigned_type_node, NULL);
83354 + add_referenced_var(intptr);
83355 + mark_sym_for_renaming(intptr);
83356 + assign_intptr = gimple_build_assign(intptr, fold_convert(long_unsigned_type_node, old_fptr));
83357 + update_stmt(assign_intptr);
83358 + gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT);
83359 +
83360 + // apply logical or to temporary unsigned long and bitmask
83361 + kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0x8000000000000000LL);
83362 +// kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0xffffffff80000000LL);
83363 + assign_intptr = gimple_build_assign(intptr, fold_build2(BIT_IOR_EXPR, long_long_unsigned_type_node, intptr, kernexec_mask));
83364 + update_stmt(assign_intptr);
83365 + gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT);
83366 +
83367 + // cast temporary unsigned long back to a temporary fptr variable
83368 + new_fptr = create_tmp_var(TREE_TYPE(old_fptr), NULL);
83369 + add_referenced_var(new_fptr);
83370 + mark_sym_for_renaming(new_fptr);
83371 + assign_new_fptr = gimple_build_assign(new_fptr, fold_convert(TREE_TYPE(old_fptr), intptr));
83372 + update_stmt(assign_new_fptr);
83373 + gsi_insert_before(&gsi, assign_new_fptr, GSI_SAME_STMT);
83374 +
83375 + // replace call stmt fn with the new fptr
83376 + gimple_call_set_fn(call_stmt, new_fptr);
83377 + update_stmt(call_stmt);
83378 +}
83379 +
83380 +/*
83381 + * find all C level function pointer dereferences and forcibly set the highest bit of the pointer
83382 + */
83383 +static unsigned int execute_kernexec_fptr(void)
83384 +{
83385 + basic_block bb;
83386 + gimple_stmt_iterator gsi;
83387 +
83388 + // 1. loop through BBs and GIMPLE statements
83389 + FOR_EACH_BB(bb) {
83390 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
83391 + // gimple match: h_1 = get_fptr (); D.2709_3 = h_1 (x_2(D));
83392 + tree fn;
83393 + gimple call_stmt;
83394 +
83395 + // is it a call ...
83396 + call_stmt = gsi_stmt(gsi);
83397 + if (!is_gimple_call(call_stmt))
83398 + continue;
83399 + fn = gimple_call_fn(call_stmt);
83400 + if (TREE_CODE(fn) == ADDR_EXPR)
83401 + continue;
83402 + if (TREE_CODE(fn) != SSA_NAME)
83403 + gcc_unreachable();
83404 +
83405 + // ... through a function pointer
83406 + fn = SSA_NAME_VAR(fn);
83407 + if (TREE_CODE(fn) != VAR_DECL && TREE_CODE(fn) != PARM_DECL)
83408 + continue;
83409 + fn = TREE_TYPE(fn);
83410 + if (TREE_CODE(fn) != POINTER_TYPE)
83411 + continue;
83412 + fn = TREE_TYPE(fn);
83413 + if (TREE_CODE(fn) != FUNCTION_TYPE)
83414 + continue;
83415 +
83416 + kernexec_instrument_fptr(gsi);
83417 +
83418 +//debug_tree(gimple_call_fn(call_stmt));
83419 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
83420 + }
83421 + }
83422 +
83423 + return 0;
83424 +}
83425 +
83426 +// add special KERNEXEC instrumentation: btsq $63,(%rsp) just before retn
83427 +static void kernexec_instrument_retaddr(rtx insn)
83428 +{
83429 + rtx btsq;
83430 + rtvec argvec, constraintvec, labelvec;
83431 + int line;
83432 +
83433 + // create asm volatile("btsq $63,(%%rsp)":::)
83434 + argvec = rtvec_alloc(0);
83435 + constraintvec = rtvec_alloc(0);
83436 + labelvec = rtvec_alloc(0);
83437 + line = expand_location(RTL_LOCATION(insn)).line;
83438 + btsq = gen_rtx_ASM_OPERANDS(VOIDmode, "btsq $63,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
83439 + MEM_VOLATILE_P(btsq) = 1;
83440 +// RTX_FRAME_RELATED_P(btsq) = 1; // not for ASM_OPERANDS
83441 + emit_insn_before(btsq, insn);
83442 +}
83443 +
83444 +/*
83445 + * find all asm level function returns and forcibly set the highest bit of the return address
83446 + */
83447 +static unsigned int execute_kernexec_retaddr(void)
83448 +{
83449 + rtx insn;
83450 +
83451 + // 1. find function returns
83452 + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
83453 + // rtl match: (jump_insn 41 40 42 2 (return) fptr.c:42 634 {return_internal} (nil))
83454 + // (jump_insn 12 9 11 2 (parallel [ (return) (unspec [ (0) ] UNSPEC_REP) ]) fptr.c:46 635 {return_internal_long} (nil))
83455 + rtx body;
83456 +
83457 + // is it a retn
83458 + if (!JUMP_P(insn))
83459 + continue;
83460 + body = PATTERN(insn);
83461 + if (GET_CODE(body) == PARALLEL)
83462 + body = XVECEXP(body, 0, 0);
83463 + if (GET_CODE(body) != RETURN)
83464 + continue;
83465 + kernexec_instrument_retaddr(insn);
83466 + }
83467 +
83468 +// print_simple_rtl(stderr, get_insns());
83469 +// print_rtl(stderr, get_insns());
83470 +
83471 + return 0;
83472 +}
83473 +
83474 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
83475 +{
83476 + const char * const plugin_name = plugin_info->base_name;
83477 + const int argc = plugin_info->argc;
83478 + const struct plugin_argument * const argv = plugin_info->argv;
83479 + int i;
83480 + struct register_pass_info kernexec_fptr_pass_info = {
83481 + .pass = &kernexec_fptr_pass.pass,
83482 + .reference_pass_name = "ssa",
83483 + .ref_pass_instance_number = 0,
83484 + .pos_op = PASS_POS_INSERT_AFTER
83485 + };
83486 + struct register_pass_info kernexec_retaddr_pass_info = {
83487 + .pass = &kernexec_retaddr_pass.pass,
83488 + .reference_pass_name = "pro_and_epilogue",
83489 + .ref_pass_instance_number = 0,
83490 + .pos_op = PASS_POS_INSERT_AFTER
83491 + };
83492 +
83493 + if (!plugin_default_version_check(version, &gcc_version)) {
83494 + error(G_("incompatible gcc/plugin versions"));
83495 + return 1;
83496 + }
83497 +
83498 + register_callback(plugin_name, PLUGIN_INFO, NULL, &kernexec_plugin_info);
83499 +
83500 + for (i = 0; i < argc; ++i)
83501 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
83502 +
83503 + if (TARGET_64BIT == 0)
83504 + return 0;
83505 +
83506 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_fptr_pass_info);
83507 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_retaddr_pass_info);
83508 +
83509 + return 0;
83510 +}
83511 diff -urNp linux-2.6.32.49/tools/gcc/Makefile linux-2.6.32.49/tools/gcc/Makefile
83512 --- linux-2.6.32.49/tools/gcc/Makefile 1969-12-31 19:00:00.000000000 -0500
83513 +++ linux-2.6.32.49/tools/gcc/Makefile 2011-11-18 18:08:04.000000000 -0500
83514 @@ -0,0 +1,21 @@
83515 +#CC := gcc
83516 +#PLUGIN_SOURCE_FILES := pax_plugin.c
83517 +#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
83518 +GCCPLUGINS_DIR := $(shell $(CC) -print-file-name=plugin)
83519 +#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W
83520 +
83521 +HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include
83522 +
83523 +hostlibs-y := constify_plugin.so
83524 +hostlibs-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so
83525 +hostlibs-$(CONFIG_KALLOCSTAT_PLUGIN) += kallocstat_plugin.so
83526 +hostlibs-$(CONFIG_PAX_KERNEXEC_PLUGIN) += kernexec_plugin.so
83527 +hostlibs-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so
83528 +
83529 +always := $(hostlibs-y)
83530 +
83531 +constify_plugin-objs := constify_plugin.o
83532 +stackleak_plugin-objs := stackleak_plugin.o
83533 +kallocstat_plugin-objs := kallocstat_plugin.o
83534 +kernexec_plugin-objs := kernexec_plugin.o
83535 +checker_plugin-objs := checker_plugin.o
83536 diff -urNp linux-2.6.32.49/tools/gcc/stackleak_plugin.c linux-2.6.32.49/tools/gcc/stackleak_plugin.c
83537 --- linux-2.6.32.49/tools/gcc/stackleak_plugin.c 1969-12-31 19:00:00.000000000 -0500
83538 +++ linux-2.6.32.49/tools/gcc/stackleak_plugin.c 2011-11-18 18:01:52.000000000 -0500
83539 @@ -0,0 +1,291 @@
83540 +/*
83541 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
83542 + * Licensed under the GPL v2
83543 + *
83544 + * Note: the choice of the license means that the compilation process is
83545 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
83546 + * but for the kernel it doesn't matter since it doesn't link against
83547 + * any of the gcc libraries
83548 + *
83549 + * gcc plugin to help implement various PaX features
83550 + *
83551 + * - track lowest stack pointer
83552 + *
83553 + * TODO:
83554 + * - initialize all local variables
83555 + *
83556 + * BUGS:
83557 + * - none known
83558 + */
83559 +#include "gcc-plugin.h"
83560 +#include "config.h"
83561 +#include "system.h"
83562 +#include "coretypes.h"
83563 +#include "tree.h"
83564 +#include "tree-pass.h"
83565 +#include "flags.h"
83566 +#include "intl.h"
83567 +#include "toplev.h"
83568 +#include "plugin.h"
83569 +//#include "expr.h" where are you...
83570 +#include "diagnostic.h"
83571 +#include "plugin-version.h"
83572 +#include "tm.h"
83573 +#include "function.h"
83574 +#include "basic-block.h"
83575 +#include "gimple.h"
83576 +#include "rtl.h"
83577 +#include "emit-rtl.h"
83578 +
83579 +extern void print_gimple_stmt(FILE *, gimple, int, int);
83580 +
83581 +int plugin_is_GPL_compatible;
83582 +
83583 +static int track_frame_size = -1;
83584 +static const char track_function[] = "pax_track_stack";
83585 +static const char check_function[] = "pax_check_alloca";
83586 +static bool init_locals;
83587 +
83588 +static struct plugin_info stackleak_plugin_info = {
83589 + .version = "201111150100",
83590 + .help = "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
83591 +// "initialize-locals\t\tforcibly initialize all stack frames\n"
83592 +};
83593 +
83594 +static bool gate_stackleak_track_stack(void);
83595 +static unsigned int execute_stackleak_tree_instrument(void);
83596 +static unsigned int execute_stackleak_final(void);
83597 +
83598 +static struct gimple_opt_pass stackleak_tree_instrument_pass = {
83599 + .pass = {
83600 + .type = GIMPLE_PASS,
83601 + .name = "stackleak_tree_instrument",
83602 + .gate = gate_stackleak_track_stack,
83603 + .execute = execute_stackleak_tree_instrument,
83604 + .sub = NULL,
83605 + .next = NULL,
83606 + .static_pass_number = 0,
83607 + .tv_id = TV_NONE,
83608 + .properties_required = PROP_gimple_leh | PROP_cfg,
83609 + .properties_provided = 0,
83610 + .properties_destroyed = 0,
83611 + .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
83612 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_update_ssa
83613 + }
83614 +};
83615 +
83616 +static struct rtl_opt_pass stackleak_final_rtl_opt_pass = {
83617 + .pass = {
83618 + .type = RTL_PASS,
83619 + .name = "stackleak_final",
83620 + .gate = gate_stackleak_track_stack,
83621 + .execute = execute_stackleak_final,
83622 + .sub = NULL,
83623 + .next = NULL,
83624 + .static_pass_number = 0,
83625 + .tv_id = TV_NONE,
83626 + .properties_required = 0,
83627 + .properties_provided = 0,
83628 + .properties_destroyed = 0,
83629 + .todo_flags_start = 0,
83630 + .todo_flags_finish = TODO_dump_func
83631 + }
83632 +};
83633 +
83634 +static bool gate_stackleak_track_stack(void)
83635 +{
83636 + return track_frame_size >= 0;
83637 +}
83638 +
83639 +static void stackleak_check_alloca(gimple_stmt_iterator gsi)
83640 +{
83641 + gimple check_alloca;
83642 + tree fndecl, fntype, alloca_size;
83643 +
83644 + // insert call to void pax_check_alloca(unsigned long size)
83645 + fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
83646 + fndecl = build_fn_decl(check_function, fntype);
83647 + DECL_ASSEMBLER_NAME(fndecl); // for LTO
83648 + alloca_size = gimple_call_arg(gsi_stmt(gsi), 0);
83649 + check_alloca = gimple_build_call(fndecl, 1, alloca_size);
83650 + gsi_insert_before(&gsi, check_alloca, GSI_CONTINUE_LINKING);
83651 +}
83652 +
83653 +static void stackleak_add_instrumentation(gimple_stmt_iterator gsi)
83654 +{
83655 + gimple track_stack;
83656 + tree fndecl, fntype;
83657 +
83658 + // insert call to void pax_track_stack(void)
83659 + fntype = build_function_type_list(void_type_node, NULL_TREE);
83660 + fndecl = build_fn_decl(track_function, fntype);
83661 + DECL_ASSEMBLER_NAME(fndecl); // for LTO
83662 + track_stack = gimple_build_call(fndecl, 0);
83663 + gsi_insert_after(&gsi, track_stack, GSI_CONTINUE_LINKING);
83664 +}
83665 +
83666 +#if __GNUC__ == 4 && __GNUC_MINOR__ == 5
83667 +static bool gimple_call_builtin_p(gimple stmt, enum built_in_function code)
83668 +{
83669 + tree fndecl;
83670 +
83671 + if (!is_gimple_call(stmt))
83672 + return false;
83673 + fndecl = gimple_call_fndecl(stmt);
83674 + if (!fndecl)
83675 + return false;
83676 + if (DECL_BUILT_IN_CLASS(fndecl) != BUILT_IN_NORMAL)
83677 + return false;
83678 +// print_node(stderr, "pax", fndecl, 4);
83679 + return DECL_FUNCTION_CODE(fndecl) == code;
83680 +}
83681 +#endif
83682 +
83683 +static bool is_alloca(gimple stmt)
83684 +{
83685 + if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
83686 + return true;
83687 +
83688 +#if __GNUC__ > 4 || __GNUC_MINOR__ >= 7
83689 + if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
83690 + return true;
83691 +#endif
83692 +
83693 + return false;
83694 +}
83695 +
83696 +static unsigned int execute_stackleak_tree_instrument(void)
83697 +{
83698 + basic_block bb, entry_bb;
83699 + bool prologue_instrumented = false;
83700 +
83701 + entry_bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb;
83702 +
83703 + // 1. loop through BBs and GIMPLE statements
83704 + FOR_EACH_BB(bb) {
83705 + gimple_stmt_iterator gsi;
83706 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
83707 + // gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
83708 + if (!is_alloca(gsi_stmt(gsi)))
83709 + continue;
83710 +
83711 + // 2. insert stack overflow check before each __builtin_alloca call
83712 + stackleak_check_alloca(gsi);
83713 +
83714 + // 3. insert track call after each __builtin_alloca call
83715 + stackleak_add_instrumentation(gsi);
83716 + if (bb == entry_bb)
83717 + prologue_instrumented = true;
83718 + }
83719 + }
83720 +
83721 + // 4. insert track call at the beginning
83722 + if (!prologue_instrumented) {
83723 + bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
83724 + if (dom_info_available_p(CDI_DOMINATORS))
83725 + set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR);
83726 + stackleak_add_instrumentation(gsi_start_bb(bb));
83727 + }
83728 +
83729 + return 0;
83730 +}
83731 +
83732 +static unsigned int execute_stackleak_final(void)
83733 +{
83734 + rtx insn;
83735 +
83736 + if (cfun->calls_alloca)
83737 + return 0;
83738 +
83739 + // keep calls only if function frame is big enough
83740 + if (get_frame_size() >= track_frame_size)
83741 + return 0;
83742 +
83743 + // 1. find pax_track_stack calls
83744 + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
83745 + // rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
83746 + rtx body;
83747 +
83748 + if (!CALL_P(insn))
83749 + continue;
83750 + body = PATTERN(insn);
83751 + if (GET_CODE(body) != CALL)
83752 + continue;
83753 + body = XEXP(body, 0);
83754 + if (GET_CODE(body) != MEM)
83755 + continue;
83756 + body = XEXP(body, 0);
83757 + if (GET_CODE(body) != SYMBOL_REF)
83758 + continue;
83759 + if (strcmp(XSTR(body, 0), track_function))
83760 + continue;
83761 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
83762 + // 2. delete call
83763 + insn = delete_insn_and_edges(insn);
83764 +#if __GNUC__ > 4 || __GNUC_MINOR__ >= 7
83765 + if (GET_CODE(insn) == NOTE && NOTE_KIND(insn) == NOTE_INSN_CALL_ARG_LOCATION)
83766 + insn = delete_insn_and_edges(insn);
83767 +#endif
83768 + }
83769 +
83770 +// print_simple_rtl(stderr, get_insns());
83771 +// print_rtl(stderr, get_insns());
83772 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
83773 +
83774 + return 0;
83775 +}
83776 +
83777 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
83778 +{
83779 + const char * const plugin_name = plugin_info->base_name;
83780 + const int argc = plugin_info->argc;
83781 + const struct plugin_argument * const argv = plugin_info->argv;
83782 + int i;
83783 + struct register_pass_info stackleak_tree_instrument_pass_info = {
83784 + .pass = &stackleak_tree_instrument_pass.pass,
83785 +// .reference_pass_name = "tree_profile",
83786 + .reference_pass_name = "optimized",
83787 + .ref_pass_instance_number = 0,
83788 + .pos_op = PASS_POS_INSERT_AFTER
83789 + };
83790 + struct register_pass_info stackleak_final_pass_info = {
83791 + .pass = &stackleak_final_rtl_opt_pass.pass,
83792 + .reference_pass_name = "final",
83793 + .ref_pass_instance_number = 0,
83794 + .pos_op = PASS_POS_INSERT_BEFORE
83795 + };
83796 +
83797 + if (!plugin_default_version_check(version, &gcc_version)) {
83798 + error(G_("incompatible gcc/plugin versions"));
83799 + return 1;
83800 + }
83801 +
83802 + register_callback(plugin_name, PLUGIN_INFO, NULL, &stackleak_plugin_info);
83803 +
83804 + for (i = 0; i < argc; ++i) {
83805 + if (!strcmp(argv[i].key, "track-lowest-sp")) {
83806 + if (!argv[i].value) {
83807 + error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
83808 + continue;
83809 + }
83810 + track_frame_size = atoi(argv[i].value);
83811 + if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
83812 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
83813 + continue;
83814 + }
83815 + if (!strcmp(argv[i].key, "initialize-locals")) {
83816 + if (argv[i].value) {
83817 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
83818 + continue;
83819 + }
83820 + init_locals = true;
83821 + continue;
83822 + }
83823 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
83824 + }
83825 +
83826 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
83827 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
83828 +
83829 + return 0;
83830 +}
83831 diff -urNp linux-2.6.32.49/usr/gen_init_cpio.c linux-2.6.32.49/usr/gen_init_cpio.c
83832 --- linux-2.6.32.49/usr/gen_init_cpio.c 2011-11-08 19:02:43.000000000 -0500
83833 +++ linux-2.6.32.49/usr/gen_init_cpio.c 2011-11-15 19:59:43.000000000 -0500
83834 @@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name,
83835 int retval;
83836 int rc = -1;
83837 int namesize;
83838 - int i;
83839 + unsigned int i;
83840
83841 mode |= S_IFREG;
83842
83843 @@ -383,9 +383,10 @@ static char *cpio_replace_env(char *new_
83844 *env_var = *expanded = '\0';
83845 strncat(env_var, start + 2, end - start - 2);
83846 strncat(expanded, new_location, start - new_location);
83847 - strncat(expanded, getenv(env_var), PATH_MAX);
83848 - strncat(expanded, end + 1, PATH_MAX);
83849 + strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
83850 + strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
83851 strncpy(new_location, expanded, PATH_MAX);
83852 + new_location[PATH_MAX] = 0;
83853 } else
83854 break;
83855 }
83856 diff -urNp linux-2.6.32.49/virt/kvm/kvm_main.c linux-2.6.32.49/virt/kvm/kvm_main.c
83857 --- linux-2.6.32.49/virt/kvm/kvm_main.c 2011-11-08 19:02:43.000000000 -0500
83858 +++ linux-2.6.32.49/virt/kvm/kvm_main.c 2011-11-15 19:59:43.000000000 -0500
83859 @@ -2494,7 +2494,7 @@ asmlinkage void kvm_handle_fault_on_rebo
83860 if (kvm_rebooting)
83861 /* spin while reset goes on */
83862 while (true)
83863 - ;
83864 + cpu_relax();
83865 /* Fault while not rebooting. We want the trace. */
83866 BUG();
83867 }
83868 @@ -2714,7 +2714,7 @@ static void kvm_sched_out(struct preempt
83869 kvm_arch_vcpu_put(vcpu);
83870 }
83871
83872 -int kvm_init(void *opaque, unsigned int vcpu_size,
83873 +int kvm_init(const void *opaque, unsigned int vcpu_size,
83874 struct module *module)
83875 {
83876 int r;
83877 @@ -2767,15 +2767,17 @@ int kvm_init(void *opaque, unsigned int
83878 /* A kmem cache lets us meet the alignment requirements of fx_save. */
83879 kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size,
83880 __alignof__(struct kvm_vcpu),
83881 - 0, NULL);
83882 + SLAB_USERCOPY, NULL);
83883 if (!kvm_vcpu_cache) {
83884 r = -ENOMEM;
83885 goto out_free_5;
83886 }
83887
83888 - kvm_chardev_ops.owner = module;
83889 - kvm_vm_fops.owner = module;
83890 - kvm_vcpu_fops.owner = module;
83891 + pax_open_kernel();
83892 + *(void **)&kvm_chardev_ops.owner = module;
83893 + *(void **)&kvm_vm_fops.owner = module;
83894 + *(void **)&kvm_vcpu_fops.owner = module;
83895 + pax_close_kernel();
83896
83897 r = misc_register(&kvm_dev);
83898 if (r) {
Unofficial grsecurity patch archive (https://github.com/slashbeast/grsecurity-scrape)